From 86c560839bc95f8d3f7e1f16c1b9d415e468b87b Mon Sep 17 00:00:00 2001
From: Sasha Levin <sashal@kernel.org>
Date: Sat, 21 Dec 2019 21:37:21 -0500
Subject: [PATCH] fixes for 5.4

Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 ...dd-dmi-quirk-for-medion-akoya-e2215t.patch |  55 +++
 ...d-sleep-just-after-breaking-connecti.patch |  64 ++++
 ...dmi-implement-mst_no_extra_pcms-flag.patch |  92 +++++
 ...sing-check-of-the-new-non-cached-buf.patch |  47 +++
 ...-limit-max-amount-of-slave-instances.patch |  70 ++++
 ...e-the-waiting-time-for-cpu_psci_cpu_.patch |  73 ++++
 ..._rt5640-update-quirk-for-acer-switch.patch |  51 +++
 ...t5663_rt5514_max98927-add-dmic-forma.patch |  40 +++
 ...ark-reg-rt5677_pwr_anlg2-as-volatile.patch |  43 +++
 ...-pcm-check-symmetry-before-hw_params.patch |  62 ++++
 ...fixup-dpcm_prune_paths-loop-continue.patch |  77 +++++
 ...oc-sof-enable-sync_write-in-hdac_bus.patch |  44 +++
 ...-reverse-config_snd_soc_sof_of-depen.patch |  58 ++++
 ...gy-set-trigger-order-for-fe-dai-link.patch |  40 +++
 ...missed-operations-in-remove-and-prob.patch |  53 +++
 ...wm5100-add-missed-pm_runtime_disable.patch |  45 +++
 .../asoc-wm8904-fix-regcache-handling.patch   |  41 +++
 ...h10k-add-cleanup-in-ath10k_sta_state.patch |  41 +++
 ...station-exists-before-forwarding-tx-.patch |  93 +++++
 ...ect-error-handling-of-dma_map_single.patch |  44 +++
 .../ath10k-fix-backtrace-on-coredump.patch    |  74 ++++
 ...-get-invalid-tx-rate-for-mesh-metric.patch |  42 +++
 ...annel-tx-failure-when-no-ath10k_mac_.patch | 120 +++++++
 ...che-fix-deadlock-in-bcache_allocator.patch | 156 +++++++++
 ...c-checker-warning-in-bcache_device_f.patch |  99 ++++++
 ...ack-throttling-w-1-compiler-warnings.patch | 128 +++++++
 ...-btusb-avoid-unused-function-warning.patch |  52 +++
 ...oth-fix-advertising-duplicated-flags.patch |  60 ++++
 ...i_core-fix-init-for-hci_user_channel.patch |  52 +++
 ...-cpu_to_le16-conversion-in-hci_init4.patch |  48 +++
 ...ound-directed-advertising-bug-in-bro.patch |  63 ++++
 ...-communication-over-multi-cos-queues.patch |  54 +++
 ..._en-improve-rx-buffer-error-handling.patch |  79 +++++
 ...roper-error-code-for-non-existent-nv.patch |  46 +++
 ...er-register-bounds-after-jmp32-instr.patch | 134 +++++++
 ...-deadlock-with-rq_lock-in-bpf_get_st.patch | 151 ++++++++
 ...around-a-verifier-failure-for-test_p.patch | 118 +++++++
 ...ove-monitor-interface-when-detaching.patch |  42 +++
 ...aturely-free-work-in-end_workqueue_f.patch |  54 +++
 ...aturely-free-work-in-reada_start_mac.patch |  66 ++++
 ...aturely-free-work-in-run_ordered_wor.patch | 154 +++++++++
 ...aturely-free-work-in-scrub_missing_r.patch |  47 +++
 ...on-t-change-task-and-cgroups-status-.patch |  50 +++
 ...-drivers-only-after-cpu-devices-have.patch |  69 ++++
 ...q-sun50i-fix-cpu-speed-bin-detection.patch |  89 +++++
 ...neon-use-clang-compatible-cflags-for.patch |  49 +++
 ...simd-build-32-bit-arm-for-v8-archite.patch |  50 +++
 ...-authenc-support-when-it-is-set-to-m.patch | 138 ++++++++
 ...cure-fix-a-maybe-uninitialized-warni.patch |  44 +++
 ...fix-64-bit-size_t-warnings-on-sun4i-.patch |  61 ++++
 ...-sun4i-ss-fix-64-bit-size_t-warnings.patch | 102 ++++++
 ...io-deal-with-unsupported-input-sizes.patch |  67 ++++
 ...rypto-vmx-avoid-weird-build-failures.patch |  67 ++++
 ...add-new-active-dongle-to-existent-w-.patch |  54 +++
 ...correctly-populate-dpp-refclk-in-fpg.patch |  63 ++++
 ...enable-hostvm-based-on-roimmu-active.patch |  92 +++++
 ...fix-dongle_caps-containing-stale-inf.patch |  65 ++++
 ...md-display-fix-header-for-rn-clk-mgr.patch |  49 +++
 ...fix-struct-init-in-update_bounding_b.patch |  47 +++
 ...handle-virtual-signal-type-in-disabl.patch |  49 +++
 .../drm-amd-display-otc-underflow-fix.patch   |  42 +++
 ...program-dwb-watermarks-from-correct-.patch |  93 +++++
 ...properly-round-nominal-frequency-for.patch |  63 ++++
 ...rebuild-mapped-resources-after-pipe-.patch |  42 +++
 ...play-set-minimum-abm-backlight-level.patch | 195 +++++++++++
 ...set-number-of-pipes-to-1-if-the-seco.patch |  47 +++
 ...setting-the-dig_mode-to-the-correct-.patch |  48 +++
 ...-verify-stream-link-before-link-test.patch |  42 +++
 ...wait-for-set-pipe-mcp-command-comple.patch |  45 +++
 ...lay-a-workaround-to-gpu-reset-on-apu.patch |  44 +++
 ...y-avoid-disabling-ecc-if-ras-is-enab.patch |  62 ++++
 ...y-fix-struct-init-in-renoir_print_cl.patch |  45 +++
 ...avoid-accidental-thread-reactivation.patch |  75 ++++
 ...low-direct-upload-save-restore-list-.patch |  45 +++
 ...mdgpu-trace-event-print-string-forma.patch | 119 +++++++
 ...gpu-fix-bad-dma-from-interrupt_cntl2.patch |  42 +++
 ...otential-double-drop-fence-reference.patch |  48 +++
 ...the-id-mgr-lock-while-accessing-pass.patch |  67 ++++
 ...-add-ring_stop-before-ring_create-in.patch | 113 ++++++
 ...-potential-null-pointer-dereference-.patch |  44 +++
 .../drm-amdkfd-fix-mqd-size-calculation.patch |  41 +++
 ...gix-anx78xx-silence-eprobe_defer-war.patch |  50 +++
 ...mi-refuse-ddc-ci-transfers-on-the-in.patch |  61 ++++
 ...mi-restore-audio-when-setting-a-mode.patch |  47 +++
 ...ree-jobs-in-wait_event_interruptible.patch | 121 +++++++
 ...k-change-einval-by-the-correct-errno.patch | 115 ++++++
 ...s_hdmi-use-cec_notifier_conn_-un-reg.patch | 129 +++++++
 ...emory-disclosures-due-to-uninitializ.patch |  44 +++
 ...round-for-broken-flip_complete-times.patch |  63 ++++
 ...-use-the-correct-g12a-frac-max-value.patch |  51 +++
 ...-mipi-dbi-fix-a-loop-in-debugfs-code.patch |  56 +++
 ...fix-debug-bus-register-configuration.patch |  69 ++++
 ...t-fix-query_payload-ack-reply-struct.patch |  47 +++
 ...-t-grab-runtime-pm-refs-for-hpd-irqs.patch |  96 ++++++
 ...ssing-drm_panel_init-in-panel-driver.patch |  49 +++
 .../drm-sun4i-dsi-fix-tcon-drq-set-bits.patch | 121 +++++++
 ...or-use-correct-sor-index-on-tegra210.patch |  40 +++
 ...busy-on-pipelining-with-no_gpu_wait-.patch | 109 ++++++
 .../drm-use-eopnotsupp-not-enotsupp.patch     | 123 +++++++
 ...-vc4-vc4_hdmi-fill-in-connector-info.patch |  61 ++++
 ...h-virtio_gpu_wait_ioctl-to-gem-helpe.patch |  74 ++++
 queue-5.4/edac-amd64-set-grain-per-dimm.patch |  57 +++
 .../edac-ghes-fix-grain-calculation.patch     |  95 +++++
 ...eset-registers-during-initialization.patch |  63 ++++
 ...-make-sure-string-is-null-terminated.patch |  46 +++
 ...fix-labels-with-comma-for-builtin-fi.patch |  56 +++
 ...ll-accesses-and-unaligned-offsets-vi.patch | 110 ++++++
 ...st1x-allocate-gather-copy-for-host1x.patch |  75 ++++
 ...call-clk_disable_unprepare-on-exit-o.patch |  50 +++
 ...e-itrn-registers-with-correct-values.patch |  82 +++++
 ...tised-fec-modes-after-set-fec-to-aut.patch | 121 +++++++
 ...d-protection_sg-size-by-data_sg-size.patch |  40 +++
 ...-completion-structure-initialization.patch | 109 ++++++
 ...ll-pointer-dereference-when-setting-.patch |  58 ++++
 queue-5.4/ice-delay-less.patch                |  60 ++++
 ...coalesce-to-handle-dcb-configuration.patch |  51 +++
 ...-vf-state-when-freeing-each-vf-resou.patch |  59 ++++
 ...x1027-reset-the-device-at-probe-time.patch |  42 +++
 ...-set-info_mask_shared_by_all_availab.patch |  44 +++
 ...d5446-add-support-for-new-ad5600-dac.patch |  76 ++++
 ...-iio_triggered_buffer_postenable-pos.patch |  95 +++++
 ...-resolve-compiler-warning-and-make-c.patch |  55 +++
 ...-missing-of_node-and-parent-referenc.patch |  36 ++
 ...low-device-module-unload-when-in-use.patch | 136 ++++++++
 ...iwlwifi-check-kasprintf-return-value.patch |  52 +++
 ...-fix-unaligned-read-of-rx_pkt_status.patch |  50 +++
 ...tect-tx-timestamping-from-api-misuse.patch |  46 +++
 ...a_port-probe-has-completed-before-de.patch |  95 +++++
 ...ll-relocation-offset-calculation-bug.patch | 238 +++++++++++++
 ...-error-handling-in-bpf_map__reuse_fd.patch |  68 ++++
 ...ative-fd-close-in-xsk_setup_xdp_prog.patch |  39 +++
 ...ng-uninitialized-bytes-to-setsockopt.patch |  47 +++
 ...f-fix-struct-end-padding-in-btf_dump.patch |  53 +++
 ...a-potential-null-pointer-dereference.patch |  45 +++
 queue-5.4/libsubcmd-use-o0-with-debug-1.patch |  46 +++
 ...x-memory-leakage-in-copy_filter_type.patch |  55 +++
 ...-unmap-write-zeroes-request-behavior.patch |  83 +++++
 ...r-qos-null-frames-for-sta_nullfunc_a.patch |  50 +++
 ...race-window-between-md_bitmap_resize.patch | 101 ++++++
 ...pare-spare-disk-superblock-events-in.patch | 191 ++++++++++
 .../media-ad5820-define-entity-function.patch |  40 +++
 ...e-setting-std-to-current-value-is-no.patch |  40 +++
 ...edia-aspeed-clear-garbage-interrupts.patch |  82 +++++
 ...-hsync-and-vsync-polarities-to-norma.patch |  41 +++
 ...ia-cec-funcs.h-add-status_req-checks.patch |  54 +++
 ...us-fill-in-bus_info-for-media-device.patch |  53 +++
 ...-undefined-shift-with-a-shift_and_ma.patch | 119 +++++++
 ...-use-helpers-to-access-capture-queue.patch |  86 +++++
 ...ome-error-handling-path-in-cx8800_in.patch |  76 ++++
 ...-fix-wrong-mdev-and-v4l2-dev-order-i.patch |  79 +++++
 ...b-fix-null-ptr-deref-in-flexcop_usb_.patch |  46 +++
 ...659-fix-missing-720p-register-config.patch |  48 +++
 ...i2c-ov2659-fix-s_stream-return-value.patch |  49 +++
 ...csis-add-a-check-for-devm_regulator_.patch |  52 +++
 ...x-build-error-without-config_regmap_.patch |  41 +++
 ...ec-move-cec_notifier_cec_adap_regist.patch | 238 +++++++++++++
 ...e-2592x1944-mode-only-available-at-1.patch |  41 +++
 ...-control-handler-not-freed-on-init-e.patch |  56 +++
 ...-crop-rectangle-alignment-not-passed.patch |  93 +++++
 ...-stored-crop-rectangle-not-in-sync-w.patch |  58 ++++
 ...-stored-frame-format-not-in-sync-wit.patch |  71 ++++
 ...-stored-frame-interval-not-in-sync-w.patch |  86 +++++
 ...x-oops-on-tear-down-when-radio-suppo.patch |  60 ++++
 ...ia-rcar_drif-fix-a-memory-disclosure.patch |  37 ++
 ...dd-a-missing-release_region-in-an-er.patch |  42 +++
 ...-i2c-add-missed-operations-in-remove.patch |  37 ++
 ...ister-sensor-after-enabling-runtime-.patch |  57 +++
 ...-add-a-check-for-devm_gpiod_get_opti.patch |  40 +++
 ...ng-imx-use-a-shorter-name-for-driver.patch |  58 ++++
 ...-ensure-buffers-are-cleaned-up-prope.patch | 127 +++++++
 ...-fix-a-v4l2-compliance-failure-about.patch |  51 +++
 ...a-v4l2-compliance-failure-about.patch-8034 |  65 ++++
 ...-fix-a-v4l2-compliance-failure-causi.patch |  62 ++++
 ...-fix-a-v4l2-compliance-warning-about.patch |  82 +++++
 ...e-vpe-fix-motion-vector-vpdma-stride.patch | 105 ++++++
 ...-make-sure-yuyv-is-set-as-default-fo.patch |  53 +++
 ...-core-fix-touch-support-in-v4l_g_fmt.patch |  87 +++++
 ...lock-main_hdl-on-operations-of-reque.patch |  79 +++++
 ...nus-core-fix-msm8996-frequency-table.patch |  62 ++++
 ...fix-occasionally-failures-to-suspend.patch |  57 +++
 ...dia_device_cleanup-was-called-too-ea.patch | 106 ++++++
 queue-5.4/media-vim2m-fix-abort-issue.patch   |  42 +++
 ...m-fix-bug_on-in-vim2m_device_release.patch |  73 ++++
 ...a_device_cleanup-was-called-too-earl.patch | 104 ++++++
 ...pf-in-rmmod-path-when-stream-is-acti.patch | 130 +++++++
 ...a_device_cleanup-was-called-too-earl.patch | 107 ++++++
 ...hen-48-bits-virtual-memory-is-enable.patch |  81 +++++
 ...loongson3-sync-workarounds-within-as.patch | 139 ++++++++
 ...ex-restore-n-after-sync-instructions.patch |  64 ++++
 ...le-pci-support-only-if-driver-for-mt.patch |  60 ++++
 ...t-loongson3-sync-workarounds-within-.patch |  54 +++
 ...pc-fix-memory-leak-from-miscdev-name.patch |  55 +++
 ..._cap_erase-to-allow-erase-discard-tr.patch |  73 ++++
 ...e-out-of-bound-access-in-mt7615_fill.patch |  58 ++++
 ...-memory-leak-in-mwifiex_pcie_init_ev.patch |  42 +++
 ...orrect-number-of-channels-from-ethto.patch |  55 +++
 ...ial-false-sharing-in-neighbor-relate.patch | 101 ++++++
 ...03-select-regmap-when-lan9303-enable.patch |  43 +++
 ...disallow-management-xmit-during-swit.patch |  62 ++++
 ...i-add-dependency-for-ti_davinci_emac.patch |  52 +++
 ...ale-clean-ale-tbl-on-init-and-intf-r.patch |  42 +++
 ...uct-netdev_queue-debug-info-for-tx-t.patch |  41 +++
 ...-clear-hardware-error-after-reset-co.patch |  39 +++
 ...-that-rule-has-at-least-one-fwd-drop.patch |  47 +++
 ...-matching-all-ones-clause-45-phy-ids.patch |  83 +++++
 ...-phy-dp83867-enable-robust-auto-mdix.patch |  69 ++++
 ...alise-phydev-speed-and-duplex-sanely.patch |  46 +++
 ...-device-refcount-for-added-link-grou.patch |  57 +++
 ...el-iwlwifi-fix-gro_normal-packet-sta.patch |  81 +++++
 ...orkaround-for-non-conformant-devices.patch |  63 ++++
 ...-command-aborted-by-host-status-code.patch |  69 ++++
 ...fix-nvmem_cell_write-inline-function.patch |  46 +++
 ...mx-ocotp-reset-error-status-on-probe.patch |  41 +++
 ...d-lowlevel-driver-if-ports-not-found.patch |  72 ++++
 ...-core-fix-the-mlock-accounting-again.patch |  69 ++++
 ...x-definition-of-macro-to_cs_queue_nr.patch |  66 ++++
 ...s-does-not-support-aux-area-sampling.patch |  54 +++
 ...-resource-leak-in-process_mapfile-an.patch | 107 ++++++
 ...otential-memory-leak-when-handling-t.patch |  85 +++++
 ...f-pmu-configuration-fails-free-terms.patch |  62 ++++
 ...r-out-instances-except-for-inlined-s.patch | 122 +++++++
 ...to-find-range-only-function-instance.patch |  50 +++
 ...o-list-probe-event-with-correct-line.patch |  78 +++++
 ...o-probe-a-function-which-has-no-entr.patch |  96 ++++++
 ...o-probe-an-inline-function-which-has.patch |  72 ++++
 ...o-show-calling-lines-of-inlined-func.patch | 122 +++++++
 ...o-show-inlined-function-callsite-wit.patch | 112 ++++++
 ...o-show-ranges-of-variables-in-functi.patch |  98 ++++++
 ...n-a-better-scope-die-if-there-is-no-.patch |  84 +++++
 ...end-of-sequence-and-non-statement-li.patch | 145 ++++++++
 ...overlapped-location-on-searching-var.patch | 104 ++++++
 ...alk-function-lines-in-lexical-blocks.patch |  76 ++++
 ...a-function-to-test-for-kernel-suppor.patch | 105 ++++++
 ...warning-when-libunwind-not-compiled-.patch |  58 ++++
 ...-decompression-of-perf_record_compre.patch | 144 ++++++++
 ...oid-infinite-loop-for-task-exit-case.patch |  67 ++++
 ...-test-report-failure-for-mmap-events.patch |  43 +++
 ...-disable-bp_signal-testing-for-arm64.patch | 113 ++++++
 ...rf-tools-fix-cross-compile-for-arm64.patch |  67 ++++
 ...ice-events-onto-evlist-even-on-error.patch |  76 ++++
 ...r-own-pid-to-avoid-a-feedback-look-i.patch |  96 ++++++
 ...ts-arm64-fix-hisi-hip08-ddrc-pmu-eve.patch |  45 +++
 ...fix-extcon-double-register-after-pow.patch |  71 ++++
 ...rcar-gen2-fix-the-array-off-by-one-w.patch |  63 ++++
 ...__iomem-annotation-in-amd_gpio_irq_h.patch |  50 +++
 ...ee-avoid-taking-direct-reference-to-.patch | 112 ++++++
 ...180-add-missing-tile-info-in-sdc_qds.patch |  72 ++++
 ...-sh-pfc-sh7734-fix-duplicate-tclk1_b.patch |  64 ++++
 ...ap-battery-check-voltage-before-orde.patch |  54 +++
 ...x-debugfs-support-for-multiple-cards.patch |  47 +++
 ...x-invalid-channel-information-output.patch |  47 +++
 .../qtnfmac-fix-using-skb-after-free.patch    |  60 ++++
 ...e-user-setting-when-restarting-netwo.patch |  75 ++++
 ...-chip-number-validation-broadcom-s-g.patch |  56 +++
 ...rdma-bnxt_re-fix-missing-le16_to_cpu.patch |  47 +++
 ...-stat-push-into-dma-buffer-on-gen-p5.patch |  40 +++
 ...turn-code-when-modify_port-isn-t-sup.patch |  47 +++
 ...ma-core-set-dma-parameters-correctly.patch |  54 +++
 ...he-admin-command-buffer-prior-to-its.patch |  54 +++
 ...ory-leak-on-context-on-error-return-.patch |  61 ++++
 ...ng-parameters-when-initial-mtt-of-sr.patch |  76 ++++
 ...dr-fix-memory-leak-in-user-qp-and-mr.patch |  55 +++
 ...-qedr-fix-srqs-xarray-initialization.patch |  39 +++
 .../rdma-siw-fix-sq-rq-drain-logic.patch      | 253 ++++++++++++++
 ...et-boot-on-regulators-be-powered-off.patch |  43 +++
 ...elease-coupled_rdevs-on-regulator_in.patch |  37 ++
 ...7-fix-the-usage-of-uninitialized-var.patch |  65 ++++
 ...h-pfc-r8a77990-fix-mod_sel1-bit30-wh.patch | 106 ++++++
 ...h-pfc-r8a77990-fix-mod_sel1-bit31-wh.patch |  82 +++++
 ...8723bu-connection-failure-issue-afte.patch |  73 ++++
 ...ry-leak-in-rtl92c_set_fw_rsvdpagepkt.patch |  64 ++++
 ...prevent-memory-leak-in-rtl_usb_probe.patch |  47 +++
 .../rtw88-coex-set-4-slot-mode-for-a2dp.patch | 127 +++++++
 queue-5.4/rtw88-fix-nss-of-hw_cap.patch       |  43 +++
 ...or-handling-to-perf_callchain_kernel.patch |  43 +++
 ...390-bpf-use-kvcalloc-for-addrs-array.patch |  60 ++++
 ...t-registration-of-s390-pmu-device-dr.patch | 135 ++++++++
 ...unsigned-variable-compared-with-zero.patch |  50 +++
 ...ler-don-t-hide-instruction-addresses.patch |  73 ++++
 ...port-memcpy_real-with-trace_irqflags.patch |  76 ++++
 ...add-mm_pxd_folded-checks-to-pxd_free.patch |  72 ++++
 ...-get_clock_monotonic-returns-monoton.patch |  65 ++++
 ...ix-proc_cmd-command-result-check-log.patch |  82 +++++
 ...amp-fix-overzealous-type-replacement.patch |  91 +++++
 ...bpf-correct-path-to-include-msg-path.patch |  72 ++++
 ...s-bpf-fix-btf_dump-padding-test-case.patch |  49 +++
 ...tests-bpf-fix-test_tc_tunnel-hanging.patch |  58 ++++
 ...ests-bpf-make-a-copy-of-subtest-name.patch |  74 ++++
 ...rkaround-an-alu32-sub-register-spill.patch |  82 +++++
 ...and-kbuild_output-handling-for-relat.patch |  74 ++++
 ...et-fix-printf-format-warnings-on-arm.patch |  74 ++++
 .../selftests-proc-make-va_max-1mb.patch      |  45 +++
 queue-5.4/series                              | 326 ++++++++++++++++++
 ...ntel-fix-pdi-stream-mapping-for-bulk.patch |  53 +++
 ...spi_slave_abort-function-when-spidev.patch |  50 +++
 .../spi-dw-fix-designware-spi-loopback.patch  |  38 ++
 ...revent-memory-leak-in-spi_gpio_probe.patch |  42 +++
 ...mg-spfi-fix-potential-double-release.patch |  39 +++
 ...pi-pxa2xx-add-missed-security-checks.patch |  45 +++
 ...able-clk-when-probe-fails-and-remove.patch |  78 +++++
 ...-missing-lock-protection-when-reboot.patch |  39 +++
 ...t-ssc4-add-missed-pm_runtime_disable.patch |  45 +++
 ...gra20-slink-add-missed-clk_unprepare.patch |  53 +++
 ...-ad9834-add-a-check-for-devm_clk_get.patch |  39 +++
 ...8188eu-fix-possible-null-dereference.patch |  54 +++
 ...-fix-multiple-memory-leaks-on-error-.patch |  72 ++++
 ...-check-if-device-is-initialzied-befo.patch |  68 ++++
 ...-potential-corruption-in-wilc_parse_.patch |  39 +++
 ...-the-correct-function-type-in-syscal.patch |  72 ++++
 ...read-lock-when-walking-the-port_list.patch |  52 +++
 ...fix-build-for-make-s-tools-bpf-o-dir.patch |  55 +++
 ...el-fix-data-race-detection-for-unord.patch |  90 +++++
 ...ower-fix-initializer-override-in-hsw.patch |  63 ++++
 ...heck-whether-the-non-suffixed-symbol.patch |  95 +++++
 ...calloc-for-tgid_map-array-allocation.patch |  59 ++++
 ...tun-fix-data-race-in-gro_normal_list.patch |  92 +++++
 ...te-and-allow-__ubsan_handle_shift_ou.patch |  82 +++++
 ...s-add-suspend-event-support-in-gadge.patch |  89 +++++
 ...ss-problematic-bind-and-unbind-ueven.patch |  82 +++++
 ...forward-declaration-of-struct-kimage.patch |  72 ++++
 ...e-intel-instructions-to-the-opcode-m.patch | 258 ++++++++++++++
 ...nt-inconsistent-state-when-moving-an.patch |  81 +++++
 ...th-emu-check-__copy_from_user-result.patch | 107 ++++++
 ...rottling-mce-messages-priority-to-wa.patch |  67 ++++
 ...orrect-function-type-for-native_set_.patch |  65 ++++
 ...dev-use-select-for-dma_shared_buffer.patch |  48 +++
 ...ost-runtime-pm-as-default-also-for-i.patch |  53 +++
 327 files changed, 23484 insertions(+)
 create mode 100644 queue-5.4/acpi-button-add-dmi-quirk-for-medion-akoya-e2215t.patch
 create mode 100644 queue-5.4/alsa-bebob-expand-sleep-just-after-breaking-connecti.patch
 create mode 100644 queue-5.4/alsa-hda-hdmi-implement-mst_no_extra_pcms-flag.patch
 create mode 100644 queue-5.4/alsa-pcm-fix-missing-check-of-the-new-non-cached-buf.patch
 create mode 100644 queue-5.4/alsa-timer-limit-max-amount-of-slave-instances.patch
 create mode 100644 queue-5.4/arm64-psci-reduce-the-waiting-time-for-cpu_psci_cpu_.patch
 create mode 100644 queue-5.4/asoc-intel-bytcr_rt5640-update-quirk-for-acer-switch.patch
 create mode 100644 queue-5.4/asoc-intel-kbl_rt5663_rt5514_max98927-add-dmic-forma.patch
 create mode 100644 queue-5.4/asoc-rt5677-mark-reg-rt5677_pwr_anlg2-as-volatile.patch
 create mode 100644 queue-5.4/asoc-soc-pcm-check-symmetry-before-hw_params.patch
 create mode 100644 queue-5.4/asoc-soc-pcm-fixup-dpcm_prune_paths-loop-continue.patch
 create mode 100644 queue-5.4/asoc-sof-enable-sync_write-in-hdac_bus.patch
 create mode 100644 queue-5.4/asoc-sof-imx-fix-reverse-config_snd_soc_sof_of-depen.patch
 create mode 100644 queue-5.4/asoc-sof-topology-set-trigger-order-for-fe-dai-link.patch
 create mode 100644 queue-5.4/asoc-wm2200-add-missed-operations-in-remove-and-prob.patch
 create mode 100644 queue-5.4/asoc-wm5100-add-missed-pm_runtime_disable.patch
 create mode 100644 queue-5.4/asoc-wm8904-fix-regcache-handling.patch
 create mode 100644 queue-5.4/ath10k-add-cleanup-in-ath10k_sta_state.patch
 create mode 100644 queue-5.4/ath10k-check-if-station-exists-before-forwarding-tx-.patch
 create mode 100644 queue-5.4/ath10k-correct-error-handling-of-dma_map_single.patch
 create mode 100644 queue-5.4/ath10k-fix-backtrace-on-coredump.patch
 create mode 100644 queue-5.4/ath10k-fix-get-invalid-tx-rate-for-mesh-metric.patch
 create mode 100644 queue-5.4/ath10k-fix-offchannel-tx-failure-when-no-ath10k_mac_.patch
 create mode 100644 queue-5.4/bcache-fix-deadlock-in-bcache_allocator.patch
 create mode 100644 queue-5.4/bcache-fix-static-checker-warning-in-bcache_device_f.patch
 create mode 100644 queue-5.4/block-fix-writeback-throttling-w-1-compiler-warnings.patch
 create mode 100644 queue-5.4/bluetooth-btusb-avoid-unused-function-warning.patch
 create mode 100644 queue-5.4/bluetooth-fix-advertising-duplicated-flags.patch
 create mode 100644 queue-5.4/bluetooth-hci_core-fix-init-for-hci_user_channel.patch
 create mode 100644 queue-5.4/bluetooth-missed-cpu_to_le16-conversion-in-hci_init4.patch
 create mode 100644 queue-5.4/bluetooth-workaround-directed-advertising-bug-in-bro.patch
 create mode 100644 queue-5.4/bnx2x-fix-pf-vf-communication-over-multi-cos-queues.patch
 create mode 100644 queue-5.4/bnxt_en-improve-rx-buffer-error-handling.patch
 create mode 100644 queue-5.4/bnxt_en-return-proper-error-code-for-non-existent-nv.patch
 create mode 100644 queue-5.4/bpf-provide-better-register-bounds-after-jmp32-instr.patch
 create mode 100644 queue-5.4/bpf-stackmap-fix-deadlock-with-rq_lock-in-bpf_get_st.patch
 create mode 100644 queue-5.4/bpf-testing-workaround-a-verifier-failure-for-test_p.patch
 create mode 100644 queue-5.4/brcmfmac-remove-monitor-interface-when-detaching.patch
 create mode 100644 queue-5.4/btrfs-don-t-prematurely-free-work-in-end_workqueue_f.patch
 create mode 100644 queue-5.4/btrfs-don-t-prematurely-free-work-in-reada_start_mac.patch
 create mode 100644 queue-5.4/btrfs-don-t-prematurely-free-work-in-run_ordered_wor.patch
 create mode 100644 queue-5.4/btrfs-don-t-prematurely-free-work-in-scrub_missing_r.patch
 create mode 100644 queue-5.4/cgroup-freezer-don-t-change-task-and-cgroups-status-.patch
 create mode 100644 queue-5.4/cpufreq-register-drivers-only-after-cpu-devices-have.patch
 create mode 100644 queue-5.4/cpufreq-sun50i-fix-cpu-speed-bin-detection.patch
 create mode 100644 queue-5.4/crypto-aegis128-neon-use-clang-compatible-cflags-for.patch
 create mode 100644 queue-5.4/crypto-aegis128-simd-build-32-bit-arm-for-v8-archite.patch
 create mode 100644 queue-5.4/crypto-atmel-fix-authenc-support-when-it-is-set-to-m.patch
 create mode 100644 queue-5.4/crypto-inside-secure-fix-a-maybe-uninitialized-warni.patch
 create mode 100644 queue-5.4/crypto-sun4i-ss-fix-64-bit-size_t-warnings-on-sun4i-.patch
 create mode 100644 queue-5.4/crypto-sun4i-ss-fix-64-bit-size_t-warnings.patch
 create mode 100644 queue-5.4/crypto-virtio-deal-with-unsupported-input-sizes.patch
 create mode 100644 queue-5.4/crypto-vmx-avoid-weird-build-failures.patch
 create mode 100644 queue-5.4/drm-amd-display-add-new-active-dongle-to-existent-w-.patch
 create mode 100644 queue-5.4/drm-amd-display-correctly-populate-dpp-refclk-in-fpg.patch
 create mode 100644 queue-5.4/drm-amd-display-enable-hostvm-based-on-roimmu-active.patch
 create mode 100644 queue-5.4/drm-amd-display-fix-dongle_caps-containing-stale-inf.patch
 create mode 100644 queue-5.4/drm-amd-display-fix-header-for-rn-clk-mgr.patch
 create mode 100644 queue-5.4/drm-amd-display-fix-struct-init-in-update_bounding_b.patch
 create mode 100644 queue-5.4/drm-amd-display-handle-virtual-signal-type-in-disabl.patch
 create mode 100644 queue-5.4/drm-amd-display-otc-underflow-fix.patch
 create mode 100644 queue-5.4/drm-amd-display-program-dwb-watermarks-from-correct-.patch
 create mode 100644 queue-5.4/drm-amd-display-properly-round-nominal-frequency-for.patch
 create mode 100644 queue-5.4/drm-amd-display-rebuild-mapped-resources-after-pipe-.patch
 create mode 100644 queue-5.4/drm-amd-display-set-minimum-abm-backlight-level.patch
 create mode 100644 queue-5.4/drm-amd-display-set-number-of-pipes-to-1-if-the-seco.patch
 create mode 100644 queue-5.4/drm-amd-display-setting-the-dig_mode-to-the-correct-.patch
 create mode 100644 queue-5.4/drm-amd-display-verify-stream-link-before-link-test.patch
 create mode 100644 queue-5.4/drm-amd-display-wait-for-set-pipe-mcp-command-comple.patch
 create mode 100644 queue-5.4/drm-amd-powerplay-a-workaround-to-gpu-reset-on-apu.patch
 create mode 100644 queue-5.4/drm-amd-powerplay-avoid-disabling-ecc-if-ras-is-enab.patch
 create mode 100644 queue-5.4/drm-amd-powerplay-fix-struct-init-in-renoir_print_cl.patch
 create mode 100644 queue-5.4/drm-amdgpu-avoid-accidental-thread-reactivation.patch
 create mode 100644 queue-5.4/drm-amdgpu-disallow-direct-upload-save-restore-list-.patch
 create mode 100644 queue-5.4/drm-amdgpu-fix-amdgpu-trace-event-print-string-forma.patch
 create mode 100644 queue-5.4/drm-amdgpu-fix-bad-dma-from-interrupt_cntl2.patch
 create mode 100644 queue-5.4/drm-amdgpu-fix-potential-double-drop-fence-reference.patch
 create mode 100644 queue-5.4/drm-amdgpu-grab-the-id-mgr-lock-while-accessing-pass.patch
 create mode 100644 queue-5.4/drm-amdgpu-sriov-add-ring_stop-before-ring_create-in.patch
 create mode 100644 queue-5.4/drm-amdkfd-fix-a-potential-null-pointer-dereference-.patch
 create mode 100644 queue-5.4/drm-amdkfd-fix-mqd-size-calculation.patch
 create mode 100644 queue-5.4/drm-bridge-analogix-anx78xx-silence-eprobe_defer-war.patch
 create mode 100644 queue-5.4/drm-bridge-dw-hdmi-refuse-ddc-ci-transfers-on-the-in.patch
 create mode 100644 queue-5.4/drm-bridge-dw-hdmi-restore-audio-when-setting-a-mode.patch
 create mode 100644 queue-5.4/drm-don-t-free-jobs-in-wait_event_interruptible.patch
 create mode 100644 queue-5.4/drm-drm_vblank-change-einval-by-the-correct-errno.patch
 create mode 100644 queue-5.4/drm-exynos-exynos_hdmi-use-cec_notifier_conn_-un-reg.patch
 create mode 100644 queue-5.4/drm-gma500-fix-memory-disclosures-due-to-uninitializ.patch
 create mode 100644 queue-5.4/drm-komeda-workaround-for-broken-flip_complete-times.patch
 create mode 100644 queue-5.4/drm-meson-vclk-use-the-correct-g12a-frac-max-value.patch
 create mode 100644 queue-5.4/drm-mipi-dbi-fix-a-loop-in-debugfs-code.patch
 create mode 100644 queue-5.4/drm-msm-a6xx-fix-debug-bus-register-configuration.patch
 create mode 100644 queue-5.4/drm-mst-fix-query_payload-ack-reply-struct.patch
 create mode 100644 queue-5.4/drm-nouveau-don-t-grab-runtime-pm-refs-for-hpd-irqs.patch
 create mode 100644 queue-5.4/drm-panel-add-missing-drm_panel_init-in-panel-driver.patch
 create mode 100644 queue-5.4/drm-sun4i-dsi-fix-tcon-drq-set-bits.patch
 create mode 100644 queue-5.4/drm-tegra-sor-use-correct-sor-index-on-tegra210.patch
 create mode 100644 queue-5.4/drm-ttm-return-ebusy-on-pipelining-with-no_gpu_wait-.patch
 create mode 100644 queue-5.4/drm-use-eopnotsupp-not-enotsupp.patch
 create mode 100644 queue-5.4/drm-vc4-vc4_hdmi-fill-in-connector-info.patch
 create mode 100644 queue-5.4/drm-virtio-switch-virtio_gpu_wait_ioctl-to-gem-helpe.patch
 create mode 100644 queue-5.4/edac-amd64-set-grain-per-dimm.patch
 create mode 100644 queue-5.4/edac-ghes-fix-grain-calculation.patch
 create mode 100644 queue-5.4/extcon-sm5502-reset-registers-during-initialization.patch
 create mode 100644 queue-5.4/fbtft-make-sure-string-is-null-terminated.patch
 create mode 100644 queue-5.4/firmware_loader-fix-labels-with-comma-for-builtin-fi.patch
 create mode 100644 queue-5.4/fsi-core-fix-small-accesses-and-unaligned-offsets-vi.patch
 create mode 100644 queue-5.4/gpu-host1x-allocate-gather-copy-for-host1x.patch
 create mode 100644 queue-5.4/hwrng-omap3-rom-call-clk_disable_unprepare-on-exit-o.patch
 create mode 100644 queue-5.4/i40e-initialize-itrn-registers-with-correct-values.patch
 create mode 100644 queue-5.4/i40e-wrong-advertised-fec-modes-after-set-fec-to-aut.patch
 create mode 100644 queue-5.4/ib-iser-bound-protection_sg-size-by-data_sg-size.patch
 create mode 100644 queue-5.4/ibmvnic-fix-completion-structure-initialization.patch
 create mode 100644 queue-5.4/ice-check-for-null-pointer-dereference-when-setting-.patch
 create mode 100644 queue-5.4/ice-delay-less.patch
 create mode 100644 queue-5.4/ice-fix-setting-coalesce-to-handle-dcb-configuration.patch
 create mode 100644 queue-5.4/ice-only-disable-vf-state-when-freeing-each-vf-resou.patch
 create mode 100644 queue-5.4/iio-adc-max1027-reset-the-device-at-probe-time.patch
 create mode 100644 queue-5.4/iio-cros_ec_baro-set-info_mask_shared_by_all_availab.patch
 create mode 100644 queue-5.4/iio-dac-ad5446-add-support-for-new-ad5600-dac.patch
 create mode 100644 queue-5.4/iio-dln2-adc-fix-iio_triggered_buffer_postenable-pos.patch
 create mode 100644 queue-5.4/iio-light-bh1750-resolve-compiler-warning-and-make-c.patch
 create mode 100644 queue-5.4/iio-max31856-add-missing-of_node-and-parent-referenc.patch
 create mode 100644 queue-5.4/ipmi-don-t-allow-device-module-unload-when-in-use.patch
 create mode 100644 queue-5.4/iwlwifi-check-kasprintf-return-value.patch
 create mode 100644 queue-5.4/iwlwifi-mvm-fix-unaligned-read-of-rx_pkt_status.patch
 create mode 100644 queue-5.4/ixgbe-protect-tx-timestamping-from-api-misuse.patch
 create mode 100644 queue-5.4/libata-ensure-ata_port-probe-has-completed-before-de.patch
 create mode 100644 queue-5.4/libbpf-fix-call-relocation-offset-calculation-bug.patch
 create mode 100644 queue-5.4/libbpf-fix-error-handling-in-bpf_map__reuse_fd.patch
 create mode 100644 queue-5.4/libbpf-fix-negative-fd-close-in-xsk_setup_xdp_prog.patch
 create mode 100644 queue-5.4/libbpf-fix-passing-uninitialized-bytes-to-setsockopt.patch
 create mode 100644 queue-5.4/libbpf-fix-struct-end-padding-in-btf_dump.patch
 create mode 100644 queue-5.4/libertas-fix-a-potential-null-pointer-dereference.patch
 create mode 100644 queue-5.4/libsubcmd-use-o0-with-debug-1.patch
 create mode 100644 queue-5.4/libtraceevent-fix-memory-leakage-in-copy_filter_type.patch
 create mode 100644 queue-5.4/loop-fix-no-unmap-write-zeroes-request-behavior.patch
 create mode 100644 queue-5.4/mac80211-consider-qos-null-frames-for-sta_nullfunc_a.patch
 create mode 100644 queue-5.4/md-bitmap-avoid-race-window-between-md_bitmap_resize.patch
 create mode 100644 queue-5.4/md-no-longer-compare-spare-disk-superblock-events-in.patch
 create mode 100644 queue-5.4/media-ad5820-define-entity-function.patch
 create mode 100644 queue-5.4/media-am437x-vpfe-setting-std-to-current-value-is-no.patch
 create mode 100644 queue-5.4/media-aspeed-clear-garbage-interrupts.patch
 create mode 100644 queue-5.4/media-aspeed-set-hsync-and-vsync-polarities-to-norma.patch
 create mode 100644 queue-5.4/media-cec-funcs.h-add-status_req-checks.patch
 create mode 100644 queue-5.4/media-cedrus-fill-in-bus_info-for-media-device.patch
 create mode 100644 queue-5.4/media-cedrus-fix-undefined-shift-with-a-shift_and_ma.patch
 create mode 100644 queue-5.4/media-cedrus-use-helpers-to-access-capture-queue.patch
 create mode 100644 queue-5.4/media-cx88-fix-some-error-handling-path-in-cx8800_in.patch
 create mode 100644 queue-5.4/media-exynos4-is-fix-wrong-mdev-and-v4l2-dev-order-i.patch
 create mode 100644 queue-5.4/media-flexcop-usb-fix-null-ptr-deref-in-flexcop_usb_.patch
 create mode 100644 queue-5.4/media-i2c-ov2659-fix-missing-720p-register-config.patch
 create mode 100644 queue-5.4/media-i2c-ov2659-fix-s_stream-return-value.patch
 create mode 100644 queue-5.4/media-imx7-mipi-csis-add-a-check-for-devm_regulator_.patch
 create mode 100644 queue-5.4/media-max2175-fix-build-error-without-config_regmap_.patch
 create mode 100644 queue-5.4/media-meson-ao-cec-move-cec_notifier_cec_adap_regist.patch
 create mode 100644 queue-5.4/media-ov5640-make-2592x1944-mode-only-available-at-1.patch
 create mode 100644 queue-5.4/media-ov6650-fix-control-handler-not-freed-on-init-e.patch
 create mode 100644 queue-5.4/media-ov6650-fix-crop-rectangle-alignment-not-passed.patch
 create mode 100644 queue-5.4/media-ov6650-fix-stored-crop-rectangle-not-in-sync-w.patch
 create mode 100644 queue-5.4/media-ov6650-fix-stored-frame-format-not-in-sync-wit.patch
 create mode 100644 queue-5.4/media-ov6650-fix-stored-frame-interval-not-in-sync-w.patch
 create mode 100644 queue-5.4/media-pvrusb2-fix-oops-on-tear-down-when-radio-suppo.patch
 create mode 100644 queue-5.4/media-rcar_drif-fix-a-memory-disclosure.patch
 create mode 100644 queue-5.4/media-seco-cec-add-a-missing-release_region-in-an-er.patch
 create mode 100644 queue-5.4/media-si470x-i2c-add-missed-operations-in-remove.patch
 create mode 100644 queue-5.4/media-smiapp-register-sensor-after-enabling-runtime-.patch
 create mode 100644 queue-5.4/media-st-mipid02-add-a-check-for-devm_gpiod_get_opti.patch
 create mode 100644 queue-5.4/media-staging-imx-use-a-shorter-name-for-driver.patch
 create mode 100644 queue-5.4/media-ti-vpe-vpe-ensure-buffers-are-cleaned-up-prope.patch
 create mode 100644 queue-5.4/media-ti-vpe-vpe-fix-a-v4l2-compliance-failure-about.patch
 create mode 100644 queue-5.4/media-ti-vpe-vpe-fix-a-v4l2-compliance-failure-about.patch-8034
 create mode 100644 queue-5.4/media-ti-vpe-vpe-fix-a-v4l2-compliance-failure-causi.patch
 create mode 100644 queue-5.4/media-ti-vpe-vpe-fix-a-v4l2-compliance-warning-about.patch
 create mode 100644 queue-5.4/media-ti-vpe-vpe-fix-motion-vector-vpdma-stride.patch
 create mode 100644 queue-5.4/media-ti-vpe-vpe-make-sure-yuyv-is-set-as-default-fo.patch
 create mode 100644 queue-5.4/media-v4l2-core-fix-touch-support-in-v4l_g_fmt.patch
 create mode 100644 queue-5.4/media-v4l2-ctrl-lock-main_hdl-on-operations-of-reque.patch
 create mode 100644 queue-5.4/media-venus-core-fix-msm8996-frequency-table.patch
 create mode 100644 queue-5.4/media-venus-fix-occasionally-failures-to-suspend.patch
 create mode 100644 queue-5.4/media-vicodec-media_device_cleanup-was-called-too-ea.patch
 create mode 100644 queue-5.4/media-vim2m-fix-abort-issue.patch
 create mode 100644 queue-5.4/media-vim2m-fix-bug_on-in-vim2m_device_release.patch
 create mode 100644 queue-5.4/media-vim2m-media_device_cleanup-was-called-too-earl.patch
 create mode 100644 queue-5.4/media-vimc-fix-gpf-in-rmmod-path-when-stream-is-acti.patch
 create mode 100644 queue-5.4/media-vivid-media_device_cleanup-was-called-too-earl.patch
 create mode 100644 queue-5.4/mips-fix-build-when-48-bits-virtual-memory-is-enable.patch
 create mode 100644 queue-5.4/mips-futex-emit-loongson3-sync-workarounds-within-as.patch
 create mode 100644 queue-5.4/mips-futex-restore-n-after-sync-instructions.patch
 create mode 100644 queue-5.4/mips-ralink-enable-pci-support-only-if-driver-for-mt.patch
 create mode 100644 queue-5.4/mips-syscall-emit-loongson3-sync-workarounds-within-.patch
 create mode 100644 queue-5.4/misc-fastrpc-fix-memory-leak-from-miscdev-name.patch
 create mode 100644 queue-5.4/mmc-tmio-add-mmc_cap_erase-to-allow-erase-discard-tr.patch
 create mode 100644 queue-5.4/mt76-fix-possible-out-of-bound-access-in-mt7615_fill.patch
 create mode 100644 queue-5.4/mwifiex-pcie-fix-memory-leak-in-mwifiex_pcie_init_ev.patch
 create mode 100644 queue-5.4/net-af_xdp-use-correct-number-of-channels-from-ethto.patch
 create mode 100644 queue-5.4/net-avoid-potential-false-sharing-in-neighbor-relate.patch
 create mode 100644 queue-5.4/net-dsa-lan9303-select-regmap-when-lan9303-enable.patch
 create mode 100644 queue-5.4/net-dsa-sja1105-disallow-management-xmit-during-swit.patch
 create mode 100644 queue-5.4/net-ethernet-ti-add-dependency-for-ti_davinci_emac.patch
 create mode 100644 queue-5.4/net-ethernet-ti-ale-clean-ale-tbl-on-init-and-intf-r.patch
 create mode 100644 queue-5.4/net-hns3-add-struct-netdev_queue-debug-info-for-tx-t.patch
 create mode 100644 queue-5.4/net-hns3-log-and-clear-hardware-error-after-reset-co.patch
 create mode 100644 queue-5.4/net-mlx5e-verify-that-rule-has-at-least-one-fwd-drop.patch
 create mode 100644 queue-5.4/net-phy-avoid-matching-all-ones-clause-45-phy-ids.patch
 create mode 100644 queue-5.4/net-phy-dp83867-enable-robust-auto-mdix.patch
 create mode 100644 queue-5.4/net-phy-initialise-phydev-speed-and-duplex-sanely.patch
 create mode 100644 queue-5.4/net-smc-increase-device-refcount-for-added-link-grou.patch
 create mode 100644 queue-5.4/net-wireless-intel-iwlwifi-fix-gro_normal-packet-sta.patch
 create mode 100644 queue-5.4/nvme-discard-workaround-for-non-conformant-devices.patch
 create mode 100644 queue-5.4/nvme-introduce-command-aborted-by-host-status-code.patch
 create mode 100644 queue-5.4/nvmem-core-fix-nvmem_cell_write-inline-function.patch
 create mode 100644 queue-5.4/nvmem-imx-ocotp-reset-error-status-on-probe.patch
 create mode 100644 queue-5.4/parport-load-lowlevel-driver-if-ports-not-found.patch
 create mode 100644 queue-5.4/perf-core-fix-the-mlock-accounting-again.patch
 create mode 100644 queue-5.4/perf-cs-etm-fix-definition-of-macro-to_cs_queue_nr.patch
 create mode 100644 queue-5.4/perf-intel-bts-does-not-support-aux-area-sampling.patch
 create mode 100644 queue-5.4/perf-jevents-fix-resource-leak-in-process_mapfile-an.patch
 create mode 100644 queue-5.4/perf-parse-fix-potential-memory-leak-when-handling-t.patch
 create mode 100644 queue-5.4/perf-parse-if-pmu-configuration-fails-free-terms.patch
 create mode 100644 queue-5.4/perf-probe-filter-out-instances-except-for-inlined-s.patch
 create mode 100644 queue-5.4/perf-probe-fix-to-find-range-only-function-instance.patch
 create mode 100644 queue-5.4/perf-probe-fix-to-list-probe-event-with-correct-line.patch
 create mode 100644 queue-5.4/perf-probe-fix-to-probe-a-function-which-has-no-entr.patch
 create mode 100644 queue-5.4/perf-probe-fix-to-probe-an-inline-function-which-has.patch
 create mode 100644 queue-5.4/perf-probe-fix-to-show-calling-lines-of-inlined-func.patch
 create mode 100644 queue-5.4/perf-probe-fix-to-show-inlined-function-callsite-wit.patch
 create mode 100644 queue-5.4/perf-probe-fix-to-show-ranges-of-variables-in-functi.patch
 create mode 100644 queue-5.4/perf-probe-return-a-better-scope-die-if-there-is-no-.patch
 create mode 100644 queue-5.4/perf-probe-skip-end-of-sequence-and-non-statement-li.patch
 create mode 100644 queue-5.4/perf-probe-skip-overlapped-location-on-searching-var.patch
 create mode 100644 queue-5.4/perf-probe-walk-function-lines-in-lexical-blocks.patch
 create mode 100644 queue-5.4/perf-record-add-a-function-to-test-for-kernel-suppor.patch
 create mode 100644 queue-5.4/perf-report-add-warning-when-libunwind-not-compiled-.patch
 create mode 100644 queue-5.4/perf-session-fix-decompression-of-perf_record_compre.patch
 create mode 100644 queue-5.4/perf-test-avoid-infinite-loop-for-task-exit-case.patch
 create mode 100644 queue-5.4/perf-test-report-failure-for-mmap-events.patch
 create mode 100644 queue-5.4/perf-tests-disable-bp_signal-testing-for-arm64.patch
 create mode 100644 queue-5.4/perf-tools-fix-cross-compile-for-arm64.patch
 create mode 100644 queue-5.4/perf-tools-splice-events-onto-evlist-even-on-error.patch
 create mode 100644 queue-5.4/perf-trace-filter-own-pid-to-avoid-a-feedback-look-i.patch
 create mode 100644 queue-5.4/perf-vendor-events-arm64-fix-hisi-hip08-ddrc-pmu-eve.patch
 create mode 100644 queue-5.4/phy-qcom-usb-hs-fix-extcon-double-register-after-pow.patch
 create mode 100644 queue-5.4/phy-renesas-phy-rcar-gen2-fix-the-array-off-by-one-w.patch
 create mode 100644 queue-5.4/pinctrl-amd-fix-__iomem-annotation-in-amd_gpio_irq_h.patch
 create mode 100644 queue-5.4/pinctrl-devicetree-avoid-taking-direct-reference-to-.patch
 create mode 100644 queue-5.4/pinctrl-qcom-sc7180-add-missing-tile-info-in-sdc_qds.patch
 create mode 100644 queue-5.4/pinctrl-sh-pfc-sh7734-fix-duplicate-tclk1_b.patch
 create mode 100644 queue-5.4/power-supply-cpcap-battery-check-voltage-before-orde.patch
 create mode 100644 queue-5.4/qtnfmac-fix-debugfs-support-for-multiple-cards.patch
 create mode 100644 queue-5.4/qtnfmac-fix-invalid-channel-information-output.patch
 create mode 100644 queue-5.4/qtnfmac-fix-using-skb-after-free.patch
 create mode 100644 queue-5.4/r8169-respect-eee-user-setting-when-restarting-netwo.patch
 create mode 100644 queue-5.4/rdma-bnxt_re-fix-chip-number-validation-broadcom-s-g.patch
 create mode 100644 queue-5.4/rdma-bnxt_re-fix-missing-le16_to_cpu.patch
 create mode 100644 queue-5.4/rdma-bnxt_re-fix-stat-push-into-dma-buffer-on-gen-p5.patch
 create mode 100644 queue-5.4/rdma-core-fix-return-code-when-modify_port-isn-t-sup.patch
 create mode 100644 queue-5.4/rdma-core-set-dma-parameters-correctly.patch
 create mode 100644 queue-5.4/rdma-efa-clear-the-admin-command-buffer-prior-to-its.patch
 create mode 100644 queue-5.4/rdma-hns-fix-memory-leak-on-context-on-error-return-.patch
 create mode 100644 queue-5.4/rdma-hns-fix-wrong-parameters-when-initial-mtt-of-sr.patch
 create mode 100644 queue-5.4/rdma-qedr-fix-memory-leak-in-user-qp-and-mr.patch
 create mode 100644 queue-5.4/rdma-qedr-fix-srqs-xarray-initialization.patch
 create mode 100644 queue-5.4/rdma-siw-fix-sq-rq-drain-logic.patch
 create mode 100644 queue-5.4/regulator-core-let-boot-on-regulators-be-powered-off.patch
 create mode 100644 queue-5.4/regulator-core-release-coupled_rdevs-on-regulator_in.patch
 create mode 100644 queue-5.4/regulator-max8907-fix-the-usage-of-uninitialized-var.patch
 create mode 100644 queue-5.4/revert-pinctrl-sh-pfc-r8a77990-fix-mod_sel1-bit30-wh.patch
 create mode 100644 queue-5.4/revert-pinctrl-sh-pfc-r8a77990-fix-mod_sel1-bit31-wh.patch
 create mode 100644 queue-5.4/rtl8xxxu-fix-rtl8723bu-connection-failure-issue-afte.patch
 create mode 100644 queue-5.4/rtlwifi-fix-memory-leak-in-rtl92c_set_fw_rsvdpagepkt.patch
 create mode 100644 queue-5.4/rtlwifi-prevent-memory-leak-in-rtl_usb_probe.patch
 create mode 100644 queue-5.4/rtw88-coex-set-4-slot-mode-for-a2dp.patch
 create mode 100644 queue-5.4/rtw88-fix-nss-of-hw_cap.patch
 create mode 100644 queue-5.4/s390-add-error-handling-to-perf_callchain_kernel.patch
 create mode 100644 queue-5.4/s390-bpf-use-kvcalloc-for-addrs-array.patch
 create mode 100644 queue-5.4/s390-cpumf-adjust-registration-of-s390-pmu-device-dr.patch
 create mode 100644 queue-5.4/s390-crypto-fix-unsigned-variable-compared-with-zero.patch
 create mode 100644 queue-5.4/s390-disassembler-don-t-hide-instruction-addresses.patch
 create mode 100644 queue-5.4/s390-kasan-support-memcpy_real-with-trace_irqflags.patch
 create mode 100644 queue-5.4/s390-mm-add-mm_pxd_folded-checks-to-pxd_free.patch
 create mode 100644 queue-5.4/s390-time-ensure-get_clock_monotonic-returns-monoton.patch
 create mode 100644 queue-5.4/samples-pktgen-fix-proc_cmd-command-result-check-log.patch
 create mode 100644 queue-5.4/sched-uclamp-fix-overzealous-type-replacement.patch
 create mode 100644 queue-5.4/selftests-bpf-correct-path-to-include-msg-path.patch
 create mode 100644 queue-5.4/selftests-bpf-fix-btf_dump-padding-test-case.patch
 create mode 100644 queue-5.4/selftests-bpf-fix-test_tc_tunnel-hanging.patch
 create mode 100644 queue-5.4/selftests-bpf-make-a-copy-of-subtest-name.patch
 create mode 100644 queue-5.4/selftests-bpf-workaround-an-alu32-sub-register-spill.patch
 create mode 100644 queue-5.4/selftests-fix-o-and-kbuild_output-handling-for-relat.patch
 create mode 100644 queue-5.4/selftests-net-fix-printf-format-warnings-on-arm.patch
 create mode 100644 queue-5.4/selftests-proc-make-va_max-1mb.patch
 create mode 100644 queue-5.4/series
 create mode 100644 queue-5.4/soundwire-intel-fix-pdi-stream-mapping-for-bulk.patch
 create mode 100644 queue-5.4/spi-add-call-to-spi_slave_abort-function-when-spidev.patch
 create mode 100644 queue-5.4/spi-dw-fix-designware-spi-loopback.patch
 create mode 100644 queue-5.4/spi-gpio-prevent-memory-leak-in-spi_gpio_probe.patch
 create mode 100644 queue-5.4/spi-img-spfi-fix-potential-double-release.patch
 create mode 100644 queue-5.4/spi-pxa2xx-add-missed-security-checks.patch
 create mode 100644 queue-5.4/spi-sifive-disable-clk-when-probe-fails-and-remove.patch
 create mode 100644 queue-5.4/spi-sprd-adi-add-missing-lock-protection-when-reboot.patch
 create mode 100644 queue-5.4/spi-st-ssc4-add-missed-pm_runtime_disable.patch
 create mode 100644 queue-5.4/spi-tegra20-slink-add-missed-clk_unprepare.patch
 create mode 100644 queue-5.4/staging-iio-ad9834-add-a-check-for-devm_clk_get.patch
 create mode 100644 queue-5.4/staging-rtl8188eu-fix-possible-null-dereference.patch
 create mode 100644 queue-5.4/staging-rtl8192u-fix-multiple-memory-leaks-on-error-.patch
 create mode 100644 queue-5.4/staging-wilc1000-check-if-device-is-initialzied-befo.patch
 create mode 100644 queue-5.4/staging-wilc1000-potential-corruption-in-wilc_parse_.patch
 create mode 100644 queue-5.4/syscalls-x86-use-the-correct-function-type-in-syscal.patch
 create mode 100644 queue-5.4/team-call-rcu-read-lock-when-walking-the-port_list.patch
 create mode 100644 queue-5.4/tools-bpf-fix-build-for-make-s-tools-bpf-o-dir.patch
 create mode 100644 queue-5.4/tools-memory-model-fix-data-race-detection-for-unord.patch
 create mode 100644 queue-5.4/tools-power-cpupower-fix-initializer-override-in-hsw.patch
 create mode 100644 queue-5.4/tracing-kprobe-check-whether-the-non-suffixed-symbol.patch
 create mode 100644 queue-5.4/tracing-use-kvcalloc-for-tgid_map-array-allocation.patch
 create mode 100644 queue-5.4/tun-fix-data-race-in-gro_normal_list.patch
 create mode 100644 queue-5.4/ubsan-x86-annotate-and-allow-__ubsan_handle_shift_ou.patch
 create mode 100644 queue-5.4/usb-renesas_usbhs-add-suspend-event-support-in-gadge.patch
 create mode 100644 queue-5.4/usb-usbfs-suppress-problematic-bind-and-unbind-ueven.patch
 create mode 100644 queue-5.4/x86-crash-add-a-forward-declaration-of-struct-kimage.patch
 create mode 100644 queue-5.4/x86-insn-add-some-intel-instructions-to-the-opcode-m.patch
 create mode 100644 queue-5.4/x86-ioapic-prevent-inconsistent-state-when-moving-an.patch
 create mode 100644 queue-5.4/x86-math-emu-check-__copy_from_user-result.patch
 create mode 100644 queue-5.4/x86-mce-lower-throttling-mce-messages-priority-to-wa.patch
 create mode 100644 queue-5.4/x86-mm-use-the-correct-function-type-for-native_set_.patch
 create mode 100644 queue-5.4/xen-gntdev-use-select-for-dma_shared_buffer.patch
 create mode 100644 queue-5.4/xhci-pci-allow-host-runtime-pm-as-default-also-for-i.patch

diff --git a/queue-5.4/acpi-button-add-dmi-quirk-for-medion-akoya-e2215t.patch b/queue-5.4/acpi-button-add-dmi-quirk-for-medion-akoya-e2215t.patch
new file mode 100644
index 00000000000..cbb3c363f61
--- /dev/null
+++ b/queue-5.4/acpi-button-add-dmi-quirk-for-medion-akoya-e2215t.patch
@@ -0,0 +1,55 @@
+From cab12e98774eb4c3313814436bcebeb63d2f5b7d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Oct 2019 22:24:34 +0200
+Subject: ACPI: button: Add DMI quirk for Medion Akoya E2215T
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 932e1ba486117de2fcea3df27ad8218ad6c11470 ]
+
+The Medion Akoya E2215T's ACPI _LID implementation is quite broken:
+
+ 1. For notifications it uses an ActiveLow Edge GpioInt, rather then
+    an ActiveBoth one, meaning that the device is only notified when the
+    lid is closed, not when it is opened.
+
+2. Matching with this its _LID method simply always returns 0 (closed)
+
+  In order for the Linux LID code to work properly with this implementation,
+  the lid_init_state selection needs to be set to ACPI_BUTTON_LID_INIT_OPEN.
+
+This commit adds a DMI quirk for this.
+
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/button.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/acpi/button.c b/drivers/acpi/button.c
+index 4a2cde2c536a..ce93a355bd1c 100644
+--- a/drivers/acpi/button.c
++++ b/drivers/acpi/button.c
+@@ -78,6 +78,17 @@ static const struct dmi_system_id lid_blacklst[] = {
+ 			DMI_MATCH(DMI_BIOS_VERSION, "BYT70A.YNCHENG.WIN.007"),
+ 		},
+ 	},
++	{
++		/*
++		 * Medion Akoya E2215T, notification of the LID device only
++		 * happens on close, not on open and _LID always returns closed.
++		 */
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "MEDION"),
++			DMI_MATCH(DMI_PRODUCT_NAME, "E2215T MD60198"),
++		},
++		.driver_data = (void *)(long)ACPI_BUTTON_LID_INIT_OPEN,
++	},
+ 	{}
+ };
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/alsa-bebob-expand-sleep-just-after-breaking-connecti.patch b/queue-5.4/alsa-bebob-expand-sleep-just-after-breaking-connecti.patch
new file mode 100644
index 00000000000..1f5319ad26c
--- /dev/null
+++ b/queue-5.4/alsa-bebob-expand-sleep-just-after-breaking-connecti.patch
@@ -0,0 +1,64 @@
+From a6925a1cb492721a882a8577633c107614f22a60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Nov 2019 22:13:21 +0900
+Subject: ALSA: bebob: expand sleep just after breaking connections for
+ protocol version 1
+
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+
+[ Upstream commit d3eabe939aee3ffd5b133766a932629a9746298c ]
+
+As long as I investigated, some devices with BeBoB protocol version 1
+can be freezed during several hundreds milliseconds after breaking
+connections. When accessing during the freezed time, any transaction
+is corrupted. In the worst case, the device is going to reboot.
+
+I can see this issue in:
+ * Roland FA-66
+ * M-Audio FireWire Solo
+
+This commit expands sleep just after breaking connections to avoid
+the freezed time as much as possible. I note that the freeze/reboot
+behaviour is similar to below models:
+ * Focusrite Saffire Pro 10 I/O
+ * Focusrite Saffire Pro 26 I/O
+
+The above models certainly reboot after breaking connections.
+
+Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Link: https://lore.kernel.org/r/20191101131323.17300-2-o-takashi@sakamocchi.jp
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/firewire/bebob/bebob_stream.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/sound/firewire/bebob/bebob_stream.c b/sound/firewire/bebob/bebob_stream.c
+index 6c1497d9f52b..ce07ea0d4e71 100644
+--- a/sound/firewire/bebob/bebob_stream.c
++++ b/sound/firewire/bebob/bebob_stream.c
+@@ -415,15 +415,16 @@ static int make_both_connections(struct snd_bebob *bebob)
+ 	return 0;
+ }
+ 
+-static void
+-break_both_connections(struct snd_bebob *bebob)
++static void break_both_connections(struct snd_bebob *bebob)
+ {
+ 	cmp_connection_break(&bebob->in_conn);
+ 	cmp_connection_break(&bebob->out_conn);
+ 
+-	/* These models seems to be in transition state for a longer time. */
+-	if (bebob->maudio_special_quirk != NULL)
+-		msleep(200);
++	// These models seem to be in transition state for a longer time. When
++	// accessing in the state, any transactions is corrupted. In the worst
++	// case, the device is going to reboot.
++	if (bebob->version < 2)
++		msleep(600);
+ }
+ 
+ static int
+-- 
+2.20.1
+
diff --git a/queue-5.4/alsa-hda-hdmi-implement-mst_no_extra_pcms-flag.patch b/queue-5.4/alsa-hda-hdmi-implement-mst_no_extra_pcms-flag.patch
new file mode 100644
index 00000000000..ea2917e405c
--- /dev/null
+++ b/queue-5.4/alsa-hda-hdmi-implement-mst_no_extra_pcms-flag.patch
@@ -0,0 +1,92 @@
+From 45eda6ce5a2caa04812f2fdfa55fb44d7cd69855 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Oct 2019 15:40:09 +0200
+Subject: ALSA: hda/hdmi - implement mst_no_extra_pcms flag
+
+From: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+
+[ Upstream commit 2a2edfbbfee47947dd05f5860c66c0e80ee5e09d ]
+
+To support the DP-MST multiple streams via single connector feature,
+the HDMI driver was extended with the concept of backup PCMs. See
+commit 9152085defb6 ("ALSA: hda - add DP MST audio support").
+
+This implementation works fine with snd_hda_intel.c as PCM topology
+is fully managed within the single driver.
+
+When the HDA codec driver is used from ASoC components, the concept
+of backup PCMs no longer fits. For ASoC topologies, the physical
+HDMI converters are presented as backend DAIs and these should match
+with hardware capabilities. The ASoC topology may define arbitrary
+PCMs (i.e. frontend DAIs) and have processing elements before eventual
+routing to the HDMI BE DAIs. With backup PCMs, the link between
+FE and BE DAIs would become dynamic and change when monitors are
+(un)plugged. This would lead to modifying the topology every time
+hotplug events happen, which is not currently possible in ASoC and
+there does not seem to be any obvious benefits from this design.
+
+To overcome above problems and enable the HDMI driver to be used
+from ASoC, this patch adds a new mode (mst_no_extra_pcms flags) to
+patch_hdmi.c. In this mode, the codec driver does not assume
+the backup PCMs to be created.
+
+Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Reviewed-by: Takashi Iwai <tiwai@suse.de>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20191029134017.18901-2-kai.vehmanen@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/sound/hda_codec.h  |  1 +
+ sound/pci/hda/patch_hdmi.c | 19 ++++++++++++++-----
+ 2 files changed, 15 insertions(+), 5 deletions(-)
+
+diff --git a/include/sound/hda_codec.h b/include/sound/hda_codec.h
+index 9a0393cf024c..ac18f428eda6 100644
+--- a/include/sound/hda_codec.h
++++ b/include/sound/hda_codec.h
+@@ -254,6 +254,7 @@ struct hda_codec {
+ 	unsigned int force_pin_prefix:1; /* Add location prefix */
+ 	unsigned int link_down_at_suspend:1; /* link down at runtime suspend */
+ 	unsigned int relaxed_resume:1;	/* don't resume forcibly for jack */
++	unsigned int mst_no_extra_pcms:1; /* no backup PCMs for DP-MST */
+ 
+ #ifdef CONFIG_PM
+ 	unsigned long power_on_acct;
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index 488c17c9f375..74f809b6fa31 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -2082,15 +2082,24 @@ static bool is_hdmi_pcm_attached(struct hdac_device *hdac, int pcm_idx)
+ static int generic_hdmi_build_pcms(struct hda_codec *codec)
+ {
+ 	struct hdmi_spec *spec = codec->spec;
+-	int idx;
++	int idx, pcm_num;
+ 
+ 	/*
+ 	 * for non-mst mode, pcm number is the same as before
+-	 * for DP MST mode, pcm number is (nid number + dev_num - 1)
+-	 *  dev_num is the device entry number in a pin
+-	 *
++	 * for DP MST mode without extra PCM, pcm number is same
++	 * for DP MST mode with extra PCMs, pcm number is
++	 *  (nid number + dev_num - 1)
++	 * dev_num is the device entry number in a pin
+ 	 */
+-	for (idx = 0; idx < spec->num_nids + spec->dev_num - 1; idx++) {
++
++	if (codec->mst_no_extra_pcms)
++		pcm_num = spec->num_nids;
++	else
++		pcm_num = spec->num_nids + spec->dev_num - 1;
++
++	codec_dbg(codec, "hdmi: pcm_num set to %d\n", pcm_num);
++
++	for (idx = 0; idx < pcm_num; idx++) {
+ 		struct hda_pcm *info;
+ 		struct hda_pcm_stream *pstr;
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/alsa-pcm-fix-missing-check-of-the-new-non-cached-buf.patch b/queue-5.4/alsa-pcm-fix-missing-check-of-the-new-non-cached-buf.patch
new file mode 100644
index 00000000000..455779799da
--- /dev/null
+++ b/queue-5.4/alsa-pcm-fix-missing-check-of-the-new-non-cached-buf.patch
@@ -0,0 +1,47 @@
+From 0728aea82fcd3f76b09f4707316f6513c42966fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2019 11:11:15 +0100
+Subject: ALSA: pcm: Fix missing check of the new non-cached buffer type
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 6111fd2370eecae9f11bfdc08ba097e0b51fcfd3 ]
+
+The check for the mmap support via hw_support_mmap() function misses
+the case where the device is with SNDRV_DMA_TYPE_DEV_UC, which should
+have been treated equally as SNDRV_DMA_TYPE_DEV.  Let's fix it.
+
+Note that this bug doesn't hit any practical problem, because
+SNDRV_DMA_TYPE_DEV_UC is used only for x86-specific drivers
+(snd-hda-intel and snd-intel8x0) for the specific platforms that need
+the non-cached buffers.  And, on such platforms, hw_support_mmap()
+already returns true in anyway.  That's the reason I didn't put
+Cc-to-stable mark here.  This is only for any theoretical future
+extension.
+
+Fixes: 425da159707b ("ALSA: pcm: use dma_can_mmap() to check if a device supports dma_mmap_*")
+Fixes: 42e748a0b325 ("ALSA: memalloc: Add non-cached buffer type")
+Link: https://lore.kernel.org/r/20191104101115.27311-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/pcm_native.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
+index 91c6ad58729f..c3a139436ac2 100644
+--- a/sound/core/pcm_native.c
++++ b/sound/core/pcm_native.c
+@@ -222,7 +222,8 @@ static bool hw_support_mmap(struct snd_pcm_substream *substream)
+ 		return false;
+ 
+ 	if (substream->ops->mmap ||
+-	    substream->dma_buffer.dev.type != SNDRV_DMA_TYPE_DEV)
++	    (substream->dma_buffer.dev.type != SNDRV_DMA_TYPE_DEV &&
++	     substream->dma_buffer.dev.type != SNDRV_DMA_TYPE_DEV_UC))
+ 		return true;
+ 
+ 	return dma_can_mmap(substream->dma_buffer.dev.dev);
+-- 
+2.20.1
+
diff --git a/queue-5.4/alsa-timer-limit-max-amount-of-slave-instances.patch b/queue-5.4/alsa-timer-limit-max-amount-of-slave-instances.patch
new file mode 100644
index 00000000000..a1a8d5c87f1
--- /dev/null
+++ b/queue-5.4/alsa-timer-limit-max-amount-of-slave-instances.patch
@@ -0,0 +1,70 @@
+From dac0192ea11dfce358bbe2c7a188bbe18c4ff59d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Nov 2019 16:42:57 +0100
+Subject: ALSA: timer: Limit max amount of slave instances
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit fdea53fe5de532969a332d6e5e727f2ad8bf084d ]
+
+The fuzzer tries to open the timer instances as much as possible, and
+this may cause a system hiccup easily.  We've already introduced the
+cap for the max number of available instances for the h/w timers, and
+we should put such a limit also to the slave timers, too.
+
+This patch introduces the limit to the multiple opened slave timers.
+The upper limit is hard-coded to 1000 for now, which should suffice
+for any practical usages up to now.
+
+Link: https://lore.kernel.org/r/20191106154257.5853-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/timer.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/sound/core/timer.c b/sound/core/timer.c
+index 59ae21b0bb93..013f0e69ff0f 100644
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -74,6 +74,9 @@ static LIST_HEAD(snd_timer_slave_list);
+ /* lock for slave active lists */
+ static DEFINE_SPINLOCK(slave_active_lock);
+ 
++#define MAX_SLAVE_INSTANCES	1000
++static int num_slaves;
++
+ static DEFINE_MUTEX(register_mutex);
+ 
+ static int snd_timer_free(struct snd_timer *timer);
+@@ -252,6 +255,10 @@ int snd_timer_open(struct snd_timer_instance **ti,
+ 			err = -EINVAL;
+ 			goto unlock;
+ 		}
++		if (num_slaves >= MAX_SLAVE_INSTANCES) {
++			err = -EBUSY;
++			goto unlock;
++		}
+ 		timeri = snd_timer_instance_new(owner, NULL);
+ 		if (!timeri) {
+ 			err = -ENOMEM;
+@@ -261,6 +268,7 @@ int snd_timer_open(struct snd_timer_instance **ti,
+ 		timeri->slave_id = tid->device;
+ 		timeri->flags |= SNDRV_TIMER_IFLG_SLAVE;
+ 		list_add_tail(&timeri->open_list, &snd_timer_slave_list);
++		num_slaves++;
+ 		err = snd_timer_check_slave(timeri);
+ 		if (err < 0) {
+ 			snd_timer_close_locked(timeri, &card_dev_to_put);
+@@ -356,6 +364,8 @@ static int snd_timer_close_locked(struct snd_timer_instance *timeri,
+ 	}
+ 
+ 	list_del(&timeri->open_list);
++	if (timeri->flags & SNDRV_TIMER_IFLG_SLAVE)
++		num_slaves--;
+ 
+ 	/* force to stop the timer */
+ 	snd_timer_stop(timeri);
+-- 
+2.20.1
+
diff --git a/queue-5.4/arm64-psci-reduce-the-waiting-time-for-cpu_psci_cpu_.patch b/queue-5.4/arm64-psci-reduce-the-waiting-time-for-cpu_psci_cpu_.patch
new file mode 100644
index 00000000000..16e48b7d71e
--- /dev/null
+++ b/queue-5.4/arm64-psci-reduce-the-waiting-time-for-cpu_psci_cpu_.patch
@@ -0,0 +1,73 @@
+From 0c1926a39762d54fd16c6759230af5cde056c9a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Oct 2019 19:31:21 +0800
+Subject: arm64: psci: Reduce the waiting time for cpu_psci_cpu_kill()
+
+From: Yunfeng Ye <yeyunfeng@huawei.com>
+
+[ Upstream commit bfcef4ab1d7ee8921bc322109b1692036cc6cbe0 ]
+
+In cases like suspend-to-disk and suspend-to-ram, a large number of CPU
+cores need to be shut down. At present, the CPU hotplug operation is
+serialised, and the CPU cores can only be shut down one by one. In this
+process, if PSCI affinity_info() does not return LEVEL_OFF quickly,
+cpu_psci_cpu_kill() needs to wait for 10ms. If hundreds of CPU cores
+need to be shut down, it will take a long time.
+
+Normally, there is no need to wait 10ms in cpu_psci_cpu_kill(). So
+change the wait interval from 10 ms to max 1 ms and use usleep_range()
+instead of msleep() for more accurate timer.
+
+In addition, reducing the time interval will increase the messages
+output, so remove the "Retry ..." message, instead, track time and
+output to the the sucessful message.
+
+Signed-off-by: Yunfeng Ye <yeyunfeng@huawei.com>
+Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/psci.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/arch/arm64/kernel/psci.c b/arch/arm64/kernel/psci.c
+index c9f72b2665f1..43ae4e0c968f 100644
+--- a/arch/arm64/kernel/psci.c
++++ b/arch/arm64/kernel/psci.c
+@@ -81,7 +81,8 @@ static void cpu_psci_cpu_die(unsigned int cpu)
+ 
+ static int cpu_psci_cpu_kill(unsigned int cpu)
+ {
+-	int err, i;
++	int err;
++	unsigned long start, end;
+ 
+ 	if (!psci_ops.affinity_info)
+ 		return 0;
+@@ -91,16 +92,18 @@ static int cpu_psci_cpu_kill(unsigned int cpu)
+ 	 * while it is dying. So, try again a few times.
+ 	 */
+ 
+-	for (i = 0; i < 10; i++) {
++	start = jiffies;
++	end = start + msecs_to_jiffies(100);
++	do {
+ 		err = psci_ops.affinity_info(cpu_logical_map(cpu), 0);
+ 		if (err == PSCI_0_2_AFFINITY_LEVEL_OFF) {
+-			pr_info("CPU%d killed.\n", cpu);
++			pr_info("CPU%d killed (polled %d ms)\n", cpu,
++				jiffies_to_msecs(jiffies - start));
+ 			return 0;
+ 		}
+ 
+-		msleep(10);
+-		pr_info("Retrying again to check for CPU kill\n");
+-	}
++		usleep_range(100, 1000);
++	} while (time_before(jiffies, end));
+ 
+ 	pr_warn("CPU%d may not have shut down cleanly (AFFINITY_INFO reports %d)\n",
+ 			cpu, err);
+-- 
+2.20.1
+
diff --git a/queue-5.4/asoc-intel-bytcr_rt5640-update-quirk-for-acer-switch.patch b/queue-5.4/asoc-intel-bytcr_rt5640-update-quirk-for-acer-switch.patch
new file mode 100644
index 00000000000..07f3828f3b0
--- /dev/null
+++ b/queue-5.4/asoc-intel-bytcr_rt5640-update-quirk-for-acer-switch.patch
@@ -0,0 +1,51 @@
+From 757ce9741e5ccf7f09af0999419b1af17658c0c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Nov 2019 15:51:38 +0100
+Subject: ASoC: Intel: bytcr_rt5640: Update quirk for Acer Switch 10 SW5-012
+ 2-in-1
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 0bb887709eb16bdc4b5baddd8337abf3de72917f ]
+
+When the Acer Switch 10 SW5-012 quirk was added we did not have
+jack-detection support yet; and the builtin microphone selection of
+the original quirk is wrong too.
+
+Fix the microphone-input quirk and add jack-detection info so that the
+internal-microphone and headphone/set jack on the Switch 10 work properly.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20191119145138.59162-1-hdegoede@redhat.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/bytcr_rt5640.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
+index 9c1aa4ec9cba..dd2b5ad08659 100644
+--- a/sound/soc/intel/boards/bytcr_rt5640.c
++++ b/sound/soc/intel/boards/bytcr_rt5640.c
+@@ -405,10 +405,12 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = {
+ 			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "Aspire SW5-012"),
+ 		},
+-		.driver_data = (void *)(BYT_RT5640_IN1_MAP |
+-						 BYT_RT5640_MCLK_EN |
+-						 BYT_RT5640_SSP0_AIF1),
+-
++		.driver_data = (void *)(BYT_RT5640_DMIC1_MAP |
++					BYT_RT5640_JD_SRC_JD2_IN4N |
++					BYT_RT5640_OVCD_TH_2000UA |
++					BYT_RT5640_OVCD_SF_0P75 |
++					BYT_RT5640_SSP0_AIF1 |
++					BYT_RT5640_MCLK_EN),
+ 	},
+ 	{
+ 		.matches = {
+-- 
+2.20.1
+
diff --git a/queue-5.4/asoc-intel-kbl_rt5663_rt5514_max98927-add-dmic-forma.patch b/queue-5.4/asoc-intel-kbl_rt5663_rt5514_max98927-add-dmic-forma.patch
new file mode 100644
index 00000000000..ef5684b657c
--- /dev/null
+++ b/queue-5.4/asoc-intel-kbl_rt5663_rt5514_max98927-add-dmic-forma.patch
@@ -0,0 +1,40 @@
+From f27a0dc65d6be39617b1c33d6a306545c82dec6b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Sep 2019 00:29:40 +0800
+Subject: ASoC: Intel: kbl_rt5663_rt5514_max98927: Add dmic format constraint
+
+From: Yu-Hsuan Hsu <yuhsuan@chromium.org>
+
+[ Upstream commit e2db787bdcb4f2722ecf410168f0583764634e45 ]
+
+On KBL platform, the microphone is attached to external codec(rt5514)
+instead of PCH. However, TDM slot between PCH and codec is 16 bits only.
+In order to avoid setting wrong format, we should add a constraint to
+force to use 16 bits format forever.
+
+Signed-off-by: Yu-Hsuan Hsu <yuhsuan@chromium.org>
+Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20190923162940.199580-1-yuhsuan@chromium.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c b/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c
+index 74dda8784f1a..67b276a65a8d 100644
+--- a/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c
++++ b/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c
+@@ -400,6 +400,9 @@ static int kabylake_dmic_startup(struct snd_pcm_substream *substream)
+ 	snd_pcm_hw_constraint_list(runtime, 0, SNDRV_PCM_HW_PARAM_CHANNELS,
+ 			dmic_constraints);
+ 
++	runtime->hw.formats = SNDRV_PCM_FMTBIT_S16_LE;
++	snd_pcm_hw_constraint_msbits(runtime, 0, 16, 16);
++
+ 	return snd_pcm_hw_constraint_list(substream->runtime, 0,
+ 			SNDRV_PCM_HW_PARAM_RATE, &constraints_rates);
+ }
+-- 
+2.20.1
+
diff --git a/queue-5.4/asoc-rt5677-mark-reg-rt5677_pwr_anlg2-as-volatile.patch b/queue-5.4/asoc-rt5677-mark-reg-rt5677_pwr_anlg2-as-volatile.patch
new file mode 100644
index 00000000000..96a64797d03
--- /dev/null
+++ b/queue-5.4/asoc-rt5677-mark-reg-rt5677_pwr_anlg2-as-volatile.patch
@@ -0,0 +1,43 @@
+From 0f730ef4d53aec30e8176f092f56888387bdb387 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Nov 2019 17:13:30 -0800
+Subject: ASoC: rt5677: Mark reg RT5677_PWR_ANLG2 as volatile
+
+From: Ben Zhang <benzh@chromium.org>
+
+[ Upstream commit eabf424f7b60246c76dcb0ea6f1e83ef9abbeaa6 ]
+
+The codec dies when RT5677_PWR_ANLG2(MX-64h) is set to 0xACE1
+while it's streaming audio over SPI. The DSP firmware turns
+on PLL2 (MX-64 bit 8) when SPI streaming starts.  However regmap
+does not believe that register can change by itself. When
+BST1 (bit 15) is turned on with regmap_update_bits(), it doesn't
+read the register first before write, so PLL2 power bit is
+cleared by accident.
+
+Marking MX-64h as volatile in regmap solved the issue.
+
+Signed-off-by: Ben Zhang <benzh@chromium.org>
+Signed-off-by: Curtis Malainey <cujomalainey@chromium.org>
+Link: https://lore.kernel.org/r/20191106011335.223061-6-cujomalainey@chromium.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rt5677.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/codecs/rt5677.c b/sound/soc/codecs/rt5677.c
+index 315a3d39bc09..8bc9450da79c 100644
+--- a/sound/soc/codecs/rt5677.c
++++ b/sound/soc/codecs/rt5677.c
+@@ -298,6 +298,7 @@ static bool rt5677_volatile_register(struct device *dev, unsigned int reg)
+ 	case RT5677_I2C_MASTER_CTRL7:
+ 	case RT5677_I2C_MASTER_CTRL8:
+ 	case RT5677_HAP_GENE_CTRL2:
++	case RT5677_PWR_ANLG2: /* Modified by DSP firmware */
+ 	case RT5677_PWR_DSP_ST:
+ 	case RT5677_PRIV_DATA:
+ 	case RT5677_ASRC_22:
+-- 
+2.20.1
+
diff --git a/queue-5.4/asoc-soc-pcm-check-symmetry-before-hw_params.patch b/queue-5.4/asoc-soc-pcm-check-symmetry-before-hw_params.patch
new file mode 100644
index 00000000000..042133428c0
--- /dev/null
+++ b/queue-5.4/asoc-soc-pcm-check-symmetry-before-hw_params.patch
@@ -0,0 +1,62 @@
+From a14a4e3d18dad8c5179eb325c67442c389f4b5b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Nov 2019 18:46:42 +0800
+Subject: ASoC: soc-pcm: check symmetry before hw_params
+
+From: Shengjiu Wang <shengjiu.wang@nxp.com>
+
+[ Upstream commit 5cca59516de5df9de6bdecb328dd55fb5bcccb41 ]
+
+This reverts commit 957ce0c6b8a1f (ASoC: soc-pcm: check symmetry after
+hw_params).
+
+That commit cause soc_pcm_params_symmetry can't take effect.
+cpu_dai->rate, cpu_dai->channels and cpu_dai->sample_bits
+are updated in the middle of soc_pcm_hw_params, so move
+soc_pcm_params_symmetry to the end of soc_pcm_hw_params is
+not a good solution, for judgement of symmetry in the function
+is always true.
+
+FIXME:
+According to the comments of that commit, I think the case
+described in the commit should disable symmetric_rates
+in Back-End, rather than changing the position of
+soc_pcm_params_symmetry.
+
+Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
+Link: https://lore.kernel.org/r/1573555602-5403-1-git-send-email-shengjiu.wang@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-pcm.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
+index cdce96a3051b..a6e96cf1d8ff 100644
+--- a/sound/soc/soc-pcm.c
++++ b/sound/soc/soc-pcm.c
+@@ -877,6 +877,11 @@ static int soc_pcm_hw_params(struct snd_pcm_substream *substream,
+ 	int i, ret = 0;
+ 
+ 	mutex_lock_nested(&rtd->card->pcm_mutex, rtd->card->pcm_subclass);
++
++	ret = soc_pcm_params_symmetry(substream, params);
++	if (ret)
++		goto out;
++
+ 	if (rtd->dai_link->ops->hw_params) {
+ 		ret = rtd->dai_link->ops->hw_params(substream, params);
+ 		if (ret < 0) {
+@@ -958,9 +963,6 @@ static int soc_pcm_hw_params(struct snd_pcm_substream *substream,
+ 	}
+ 	component = NULL;
+ 
+-	ret = soc_pcm_params_symmetry(substream, params);
+-        if (ret)
+-		goto component_err;
+ out:
+ 	mutex_unlock(&rtd->card->pcm_mutex);
+ 	return ret;
+-- 
+2.20.1
+
diff --git a/queue-5.4/asoc-soc-pcm-fixup-dpcm_prune_paths-loop-continue.patch b/queue-5.4/asoc-soc-pcm-fixup-dpcm_prune_paths-loop-continue.patch
new file mode 100644
index 00000000000..929b34f3d70
--- /dev/null
+++ b/queue-5.4/asoc-soc-pcm-fixup-dpcm_prune_paths-loop-continue.patch
@@ -0,0 +1,77 @@
+From 64b275e6f694d9c57e00e5f045ae71b3149874b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Oct 2019 12:59:38 +0900
+Subject: ASoC: soc-pcm: fixup dpcm_prune_paths() loop continue
+
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+
+[ Upstream commit bed646dc3f7bcec91178c278deaf969cce0700a8 ]
+
+dpcm_prune_paths() is checking widget at 2 parts.
+(A) is for CPU, (B) is for Codec.
+If we focus to (A) part, continue at (a) is for (1) loop. But,
+if we focus to (B) part, continue at (b) is for (2) loop, not for (1).
+This is bug.
+This patch fixup this issue.
+
+	static int dpcm_prune_paths(...)
+	{
+		...
+   (1)		for_each_dpcm_be(fe, stream, dpcm) {
+			...
+
+ ^			widget = dai_get_widget(...);
+ |
+(A)			if (widget && widget_in_list(...))
+ | (a)				continue;
+ v
+ ^ (2)			for_each_rtd_codec_dai(...) {
+ |				widget = dai_get_widget(...);
+(B)
+ |				if (widget && widget_in_list(...))
+ v (b)					continue;
+			}
+			...
+
+Fixes: 2e5894d73789 ("ASoC: pcm: Add support for DAI multicodec")
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Link: https://lore.kernel.org/r/87blui64mf.wl-kuninori.morimoto.gx@renesas.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-pcm.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
+index b600d3eaaf5c..cdce96a3051b 100644
+--- a/sound/soc/soc-pcm.c
++++ b/sound/soc/soc-pcm.c
+@@ -1385,6 +1385,7 @@ static int dpcm_prune_paths(struct snd_soc_pcm_runtime *fe, int stream,
+ 	struct snd_soc_dapm_widget *widget;
+ 	struct snd_soc_dai *dai;
+ 	int prune = 0;
++	int do_prune;
+ 
+ 	/* Destroy any old FE <--> BE connections */
+ 	for_each_dpcm_be(fe, stream, dpcm) {
+@@ -1398,13 +1399,16 @@ static int dpcm_prune_paths(struct snd_soc_pcm_runtime *fe, int stream,
+ 			continue;
+ 
+ 		/* is there a valid CODEC DAI widget for this BE */
++		do_prune = 1;
+ 		for_each_rtd_codec_dai(dpcm->be, i, dai) {
+ 			widget = dai_get_widget(dai, stream);
+ 
+ 			/* prune the BE if it's no longer in our active list */
+ 			if (widget && widget_in_list(list, widget))
+-				continue;
++				do_prune = 0;
+ 		}
++		if (!do_prune)
++			continue;
+ 
+ 		dev_dbg(fe->dev, "ASoC: pruning %s BE %s for %s\n",
+ 			stream ? "capture" : "playback",
+-- 
+2.20.1
+
diff --git a/queue-5.4/asoc-sof-enable-sync_write-in-hdac_bus.patch b/queue-5.4/asoc-sof-enable-sync_write-in-hdac_bus.patch
new file mode 100644
index 00000000000..6305db6b264
--- /dev/null
+++ b/queue-5.4/asoc-sof-enable-sync_write-in-hdac_bus.patch
@@ -0,0 +1,44 @@
+From db150ad94edf892ee32c2e669cc5ad432b4dd89b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2019 11:44:35 -0500
+Subject: ASoC: SOF: enable sync_write in hdac_bus
+
+From: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+
+[ Upstream commit f3416e7144f5d4ba0fc5dcef6ebfff891266c46a ]
+
+Align SOF HDA implementation with snd-hda-intel driver and enable
+sync_write flag for all supported Intel platforms in SOF. When set,
+a sync is issued after each verb write.
+
+Sync after write has helped to overcome intermittent delays in
+system resume flow on Intel Coffee Lake systems, and most recently
+probe errors related to the HDMI codec on Ice Lake systems.
+
+Matches the snd-hda-intel driver change done in commit 2756d9143aa5
+("ALSA: hda - Fix intermittent CORB/RIRB stall on Intel chips").
+
+Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20191008164443.1358-2-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/intel/hda.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/sof/intel/hda.c b/sound/soc/sof/intel/hda.c
+index 06e84679087b..5a5163eef2ef 100644
+--- a/sound/soc/sof/intel/hda.c
++++ b/sound/soc/sof/intel/hda.c
+@@ -268,6 +268,7 @@ static int hda_init(struct snd_sof_dev *sdev)
+ 
+ 	bus->use_posbuf = 1;
+ 	bus->bdl_pos_adj = 0;
++	bus->sync_write = 1;
+ 
+ 	mutex_init(&hbus->prepare_mutex);
+ 	hbus->pci = pci;
+-- 
+2.20.1
+
diff --git a/queue-5.4/asoc-sof-imx-fix-reverse-config_snd_soc_sof_of-depen.patch b/queue-5.4/asoc-sof-imx-fix-reverse-config_snd_soc_sof_of-depen.patch
new file mode 100644
index 00000000000..38f87c44c32
--- /dev/null
+++ b/queue-5.4/asoc-sof-imx-fix-reverse-config_snd_soc_sof_of-depen.patch
@@ -0,0 +1,58 @@
+From 196a15f192317138bf9386340d548f444284b9d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Nov 2019 12:30:39 -0500
+Subject: ASoC: SOF: imx: fix reverse CONFIG_SND_SOC_SOF_OF dependency
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit f9ad75468453b019b92c5296e6a04bf7c37f49e4 ]
+
+updated solution to the problem reported with randconfig:
+
+CONFIG_SND_SOC_SOF_IMX depends on CONFIG_SND_SOC_SOF, but is in
+turn referenced by the sof-of-dev driver. This creates a reverse
+dependency that manifests in a link error when CONFIG_SND_SOC_SOF_OF
+is built-in but CONFIG_SND_SOC_SOF_IMX=m:
+
+sound/soc/sof/sof-of-dev.o:(.data+0x118): undefined reference to `sof_imx8_ops'
+
+use def_trisate to propagate the right settings without select.
+
+Fixes: f4df4e4042b0 ("ASoC: SOF: imx8: Fix COMPILE_TEST error")
+Fixes: 202acc565a1f ("ASoC: SOF: imx: Add i.MX8 HW support")
+Suggested-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20191101173045.27099-6-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/imx/Kconfig | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/sof/imx/Kconfig b/sound/soc/sof/imx/Kconfig
+index 5acae75f5750..71f318bc2c74 100644
+--- a/sound/soc/sof/imx/Kconfig
++++ b/sound/soc/sof/imx/Kconfig
+@@ -11,8 +11,8 @@ config SND_SOC_SOF_IMX_TOPLEVEL
+ 
+ if SND_SOC_SOF_IMX_TOPLEVEL
+ 
+-config SND_SOC_SOF_IMX8
+-	tristate "SOF support for i.MX8"
++config SND_SOC_SOF_IMX8_SUPPORT
++	bool "SOF support for i.MX8"
+ 	depends on IMX_SCU
+ 	depends on IMX_DSP
+ 	help
+@@ -20,4 +20,8 @@ config SND_SOC_SOF_IMX8
+           Say Y if you have such a device.
+           If unsure select "N".
+ 
++config SND_SOC_SOF_IMX8
++	def_tristate SND_SOC_SOF_OF
++	depends on SND_SOC_SOF_IMX8_SUPPORT
++
+ endif ## SND_SOC_SOF_IMX_IMX_TOPLEVEL
+-- 
+2.20.1
+
diff --git a/queue-5.4/asoc-sof-topology-set-trigger-order-for-fe-dai-link.patch b/queue-5.4/asoc-sof-topology-set-trigger-order-for-fe-dai-link.patch
new file mode 100644
index 00000000000..2a87baf5e04
--- /dev/null
+++ b/queue-5.4/asoc-sof-topology-set-trigger-order-for-fe-dai-link.patch
@@ -0,0 +1,40 @@
+From c2bdc507cafc93b82689c679e26db11960e5ed1d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2019 14:48:12 -0800
+Subject: ASoC: SOF: topology: set trigger order for FE DAI link
+
+From: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+
+[ Upstream commit 5eee2b3f60065a2530d13f28e771be48b989eb4c ]
+
+Set trigger order for FE DAI links to SND_SOC_DPCM_TRIGGER_POST
+to trigger the BE DAI's before the FE DAI's. This prevents the
+xruns seen on playback pipelines using the link DMA.
+
+Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20191104224812.3393-3-ranjani.sridharan@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/topology.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/sound/soc/sof/topology.c b/sound/soc/sof/topology.c
+index 4452594c2e17..fa299e078156 100644
+--- a/sound/soc/sof/topology.c
++++ b/sound/soc/sof/topology.c
+@@ -2828,6 +2828,10 @@ static int sof_link_load(struct snd_soc_component *scomp, int index,
+ 	if (!link->no_pcm) {
+ 		link->nonatomic = true;
+ 
++		/* set trigger order */
++		link->trigger[0] = SND_SOC_DPCM_TRIGGER_POST;
++		link->trigger[1] = SND_SOC_DPCM_TRIGGER_POST;
++
+ 		/* nothing more to do for FE dai links */
+ 		return 0;
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-5.4/asoc-wm2200-add-missed-operations-in-remove-and-prob.patch b/queue-5.4/asoc-wm2200-add-missed-operations-in-remove-and-prob.patch
new file mode 100644
index 00000000000..da5a45be545
--- /dev/null
+++ b/queue-5.4/asoc-wm2200-add-missed-operations-in-remove-and-prob.patch
@@ -0,0 +1,53 @@
+From ef0e572540dc1444b6d76e97d9ec2af20d69a41b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Nov 2019 15:36:33 +0800
+Subject: ASoC: wm2200: add missed operations in remove and probe failure
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+[ Upstream commit 2dab09be49a1e7a4dd13cb47d3a1441a2ef33a87 ]
+
+This driver misses calls to pm_runtime_disable and regulator_bulk_disable
+in remove and a call to free_irq in probe failure.
+Add the calls to fix it.
+
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Link: https://lore.kernel.org/r/20191118073633.28237-1-hslester96@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm2200.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/sound/soc/codecs/wm2200.c b/sound/soc/codecs/wm2200.c
+index cf64e109c658..7b087d94141b 100644
+--- a/sound/soc/codecs/wm2200.c
++++ b/sound/soc/codecs/wm2200.c
+@@ -2410,6 +2410,8 @@ static int wm2200_i2c_probe(struct i2c_client *i2c,
+ 
+ err_pm_runtime:
+ 	pm_runtime_disable(&i2c->dev);
++	if (i2c->irq)
++		free_irq(i2c->irq, wm2200);
+ err_reset:
+ 	if (wm2200->pdata.reset)
+ 		gpio_set_value_cansleep(wm2200->pdata.reset, 0);
+@@ -2426,12 +2428,15 @@ static int wm2200_i2c_remove(struct i2c_client *i2c)
+ {
+ 	struct wm2200_priv *wm2200 = i2c_get_clientdata(i2c);
+ 
++	pm_runtime_disable(&i2c->dev);
+ 	if (i2c->irq)
+ 		free_irq(i2c->irq, wm2200);
+ 	if (wm2200->pdata.reset)
+ 		gpio_set_value_cansleep(wm2200->pdata.reset, 0);
+ 	if (wm2200->pdata.ldo_ena)
+ 		gpio_set_value_cansleep(wm2200->pdata.ldo_ena, 0);
++	regulator_bulk_disable(ARRAY_SIZE(wm2200->core_supplies),
++			       wm2200->core_supplies);
+ 
+ 	return 0;
+ }
+-- 
+2.20.1
+
diff --git a/queue-5.4/asoc-wm5100-add-missed-pm_runtime_disable.patch b/queue-5.4/asoc-wm5100-add-missed-pm_runtime_disable.patch
new file mode 100644
index 00000000000..db86956d10a
--- /dev/null
+++ b/queue-5.4/asoc-wm5100-add-missed-pm_runtime_disable.patch
@@ -0,0 +1,45 @@
+From b465ba042b645be9e8e371e69ed97752728467dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Nov 2019 15:37:07 +0800
+Subject: ASoC: wm5100: add missed pm_runtime_disable
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+[ Upstream commit b1176bbb70866f24099cd2720283c7219fb4a81c ]
+
+The driver forgets to call pm_runtime_disable in remove and
+probe failure.
+Add the calls to fix it.
+
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20191118073707.28298-1-hslester96@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm5100.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/soc/codecs/wm5100.c b/sound/soc/codecs/wm5100.c
+index 4af0e519e623..91cc63c5a51f 100644
+--- a/sound/soc/codecs/wm5100.c
++++ b/sound/soc/codecs/wm5100.c
+@@ -2617,6 +2617,7 @@ static int wm5100_i2c_probe(struct i2c_client *i2c,
+ 	return ret;
+ 
+ err_reset:
++	pm_runtime_disable(&i2c->dev);
+ 	if (i2c->irq)
+ 		free_irq(i2c->irq, wm5100);
+ 	wm5100_free_gpio(i2c);
+@@ -2640,6 +2641,7 @@ static int wm5100_i2c_remove(struct i2c_client *i2c)
+ {
+ 	struct wm5100_priv *wm5100 = i2c_get_clientdata(i2c);
+ 
++	pm_runtime_disable(&i2c->dev);
+ 	if (i2c->irq)
+ 		free_irq(i2c->irq, wm5100);
+ 	wm5100_free_gpio(i2c);
+-- 
+2.20.1
+
diff --git a/queue-5.4/asoc-wm8904-fix-regcache-handling.patch b/queue-5.4/asoc-wm8904-fix-regcache-handling.patch
new file mode 100644
index 00000000000..1481bbad486
--- /dev/null
+++ b/queue-5.4/asoc-wm8904-fix-regcache-handling.patch
@@ -0,0 +1,41 @@
+From 3751f71fddca77d002efd9bafe1c09e0544103d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Nov 2019 23:36:29 +0100
+Subject: ASoC: wm8904: fix regcache handling
+
+From: Michael Walle <michael@walle.cc>
+
+[ Upstream commit e9149b8c00d25dbaef1aa174fc604bed207e576d ]
+
+The current code assumes that the power is turned off in
+SND_SOC_BIAS_OFF. If there are no actual regulator the codec isn't
+turned off and the registers are not reset to their default values but
+the regcache is still marked as dirty. Thus a value might not be written
+to the hardware if it is set to the default value. Do a software reset
+before turning off the power to make sure the registers are always reset
+to their default states.
+
+Signed-off-by: Michael Walle <michael@walle.cc>
+Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20191112223629.21867-1-michael@walle.cc
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8904.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/codecs/wm8904.c b/sound/soc/codecs/wm8904.c
+index bcb3c9d5abf0..9e8c564f6e9c 100644
+--- a/sound/soc/codecs/wm8904.c
++++ b/sound/soc/codecs/wm8904.c
+@@ -1917,6 +1917,7 @@ static int wm8904_set_bias_level(struct snd_soc_component *component,
+ 		snd_soc_component_update_bits(component, WM8904_BIAS_CONTROL_0,
+ 				    WM8904_BIAS_ENA, 0);
+ 
++		snd_soc_component_write(component, WM8904_SW_RESET_AND_ID, 0);
+ 		regcache_cache_only(wm8904->regmap, true);
+ 		regcache_mark_dirty(wm8904->regmap);
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/ath10k-add-cleanup-in-ath10k_sta_state.patch b/queue-5.4/ath10k-add-cleanup-in-ath10k_sta_state.patch
new file mode 100644
index 00000000000..f4dca25dd11
--- /dev/null
+++ b/queue-5.4/ath10k-add-cleanup-in-ath10k_sta_state.patch
@@ -0,0 +1,41 @@
+From eb529c99b4cc6c0a76f35e847079eea531dedf97 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Aug 2019 16:04:31 -0500
+Subject: ath10k: add cleanup in ath10k_sta_state()
+
+From: Wenwen Wang <wenwen@cs.uga.edu>
+
+[ Upstream commit 334f5b61a6f29834e881923b98d1e27e5ce9620d ]
+
+If 'sta->tdls' is false, no cleanup is executed, leading to memory/resource
+leaks, e.g., 'arsta->tx_stats'. To fix this issue, perform cleanup before
+go to the 'exit' label.
+
+Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/mac.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
+index a6d21856b7e7..40889b79fc70 100644
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -6549,8 +6549,12 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
+ 
+ 		spin_unlock_bh(&ar->data_lock);
+ 
+-		if (!sta->tdls)
++		if (!sta->tdls) {
++			ath10k_peer_delete(ar, arvif->vdev_id, sta->addr);
++			ath10k_mac_dec_num_stations(arvif, sta);
++			kfree(arsta->tx_stats);
+ 			goto exit;
++		}
+ 
+ 		ret = ath10k_wmi_update_fw_tdls_state(ar, arvif->vdev_id,
+ 						      WMI_TDLS_ENABLE_ACTIVE);
+-- 
+2.20.1
+
diff --git a/queue-5.4/ath10k-check-if-station-exists-before-forwarding-tx-.patch b/queue-5.4/ath10k-check-if-station-exists-before-forwarding-tx-.patch
new file mode 100644
index 00000000000..0513577b8fc
--- /dev/null
+++ b/queue-5.4/ath10k-check-if-station-exists-before-forwarding-tx-.patch
@@ -0,0 +1,93 @@
+From cacd001dc82871ef1a44f1cd986fc3d24364a2f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 18 Aug 2019 21:09:20 +0200
+Subject: ath10k: Check if station exists before forwarding tx airtime report
+
+From: Hauke Mehrtens <hauke@hauke-m.de>
+
+[ Upstream commit b10f32672946ad638a430cc4289029b7acf8e979 ]
+
+It looks like the FW on QCA9984 already reports the tx airtimes before
+the station is added to the peer entry. The peer entry is created in
+ath10k_peer_map_event() just with the vdev_id and the ethaddr, but
+not with a station entry, this is added later in ath10k_peer_create() in
+callbacks from mac80211.
+
+When there is no sta added to the peer entry, this function fails
+because it calls ieee80211_sta_register_airtime() with NULL.
+
+This was reported in OpenWrt some time ago:
+https://bugs.openwrt.org/index.php?do=details&task_id=2414
+
+This commit should fix this crash:
+[   75.991714] Unable to handle kernel paging request at virtual address fffff9e8
+[   75.991756] pgd = c0204000
+[   75.997955] [fffff9e8] *pgd=5fdfd861, *pte=00000000, *ppte=00000000
+[   76.000537] Internal error: Oops: 37 [#1] SMP ARM
+[   76.006686] Modules linked in: pppoe ppp_async ath10k_pci ath10k_core ath pptp pppox ppp_mppe ppp_generic mac80211 iptable_nat ipt_REJECT ipt_MASQUERADE cfg80211 xt_time xt_tcpudp xt_tcpmss xt_statistic xt_state xt_recent xt_nat xt_multiport xt_mark xt_mac xt_limit xt_length xt_hl xt_helper xt_esp xt_ecn xt_dscp xt_conntrack xt_connmark xt_connlimit xt_connbytes xt_comment xt_TCPMSS xt_REDIRECT xt_LOG xt_HL xt_FLOWOFFLOAD xt_DSCP xt_CT xt_CLASSIFY usbserial slhc nf_reject_ipv4 nf_nat_redirect nf_nat_masquerade_ipv4 nf_conntrack_ipv4 nf_nat_ipv4 nf_log_ipv4 nf_flow_table_hw nf_flow_table nf_defrag_ipv4 nf_conntrack_rtcache nf_conntrack_netlink iptable_raw iptable_mangle iptable_filter ipt_ah ipt_ECN ip_tables crc_ccitt compat chaoskey fuse sch_cake sch_tbf sch_ingress sch_htb sch_hfsc em_u32 cls_u32
+[   76.059974]  cls_tcindex cls_route cls_matchall cls_fw cls_flow cls_basic act_skbedit act_mirred ledtrig_usbport xt_set ip_set_list_set ip_set_hash_netportnet ip_set_hash_netport ip_set_hash_netnet ip_set_hash_netiface ip_set_hash_net ip_set_hash_mac ip_set_hash_ipportnet ip_set_hash_ipportip ip_set_hash_ipport ip_set_hash_ipmark ip_set_hash_ip ip_set_bitmap_port ip_set_bitmap_ipmac ip_set_bitmap_ip ip_set nfnetlink ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6t_NPT ip6t_MASQUERADE nf_nat_masquerade_ipv6 nf_nat nf_conntrack nf_log_ipv6 nf_log_common ip6table_mangle ip6table_filter ip6_tables ip6t_REJECT x_tables nf_reject_ipv6 msdos ip_gre gre ifb sit tunnel4 ip_tunnel tun vfat fat hfsplus cifs nls_utf8 nls_iso8859_15 nls_iso8859_1 nls_cp850 nls_cp437 nls_cp1250 sha1_generic md5 md4
+[   76.130634]  usb_storage leds_gpio xhci_plat_hcd xhci_pci xhci_hcd dwc3 dwc3_of_simple ohci_platform ohci_hcd phy_qcom_dwc3 ahci ehci_platform sd_mod ahci_platform libahci_platform libahci libata scsi_mod ehci_hcd gpio_button_hotplug ext4 mbcache jbd2 exfat crc32c_generic
+[   76.154772] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.14.132 #0
+[   76.177001] Hardware name: Generic DT based system
+[   76.182990] task: c0b06d80 task.stack: c0b00000
+[   76.187832] PC is at ieee80211_sta_register_airtime+0x24/0x148 [mac80211]
+[   76.192211] LR is at ath10k_htt_t2h_msg_handler+0x678/0x10f4 [ath10k_core]
+[   76.199052] pc : [<bf75bfac>]    lr : [<bf83e8b0>]    psr: a0000113
+[   76.205820] sp : c0b01d54  ip : 00000002  fp : bf869c0c
+[   76.211981] r10: 0000003c  r9 : dbdca138  r8 : 00060002
+[   76.217192] r7 : 00000000  r6 : dabe1150  r5 : 00000000  r4 : dbdc95c0
+[   76.222401] r3 : 00000000  r2 : 00060002  r1 : 00000000  r0 : 00000000
+[   76.229003] Flags: NzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
+[   76.235509] Control: 10c5787d  Table: 5c94006a  DAC: 00000051
+[   76.242716] Process swapper/0 (pid: 0, stack limit = 0xc0b00210)
+[   76.248446] Stack: (0xc0b01d54 to 0xc0b02000)
+[   76.254532] 1d40:                                              dbdc95c0 00000000 dabe1150
+[   76.258808] 1d60: 00000001 dabe1150 dbdca138 0000003c bf869c0c bf83e8b0 00000002 c0314b10
+[   76.266969] 1d80: dbdc9c70 00000001 00000001 dabe114c 00010000 00000000 dbdcd724 bf88f3d8
+[   76.275126] 1da0: c0310d28 db393c00 dbdc95c0 00000000 c0b01dd0 c07fb4c4 dbdcd724 00000001
+[   76.283286] 1dc0: 00000022 bf88b09c db393c00 00000022 c0b01dd0 c0b01dd0 00000000 dbdcc5c0
+[   76.291445] 1de0: bf88f04c dbdcd654 dbdcd71c dbdc95c0 00000014 dbdcd724 dbdcc5c0 00000005
+[   76.299605] 1e00: 0004b400 bf85c360 00000000 bf87101c c0b01e24 00000006 00000000 dbdc95c0
+[   76.307764] 1e20: 00000001 00000040 0000012c c0b01e80 1cf51000 bf85c448 dbdcd440 dbdc95c0
+[   76.315925] 1e40: dbdca440 ffffa880 00000040 bf88cb68 dbdcd440 00000001 00000040 ffffa880
+[   76.324084] 1e60: c0b02d00 c06d72e0 dd990080 c0a3f080 c0b255dc c0b047e4 c090afac c090e80c
+[   76.332244] 1e80: c0b01e80 c0b01e80 c0b01e88 c0b01e88 dd4cc200 00000000 00000003 c0b0208c
+[   76.340405] 1ea0: c0b02080 40000003 ffffe000 00000100 c0b02080 c03015c8 00000000 00000001
+[   76.348564] 1ec0: dd408000 c0a38210 c0b2c7c0 0000000a ffffa880 c0b02d00 c07fb764 00200102
+[   76.356723] 1ee0: dd4cc268 c0a3e414 00000000 00000000 00000001 dd408000 de803000 00000000
+[   76.364883] 1f00: 00000000 c03247cc c0a3e414 c0368f1c c0b03f60 c0b153cc de80200c de802000
+[   76.373042] 1f20: c0b01f48 c0301488 c0308630 60000013 ffffffff c0b01f7c 00000000 c0b00000
+[   76.381204] 1f40: 00000000 c030c08c 00000001 00000000 00000000 c0315180 ffffe000 c0b03cc0
+[   76.389363] 1f60: c0b03c70 00000000 00000000 c0a2da28 00000000 00000000 c0b01f90 c0b01f98
+[   76.397522] 1f80: c030862c c0308630 60000013 ffffffff 00000051 00000000 ffffe000 c035dd18
+[   76.405681] 1fa0: 000000bf c0b03c40 00000000 c0b2c000 dddfce80 c035e060 c0b2c040 c0a00cf4
+[   76.413842] 1fc0: ffffffff ffffffff 00000000 c0a0067c c0a2da28 00000000 00000000 c0b2c1d4
+[   76.422001] 1fe0: c0b03c5c c0a2da24 c0b07ee0 4220406a 512f04d0 4220807c 00000000 00000000
+[   76.430335] [<bf75bfac>] (ieee80211_sta_register_airtime [mac80211]) from [<00000002>] (0x2)
+[   76.438314] Code: e1cd81f0 e1a08002 e1cda1f8 e58de020 (e5102618)
+[   76.446965] ---[ end trace 227a38ade964d642 ]---
+
+Fixes: bb31b7cb106c ("ath10k: report tx airtime provided by fw")
+Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/htt_rx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
+index 53f1095de8ff..9f0e7b4943ec 100644
+--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
++++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
+@@ -2726,7 +2726,7 @@ static void ath10k_htt_rx_tx_compl_ind(struct ath10k *ar,
+ 		spin_lock_bh(&ar->data_lock);
+ 
+ 		peer = ath10k_peer_find_by_id(ar, peer_id);
+-		if (!peer) {
++		if (!peer || !peer->sta) {
+ 			spin_unlock_bh(&ar->data_lock);
+ 			rcu_read_unlock();
+ 			continue;
+-- 
+2.20.1
+
diff --git a/queue-5.4/ath10k-correct-error-handling-of-dma_map_single.patch b/queue-5.4/ath10k-correct-error-handling-of-dma_map_single.patch
new file mode 100644
index 00000000000..a7523bb1d13
--- /dev/null
+++ b/queue-5.4/ath10k-correct-error-handling-of-dma_map_single.patch
@@ -0,0 +1,44 @@
+From 71304588938ac4f7fbf84fd61bbe095dca027948 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Oct 2019 11:28:17 -0700
+Subject: ath10k: Correct error handling of dma_map_single()
+
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+
+[ Upstream commit d43810b2c1808ac865aa1a2a2c291644bf95345c ]
+
+The return value of dma_map_single() should be checked for errors using
+dma_mapping_error() and the skb has been dequeued so it needs to be
+freed.
+
+This was found when enabling CONFIG_DMA_API_DEBUG and it warned about the
+missing dma_mapping_error() call.
+
+Fixes: 1807da49733e ("ath10k: wmi: add management tx by reference support over wmi")
+Reported-by: Niklas Cassel <niklas.cassel@linaro.org>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/mac.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
+index a40e1a998f4c..2b53ea6ca205 100644
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -3903,8 +3903,10 @@ void ath10k_mgmt_over_wmi_tx_work(struct work_struct *work)
+ 			     ar->running_fw->fw_file.fw_features)) {
+ 			paddr = dma_map_single(ar->dev, skb->data,
+ 					       skb->len, DMA_TO_DEVICE);
+-			if (!paddr)
++			if (dma_mapping_error(ar->dev, paddr)) {
++				ieee80211_free_txskb(ar->hw, skb);
+ 				continue;
++			}
+ 			ret = ath10k_wmi_mgmt_tx_send(ar, skb, paddr);
+ 			if (ret) {
+ 				ath10k_warn(ar, "failed to transmit management frame by ref via WMI: %d\n",
+-- 
+2.20.1
+
diff --git a/queue-5.4/ath10k-fix-backtrace-on-coredump.patch b/queue-5.4/ath10k-fix-backtrace-on-coredump.patch
new file mode 100644
index 00000000000..f82f208c400
--- /dev/null
+++ b/queue-5.4/ath10k-fix-backtrace-on-coredump.patch
@@ -0,0 +1,74 @@
+From d64caa751a4f5beecbe49082d5f2d91121f0b30d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Sep 2019 19:07:01 +0530
+Subject: ath10k: fix backtrace on coredump
+
+From: Anilkumar Kolli <akolli@codeaurora.org>
+
+[ Upstream commit d98ddae85a4a57124f87960047b1b6419312147f ]
+
+In a multiradio board with one QCA9984 and one AR9987
+after enabling the crashdump with module parameter
+coredump_mask=7, below backtrace is seen.
+
+vmalloc: allocation failure: 0 bytes
+ kworker/u4:0: page allocation failure: order:0, mode:0x80d2
+ CPU: 0 PID: 6 Comm: kworker/u4:0 Not tainted 3.14.77 #130
+ Workqueue: ath10k_wq ath10k_core_register_work [ath10k_core]
+ (unwind_backtrace) from [<c021abf8>] (show_stack+0x10/0x14)
+ (dump_stack+0x80/0xa0)
+ (warn_alloc_failed+0xd0/0xfc)
+ (__vmalloc_node_range+0x1b4/0x1d8)
+ (__vmalloc_node+0x34/0x40)
+ (vzalloc+0x24/0x30)
+ (ath10k_coredump_register+0x6c/0x88 [ath10k_core])
+ (ath10k_core_register_work+0x350/0xb34 [ath10k_core])
+ (process_one_work+0x20c/0x32c)
+ (worker_thread+0x228/0x360)
+
+This is due to ath10k_hw_mem_layout is not defined for AR9987.
+For coredump undefined hw ramdump_size is 0.
+Check for the ramdump_size before allocation memory.
+
+Tested on: AR9987, QCA9984
+FW version: 10.4-3.9.0.2-00044
+
+Signed-off-by: Anilkumar Kolli <akolli@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/coredump.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/coredump.c b/drivers/net/wireless/ath/ath10k/coredump.c
+index b6d2932383cf..1cfe75a2d0c3 100644
+--- a/drivers/net/wireless/ath/ath10k/coredump.c
++++ b/drivers/net/wireless/ath/ath10k/coredump.c
+@@ -1208,9 +1208,11 @@ static struct ath10k_dump_file_data *ath10k_coredump_build(struct ath10k *ar)
+ 		dump_tlv = (struct ath10k_tlv_dump_data *)(buf + sofar);
+ 		dump_tlv->type = cpu_to_le32(ATH10K_FW_CRASH_DUMP_RAM_DATA);
+ 		dump_tlv->tlv_len = cpu_to_le32(crash_data->ramdump_buf_len);
+-		memcpy(dump_tlv->tlv_data, crash_data->ramdump_buf,
+-		       crash_data->ramdump_buf_len);
+-		sofar += sizeof(*dump_tlv) + crash_data->ramdump_buf_len;
++		if (crash_data->ramdump_buf_len) {
++			memcpy(dump_tlv->tlv_data, crash_data->ramdump_buf,
++			       crash_data->ramdump_buf_len);
++			sofar += sizeof(*dump_tlv) + crash_data->ramdump_buf_len;
++		}
+ 	}
+ 
+ 	mutex_unlock(&ar->dump_mutex);
+@@ -1257,6 +1259,9 @@ int ath10k_coredump_register(struct ath10k *ar)
+ 	if (test_bit(ATH10K_FW_CRASH_DUMP_RAM_DATA, &ath10k_coredump_mask)) {
+ 		crash_data->ramdump_buf_len = ath10k_coredump_get_ramdump_size(ar);
+ 
++		if (!crash_data->ramdump_buf_len)
++			return 0;
++
+ 		crash_data->ramdump_buf = vzalloc(crash_data->ramdump_buf_len);
+ 		if (!crash_data->ramdump_buf)
+ 			return -ENOMEM;
+-- 
+2.20.1
+
diff --git a/queue-5.4/ath10k-fix-get-invalid-tx-rate-for-mesh-metric.patch b/queue-5.4/ath10k-fix-get-invalid-tx-rate-for-mesh-metric.patch
new file mode 100644
index 00000000000..6a1ff8c7af0
--- /dev/null
+++ b/queue-5.4/ath10k-fix-get-invalid-tx-rate-for-mesh-metric.patch
@@ -0,0 +1,42 @@
+From 5df9e6052212a92300d148bd0af4164ac82cd8a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Nov 2019 20:04:37 +0200
+Subject: ath10k: fix get invalid tx rate for Mesh metric
+
+From: Miaoqing Pan <miaoqing@codeaurora.org>
+
+[ Upstream commit 05a11003a56507023f18d3249a4d4d119c0a3e9c ]
+
+ath10k does not provide transmit rate info per MSDU
+in tx completion, mark that as -1 so mac80211
+will ignore the rates. This fixes mac80211 update Mesh
+link metric with invalid transmit rate info.
+
+Tested HW: QCA9984
+Tested FW: 10.4-3.9.0.2-00035
+
+Signed-off-by: Hou Bao Hou <houbao@codeaurora.org>
+Signed-off-by: Anilkumar Kolli <akolli@codeaurora.org>
+Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/txrx.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/ath/ath10k/txrx.c b/drivers/net/wireless/ath/ath10k/txrx.c
+index 4102df016931..39abf8b12903 100644
+--- a/drivers/net/wireless/ath/ath10k/txrx.c
++++ b/drivers/net/wireless/ath/ath10k/txrx.c
+@@ -95,6 +95,8 @@ int ath10k_txrx_tx_unref(struct ath10k_htt *htt,
+ 
+ 	info = IEEE80211_SKB_CB(msdu);
+ 	memset(&info->status, 0, sizeof(info->status));
++	info->status.rates[0].idx = -1;
++
+ 	trace_ath10k_txrx_tx_unref(ar, tx_done->msdu_id);
+ 
+ 	if (!(info->flags & IEEE80211_TX_CTL_NO_ACK))
+-- 
+2.20.1
+
diff --git a/queue-5.4/ath10k-fix-offchannel-tx-failure-when-no-ath10k_mac_.patch b/queue-5.4/ath10k-fix-offchannel-tx-failure-when-no-ath10k_mac_.patch
new file mode 100644
index 00000000000..23a4b5b2de8
--- /dev/null
+++ b/queue-5.4/ath10k-fix-offchannel-tx-failure-when-no-ath10k_mac_.patch
@@ -0,0 +1,120 @@
+From 25cc870f59b14ff14a241d333550797d7e341b77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Oct 2017 17:03:12 -0700
+Subject: ath10k: fix offchannel tx failure when no ath10k_mac_tx_frm_has_freq
+
+From: Ben Greear <greearb@candelatech.com>
+
+[ Upstream commit cc6df017e55764ffef9819dd9554053182535ffd ]
+
+Offchannel management frames were failing:
+
+[18099.253732] ath10k_pci 0000:01:00.0: timed out waiting for offchannel skb cf0e3780
+[18102.293686] ath10k_pci 0000:01:00.0: timed out waiting for offchannel skb cf0e3780
+[18105.333653] ath10k_pci 0000:01:00.0: timed out waiting for offchannel skb cf0e3780
+[18108.373712] ath10k_pci 0000:01:00.0: timed out waiting for offchannel skb cf0e3780
+[18111.413687] ath10k_pci 0000:01:00.0: timed out waiting for offchannel skb cf0e36c0
+[18114.453726] ath10k_pci 0000:01:00.0: timed out waiting for offchannel skb cf0e3f00
+[18117.493773] ath10k_pci 0000:01:00.0: timed out waiting for offchannel skb cf0e36c0
+[18120.533631] ath10k_pci 0000:01:00.0: timed out waiting for offchannel skb cf0e3f00
+
+This bug appears to have been added between 4.0 (which works for us),
+and 4.4, which does not work.
+
+I think this is because the tx-offchannel logic gets in a loop when
+ath10k_mac_tx_frm_has_freq(ar) is false, so pkt is never actually
+sent to the firmware for transmit.
+
+This patch fixes the problem on 4.9 for me, and now HS20 clients
+can work again with my firmware.
+
+Antonio: tested with 10.4-3.5.3-00057 on QCA4019 and QCA9888
+
+Signed-off-by: Ben Greear <greearb@candelatech.com>
+Tested-by: Antonio Quartulli <antonio.quartulli@kaiwoo.ai>
+[kvalo@codeaurora.org: improve commit log, remove unneeded parenthesis]
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/mac.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
+index 40889b79fc70..a40e1a998f4c 100644
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -3708,7 +3708,7 @@ static int ath10k_mac_tx(struct ath10k *ar,
+ 			 struct ieee80211_vif *vif,
+ 			 enum ath10k_hw_txrx_mode txmode,
+ 			 enum ath10k_mac_tx_path txpath,
+-			 struct sk_buff *skb)
++			 struct sk_buff *skb, bool noque_offchan)
+ {
+ 	struct ieee80211_hw *hw = ar->hw;
+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+@@ -3738,10 +3738,10 @@ static int ath10k_mac_tx(struct ath10k *ar,
+ 		}
+ 	}
+ 
+-	if (info->flags & IEEE80211_TX_CTL_TX_OFFCHAN) {
++	if (!noque_offchan && info->flags & IEEE80211_TX_CTL_TX_OFFCHAN) {
+ 		if (!ath10k_mac_tx_frm_has_freq(ar)) {
+-			ath10k_dbg(ar, ATH10K_DBG_MAC, "queued offchannel skb %pK\n",
+-				   skb);
++			ath10k_dbg(ar, ATH10K_DBG_MAC, "mac queued offchannel skb %pK len %d\n",
++				   skb, skb->len);
+ 
+ 			skb_queue_tail(&ar->offchan_tx_queue, skb);
+ 			ieee80211_queue_work(hw, &ar->offchan_tx_work);
+@@ -3803,8 +3803,8 @@ void ath10k_offchan_tx_work(struct work_struct *work)
+ 
+ 		mutex_lock(&ar->conf_mutex);
+ 
+-		ath10k_dbg(ar, ATH10K_DBG_MAC, "mac offchannel skb %pK\n",
+-			   skb);
++		ath10k_dbg(ar, ATH10K_DBG_MAC, "mac offchannel skb %pK len %d\n",
++			   skb, skb->len);
+ 
+ 		hdr = (struct ieee80211_hdr *)skb->data;
+ 		peer_addr = ieee80211_get_DA(hdr);
+@@ -3850,7 +3850,7 @@ void ath10k_offchan_tx_work(struct work_struct *work)
+ 		txmode = ath10k_mac_tx_h_get_txmode(ar, vif, sta, skb);
+ 		txpath = ath10k_mac_tx_h_get_txpath(ar, skb, txmode);
+ 
+-		ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb);
++		ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb, true);
+ 		if (ret) {
+ 			ath10k_warn(ar, "failed to transmit offchannel frame: %d\n",
+ 				    ret);
+@@ -3860,8 +3860,8 @@ void ath10k_offchan_tx_work(struct work_struct *work)
+ 		time_left =
+ 		wait_for_completion_timeout(&ar->offchan_tx_completed, 3 * HZ);
+ 		if (time_left == 0)
+-			ath10k_warn(ar, "timed out waiting for offchannel skb %pK\n",
+-				    skb);
++			ath10k_warn(ar, "timed out waiting for offchannel skb %pK, len: %d\n",
++				    skb, skb->len);
+ 
+ 		if (!peer && tmp_peer_created) {
+ 			ret = ath10k_peer_delete(ar, vdev_id, peer_addr);
+@@ -4097,7 +4097,7 @@ int ath10k_mac_tx_push_txq(struct ieee80211_hw *hw,
+ 		spin_unlock_bh(&ar->htt.tx_lock);
+ 	}
+ 
+-	ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb);
++	ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb, false);
+ 	if (unlikely(ret)) {
+ 		ath10k_warn(ar, "failed to push frame: %d\n", ret);
+ 
+@@ -4378,7 +4378,7 @@ static void ath10k_mac_op_tx(struct ieee80211_hw *hw,
+ 		spin_unlock_bh(&ar->htt.tx_lock);
+ 	}
+ 
+-	ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb);
++	ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb, false);
+ 	if (ret) {
+ 		ath10k_warn(ar, "failed to transmit frame: %d\n", ret);
+ 		if (is_htt) {
+-- 
+2.20.1
+
diff --git a/queue-5.4/bcache-fix-deadlock-in-bcache_allocator.patch b/queue-5.4/bcache-fix-deadlock-in-bcache_allocator.patch
new file mode 100644
index 00000000000..e09d780a5d1
--- /dev/null
+++ b/queue-5.4/bcache-fix-deadlock-in-bcache_allocator.patch
@@ -0,0 +1,156 @@
+From 5abad2930e6411b56bd974ddf7cdf57c2590274a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Nov 2019 16:03:21 +0800
+Subject: bcache: fix deadlock in bcache_allocator
+
+From: Andrea Righi <andrea.righi@canonical.com>
+
+[ Upstream commit 84c529aea182939e68f618ed9813740c9165c7eb ]
+
+bcache_allocator can call the following:
+
+ bch_allocator_thread()
+  -> bch_prio_write()
+     -> bch_bucket_alloc()
+        -> wait on &ca->set->bucket_wait
+
+But the wake up event on bucket_wait is supposed to come from
+bch_allocator_thread() itself => deadlock:
+
+[ 1158.490744] INFO: task bcache_allocato:15861 blocked for more than 10 seconds.
+[ 1158.495929]       Not tainted 5.3.0-050300rc3-generic #201908042232
+[ 1158.500653] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+[ 1158.504413] bcache_allocato D    0 15861      2 0x80004000
+[ 1158.504419] Call Trace:
+[ 1158.504429]  __schedule+0x2a8/0x670
+[ 1158.504432]  schedule+0x2d/0x90
+[ 1158.504448]  bch_bucket_alloc+0xe5/0x370 [bcache]
+[ 1158.504453]  ? wait_woken+0x80/0x80
+[ 1158.504466]  bch_prio_write+0x1dc/0x390 [bcache]
+[ 1158.504476]  bch_allocator_thread+0x233/0x490 [bcache]
+[ 1158.504491]  kthread+0x121/0x140
+[ 1158.504503]  ? invalidate_buckets+0x890/0x890 [bcache]
+[ 1158.504506]  ? kthread_park+0xb0/0xb0
+[ 1158.504510]  ret_from_fork+0x35/0x40
+
+Fix by making the call to bch_prio_write() non-blocking, so that
+bch_allocator_thread() never waits on itself.
+
+Moreover, make sure to wake up the garbage collector thread when
+bch_prio_write() is failing to allocate buckets.
+
+BugLink: https://bugs.launchpad.net/bugs/1784665
+BugLink: https://bugs.launchpad.net/bugs/1796292
+Signed-off-by: Andrea Righi <andrea.righi@canonical.com>
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/bcache/alloc.c  |  5 ++++-
+ drivers/md/bcache/bcache.h |  2 +-
+ drivers/md/bcache/super.c  | 27 +++++++++++++++++++++------
+ 3 files changed, 26 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/md/bcache/alloc.c b/drivers/md/bcache/alloc.c
+index 6f776823b9ba..a1df0d95151c 100644
+--- a/drivers/md/bcache/alloc.c
++++ b/drivers/md/bcache/alloc.c
+@@ -377,7 +377,10 @@ retry_invalidate:
+ 			if (!fifo_full(&ca->free_inc))
+ 				goto retry_invalidate;
+ 
+-			bch_prio_write(ca);
++			if (bch_prio_write(ca, false) < 0) {
++				ca->invalidate_needs_gc = 1;
++				wake_up_gc(ca->set);
++			}
+ 		}
+ 	}
+ out:
+diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h
+index 013e35a9e317..deb924e1d790 100644
+--- a/drivers/md/bcache/bcache.h
++++ b/drivers/md/bcache/bcache.h
+@@ -977,7 +977,7 @@ bool bch_cached_dev_error(struct cached_dev *dc);
+ __printf(2, 3)
+ bool bch_cache_set_error(struct cache_set *c, const char *fmt, ...);
+ 
+-void bch_prio_write(struct cache *ca);
++int bch_prio_write(struct cache *ca, bool wait);
+ void bch_write_bdev_super(struct cached_dev *dc, struct closure *parent);
+ 
+ extern struct workqueue_struct *bcache_wq;
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index d2654880b7b9..64999c7a8033 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -529,12 +529,29 @@ static void prio_io(struct cache *ca, uint64_t bucket, int op,
+ 	closure_sync(cl);
+ }
+ 
+-void bch_prio_write(struct cache *ca)
++int bch_prio_write(struct cache *ca, bool wait)
+ {
+ 	int i;
+ 	struct bucket *b;
+ 	struct closure cl;
+ 
++	pr_debug("free_prio=%zu, free_none=%zu, free_inc=%zu",
++		 fifo_used(&ca->free[RESERVE_PRIO]),
++		 fifo_used(&ca->free[RESERVE_NONE]),
++		 fifo_used(&ca->free_inc));
++
++	/*
++	 * Pre-check if there are enough free buckets. In the non-blocking
++	 * scenario it's better to fail early rather than starting to allocate
++	 * buckets and do a cleanup later in case of failure.
++	 */
++	if (!wait) {
++		size_t avail = fifo_used(&ca->free[RESERVE_PRIO]) +
++			       fifo_used(&ca->free[RESERVE_NONE]);
++		if (prio_buckets(ca) > avail)
++			return -ENOMEM;
++	}
++
+ 	closure_init_stack(&cl);
+ 
+ 	lockdep_assert_held(&ca->set->bucket_lock);
+@@ -544,9 +561,6 @@ void bch_prio_write(struct cache *ca)
+ 	atomic_long_add(ca->sb.bucket_size * prio_buckets(ca),
+ 			&ca->meta_sectors_written);
+ 
+-	//pr_debug("free %zu, free_inc %zu, unused %zu", fifo_used(&ca->free),
+-	//	 fifo_used(&ca->free_inc), fifo_used(&ca->unused));
+-
+ 	for (i = prio_buckets(ca) - 1; i >= 0; --i) {
+ 		long bucket;
+ 		struct prio_set *p = ca->disk_buckets;
+@@ -564,7 +578,7 @@ void bch_prio_write(struct cache *ca)
+ 		p->magic	= pset_magic(&ca->sb);
+ 		p->csum		= bch_crc64(&p->magic, bucket_bytes(ca) - 8);
+ 
+-		bucket = bch_bucket_alloc(ca, RESERVE_PRIO, true);
++		bucket = bch_bucket_alloc(ca, RESERVE_PRIO, wait);
+ 		BUG_ON(bucket == -1);
+ 
+ 		mutex_unlock(&ca->set->bucket_lock);
+@@ -593,6 +607,7 @@ void bch_prio_write(struct cache *ca)
+ 
+ 		ca->prio_last_buckets[i] = ca->prio_buckets[i];
+ 	}
++	return 0;
+ }
+ 
+ static void prio_read(struct cache *ca, uint64_t bucket)
+@@ -1962,7 +1977,7 @@ static int run_cache_set(struct cache_set *c)
+ 
+ 		mutex_lock(&c->bucket_lock);
+ 		for_each_cache(ca, c, i)
+-			bch_prio_write(ca);
++			bch_prio_write(ca, true);
+ 		mutex_unlock(&c->bucket_lock);
+ 
+ 		err = "cannot allocate new UUID bucket";
+-- 
+2.20.1
+
diff --git a/queue-5.4/bcache-fix-static-checker-warning-in-bcache_device_f.patch b/queue-5.4/bcache-fix-static-checker-warning-in-bcache_device_f.patch
new file mode 100644
index 00000000000..a14310bc478
--- /dev/null
+++ b/queue-5.4/bcache-fix-static-checker-warning-in-bcache_device_f.patch
@@ -0,0 +1,99 @@
+From dc52485e2ed19c9beb58bd5482616936182217dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Nov 2019 16:03:17 +0800
+Subject: bcache: fix static checker warning in bcache_device_free()
+
+From: Coly Li <colyli@suse.de>
+
+[ Upstream commit 2d8869518a525c9bce5f5268419df9dfbe3dfdeb ]
+
+Commit cafe56359144 ("bcache: A block layer cache") leads to the
+following static checker warning:
+
+    ./drivers/md/bcache/super.c:770 bcache_device_free()
+    warn: variable dereferenced before check 'd->disk' (see line 766)
+
+drivers/md/bcache/super.c
+   762  static void bcache_device_free(struct bcache_device *d)
+   763  {
+   764          lockdep_assert_held(&bch_register_lock);
+   765
+   766          pr_info("%s stopped", d->disk->disk_name);
+                                      ^^^^^^^^^
+Unchecked dereference.
+
+   767
+   768          if (d->c)
+   769                  bcache_device_detach(d);
+   770          if (d->disk && d->disk->flags & GENHD_FL_UP)
+                    ^^^^^^^
+Check too late.
+
+   771                  del_gendisk(d->disk);
+   772          if (d->disk && d->disk->queue)
+   773                  blk_cleanup_queue(d->disk->queue);
+   774          if (d->disk) {
+   775                  ida_simple_remove(&bcache_device_idx,
+   776                                    first_minor_to_idx(d->disk->first_minor));
+   777                  put_disk(d->disk);
+   778          }
+   779
+
+It is not 100% sure that the gendisk struct of bcache device will always
+be there, the warning makes sense when there is problem in block core.
+
+This patch tries to remove the static checking warning by checking
+d->disk to avoid NULL pointer deferences.
+
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/bcache/super.c | 24 ++++++++++++++++--------
+ 1 file changed, 16 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index 20ed838e9413..d2654880b7b9 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -761,20 +761,28 @@ static inline int idx_to_first_minor(int idx)
+ 
+ static void bcache_device_free(struct bcache_device *d)
+ {
++	struct gendisk *disk = d->disk;
++
+ 	lockdep_assert_held(&bch_register_lock);
+ 
+-	pr_info("%s stopped", d->disk->disk_name);
++	if (disk)
++		pr_info("%s stopped", disk->disk_name);
++	else
++		pr_err("bcache device (NULL gendisk) stopped");
+ 
+ 	if (d->c)
+ 		bcache_device_detach(d);
+-	if (d->disk && d->disk->flags & GENHD_FL_UP)
+-		del_gendisk(d->disk);
+-	if (d->disk && d->disk->queue)
+-		blk_cleanup_queue(d->disk->queue);
+-	if (d->disk) {
++
++	if (disk) {
++		if (disk->flags & GENHD_FL_UP)
++			del_gendisk(disk);
++
++		if (disk->queue)
++			blk_cleanup_queue(disk->queue);
++
+ 		ida_simple_remove(&bcache_device_idx,
+-				  first_minor_to_idx(d->disk->first_minor));
+-		put_disk(d->disk);
++				  first_minor_to_idx(disk->first_minor));
++		put_disk(disk);
+ 	}
+ 
+ 	bioset_exit(&d->bio_split);
+-- 
+2.20.1
+
diff --git a/queue-5.4/block-fix-writeback-throttling-w-1-compiler-warnings.patch b/queue-5.4/block-fix-writeback-throttling-w-1-compiler-warnings.patch
new file mode 100644
index 00000000000..ef8e9c0e8da
--- /dev/null
+++ b/queue-5.4/block-fix-writeback-throttling-w-1-compiler-warnings.patch
@@ -0,0 +1,128 @@
+From d704ebde0caddcdff21299837a6e9056fbb525f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Sep 2019 16:00:41 -0700
+Subject: block: Fix writeback throttling W=1 compiler warnings
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit 1d200e9d6f635ae894993a7d0f1b9e0b6e522e3b ]
+
+Fix the following compiler warnings:
+
+In file included from ./include/linux/bitmap.h:9,
+                 from ./include/linux/cpumask.h:12,
+                 from ./arch/x86/include/asm/cpumask.h:5,
+                 from ./arch/x86/include/asm/msr.h:11,
+                 from ./arch/x86/include/asm/processor.h:21,
+                 from ./arch/x86/include/asm/cpufeature.h:5,
+                 from ./arch/x86/include/asm/thread_info.h:53,
+                 from ./include/linux/thread_info.h:38,
+                 from ./arch/x86/include/asm/preempt.h:7,
+                 from ./include/linux/preempt.h:78,
+                 from ./include/linux/spinlock.h:51,
+                 from ./include/linux/mmzone.h:8,
+                 from ./include/linux/gfp.h:6,
+                 from ./include/linux/mm.h:10,
+                 from ./include/linux/bvec.h:13,
+                 from ./include/linux/blk_types.h:10,
+                 from block/blk-wbt.c:23:
+In function 'strncpy',
+    inlined from 'perf_trace_wbt_stat' at ./include/trace/events/wbt.h:15:1:
+./include/linux/string.h:260:9: warning: '__builtin_strncpy' specified bound 32 equals destination size [-Wstringop-truncation]
+  return __builtin_strncpy(p, q, size);
+         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+In function 'strncpy',
+    inlined from 'perf_trace_wbt_lat' at ./include/trace/events/wbt.h:58:1:
+./include/linux/string.h:260:9: warning: '__builtin_strncpy' specified bound 32 equals destination size [-Wstringop-truncation]
+  return __builtin_strncpy(p, q, size);
+         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+In function 'strncpy',
+    inlined from 'perf_trace_wbt_step' at ./include/trace/events/wbt.h:87:1:
+./include/linux/string.h:260:9: warning: '__builtin_strncpy' specified bound 32 equals destination size [-Wstringop-truncation]
+  return __builtin_strncpy(p, q, size);
+         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+In function 'strncpy',
+    inlined from 'perf_trace_wbt_timer' at ./include/trace/events/wbt.h:126:1:
+./include/linux/string.h:260:9: warning: '__builtin_strncpy' specified bound 32 equals destination size [-Wstringop-truncation]
+  return __builtin_strncpy(p, q, size);
+         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+In function 'strncpy',
+    inlined from 'trace_event_raw_event_wbt_stat' at ./include/trace/events/wbt.h:15:1:
+./include/linux/string.h:260:9: warning: '__builtin_strncpy' specified bound 32 equals destination size [-Wstringop-truncation]
+  return __builtin_strncpy(p, q, size);
+         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+In function 'strncpy',
+    inlined from 'trace_event_raw_event_wbt_lat' at ./include/trace/events/wbt.h:58:1:
+./include/linux/string.h:260:9: warning: '__builtin_strncpy' specified bound 32 equals destination size [-Wstringop-truncation]
+  return __builtin_strncpy(p, q, size);
+         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+In function 'strncpy',
+    inlined from 'trace_event_raw_event_wbt_timer' at ./include/trace/events/wbt.h:126:1:
+./include/linux/string.h:260:9: warning: '__builtin_strncpy' specified bound 32 equals destination size [-Wstringop-truncation]
+  return __builtin_strncpy(p, q, size);
+         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+In function 'strncpy',
+    inlined from 'trace_event_raw_event_wbt_step' at ./include/trace/events/wbt.h:87:1:
+./include/linux/string.h:260:9: warning: '__builtin_strncpy' specified bound 32 equals destination size [-Wstringop-truncation]
+  return __builtin_strncpy(p, q, size);
+         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Cc: Christoph Hellwig <hch@infradead.org>
+Cc: Ming Lei <ming.lei@redhat.com>
+Cc: Hannes Reinecke <hare@suse.com>
+Cc: Johannes Thumshirn <jthumshirn@suse.de>
+Fixes: e34cbd307477 ("blk-wbt: add general throttling mechanism"; v4.10).
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/trace/events/wbt.h | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/include/trace/events/wbt.h b/include/trace/events/wbt.h
+index b048694070e2..37342a13c9cb 100644
+--- a/include/trace/events/wbt.h
++++ b/include/trace/events/wbt.h
+@@ -33,7 +33,8 @@ TRACE_EVENT(wbt_stat,
+ 	),
+ 
+ 	TP_fast_assign(
+-		strncpy(__entry->name, dev_name(bdi->dev), 32);
++		strlcpy(__entry->name, dev_name(bdi->dev),
++			ARRAY_SIZE(__entry->name));
+ 		__entry->rmean		= stat[0].mean;
+ 		__entry->rmin		= stat[0].min;
+ 		__entry->rmax		= stat[0].max;
+@@ -67,7 +68,8 @@ TRACE_EVENT(wbt_lat,
+ 	),
+ 
+ 	TP_fast_assign(
+-		strncpy(__entry->name, dev_name(bdi->dev), 32);
++		strlcpy(__entry->name, dev_name(bdi->dev),
++			ARRAY_SIZE(__entry->name));
+ 		__entry->lat = div_u64(lat, 1000);
+ 	),
+ 
+@@ -103,7 +105,8 @@ TRACE_EVENT(wbt_step,
+ 	),
+ 
+ 	TP_fast_assign(
+-		strncpy(__entry->name, dev_name(bdi->dev), 32);
++		strlcpy(__entry->name, dev_name(bdi->dev),
++			ARRAY_SIZE(__entry->name));
+ 		__entry->msg	= msg;
+ 		__entry->step	= step;
+ 		__entry->window	= div_u64(window, 1000);
+@@ -138,7 +141,8 @@ TRACE_EVENT(wbt_timer,
+ 	),
+ 
+ 	TP_fast_assign(
+-		strncpy(__entry->name, dev_name(bdi->dev), 32);
++		strlcpy(__entry->name, dev_name(bdi->dev),
++			ARRAY_SIZE(__entry->name));
+ 		__entry->status		= status;
+ 		__entry->step		= step;
+ 		__entry->inflight	= inflight;
+-- 
+2.20.1
+
diff --git a/queue-5.4/bluetooth-btusb-avoid-unused-function-warning.patch b/queue-5.4/bluetooth-btusb-avoid-unused-function-warning.patch
new file mode 100644
index 00000000000..414df5ea963
--- /dev/null
+++ b/queue-5.4/bluetooth-btusb-avoid-unused-function-warning.patch
@@ -0,0 +1,52 @@
+From 7f40408f489575e886c6ea2f68902cd4dc4ade26 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Sep 2019 21:59:02 +0200
+Subject: Bluetooth: btusb: avoid unused function warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 42d22098127d6384f789107f59caae87d7520fc4 ]
+
+The btusb_rtl_cmd_timeout() function is used inside of an
+ifdef, leading to a warning when this part is hidden
+from the compiler:
+
+drivers/bluetooth/btusb.c:530:13: error: unused function 'btusb_rtl_cmd_timeout' [-Werror,-Wunused-function]
+
+Use an IS_ENABLED() check instead so the compiler can see
+the code and then discard it silently.
+
+Fixes: d7ef0d1e3968 ("Bluetooth: btusb: Use cmd_timeout to reset Realtek device")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btusb.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index a9c35ebb30f8..23e606aaaea4 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -3807,8 +3807,8 @@ static int btusb_probe(struct usb_interface *intf,
+ 		btusb_check_needs_reset_resume(intf);
+ 	}
+ 
+-#ifdef CONFIG_BT_HCIBTUSB_RTL
+-	if (id->driver_info & BTUSB_REALTEK) {
++	if (IS_ENABLED(CONFIG_BT_HCIBTUSB_RTL) &&
++	    (id->driver_info & BTUSB_REALTEK)) {
+ 		hdev->setup = btrtl_setup_realtek;
+ 		hdev->shutdown = btrtl_shutdown_realtek;
+ 		hdev->cmd_timeout = btusb_rtl_cmd_timeout;
+@@ -3819,7 +3819,6 @@ static int btusb_probe(struct usb_interface *intf,
+ 		 */
+ 		set_bit(BTUSB_WAKEUP_DISABLE, &data->flags);
+ 	}
+-#endif
+ 
+ 	if (id->driver_info & BTUSB_AMP) {
+ 		/* AMP controllers do not support SCO packets */
+-- 
+2.20.1
+
diff --git a/queue-5.4/bluetooth-fix-advertising-duplicated-flags.patch b/queue-5.4/bluetooth-fix-advertising-duplicated-flags.patch
new file mode 100644
index 00000000000..f8618eff4d7
--- /dev/null
+++ b/queue-5.4/bluetooth-fix-advertising-duplicated-flags.patch
@@ -0,0 +1,60 @@
+From 712ba3577caf44652569ec934f6d7ed30dc00bb3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 Nov 2019 23:58:15 +0200
+Subject: Bluetooth: Fix advertising duplicated flags
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit 6012b9346d8959194c239fd60a62dfec98d43048 ]
+
+Instances may have flags set as part of its data in which case the code
+should not attempt to add it again otherwise it can cause duplication:
+
+< HCI Command: LE Set Extended Advertising Data (0x08|0x0037) plen 35
+        Handle: 0x00
+        Operation: Complete extended advertising data (0x03)
+        Fragment preference: Minimize fragmentation (0x01)
+        Data length: 0x06
+        Flags: 0x04
+          BR/EDR Not Supported
+        Flags: 0x06
+          LE General Discoverable Mode
+          BR/EDR Not Supported
+
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_request.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/net/bluetooth/hci_request.c b/net/bluetooth/hci_request.c
+index 7f6a581b5b7e..3d25dbf10b26 100644
+--- a/net/bluetooth/hci_request.c
++++ b/net/bluetooth/hci_request.c
+@@ -1273,6 +1273,14 @@ static u8 create_instance_adv_data(struct hci_dev *hdev, u8 instance, u8 *ptr)
+ 
+ 	instance_flags = get_adv_instance_flags(hdev, instance);
+ 
++	/* If instance already has the flags set skip adding it once
++	 * again.
++	 */
++	if (adv_instance && eir_get_data(adv_instance->adv_data,
++					 adv_instance->adv_data_len, EIR_FLAGS,
++					 NULL))
++		goto skip_flags;
++
+ 	/* The Add Advertising command allows userspace to set both the general
+ 	 * and limited discoverable flags.
+ 	 */
+@@ -1305,6 +1313,7 @@ static u8 create_instance_adv_data(struct hci_dev *hdev, u8 instance, u8 *ptr)
+ 		}
+ 	}
+ 
++skip_flags:
+ 	if (adv_instance) {
+ 		memcpy(ptr, adv_instance->adv_data,
+ 		       adv_instance->adv_data_len);
+-- 
+2.20.1
+
diff --git a/queue-5.4/bluetooth-hci_core-fix-init-for-hci_user_channel.patch b/queue-5.4/bluetooth-hci_core-fix-init-for-hci_user_channel.patch
new file mode 100644
index 00000000000..a1c1d626221
--- /dev/null
+++ b/queue-5.4/bluetooth-hci_core-fix-init-for-hci_user_channel.patch
@@ -0,0 +1,52 @@
+From 617db84f83f38b1e54f68a2b8b1be78306ad0203 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Oct 2019 20:20:39 -0700
+Subject: Bluetooth: hci_core: fix init for HCI_USER_CHANNEL
+
+From: Mattijs Korpershoek <mkorpershoek@baylibre.com>
+
+[ Upstream commit eb8c101e28496888a0dcfe16ab86a1bee369e820 ]
+
+During the setup() stage, HCI device drivers expect the chip to
+acknowledge its setup() completion via vendor specific frames.
+
+If userspace opens() such HCI device in HCI_USER_CHANNEL [1] mode,
+the vendor specific frames are never tranmitted to the driver, as
+they are filtered in hci_rx_work().
+
+Allow HCI devices which operate in HCI_USER_CHANNEL mode to receive
+frames if the HCI device is is HCI_INIT state.
+
+[1] https://www.spinics.net/lists/linux-bluetooth/msg37345.html
+
+Fixes: 23500189d7e0 ("Bluetooth: Introduce new HCI socket channel for user operation")
+Signed-off-by: Mattijs Korpershoek <mkorpershoek@baylibre.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_core.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
+index b2559d4bed81..0cc9ce917222 100644
+--- a/net/bluetooth/hci_core.c
++++ b/net/bluetooth/hci_core.c
+@@ -4440,7 +4440,14 @@ static void hci_rx_work(struct work_struct *work)
+ 			hci_send_to_sock(hdev, skb);
+ 		}
+ 
+-		if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
++		/* If the device has been opened in HCI_USER_CHANNEL,
++		 * the userspace has exclusive access to device.
++		 * When device is HCI_INIT, we still need to process
++		 * the data packets to the driver in order
++		 * to complete its setup().
++		 */
++		if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
++		    !test_bit(HCI_INIT, &hdev->flags)) {
+ 			kfree_skb(skb);
+ 			continue;
+ 		}
+-- 
+2.20.1
+
diff --git a/queue-5.4/bluetooth-missed-cpu_to_le16-conversion-in-hci_init4.patch b/queue-5.4/bluetooth-missed-cpu_to_le16-conversion-in-hci_init4.patch
new file mode 100644
index 00000000000..7cd3df52f59
--- /dev/null
+++ b/queue-5.4/bluetooth-missed-cpu_to_le16-conversion-in-hci_init4.patch
@@ -0,0 +1,48 @@
+From dcc0e14c8b663840c7580252189f6659fbb039dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Oct 2019 12:39:43 +0100
+Subject: Bluetooth: missed cpu_to_le16 conversion in hci_init4_req
+
+From: Ben Dooks (Codethink) <ben.dooks@codethink.co.uk>
+
+[ Upstream commit 727ea61a5028f8ac96f75ab34cb1b56e63fd9227 ]
+
+It looks like in hci_init4_req() the request is being
+initialised from cpu-endian data but the packet is specified
+to be little-endian. This causes an warning from sparse due
+to __le16 to u16 conversion.
+
+Fix this by using cpu_to_le16() on the two fields in the packet.
+
+net/bluetooth/hci_core.c:845:27: warning: incorrect type in assignment (different base types)
+net/bluetooth/hci_core.c:845:27:    expected restricted __le16 [usertype] tx_len
+net/bluetooth/hci_core.c:845:27:    got unsigned short [usertype] le_max_tx_len
+net/bluetooth/hci_core.c:846:28: warning: incorrect type in assignment (different base types)
+net/bluetooth/hci_core.c:846:28:    expected restricted __le16 [usertype] tx_time
+net/bluetooth/hci_core.c:846:28:    got unsigned short [usertype] le_max_tx_time
+
+Signed-off-by: Ben Dooks <ben.dooks@codethink.co.uk>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
+index 04bc79359a17..b2559d4bed81 100644
+--- a/net/bluetooth/hci_core.c
++++ b/net/bluetooth/hci_core.c
+@@ -842,8 +842,8 @@ static int hci_init4_req(struct hci_request *req, unsigned long opt)
+ 	if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT) {
+ 		struct hci_cp_le_write_def_data_len cp;
+ 
+-		cp.tx_len = hdev->le_max_tx_len;
+-		cp.tx_time = hdev->le_max_tx_time;
++		cp.tx_len = cpu_to_le16(hdev->le_max_tx_len);
++		cp.tx_time = cpu_to_le16(hdev->le_max_tx_time);
+ 		hci_req_add(req, HCI_OP_LE_WRITE_DEF_DATA_LEN, sizeof(cp), &cp);
+ 	}
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/bluetooth-workaround-directed-advertising-bug-in-bro.patch b/queue-5.4/bluetooth-workaround-directed-advertising-bug-in-bro.patch
new file mode 100644
index 00000000000..430457a4289
--- /dev/null
+++ b/queue-5.4/bluetooth-workaround-directed-advertising-bug-in-bro.patch
@@ -0,0 +1,63 @@
+From 25ef564cbc5f4af7ee219ec3d806c7f556d4d1ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Oct 2019 14:22:43 +0200
+Subject: Bluetooth: Workaround directed advertising bug in Broadcom
+ controllers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Szymon Janc <szymon.janc@codecoup.pl>
+
+[ Upstream commit 4c371bb95cf06ded80df0e6139fdd77cee1d9a94 ]
+
+It appears that some Broadcom controllers (eg BCM20702A0) reject LE Set
+Advertising Parameters command if advertising intervals provided are not
+within range for undirected and low duty directed advertising.
+
+Workaround this bug by populating min and max intervals with 'valid'
+values.
+
+< HCI Command: LE Set Advertising Parameters (0x08|0x0006) plen 15
+        Min advertising interval: 0.000 msec (0x0000)
+        Max advertising interval: 0.000 msec (0x0000)
+        Type: Connectable directed - ADV_DIRECT_IND (high duty cycle) (0x01)
+        Own address type: Public (0x00)
+        Direct address type: Random (0x01)
+        Direct address: E2:F0:7B:9F:DC:F4 (Static)
+        Channel map: 37, 38, 39 (0x07)
+        Filter policy: Allow Scan Request from Any, Allow Connect Request from Any (0x00)
+> HCI Event: Command Complete (0x0e) plen 4
+      LE Set Advertising Parameters (0x08|0x0006) ncmd 1
+        Status: Invalid HCI Command Parameters (0x12)
+
+Signed-off-by: Szymon Janc <szymon.janc@codecoup.pl>
+Tested-by: Sören Beye <linux@hypfer.de>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_conn.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
+index ad5b0ac1f9ce..7ff92dd4c53c 100644
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -934,6 +934,14 @@ static void hci_req_directed_advertising(struct hci_request *req,
+ 			return;
+ 
+ 		memset(&cp, 0, sizeof(cp));
++
++		/* Some controllers might reject command if intervals are not
++		 * within range for undirected advertising.
++		 * BCM20702A0 is known to be affected by this.
++		 */
++		cp.min_interval = cpu_to_le16(0x0020);
++		cp.max_interval = cpu_to_le16(0x0020);
++
+ 		cp.type = LE_ADV_DIRECT_IND;
+ 		cp.own_address_type = own_addr_type;
+ 		cp.direct_addr_type = conn->dst_type;
+-- 
+2.20.1
+
diff --git a/queue-5.4/bnx2x-fix-pf-vf-communication-over-multi-cos-queues.patch b/queue-5.4/bnx2x-fix-pf-vf-communication-over-multi-cos-queues.patch
new file mode 100644
index 00000000000..68f5103fc37
--- /dev/null
+++ b/queue-5.4/bnx2x-fix-pf-vf-communication-over-multi-cos-queues.patch
@@ -0,0 +1,54 @@
+From c8f82a585d52e481cc112b2860432187f7eae8d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2019 21:51:11 -0800
+Subject: bnx2x: Fix PF-VF communication over multi-cos queues.
+
+From: Manish Chopra <manishc@marvell.com>
+
+[ Upstream commit dc5a3d79c345871439ffe72550b604fcde9770e1 ]
+
+PF driver doesn't enable tx-switching for all cos queues/clients,
+which causes packets drop from PF to VF. Fix this by enabling
+tx-switching on all cos queues/clients.
+
+Signed-off-by: Manish Chopra <manishc@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/broadcom/bnx2x/bnx2x_sriov.c    | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
+index 0edbb0a76847..5097a44686b3 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
+@@ -2397,15 +2397,21 @@ static int bnx2x_set_pf_tx_switching(struct bnx2x *bp, bool enable)
+ 	/* send the ramrod on all the queues of the PF */
+ 	for_each_eth_queue(bp, i) {
+ 		struct bnx2x_fastpath *fp = &bp->fp[i];
++		int tx_idx;
+ 
+ 		/* Set the appropriate Queue object */
+ 		q_params.q_obj = &bnx2x_sp_obj(bp, fp).q_obj;
+ 
+-		/* Update the Queue state */
+-		rc = bnx2x_queue_state_change(bp, &q_params);
+-		if (rc) {
+-			BNX2X_ERR("Failed to configure Tx switching\n");
+-			return rc;
++		for (tx_idx = FIRST_TX_COS_INDEX;
++		     tx_idx < fp->max_cos; tx_idx++) {
++			q_params.params.update.cid_index = tx_idx;
++
++			/* Update the Queue state */
++			rc = bnx2x_queue_state_change(bp, &q_params);
++			if (rc) {
++				BNX2X_ERR("Failed to configure Tx switching\n");
++				return rc;
++			}
+ 		}
+ 	}
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/bnxt_en-improve-rx-buffer-error-handling.patch b/queue-5.4/bnxt_en-improve-rx-buffer-error-handling.patch
new file mode 100644
index 00000000000..1f4373a97c5
--- /dev/null
+++ b/queue-5.4/bnxt_en-improve-rx-buffer-error-handling.patch
@@ -0,0 +1,79 @@
+From 756b592688ae06b23c2ad24c153d76b65504eab9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Nov 2019 03:56:36 -0500
+Subject: bnxt_en: Improve RX buffer error handling.
+
+From: Michael Chan <michael.chan@broadcom.com>
+
+[ Upstream commit 19b3751ffa713d04290effb26fe01009010f2206 ]
+
+When hardware reports RX buffer errors, the latest 57500 chips do not
+require reset.  The packet is discarded by the hardware and the
+ring will continue to operate.
+
+Also, add an rx_buf_errors counter for this type of error.  It can help
+the user to identify if the aggregation ring is too small.
+
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c         | 8 ++++++--
+ drivers/net/ethernet/broadcom/bnxt/bnxt.h         | 1 +
+ drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2 ++
+ 3 files changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 04ec909e06df..527e1bf93116 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -1767,8 +1767,12 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr,
+ 
+ 		rc = -EIO;
+ 		if (rx_err & RX_CMPL_ERRORS_BUFFER_ERROR_MASK) {
+-			netdev_warn(bp->dev, "RX buffer error %x\n", rx_err);
+-			bnxt_sched_reset(bp, rxr);
++			bnapi->cp_ring.rx_buf_errors++;
++			if (!(bp->flags & BNXT_FLAG_CHIP_P5)) {
++				netdev_warn(bp->dev, "RX buffer error %x\n",
++					    rx_err);
++				bnxt_sched_reset(bp, rxr);
++			}
+ 		}
+ 		goto next_rx_no_len;
+ 	}
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+index d333589811a5..5163bb848618 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+@@ -927,6 +927,7 @@ struct bnxt_cp_ring_info {
+ 	dma_addr_t		hw_stats_map;
+ 	u32			hw_stats_ctx_id;
+ 	u64			rx_l4_csum_errors;
++	u64			rx_buf_errors;
+ 	u64			missed_irqs;
+ 
+ 	struct bnxt_ring_struct	cp_ring_struct;
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+index 51c140476717..89f95428556e 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+@@ -173,6 +173,7 @@ static const char * const bnxt_ring_tpa2_stats_str[] = {
+ 
+ static const char * const bnxt_ring_sw_stats_str[] = {
+ 	"rx_l4_csum_errors",
++	"rx_buf_errors",
+ 	"missed_irqs",
+ };
+ 
+@@ -552,6 +553,7 @@ static void bnxt_get_ethtool_stats(struct net_device *dev,
+ 		for (k = 0; k < stat_fields; j++, k++)
+ 			buf[j] = le64_to_cpu(hw_stats[k]);
+ 		buf[j++] = cpr->rx_l4_csum_errors;
++		buf[j++] = cpr->rx_buf_errors;
+ 		buf[j++] = cpr->missed_irqs;
+ 
+ 		bnxt_sw_func_stats[RX_TOTAL_DISCARDS].counter +=
+-- 
+2.20.1
+
diff --git a/queue-5.4/bnxt_en-return-proper-error-code-for-non-existent-nv.patch b/queue-5.4/bnxt_en-return-proper-error-code-for-non-existent-nv.patch
new file mode 100644
index 00000000000..e065ebb0d8b
--- /dev/null
+++ b/queue-5.4/bnxt_en-return-proper-error-code-for-non-existent-nv.patch
@@ -0,0 +1,46 @@
+From 5e82ab5bd35b4ff233768ad1eb58034e344e2b9f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Nov 2019 03:56:41 -0500
+Subject: bnxt_en: Return proper error code for non-existent NVM variable
+
+From: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
+
+[ Upstream commit 05069dd4c577f9b143dfd243d55834333c4470c5 ]
+
+For NVM params that are not supported in the current NVM
+configuration, return the error as -EOPNOTSUPP.
+
+Signed-off-by: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
+index 7151244f8c7d..7d2cfea05737 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
+@@ -311,10 +311,17 @@ static int bnxt_hwrm_nvm_req(struct bnxt *bp, u32 param_id, void *msg,
+ 	} else {
+ 		rc = hwrm_send_message_silent(bp, msg, msg_len,
+ 					      HWRM_CMD_TIMEOUT);
+-		if (!rc)
++		if (!rc) {
+ 			bnxt_copy_from_nvm_data(val, data,
+ 						nvm_param.nvm_num_bits,
+ 						nvm_param.dl_num_bytes);
++		} else {
++			struct hwrm_err_output *resp = bp->hwrm_cmd_resp_addr;
++
++			if (resp->cmd_err ==
++				NVM_GET_VARIABLE_CMD_ERR_CODE_VAR_NOT_EXIST)
++				rc = -EOPNOTSUPP;
++		}
+ 	}
+ 	dma_free_coherent(&bp->pdev->dev, sizeof(*data), data, data_dma_addr);
+ 	if (rc == -EACCES)
+-- 
+2.20.1
+
diff --git a/queue-5.4/bpf-provide-better-register-bounds-after-jmp32-instr.patch b/queue-5.4/bpf-provide-better-register-bounds-after-jmp32-instr.patch
new file mode 100644
index 00000000000..0d80e5259ab
--- /dev/null
+++ b/queue-5.4/bpf-provide-better-register-bounds-after-jmp32-instr.patch
@@ -0,0 +1,134 @@
+From 9c5071ec7ed584236ab3817e8b0c7944bfa731f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Nov 2019 09:06:50 -0800
+Subject: bpf: Provide better register bounds after jmp32 instructions
+
+From: Yonghong Song <yhs@fb.com>
+
+[ Upstream commit 581738a681b6faae5725c2555439189ca81c0f1f ]
+
+With latest llvm (trunk https://github.com/llvm/llvm-project),
+test_progs, which has +alu32 enabled, failed for strobemeta.o.
+The verifier output looks like below with edit to replace large
+decimal numbers with hex ones.
+ 193: (85) call bpf_probe_read_user_str#114
+   R0=inv(id=0)
+ 194: (26) if w0 > 0x1 goto pc+4
+   R0_w=inv(id=0,umax_value=0xffffffff00000001)
+ 195: (6b) *(u16 *)(r7 +80) = r0
+ 196: (bc) w6 = w0
+   R6_w=inv(id=0,umax_value=0xffffffff,var_off=(0x0; 0xffffffff))
+ 197: (67) r6 <<= 32
+   R6_w=inv(id=0,smax_value=0x7fffffff00000000,umax_value=0xffffffff00000000,
+            var_off=(0x0; 0xffffffff00000000))
+ 198: (77) r6 >>= 32
+   R6=inv(id=0,umax_value=0xffffffff,var_off=(0x0; 0xffffffff))
+ ...
+ 201: (79) r8 = *(u64 *)(r10 -416)
+   R8_w=map_value(id=0,off=40,ks=4,vs=13872,imm=0)
+ 202: (0f) r8 += r6
+   R8_w=map_value(id=0,off=40,ks=4,vs=13872,umax_value=0xffffffff,var_off=(0x0; 0xffffffff))
+ 203: (07) r8 += 9696
+   R8_w=map_value(id=0,off=9736,ks=4,vs=13872,umax_value=0xffffffff,var_off=(0x0; 0xffffffff))
+ ...
+ 255: (bf) r1 = r8
+   R1_w=map_value(id=0,off=9736,ks=4,vs=13872,umax_value=0xffffffff,var_off=(0x0; 0xffffffff))
+ ...
+ 257: (85) call bpf_probe_read_user_str#114
+ R1 unbounded memory access, make sure to bounds check any array access into a map
+
+The value range for register r6 at insn 198 should be really just 0/1.
+The umax_value=0xffffffff caused later verification failure.
+
+After jmp instructions, the current verifier already tried to use just
+obtained information to get better register range. The current mechanism is
+for 64bit register only. This patch implemented to tighten the range
+for 32bit sub-registers after jmp32 instructions.
+With the patch, we have the below range ranges for the
+above code sequence:
+ 193: (85) call bpf_probe_read_user_str#114
+   R0=inv(id=0)
+ 194: (26) if w0 > 0x1 goto pc+4
+   R0_w=inv(id=0,smax_value=0x7fffffff00000001,umax_value=0xffffffff00000001,
+            var_off=(0x0; 0xffffffff00000001))
+ 195: (6b) *(u16 *)(r7 +80) = r0
+ 196: (bc) w6 = w0
+   R6_w=inv(id=0,umax_value=0xffffffff,var_off=(0x0; 0x1))
+ 197: (67) r6 <<= 32
+   R6_w=inv(id=0,umax_value=0x100000000,var_off=(0x0; 0x100000000))
+ 198: (77) r6 >>= 32
+   R6=inv(id=0,umax_value=1,var_off=(0x0; 0x1))
+ ...
+ 201: (79) r8 = *(u64 *)(r10 -416)
+   R8_w=map_value(id=0,off=40,ks=4,vs=13872,imm=0)
+ 202: (0f) r8 += r6
+   R8_w=map_value(id=0,off=40,ks=4,vs=13872,umax_value=1,var_off=(0x0; 0x1))
+ 203: (07) r8 += 9696
+   R8_w=map_value(id=0,off=9736,ks=4,vs=13872,umax_value=1,var_off=(0x0; 0x1))
+ ...
+ 255: (bf) r1 = r8
+   R1_w=map_value(id=0,off=9736,ks=4,vs=13872,umax_value=1,var_off=(0x0; 0x1))
+ ...
+ 257: (85) call bpf_probe_read_user_str#114
+ ...
+
+At insn 194, the register R0 has better var_off.mask and smax_value.
+Especially, the var_off.mask ensures later lshift and rshift
+maintains proper value range.
+
+Suggested-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Yonghong Song <yhs@fb.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Link: https://lore.kernel.org/bpf/20191121170650.449030-1-yhs@fb.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index ffc3e53f5300..9e7cee5307e0 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -978,6 +978,17 @@ static void __reg_bound_offset(struct bpf_reg_state *reg)
+ 						 reg->umax_value));
+ }
+ 
++static void __reg_bound_offset32(struct bpf_reg_state *reg)
++{
++	u64 mask = 0xffffFFFF;
++	struct tnum range = tnum_range(reg->umin_value & mask,
++				       reg->umax_value & mask);
++	struct tnum lo32 = tnum_cast(reg->var_off, 4);
++	struct tnum hi32 = tnum_lshift(tnum_rshift(reg->var_off, 32), 32);
++
++	reg->var_off = tnum_or(hi32, tnum_intersect(lo32, range));
++}
++
+ /* Reset the min/max bounds of a register */
+ static void __mark_reg_unbounded(struct bpf_reg_state *reg)
+ {
+@@ -5433,6 +5444,10 @@ static void reg_set_min_max(struct bpf_reg_state *true_reg,
+ 	/* We might have learned some bits from the bounds. */
+ 	__reg_bound_offset(false_reg);
+ 	__reg_bound_offset(true_reg);
++	if (is_jmp32) {
++		__reg_bound_offset32(false_reg);
++		__reg_bound_offset32(true_reg);
++	}
+ 	/* Intersecting with the old var_off might have improved our bounds
+ 	 * slightly.  e.g. if umax was 0x7f...f and var_off was (0; 0xf...fc),
+ 	 * then new var_off is (0; 0x7f...fc) which improves our umax.
+@@ -5542,6 +5557,10 @@ static void reg_set_min_max_inv(struct bpf_reg_state *true_reg,
+ 	/* We might have learned some bits from the bounds. */
+ 	__reg_bound_offset(false_reg);
+ 	__reg_bound_offset(true_reg);
++	if (is_jmp32) {
++		__reg_bound_offset32(false_reg);
++		__reg_bound_offset32(true_reg);
++	}
+ 	/* Intersecting with the old var_off might have improved our bounds
+ 	 * slightly.  e.g. if umax was 0x7f...f and var_off was (0; 0xf...fc),
+ 	 * then new var_off is (0; 0x7f...fc) which improves our umax.
+-- 
+2.20.1
+
diff --git a/queue-5.4/bpf-stackmap-fix-deadlock-with-rq_lock-in-bpf_get_st.patch b/queue-5.4/bpf-stackmap-fix-deadlock-with-rq_lock-in-bpf_get_st.patch
new file mode 100644
index 00000000000..cd4296c3b6a
--- /dev/null
+++ b/queue-5.4/bpf-stackmap-fix-deadlock-with-rq_lock-in-bpf_get_st.patch
@@ -0,0 +1,151 @@
+From 316b4d5bedc9f281432b6503360a8829271980a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Oct 2019 10:12:23 -0700
+Subject: bpf/stackmap: Fix deadlock with rq_lock in bpf_get_stack()
+
+From: Song Liu <songliubraving@fb.com>
+
+[ Upstream commit eac9153f2b584c702cea02c1f1a57d85aa9aea42 ]
+
+bpf stackmap with build-id lookup (BPF_F_STACK_BUILD_ID) can trigger A-A
+deadlock on rq_lock():
+
+rcu: INFO: rcu_sched detected stalls on CPUs/tasks:
+[...]
+Call Trace:
+ try_to_wake_up+0x1ad/0x590
+ wake_up_q+0x54/0x80
+ rwsem_wake+0x8a/0xb0
+ bpf_get_stack+0x13c/0x150
+ bpf_prog_fbdaf42eded9fe46_on_event+0x5e3/0x1000
+ bpf_overflow_handler+0x60/0x100
+ __perf_event_overflow+0x4f/0xf0
+ perf_swevent_overflow+0x99/0xc0
+ ___perf_sw_event+0xe7/0x120
+ __schedule+0x47d/0x620
+ schedule+0x29/0x90
+ futex_wait_queue_me+0xb9/0x110
+ futex_wait+0x139/0x230
+ do_futex+0x2ac/0xa50
+ __x64_sys_futex+0x13c/0x180
+ do_syscall_64+0x42/0x100
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+This can be reproduced by:
+1. Start a multi-thread program that does parallel mmap() and malloc();
+2. taskset the program to 2 CPUs;
+3. Attach bpf program to trace_sched_switch and gather stackmap with
+   build-id, e.g. with trace.py from bcc tools:
+   trace.py -U -p <pid> -s <some-bin,some-lib> t:sched:sched_switch
+
+A sample reproducer is attached at the end.
+
+This could also trigger deadlock with other locks that are nested with
+rq_lock.
+
+Fix this by checking whether irqs are disabled. Since rq_lock and all
+other nested locks are irq safe, it is safe to do up_read() when irqs are
+not disable. If the irqs are disabled, postpone up_read() in irq_work.
+
+Fixes: 615755a77b24 ("bpf: extend stackmap to save binary_build_id+offset instead of address")
+Signed-off-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Alexei Starovoitov <ast@kernel.org>
+Cc: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20191014171223.357174-1-songliubraving@fb.com
+
+Reproducer:
+============================ 8< ============================
+
+char *filename;
+
+void *worker(void *p)
+{
+        void *ptr;
+        int fd;
+        char *pptr;
+
+        fd = open(filename, O_RDONLY);
+        if (fd < 0)
+                return NULL;
+        while (1) {
+                struct timespec ts = {0, 1000 + rand() % 2000};
+
+                ptr = mmap(NULL, 4096 * 64, PROT_READ, MAP_PRIVATE, fd, 0);
+                usleep(1);
+                if (ptr == MAP_FAILED) {
+                        printf("failed to mmap\n");
+                        break;
+                }
+                munmap(ptr, 4096 * 64);
+                usleep(1);
+                pptr = malloc(1);
+                usleep(1);
+                pptr[0] = 1;
+                usleep(1);
+                free(pptr);
+                usleep(1);
+                nanosleep(&ts, NULL);
+        }
+        close(fd);
+        return NULL;
+}
+
+int main(int argc, char *argv[])
+{
+        void *ptr;
+        int i;
+        pthread_t threads[THREAD_COUNT];
+
+        if (argc < 2)
+                return 0;
+
+        filename = argv[1];
+
+        for (i = 0; i < THREAD_COUNT; i++) {
+                if (pthread_create(threads + i, NULL, worker, NULL)) {
+                        fprintf(stderr, "Error creating thread\n");
+                        return 0;
+                }
+        }
+
+        for (i = 0; i < THREAD_COUNT; i++)
+                pthread_join(threads[i], NULL);
+        return 0;
+}
+============================ 8< ============================
+
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/stackmap.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
+index 052580c33d26..173e983619d7 100644
+--- a/kernel/bpf/stackmap.c
++++ b/kernel/bpf/stackmap.c
+@@ -287,7 +287,7 @@ static void stack_map_get_build_id_offset(struct bpf_stack_build_id *id_offs,
+ 	bool irq_work_busy = false;
+ 	struct stack_map_irq_work *work = NULL;
+ 
+-	if (in_nmi()) {
++	if (irqs_disabled()) {
+ 		work = this_cpu_ptr(&up_read_work);
+ 		if (work->irq_work.flags & IRQ_WORK_BUSY)
+ 			/* cannot queue more up_read, fallback */
+@@ -295,8 +295,9 @@ static void stack_map_get_build_id_offset(struct bpf_stack_build_id *id_offs,
+ 	}
+ 
+ 	/*
+-	 * We cannot do up_read() in nmi context. To do build_id lookup
+-	 * in nmi context, we need to run up_read() in irq_work. We use
++	 * We cannot do up_read() when the irq is disabled, because of
++	 * risk to deadlock with rq_lock. To do build_id lookup when the
++	 * irqs are disabled, we need to run up_read() in irq_work. We use
+ 	 * a percpu variable to do the irq_work. If the irq_work is
+ 	 * already used by another lookup, we fall back to report ips.
+ 	 *
+-- 
+2.20.1
+
diff --git a/queue-5.4/bpf-testing-workaround-a-verifier-failure-for-test_p.patch b/queue-5.4/bpf-testing-workaround-a-verifier-failure-for-test_p.patch
new file mode 100644
index 00000000000..e8ec7125546
--- /dev/null
+++ b/queue-5.4/bpf-testing-workaround-a-verifier-failure-for-test_p.patch
@@ -0,0 +1,118 @@
+From 7245b41c664467e31217677b7cf2cc6ee53bc708 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2019 09:00:45 -0800
+Subject: bpf, testing: Workaround a verifier failure for test_progs
+
+From: Yonghong Song <yhs@fb.com>
+
+[ Upstream commit b7a0d65d80a0c5034b366392624397a0915b7556 ]
+
+With latest llvm compiler, running test_progs will have the following
+verifier failure for test_sysctl_loop1.o:
+
+  libbpf: load bpf program failed: Permission denied
+  libbpf: -- BEGIN DUMP LOG ---
+  libbpf:
+  invalid indirect read from stack var_off (0x0; 0xff)+196 size 7
+  ...
+  libbpf: -- END LOG --
+  libbpf: failed to load program 'cgroup/sysctl'
+  libbpf: failed to load object 'test_sysctl_loop1.o'
+
+The related bytecode looks as below:
+
+  0000000000000308 LBB0_8:
+      97:       r4 = r10
+      98:       r4 += -288
+      99:       r4 += r7
+     100:       w8 &= 255
+     101:       r1 = r10
+     102:       r1 += -488
+     103:       r1 += r8
+     104:       r2 = 7
+     105:       r3 = 0
+     106:       call 106
+     107:       w1 = w0
+     108:       w1 += -1
+     109:       if w1 > 6 goto -24 <LBB0_5>
+     110:       w0 += w8
+     111:       r7 += 8
+     112:       w8 = w0
+     113:       if r7 != 224 goto -17 <LBB0_8>
+
+And source code:
+
+     for (i = 0; i < ARRAY_SIZE(tcp_mem); ++i) {
+             ret = bpf_strtoul(value + off, MAX_ULONG_STR_LEN, 0,
+                               tcp_mem + i);
+             if (ret <= 0 || ret > MAX_ULONG_STR_LEN)
+                     return 0;
+             off += ret & MAX_ULONG_STR_LEN;
+     }
+
+Current verifier is not able to conclude that register w0 before '+'
+at insn 110 has a range of 1 to 7 and thinks it is from 0 - 255. This
+leads to more conservative range for w8 at insn 112, and later verifier
+complaint.
+
+Let us workaround this issue until we found a compiler and/or verifier
+solution. The workaround in this patch is to make variable 'ret' volatile,
+which will force a reload and then '&' operation to ensure better value
+range. With this patch, I got the below byte code for the loop:
+
+  0000000000000328 LBB0_9:
+     101:       r4 = r10
+     102:       r4 += -288
+     103:       r4 += r7
+     104:       w8 &= 255
+     105:       r1 = r10
+     106:       r1 += -488
+     107:       r1 += r8
+     108:       r2 = 7
+     109:       r3 = 0
+     110:       call 106
+     111:       *(u32 *)(r10 - 64) = r0
+     112:       r1 = *(u32 *)(r10 - 64)
+     113:       if w1 s< 1 goto -28 <LBB0_5>
+     114:       r1 = *(u32 *)(r10 - 64)
+     115:       if w1 s> 7 goto -30 <LBB0_5>
+     116:       r1 = *(u32 *)(r10 - 64)
+     117:       w1 &= 7
+     118:       w1 += w8
+     119:       r7 += 8
+     120:       w8 = w1
+     121:       if r7 != 224 goto -21 <LBB0_9>
+
+Insn 117 did the '&' operation and we got more precise value range
+for 'w8' at insn 120. The test is happy then:
+
+  #3/17 test_sysctl_loop1.o:OK
+
+Signed-off-by: Yonghong Song <yhs@fb.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Song Liu <songliubraving@fb.com>
+Link: https://lore.kernel.org/bpf/20191107170045.2503480-1-yhs@fb.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/progs/test_sysctl_loop1.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/progs/test_sysctl_loop1.c b/tools/testing/selftests/bpf/progs/test_sysctl_loop1.c
+index 608a06871572..d22e438198cf 100644
+--- a/tools/testing/selftests/bpf/progs/test_sysctl_loop1.c
++++ b/tools/testing/selftests/bpf/progs/test_sysctl_loop1.c
+@@ -44,7 +44,10 @@ int sysctl_tcp_mem(struct bpf_sysctl *ctx)
+ 	unsigned long tcp_mem[TCP_MEM_LOOPS] = {};
+ 	char value[MAX_VALUE_STR_LEN];
+ 	unsigned char i, off = 0;
+-	int ret;
++	/* a workaround to prevent compiler from generating
++	 * codes verifier cannot handle yet.
++	 */
++	volatile int ret;
+ 
+ 	if (ctx->write)
+ 		return 0;
+-- 
+2.20.1
+
diff --git a/queue-5.4/brcmfmac-remove-monitor-interface-when-detaching.patch b/queue-5.4/brcmfmac-remove-monitor-interface-when-detaching.patch
new file mode 100644
index 00000000000..f2d07f5089a
--- /dev/null
+++ b/queue-5.4/brcmfmac-remove-monitor-interface-when-detaching.patch
@@ -0,0 +1,42 @@
+From 25f5ee2f5b14370b4c59991bb78370e10b18b6c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Nov 2019 13:38:55 +0100
+Subject: brcmfmac: remove monitor interface when detaching
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafał Miłecki <rafal@milecki.pl>
+
+[ Upstream commit 4f61563da075bc8faefddfd5f8fc0cc14c49650a ]
+
+This fixes a minor WARNING in the cfg80211:
+[  130.658034] ------------[ cut here ]------------
+[  130.662805] WARNING: CPU: 1 PID: 610 at net/wireless/core.c:954 wiphy_unregister+0xb4/0x198 [cfg80211]
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+index 406b367c284c..85cf96461dde 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -1350,6 +1350,11 @@ void brcmf_detach(struct device *dev)
+ 	brcmf_fweh_detach(drvr);
+ 	brcmf_proto_detach(drvr);
+ 
++	if (drvr->mon_if) {
++		brcmf_net_detach(drvr->mon_if->ndev, false);
++		drvr->mon_if = NULL;
++	}
++
+ 	/* make sure primary interface removed last */
+ 	for (i = BRCMF_MAX_IFS - 1; i > -1; i--) {
+ 		if (drvr->iflist[i])
+-- 
+2.20.1
+
diff --git a/queue-5.4/btrfs-don-t-prematurely-free-work-in-end_workqueue_f.patch b/queue-5.4/btrfs-don-t-prematurely-free-work-in-end_workqueue_f.patch
new file mode 100644
index 00000000000..c183a45f43f
--- /dev/null
+++ b/queue-5.4/btrfs-don-t-prematurely-free-work-in-end_workqueue_f.patch
@@ -0,0 +1,54 @@
+From ba6ae4754649c77ea2f707780aa17a57c79762c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Sep 2019 11:30:54 -0700
+Subject: btrfs: don't prematurely free work in end_workqueue_fn()
+
+From: Omar Sandoval <osandov@fb.com>
+
+[ Upstream commit 9be490f1e15c34193b1aae17da58e14dd9f55a95 ]
+
+Currently, end_workqueue_fn() frees the end_io_wq entry (which embeds
+the work item) and then calls bio_endio(). This is another potential
+instance of the bug in "btrfs: don't prematurely free work in
+run_ordered_work()".
+
+In particular, the endio call may depend on other work items. For
+example, btrfs_end_dio_bio() can call btrfs_subio_endio_read() ->
+__btrfs_correct_data_nocsum() -> dio_read_error() ->
+submit_dio_repair_bio(), which submits a bio that is also completed
+through a end_workqueue_fn() work item. However,
+__btrfs_correct_data_nocsum() waits for the newly submitted bio to
+complete, thus it depends on another work item.
+
+This example currently usually works because we use different workqueue
+helper functions for BTRFS_WQ_ENDIO_DATA and BTRFS_WQ_ENDIO_DIO_REPAIR.
+However, it may deadlock with stacked filesystems and is fragile
+overall. The proper fix is to free the work item at the very end of the
+work function, so let's do that.
+
+Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
+Signed-off-by: Omar Sandoval <osandov@fb.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/disk-io.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
+index 402b61bf345c..3895c21853cc 100644
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -1657,8 +1657,8 @@ static void end_workqueue_fn(struct btrfs_work *work)
+ 	bio->bi_status = end_io_wq->status;
+ 	bio->bi_private = end_io_wq->private;
+ 	bio->bi_end_io = end_io_wq->end_io;
+-	kmem_cache_free(btrfs_end_io_wq_cache, end_io_wq);
+ 	bio_endio(bio);
++	kmem_cache_free(btrfs_end_io_wq_cache, end_io_wq);
+ }
+ 
+ static int cleaner_kthread(void *arg)
+-- 
+2.20.1
+
diff --git a/queue-5.4/btrfs-don-t-prematurely-free-work-in-reada_start_mac.patch b/queue-5.4/btrfs-don-t-prematurely-free-work-in-reada_start_mac.patch
new file mode 100644
index 00000000000..2bd311d18c6
--- /dev/null
+++ b/queue-5.4/btrfs-don-t-prematurely-free-work-in-reada_start_mac.patch
@@ -0,0 +1,66 @@
+From ac1c9324a647c1c450728ed1710d1ef8d93a2064 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Sep 2019 11:30:55 -0700
+Subject: btrfs: don't prematurely free work in reada_start_machine_worker()
+
+From: Omar Sandoval <osandov@fb.com>
+
+[ Upstream commit e732fe95e4cad35fc1df278c23a32903341b08b3 ]
+
+Currently, reada_start_machine_worker() frees the reada_machine_work and
+then calls __reada_start_machine() to do readahead. This is another
+potential instance of the bug in "btrfs: don't prematurely free work in
+run_ordered_work()".
+
+There _might_ already be a deadlock here: reada_start_machine_worker()
+can depend on itself through stacked filesystems (__read_start_machine()
+-> reada_start_machine_dev() -> reada_tree_block_flagged() ->
+read_extent_buffer_pages() -> submit_one_bio() ->
+btree_submit_bio_hook() -> btrfs_map_bio() -> submit_stripe_bio() ->
+submit_bio() onto a loop device can trigger readahead on the lower
+filesystem).
+
+Either way, let's fix it by freeing the work at the end.
+
+Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
+Signed-off-by: Omar Sandoval <osandov@fb.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/reada.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/fs/btrfs/reada.c b/fs/btrfs/reada.c
+index ee6f60547a8d..dd4f9c2b7107 100644
+--- a/fs/btrfs/reada.c
++++ b/fs/btrfs/reada.c
+@@ -752,21 +752,19 @@ static int reada_start_machine_dev(struct btrfs_device *dev)
+ static void reada_start_machine_worker(struct btrfs_work *work)
+ {
+ 	struct reada_machine_work *rmw;
+-	struct btrfs_fs_info *fs_info;
+ 	int old_ioprio;
+ 
+ 	rmw = container_of(work, struct reada_machine_work, work);
+-	fs_info = rmw->fs_info;
+-
+-	kfree(rmw);
+ 
+ 	old_ioprio = IOPRIO_PRIO_VALUE(task_nice_ioclass(current),
+ 				       task_nice_ioprio(current));
+ 	set_task_ioprio(current, BTRFS_IOPRIO_READA);
+-	__reada_start_machine(fs_info);
++	__reada_start_machine(rmw->fs_info);
+ 	set_task_ioprio(current, old_ioprio);
+ 
+-	atomic_dec(&fs_info->reada_works_cnt);
++	atomic_dec(&rmw->fs_info->reada_works_cnt);
++
++	kfree(rmw);
+ }
+ 
+ static void __reada_start_machine(struct btrfs_fs_info *fs_info)
+-- 
+2.20.1
+
diff --git a/queue-5.4/btrfs-don-t-prematurely-free-work-in-run_ordered_wor.patch b/queue-5.4/btrfs-don-t-prematurely-free-work-in-run_ordered_wor.patch
new file mode 100644
index 00000000000..5938114e5ed
--- /dev/null
+++ b/queue-5.4/btrfs-don-t-prematurely-free-work-in-run_ordered_wor.patch
@@ -0,0 +1,154 @@
+From fe50672d931d45dc9db42602740a1503f15f255f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Sep 2019 11:30:53 -0700
+Subject: btrfs: don't prematurely free work in run_ordered_work()
+
+From: Omar Sandoval <osandov@fb.com>
+
+[ Upstream commit c495dcd6fbe1dce51811a76bb85b4675f6494938 ]
+
+We hit the following very strange deadlock on a system with Btrfs on a
+loop device backed by another Btrfs filesystem:
+
+1. The top (loop device) filesystem queues an async_cow work item from
+   cow_file_range_async(). We'll call this work X.
+2. Worker thread A starts work X (normal_work_helper()).
+3. Worker thread A executes the ordered work for the top filesystem
+   (run_ordered_work()).
+4. Worker thread A finishes the ordered work for work X and frees X
+   (work->ordered_free()).
+5. Worker thread A executes another ordered work and gets blocked on I/O
+   to the bottom filesystem (still in run_ordered_work()).
+6. Meanwhile, the bottom filesystem allocates and queues an async_cow
+   work item which happens to be the recently-freed X.
+7. The workqueue code sees that X is already being executed by worker
+   thread A, so it schedules X to be executed _after_ worker thread A
+   finishes (see the find_worker_executing_work() call in
+   process_one_work()).
+
+Now, the top filesystem is waiting for I/O on the bottom filesystem, but
+the bottom filesystem is waiting for the top filesystem to finish, so we
+deadlock.
+
+This happens because we are breaking the workqueue assumption that a
+work item cannot be recycled while it still depends on other work. Fix
+it by waiting to free the work item until we are done with all of the
+related ordered work.
+
+P.S.:
+
+One might ask why the workqueue code doesn't try to detect a recycled
+work item. It actually does try by checking whether the work item has
+the same work function (find_worker_executing_work()), but in our case
+the function is the same. This is the only key that the workqueue code
+has available to compare, short of adding an additional, layer-violating
+"custom key". Considering that we're the only ones that have ever hit
+this, we should just play by the rules.
+
+Unfortunately, we haven't been able to create a minimal reproducer other
+than our full container setup using a compress-force=zstd filesystem on
+top of another compress-force=zstd filesystem.
+
+Suggested-by: Tejun Heo <tj@kernel.org>
+Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
+Signed-off-by: Omar Sandoval <osandov@fb.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/async-thread.c | 56 ++++++++++++++++++++++++++++++++---------
+ 1 file changed, 44 insertions(+), 12 deletions(-)
+
+diff --git a/fs/btrfs/async-thread.c b/fs/btrfs/async-thread.c
+index 2e9e13ffbd08..10a04b99798a 100644
+--- a/fs/btrfs/async-thread.c
++++ b/fs/btrfs/async-thread.c
+@@ -252,16 +252,17 @@ out:
+ 	}
+ }
+ 
+-static void run_ordered_work(struct __btrfs_workqueue *wq)
++static void run_ordered_work(struct __btrfs_workqueue *wq,
++			     struct btrfs_work *self)
+ {
+ 	struct list_head *list = &wq->ordered_list;
+ 	struct btrfs_work *work;
+ 	spinlock_t *lock = &wq->list_lock;
+ 	unsigned long flags;
++	void *wtag;
++	bool free_self = false;
+ 
+ 	while (1) {
+-		void *wtag;
+-
+ 		spin_lock_irqsave(lock, flags);
+ 		if (list_empty(list))
+ 			break;
+@@ -287,16 +288,47 @@ static void run_ordered_work(struct __btrfs_workqueue *wq)
+ 		list_del(&work->ordered_list);
+ 		spin_unlock_irqrestore(lock, flags);
+ 
+-		/*
+-		 * We don't want to call the ordered free functions with the
+-		 * lock held though. Save the work as tag for the trace event,
+-		 * because the callback could free the structure.
+-		 */
+-		wtag = work;
+-		work->ordered_free(work);
+-		trace_btrfs_all_work_done(wq->fs_info, wtag);
++		if (work == self) {
++			/*
++			 * This is the work item that the worker is currently
++			 * executing.
++			 *
++			 * The kernel workqueue code guarantees non-reentrancy
++			 * of work items. I.e., if a work item with the same
++			 * address and work function is queued twice, the second
++			 * execution is blocked until the first one finishes. A
++			 * work item may be freed and recycled with the same
++			 * work function; the workqueue code assumes that the
++			 * original work item cannot depend on the recycled work
++			 * item in that case (see find_worker_executing_work()).
++			 *
++			 * Note that the work of one Btrfs filesystem may depend
++			 * on the work of another Btrfs filesystem via, e.g., a
++			 * loop device. Therefore, we must not allow the current
++			 * work item to be recycled until we are really done,
++			 * otherwise we break the above assumption and can
++			 * deadlock.
++			 */
++			free_self = true;
++		} else {
++			/*
++			 * We don't want to call the ordered free functions with
++			 * the lock held though. Save the work as tag for the
++			 * trace event, because the callback could free the
++			 * structure.
++			 */
++			wtag = work;
++			work->ordered_free(work);
++			trace_btrfs_all_work_done(wq->fs_info, wtag);
++		}
+ 	}
+ 	spin_unlock_irqrestore(lock, flags);
++
++	if (free_self) {
++		wtag = self;
++		self->ordered_free(self);
++		trace_btrfs_all_work_done(wq->fs_info, wtag);
++	}
+ }
+ 
+ static void normal_work_helper(struct btrfs_work *work)
+@@ -324,7 +356,7 @@ static void normal_work_helper(struct btrfs_work *work)
+ 	work->func(work);
+ 	if (need_order) {
+ 		set_bit(WORK_DONE_BIT, &work->flags);
+-		run_ordered_work(wq);
++		run_ordered_work(wq, work);
+ 	}
+ 	if (!need_order)
+ 		trace_btrfs_all_work_done(wq->fs_info, wtag);
+-- 
+2.20.1
+
diff --git a/queue-5.4/btrfs-don-t-prematurely-free-work-in-scrub_missing_r.patch b/queue-5.4/btrfs-don-t-prematurely-free-work-in-scrub_missing_r.patch
new file mode 100644
index 00000000000..c0d4350c8f7
--- /dev/null
+++ b/queue-5.4/btrfs-don-t-prematurely-free-work-in-scrub_missing_r.patch
@@ -0,0 +1,47 @@
+From 67551330b295b8c966347d6aebe16f05b4f8407d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Sep 2019 11:30:56 -0700
+Subject: btrfs: don't prematurely free work in scrub_missing_raid56_worker()
+
+From: Omar Sandoval <osandov@fb.com>
+
+[ Upstream commit 57d4f0b863272ba04ba85f86bfdc0f976f0af91c ]
+
+Currently, scrub_missing_raid56_worker() puts and potentially frees
+sblock (which embeds the work item) and then submits a bio through
+scrub_wr_submit(). This is another potential instance of the bug in
+"btrfs: don't prematurely free work in run_ordered_work()". Fix it by
+dropping the reference after we submit the bio.
+
+Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
+Signed-off-by: Omar Sandoval <osandov@fb.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/scrub.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
+index f7d4e03f4c5d..a0770a6aee00 100644
+--- a/fs/btrfs/scrub.c
++++ b/fs/btrfs/scrub.c
+@@ -2149,14 +2149,13 @@ static void scrub_missing_raid56_worker(struct btrfs_work *work)
+ 		scrub_write_block_to_dev_replace(sblock);
+ 	}
+ 
+-	scrub_block_put(sblock);
+-
+ 	if (sctx->is_dev_replace && sctx->flush_all_writes) {
+ 		mutex_lock(&sctx->wr_lock);
+ 		scrub_wr_submit(sctx);
+ 		mutex_unlock(&sctx->wr_lock);
+ 	}
+ 
++	scrub_block_put(sblock);
+ 	scrub_pending_bio_dec(sctx);
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/cgroup-freezer-don-t-change-task-and-cgroups-status-.patch b/queue-5.4/cgroup-freezer-don-t-change-task-and-cgroups-status-.patch
new file mode 100644
index 00000000000..c551858eec5
--- /dev/null
+++ b/queue-5.4/cgroup-freezer-don-t-change-task-and-cgroups-status-.patch
@@ -0,0 +1,50 @@
+From 2114b1b73f8deacf285b379539aeca148919b0f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Oct 2019 16:18:10 +0800
+Subject: cgroup: freezer: don't change task and cgroups status unnecessarily
+
+From: Honglei Wang <honglei.wang@oracle.com>
+
+[ Upstream commit 742e8cd3e1ba6f19cad6d912f8d469df5557d0fd ]
+
+It's not necessary to adjust the task state and revisit the state
+of source and destination cgroups if the cgroups are not in freeze
+state and the task itself is not frozen.
+
+And in this scenario, it wakes up the task who's not supposed to be
+ready to run.
+
+Don't do the unnecessary task state adjustment can help stop waking
+up the task without a reason.
+
+Signed-off-by: Honglei Wang <honglei.wang@oracle.com>
+Acked-by: Roman Gushchin <guro@fb.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/cgroup/freezer.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/kernel/cgroup/freezer.c b/kernel/cgroup/freezer.c
+index 8cf010680678..3984dd6b8ddb 100644
+--- a/kernel/cgroup/freezer.c
++++ b/kernel/cgroup/freezer.c
+@@ -230,6 +230,15 @@ void cgroup_freezer_migrate_task(struct task_struct *task,
+ 	if (task->flags & PF_KTHREAD)
+ 		return;
+ 
++	/*
++	 * It's not necessary to do changes if both of the src and dst cgroups
++	 * are not freezing and task is not frozen.
++	 */
++	if (!test_bit(CGRP_FREEZE, &src->flags) &&
++	    !test_bit(CGRP_FREEZE, &dst->flags) &&
++	    !task->frozen)
++		return;
++
+ 	/*
+ 	 * Adjust counters of freezing and frozen tasks.
+ 	 * Note, that if the task is frozen, but the destination cgroup is not
+-- 
+2.20.1
+
diff --git a/queue-5.4/cpufreq-register-drivers-only-after-cpu-devices-have.patch b/queue-5.4/cpufreq-register-drivers-only-after-cpu-devices-have.patch
new file mode 100644
index 00000000000..0da69e04fab
--- /dev/null
+++ b/queue-5.4/cpufreq-register-drivers-only-after-cpu-devices-have.patch
@@ -0,0 +1,69 @@
+From 3571336d3eceeb50fa79f3db4044f153657d9c50 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Nov 2019 09:06:17 +0530
+Subject: cpufreq: Register drivers only after CPU devices have been registered
+
+From: Viresh Kumar <viresh.kumar@linaro.org>
+
+[ Upstream commit 46770be0cf94149ca48be87719bda1d951066644 ]
+
+The cpufreq core heavily depends on the availability of the struct
+device for CPUs and if they aren't available at the time cpufreq driver
+is registered, we will never succeed in making cpufreq work.
+
+This happens due to following sequence of events:
+
+- cpufreq_register_driver()
+  - subsys_interface_register()
+  - return 0; //successful registration of driver
+
+... at a later point of time
+
+- register_cpu();
+  - device_register();
+    - bus_probe_device();
+      - sif->add_dev();
+	- cpufreq_add_dev();
+	  - get_cpu_device(); //FAILS
+  - per_cpu(cpu_sys_devices, num) = &cpu->dev; //used by get_cpu_device()
+  - return 0; //CPU registered successfully
+
+Because the per-cpu variable cpu_sys_devices is set only after the CPU
+device is regsitered, cpufreq will never be able to get it when
+cpufreq_add_dev() is called.
+
+This patch avoids this failure by making sure device structure of at
+least CPU0 is available when the cpufreq driver is registered, else
+return -EPROBE_DEFER.
+
+Reported-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Co-developed-by: Amit Kucheria <amit.kucheria@linaro.org>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Tested-by: Amit Kucheria <amit.kucheria@linaro.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/cpufreq.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
+index bc19d6c16aaa..a7db4f22a077 100644
+--- a/drivers/cpufreq/cpufreq.c
++++ b/drivers/cpufreq/cpufreq.c
+@@ -2634,6 +2634,13 @@ int cpufreq_register_driver(struct cpufreq_driver *driver_data)
+ 	if (cpufreq_disabled())
+ 		return -ENODEV;
+ 
++	/*
++	 * The cpufreq core depends heavily on the availability of device
++	 * structure, make sure they are available before proceeding further.
++	 */
++	if (!get_cpu_device(0))
++		return -EPROBE_DEFER;
++
+ 	if (!driver_data || !driver_data->verify || !driver_data->init ||
+ 	    !(driver_data->setpolicy || driver_data->target_index ||
+ 		    driver_data->target) ||
+-- 
+2.20.1
+
diff --git a/queue-5.4/cpufreq-sun50i-fix-cpu-speed-bin-detection.patch b/queue-5.4/cpufreq-sun50i-fix-cpu-speed-bin-detection.patch
new file mode 100644
index 00000000000..93bf063a965
--- /dev/null
+++ b/queue-5.4/cpufreq-sun50i-fix-cpu-speed-bin-detection.patch
@@ -0,0 +1,89 @@
+From 3521cffd5e441bb43de3075c3b5272f4876895f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Nov 2019 17:41:51 +0100
+Subject: cpufreq: sun50i: Fix CPU speed bin detection
+
+From: Ondrej Jirman <megous@megous.com>
+
+[ Upstream commit c23734487fb44ee16c1b007ba72d793c085e4ec4 ]
+
+I have observed failures to boot on Orange Pi 3, because this driver
+determined that my SoC is from the normal bin, but my SoC only works
+reliably with the OPP values for the slowest bin.
+
+By querying H6 owners, it was found that e-fuse values found in the wild
+are in the range of 1-3, value of 7 was not reported, yet. From this and
+from unused defines in BSP code, it can be assumed that meaning of efuse
+values on H6 actually is:
+
+- 1 = slowest bin
+- 2 = normal bin
+- 3 = fastest bin
+
+Vendor code actually treats 0 and 2 as invalid efuse values, but later
+treats all invalid values as a normal bin. This looks like a mistake in
+bin detection code, that was plastered over by a hack in cpufreq code,
+so let's not repeat it here. It probably only works because there are no
+SoCs in the wild with efuse value of 0, and fast bin SoCs are made to
+use normal bin OPP tables, which is also safe.
+
+Let's play it safe and interpret 0 as the slowest bin, but fix detection
+of other bins to match this research. More research will be done before
+actual OPP tables are merged.
+
+Fixes: f328584f7bff ("cpufreq: Add sun50i nvmem based CPU scaling driver")
+Acked-by: Maxime Ripard <mripard@kernel.org>
+Signed-off-by: Ondrej Jirman <megous@megous.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/sun50i-cpufreq-nvmem.c | 25 ++++++++++---------------
+ 1 file changed, 10 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/cpufreq/sun50i-cpufreq-nvmem.c b/drivers/cpufreq/sun50i-cpufreq-nvmem.c
+index eca32e443716..9907a165135b 100644
+--- a/drivers/cpufreq/sun50i-cpufreq-nvmem.c
++++ b/drivers/cpufreq/sun50i-cpufreq-nvmem.c
+@@ -25,7 +25,7 @@
+ static struct platform_device *cpufreq_dt_pdev, *sun50i_cpufreq_pdev;
+ 
+ /**
+- * sun50i_cpufreq_get_efuse() - Parse and return efuse value present on SoC
++ * sun50i_cpufreq_get_efuse() - Determine speed grade from efuse value
+  * @versions: Set to the value parsed from efuse
+  *
+  * Returns 0 if success.
+@@ -69,21 +69,16 @@ static int sun50i_cpufreq_get_efuse(u32 *versions)
+ 		return PTR_ERR(speedbin);
+ 
+ 	efuse_value = (*speedbin >> NVMEM_SHIFT) & NVMEM_MASK;
+-	switch (efuse_value) {
+-	case 0b0001:
+-		*versions = 1;
+-		break;
+-	case 0b0011:
+-		*versions = 2;
+-		break;
+-	default:
+-		/*
+-		 * For other situations, we treat it as bin0.
+-		 * This vf table can be run for any good cpu.
+-		 */
++
++	/*
++	 * We treat unexpected efuse values as if the SoC was from
++	 * the slowest bin. Expected efuse values are 1-3, slowest
++	 * to fastest.
++	 */
++	if (efuse_value >= 1 && efuse_value <= 3)
++		*versions = efuse_value - 1;
++	else
+ 		*versions = 0;
+-		break;
+-	}
+ 
+ 	kfree(speedbin);
+ 	return 0;
+-- 
+2.20.1
+
diff --git a/queue-5.4/crypto-aegis128-neon-use-clang-compatible-cflags-for.patch b/queue-5.4/crypto-aegis128-neon-use-clang-compatible-cflags-for.patch
new file mode 100644
index 00000000000..b78cb754668
--- /dev/null
+++ b/queue-5.4/crypto-aegis128-neon-use-clang-compatible-cflags-for.patch
@@ -0,0 +1,49 @@
+From 6b7ca6d485017b39cf334737da3358543b1107bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Sep 2019 19:36:18 +0100
+Subject: crypto: aegis128-neon - use Clang compatible cflags for ARM
+
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+
+[ Upstream commit 2eb2d198bd6cd0083a5363ce66272fb34a19928f ]
+
+The next version of Clang will start policing compiler command line
+options, and will reject combinations of -march and -mfpu that it
+thinks are incompatible.
+
+This results in errors like
+
+  clang-10: warning: ignoring extension 'crypto' because the 'armv7-a'
+  architecture does not support it [-Winvalid-command-line-argument]
+  /tmp/aegis128-neon-inner-5ee428.s: Assembler messages:
+            /tmp/aegis128-neon-inner-5ee428.s:73: Error: selected
+  processor does not support `aese.8 q2,q14' in ARM mode
+
+when buiding the SIMD aegis128 code for 32-bit ARM, given that the
+'armv7-a' -march argument is considered to be compatible with the
+ARM crypto extensions. Instead, we should use armv8-a, which does
+allow the crypto extensions to be enabled.
+
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/crypto/Makefile b/crypto/Makefile
+index fcb1ee679782..aa740c8492b9 100644
+--- a/crypto/Makefile
++++ b/crypto/Makefile
+@@ -93,7 +93,7 @@ obj-$(CONFIG_CRYPTO_AEGIS128) += aegis128.o
+ aegis128-y := aegis128-core.o
+ 
+ ifeq ($(ARCH),arm)
+-CFLAGS_aegis128-neon-inner.o += -ffreestanding -march=armv7-a -mfloat-abi=softfp
++CFLAGS_aegis128-neon-inner.o += -ffreestanding -march=armv8-a -mfloat-abi=softfp
+ CFLAGS_aegis128-neon-inner.o += -mfpu=crypto-neon-fp-armv8
+ aegis128-$(CONFIG_CRYPTO_AEGIS128_SIMD) += aegis128-neon.o aegis128-neon-inner.o
+ endif
+-- 
+2.20.1
+
diff --git a/queue-5.4/crypto-aegis128-simd-build-32-bit-arm-for-v8-archite.patch b/queue-5.4/crypto-aegis128-simd-build-32-bit-arm-for-v8-archite.patch
new file mode 100644
index 00000000000..84c1cd10d5e
--- /dev/null
+++ b/queue-5.4/crypto-aegis128-simd-build-32-bit-arm-for-v8-archite.patch
@@ -0,0 +1,50 @@
+From c17bd142bc61d1da82ef9780110ddc7d39138f32 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Oct 2019 09:54:48 +0200
+Subject: crypto: aegis128/simd - build 32-bit ARM for v8 architecture
+ explicitly
+
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+
+[ Upstream commit 830536770f968ab33ece123b317e252c269098db ]
+
+Now that the Clang compiler has taken it upon itself to police the
+compiler command line, and reject combinations for arguments it views
+as incompatible, the AEGIS128 no longer builds correctly, and errors
+out like this:
+
+  clang-10: warning: ignoring extension 'crypto' because the 'armv7-a'
+  architecture does not support it [-Winvalid-command-line-argument]
+
+So let's switch to armv8-a instead, which matches the crypto-neon-fp-armv8
+FPU profile we specify. Since neither were actually supported by GCC
+versions before 4.8, let's tighten the Kconfig dependencies as well so
+we won't run into errors when building with an ancient compiler.
+
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
+Tested-by: Nathan Chancellor <natechancellor@gmail.com>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Tested-by: Nick Desaulniers <ndesaulniers@google.com>
+Reported-by: <ci_notify@linaro.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/crypto/Kconfig b/crypto/Kconfig
+index 9e524044d312..29472fb795f3 100644
+--- a/crypto/Kconfig
++++ b/crypto/Kconfig
+@@ -309,6 +309,7 @@ config CRYPTO_AEGIS128
+ config CRYPTO_AEGIS128_SIMD
+ 	bool "Support SIMD acceleration for AEGIS-128"
+ 	depends on CRYPTO_AEGIS128 && ((ARM || ARM64) && KERNEL_MODE_NEON)
++	depends on !ARM || CC_IS_CLANG || GCC_VERSION >= 40800
+ 	default y
+ 
+ config CRYPTO_AEGIS128_AESNI_SSE2
+-- 
+2.20.1
+
diff --git a/queue-5.4/crypto-atmel-fix-authenc-support-when-it-is-set-to-m.patch b/queue-5.4/crypto-atmel-fix-authenc-support-when-it-is-set-to-m.patch
new file mode 100644
index 00000000000..49c6a4e6299
--- /dev/null
+++ b/queue-5.4/crypto-atmel-fix-authenc-support-when-it-is-set-to-m.patch
@@ -0,0 +1,138 @@
+From 529eaba288135bc5ebd73b295ba400300a2534d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Oct 2019 15:39:07 +0800
+Subject: crypto: atmel - Fix authenc support when it is set to m
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 1520c72596dde7f22b8bd6bed3ef7df2b8b7ef39 ]
+
+As it is if CONFIG_CRYPTO_DEV_ATMEL_AUTHENC is set to m it is in
+effect disabled.  This patch fixes it by using IS_ENABLED instead
+of ifdef.
+
+Fixes: 89a82ef87e01 ("crypto: atmel-authenc - add support to...")
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Reviewed-by: Tudor Ambarus <tudor.ambarus@microchip.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/atmel-aes.c     | 18 +++++++++---------
+ drivers/crypto/atmel-authenc.h |  2 +-
+ drivers/crypto/atmel-sha.c     |  2 +-
+ 3 files changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/crypto/atmel-aes.c b/drivers/crypto/atmel-aes.c
+index 00920a2b95ce..db99cee1991c 100644
+--- a/drivers/crypto/atmel-aes.c
++++ b/drivers/crypto/atmel-aes.c
+@@ -145,7 +145,7 @@ struct atmel_aes_xts_ctx {
+ 	u32			key2[AES_KEYSIZE_256 / sizeof(u32)];
+ };
+ 
+-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC
++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC)
+ struct atmel_aes_authenc_ctx {
+ 	struct atmel_aes_base_ctx	base;
+ 	struct atmel_sha_authenc_ctx	*auth;
+@@ -157,7 +157,7 @@ struct atmel_aes_reqctx {
+ 	u32			lastc[AES_BLOCK_SIZE / sizeof(u32)];
+ };
+ 
+-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC
++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC)
+ struct atmel_aes_authenc_reqctx {
+ 	struct atmel_aes_reqctx	base;
+ 
+@@ -486,7 +486,7 @@ static inline bool atmel_aes_is_encrypt(const struct atmel_aes_dev *dd)
+ 	return (dd->flags & AES_FLAGS_ENCRYPT);
+ }
+ 
+-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC
++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC)
+ static void atmel_aes_authenc_complete(struct atmel_aes_dev *dd, int err);
+ #endif
+ 
+@@ -515,7 +515,7 @@ static void atmel_aes_set_iv_as_last_ciphertext_block(struct atmel_aes_dev *dd)
+ 
+ static inline int atmel_aes_complete(struct atmel_aes_dev *dd, int err)
+ {
+-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC
++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC)
+ 	if (dd->ctx->is_aead)
+ 		atmel_aes_authenc_complete(dd, err);
+ #endif
+@@ -1980,7 +1980,7 @@ static struct crypto_alg aes_xts_alg = {
+ 	}
+ };
+ 
+-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC
++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC)
+ /* authenc aead functions */
+ 
+ static int atmel_aes_authenc_start(struct atmel_aes_dev *dd);
+@@ -2467,7 +2467,7 @@ static void atmel_aes_unregister_algs(struct atmel_aes_dev *dd)
+ {
+ 	int i;
+ 
+-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC
++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC)
+ 	if (dd->caps.has_authenc)
+ 		for (i = 0; i < ARRAY_SIZE(aes_authenc_algs); i++)
+ 			crypto_unregister_aead(&aes_authenc_algs[i]);
+@@ -2514,7 +2514,7 @@ static int atmel_aes_register_algs(struct atmel_aes_dev *dd)
+ 			goto err_aes_xts_alg;
+ 	}
+ 
+-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC
++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC)
+ 	if (dd->caps.has_authenc) {
+ 		for (i = 0; i < ARRAY_SIZE(aes_authenc_algs); i++) {
+ 			err = crypto_register_aead(&aes_authenc_algs[i]);
+@@ -2526,7 +2526,7 @@ static int atmel_aes_register_algs(struct atmel_aes_dev *dd)
+ 
+ 	return 0;
+ 
+-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC
++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC)
+ 	/* i = ARRAY_SIZE(aes_authenc_algs); */
+ err_aes_authenc_alg:
+ 	for (j = 0; j < i; j++)
+@@ -2716,7 +2716,7 @@ static int atmel_aes_probe(struct platform_device *pdev)
+ 
+ 	atmel_aes_get_cap(aes_dd);
+ 
+-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC
++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC)
+ 	if (aes_dd->caps.has_authenc && !atmel_sha_authenc_is_ready()) {
+ 		err = -EPROBE_DEFER;
+ 		goto iclk_unprepare;
+diff --git a/drivers/crypto/atmel-authenc.h b/drivers/crypto/atmel-authenc.h
+index cbd37a2edada..d6de810df44f 100644
+--- a/drivers/crypto/atmel-authenc.h
++++ b/drivers/crypto/atmel-authenc.h
+@@ -12,7 +12,7 @@
+ #ifndef __ATMEL_AUTHENC_H__
+ #define __ATMEL_AUTHENC_H__
+ 
+-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC
++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC)
+ 
+ #include <crypto/authenc.h>
+ #include <crypto/hash.h>
+diff --git a/drivers/crypto/atmel-sha.c b/drivers/crypto/atmel-sha.c
+index 84cb8748a795..d32626458e67 100644
+--- a/drivers/crypto/atmel-sha.c
++++ b/drivers/crypto/atmel-sha.c
+@@ -2212,7 +2212,7 @@ static struct ahash_alg sha_hmac_algs[] = {
+ },
+ };
+ 
+-#ifdef CONFIG_CRYPTO_DEV_ATMEL_AUTHENC
++#if IS_ENABLED(CONFIG_CRYPTO_DEV_ATMEL_AUTHENC)
+ /* authenc functions */
+ 
+ static int atmel_sha_authenc_init2(struct atmel_sha_dev *dd);
+-- 
+2.20.1
+
diff --git a/queue-5.4/crypto-inside-secure-fix-a-maybe-uninitialized-warni.patch b/queue-5.4/crypto-inside-secure-fix-a-maybe-uninitialized-warni.patch
new file mode 100644
index 00000000000..0ec2b466418
--- /dev/null
+++ b/queue-5.4/crypto-inside-secure-fix-a-maybe-uninitialized-warni.patch
@@ -0,0 +1,44 @@
+From 2b5c3b5ea02d6dc7696c5dfc3d441d337d7b52eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Sep 2019 14:14:33 +0200
+Subject: crypto: inside-secure - Fix a maybe-uninitialized warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 74e6bd472b6d9e80ec9972989d8991736fe46c51 ]
+
+A previous fixup avoided an unused variable warning but replaced
+it with a slightly scarier warning:
+
+drivers/crypto/inside-secure/safexcel.c:1100:6: error: variable 'irq' is used uninitialized whenever 'if' condition is false [-Werror,-Wsometimes-uninitialized]
+
+This is harmless as it is impossible to get into this case, but
+the compiler has no way of knowing that. Add an explicit error
+handling case to make it obvious to both compilers and humans
+reading the source.
+
+Fixes: 212ef6f29e5b ("crypto: inside-secure - Fix unused variable warning when CONFIG_PCI=n")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Pascal van Leeuwen <pvanleeuwen@verimatrix.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/inside-secure/safexcel.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/crypto/inside-secure/safexcel.c b/drivers/crypto/inside-secure/safexcel.c
+index 294debd435b6..991a4425f006 100644
+--- a/drivers/crypto/inside-secure/safexcel.c
++++ b/drivers/crypto/inside-secure/safexcel.c
+@@ -1120,6 +1120,8 @@ static int safexcel_request_ring_irq(void *pdev, int irqid,
+ 				irq_name, irq);
+ 			return irq;
+ 		}
++	} else {
++		return -ENXIO;
+ 	}
+ 
+ 	ret = devm_request_threaded_irq(dev, irq, handler,
+-- 
+2.20.1
+
diff --git a/queue-5.4/crypto-sun4i-ss-fix-64-bit-size_t-warnings-on-sun4i-.patch b/queue-5.4/crypto-sun4i-ss-fix-64-bit-size_t-warnings-on-sun4i-.patch
new file mode 100644
index 00000000000..5e16ab97f3c
--- /dev/null
+++ b/queue-5.4/crypto-sun4i-ss-fix-64-bit-size_t-warnings-on-sun4i-.patch
@@ -0,0 +1,61 @@
+From b5a858521f5c5dae57bf06337f6211c2b5c08f13 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Nov 2019 11:49:06 +0100
+Subject: crypto: sun4i-ss - Fix 64-bit size_t warnings on sun4i-ss-hash.c
+
+From: Corentin Labbe <clabbe.montjoie@gmail.com>
+
+[ Upstream commit a7126603d46fe8f01aeedf589e071c6aaa6c6c39 ]
+
+If you try to compile this driver on a 64-bit platform then you
+will get warnings because it mixes size_t with unsigned int which
+only works on 32-bit.
+
+This patch fixes all of the warnings on sun4i-ss-hash.c.
+Signed-off-by: Corentin Labbe <clabbe.montjoie@gmail.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/sunxi-ss/sun4i-ss-hash.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/crypto/sunxi-ss/sun4i-ss-hash.c b/drivers/crypto/sunxi-ss/sun4i-ss-hash.c
+index fcffba5ef927..1369c5fa3087 100644
+--- a/drivers/crypto/sunxi-ss/sun4i-ss-hash.c
++++ b/drivers/crypto/sunxi-ss/sun4i-ss-hash.c
+@@ -272,8 +272,8 @@ static int sun4i_hash(struct ahash_request *areq)
+ 			 */
+ 			while (op->len < 64 && i < end) {
+ 				/* how many bytes we can read from current SG */
+-				in_r = min3(mi.length - in_i, end - i,
+-					    64 - op->len);
++				in_r = min(end - i, 64 - op->len);
++				in_r = min_t(size_t, mi.length - in_i, in_r);
+ 				memcpy(op->buf + op->len, mi.addr + in_i, in_r);
+ 				op->len += in_r;
+ 				i += in_r;
+@@ -293,8 +293,8 @@ static int sun4i_hash(struct ahash_request *areq)
+ 		}
+ 		if (mi.length - in_i > 3 && i < end) {
+ 			/* how many bytes we can read from current SG */
+-			in_r = min3(mi.length - in_i, areq->nbytes - i,
+-				    ((mi.length - in_i) / 4) * 4);
++			in_r = min_t(size_t, mi.length - in_i, areq->nbytes - i);
++			in_r = min_t(size_t, ((mi.length - in_i) / 4) * 4, in_r);
+ 			/* how many bytes we can write in the device*/
+ 			todo = min3((u32)(end - i) / 4, rx_cnt, (u32)in_r / 4);
+ 			writesl(ss->base + SS_RXFIFO, mi.addr + in_i, todo);
+@@ -320,8 +320,8 @@ static int sun4i_hash(struct ahash_request *areq)
+ 	if ((areq->nbytes - i) < 64) {
+ 		while (i < areq->nbytes && in_i < mi.length && op->len < 64) {
+ 			/* how many bytes we can read from current SG */
+-			in_r = min3(mi.length - in_i, areq->nbytes - i,
+-				    64 - op->len);
++			in_r = min(areq->nbytes - i, 64 - op->len);
++			in_r = min_t(size_t, mi.length - in_i, in_r);
+ 			memcpy(op->buf + op->len, mi.addr + in_i, in_r);
+ 			op->len += in_r;
+ 			i += in_r;
+-- 
+2.20.1
+
diff --git a/queue-5.4/crypto-sun4i-ss-fix-64-bit-size_t-warnings.patch b/queue-5.4/crypto-sun4i-ss-fix-64-bit-size_t-warnings.patch
new file mode 100644
index 00000000000..218270b6858
--- /dev/null
+++ b/queue-5.4/crypto-sun4i-ss-fix-64-bit-size_t-warnings.patch
@@ -0,0 +1,102 @@
+From b5c38944213841fb6d073e618d7630c85be63c36 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Nov 2019 10:38:34 +0800
+Subject: crypto: sun4i-ss - Fix 64-bit size_t warnings
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit d6e9da21ee8246b5e556b3b153401ab045adb986 ]
+
+If you try to compile this driver on a 64-bit platform then you
+will get warnings because it mixes size_t with unsigned int which
+only works on 32-bit.
+
+This patch fixes all of the warnings.
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Acked-by: Corentin Labbe <clabbe.montjoie@gmail.com>
+Tested-by: Corentin Labbe <clabbe.montjoie@gmail.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/sunxi-ss/sun4i-ss-cipher.c | 22 ++++++++++++++--------
+ 1 file changed, 14 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c b/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c
+index 6536fd4bee65..7e5e092a23b3 100644
+--- a/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c
++++ b/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c
+@@ -72,7 +72,8 @@ static int noinline_for_stack sun4i_ss_opti_poll(struct skcipher_request *areq)
+ 	oi = 0;
+ 	oo = 0;
+ 	do {
+-		todo = min3(rx_cnt, ileft, (mi.length - oi) / 4);
++		todo = min(rx_cnt, ileft);
++		todo = min_t(size_t, todo, (mi.length - oi) / 4);
+ 		if (todo) {
+ 			ileft -= todo;
+ 			writesl(ss->base + SS_RXFIFO, mi.addr + oi, todo);
+@@ -87,7 +88,8 @@ static int noinline_for_stack sun4i_ss_opti_poll(struct skcipher_request *areq)
+ 		rx_cnt = SS_RXFIFO_SPACES(spaces);
+ 		tx_cnt = SS_TXFIFO_SPACES(spaces);
+ 
+-		todo = min3(tx_cnt, oleft, (mo.length - oo) / 4);
++		todo = min(tx_cnt, oleft);
++		todo = min_t(size_t, todo, (mo.length - oo) / 4);
+ 		if (todo) {
+ 			oleft -= todo;
+ 			readsl(ss->base + SS_TXFIFO, mo.addr + oo, todo);
+@@ -239,7 +241,8 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
+ 			 * todo is the number of consecutive 4byte word that we
+ 			 * can read from current SG
+ 			 */
+-			todo = min3(rx_cnt, ileft / 4, (mi.length - oi) / 4);
++			todo = min(rx_cnt, ileft / 4);
++			todo = min_t(size_t, todo, (mi.length - oi) / 4);
+ 			if (todo && !ob) {
+ 				writesl(ss->base + SS_RXFIFO, mi.addr + oi,
+ 					todo);
+@@ -253,8 +256,8 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
+ 				 * we need to be able to write all buf in one
+ 				 * pass, so it is why we min() with rx_cnt
+ 				 */
+-				todo = min3(rx_cnt * 4 - ob, ileft,
+-					    mi.length - oi);
++				todo = min(rx_cnt * 4 - ob, ileft);
++				todo = min_t(size_t, todo, mi.length - oi);
+ 				memcpy(buf + ob, mi.addr + oi, todo);
+ 				ileft -= todo;
+ 				oi += todo;
+@@ -274,7 +277,8 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
+ 		spaces = readl(ss->base + SS_FCSR);
+ 		rx_cnt = SS_RXFIFO_SPACES(spaces);
+ 		tx_cnt = SS_TXFIFO_SPACES(spaces);
+-		dev_dbg(ss->dev, "%x %u/%u %u/%u cnt=%u %u/%u %u/%u cnt=%u %u\n",
++		dev_dbg(ss->dev,
++			"%x %u/%zu %u/%u cnt=%u %u/%zu %u/%u cnt=%u %u\n",
+ 			mode,
+ 			oi, mi.length, ileft, areq->cryptlen, rx_cnt,
+ 			oo, mo.length, oleft, areq->cryptlen, tx_cnt, ob);
+@@ -282,7 +286,8 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
+ 		if (!tx_cnt)
+ 			continue;
+ 		/* todo in 4bytes word */
+-		todo = min3(tx_cnt, oleft / 4, (mo.length - oo) / 4);
++		todo = min(tx_cnt, oleft / 4);
++		todo = min_t(size_t, todo, (mo.length - oo) / 4);
+ 		if (todo) {
+ 			readsl(ss->base + SS_TXFIFO, mo.addr + oo, todo);
+ 			oleft -= todo * 4;
+@@ -308,7 +313,8 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
+ 				 * no more than remaining buffer
+ 				 * no need to test against oleft
+ 				 */
+-				todo = min(mo.length - oo, obl - obo);
++				todo = min_t(size_t,
++					     mo.length - oo, obl - obo);
+ 				memcpy(mo.addr + oo, bufo + obo, todo);
+ 				oleft -= todo;
+ 				obo += todo;
+-- 
+2.20.1
+
diff --git a/queue-5.4/crypto-virtio-deal-with-unsupported-input-sizes.patch b/queue-5.4/crypto-virtio-deal-with-unsupported-input-sizes.patch
new file mode 100644
index 00000000000..972389b270d
--- /dev/null
+++ b/queue-5.4/crypto-virtio-deal-with-unsupported-input-sizes.patch
@@ -0,0 +1,67 @@
+From 4eaf2a82afc8bf51c59f960ed23ab52b2d72c6e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 9 Nov 2019 18:09:27 +0100
+Subject: crypto: virtio - deal with unsupported input sizes
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+[ Upstream commit 19c5da7d4a2662e85ea67d2d81df57e038fde3ab ]
+
+Return -EINVAL for input sizes that are not a multiple of the AES
+block size, since they are not supported by our CBC chaining mode.
+
+While at it, remove the pr_err() that reports unsupported key sizes
+being used: we shouldn't spam the kernel log with that.
+
+Fixes: dbaf0624ffa5 ("crypto: add virtio-crypto driver")
+Cc: "Michael S. Tsirkin" <mst@redhat.com>
+Cc: Jason Wang <jasowang@redhat.com>
+Cc: Gonglei <arei.gonglei@huawei.com>
+Cc: virtualization@lists.linux-foundation.org
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/virtio/virtio_crypto_algs.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/crypto/virtio/virtio_crypto_algs.c b/drivers/crypto/virtio/virtio_crypto_algs.c
+index 42d19205166b..673fb29fda53 100644
+--- a/drivers/crypto/virtio/virtio_crypto_algs.c
++++ b/drivers/crypto/virtio/virtio_crypto_algs.c
+@@ -105,8 +105,6 @@ virtio_crypto_alg_validate_key(int key_len, uint32_t *alg)
+ 		*alg = VIRTIO_CRYPTO_CIPHER_AES_CBC;
+ 		break;
+ 	default:
+-		pr_err("virtio_crypto: Unsupported key length: %d\n",
+-			key_len);
+ 		return -EINVAL;
+ 	}
+ 	return 0;
+@@ -484,6 +482,11 @@ static int virtio_crypto_ablkcipher_encrypt(struct ablkcipher_request *req)
+ 	/* Use the first data virtqueue as default */
+ 	struct data_queue *data_vq = &vcrypto->data_vq[0];
+ 
++	if (!req->nbytes)
++		return 0;
++	if (req->nbytes % AES_BLOCK_SIZE)
++		return -EINVAL;
++
+ 	vc_req->dataq = data_vq;
+ 	vc_req->alg_cb = virtio_crypto_dataq_sym_callback;
+ 	vc_sym_req->ablkcipher_ctx = ctx;
+@@ -504,6 +507,11 @@ static int virtio_crypto_ablkcipher_decrypt(struct ablkcipher_request *req)
+ 	/* Use the first data virtqueue as default */
+ 	struct data_queue *data_vq = &vcrypto->data_vq[0];
+ 
++	if (!req->nbytes)
++		return 0;
++	if (req->nbytes % AES_BLOCK_SIZE)
++		return -EINVAL;
++
+ 	vc_req->dataq = data_vq;
+ 	vc_req->alg_cb = virtio_crypto_dataq_sym_callback;
+ 	vc_sym_req->ablkcipher_ctx = ctx;
+-- 
+2.20.1
+
diff --git a/queue-5.4/crypto-vmx-avoid-weird-build-failures.patch b/queue-5.4/crypto-vmx-avoid-weird-build-failures.patch
new file mode 100644
index 00000000000..32e7d203f56
--- /dev/null
+++ b/queue-5.4/crypto-vmx-avoid-weird-build-failures.patch
@@ -0,0 +1,67 @@
+From 119deeb75df235efa910683365354640bd80fec7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Nov 2019 22:27:38 +1100
+Subject: crypto: vmx - Avoid weird build failures
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+[ Upstream commit 4ee812f6143d78d8ba1399671d78c8d78bf2817c ]
+
+In the vmx crypto Makefile we assign to a variable called TARGET and
+pass that to the aesp8-ppc.pl and ghashp8-ppc.pl scripts.
+
+The variable is meant to describe what flavour of powerpc we're
+building for, eg. either 32 or 64-bit, and big or little endian.
+
+Unfortunately TARGET is a fairly common name for a make variable, and
+if it happens that TARGET is specified as a command line parameter to
+make, the value specified on the command line will override our value.
+
+In particular this can happen if the kernel Makefile is driven by an
+external Makefile that uses TARGET for something.
+
+This leads to weird build failures, eg:
+  nonsense  at /build/linux/drivers/crypto/vmx/ghashp8-ppc.pl line 45.
+  /linux/drivers/crypto/vmx/Makefile:20: recipe for target 'drivers/crypto/vmx/ghashp8-ppc.S' failed
+
+Which shows that we passed an empty value for $(TARGET) to the perl
+script, confirmed with make V=1:
+
+  perl /linux/drivers/crypto/vmx/ghashp8-ppc.pl  > drivers/crypto/vmx/ghashp8-ppc.S
+
+We can avoid this confusion by using override, to tell make that we
+don't want anything to override our variable, even a value specified
+on the command line. We can also use a less common name, given the
+script calls it "flavour", let's use that.
+
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/vmx/Makefile | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/crypto/vmx/Makefile b/drivers/crypto/vmx/Makefile
+index cab32cfec9c4..709670d2b553 100644
+--- a/drivers/crypto/vmx/Makefile
++++ b/drivers/crypto/vmx/Makefile
+@@ -3,13 +3,13 @@ obj-$(CONFIG_CRYPTO_DEV_VMX_ENCRYPT) += vmx-crypto.o
+ vmx-crypto-objs := vmx.o aesp8-ppc.o ghashp8-ppc.o aes.o aes_cbc.o aes_ctr.o aes_xts.o ghash.o
+ 
+ ifeq ($(CONFIG_CPU_LITTLE_ENDIAN),y)
+-TARGET := linux-ppc64le
++override flavour := linux-ppc64le
+ else
+-TARGET := linux-ppc64
++override flavour := linux-ppc64
+ endif
+ 
+ quiet_cmd_perl = PERL $@
+-      cmd_perl = $(PERL) $(<) $(TARGET) > $(@)
++      cmd_perl = $(PERL) $(<) $(flavour) > $(@)
+ 
+ targets += aesp8-ppc.S ghashp8-ppc.S
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/drm-amd-display-add-new-active-dongle-to-existent-w-.patch b/queue-5.4/drm-amd-display-add-new-active-dongle-to-existent-w-.patch
new file mode 100644
index 00000000000..16fd0af45fd
--- /dev/null
+++ b/queue-5.4/drm-amd-display-add-new-active-dongle-to-existent-w-.patch
@@ -0,0 +1,54 @@
+From ca3bcf95412ef36f01ddb9a4dd8c41e1e7b9c47a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Sep 2019 17:04:33 -0500
+Subject: drm/amd/display: add new active dongle to existent w/a
+
+From: Vitaly Prosyak <vitaly.prosyak@amd.com>
+
+[ Upstream commit 566b4252fe9da9582dde008c5e9c3eb7c136e348 ]
+
+[Why & How]
+Dongle 0x00E04C power down all internal circuits including
+AUX communication preventing reading DPCD table.
+Encoder will skip DP RX power down on disable output
+to keep receiver powered all the time.
+
+Signed-off-by: Vitaly Prosyak <vitaly.prosyak@amd.com>
+Reviewed-by: Charlene Liu <Charlene.Liu@amd.com>
+Acked-by: Bhawanpreet Lakha <Bhawanpreet.Lakha@amd.com>
+Acked-by: Vitaly Prosyak <Vitaly.Prosyak@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c        | 1 +
+ drivers/gpu/drm/amd/display/include/ddc_service_types.h | 2 ++
+ 2 files changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
+index f5742719b5d9..9e261dbf2e49 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
+@@ -2691,6 +2691,7 @@ static void dp_wa_power_up_0010FA(struct dc_link *link, uint8_t *dpcd_data,
+ 		 * keep receiver powered all the time.*/
+ 		case DP_BRANCH_DEVICE_ID_0010FA:
+ 		case DP_BRANCH_DEVICE_ID_0080E1:
++		case DP_BRANCH_DEVICE_ID_00E04C:
+ 			link->wa_flags.dp_keep_receiver_powered = true;
+ 			break;
+ 
+diff --git a/drivers/gpu/drm/amd/display/include/ddc_service_types.h b/drivers/gpu/drm/amd/display/include/ddc_service_types.h
+index 18961707db23..9ad49da50a17 100644
+--- a/drivers/gpu/drm/amd/display/include/ddc_service_types.h
++++ b/drivers/gpu/drm/amd/display/include/ddc_service_types.h
+@@ -31,6 +31,8 @@
+ #define DP_BRANCH_DEVICE_ID_0022B9 0x0022B9
+ #define DP_BRANCH_DEVICE_ID_00001A 0x00001A
+ #define DP_BRANCH_DEVICE_ID_0080E1 0x0080e1
++#define DP_BRANCH_DEVICE_ID_90CC24 0x90CC24
++#define DP_BRANCH_DEVICE_ID_00E04C 0x00E04C
+ 
+ enum ddc_result {
+ 	DDC_RESULT_UNKNOWN = 0,
+-- 
+2.20.1
+
diff --git a/queue-5.4/drm-amd-display-correctly-populate-dpp-refclk-in-fpg.patch b/queue-5.4/drm-amd-display-correctly-populate-dpp-refclk-in-fpg.patch
new file mode 100644
index 00000000000..16816661610
--- /dev/null
+++ b/queue-5.4/drm-amd-display-correctly-populate-dpp-refclk-in-fpg.patch
@@ -0,0 +1,63 @@
+From 1f6c6c0b704da0861f0fba5a2091adfa36091ccb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Sep 2019 10:52:15 -0400
+Subject: drm/amd/display: correctly populate dpp refclk in fpga
+
+From: Anthony Koo <Anthony.Koo@amd.com>
+
+[ Upstream commit 952f6c4b5d72d40f93f3deb61239290b357d434e ]
+
+[Why]
+In diags environment we are not programming the DPP DTO
+correctly.
+
+[How]
+Populate the dpp refclk in dccg so it can be used to correctly
+program DPP DTO.
+
+Signed-off-by: Anthony Koo <Anthony.Koo@amd.com>
+Reviewed-by: Tony Cheng <Tony.Cheng@amd.com>
+Acked-by: Leo Li <sunpeng.li@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../drm/amd/display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c   | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c
+index 3e8ac303bd52..23ec283eb07b 100644
+--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c
++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn20/dcn20_clk_mgr.c
+@@ -320,6 +320,8 @@ void dcn2_update_clocks_fpga(struct clk_mgr *clk_mgr,
+ 		struct dc_state *context,
+ 		bool safe_to_lower)
+ {
++	struct clk_mgr_internal *clk_mgr_int = TO_CLK_MGR_INTERNAL(clk_mgr);
++
+ 	struct dc_clocks *new_clocks = &context->bw_ctx.bw.dcn.clk;
+ 	/* Min fclk = 1.2GHz since all the extra scemi logic seems to run off of it */
+ 	int fclk_adj = new_clocks->fclk_khz > 1200000 ? new_clocks->fclk_khz : 1200000;
+@@ -357,14 +359,18 @@ void dcn2_update_clocks_fpga(struct clk_mgr *clk_mgr,
+ 		clk_mgr->clks.dispclk_khz = new_clocks->dispclk_khz;
+ 	}
+ 
+-	/* Both fclk and dppclk ref are run on the same scemi clock so we
+-	 * need to keep the same value for both
++	/* Both fclk and ref_dppclk run on the same scemi clock.
++	 * So take the higher value since the DPP DTO is typically programmed
++	 * such that max dppclk is 1:1 with ref_dppclk.
+ 	 */
+ 	if (clk_mgr->clks.fclk_khz > clk_mgr->clks.dppclk_khz)
+ 		clk_mgr->clks.dppclk_khz = clk_mgr->clks.fclk_khz;
+ 	if (clk_mgr->clks.dppclk_khz > clk_mgr->clks.fclk_khz)
+ 		clk_mgr->clks.fclk_khz = clk_mgr->clks.dppclk_khz;
+ 
++	// Both fclk and ref_dppclk run on the same scemi clock.
++	clk_mgr_int->dccg->ref_dppclk = clk_mgr->clks.fclk_khz;
++
+ 	dm_set_dcn_clocks(clk_mgr->ctx, &clk_mgr->clks);
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/drm-amd-display-enable-hostvm-based-on-roimmu-active.patch b/queue-5.4/drm-amd-display-enable-hostvm-based-on-roimmu-active.patch
new file mode 100644
index 00000000000..035aeb65a46
--- /dev/null
+++ b/queue-5.4/drm-amd-display-enable-hostvm-based-on-roimmu-active.patch
@@ -0,0 +1,92 @@
+From c6ca709721315b404c61d4e3824a8165cc3bf4d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Oct 2019 15:19:41 -0400
+Subject: drm/amd/display: enable hostvm based on roimmu active for dcn2.1
+
+From: Dmytro Laktyushkin <Dmytro.Laktyushkin@amd.com>
+
+[ Upstream commit 48d92e8eda3d9b61978377e7539bfc5958e850cf ]
+
+Enabling hostvm when ROIMMU is not active seems to break GPUVM.
+This fixes the issue by not enabling hostvm if ROIMMU is not
+activated.
+
+Signed-off-by: Dmytro Laktyushkin <Dmytro.Laktyushkin@amd.com>
+Acked-by: Bhawanpreet Lakha <Bhawanpreet.Lakha@amd.com>
+Reviewed-by: Roman Li <Roman.Li@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../drm/amd/display/dc/dcn21/dcn21_hubbub.c   | 40 ++++++++++++-------
+ 1 file changed, 25 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubbub.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubbub.c
+index d1266741763b..f5f6b4a0f0aa 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubbub.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubbub.c
+@@ -22,6 +22,7 @@
+  * Authors: AMD
+  *
+  */
++#include <linux/delay.h>
+ #include "dm_services.h"
+ #include "dcn20/dcn20_hubbub.h"
+ #include "dcn21_hubbub.h"
+@@ -71,30 +72,39 @@ static uint32_t convert_and_clamp(
+ void dcn21_dchvm_init(struct hubbub *hubbub)
+ {
+ 	struct dcn20_hubbub *hubbub1 = TO_DCN20_HUBBUB(hubbub);
++	uint32_t riommu_active;
++	int i;
+ 
+ 	//Init DCHVM block
+ 	REG_UPDATE(DCHVM_CTRL0, HOSTVM_INIT_REQ, 1);
+ 
+ 	//Poll until RIOMMU_ACTIVE = 1
+-	//TODO: Figure out interval us and retry count
+-	REG_WAIT(DCHVM_RIOMMU_STAT0, RIOMMU_ACTIVE, 1, 5, 100);
++	for (i = 0; i < 100; i++) {
++		REG_GET(DCHVM_RIOMMU_STAT0, RIOMMU_ACTIVE, &riommu_active);
+ 
+-	//Reflect the power status of DCHUBBUB
+-	REG_UPDATE(DCHVM_RIOMMU_CTRL0, HOSTVM_POWERSTATUS, 1);
++		if (riommu_active)
++			break;
++		else
++			udelay(5);
++	}
++
++	if (riommu_active) {
++		//Reflect the power status of DCHUBBUB
++		REG_UPDATE(DCHVM_RIOMMU_CTRL0, HOSTVM_POWERSTATUS, 1);
+ 
+-	//Start rIOMMU prefetching
+-	REG_UPDATE(DCHVM_RIOMMU_CTRL0, HOSTVM_PREFETCH_REQ, 1);
++		//Start rIOMMU prefetching
++		REG_UPDATE(DCHVM_RIOMMU_CTRL0, HOSTVM_PREFETCH_REQ, 1);
+ 
+-	// Enable dynamic clock gating
+-	REG_UPDATE_4(DCHVM_CLK_CTRL,
+-					HVM_DISPCLK_R_GATE_DIS, 0,
+-					HVM_DISPCLK_G_GATE_DIS, 0,
+-					HVM_DCFCLK_R_GATE_DIS, 0,
+-					HVM_DCFCLK_G_GATE_DIS, 0);
++		// Enable dynamic clock gating
++		REG_UPDATE_4(DCHVM_CLK_CTRL,
++						HVM_DISPCLK_R_GATE_DIS, 0,
++						HVM_DISPCLK_G_GATE_DIS, 0,
++						HVM_DCFCLK_R_GATE_DIS, 0,
++						HVM_DCFCLK_G_GATE_DIS, 0);
+ 
+-	//Poll until HOSTVM_PREFETCH_DONE = 1
+-	//TODO: Figure out interval us and retry count
+-	REG_WAIT(DCHVM_RIOMMU_STAT0, HOSTVM_PREFETCH_DONE, 1, 5, 100);
++		//Poll until HOSTVM_PREFETCH_DONE = 1
++		REG_WAIT(DCHVM_RIOMMU_STAT0, HOSTVM_PREFETCH_DONE, 1, 5, 100);
++	}
+ }
+ 
+ static int hubbub21_init_dchub(struct hubbub *hubbub,
+-- 
+2.20.1
+
diff --git a/queue-5.4/drm-amd-display-fix-dongle_caps-containing-stale-inf.patch b/queue-5.4/drm-amd-display-fix-dongle_caps-containing-stale-inf.patch
new file mode 100644
index 00000000000..b8f4c7f2c37
--- /dev/null
+++ b/queue-5.4/drm-amd-display-fix-dongle_caps-containing-stale-inf.patch
@@ -0,0 +1,65 @@
+From 9ae02d51651dca3b636d70ad25e4f0ae25715e6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Sep 2019 20:20:23 -0400
+Subject: drm/amd/display: Fix dongle_caps containing stale information.
+
+From: David Galiffi <david.galiffi@amd.com>
+
+[ Upstream commit dd998291dbe92106d8c4a7581c409b356928d711 ]
+
+[WHY]
+
+During detection:
+function: get_active_converter_info populates link->dpcd_caps.dongle_caps
+only when dpcd_rev >= DPCD_REV_11 and DWN_STRM_PORTX_TYPE is
+DOWN_STREAM_DETAILED_HDMI or DOWN_STREAM_DETAILED_DP_PLUS_PLUS.
+Otherwise, it is not cleared, and stale information remains.
+
+During mode validation:
+function: dp_active_dongle_validate_timing reads
+link->dpcd_caps.dongle_caps->dongle_type to determine the maximum
+pixel clock to support. This information is now stale and no longer
+valid.
+
+[HOW]
+dp_active_dongle_validate_timing should be using
+link->dpcd_caps->dongle_type instead.
+
+Signed-off-by: David Galiffi <david.galiffi@amd.com>
+Reviewed-by: Jun Lei <Jun.Lei@amd.com>
+Acked-by: Bhawanpreet Lakha <Bhawanpreet.Lakha@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc_link.c    | 2 +-
+ drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | 1 +
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+index de1b61595ffb..efc1d30544bb 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+@@ -2219,7 +2219,7 @@ static bool dp_active_dongle_validate_timing(
+ 		break;
+ 	}
+ 
+-	if (dongle_caps->dongle_type != DISPLAY_DONGLE_DP_HDMI_CONVERTER ||
++	if (dpcd_caps->dongle_type != DISPLAY_DONGLE_DP_HDMI_CONVERTER ||
+ 		dongle_caps->extendedCapValid == false)
+ 		return true;
+ 
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
+index 9e261dbf2e49..5a583707d198 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
+@@ -2545,6 +2545,7 @@ static void get_active_converter_info(
+ 	uint8_t data, struct dc_link *link)
+ {
+ 	union dp_downstream_port_present ds_port = { .byte = data };
++	memset(&link->dpcd_caps.dongle_caps, 0, sizeof(link->dpcd_caps.dongle_caps));
+ 
+ 	/* decode converter info*/
+ 	if (!ds_port.fields.PORT_PRESENT) {
+-- 
+2.20.1
+
diff --git a/queue-5.4/drm-amd-display-fix-header-for-rn-clk-mgr.patch b/queue-5.4/drm-amd-display-fix-header-for-rn-clk-mgr.patch
new file mode 100644
index 00000000000..e1e0f06ab81
--- /dev/null
+++ b/queue-5.4/drm-amd-display-fix-header-for-rn-clk-mgr.patch
@@ -0,0 +1,49 @@
+From 7db67f39c0aa58c10ca78b4ca2a3c0c02315c6b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Jul 2019 13:41:01 -0400
+Subject: drm/amd/display: fix header for RN clk mgr
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: joseph gravenor <joseph.gravenor@amd.com>
+
+[ Upstream commit cd83fa1ea9b9431cf1d57ac4179a11bc4393a5b6 ]
+
+[why]
+Should always MP0_BASE for any register definition from MP per-IP header files.
+I belive the reason the linux version of MP1_BASE works is The 0th element of the 0th table
+of that is identical to the corrisponding value of MP0_BASE in the renoir offset header file.
+The reason we should only use MP0_BASE is There is only one set of per-IP headers MP
+that includes all register definitions related to SMU IP block. This IP includes MP0, MP1, MP2
+and  an ecryption engine that can be used only by MP0. As a result all register definitions from
+MP file should be based only on MP0_BASE data.
+
+[How]
+Change MP1_BASE to MP0_BASE
+
+Signed-off-by: joseph gravenor <joseph.gravenor@amd.com>
+Acked-by: Bhawanpreet Lakha <Bhawanpreet.Lakha@amd.com>
+Reviewed-by: Roman Li <Roman.Li@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr_vbios_smu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr_vbios_smu.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr_vbios_smu.c
+index 50984c1811bb..468c6bb0e311 100644
+--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr_vbios_smu.c
++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr_vbios_smu.c
+@@ -33,7 +33,7 @@
+ #include "mp/mp_12_0_0_sh_mask.h"
+ 
+ #define REG(reg_name) \
+-	(MP1_BASE.instance[0].segment[mm ## reg_name ## _BASE_IDX] + mm ## reg_name)
++	(MP0_BASE.instance[0].segment[mm ## reg_name ## _BASE_IDX] + mm ## reg_name)
+ 
+ #define FN(reg_name, field) \
+ 	FD(reg_name##__##field)
+-- 
+2.20.1
+
diff --git a/queue-5.4/drm-amd-display-fix-struct-init-in-update_bounding_b.patch b/queue-5.4/drm-amd-display-fix-struct-init-in-update_bounding_b.patch
new file mode 100644
index 00000000000..50f87188c7f
--- /dev/null
+++ b/queue-5.4/drm-amd-display-fix-struct-init-in-update_bounding_b.patch
@@ -0,0 +1,47 @@
+From 8267c7b9d138796ce0187cf94c37b3ec022c5252 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Oct 2019 14:24:44 -0600
+Subject: drm/amd/display: fix struct init in update_bounding_box
+
+From: Raul E Rangel <rrangel@chromium.org>
+
+[ Upstream commit 960b6f4f2d2e96d5f7ffe2854e0040b46cafbd36 ]
+
+dcn20_resource.c:2636:9: error: missing braces around initializer [-Werror=missing-braces]
+  struct _vcs_dpi_voltage_scaling_st calculated_states[MAX_CLOCK_LIMIT_STATES] = {0};
+         ^
+
+Fixes: 7ed4e6352c16f ("drm/amd/display: Add DCN2 HW Sequencer and Resource")
+
+Signed-off-by: Raul E Rangel <rrangel@chromium.org>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
+index ebe67c34dabf..78b2cc2e122f 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
+@@ -3041,7 +3041,7 @@ static void cap_soc_clocks(
+ static void update_bounding_box(struct dc *dc, struct _vcs_dpi_soc_bounding_box_st *bb,
+ 		struct pp_smu_nv_clock_table *max_clocks, unsigned int *uclk_states, unsigned int num_states)
+ {
+-	struct _vcs_dpi_voltage_scaling_st calculated_states[MAX_CLOCK_LIMIT_STATES] = {0};
++	struct _vcs_dpi_voltage_scaling_st calculated_states[MAX_CLOCK_LIMIT_STATES];
+ 	int i;
+ 	int num_calculated_states = 0;
+ 	int min_dcfclk = 0;
+@@ -3049,6 +3049,8 @@ static void update_bounding_box(struct dc *dc, struct _vcs_dpi_soc_bounding_box_
+ 	if (num_states == 0)
+ 		return;
+ 
++	memset(calculated_states, 0, sizeof(calculated_states));
++
+ 	if (dc->bb_overrides.min_dcfclk_mhz > 0)
+ 		min_dcfclk = dc->bb_overrides.min_dcfclk_mhz;
+ 	else
+-- 
+2.20.1
+
diff --git a/queue-5.4/drm-amd-display-handle-virtual-signal-type-in-disabl.patch b/queue-5.4/drm-amd-display-handle-virtual-signal-type-in-disabl.patch
new file mode 100644
index 00000000000..e863e626c6a
--- /dev/null
+++ b/queue-5.4/drm-amd-display-handle-virtual-signal-type-in-disabl.patch
@@ -0,0 +1,49 @@
+From fb4e68473cd9dd47cf4a199b2db2be0ba7a49869 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Aug 2019 10:02:13 +0800
+Subject: drm/amd/display: Handle virtual signal type in disable_link()
+
+From: Martin Tsai <martin.tsai@amd.com>
+
+[ Upstream commit 616f5b65f1c02d3d6ae370644670d14c57de2fd8 ]
+
+[Why]
+The new implementation changed the behavior to allow process setMode
+to DAL when DAL returns empty mode query for unplugged display.
+This will trigger additional disable_link().
+When unplug HDMI from MST dock, driver will update stream->signal to
+"Virtual". disable_link() will call disable_output() if the signal type
+is not DP and induce other displays on MST dock show black screen.
+
+[How]
+Don't need to process disable_output() if the signal type is virtual.
+
+Signed-off-by: Martin Tsai <martin.tsai@amd.com>
+Reviewed-by: Charlene Liu <Charlene.Liu@amd.com>
+Acked-by: Leo Li <sunpeng.li@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc_link.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+index ca20b150afcc..de1b61595ffb 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+@@ -2169,8 +2169,10 @@ static void disable_link(struct dc_link *link, enum signal_type signal)
+ 			dp_set_fec_ready(link, false);
+ 		}
+ #endif
+-	} else
+-		link->link_enc->funcs->disable_output(link->link_enc, signal);
++	} else {
++		if (signal != SIGNAL_TYPE_VIRTUAL)
++			link->link_enc->funcs->disable_output(link->link_enc, signal);
++	}
+ 
+ 	if (signal == SIGNAL_TYPE_DISPLAY_PORT_MST) {
+ 		/* MST disable link only when no stream use the link */
+-- 
+2.20.1
+
diff --git a/queue-5.4/drm-amd-display-otc-underflow-fix.patch b/queue-5.4/drm-amd-display-otc-underflow-fix.patch
new file mode 100644
index 00000000000..fefa717d8b6
--- /dev/null
+++ b/queue-5.4/drm-amd-display-otc-underflow-fix.patch
@@ -0,0 +1,42 @@
+From 72c99f438c4eb8f7455ff4239177f24851dea14b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Aug 2019 16:45:05 -0400
+Subject: drm/amd/display: OTC underflow fix
+
+From: Jaehyun Chung <jaehyun.chung@amd.com>
+
+[ Upstream commit 785908cf19c9eb4803f6bf9c0a7447dc3661d5c3 ]
+
+[Why] Underflow occurs on some display setups(repro'd on 3x4K HDR) on boot,
+mode set, and hot-plugs with. Underflow occurs because mem clk
+is not set high after disabling pstate switching. This behaviour occurs
+because some calculations assumed displays were synchronized.
+
+[How] Add a condition to check if timing sync is disabled so that
+synchronized vblank can be set to false.
+
+Signed-off-by: Jaehyun Chung <jaehyun.chung@amd.com>
+Reviewed-by: Alvin Lee <Alvin.Lee2@amd.com>
+Acked-by: Bhawanpreet Lakha <Bhawanpreet.Lakha@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
+index 6b2f2f1a1c9c..3980c7b78259 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
+@@ -1765,7 +1765,7 @@ int dcn20_populate_dml_pipes_from_context(
+ 			pipe_cnt = i;
+ 			continue;
+ 		}
+-		if (!resource_are_streams_timing_synchronizable(
++		if (dc->debug.disable_timing_sync || !resource_are_streams_timing_synchronizable(
+ 				res_ctx->pipe_ctx[pipe_cnt].stream,
+ 				res_ctx->pipe_ctx[i].stream)) {
+ 			synchronized_vblank = false;
+-- 
+2.20.1
+
diff --git a/queue-5.4/drm-amd-display-program-dwb-watermarks-from-correct-.patch b/queue-5.4/drm-amd-display-program-dwb-watermarks-from-correct-.patch
new file mode 100644
index 00000000000..9616564d16b
--- /dev/null
+++ b/queue-5.4/drm-amd-display-program-dwb-watermarks-from-correct-.patch
@@ -0,0 +1,93 @@
+From 1428dd5973545e421e91470dfb2bef645d5a9ec0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Aug 2019 17:06:05 -0400
+Subject: drm/amd/display: Program DWB watermarks from correct state
+
+From: Julian Parkin <julian.parkin@amd.com>
+
+[ Upstream commit edb922b022c0c94805c4ffad202b3edff83d76f0 ]
+
+[Why]
+When diags adds a DWB via a stream update, we calculate MMHUBBUB
+paramaters, but dc->current_state has not yet been updated
+when the DWB programming happens. This leads to overflow on
+high bandwidth tests since the incorrect MMHUBBUB arbitration
+parameters are programmed.
+
+[How]
+Pass the updated context down to the (enable|update)_writeback functions
+so that they can use the correct watermarks when programming MMHUBBUB.
+
+Signed-off-by: Julian Parkin <julian.parkin@amd.com>
+Reviewed-by: Dmytro Laktyushkin <Dmytro.Laktyushkin@amd.com>
+Acked-by: Bhawanpreet Lakha <Bhawanpreet.Lakha@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc_stream.c    | 4 ++--
+ drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c | 5 +++--
+ drivers/gpu/drm/amd/display/dc/inc/hw_sequencer.h  | 6 ++++--
+ 3 files changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
+index bf1d7bb90e0f..bb09243758fe 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
+@@ -423,10 +423,10 @@ bool dc_stream_add_writeback(struct dc *dc,
+ 
+ 		if (dwb->funcs->is_enabled(dwb)) {
+ 			/* writeback pipe already enabled, only need to update */
+-			dc->hwss.update_writeback(dc, stream_status, wb_info);
++			dc->hwss.update_writeback(dc, stream_status, wb_info, dc->current_state);
+ 		} else {
+ 			/* Enable writeback pipe from scratch*/
+-			dc->hwss.enable_writeback(dc, stream_status, wb_info);
++			dc->hwss.enable_writeback(dc, stream_status, wb_info, dc->current_state);
+ 		}
+ 	}
+ 
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
+index b3ae1c41fc69..937a8ba81160 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
+@@ -1356,7 +1356,8 @@ bool dcn20_update_bandwidth(
+ static void dcn20_enable_writeback(
+ 		struct dc *dc,
+ 		const struct dc_stream_status *stream_status,
+-		struct dc_writeback_info *wb_info)
++		struct dc_writeback_info *wb_info,
++		struct dc_state *context)
+ {
+ 	struct dwbc *dwb;
+ 	struct mcif_wb *mcif_wb;
+@@ -1373,7 +1374,7 @@ static void dcn20_enable_writeback(
+ 	optc->funcs->set_dwb_source(optc, wb_info->dwb_pipe_inst);
+ 	/* set MCIF_WB buffer and arbitration configuration */
+ 	mcif_wb->funcs->config_mcif_buf(mcif_wb, &wb_info->mcif_buf_params, wb_info->dwb_params.dest_height);
+-	mcif_wb->funcs->config_mcif_arb(mcif_wb, &dc->current_state->bw_ctx.bw.dcn.bw_writeback.mcif_wb_arb[wb_info->dwb_pipe_inst]);
++	mcif_wb->funcs->config_mcif_arb(mcif_wb, &context->bw_ctx.bw.dcn.bw_writeback.mcif_wb_arb[wb_info->dwb_pipe_inst]);
+ 	/* Enable MCIF_WB */
+ 	mcif_wb->funcs->enable_mcif(mcif_wb);
+ 	/* Enable DWB */
+diff --git a/drivers/gpu/drm/amd/display/dc/inc/hw_sequencer.h b/drivers/gpu/drm/amd/display/dc/inc/hw_sequencer.h
+index 3a938cd414ea..f6cc2d6f576d 100644
+--- a/drivers/gpu/drm/amd/display/dc/inc/hw_sequencer.h
++++ b/drivers/gpu/drm/amd/display/dc/inc/hw_sequencer.h
+@@ -321,10 +321,12 @@ struct hw_sequencer_funcs {
+ 			struct dc_state *context);
+ 	void (*update_writeback)(struct dc *dc,
+ 			const struct dc_stream_status *stream_status,
+-			struct dc_writeback_info *wb_info);
++			struct dc_writeback_info *wb_info,
++			struct dc_state *context);
+ 	void (*enable_writeback)(struct dc *dc,
+ 			const struct dc_stream_status *stream_status,
+-			struct dc_writeback_info *wb_info);
++			struct dc_writeback_info *wb_info,
++			struct dc_state *context);
+ 	void (*disable_writeback)(struct dc *dc,
+ 			unsigned int dwb_pipe_inst);
+ #endif
+-- 
+2.20.1
+
diff --git a/queue-5.4/drm-amd-display-properly-round-nominal-frequency-for.patch b/queue-5.4/drm-amd-display-properly-round-nominal-frequency-for.patch
new file mode 100644
index 00000000000..631bdaa6178
--- /dev/null
+++ b/queue-5.4/drm-amd-display-properly-round-nominal-frequency-for.patch
@@ -0,0 +1,63 @@
+From 8871d86cf4a4bcfc32af3fb262dc21a08cf9ec5e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Sep 2019 16:17:08 -0400
+Subject: drm/amd/display: Properly round nominal frequency for SPD
+
+From: Aric Cyr <aric.cyr@amd.com>
+
+[ Upstream commit c59802313e84bede954235b3a5dd0dd5325f49c5 ]
+
+[Why]
+Some displays rely on the SPD verticle frequency maximum value.
+Must round the calculated refresh rate to the nearest integer.
+
+[How]
+Round the nominal calculated refresh rate to the nearest whole
+integer.
+
+Signed-off-by: Aric Cyr <aric.cyr@amd.com>
+Reviewed-by: Anthony Koo <Anthony.Koo@amd.com>
+Acked-by: Bhawanpreet Lakha <Bhawanpreet.Lakha@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/modules/freesync/freesync.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/modules/freesync/freesync.c b/drivers/gpu/drm/amd/display/modules/freesync/freesync.c
+index ec70c9b12e1a..0978c698f0f8 100644
+--- a/drivers/gpu/drm/amd/display/modules/freesync/freesync.c
++++ b/drivers/gpu/drm/amd/display/modules/freesync/freesync.c
+@@ -743,6 +743,10 @@ void mod_freesync_build_vrr_params(struct mod_freesync *mod_freesync,
+ 	nominal_field_rate_in_uhz =
+ 			mod_freesync_calc_nominal_field_rate(stream);
+ 
++	/* Rounded to the nearest Hz */
++	nominal_field_rate_in_uhz = 1000000ULL *
++			div_u64(nominal_field_rate_in_uhz + 500000, 1000000);
++
+ 	min_refresh_in_uhz = in_config->min_refresh_in_uhz;
+ 	max_refresh_in_uhz = in_config->max_refresh_in_uhz;
+ 
+@@ -996,14 +1000,13 @@ unsigned long long mod_freesync_calc_nominal_field_rate(
+ 			const struct dc_stream_state *stream)
+ {
+ 	unsigned long long nominal_field_rate_in_uhz = 0;
++	unsigned int total = stream->timing.h_total * stream->timing.v_total;
+ 
+-	/* Calculate nominal field rate for stream */
++	/* Calculate nominal field rate for stream, rounded up to nearest integer */
+ 	nominal_field_rate_in_uhz = stream->timing.pix_clk_100hz / 10;
+ 	nominal_field_rate_in_uhz *= 1000ULL * 1000ULL * 1000ULL;
+-	nominal_field_rate_in_uhz = div_u64(nominal_field_rate_in_uhz,
+-						stream->timing.h_total);
+-	nominal_field_rate_in_uhz = div_u64(nominal_field_rate_in_uhz,
+-						stream->timing.v_total);
++
++	nominal_field_rate_in_uhz =	div_u64(nominal_field_rate_in_uhz, total);
+ 
+ 	return nominal_field_rate_in_uhz;
+ }
+-- 
+2.20.1
+
diff --git a/queue-5.4/drm-amd-display-rebuild-mapped-resources-after-pipe-.patch b/queue-5.4/drm-amd-display-rebuild-mapped-resources-after-pipe-.patch
new file mode 100644
index 00000000000..1a87f5bdcf0
--- /dev/null
+++ b/queue-5.4/drm-amd-display-rebuild-mapped-resources-after-pipe-.patch
@@ -0,0 +1,42 @@
+From 92083bd6a4411515ef326cf32995281a74b40962 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Aug 2019 13:26:24 -0400
+Subject: drm/amd/display: Rebuild mapped resources after pipe split
+
+From: Mikita Lipski <mikita.lipski@amd.com>
+
+[ Upstream commit 387596ef2859c37d564ce15abddbc9063a132e2c ]
+
+[why]
+The issue is specific for linux, as on timings such as 8K@60
+or 4K@144 DSC should be working in combination with ODM Combine
+in order to ensure that we can run those timings. The validation
+for those timings was passing, but when pipe split was happening
+second pipe wasn't being programmed.
+
+[how]
+Rebuild mapped resources if we split stream for ODM.
+
+Signed-off-by: Mikita Lipski <mikita.lipski@amd.com>
+Acked-by: Leo Li <sunpeng.li@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
+index 3980c7b78259..ebe67c34dabf 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
+@@ -2474,6 +2474,7 @@ bool dcn20_fast_validate_bw(
+ 							&context->res_ctx, dc->res_pool,
+ 							pipe, hsplit_pipe))
+ 						goto validate_fail;
++					dcn20_build_mapped_resource(dc, context, pipe->stream);
+ 				} else
+ 					dcn20_split_stream_for_mpc(
+ 						&context->res_ctx, dc->res_pool,
+-- 
+2.20.1
+
diff --git a/queue-5.4/drm-amd-display-set-minimum-abm-backlight-level.patch b/queue-5.4/drm-amd-display-set-minimum-abm-backlight-level.patch
new file mode 100644
index 00000000000..9c91ae9c594
--- /dev/null
+++ b/queue-5.4/drm-amd-display-set-minimum-abm-backlight-level.patch
@@ -0,0 +1,195 @@
+From d0a545c159e3a8c5cc64dff671086f867849dc6f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Aug 2019 10:49:12 -0400
+Subject: drm/amd/display: set minimum abm backlight level
+
+From: Anthony Koo <Anthony.Koo@amd.com>
+
+[ Upstream commit 2ad0cdf9e2e9e079af34af681863fa638f2ee212 ]
+
+[Why]
+A lot of the time, the backlight characteristic curve maps min backlight
+to a non-zero value.
+But there are cases where we want the curve to intersect at 0.
+In this scenario even if OS never asks to set 0% backlight, the ABM
+reduction can result in backlight being lowered close to 0.
+This particularly can cause problems in some LED drivers, and in
+general just looks like backlight is completely off.
+
+[How]
+Add default cap to disallow backlight from dropping below 1%
+even after ABM reduction is applied.
+
+Signed-off-by: Anthony Koo <Anthony.Koo@amd.com>
+Reviewed-by: Aric Cyr <Aric.Cyr@amd.com>
+Acked-by: Leo Li <sunpeng.li@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c |  5 ++
+ .../amd/display/modules/power/power_helpers.c | 77 +++++++++++--------
+ .../amd/display/modules/power/power_helpers.h |  1 +
+ 3 files changed, 49 insertions(+), 34 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 4139f129eafb..4e9c15c409ba 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -940,6 +940,11 @@ static int dm_late_init(void *handle)
+ 	params.backlight_lut_array_size = 16;
+ 	params.backlight_lut_array = linear_lut;
+ 
++	/* Min backlight level after ABM reduction,  Don't allow below 1%
++	 * 0xFFFF x 0.01 = 0x28F
++	 */
++	params.min_abm_backlight = 0x28F;
++
+ 	/* todo will enable for navi10 */
+ 	if (adev->asic_type <= CHIP_RAVEN) {
+ 		ret = dmcu_load_iram(dmcu, params);
+diff --git a/drivers/gpu/drm/amd/display/modules/power/power_helpers.c b/drivers/gpu/drm/amd/display/modules/power/power_helpers.c
+index 05e2be856037..ba1aafe40512 100644
+--- a/drivers/gpu/drm/amd/display/modules/power/power_helpers.c
++++ b/drivers/gpu/drm/amd/display/modules/power/power_helpers.c
+@@ -115,7 +115,7 @@ static const struct abm_parameters * const abm_settings[] = {
+ /* NOTE: iRAM is 256B in size */
+ struct iram_table_v_2 {
+ 	/* flags                      */
+-	uint16_t flags;							/* 0x00 U16  */
++	uint16_t min_abm_backlight;					/* 0x00 U16  */
+ 
+ 	/* parameters for ABM2.0 algorithm */
+ 	uint8_t min_reduction[NUM_AMBI_LEVEL][NUM_AGGR_LEVEL];		/* 0x02 U0.8 */
+@@ -140,10 +140,10 @@ struct iram_table_v_2 {
+ 
+ 	/* For reading PSR State directly from IRAM */
+ 	uint8_t psr_state;						/* 0xf0       */
+-	uint8_t dmcu_mcp_interface_version;							/* 0xf1       */
+-	uint8_t dmcu_abm_feature_version;							/* 0xf2       */
+-	uint8_t dmcu_psr_feature_version;							/* 0xf3       */
+-	uint16_t dmcu_version;										/* 0xf4       */
++	uint8_t dmcu_mcp_interface_version;				/* 0xf1       */
++	uint8_t dmcu_abm_feature_version;				/* 0xf2       */
++	uint8_t dmcu_psr_feature_version;				/* 0xf3       */
++	uint16_t dmcu_version;						/* 0xf4       */
+ 	uint8_t dmcu_state;						/* 0xf6       */
+ 
+ 	uint16_t blRampReduction;					/* 0xf7       */
+@@ -164,42 +164,43 @@ struct iram_table_v_2_2 {
+ 	uint8_t max_reduction[NUM_AMBI_LEVEL][NUM_AGGR_LEVEL];		/* 0x16 U0.8 */
+ 	uint8_t bright_pos_gain[NUM_AMBI_LEVEL][NUM_AGGR_LEVEL];	/* 0x2a U2.6 */
+ 	uint8_t dark_pos_gain[NUM_AMBI_LEVEL][NUM_AGGR_LEVEL];		/* 0x3e U2.6 */
+-	uint8_t hybrid_factor[NUM_AGGR_LEVEL];						/* 0x52 U0.8 */
+-	uint8_t contrast_factor[NUM_AGGR_LEVEL];					/* 0x56 U0.8 */
+-	uint8_t deviation_gain[NUM_AGGR_LEVEL];						/* 0x5a U0.8 */
+-	uint8_t iir_curve[NUM_AMBI_LEVEL];							/* 0x5e U0.8 */
+-	uint8_t min_knee[NUM_AGGR_LEVEL];							/* 0x63 U0.8 */
+-	uint8_t max_knee[NUM_AGGR_LEVEL];							/* 0x67 U0.8 */
+-	uint8_t pad[21];											/* 0x6b U0.8 */
++	uint8_t hybrid_factor[NUM_AGGR_LEVEL];				/* 0x52 U0.8 */
++	uint8_t contrast_factor[NUM_AGGR_LEVEL];			/* 0x56 U0.8 */
++	uint8_t deviation_gain[NUM_AGGR_LEVEL];				/* 0x5a U0.8 */
++	uint8_t iir_curve[NUM_AMBI_LEVEL];				/* 0x5e U0.8 */
++	uint8_t min_knee[NUM_AGGR_LEVEL];				/* 0x63 U0.8 */
++	uint8_t max_knee[NUM_AGGR_LEVEL];				/* 0x67 U0.8 */
++	uint16_t min_abm_backlight;					/* 0x6b U16  */
++	uint8_t pad[19];						/* 0x6d U0.8 */
+ 
+ 	/* parameters for crgb conversion */
+-	uint16_t crgb_thresh[NUM_POWER_FN_SEGS];					/* 0x80 U3.13 */
+-	uint16_t crgb_offset[NUM_POWER_FN_SEGS];					/* 0x90 U1.15 */
+-	uint16_t crgb_slope[NUM_POWER_FN_SEGS];						/* 0xa0 U4.12 */
++	uint16_t crgb_thresh[NUM_POWER_FN_SEGS];			/* 0x80 U3.13 */
++	uint16_t crgb_offset[NUM_POWER_FN_SEGS];			/* 0x90 U1.15 */
++	uint16_t crgb_slope[NUM_POWER_FN_SEGS];				/* 0xa0 U4.12 */
+ 
+ 	/* parameters for custom curve */
+ 	/* thresholds for brightness --> backlight */
+-	uint16_t backlight_thresholds[NUM_BL_CURVE_SEGS];			/* 0xb0 U16.0 */
++	uint16_t backlight_thresholds[NUM_BL_CURVE_SEGS];		/* 0xb0 U16.0 */
+ 	/* offsets for brightness --> backlight */
+-	uint16_t backlight_offsets[NUM_BL_CURVE_SEGS];				/* 0xd0 U16.0 */
++	uint16_t backlight_offsets[NUM_BL_CURVE_SEGS];			/* 0xd0 U16.0 */
+ 
+ 	/* For reading PSR State directly from IRAM */
+-	uint8_t psr_state;											/* 0xf0       */
+-	uint8_t dmcu_mcp_interface_version;							/* 0xf1       */
+-	uint8_t dmcu_abm_feature_version;							/* 0xf2       */
+-	uint8_t dmcu_psr_feature_version;							/* 0xf3       */
+-	uint16_t dmcu_version;										/* 0xf4       */
+-	uint8_t dmcu_state;											/* 0xf6       */
+-
+-	uint8_t dummy1;												/* 0xf7       */
+-	uint8_t dummy2;												/* 0xf8       */
+-	uint8_t dummy3;												/* 0xf9       */
+-	uint8_t dummy4;												/* 0xfa       */
+-	uint8_t dummy5;												/* 0xfb       */
+-	uint8_t dummy6;												/* 0xfc       */
+-	uint8_t dummy7;												/* 0xfd       */
+-	uint8_t dummy8;												/* 0xfe       */
+-	uint8_t dummy9;												/* 0xff       */
++	uint8_t psr_state;						/* 0xf0       */
++	uint8_t dmcu_mcp_interface_version;				/* 0xf1       */
++	uint8_t dmcu_abm_feature_version;				/* 0xf2       */
++	uint8_t dmcu_psr_feature_version;				/* 0xf3       */
++	uint16_t dmcu_version;						/* 0xf4       */
++	uint8_t dmcu_state;						/* 0xf6       */
++
++	uint8_t dummy1;							/* 0xf7       */
++	uint8_t dummy2;							/* 0xf8       */
++	uint8_t dummy3;							/* 0xf9       */
++	uint8_t dummy4;							/* 0xfa       */
++	uint8_t dummy5;							/* 0xfb       */
++	uint8_t dummy6;							/* 0xfc       */
++	uint8_t dummy7;							/* 0xfd       */
++	uint8_t dummy8;							/* 0xfe       */
++	uint8_t dummy9;							/* 0xff       */
+ };
+ #pragma pack(pop)
+ 
+@@ -271,7 +272,8 @@ void fill_iram_v_2(struct iram_table_v_2 *ram_table, struct dmcu_iram_parameters
+ {
+ 	unsigned int set = params.set;
+ 
+-	ram_table->flags = 0x0;
++	ram_table->min_abm_backlight =
++			cpu_to_be16(params.min_abm_backlight);
+ 	ram_table->deviation_gain = 0xb3;
+ 
+ 	ram_table->blRampReduction =
+@@ -445,6 +447,9 @@ void fill_iram_v_2_2(struct iram_table_v_2_2 *ram_table, struct dmcu_iram_parame
+ 
+ 	ram_table->flags = 0x0;
+ 
++	ram_table->min_abm_backlight =
++			cpu_to_be16(params.min_abm_backlight);
++
+ 	ram_table->deviation_gain[0] = 0xb3;
+ 	ram_table->deviation_gain[1] = 0xa8;
+ 	ram_table->deviation_gain[2] = 0x98;
+@@ -588,6 +593,10 @@ void fill_iram_v_2_3(struct iram_table_v_2_2 *ram_table, struct dmcu_iram_parame
+ 	unsigned int set = params.set;
+ 
+ 	ram_table->flags = 0x0;
++
++	ram_table->min_abm_backlight =
++			cpu_to_be16(params.min_abm_backlight);
++
+ 	for (i = 0; i < NUM_AGGR_LEVEL; i++) {
+ 		ram_table->hybrid_factor[i] = abm_settings[set][i].brightness_gain;
+ 		ram_table->contrast_factor[i] = abm_settings[set][i].contrast_factor;
+diff --git a/drivers/gpu/drm/amd/display/modules/power/power_helpers.h b/drivers/gpu/drm/amd/display/modules/power/power_helpers.h
+index da5df00fedce..e54157026330 100644
+--- a/drivers/gpu/drm/amd/display/modules/power/power_helpers.h
++++ b/drivers/gpu/drm/amd/display/modules/power/power_helpers.h
+@@ -38,6 +38,7 @@ struct dmcu_iram_parameters {
+ 	unsigned int backlight_lut_array_size;
+ 	unsigned int backlight_ramping_reduction;
+ 	unsigned int backlight_ramping_start;
++	unsigned int min_abm_backlight;
+ 	unsigned int set;
+ };
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/drm-amd-display-set-number-of-pipes-to-1-if-the-seco.patch b/queue-5.4/drm-amd-display-set-number-of-pipes-to-1-if-the-seco.patch
new file mode 100644
index 00000000000..7d8dd55913b
--- /dev/null
+++ b/queue-5.4/drm-amd-display-set-number-of-pipes-to-1-if-the-seco.patch
@@ -0,0 +1,47 @@
+From bb3f8e02a88e3725716438cbdee0264642081f3c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Aug 2019 18:30:43 -0400
+Subject: drm/amd/display: Set number of pipes to 1 if the second pipe was
+ disabled
+
+From: Nikola Cornij <nikola.cornij@amd.com>
+
+[ Upstream commit 2fef0faa1cdc5d41ce3ef83f7b8f7e7ecb02d700 ]
+
+[why]
+Some ODM-related register settings are inconsistently updated by VBIOS, causing
+the state in DC to be invalid, which would then end up crashing in certain
+use-cases (such as disable/enable device).
+
+[how]
+Check the enabled status of the second pipe when determining the number of
+OPTC sources. If the second pipe is disabled, set the number of sources to 1
+regardless of other settings (that may not be updated correctly).
+
+Signed-off-by: Nikola Cornij <nikola.cornij@amd.com>
+Reviewed-by: Dmytro Laktyushkin <Dmytro.Laktyushkin@amd.com>
+Acked-by: Leo Li <sunpeng.li@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dcn20/dcn20_optc.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_optc.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_optc.c
+index 2137e2be2140..dda90995ba93 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_optc.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_optc.c
+@@ -287,6 +287,10 @@ void optc2_get_optc_source(struct timing_generator *optc,
+ 		*num_of_src_opp = 2;
+ 	else
+ 		*num_of_src_opp = 1;
++
++	/* Work around VBIOS not updating OPTC_NUM_OF_INPUT_SEGMENT */
++	if (*src_opp_id_1 == 0xf)
++		*num_of_src_opp = 1;
+ }
+ 
+ void optc2_set_dwb_source(struct timing_generator *optc,
+-- 
+2.20.1
+
diff --git a/queue-5.4/drm-amd-display-setting-the-dig_mode-to-the-correct-.patch b/queue-5.4/drm-amd-display-setting-the-dig_mode-to-the-correct-.patch
new file mode 100644
index 00000000000..fd2cae17d33
--- /dev/null
+++ b/queue-5.4/drm-amd-display-setting-the-dig_mode-to-the-correct-.patch
@@ -0,0 +1,48 @@
+From 0ea48605cd9eba0675f70ad202f9a79d938027df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Oct 2019 14:55:56 -0400
+Subject: drm/amd/display: setting the DIG_MODE to the correct value.
+
+From: Zhan liu <zhan.liu@amd.com>
+
+[ Upstream commit 967a3b85bac91c55eff740e61bf270c2732f48b2 ]
+
+[Why]
+This patch is for fixing Navi14 HDMI display pink screen issue.
+
+[How]
+Call stream->link->link_enc->funcs->setup twice. This is setting
+the DIG_MODE to the correct value after having been overridden by
+the call to transmitter control.
+
+Signed-off-by: Zhan Liu <zhan.liu@amd.com>
+Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc_link.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+index efc1d30544bb..067f5579f452 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+@@ -2769,6 +2769,15 @@ void core_link_enable_stream(
+ 					CONTROLLER_DP_TEST_PATTERN_VIDEOMODE,
+ 					COLOR_DEPTH_UNDEFINED);
+ 
++		/* This second call is needed to reconfigure the DIG
++		 * as a workaround for the incorrect value being applied
++		 * from transmitter control.
++		 */
++		if (!dc_is_virtual_signal(pipe_ctx->stream->signal))
++			stream->link->link_enc->funcs->setup(
++				stream->link->link_enc,
++				pipe_ctx->stream->signal);
++
+ #ifdef CONFIG_DRM_AMD_DC_DSC_SUPPORT
+ 		if (pipe_ctx->stream->timing.flags.DSC) {
+ 			if (dc_is_dp_signal(pipe_ctx->stream->signal) ||
+-- 
+2.20.1
+
diff --git a/queue-5.4/drm-amd-display-verify-stream-link-before-link-test.patch b/queue-5.4/drm-amd-display-verify-stream-link-before-link-test.patch
new file mode 100644
index 00000000000..035ed853678
--- /dev/null
+++ b/queue-5.4/drm-amd-display-verify-stream-link-before-link-test.patch
@@ -0,0 +1,42 @@
+From 470785351417763b891fc0e979f8afaef3b340b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Aug 2019 14:26:33 +0800
+Subject: drm/amd/display: verify stream link before link test
+
+From: Jing Zhou <Jing.Zhou@amd.com>
+
+[ Upstream commit b131932215c993ea5adf8192d1de2e8d6b23048d ]
+
+[Why]
+DP1.2 LL CTS test failure.
+
+[How]
+The failure is caused by not verify stream link is equal
+to link, only check stream and link is not null.
+
+Signed-off-by: Jing Zhou <Jing.Zhou@amd.com>
+Reviewed-by: Wenjing Liu <Wenjing.Liu@amd.com>
+Acked-by: Bhawanpreet Lakha <Bhawanpreet.Lakha@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc_link_hwss.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_hwss.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_hwss.c
+index 79438c4f1e20..a519dbc5ecb6 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_hwss.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_hwss.c
+@@ -277,7 +277,8 @@ void dp_retrain_link_dp_test(struct dc_link *link,
+ 		if (pipes[i].stream != NULL &&
+ 			!pipes[i].top_pipe && !pipes[i].prev_odm_pipe &&
+ 			pipes[i].stream->link != NULL &&
+-			pipes[i].stream_res.stream_enc != NULL) {
++			pipes[i].stream_res.stream_enc != NULL &&
++			pipes[i].stream->link == link) {
+ 			udelay(100);
+ 
+ 			pipes[i].stream_res.stream_enc->funcs->dp_blank(
+-- 
+2.20.1
+
diff --git a/queue-5.4/drm-amd-display-wait-for-set-pipe-mcp-command-comple.patch b/queue-5.4/drm-amd-display-wait-for-set-pipe-mcp-command-comple.patch
new file mode 100644
index 00000000000..e53650dbbc8
--- /dev/null
+++ b/queue-5.4/drm-amd-display-wait-for-set-pipe-mcp-command-comple.patch
@@ -0,0 +1,45 @@
+From 633f332924b09115696f516c378dd562df218ee9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Sep 2019 15:40:08 -0400
+Subject: drm/amd/display: wait for set pipe mcp command completion
+
+From: Josip Pavic <Josip.Pavic@amd.com>
+
+[ Upstream commit 15caeabc5787c15babad7ee444afe9c26df1c8b3 ]
+
+[Why]
+When the driver sends a pipe set command to the DMCU FW, it does not wait
+for the command to complete. This can lead to unpredictable behavior if,
+for example, the driver were to request a pipe disable to the FW via MCP,
+then power down some hardware before the firmware has completed processing
+the command.
+
+[How]
+Wait for the DMCU FW to finish processing set pipe commands
+
+Signed-off-by: Josip Pavic <Josip.Pavic@amd.com>
+Reviewed-by: Anthony Koo <Anthony.Koo@amd.com>
+Acked-by: Bhawanpreet Lakha <Bhawanpreet.Lakha@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dce/dce_abm.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_abm.c b/drivers/gpu/drm/amd/display/dc/dce/dce_abm.c
+index 58bd131d5b48..7700a855d77c 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_abm.c
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_abm.c
+@@ -77,6 +77,9 @@ static bool dce_abm_set_pipe(struct abm *abm, uint32_t controller_id)
+ 	/* notifyDMCUMsg */
+ 	REG_UPDATE(MASTER_COMM_CNTL_REG, MASTER_COMM_INTERRUPT, 1);
+ 
++	REG_WAIT(MASTER_COMM_CNTL_REG, MASTER_COMM_INTERRUPT, 0,
++			1, 80000);
++
+ 	return true;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/drm-amd-powerplay-a-workaround-to-gpu-reset-on-apu.patch b/queue-5.4/drm-amd-powerplay-a-workaround-to-gpu-reset-on-apu.patch
new file mode 100644
index 00000000000..fabfc6209e8
--- /dev/null
+++ b/queue-5.4/drm-amd-powerplay-a-workaround-to-gpu-reset-on-apu.patch
@@ -0,0 +1,44 @@
+From 63fb59c8f5b0de32d3638acb16cf733530601b0b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Sep 2019 15:02:56 +0800
+Subject: drm/amd/powerplay: A workaround to GPU RESET on APU
+
+From: chen gong <curry.gong@amd.com>
+
+[ Upstream commit 068ad870bbd8f4f2c5b2fd4977a4f3330c9988f4 ]
+
+Changes to function "smu_suspend" in amdgpu_smu.c is a workaround.
+
+We should get real information about if baco is enabled or not, while we
+always consider APU SMU feature as enabled in current code.
+
+I know APU do not support baco mode for GPU reset, so I use
+"adev->flags" to skip function "smu_feature_is_enabled".
+
+Signed-off-by: chen gong <curry.gong@amd.com>
+Reviewed-by: Aaron Liu <aaron.liu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/powerplay/amdgpu_smu.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c b/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c
+index 4acf139ea014..58c091ab67b2 100644
+--- a/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c
++++ b/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c
+@@ -1344,7 +1344,10 @@ static int smu_suspend(void *handle)
+ 	int ret;
+ 	struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+ 	struct smu_context *smu = &adev->smu;
+-	bool baco_feature_is_enabled = smu_feature_is_enabled(smu, SMU_FEATURE_BACO_BIT);
++	bool baco_feature_is_enabled = false;
++
++	if(!(adev->flags & AMD_IS_APU))
++		baco_feature_is_enabled = smu_feature_is_enabled(smu, SMU_FEATURE_BACO_BIT);
+ 
+ 	ret = smu_system_features_control(smu, false);
+ 	if (ret)
+-- 
+2.20.1
+
diff --git a/queue-5.4/drm-amd-powerplay-avoid-disabling-ecc-if-ras-is-enab.patch b/queue-5.4/drm-amd-powerplay-avoid-disabling-ecc-if-ras-is-enab.patch
new file mode 100644
index 00000000000..14f0e4edd9b
--- /dev/null
+++ b/queue-5.4/drm-amd-powerplay-avoid-disabling-ecc-if-ras-is-enab.patch
@@ -0,0 +1,62 @@
+From 32dbafd1b6ff008fa8bdac587c9098d4c6f9d6b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Oct 2019 18:37:49 +0800
+Subject: drm/amd/powerplay: avoid disabling ECC if RAS is enabled for VEGA20
+
+From: Le Ma <le.ma@amd.com>
+
+[ Upstream commit df9331e561dab0a451cbd6a679ee88a95f306fd6 ]
+
+Program THM_BACO_CNTL.SOC_DOMAIN_IDLE=1 will tell VBIOS to disable ECC when
+BACO exit. This can save BACO exit time by PSP on none-ECC SKU. Drop the setting
+for ECC supported SKU.
+
+Signed-off-by: Le Ma <le.ma@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/powerplay/hwmgr/vega20_baco.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_baco.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_baco.c
+index df6ff9252401..b068d1c7b44d 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_baco.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_baco.c
+@@ -29,7 +29,7 @@
+ #include "vega20_baco.h"
+ #include "vega20_smumgr.h"
+ 
+-
++#include "amdgpu_ras.h"
+ 
+ static const struct soc15_baco_cmd_entry clean_baco_tbl[] =
+ {
+@@ -74,6 +74,7 @@ int vega20_baco_get_state(struct pp_hwmgr *hwmgr, enum BACO_STATE *state)
+ int vega20_baco_set_state(struct pp_hwmgr *hwmgr, enum BACO_STATE state)
+ {
+ 	struct amdgpu_device *adev = (struct amdgpu_device *)(hwmgr->adev);
++	struct amdgpu_ras *ras = amdgpu_ras_get_context(adev);
+ 	enum BACO_STATE cur_state;
+ 	uint32_t data;
+ 
+@@ -84,10 +85,11 @@ int vega20_baco_set_state(struct pp_hwmgr *hwmgr, enum BACO_STATE state)
+ 		return 0;
+ 
+ 	if (state == BACO_STATE_IN) {
+-		data = RREG32_SOC15(THM, 0, mmTHM_BACO_CNTL);
+-		data |= 0x80000000;
+-		WREG32_SOC15(THM, 0, mmTHM_BACO_CNTL, data);
+-
++		if (!ras || !ras->supported) {
++			data = RREG32_SOC15(THM, 0, mmTHM_BACO_CNTL);
++			data |= 0x80000000;
++			WREG32_SOC15(THM, 0, mmTHM_BACO_CNTL, data);
++		}
+ 
+ 		if(smum_send_msg_to_smc_with_parameter(hwmgr, PPSMC_MSG_EnterBaco, 0))
+ 			return -EINVAL;
+-- 
+2.20.1
+
diff --git a/queue-5.4/drm-amd-powerplay-fix-struct-init-in-renoir_print_cl.patch b/queue-5.4/drm-amd-powerplay-fix-struct-init-in-renoir_print_cl.patch
new file mode 100644
index 00000000000..3c7659df11a
--- /dev/null
+++ b/queue-5.4/drm-amd-powerplay-fix-struct-init-in-renoir_print_cl.patch
@@ -0,0 +1,45 @@
+From 0185f524e6fadcd66473aacfedd2851669a44464 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Nov 2019 15:58:02 -0700
+Subject: drm/amd/powerplay: fix struct init in renoir_print_clk_levels
+
+From: Raul E Rangel <rrangel@chromium.org>
+
+[ Upstream commit d942070575910fdb687b9c8fd5467704b2f77c24 ]
+
+drivers/gpu/drm/amd/powerplay/renoir_ppt.c:186:2: error: missing braces
+around initializer [-Werror=missing-braces]
+  SmuMetrics_t metrics = {0};
+    ^
+
+Fixes: 8b8031703bd7 ("drm/amd/powerplay: implement sysfs for getting dpm clock")
+
+Signed-off-by: Raul E Rangel <rrangel@chromium.org>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/powerplay/renoir_ppt.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/powerplay/renoir_ppt.c b/drivers/gpu/drm/amd/powerplay/renoir_ppt.c
+index e62bfba51562..e5283dafc414 100644
+--- a/drivers/gpu/drm/amd/powerplay/renoir_ppt.c
++++ b/drivers/gpu/drm/amd/powerplay/renoir_ppt.c
+@@ -183,11 +183,13 @@ static int renoir_print_clk_levels(struct smu_context *smu,
+ 	int i, size = 0, ret = 0;
+ 	uint32_t cur_value = 0, value = 0, count = 0, min = 0, max = 0;
+ 	DpmClocks_t *clk_table = smu->smu_table.clocks_table;
+-	SmuMetrics_t metrics = {0};
++	SmuMetrics_t metrics;
+ 
+ 	if (!clk_table || clk_type >= SMU_CLK_COUNT)
+ 		return -EINVAL;
+ 
++	memset(&metrics, 0, sizeof(metrics));
++
+ 	ret = smu_update_table(smu, SMU_TABLE_SMU_METRICS, 0,
+ 			       (void *)&metrics, false);
+ 	if (ret)
+-- 
+2.20.1
+
diff --git a/queue-5.4/drm-amdgpu-avoid-accidental-thread-reactivation.patch b/queue-5.4/drm-amdgpu-avoid-accidental-thread-reactivation.patch
new file mode 100644
index 00000000000..4506b4e8f04
--- /dev/null
+++ b/queue-5.4/drm-amdgpu-avoid-accidental-thread-reactivation.patch
@@ -0,0 +1,75 @@
+From 30c2e74b2db177c5e4ddf46f8eb3d3d803c6f206 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Nov 2019 12:36:29 -0500
+Subject: drm/amdgpu: Avoid accidental thread reactivation.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Andrey Grodzovsky <andrey.grodzovsky@amd.com>
+
+[ Upstream commit a28fda312a9fabdf0e5f5652449d6197c9fb0a90 ]
+
+Problem:
+During GPU reset we call the GPU scheduler to suspend it's
+thread, those two functions in amdgpu also suspend and resume
+the sceduler for their needs but this can collide with GPU
+reset in progress and accidently restart a suspended thread
+before time.
+
+Fix:
+Serialize with GPU reset.
+
+Signed-off-by: Andrey Grodzovsky <andrey.grodzovsky@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
+index 5652cc72ed3a..81842ba8cd75 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
+@@ -859,6 +859,9 @@ static int amdgpu_debugfs_test_ib(struct seq_file *m, void *data)
+ 	struct amdgpu_device *adev = dev->dev_private;
+ 	int r = 0, i;
+ 
++	/* Avoid accidently unparking the sched thread during GPU reset */
++	mutex_lock(&adev->lock_reset);
++
+ 	/* hold on the scheduler */
+ 	for (i = 0; i < AMDGPU_MAX_RINGS; i++) {
+ 		struct amdgpu_ring *ring = adev->rings[i];
+@@ -884,6 +887,8 @@ static int amdgpu_debugfs_test_ib(struct seq_file *m, void *data)
+ 		kthread_unpark(ring->sched.thread);
+ 	}
+ 
++	mutex_unlock(&adev->lock_reset);
++
+ 	return 0;
+ }
+ 
+@@ -1036,6 +1041,9 @@ static int amdgpu_debugfs_ib_preempt(void *data, u64 val)
+ 	if (!fences)
+ 		return -ENOMEM;
+ 
++	/* Avoid accidently unparking the sched thread during GPU reset */
++	mutex_lock(&adev->lock_reset);
++
+ 	/* stop the scheduler */
+ 	kthread_park(ring->sched.thread);
+ 
+@@ -1075,6 +1083,8 @@ failure:
+ 	/* restart the scheduler */
+ 	kthread_unpark(ring->sched.thread);
+ 
++	mutex_unlock(&adev->lock_reset);
++
+ 	ttm_bo_unlock_delayed_workqueue(&adev->mman.bdev, resched);
+ 
+ 	if (fences)
+-- 
+2.20.1
+
diff --git a/queue-5.4/drm-amdgpu-disallow-direct-upload-save-restore-list-.patch b/queue-5.4/drm-amdgpu-disallow-direct-upload-save-restore-list-.patch
new file mode 100644
index 00000000000..2306b5357de
--- /dev/null
+++ b/queue-5.4/drm-amdgpu-disallow-direct-upload-save-restore-list-.patch
@@ -0,0 +1,45 @@
+From 86178086aafb1273ced66b71d6fa3570dd802b1c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2019 16:20:06 +0800
+Subject: drm/amdgpu: disallow direct upload save restore list from gfx driver
+
+From: Hawking Zhang <Hawking.Zhang@amd.com>
+
+[ Upstream commit 58f46d4b65021083ef4b4d49c6e2c58e5783f626 ]
+
+Direct uploading save/restore list via mmio register writes breaks the security
+policy. Instead, the driver should pass s&r list to psp.
+
+For all the ASICs that use rlc v2_1 headers, the driver actually upload s&r list
+twice, in non-psp ucode front door loading phase and gfx pg initialization phase.
+The latter is not allowed.
+
+VG12 is the only exception where the driver still keeps legacy approach for S&R
+list uploading. In theory, this can be elimnated if we have valid srcntl ucode
+for VG12.
+
+Signed-off-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Reviewed-by: Candice Li <Candice.Li@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+index 97cf0b536873..c9ba2ec6d038 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+@@ -2930,7 +2930,8 @@ static void gfx_v9_0_init_pg(struct amdgpu_device *adev)
+ 	 * And it's needed by gfxoff feature.
+ 	 */
+ 	if (adev->gfx.rlc.is_rlc_v2_1) {
+-		gfx_v9_1_init_rlc_save_restore_list(adev);
++		if (adev->asic_type == CHIP_VEGA12)
++			gfx_v9_1_init_rlc_save_restore_list(adev);
+ 		gfx_v9_0_enable_save_restore_machine(adev);
+ 	}
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/drm-amdgpu-fix-amdgpu-trace-event-print-string-forma.patch b/queue-5.4/drm-amdgpu-fix-amdgpu-trace-event-print-string-forma.patch
new file mode 100644
index 00000000000..879c0c9d33f
--- /dev/null
+++ b/queue-5.4/drm-amdgpu-fix-amdgpu-trace-event-print-string-forma.patch
@@ -0,0 +1,119 @@
+From 32334856a0535cf88accbe021454ad9e26c3626e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Oct 2019 10:51:32 +0800
+Subject: drm/amdgpu: fix amdgpu trace event print string format error
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Kevin Wang <kevin1.wang@amd.com>
+
+[ Upstream commit 2c2fdb8bca290c439e383cfb6857b0c65e528964 ]
+
+the trace event print string format error.
+(use integer type to handle string)
+
+before:
+amdgpu_test_kev-1556  [002]   138.508781: amdgpu_cs_ioctl:
+sched_job=8, timeline=gfx_0.0.0, context=177, seqno=1,
+ring_name=ffff94d01c207bf0, num_ibs=2
+
+after:
+amdgpu_test_kev-1506  [004]   370.703783: amdgpu_cs_ioctl:
+sched_job=12, timeline=gfx_0.0.0, context=234, seqno=2,
+ring_name=gfx_0.0.0, num_ibs=1
+
+change trace event list:
+1.amdgpu_cs_ioctl
+2.amdgpu_sched_run_job
+3.amdgpu_ib_pipe_sync
+
+Signed-off-by: Kevin Wang <kevin1.wang@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h
+index 77674a7b9616..91899d28fa72 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h
+@@ -170,7 +170,7 @@ TRACE_EVENT(amdgpu_cs_ioctl,
+ 			     __field(unsigned int, context)
+ 			     __field(unsigned int, seqno)
+ 			     __field(struct dma_fence *, fence)
+-			     __field(char *, ring_name)
++			     __string(ring, to_amdgpu_ring(job->base.sched)->name)
+ 			     __field(u32, num_ibs)
+ 			     ),
+ 
+@@ -179,12 +179,12 @@ TRACE_EVENT(amdgpu_cs_ioctl,
+ 			   __assign_str(timeline, AMDGPU_JOB_GET_TIMELINE_NAME(job))
+ 			   __entry->context = job->base.s_fence->finished.context;
+ 			   __entry->seqno = job->base.s_fence->finished.seqno;
+-			   __entry->ring_name = to_amdgpu_ring(job->base.sched)->name;
++			   __assign_str(ring, to_amdgpu_ring(job->base.sched)->name)
+ 			   __entry->num_ibs = job->num_ibs;
+ 			   ),
+ 	    TP_printk("sched_job=%llu, timeline=%s, context=%u, seqno=%u, ring_name=%s, num_ibs=%u",
+ 		      __entry->sched_job_id, __get_str(timeline), __entry->context,
+-		      __entry->seqno, __entry->ring_name, __entry->num_ibs)
++		      __entry->seqno, __get_str(ring), __entry->num_ibs)
+ );
+ 
+ TRACE_EVENT(amdgpu_sched_run_job,
+@@ -195,7 +195,7 @@ TRACE_EVENT(amdgpu_sched_run_job,
+ 			     __string(timeline, AMDGPU_JOB_GET_TIMELINE_NAME(job))
+ 			     __field(unsigned int, context)
+ 			     __field(unsigned int, seqno)
+-			     __field(char *, ring_name)
++			     __string(ring, to_amdgpu_ring(job->base.sched)->name)
+ 			     __field(u32, num_ibs)
+ 			     ),
+ 
+@@ -204,12 +204,12 @@ TRACE_EVENT(amdgpu_sched_run_job,
+ 			   __assign_str(timeline, AMDGPU_JOB_GET_TIMELINE_NAME(job))
+ 			   __entry->context = job->base.s_fence->finished.context;
+ 			   __entry->seqno = job->base.s_fence->finished.seqno;
+-			   __entry->ring_name = to_amdgpu_ring(job->base.sched)->name;
++			   __assign_str(ring, to_amdgpu_ring(job->base.sched)->name)
+ 			   __entry->num_ibs = job->num_ibs;
+ 			   ),
+ 	    TP_printk("sched_job=%llu, timeline=%s, context=%u, seqno=%u, ring_name=%s, num_ibs=%u",
+ 		      __entry->sched_job_id, __get_str(timeline), __entry->context,
+-		      __entry->seqno, __entry->ring_name, __entry->num_ibs)
++		      __entry->seqno, __get_str(ring), __entry->num_ibs)
+ );
+ 
+ 
+@@ -468,7 +468,7 @@ TRACE_EVENT(amdgpu_ib_pipe_sync,
+ 	    TP_PROTO(struct amdgpu_job *sched_job, struct dma_fence *fence),
+ 	    TP_ARGS(sched_job, fence),
+ 	    TP_STRUCT__entry(
+-			     __field(const char *,name)
++			     __string(ring, sched_job->base.sched->name);
+ 			     __field(uint64_t, id)
+ 			     __field(struct dma_fence *, fence)
+ 			     __field(uint64_t, ctx)
+@@ -476,14 +476,14 @@ TRACE_EVENT(amdgpu_ib_pipe_sync,
+ 			     ),
+ 
+ 	    TP_fast_assign(
+-			   __entry->name = sched_job->base.sched->name;
++			   __assign_str(ring, sched_job->base.sched->name)
+ 			   __entry->id = sched_job->base.id;
+ 			   __entry->fence = fence;
+ 			   __entry->ctx = fence->context;
+ 			   __entry->seqno = fence->seqno;
+ 			   ),
+ 	    TP_printk("job ring=%s, id=%llu, need pipe sync to fence=%p, context=%llu, seq=%u",
+-		      __entry->name, __entry->id,
++		      __get_str(ring), __entry->id,
+ 		      __entry->fence, __entry->ctx,
+ 		      __entry->seqno)
+ );
+-- 
+2.20.1
+
diff --git a/queue-5.4/drm-amdgpu-fix-bad-dma-from-interrupt_cntl2.patch b/queue-5.4/drm-amdgpu-fix-bad-dma-from-interrupt_cntl2.patch
new file mode 100644
index 00000000000..bfa3e9a6566
--- /dev/null
+++ b/queue-5.4/drm-amdgpu-fix-bad-dma-from-interrupt_cntl2.patch
@@ -0,0 +1,42 @@
+From 56b802e4848348d505d16c6990e9123292b660d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Nov 2019 10:53:54 +1100
+Subject: drm/amdgpu: fix bad DMA from INTERRUPT_CNTL2
+
+From: Sam Bobroff <sbobroff@linux.ibm.com>
+
+[ Upstream commit 3d0e3ce52ce3eb4b9de3caf9c38dbb5a4d3e13c3 ]
+
+The INTERRUPT_CNTL2 register expects a valid DMA address, but is
+currently set with a GPU MC address.  This can cause problems on
+systems that detect the resulting DMA read from an invalid address
+(found on a Power8 guest).
+
+Instead, use the DMA address of the dummy page because it will always
+be safe.
+
+Fixes: 27ae10641e9c ("drm/amdgpu: add interupt handler implementation for si v3")
+Signed-off-by: Sam Bobroff <sbobroff@linux.ibm.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/si_ih.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/si_ih.c b/drivers/gpu/drm/amd/amdgpu/si_ih.c
+index 57bb5f9e08b2..88ae27a5a03d 100644
+--- a/drivers/gpu/drm/amd/amdgpu/si_ih.c
++++ b/drivers/gpu/drm/amd/amdgpu/si_ih.c
+@@ -64,7 +64,8 @@ static int si_ih_irq_init(struct amdgpu_device *adev)
+ 	u32 interrupt_cntl, ih_cntl, ih_rb_cntl;
+ 
+ 	si_ih_disable_interrupts(adev);
+-	WREG32(INTERRUPT_CNTL2, adev->irq.ih.gpu_addr >> 8);
++	/* set dummy read address to dummy page address */
++	WREG32(INTERRUPT_CNTL2, adev->dummy_page_addr >> 8);
+ 	interrupt_cntl = RREG32(INTERRUPT_CNTL);
+ 	interrupt_cntl &= ~IH_DUMMY_RD_OVERRIDE;
+ 	interrupt_cntl &= ~IH_REQ_NONSNOOP_EN;
+-- 
+2.20.1
+
diff --git a/queue-5.4/drm-amdgpu-fix-potential-double-drop-fence-reference.patch b/queue-5.4/drm-amdgpu-fix-potential-double-drop-fence-reference.patch
new file mode 100644
index 00000000000..8a17bff88e8
--- /dev/null
+++ b/queue-5.4/drm-amdgpu-fix-potential-double-drop-fence-reference.patch
@@ -0,0 +1,48 @@
+From e75eef52269346adcb259bd28598e6b4a99102bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Nov 2019 17:14:45 +0800
+Subject: drm/amdgpu: fix potential double drop fence reference
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit 946ab8db6953535a3a88c957db8328beacdfed9d ]
+
+The object fence is not set to NULL after its reference is dropped. As a
+result, its reference may be dropped again if error occurs after that,
+which may lead to a use after free bug. To avoid the issue, fence is
+explicitly set to NULL after dropping its reference.
+
+Acked-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_test.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_test.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_test.c
+index b66d29d5ffa2..b158230af8db 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_test.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_test.c
+@@ -138,6 +138,7 @@ static void amdgpu_do_test_moves(struct amdgpu_device *adev)
+ 		}
+ 
+ 		dma_fence_put(fence);
++		fence = NULL;
+ 
+ 		r = amdgpu_bo_kmap(vram_obj, &vram_map);
+ 		if (r) {
+@@ -183,6 +184,7 @@ static void amdgpu_do_test_moves(struct amdgpu_device *adev)
+ 		}
+ 
+ 		dma_fence_put(fence);
++		fence = NULL;
+ 
+ 		r = amdgpu_bo_kmap(gtt_obj[i], &gtt_map);
+ 		if (r) {
+-- 
+2.20.1
+
diff --git a/queue-5.4/drm-amdgpu-grab-the-id-mgr-lock-while-accessing-pass.patch b/queue-5.4/drm-amdgpu-grab-the-id-mgr-lock-while-accessing-pass.patch
new file mode 100644
index 00000000000..4d71d7bc5ea
--- /dev/null
+++ b/queue-5.4/drm-amdgpu-grab-the-id-mgr-lock-while-accessing-pass.patch
@@ -0,0 +1,67 @@
+From 224da796d7ba77718ef28a665d6d47345fcad476 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Sep 2019 13:57:32 +0200
+Subject: drm/amdgpu: grab the id mgr lock while accessing passid_mapping
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christian König <christian.koenig@amd.com>
+
+[ Upstream commit 6817bf283b2b851095825ec7f0e9f10398e09125 ]
+
+Need to make sure that we actually dropping the right fence.
+Could be done with RCU as well, but to complicated for a fix.
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Chunming Zhou <david1.zhou@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+index 5251352f5922..7700c32dd743 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+@@ -1034,10 +1034,8 @@ int amdgpu_vm_flush(struct amdgpu_ring *ring, struct amdgpu_job *job, bool need_
+ 		id->oa_base != job->oa_base ||
+ 		id->oa_size != job->oa_size);
+ 	bool vm_flush_needed = job->vm_needs_flush;
+-	bool pasid_mapping_needed = id->pasid != job->pasid ||
+-		!id->pasid_mapping ||
+-		!dma_fence_is_signaled(id->pasid_mapping);
+ 	struct dma_fence *fence = NULL;
++	bool pasid_mapping_needed;
+ 	unsigned patch_offset = 0;
+ 	int r;
+ 
+@@ -1047,6 +1045,12 @@ int amdgpu_vm_flush(struct amdgpu_ring *ring, struct amdgpu_job *job, bool need_
+ 		pasid_mapping_needed = true;
+ 	}
+ 
++	mutex_lock(&id_mgr->lock);
++	if (id->pasid != job->pasid || !id->pasid_mapping ||
++	    !dma_fence_is_signaled(id->pasid_mapping))
++		pasid_mapping_needed = true;
++	mutex_unlock(&id_mgr->lock);
++
+ 	gds_switch_needed &= !!ring->funcs->emit_gds_switch;
+ 	vm_flush_needed &= !!ring->funcs->emit_vm_flush  &&
+ 			job->vm_pd_addr != AMDGPU_BO_INVALID_OFFSET;
+@@ -1086,9 +1090,11 @@ int amdgpu_vm_flush(struct amdgpu_ring *ring, struct amdgpu_job *job, bool need_
+ 	}
+ 
+ 	if (pasid_mapping_needed) {
++		mutex_lock(&id_mgr->lock);
+ 		id->pasid = job->pasid;
+ 		dma_fence_put(id->pasid_mapping);
+ 		id->pasid_mapping = dma_fence_get(fence);
++		mutex_unlock(&id_mgr->lock);
+ 	}
+ 	dma_fence_put(fence);
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/drm-amdgpu-sriov-add-ring_stop-before-ring_create-in.patch b/queue-5.4/drm-amdgpu-sriov-add-ring_stop-before-ring_create-in.patch
new file mode 100644
index 00000000000..eda7f42927a
--- /dev/null
+++ b/queue-5.4/drm-amdgpu-sriov-add-ring_stop-before-ring_create-in.patch
@@ -0,0 +1,113 @@
+From d7e2c22adfb2d5e5fafb26d0eec1c5a060ed3c30 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Sep 2019 12:29:14 +0800
+Subject: drm/amdgpu/sriov: add ring_stop before ring_create in psp v11 code
+
+From: Jack Zhang <Jack.Zhang1@amd.com>
+
+[ Upstream commit 51c0f58e9f6af3a387d14608033e6796a7ad90ee ]
+
+psp  v11 code missed ring stop in ring create function(VMR)
+while psp v3.1 code had the code. This will cause VM destroy1
+fail and psp ring create fail.
+
+For SIOV-VF, ring_stop should not be deleted in ring_create
+function.
+
+Signed-off-by: Jack Zhang <Jack.Zhang1@amd.com>
+Reviewed-by: Feifei Xu <Feifei.Xu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/psp_v11_0.c | 61 ++++++++++++++------------
+ 1 file changed, 34 insertions(+), 27 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/psp_v11_0.c b/drivers/gpu/drm/amd/amdgpu/psp_v11_0.c
+index 10166104b8a3..d483684db95b 100644
+--- a/drivers/gpu/drm/amd/amdgpu/psp_v11_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/psp_v11_0.c
+@@ -398,6 +398,34 @@ static bool psp_v11_0_support_vmr_ring(struct psp_context *psp)
+ 	return false;
+ }
+ 
++static int psp_v11_0_ring_stop(struct psp_context *psp,
++			      enum psp_ring_type ring_type)
++{
++	int ret = 0;
++	struct amdgpu_device *adev = psp->adev;
++
++	/* Write the ring destroy command*/
++	if (psp_v11_0_support_vmr_ring(psp))
++		WREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_101,
++				     GFX_CTRL_CMD_ID_DESTROY_GPCOM_RING);
++	else
++		WREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_64,
++				     GFX_CTRL_CMD_ID_DESTROY_RINGS);
++
++	/* there might be handshake issue with hardware which needs delay */
++	mdelay(20);
++
++	/* Wait for response flag (bit 31) */
++	if (psp_v11_0_support_vmr_ring(psp))
++		ret = psp_wait_for(psp, SOC15_REG_OFFSET(MP0, 0, mmMP0_SMN_C2PMSG_101),
++				   0x80000000, 0x80000000, false);
++	else
++		ret = psp_wait_for(psp, SOC15_REG_OFFSET(MP0, 0, mmMP0_SMN_C2PMSG_64),
++				   0x80000000, 0x80000000, false);
++
++	return ret;
++}
++
+ static int psp_v11_0_ring_create(struct psp_context *psp,
+ 				enum psp_ring_type ring_type)
+ {
+@@ -407,6 +435,12 @@ static int psp_v11_0_ring_create(struct psp_context *psp,
+ 	struct amdgpu_device *adev = psp->adev;
+ 
+ 	if (psp_v11_0_support_vmr_ring(psp)) {
++		ret = psp_v11_0_ring_stop(psp, ring_type);
++		if (ret) {
++			DRM_ERROR("psp_v11_0_ring_stop_sriov failed!\n");
++			return ret;
++		}
++
+ 		/* Write low address of the ring to C2PMSG_102 */
+ 		psp_ring_reg = lower_32_bits(ring->ring_mem_mc_addr);
+ 		WREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_102, psp_ring_reg);
+@@ -451,33 +485,6 @@ static int psp_v11_0_ring_create(struct psp_context *psp,
+ 	return ret;
+ }
+ 
+-static int psp_v11_0_ring_stop(struct psp_context *psp,
+-			      enum psp_ring_type ring_type)
+-{
+-	int ret = 0;
+-	struct amdgpu_device *adev = psp->adev;
+-
+-	/* Write the ring destroy command*/
+-	if (psp_v11_0_support_vmr_ring(psp))
+-		WREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_101,
+-				     GFX_CTRL_CMD_ID_DESTROY_GPCOM_RING);
+-	else
+-		WREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_64,
+-				     GFX_CTRL_CMD_ID_DESTROY_RINGS);
+-
+-	/* there might be handshake issue with hardware which needs delay */
+-	mdelay(20);
+-
+-	/* Wait for response flag (bit 31) */
+-	if (psp_v11_0_support_vmr_ring(psp))
+-		ret = psp_wait_for(psp, SOC15_REG_OFFSET(MP0, 0, mmMP0_SMN_C2PMSG_101),
+-				   0x80000000, 0x80000000, false);
+-	else
+-		ret = psp_wait_for(psp, SOC15_REG_OFFSET(MP0, 0, mmMP0_SMN_C2PMSG_64),
+-				   0x80000000, 0x80000000, false);
+-
+-	return ret;
+-}
+ 
+ static int psp_v11_0_ring_destroy(struct psp_context *psp,
+ 				 enum psp_ring_type ring_type)
+-- 
+2.20.1
+
diff --git a/queue-5.4/drm-amdkfd-fix-a-potential-null-pointer-dereference-.patch b/queue-5.4/drm-amdkfd-fix-a-potential-null-pointer-dereference-.patch
new file mode 100644
index 00000000000..c98bda640be
--- /dev/null
+++ b/queue-5.4/drm-amdkfd-fix-a-potential-null-pointer-dereference-.patch
@@ -0,0 +1,44 @@
+From bceec8ee22587efd1f5a88c99b50f3d68f7192ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Sep 2019 22:00:31 +0530
+Subject: drm/amdkfd: fix a potential NULL pointer dereference (v2)
+
+From: Allen Pais <allen.pais@oracle.com>
+
+[ Upstream commit 81de29d842ccb776c0f77aa3e2b11b07fff0c0e2 ]
+
+alloc_workqueue is not checked for errors and as a result,
+a potential NULL dereference could occur.
+
+v2 (Felix Kuehling):
+* Fix compile error (kfifo_free instead of fifo_free)
+* Return proper error code
+
+Signed-off-by: Allen Pais <allen.pais@oracle.com>
+Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c b/drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c
+index c56ac47cd318..bc47f6a44456 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c
+@@ -62,6 +62,11 @@ int kfd_interrupt_init(struct kfd_dev *kfd)
+ 	}
+ 
+ 	kfd->ih_wq = alloc_workqueue("KFD IH", WQ_HIGHPRI, 1);
++	if (unlikely(!kfd->ih_wq)) {
++		kfifo_free(&kfd->ih_fifo);
++		dev_err(kfd_chardev(), "Failed to allocate KFD IH workqueue\n");
++		return -ENOMEM;
++	}
+ 	spin_lock_init(&kfd->interrupt_lock);
+ 
+ 	INIT_WORK(&kfd->interrupt_work, interrupt_wq);
+-- 
+2.20.1
+
diff --git a/queue-5.4/drm-amdkfd-fix-mqd-size-calculation.patch b/queue-5.4/drm-amdkfd-fix-mqd-size-calculation.patch
new file mode 100644
index 00000000000..7557007224c
--- /dev/null
+++ b/queue-5.4/drm-amdkfd-fix-mqd-size-calculation.patch
@@ -0,0 +1,41 @@
+From 1a7c8c1bbc873e7b77372d992f610968011b0180 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Oct 2019 09:28:21 -0500
+Subject: drm/amdkfd: Fix MQD size calculation
+
+From: Oak Zeng <Oak.Zeng@amd.com>
+
+[ Upstream commit 40a9592a26608e16f7545a068ea4165e1869f629 ]
+
+On device initialization, a chunk of GTT memory is pre-allocated for
+HIQ and all SDMA queues mqd. The size of this allocation was wrong.
+The correct sdma engine number should be PCIe-optimized SDMA engine
+number plus xgmi SDMA engine number.
+
+Reported-by: Jonathan Kim <Jonathan.Kim@amd.com>
+Signed-off-by: Jonathan Kim <Jonathan.Kim@amd.com>
+Signed-off-by: Oak Zeng <Oak.Zeng@amd.com>
+Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+index d985e31fcc1e..f335f73919d1 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+@@ -1676,7 +1676,8 @@ static int allocate_hiq_sdma_mqd(struct device_queue_manager *dqm)
+ 	struct kfd_dev *dev = dqm->dev;
+ 	struct kfd_mem_obj *mem_obj = &dqm->hiq_sdma_mqd;
+ 	uint32_t size = dqm->mqd_mgrs[KFD_MQD_TYPE_SDMA]->mqd_size *
+-		dev->device_info->num_sdma_engines *
++		(dev->device_info->num_sdma_engines +
++		dev->device_info->num_xgmi_sdma_engines) *
+ 		dev->device_info->num_sdma_queues_per_engine +
+ 		dqm->mqd_mgrs[KFD_MQD_TYPE_HIQ]->mqd_size;
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/drm-bridge-analogix-anx78xx-silence-eprobe_defer-war.patch b/queue-5.4/drm-bridge-analogix-anx78xx-silence-eprobe_defer-war.patch
new file mode 100644
index 00000000000..7d1cb74c248
--- /dev/null
+++ b/queue-5.4/drm-bridge-analogix-anx78xx-silence-eprobe_defer-war.patch
@@ -0,0 +1,50 @@
+From e562996e335cf388e7414b68ca7100c35e2a2f09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Aug 2019 20:48:46 -0400
+Subject: drm/bridge: analogix-anx78xx: silence -EPROBE_DEFER warnings
+
+From: Brian Masney <masneyb@onstation.org>
+
+[ Upstream commit 2708e876272d89bbbff811d12834adbeef85f022 ]
+
+Silence two warning messages that occur due to -EPROBE_DEFER errors to
+help cleanup the system boot log.
+
+Signed-off-by: Brian Masney <masneyb@onstation.org>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190815004854.19860-4-masneyb@onstation.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/analogix-anx78xx.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/analogix-anx78xx.c b/drivers/gpu/drm/bridge/analogix-anx78xx.c
+index 3c7cc5af735c..56df07cdab68 100644
+--- a/drivers/gpu/drm/bridge/analogix-anx78xx.c
++++ b/drivers/gpu/drm/bridge/analogix-anx78xx.c
+@@ -715,7 +715,9 @@ static int anx78xx_init_pdata(struct anx78xx *anx78xx)
+ 	/* 1.0V digital core power regulator  */
+ 	pdata->dvdd10 = devm_regulator_get(dev, "dvdd10");
+ 	if (IS_ERR(pdata->dvdd10)) {
+-		DRM_ERROR("DVDD10 regulator not found\n");
++		if (PTR_ERR(pdata->dvdd10) != -EPROBE_DEFER)
++			DRM_ERROR("DVDD10 regulator not found\n");
++
+ 		return PTR_ERR(pdata->dvdd10);
+ 	}
+ 
+@@ -1332,7 +1334,9 @@ static int anx78xx_i2c_probe(struct i2c_client *client,
+ 
+ 	err = anx78xx_init_pdata(anx78xx);
+ 	if (err) {
+-		DRM_ERROR("Failed to initialize pdata: %d\n", err);
++		if (err != -EPROBE_DEFER)
++			DRM_ERROR("Failed to initialize pdata: %d\n", err);
++
+ 		return err;
+ 	}
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/drm-bridge-dw-hdmi-refuse-ddc-ci-transfers-on-the-in.patch b/queue-5.4/drm-bridge-dw-hdmi-refuse-ddc-ci-transfers-on-the-in.patch
new file mode 100644
index 00000000000..792a55387cb
--- /dev/null
+++ b/queue-5.4/drm-bridge-dw-hdmi-refuse-ddc-ci-transfers-on-the-in.patch
@@ -0,0 +1,61 @@
+From 73dff9ed8a2a1b59d017322f30050ac724cff737 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Oct 2019 12:44:06 -0700
+Subject: drm/bridge: dw-hdmi: Refuse DDC/CI transfers on the internal I2C
+ controller
+
+From: Matthias Kaehlcke <mka@chromium.org>
+
+[ Upstream commit bee447e224b2645911c5d06e35dc90d8433fcef6 ]
+
+The DDC/CI protocol involves sending a multi-byte request to the
+display via I2C, which is typically followed by a multi-byte
+response. The internal I2C controller only allows single byte
+reads/writes or reads of 8 sequential bytes, hence DDC/CI is not
+supported when the internal I2C controller is used. The I2C
+transfers complete without errors, however the data in the response
+is garbage. Abort transfers to/from slave address 0x37 (DDC) with
+-EOPNOTSUPP, to make it evident that the communication is failing.
+
+Signed-off-by: Matthias Kaehlcke <mka@chromium.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Sean Paul <sean@poorly.run>
+Acked-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20191002124354.v2.1.I709dfec496f5f0b44a7b61dcd4937924da8d8382@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
+index 521d689413c8..3e82d604201e 100644
+--- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
++++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
+@@ -36,6 +36,7 @@
+ #include "dw-hdmi-cec.h"
+ #include "dw-hdmi.h"
+ 
++#define DDC_CI_ADDR		0x37
+ #define DDC_SEGMENT_ADDR	0x30
+ 
+ #define HDMI_EDID_LEN		512
+@@ -398,6 +399,15 @@ static int dw_hdmi_i2c_xfer(struct i2c_adapter *adap,
+ 	u8 addr = msgs[0].addr;
+ 	int i, ret = 0;
+ 
++	if (addr == DDC_CI_ADDR)
++		/*
++		 * The internal I2C controller does not support the multi-byte
++		 * read and write operations needed for DDC/CI.
++		 * TOFIX: Blacklist the DDC/CI address until we filter out
++		 * unsupported I2C operations.
++		 */
++		return -EOPNOTSUPP;
++
+ 	dev_dbg(hdmi->dev, "xfer: num: %d, addr: %#x\n", num, addr);
+ 
+ 	for (i = 0; i < num; i++) {
+-- 
+2.20.1
+
diff --git a/queue-5.4/drm-bridge-dw-hdmi-restore-audio-when-setting-a-mode.patch b/queue-5.4/drm-bridge-dw-hdmi-restore-audio-when-setting-a-mode.patch
new file mode 100644
index 00000000000..22f2a8e5368
--- /dev/null
+++ b/queue-5.4/drm-bridge-dw-hdmi-restore-audio-when-setting-a-mode.patch
@@ -0,0 +1,47 @@
+From b2fe4ad1ffb0d34ddbe77d05feced5ddadaad19d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2019 18:21:45 +0800
+Subject: drm/bridge: dw-hdmi: Restore audio when setting a mode
+
+From: Daniel Kurtz <djkurtz@chromium.org>
+
+[ Upstream commit fadfee3f9d8f114435a8a3e9f83a227600d89de7 ]
+
+When setting a new display mode, dw_hdmi_setup() calls
+dw_hdmi_enable_video_path(), which disables all hdmi clocks, including
+the audio clock.
+
+We should only (re-)enable the audio clock if audio was already enabled
+when setting the new mode.
+
+Without this patch, on RK3288, there will be HDMI audio on some monitors
+if i2s was played to headphone when the monitor was plugged.
+ACER H277HU and ASUS PB278 are two of the monitors showing this issue.
+
+Signed-off-by: Cheng-Yi Chiang <cychiang@chromium.org>
+Signed-off-by: Daniel Kurtz <djkurtz@chromium.org>
+Signed-off-by: Yakir Yang <ykk@rock-chips.com>
+Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20191008102145.55134-1-cychiang@chromium.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
+index 3e82d604201e..1326f2c734bf 100644
+--- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
++++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
+@@ -2033,7 +2033,7 @@ static int dw_hdmi_setup(struct dw_hdmi *hdmi, struct drm_display_mode *mode)
+ 
+ 		/* HDMI Initialization Step E - Configure audio */
+ 		hdmi_clk_regenerator_update_pixel_clock(hdmi);
+-		hdmi_enable_audio_clk(hdmi, true);
++		hdmi_enable_audio_clk(hdmi, hdmi->audio_enable);
+ 	}
+ 
+ 	/* not for DVI mode */
+-- 
+2.20.1
+
diff --git a/queue-5.4/drm-don-t-free-jobs-in-wait_event_interruptible.patch b/queue-5.4/drm-don-t-free-jobs-in-wait_event_interruptible.patch
new file mode 100644
index 00000000000..03ad368d3ac
--- /dev/null
+++ b/queue-5.4/drm-don-t-free-jobs-in-wait_event_interruptible.patch
@@ -0,0 +1,121 @@
+From ef32eb8f1724f872038edc63a35bf03710a3ba39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Oct 2019 11:51:56 +0100
+Subject: drm: Don't free jobs in wait_event_interruptible()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Steven Price <steven.price@arm.com>
+
+[ Upstream commit 588b9828f0744ca13555c4a35cd0251ac8ad8ad2 ]
+
+drm_sched_cleanup_jobs() attempts to free finished jobs, however because
+it is called as the condition of wait_event_interruptible() it must not
+sleep. Unfortunately some free callbacks (notably for Panfrost) do sleep.
+
+Instead let's rename drm_sched_cleanup_jobs() to
+drm_sched_get_cleanup_job() and simply return a job for processing if
+there is one. The caller can then call the free_job() callback outside
+the wait_event_interruptible() where sleeping is possible before
+re-checking and returning to sleep if necessary.
+
+Tested-by: Christian Gmeiner <christian.gmeiner@gmail.com>
+Fixes: 5918045c4ed4 ("drm/scheduler: rework job destruction")
+Signed-off-by: Steven Price <steven.price@arm.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Link: https://patchwork.freedesktop.org/patch/337652/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/scheduler/sched_main.c | 43 ++++++++++++++------------
+ 1 file changed, 24 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/gpu/drm/scheduler/sched_main.c b/drivers/gpu/drm/scheduler/sched_main.c
+index f39b97ed4ade..2af64459b3d7 100644
+--- a/drivers/gpu/drm/scheduler/sched_main.c
++++ b/drivers/gpu/drm/scheduler/sched_main.c
+@@ -632,43 +632,41 @@ static void drm_sched_process_job(struct dma_fence *f, struct dma_fence_cb *cb)
+ }
+ 
+ /**
+- * drm_sched_cleanup_jobs - destroy finished jobs
++ * drm_sched_get_cleanup_job - fetch the next finished job to be destroyed
+  *
+  * @sched: scheduler instance
+  *
+- * Remove all finished jobs from the mirror list and destroy them.
++ * Returns the next finished job from the mirror list (if there is one)
++ * ready for it to be destroyed.
+  */
+-static void drm_sched_cleanup_jobs(struct drm_gpu_scheduler *sched)
++static struct drm_sched_job *
++drm_sched_get_cleanup_job(struct drm_gpu_scheduler *sched)
+ {
++	struct drm_sched_job *job;
+ 	unsigned long flags;
+ 
+ 	/* Don't destroy jobs while the timeout worker is running */
+ 	if (sched->timeout != MAX_SCHEDULE_TIMEOUT &&
+ 	    !cancel_delayed_work(&sched->work_tdr))
+-		return;
+-
++		return NULL;
+ 
+-	while (!list_empty(&sched->ring_mirror_list)) {
+-		struct drm_sched_job *job;
++	spin_lock_irqsave(&sched->job_list_lock, flags);
+ 
+-		job = list_first_entry(&sched->ring_mirror_list,
++	job = list_first_entry_or_null(&sched->ring_mirror_list,
+ 				       struct drm_sched_job, node);
+-		if (!dma_fence_is_signaled(&job->s_fence->finished))
+-			break;
+ 
+-		spin_lock_irqsave(&sched->job_list_lock, flags);
++	if (job && dma_fence_is_signaled(&job->s_fence->finished)) {
+ 		/* remove job from ring_mirror_list */
+ 		list_del_init(&job->node);
+-		spin_unlock_irqrestore(&sched->job_list_lock, flags);
+-
+-		sched->ops->free_job(job);
++	} else {
++		job = NULL;
++		/* queue timeout for next job */
++		drm_sched_start_timeout(sched);
+ 	}
+ 
+-	/* queue timeout for next job */
+-	spin_lock_irqsave(&sched->job_list_lock, flags);
+-	drm_sched_start_timeout(sched);
+ 	spin_unlock_irqrestore(&sched->job_list_lock, flags);
+ 
++	return job;
+ }
+ 
+ /**
+@@ -708,12 +706,19 @@ static int drm_sched_main(void *param)
+ 		struct drm_sched_fence *s_fence;
+ 		struct drm_sched_job *sched_job;
+ 		struct dma_fence *fence;
++		struct drm_sched_job *cleanup_job = NULL;
+ 
+ 		wait_event_interruptible(sched->wake_up_worker,
+-					 (drm_sched_cleanup_jobs(sched),
++					 (cleanup_job = drm_sched_get_cleanup_job(sched)) ||
+ 					 (!drm_sched_blocked(sched) &&
+ 					  (entity = drm_sched_select_entity(sched))) ||
+-					 kthread_should_stop()));
++					 kthread_should_stop());
++
++		if (cleanup_job) {
++			sched->ops->free_job(cleanup_job);
++			/* queue timeout for next job */
++			drm_sched_start_timeout(sched);
++		}
+ 
+ 		if (!entity)
+ 			continue;
+-- 
+2.20.1
+
diff --git a/queue-5.4/drm-drm_vblank-change-einval-by-the-correct-errno.patch b/queue-5.4/drm-drm_vblank-change-einval-by-the-correct-errno.patch
new file mode 100644
index 00000000000..f78767bfcaa
--- /dev/null
+++ b/queue-5.4/drm-drm_vblank-change-einval-by-the-correct-errno.patch
@@ -0,0 +1,115 @@
+From 27f9865aff91a19dffa3fc3e8f2c27b0f02fa940 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Oct 2019 11:05:16 -0300
+Subject: drm/drm_vblank: Change EINVAL by the correct errno
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rodrigo Siqueira <rodrigosiqueiramelo@gmail.com>
+
+[ Upstream commit aed6105b28b10613f16c0bfe97525fe5a23338df ]
+
+For historical reasons, the function drm_wait_vblank_ioctl always return
+-EINVAL if something gets wrong. This scenario limits the flexibility
+for the userspace to make detailed verification of any problem and take
+some action. In particular, the validation of “if (!dev->irq_enabled)”
+in the drm_wait_vblank_ioctl is responsible for checking if the driver
+support vblank or not. If the driver does not support VBlank, the
+function drm_wait_vblank_ioctl returns EINVAL, which does not represent
+the real issue; this patch changes this behavior by return EOPNOTSUPP.
+Additionally, drm_crtc_get_sequence_ioctl and
+drm_crtc_queue_sequence_ioctl, also returns EINVAL if vblank is not
+supported; this patch also changes the return value to EOPNOTSUPP in
+these functions. Lastly, these functions are invoked by libdrm, which is
+used by many compositors; because of this, it is important to check if
+this change breaks any compositor. In this sense, the following projects
+were examined:
+
+* Drm-hwcomposer
+* Kwin
+* Sway
+* Wlroots
+* Wayland
+* Weston
+* Mutter
+* Xorg (67 different drivers)
+
+For each repository the verification happened in three steps:
+
+* Update the main branch
+* Look for any occurrence of "drmCrtcQueueSequence",
+  "drmCrtcGetSequence", and "drmWaitVBlank" with the command git grep -n
+  "STRING".
+* Look in the git history of the project with the command
+git log -S<STRING>
+
+None of the above projects validate the use of EINVAL when using
+drmWaitVBlank(), which make safe, at least for these projects, to change
+the return values. On the other hand, mesa and xserver project uses
+drmCrtcQueueSequence() and drmCrtcGetSequence(); this change is harmless
+for both projects.
+
+Change since V5 (Pekka Paalanen):
+ - Check if the change also affects Mutter
+
+Change since V4 (Daniel):
+ - Also return EOPNOTSUPP in drm_crtc_[get|queue]_sequence_ioctl
+
+Change since V3:
+ - Return EINVAL for _DRM_VBLANK_SIGNAL (Daniel)
+
+Change since V2:
+ Daniel Vetter and Chris Wilson
+ - Replace ENOTTY by EOPNOTSUPP
+ - Return EINVAL if the parameters are wrong
+
+Cc: Keith Packard <keithp@keithp.com>
+Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Cc: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Daniel Vetter <daniel@ffwll.ch>
+Cc: Pekka Paalanen <pekka.paalanen@collabora.com>
+Signed-off-by: Rodrigo Siqueira <rodrigosiqueiramelo@gmail.com>
+Reviewed-by: Daniel Vetter <daniel@ffwll.ch>
+Acked-by: Pekka Paalanen <pekka.paalanen@collabora.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20191002140516.adeyj3htylimmlmg@smtp.gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_vblank.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_vblank.c b/drivers/gpu/drm/drm_vblank.c
+index fd1fbc77871f..552ec82e9bc5 100644
+--- a/drivers/gpu/drm/drm_vblank.c
++++ b/drivers/gpu/drm/drm_vblank.c
+@@ -1581,7 +1581,7 @@ int drm_wait_vblank_ioctl(struct drm_device *dev, void *data,
+ 	unsigned int flags, pipe, high_pipe;
+ 
+ 	if (!dev->irq_enabled)
+-		return -EINVAL;
++		return -EOPNOTSUPP;
+ 
+ 	if (vblwait->request.type & _DRM_VBLANK_SIGNAL)
+ 		return -EINVAL;
+@@ -1838,7 +1838,7 @@ int drm_crtc_get_sequence_ioctl(struct drm_device *dev, void *data,
+ 		return -EOPNOTSUPP;
+ 
+ 	if (!dev->irq_enabled)
+-		return -EINVAL;
++		return -EOPNOTSUPP;
+ 
+ 	crtc = drm_crtc_find(dev, file_priv, get_seq->crtc_id);
+ 	if (!crtc)
+@@ -1896,7 +1896,7 @@ int drm_crtc_queue_sequence_ioctl(struct drm_device *dev, void *data,
+ 		return -EOPNOTSUPP;
+ 
+ 	if (!dev->irq_enabled)
+-		return -EINVAL;
++		return -EOPNOTSUPP;
+ 
+ 	crtc = drm_crtc_find(dev, file_priv, queue_seq->crtc_id);
+ 	if (!crtc)
+-- 
+2.20.1
+
diff --git a/queue-5.4/drm-exynos-exynos_hdmi-use-cec_notifier_conn_-un-reg.patch b/queue-5.4/drm-exynos-exynos_hdmi-use-cec_notifier_conn_-un-reg.patch
new file mode 100644
index 00000000000..cc8c9412b24
--- /dev/null
+++ b/queue-5.4/drm-exynos-exynos_hdmi-use-cec_notifier_conn_-un-reg.patch
@@ -0,0 +1,129 @@
+From 48598466c0abf91aa26da85e44ca969d0591fd41 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Aug 2019 14:34:15 +0200
+Subject: drm: exynos: exynos_hdmi: use cec_notifier_conn_(un)register
+
+From: Dariusz Marcinkiewicz <darekm@google.com>
+
+[ Upstream commit 71137bfd98973efb7b762ba168df077b87b34311 ]
+
+Use the new cec_notifier_conn_(un)register() functions to
+(un)register the notifier for the HDMI connector, and fill in
+the cec_connector_info.
+
+Changes since v7:
+	- err_runtime_disable -> err_rpm_disable
+Changes since v2:
+	- removed unnecessary call to invalidate phys address before
+	deregistering the notifier,
+	- use cec_notifier_phys_addr_invalidate instead of setting
+	invalid address on a notifier.
+
+Signed-off-by: Dariusz Marcinkiewicz <darekm@google.com>
+Tested-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+[hverkuil-cisco@xs4all.nl: use 'if (!hdata->notifier)' instead of '== NULL']
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190828123415.139441-1-darekm@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/exynos/exynos_hdmi.c | 31 ++++++++++++++++------------
+ 1 file changed, 18 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/gpu/drm/exynos/exynos_hdmi.c b/drivers/gpu/drm/exynos/exynos_hdmi.c
+index bc1565f1822a..09aa73c0f2ad 100644
+--- a/drivers/gpu/drm/exynos/exynos_hdmi.c
++++ b/drivers/gpu/drm/exynos/exynos_hdmi.c
+@@ -852,6 +852,10 @@ static enum drm_connector_status hdmi_detect(struct drm_connector *connector,
+ 
+ static void hdmi_connector_destroy(struct drm_connector *connector)
+ {
++	struct hdmi_context *hdata = connector_to_hdmi(connector);
++
++	cec_notifier_conn_unregister(hdata->notifier);
++
+ 	drm_connector_unregister(connector);
+ 	drm_connector_cleanup(connector);
+ }
+@@ -935,6 +939,7 @@ static int hdmi_create_connector(struct drm_encoder *encoder)
+ {
+ 	struct hdmi_context *hdata = encoder_to_hdmi(encoder);
+ 	struct drm_connector *connector = &hdata->connector;
++	struct cec_connector_info conn_info;
+ 	int ret;
+ 
+ 	connector->interlace_allowed = true;
+@@ -957,6 +962,15 @@ static int hdmi_create_connector(struct drm_encoder *encoder)
+ 			DRM_DEV_ERROR(hdata->dev, "Failed to attach bridge\n");
+ 	}
+ 
++	cec_fill_conn_info_from_drm(&conn_info, connector);
++
++	hdata->notifier = cec_notifier_conn_register(hdata->dev, NULL,
++						     &conn_info);
++	if (!hdata->notifier) {
++		ret = -ENOMEM;
++		DRM_DEV_ERROR(hdata->dev, "Failed to allocate CEC notifier\n");
++	}
++
+ 	return ret;
+ }
+ 
+@@ -1528,8 +1542,8 @@ static void hdmi_disable(struct drm_encoder *encoder)
+ 		 */
+ 		mutex_unlock(&hdata->mutex);
+ 		cancel_delayed_work(&hdata->hotplug_work);
+-		cec_notifier_set_phys_addr(hdata->notifier,
+-					   CEC_PHYS_ADDR_INVALID);
++		if (hdata->notifier)
++			cec_notifier_phys_addr_invalidate(hdata->notifier);
+ 		return;
+ 	}
+ 
+@@ -2006,12 +2020,6 @@ static int hdmi_probe(struct platform_device *pdev)
+ 		}
+ 	}
+ 
+-	hdata->notifier = cec_notifier_get(&pdev->dev);
+-	if (hdata->notifier == NULL) {
+-		ret = -ENOMEM;
+-		goto err_hdmiphy;
+-	}
+-
+ 	pm_runtime_enable(dev);
+ 
+ 	audio_infoframe = &hdata->audio.infoframe;
+@@ -2023,7 +2031,7 @@ static int hdmi_probe(struct platform_device *pdev)
+ 
+ 	ret = hdmi_register_audio_device(hdata);
+ 	if (ret)
+-		goto err_notifier_put;
++		goto err_rpm_disable;
+ 
+ 	ret = component_add(&pdev->dev, &hdmi_component_ops);
+ 	if (ret)
+@@ -2034,8 +2042,7 @@ static int hdmi_probe(struct platform_device *pdev)
+ err_unregister_audio:
+ 	platform_device_unregister(hdata->audio.pdev);
+ 
+-err_notifier_put:
+-	cec_notifier_put(hdata->notifier);
++err_rpm_disable:
+ 	pm_runtime_disable(dev);
+ 
+ err_hdmiphy:
+@@ -2054,12 +2061,10 @@ static int hdmi_remove(struct platform_device *pdev)
+ 	struct hdmi_context *hdata = platform_get_drvdata(pdev);
+ 
+ 	cancel_delayed_work_sync(&hdata->hotplug_work);
+-	cec_notifier_set_phys_addr(hdata->notifier, CEC_PHYS_ADDR_INVALID);
+ 
+ 	component_del(&pdev->dev, &hdmi_component_ops);
+ 	platform_device_unregister(hdata->audio.pdev);
+ 
+-	cec_notifier_put(hdata->notifier);
+ 	pm_runtime_disable(&pdev->dev);
+ 
+ 	if (!IS_ERR(hdata->reg_hdmi_en))
+-- 
+2.20.1
+
diff --git a/queue-5.4/drm-gma500-fix-memory-disclosures-due-to-uninitializ.patch b/queue-5.4/drm-gma500-fix-memory-disclosures-due-to-uninitializ.patch
new file mode 100644
index 00000000000..320dada8404
--- /dev/null
+++ b/queue-5.4/drm-gma500-fix-memory-disclosures-due-to-uninitializ.patch
@@ -0,0 +1,44 @@
+From a292a8b6bb8d21f17ed1326e9b63869b283aa96f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Oct 2019 23:41:50 -0500
+Subject: drm/gma500: fix memory disclosures due to uninitialized bytes
+
+From: Kangjie Lu <kjlu@umn.edu>
+
+[ Upstream commit ec3b7b6eb8c90b52f61adff11b6db7a8db34de19 ]
+
+"clock" may be copied to "best_clock". Initializing best_clock
+is not sufficient. The fix initializes clock as well to avoid
+memory disclosures and informaiton leaks.
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/20191018044150.1899-1-kjlu@umn.edu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/gma500/oaktrail_crtc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/gma500/oaktrail_crtc.c b/drivers/gpu/drm/gma500/oaktrail_crtc.c
+index 167c10767dd4..900e5499249d 100644
+--- a/drivers/gpu/drm/gma500/oaktrail_crtc.c
++++ b/drivers/gpu/drm/gma500/oaktrail_crtc.c
+@@ -129,6 +129,7 @@ static bool mrst_sdvo_find_best_pll(const struct gma_limit_t *limit,
+ 	s32 freq_error, min_error = 100000;
+ 
+ 	memset(best_clock, 0, sizeof(*best_clock));
++	memset(&clock, 0, sizeof(clock));
+ 
+ 	for (clock.m = limit->m.min; clock.m <= limit->m.max; clock.m++) {
+ 		for (clock.n = limit->n.min; clock.n <= limit->n.max;
+@@ -185,6 +186,7 @@ static bool mrst_lvds_find_best_pll(const struct gma_limit_t *limit,
+ 	int err = target;
+ 
+ 	memset(best_clock, 0, sizeof(*best_clock));
++	memset(&clock, 0, sizeof(clock));
+ 
+ 	for (clock.m = limit->m.min; clock.m <= limit->m.max; clock.m++) {
+ 		for (clock.p1 = limit->p1.min; clock.p1 <= limit->p1.max;
+-- 
+2.20.1
+
diff --git a/queue-5.4/drm-komeda-workaround-for-broken-flip_complete-times.patch b/queue-5.4/drm-komeda-workaround-for-broken-flip_complete-times.patch
new file mode 100644
index 00000000000..f0a4ff9344d
--- /dev/null
+++ b/queue-5.4/drm-komeda-workaround-for-broken-flip_complete-times.patch
@@ -0,0 +1,63 @@
+From 9faa2dd7a22b274ee24a6f87a85a6cda18f1220b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Oct 2019 14:21:40 +0000
+Subject: drm/komeda: Workaround for broken FLIP_COMPLETE timestamps
+
+From: Mihail Atanassov <Mihail.Atanassov@arm.com>
+
+[ Upstream commit f59769c52cd7d158df53487ec2936f5592073340 ]
+
+When initially turning a crtc on, drm_reset_vblank_timestamp will
+set the vblank timestamp to 0 for any driver that doesn't provide
+a ->get_vblank_timestamp() hook.
+
+Unfortunately, the FLIP_COMPLETE event depends on that timestamp,
+and the only way to regenerate a valid one is to have vblank
+interrupts enabled and have a valid in-ISR call to
+drm_crtc_handle_vblank.
+
+Additionally, if the user doesn't request vblanks but _does_ request
+FLIP_COMPLETE events, we still don't have a good timestamp: it'll be the
+same stamp as the last vblank one.
+
+Work around the issue by always enabling vblanks when the CRTC is on.
+Reducing the amount of time that PL0 has to be unmasked would be nice to
+fix at a later time.
+
+Changes since v1 [https://patchwork.freedesktop.org/patch/331727/]:
+ - moved drm_crtc_vblank_put call to the ->atomic_disable() hook
+
+Cc: Daniel Vetter <daniel@ffwll.ch>
+Cc: Liviu Dudau <Liviu.Dudau@arm.com>
+Signed-off-by: Mihail Atanassov <mihail.atanassov@arm.com>
+Reviewed-by: James Qian Wang (Arm Technology China) <james.qian.wang@arm.com>
+Signed-off-by: Ayan kumar halder <ayan.halder@arm.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20191001142121.13939-1-mihail.atanassov@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/arm/display/komeda/komeda_crtc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/arm/display/komeda/komeda_crtc.c b/drivers/gpu/drm/arm/display/komeda/komeda_crtc.c
+index 624d257da20f..52c42569a111 100644
+--- a/drivers/gpu/drm/arm/display/komeda/komeda_crtc.c
++++ b/drivers/gpu/drm/arm/display/komeda/komeda_crtc.c
+@@ -250,6 +250,7 @@ komeda_crtc_atomic_enable(struct drm_crtc *crtc,
+ {
+ 	komeda_crtc_prepare(to_kcrtc(crtc));
+ 	drm_crtc_vblank_on(crtc);
++	WARN_ON(drm_crtc_vblank_get(crtc));
+ 	komeda_crtc_do_flush(crtc, old);
+ }
+ 
+@@ -319,6 +320,7 @@ komeda_crtc_atomic_disable(struct drm_crtc *crtc,
+ 		}
+ 	}
+ 
++	drm_crtc_vblank_put(crtc);
+ 	drm_crtc_vblank_off(crtc);
+ 	komeda_crtc_unprepare(kcrtc);
+ }
+-- 
+2.20.1
+
diff --git a/queue-5.4/drm-meson-vclk-use-the-correct-g12a-frac-max-value.patch b/queue-5.4/drm-meson-vclk-use-the-correct-g12a-frac-max-value.patch
new file mode 100644
index 00000000000..1e783621539
--- /dev/null
+++ b/queue-5.4/drm-meson-vclk-use-the-correct-g12a-frac-max-value.patch
@@ -0,0 +1,51 @@
+From 6541c98260e2ae4b6d50ce367fa11b9447497946 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Aug 2019 15:23:11 +0200
+Subject: drm/meson: vclk: use the correct G12A frac max value
+
+From: Neil Armstrong <narmstrong@baylibre.com>
+
+[ Upstream commit d56276a13c2b9ea287b9fc7cc78bed4c43b286f9 ]
+
+When calculating the HDMI PLL settings for a DMT mode PHY frequency,
+use the correct max fractional PLL value for G12A VPU.
+
+With this fix, we can finally setup the 1024x768-60 mode.
+
+Fixes: 202b9808f8ed ("drm/meson: Add G12A Video Clock setup")
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Reviewed-by: Kevin Hilman <khilman@baylibre.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190828132311.23881-1-narmstrong@baylibre.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/meson/meson_vclk.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/meson/meson_vclk.c b/drivers/gpu/drm/meson/meson_vclk.c
+index ac491a781952..f690793ae2d5 100644
+--- a/drivers/gpu/drm/meson/meson_vclk.c
++++ b/drivers/gpu/drm/meson/meson_vclk.c
+@@ -638,13 +638,18 @@ static bool meson_hdmi_pll_validate_params(struct meson_drm *priv,
+ 		if (frac >= HDMI_FRAC_MAX_GXBB)
+ 			return false;
+ 	} else if (meson_vpu_is_compatible(priv, VPU_COMPATIBLE_GXM) ||
+-		   meson_vpu_is_compatible(priv, VPU_COMPATIBLE_GXL) ||
+-		   meson_vpu_is_compatible(priv, VPU_COMPATIBLE_G12A)) {
++		   meson_vpu_is_compatible(priv, VPU_COMPATIBLE_GXL)) {
+ 		/* Empiric supported min/max dividers */
+ 		if (m < 106 || m > 247)
+ 			return false;
+ 		if (frac >= HDMI_FRAC_MAX_GXL)
+ 			return false;
++	} else if (meson_vpu_is_compatible(priv, VPU_COMPATIBLE_G12A)) {
++		/* Empiric supported min/max dividers */
++		if (m < 106 || m > 247)
++			return false;
++		if (frac >= HDMI_FRAC_MAX_G12A)
++			return false;
+ 	}
+ 
+ 	return true;
+-- 
+2.20.1
+
diff --git a/queue-5.4/drm-mipi-dbi-fix-a-loop-in-debugfs-code.patch b/queue-5.4/drm-mipi-dbi-fix-a-loop-in-debugfs-code.patch
new file mode 100644
index 00000000000..65dc1ed9cca
--- /dev/null
+++ b/queue-5.4/drm-mipi-dbi-fix-a-loop-in-debugfs-code.patch
@@ -0,0 +1,56 @@
+From e6e158fed94c485fe6a166c9d3f23b192460d6dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Aug 2019 10:24:56 +0300
+Subject: drm/mipi-dbi: fix a loop in debugfs code
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit d72cf01f410aa09868d98b672f3f92328c96b32d ]
+
+This code will likely crash if we try to do a zero byte write.  The code
+looks like this:
+
+        /* strip trailing whitespace */
+        for (i = count - 1; i > 0; i--)
+                if (isspace(buf[i]))
+			...
+
+We're writing zero bytes so count = 0.  You would think that "count - 1"
+would be negative one, but because "i" is unsigned it is a large
+positive numer instead.  The "i > 0" condition is true and the "buf[i]"
+access will be out of bounds.
+
+The fix is to make "i" signed and now everything works as expected.  The
+upper bound of "count" is capped in __kernel_write() at MAX_RW_COUNT so
+we don't have to worry about it being higher than INT_MAX.
+
+Fixes: 02dd95fe3169 ("drm/tinydrm: Add MIPI DBI support")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+[noralf: Adjust title]
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190821072456.GJ26957@mwanda
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_mipi_dbi.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_mipi_dbi.c b/drivers/gpu/drm/drm_mipi_dbi.c
+index 1961f713aaab..c4ee2709a6f3 100644
+--- a/drivers/gpu/drm/drm_mipi_dbi.c
++++ b/drivers/gpu/drm/drm_mipi_dbi.c
+@@ -1187,8 +1187,7 @@ static ssize_t mipi_dbi_debugfs_command_write(struct file *file,
+ 	struct mipi_dbi_dev *dbidev = m->private;
+ 	u8 val, cmd = 0, parameters[64];
+ 	char *buf, *pos, *token;
+-	unsigned int i;
+-	int ret, idx;
++	int i, ret, idx;
+ 
+ 	if (!drm_dev_enter(&dbidev->drm, &idx))
+ 		return -ENODEV;
+-- 
+2.20.1
+
diff --git a/queue-5.4/drm-msm-a6xx-fix-debug-bus-register-configuration.patch b/queue-5.4/drm-msm-a6xx-fix-debug-bus-register-configuration.patch
new file mode 100644
index 00000000000..927772a6481
--- /dev/null
+++ b/queue-5.4/drm-msm-a6xx-fix-debug-bus-register-configuration.patch
@@ -0,0 +1,69 @@
+From bf81a9e1dc07ad3ceecbabc1f3fd86e8c84a070b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Nov 2019 17:19:23 +0530
+Subject: drm: msm: a6xx: fix debug bus register configuration
+
+From: Sharat Masetty <smasetty@codeaurora.org>
+
+[ Upstream commit 7f4009c4bbea4438b50f3b12d1c57da3f5cd8db3 ]
+
+Fix the cx debugbus related register configuration, to collect accurate
+bus data during gpu snapshot. This helps with complete snapshot dump
+and also complete proper GPU recovery.
+
+Fixes: 1707add81551 ("drm/msm/a6xx: Add a6xx gpu state")
+Reviewed-by: Rob Clark <robdclark@gmail.com>
+Signed-off-by: Sharat Masetty <smasetty@codeaurora.org>
+Signed-off-by: Sean Paul <seanpaul@chromium.org>
+Link: https://patchwork.freedesktop.org/patch/339165
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c | 24 ++++++++++-----------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c
+index e686331fa089..691c1a277d91 100644
+--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c
++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c
+@@ -352,26 +352,26 @@ static void a6xx_get_debugbus(struct msm_gpu *gpu,
+ 		cxdbg = ioremap(res->start, resource_size(res));
+ 
+ 	if (cxdbg) {
+-		cxdbg_write(cxdbg, REG_A6XX_DBGC_CFG_DBGBUS_CNTLT,
++		cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_CNTLT,
+ 			A6XX_DBGC_CFG_DBGBUS_CNTLT_SEGT(0xf));
+ 
+-		cxdbg_write(cxdbg, REG_A6XX_DBGC_CFG_DBGBUS_CNTLM,
++		cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_CNTLM,
+ 			A6XX_DBGC_CFG_DBGBUS_CNTLM_ENABLE(0xf));
+ 
+-		cxdbg_write(cxdbg, REG_A6XX_DBGC_CFG_DBGBUS_IVTL_0, 0);
+-		cxdbg_write(cxdbg, REG_A6XX_DBGC_CFG_DBGBUS_IVTL_1, 0);
+-		cxdbg_write(cxdbg, REG_A6XX_DBGC_CFG_DBGBUS_IVTL_2, 0);
+-		cxdbg_write(cxdbg, REG_A6XX_DBGC_CFG_DBGBUS_IVTL_3, 0);
++		cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_IVTL_0, 0);
++		cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_IVTL_1, 0);
++		cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_IVTL_2, 0);
++		cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_IVTL_3, 0);
+ 
+-		cxdbg_write(cxdbg, REG_A6XX_DBGC_CFG_DBGBUS_BYTEL_0,
++		cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_BYTEL_0,
+ 			0x76543210);
+-		cxdbg_write(cxdbg, REG_A6XX_DBGC_CFG_DBGBUS_BYTEL_1,
++		cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_BYTEL_1,
+ 			0xFEDCBA98);
+ 
+-		cxdbg_write(cxdbg, REG_A6XX_DBGC_CFG_DBGBUS_MASKL_0, 0);
+-		cxdbg_write(cxdbg, REG_A6XX_DBGC_CFG_DBGBUS_MASKL_1, 0);
+-		cxdbg_write(cxdbg, REG_A6XX_DBGC_CFG_DBGBUS_MASKL_2, 0);
+-		cxdbg_write(cxdbg, REG_A6XX_DBGC_CFG_DBGBUS_MASKL_3, 0);
++		cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_MASKL_0, 0);
++		cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_MASKL_1, 0);
++		cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_MASKL_2, 0);
++		cxdbg_write(cxdbg, REG_A6XX_CX_DBGC_CFG_DBGBUS_MASKL_3, 0);
+ 	}
+ 
+ 	a6xx_state->debugbus = state_kcalloc(a6xx_state,
+-- 
+2.20.1
+
diff --git a/queue-5.4/drm-mst-fix-query_payload-ack-reply-struct.patch b/queue-5.4/drm-mst-fix-query_payload-ack-reply-struct.patch
new file mode 100644
index 00000000000..ecdb2819f45
--- /dev/null
+++ b/queue-5.4/drm-mst-fix-query_payload-ack-reply-struct.patch
@@ -0,0 +1,47 @@
+From d09d1da9474120640553ae6028a2cf46403ad180 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Aug 2019 12:52:19 -0400
+Subject: drm: mst: Fix query_payload ack reply struct
+
+From: Sean Paul <seanpaul@chromium.org>
+
+[ Upstream commit 268de6530aa18fe5773062367fd119f0045f6e88 ]
+
+Spec says[1] Allocated_PBN is 16 bits
+
+[1]- DisplayPort 1.2 Spec, Section 2.11.9.8, Table 2-98
+
+Fixes: ad7f8a1f9ced ("drm/helper: add Displayport multi-stream helper (v0.6)")
+Cc: Lyude Paul <lyude@redhat.com>
+Cc: Todd Previte <tprevite@gmail.com>
+Cc: Dave Airlie <airlied@redhat.com>
+Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Cc: Maxime Ripard <maxime.ripard@bootlin.com>
+Cc: Sean Paul <sean@poorly.run>
+Cc: David Airlie <airlied@linux.ie>
+Cc: Daniel Vetter <daniel@ffwll.ch>
+Cc: dri-devel@lists.freedesktop.org
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+Signed-off-by: Sean Paul <seanpaul@chromium.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190829165223.129662-1-sean@poorly.run
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/drm/drm_dp_mst_helper.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/drm/drm_dp_mst_helper.h b/include/drm/drm_dp_mst_helper.h
+index 2ba6253ea6d3..fc349204a71b 100644
+--- a/include/drm/drm_dp_mst_helper.h
++++ b/include/drm/drm_dp_mst_helper.h
+@@ -334,7 +334,7 @@ struct drm_dp_resource_status_notify {
+ 
+ struct drm_dp_query_payload_ack_reply {
+ 	u8 port_number;
+-	u8 allocated_pbn;
++	u16 allocated_pbn;
+ };
+ 
+ struct drm_dp_sideband_msg_req_body {
+-- 
+2.20.1
+
diff --git a/queue-5.4/drm-nouveau-don-t-grab-runtime-pm-refs-for-hpd-irqs.patch b/queue-5.4/drm-nouveau-don-t-grab-runtime-pm-refs-for-hpd-irqs.patch
new file mode 100644
index 00000000000..6e4f60887aa
--- /dev/null
+++ b/queue-5.4/drm-nouveau-don-t-grab-runtime-pm-refs-for-hpd-irqs.patch
@@ -0,0 +1,96 @@
+From c68b32895ab8c0ad1b9ea93d745427364222a342 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Jul 2019 18:35:37 -0400
+Subject: drm/nouveau: Don't grab runtime PM refs for HPD IRQs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Lyude Paul <lyude@redhat.com>
+
+[ Upstream commit 09e530657e1c982d3dbc5e4302bf9207950c3d0a ]
+
+In order for suspend/resume reprobing to work, we need to be able to
+perform sideband communications during suspend/resume, along with
+runtime PM suspend/resume. In order to do so, we also need to make sure
+that nouveau doesn't bother grabbing a runtime PM reference to do so,
+since otherwise we'll start deadlocking runtime PM again.
+
+Note that we weren't able to do this before, because of the DP MST
+helpers processing UP requests from topologies in the same context as
+drm_dp_mst_hpd_irq() which would have caused us to open ourselves up to
+receiving hotplug events and deadlocking with runtime suspend/resume.
+Now that those requests are handled asynchronously, this change should
+be completely safe.
+
+Cc: Juston Li <juston.li@intel.com>
+Cc: Imre Deak <imre.deak@intel.com>
+Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Cc: Harry Wentland <hwentlan@amd.com>
+Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
+Reviewed-by: Ben Skeggs <bskeggs@redhat.com>
+Reviewed-by: Sean Paul <sean@poorly.run>
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20191022023641.8026-10-lyude@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nouveau_connector.c | 33 +++++++++++----------
+ 1 file changed, 17 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c
+index 94dfa2e5a9ab..a442a955f98c 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_connector.c
++++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
+@@ -1131,6 +1131,16 @@ nouveau_connector_hotplug(struct nvif_notify *notify)
+ 	const char *name = connector->name;
+ 	struct nouveau_encoder *nv_encoder;
+ 	int ret;
++	bool plugged = (rep->mask != NVIF_NOTIFY_CONN_V0_UNPLUG);
++
++	if (rep->mask & NVIF_NOTIFY_CONN_V0_IRQ) {
++		NV_DEBUG(drm, "service %s\n", name);
++		drm_dp_cec_irq(&nv_connector->aux);
++		if ((nv_encoder = find_encoder(connector, DCB_OUTPUT_DP)))
++			nv50_mstm_service(nv_encoder->dp.mstm);
++
++		return NVIF_NOTIFY_KEEP;
++	}
+ 
+ 	ret = pm_runtime_get(drm->dev->dev);
+ 	if (ret == 0) {
+@@ -1151,25 +1161,16 @@ nouveau_connector_hotplug(struct nvif_notify *notify)
+ 		return NVIF_NOTIFY_DROP;
+ 	}
+ 
+-	if (rep->mask & NVIF_NOTIFY_CONN_V0_IRQ) {
+-		NV_DEBUG(drm, "service %s\n", name);
+-		drm_dp_cec_irq(&nv_connector->aux);
+-		if ((nv_encoder = find_encoder(connector, DCB_OUTPUT_DP)))
+-			nv50_mstm_service(nv_encoder->dp.mstm);
+-	} else {
+-		bool plugged = (rep->mask != NVIF_NOTIFY_CONN_V0_UNPLUG);
+-
++	if (!plugged)
++		drm_dp_cec_unset_edid(&nv_connector->aux);
++	NV_DEBUG(drm, "%splugged %s\n", plugged ? "" : "un", name);
++	if ((nv_encoder = find_encoder(connector, DCB_OUTPUT_DP))) {
+ 		if (!plugged)
+-			drm_dp_cec_unset_edid(&nv_connector->aux);
+-		NV_DEBUG(drm, "%splugged %s\n", plugged ? "" : "un", name);
+-		if ((nv_encoder = find_encoder(connector, DCB_OUTPUT_DP))) {
+-			if (!plugged)
+-				nv50_mstm_remove(nv_encoder->dp.mstm);
+-		}
+-
+-		drm_helper_hpd_irq_event(connector->dev);
++			nv50_mstm_remove(nv_encoder->dp.mstm);
+ 	}
+ 
++	drm_helper_hpd_irq_event(connector->dev);
++
+ 	pm_runtime_mark_last_busy(drm->dev->dev);
+ 	pm_runtime_put_autosuspend(drm->dev->dev);
+ 	return NVIF_NOTIFY_KEEP;
+-- 
+2.20.1
+
diff --git a/queue-5.4/drm-panel-add-missing-drm_panel_init-in-panel-driver.patch b/queue-5.4/drm-panel-add-missing-drm_panel_init-in-panel-driver.patch
new file mode 100644
index 00000000000..2288a1f130a
--- /dev/null
+++ b/queue-5.4/drm-panel-add-missing-drm_panel_init-in-panel-driver.patch
@@ -0,0 +1,49 @@
+From dad68d4d58ddc40d1da28291927aaf4ae29cec9c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Aug 2019 22:32:42 +0300
+Subject: drm/panel: Add missing drm_panel_init() in panel drivers
+
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+
+[ Upstream commit 65abbda8ed7ca48c8807d6b04a77431b438fa659 ]
+
+Panels must be initialised with drm_panel_init(). Add the missing
+function call in the panel-raspberrypi-touchscreen.c and
+panel-sitronix-st7789v.c drivers.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190823193245.23876-2-laurent.pinchart@ideasonboard.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c | 1 +
+ drivers/gpu/drm/panel/panel-sitronix-st7789v.c        | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c b/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c
+index b5b14aa059ea..2aa89eaecf6f 100644
+--- a/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c
++++ b/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c
+@@ -426,6 +426,7 @@ static int rpi_touchscreen_probe(struct i2c_client *i2c,
+ 		return PTR_ERR(ts->dsi);
+ 	}
+ 
++	drm_panel_init(&ts->base);
+ 	ts->base.dev = dev;
+ 	ts->base.funcs = &rpi_touchscreen_funcs;
+ 
+diff --git a/drivers/gpu/drm/panel/panel-sitronix-st7789v.c b/drivers/gpu/drm/panel/panel-sitronix-st7789v.c
+index 5e3e92ea9ea6..3b2612ae931e 100644
+--- a/drivers/gpu/drm/panel/panel-sitronix-st7789v.c
++++ b/drivers/gpu/drm/panel/panel-sitronix-st7789v.c
+@@ -381,6 +381,7 @@ static int st7789v_probe(struct spi_device *spi)
+ 	spi_set_drvdata(spi, ctx);
+ 	ctx->spi = spi;
+ 
++	drm_panel_init(&ctx->panel);
+ 	ctx->panel.dev = &spi->dev;
+ 	ctx->panel.funcs = &st7789v_drm_funcs;
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/drm-sun4i-dsi-fix-tcon-drq-set-bits.patch b/queue-5.4/drm-sun4i-dsi-fix-tcon-drq-set-bits.patch
new file mode 100644
index 00000000000..3f6dbdd2fcf
--- /dev/null
+++ b/queue-5.4/drm-sun4i-dsi-fix-tcon-drq-set-bits.patch
@@ -0,0 +1,121 @@
+From 8fd37fc39412ea98a18bd790c5b73cb9ee5e02c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Oct 2019 12:15:21 +0530
+Subject: drm/sun4i: dsi: Fix TCON DRQ set bits
+
+From: Jagan Teki <jagan@amarulasolutions.com>
+
+[ Upstream commit 7ac6269968826f9cad61b501bb613cc5cadb7229 ]
+
+The LCD timing definitions between Linux DRM vs Allwinner are different,
+below diagram shows this clear differences.
+
+           Active                 Front           Sync           Back
+           Region                 Porch                          Porch
+<-----------------------><----------------><--------------><-------------->
+  //////////////////////|
+ ////////////////////// |
+//////////////////////  |..................                ................
+                                           ________________
+<----- [hv]display ----->
+<------------- [hv]sync_start ------------>
+<--------------------- [hv]sync_end ---------------------->
+<-------------------------------- [hv]total ------------------------------>
+
+<----- lcd_[xy] -------->		  <- lcd_[hv]spw ->
+					  <---------- lcd_[hv]bp --------->
+<-------------------------------- lcd_[hv]t ------------------------------>
+
+The DSI driver misinterpreted the hbp term from the BSP code to refer
+only to the backporch, when in fact it was backporch + sync. Thus the
+driver incorrectly used the horizontal front porch plus sync in its
+calculation of the DRQ set bit value, when it should not have included
+the sync timing.
+
+Including additional sync timings leads to flip_done timed out as:
+
+WARNING: CPU: 0 PID: 31 at drivers/gpu/drm/drm_atomic_helper.c:1429 drm_atomic_helper_wait_for_vblanks.part.1+0x298/0x2a0
+[CRTC:46:crtc-0] vblank wait timed out
+Modules linked in:
+CPU: 0 PID: 31 Comm: kworker/0:1 Not tainted 5.1.0-next-20190514-00026-g01f0c75b902d-dirty #13
+Hardware name: Allwinner sun8i Family
+Workqueue: events deferred_probe_work_func
+[<c010ed54>] (unwind_backtrace) from [<c010b76c>] (show_stack+0x10/0x14)
+[<c010b76c>] (show_stack) from [<c0688c70>] (dump_stack+0x84/0x98)
+[<c0688c70>] (dump_stack) from [<c011d9e4>] (__warn+0xfc/0x114)
+[<c011d9e4>] (__warn) from [<c011da40>] (warn_slowpath_fmt+0x44/0x68)
+[<c011da40>] (warn_slowpath_fmt) from [<c040cd50>] (drm_atomic_helper_wait_for_vblanks.part.1+0x298/0x2a0)
+[<c040cd50>] (drm_atomic_helper_wait_for_vblanks.part.1) from [<c040e694>] (drm_atomic_helper_commit_tail_rpm+0x5c/0x6c)
+[<c040e694>] (drm_atomic_helper_commit_tail_rpm) from [<c040e4dc>] (commit_tail+0x40/0x6c)
+[<c040e4dc>] (commit_tail) from [<c040e5cc>] (drm_atomic_helper_commit+0xbc/0x128)
+[<c040e5cc>] (drm_atomic_helper_commit) from [<c0411b64>] (restore_fbdev_mode_atomic+0x1cc/0x1dc)
+[<c0411b64>] (restore_fbdev_mode_atomic) from [<c04156f8>] (drm_fb_helper_restore_fbdev_mode_unlocked+0x54/0xa0)
+[<c04156f8>] (drm_fb_helper_restore_fbdev_mode_unlocked) from [<c0415774>] (drm_fb_helper_set_par+0x30/0x54)
+[<c0415774>] (drm_fb_helper_set_par) from [<c03ad450>] (fbcon_init+0x560/0x5ac)
+[<c03ad450>] (fbcon_init) from [<c03eb8a0>] (visual_init+0xbc/0x104)
+[<c03eb8a0>] (visual_init) from [<c03ed1b8>] (do_bind_con_driver+0x1b0/0x390)
+[<c03ed1b8>] (do_bind_con_driver) from [<c03ed780>] (do_take_over_console+0x13c/0x1c4)
+[<c03ed780>] (do_take_over_console) from [<c03ad800>] (do_fbcon_takeover+0x74/0xcc)
+[<c03ad800>] (do_fbcon_takeover) from [<c013c9c8>] (notifier_call_chain+0x44/0x84)
+[<c013c9c8>] (notifier_call_chain) from [<c013cd20>] (__blocking_notifier_call_chain+0x48/0x60)
+[<c013cd20>] (__blocking_notifier_call_chain) from [<c013cd50>] (blocking_notifier_call_chain+0x18/0x20)
+[<c013cd50>] (blocking_notifier_call_chain) from [<c03a6e44>] (register_framebuffer+0x1e0/0x2f8)
+[<c03a6e44>] (register_framebuffer) from [<c04153c0>] (__drm_fb_helper_initial_config_and_unlock+0x2fc/0x50c)
+[<c04153c0>] (__drm_fb_helper_initial_config_and_unlock) from [<c04158c8>] (drm_fbdev_client_hotplug+0xe8/0x1b8)
+[<c04158c8>] (drm_fbdev_client_hotplug) from [<c0415a20>] (drm_fbdev_generic_setup+0x88/0x118)
+[<c0415a20>] (drm_fbdev_generic_setup) from [<c043f060>] (sun4i_drv_bind+0x128/0x160)
+[<c043f060>] (sun4i_drv_bind) from [<c044b598>] (try_to_bring_up_master+0x164/0x1a0)
+[<c044b598>] (try_to_bring_up_master) from [<c044b668>] (__component_add+0x94/0x140)
+[<c044b668>] (__component_add) from [<c0445e1c>] (sun6i_dsi_probe+0x144/0x234)
+[<c0445e1c>] (sun6i_dsi_probe) from [<c0452ef4>] (platform_drv_probe+0x48/0x9c)
+[<c0452ef4>] (platform_drv_probe) from [<c04512cc>] (really_probe+0x1dc/0x2c8)
+[<c04512cc>] (really_probe) from [<c0451518>] (driver_probe_device+0x60/0x160)
+[<c0451518>] (driver_probe_device) from [<c044f7a4>] (bus_for_each_drv+0x74/0xb8)
+[<c044f7a4>] (bus_for_each_drv) from [<c045107c>] (__device_attach+0xd0/0x13c)
+[<c045107c>] (__device_attach) from [<c0450474>] (bus_probe_device+0x84/0x8c)
+[<c0450474>] (bus_probe_device) from [<c0450900>] (deferred_probe_work_func+0x64/0x90)
+[<c0450900>] (deferred_probe_work_func) from [<c0135970>] (process_one_work+0x204/0x420)
+[<c0135970>] (process_one_work) from [<c013690c>] (worker_thread+0x274/0x5a0)
+[<c013690c>] (worker_thread) from [<c013b3d8>] (kthread+0x11c/0x14c)
+[<c013b3d8>] (kthread) from [<c01010e8>] (ret_from_fork+0x14/0x2c)
+Exception stack(0xde539fb0 to 0xde539ff8)
+9fa0:                                     00000000 00000000 00000000 00000000
+9fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
+9fe0: 00000000 00000000 00000000 00000000 00000013 00000000
+---[ end trace b57eb1e5c64c6b8b ]---
+random: fast init done
+[drm:drm_atomic_helper_wait_for_dependencies] *ERROR* [CRTC:46:crtc-0] flip_done timed out
+[drm:drm_atomic_helper_wait_for_dependencies] *ERROR* [CONNECTOR:48:DSI-1] flip_done timed out
+[drm:drm_atomic_helper_wait_for_dependencies] *ERROR* [PLANE:30:plane-0] flip_done timed out
+
+With the terms(as described in above diagram) fixed, the panel
+displays correctly without any timeouts.
+
+Tested-by: Merlijn Wajer <merlijn@wizzup.org>
+Signed-off-by: Jagan Teki <jagan@amarulasolutions.com>
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20191003064527.15128-2-jagan@amarulasolutions.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c
+index 1636344ba9ec..f83522717488 100644
+--- a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c
++++ b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c
+@@ -437,9 +437,9 @@ static void sun6i_dsi_setup_burst(struct sun6i_dsi *dsi,
+ 			     SUN6I_DSI_BURST_LINE_SYNC_POINT(SUN6I_DSI_SYNC_POINT));
+ 
+ 		val = SUN6I_DSI_TCON_DRQ_ENABLE_MODE;
+-	} else if ((mode->hsync_end - mode->hdisplay) > 20) {
++	} else if ((mode->hsync_start - mode->hdisplay) > 20) {
+ 		/* Maaaaaagic */
+-		u16 drq = (mode->hsync_end - mode->hdisplay) - 20;
++		u16 drq = (mode->hsync_start - mode->hdisplay) - 20;
+ 
+ 		drq *= mipi_dsi_pixel_format_to_bpp(device->format);
+ 		drq /= 32;
+-- 
+2.20.1
+
diff --git a/queue-5.4/drm-tegra-sor-use-correct-sor-index-on-tegra210.patch b/queue-5.4/drm-tegra-sor-use-correct-sor-index-on-tegra210.patch
new file mode 100644
index 00000000000..560b2d2730e
--- /dev/null
+++ b/queue-5.4/drm-tegra-sor-use-correct-sor-index-on-tegra210.patch
@@ -0,0 +1,40 @@
+From d748359ab87b4e09da1d0af4e48d682c7ae2b09c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Jul 2019 17:06:17 +0200
+Subject: drm/tegra: sor: Use correct SOR index on Tegra210
+
+From: Thierry Reding <treding@nvidia.com>
+
+[ Upstream commit 24e64f86da40e68c5f58af08796110f147b12193 ]
+
+The device tree bindings for the Tegra210 SOR don't require the
+controller instance to be defined, since the instance can be derived
+from the compatible string. The index is never used on Tegra210, so we
+got away with it not getting set. However, subsequent patches will
+change that, so make sure the proper index is used.
+
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tegra/sor.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/tegra/sor.c b/drivers/gpu/drm/tegra/sor.c
+index e1669ada0a40..75e65d9536d5 100644
+--- a/drivers/gpu/drm/tegra/sor.c
++++ b/drivers/gpu/drm/tegra/sor.c
+@@ -3200,6 +3200,11 @@ static int tegra_sor_parse_dt(struct tegra_sor *sor)
+ 		 * earlier
+ 		 */
+ 		sor->pad = TEGRA_IO_PAD_HDMI_DP0 + sor->index;
++	} else {
++		if (sor->soc->supports_edp)
++			sor->index = 0;
++		else
++			sor->index = 1;
+ 	}
+ 
+ 	err = of_property_read_u32_array(np, "nvidia,xbar-cfg", xbar_cfg, 5);
+-- 
+2.20.1
+
diff --git a/queue-5.4/drm-ttm-return-ebusy-on-pipelining-with-no_gpu_wait-.patch b/queue-5.4/drm-ttm-return-ebusy-on-pipelining-with-no_gpu_wait-.patch
new file mode 100644
index 00000000000..bb1f9c9f8c6
--- /dev/null
+++ b/queue-5.4/drm-ttm-return-ebusy-on-pipelining-with-no_gpu_wait-.patch
@@ -0,0 +1,109 @@
+From 5cabfcb290d87958e65c75c8f2ac1adc0801c258 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Sep 2019 10:20:47 -0500
+Subject: drm/ttm: return -EBUSY on pipelining with no_gpu_wait (v2)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christian König <christian.koenig@amd.com>
+
+[ Upstream commit 3084cf46cf8110826a42de8c8ef30e8fa48974c2 ]
+
+Setting the no_gpu_wait flag means that the allocate BO must be available
+immediately and we can't wait for any GPU operation to finish.
+
+v2: squash in mem leak fix, rebase
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Acked-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/ttm/ttm_bo.c | 44 +++++++++++++++++++++---------------
+ 1 file changed, 26 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
+index 98819462f025..f07803699809 100644
+--- a/drivers/gpu/drm/ttm/ttm_bo.c
++++ b/drivers/gpu/drm/ttm/ttm_bo.c
+@@ -926,7 +926,8 @@ EXPORT_SYMBOL(ttm_bo_mem_put);
+  */
+ static int ttm_bo_add_move_fence(struct ttm_buffer_object *bo,
+ 				 struct ttm_mem_type_manager *man,
+-				 struct ttm_mem_reg *mem)
++				 struct ttm_mem_reg *mem,
++				 bool no_wait_gpu)
+ {
+ 	struct dma_fence *fence;
+ 	int ret;
+@@ -935,19 +936,22 @@ static int ttm_bo_add_move_fence(struct ttm_buffer_object *bo,
+ 	fence = dma_fence_get(man->move);
+ 	spin_unlock(&man->move_lock);
+ 
+-	if (fence) {
+-		dma_resv_add_shared_fence(bo->base.resv, fence);
++	if (!fence)
++		return 0;
+ 
+-		ret = dma_resv_reserve_shared(bo->base.resv, 1);
+-		if (unlikely(ret)) {
+-			dma_fence_put(fence);
+-			return ret;
+-		}
++	if (no_wait_gpu)
++		return -EBUSY;
++
++	dma_resv_add_shared_fence(bo->base.resv, fence);
+ 
+-		dma_fence_put(bo->moving);
+-		bo->moving = fence;
++	ret = dma_resv_reserve_shared(bo->base.resv, 1);
++	if (unlikely(ret)) {
++		dma_fence_put(fence);
++		return ret;
+ 	}
+ 
++	dma_fence_put(bo->moving);
++	bo->moving = fence;
+ 	return 0;
+ }
+ 
+@@ -978,7 +982,7 @@ static int ttm_bo_mem_force_space(struct ttm_buffer_object *bo,
+ 			return ret;
+ 	} while (1);
+ 
+-	return ttm_bo_add_move_fence(bo, man, mem);
++	return ttm_bo_add_move_fence(bo, man, mem, ctx->no_wait_gpu);
+ }
+ 
+ static uint32_t ttm_bo_select_caching(struct ttm_mem_type_manager *man,
+@@ -1120,14 +1124,18 @@ int ttm_bo_mem_space(struct ttm_buffer_object *bo,
+ 		if (unlikely(ret))
+ 			goto error;
+ 
+-		if (mem->mm_node) {
+-			ret = ttm_bo_add_move_fence(bo, man, mem);
+-			if (unlikely(ret)) {
+-				(*man->func->put_node)(man, mem);
+-				goto error;
+-			}
+-			return 0;
++		if (!mem->mm_node)
++			continue;
++
++		ret = ttm_bo_add_move_fence(bo, man, mem, ctx->no_wait_gpu);
++		if (unlikely(ret)) {
++			(*man->func->put_node)(man, mem);
++			if (ret == -EBUSY)
++				continue;
++
++			goto error;
+ 		}
++		return 0;
+ 	}
+ 
+ 	for (i = 0; i < placement->num_busy_placement; ++i) {
+-- 
+2.20.1
+
diff --git a/queue-5.4/drm-use-eopnotsupp-not-enotsupp.patch b/queue-5.4/drm-use-eopnotsupp-not-enotsupp.patch
new file mode 100644
index 00000000000..e4cd54b6a39
--- /dev/null
+++ b/queue-5.4/drm-use-eopnotsupp-not-enotsupp.patch
@@ -0,0 +1,123 @@
+From ee891ed43fe0ecb809ee4a1b951b628cdf6bfa5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Sep 2019 16:39:42 +0200
+Subject: drm: Use EOPNOTSUPP, not ENOTSUPP
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+
+[ Upstream commit c7581a414d28413c1dd6d116d44859b5a52e0950 ]
+
+- it's what we recommend in our docs:
+
+https://dri.freedesktop.org/docs/drm/gpu/drm-uapi.html#recommended-ioctl-return-values
+
+- it's the overwhelmingly used error code for "operation not
+  supported", at least in drm core (slightly less so in drivers):
+
+$ git grep EOPNOTSUPP -- drivers/gpu/drm/*c | wc -l
+83
+$ git grep ENOTSUPP -- drivers/gpu/drm/*c | wc -l
+5
+
+- include/linux/errno.h makes it fairly clear that these are for nfsv3
+  (plus they also have error codes above 512, which is the block with
+  some special behaviour ...)
+
+/* Defined for the NFSv3 protocol */
+
+If the above isn't reflecting current practice, then I guess we should
+at least update the docs.
+
+Noralf commented:
+
+Ben Hutchings made this comment[1] in a thread about use of ENOTSUPP in
+drivers:
+
+  glibc's strerror() returns these strings for ENOTSUPP and EOPNOTSUPP
+  respectively:
+
+  "Unknown error 524"
+  "Operation not supported"
+
+So at least for errors returned to userspace EOPNOTSUPP makes sense.
+
+José asked:
+
+> Hopefully this will not break any userspace
+
+None of the functions in drm_edid.c affected by this reach userspace,
+it's all driver internal.
+
+Same for the mipi function, that error code should be handled by
+drivers. Drivers are supposed to remap "the hw is on fire" to EIO when
+reporting up to userspace, but I think if a driver sees this it would
+be a driver bug.
+v2: Augment commit message with comments from Noralf and José
+
+Reviewed-by: José Roberto de Souza <jose.souza@intel.com>
+Acked-by: Noralf Trønnes <noralf@tronnes.org>
+Cc: José Roberto de Souza <jose.souza@intel.com>
+Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Cc: Maxime Ripard <mripard@kernel.org>
+Cc: Sean Paul <sean@poorly.run>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Cc: Andres Rodriguez <andresx7@gmail.com>
+Cc: Noralf Trønnes <noralf@tronnes.org>
+Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190904143942.31756-1-daniel.vetter@ffwll.ch
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_edid.c     | 6 +++---
+ drivers/gpu/drm/drm_mipi_dbi.c | 2 +-
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
+index 6b0177112e18..3f50b8865db4 100644
+--- a/drivers/gpu/drm/drm_edid.c
++++ b/drivers/gpu/drm/drm_edid.c
+@@ -3722,7 +3722,7 @@ cea_db_offsets(const u8 *cea, int *start, int *end)
+ 		if (*end < 4 || *end > 127)
+ 			return -ERANGE;
+ 	} else {
+-		return -ENOTSUPP;
++		return -EOPNOTSUPP;
+ 	}
+ 
+ 	return 0;
+@@ -4191,7 +4191,7 @@ int drm_edid_to_sad(struct edid *edid, struct cea_sad **sads)
+ 
+ 	if (cea_revision(cea) < 3) {
+ 		DRM_DEBUG_KMS("SAD: wrong CEA revision\n");
+-		return -ENOTSUPP;
++		return -EOPNOTSUPP;
+ 	}
+ 
+ 	if (cea_db_offsets(cea, &start, &end)) {
+@@ -4252,7 +4252,7 @@ int drm_edid_to_speaker_allocation(struct edid *edid, u8 **sadb)
+ 
+ 	if (cea_revision(cea) < 3) {
+ 		DRM_DEBUG_KMS("SAD: wrong CEA revision\n");
+-		return -ENOTSUPP;
++		return -EOPNOTSUPP;
+ 	}
+ 
+ 	if (cea_db_offsets(cea, &start, &end)) {
+diff --git a/drivers/gpu/drm/drm_mipi_dbi.c b/drivers/gpu/drm/drm_mipi_dbi.c
+index c4ee2709a6f3..f8154316a3b0 100644
+--- a/drivers/gpu/drm/drm_mipi_dbi.c
++++ b/drivers/gpu/drm/drm_mipi_dbi.c
+@@ -955,7 +955,7 @@ static int mipi_dbi_typec1_command(struct mipi_dbi *dbi, u8 *cmd,
+ 	int ret;
+ 
+ 	if (mipi_dbi_command_is_read(dbi, *cmd))
+-		return -ENOTSUPP;
++		return -EOPNOTSUPP;
+ 
+ 	MIPI_DBI_DEBUG_COMMAND(*cmd, parameters, num);
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/drm-vc4-vc4_hdmi-fill-in-connector-info.patch b/queue-5.4/drm-vc4-vc4_hdmi-fill-in-connector-info.patch
new file mode 100644
index 00000000000..fa008a6d941
--- /dev/null
+++ b/queue-5.4/drm-vc4-vc4_hdmi-fill-in-connector-info.patch
@@ -0,0 +1,61 @@
+From 94f5681bcc2250de4aec1bf84ff2d2024d0e31b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Aug 2019 13:24:25 +0200
+Subject: drm/vc4/vc4_hdmi: fill in connector info
+
+From: Dariusz Marcinkiewicz <darekm@google.com>
+
+[ Upstream commit 66c2dee4ae10a2d841c40b9dd9c7141eb23eee76 ]
+
+Fill in the connector info, allowing userspace to associate
+the CEC device with the drm connector.
+
+Tested on a Raspberry Pi 3B.
+
+Signed-off-by: Dariusz Marcinkiewicz <darekm@google.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Tested-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Acked-by: Eric Anholt <eric@anholt.net>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190823112427.42394-2-hverkuil-cisco@xs4all.nl
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vc4/vc4_hdmi.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
+index ee7d4e7b0ee3..0853b980bcb3 100644
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
+@@ -1285,6 +1285,9 @@ static const struct cec_adap_ops vc4_hdmi_cec_adap_ops = {
+ 
+ static int vc4_hdmi_bind(struct device *dev, struct device *master, void *data)
+ {
++#ifdef CONFIG_DRM_VC4_HDMI_CEC
++	struct cec_connector_info conn_info;
++#endif
+ 	struct platform_device *pdev = to_platform_device(dev);
+ 	struct drm_device *drm = dev_get_drvdata(master);
+ 	struct vc4_dev *vc4 = drm->dev_private;
+@@ -1403,13 +1406,15 @@ static int vc4_hdmi_bind(struct device *dev, struct device *master, void *data)
+ #ifdef CONFIG_DRM_VC4_HDMI_CEC
+ 	hdmi->cec_adap = cec_allocate_adapter(&vc4_hdmi_cec_adap_ops,
+ 					      vc4, "vc4",
+-					      CEC_CAP_TRANSMIT |
+-					      CEC_CAP_LOG_ADDRS |
+-					      CEC_CAP_PASSTHROUGH |
+-					      CEC_CAP_RC, 1);
++					      CEC_CAP_DEFAULTS |
++					      CEC_CAP_CONNECTOR_INFO, 1);
+ 	ret = PTR_ERR_OR_ZERO(hdmi->cec_adap);
+ 	if (ret < 0)
+ 		goto err_destroy_conn;
++
++	cec_fill_conn_info_from_drm(&conn_info, hdmi->connector);
++	cec_s_conn_info(hdmi->cec_adap, &conn_info);
++
+ 	HDMI_WRITE(VC4_HDMI_CPU_MASK_SET, 0xffffffff);
+ 	value = HDMI_READ(VC4_HDMI_CEC_CNTRL_1);
+ 	value &= ~VC4_HDMI_CEC_DIV_CLK_CNT_MASK;
+-- 
+2.20.1
+
diff --git a/queue-5.4/drm-virtio-switch-virtio_gpu_wait_ioctl-to-gem-helpe.patch b/queue-5.4/drm-virtio-switch-virtio_gpu_wait_ioctl-to-gem-helpe.patch
new file mode 100644
index 00000000000..07f05b8ca1d
--- /dev/null
+++ b/queue-5.4/drm-virtio-switch-virtio_gpu_wait_ioctl-to-gem-helpe.patch
@@ -0,0 +1,74 @@
+From a9ae69b59e92d3aa24214fc289df1406c4214fd4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Aug 2019 12:32:45 +0200
+Subject: drm/virtio: switch virtio_gpu_wait_ioctl() to gem helper.
+
+From: Gerd Hoffmann <kraxel@redhat.com>
+
+[ Upstream commit 29cf12394c0565d7eb1685bf0c1b4749aa6a8b66 ]
+
+Use drm_gem_reservation_object_wait() in virtio_gpu_wait_ioctl().
+This also makes the ioctl run lockless.
+
+v9: fix return value.
+v5: handle lookup failure.
+v2: use reservation_object_test_signaled_rcu for VIRTGPU_WAIT_NOWAIT.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Reviewed-by: Chia-I Wu <olvaffe@gmail.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/20190829103301.3539-3-kraxel@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/virtio/virtgpu_ioctl.c | 28 +++++++++++++++-----------
+ 1 file changed, 16 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/gpu/drm/virtio/virtgpu_ioctl.c b/drivers/gpu/drm/virtio/virtgpu_ioctl.c
+index 0a88ef11b9d3..a662394f6892 100644
+--- a/drivers/gpu/drm/virtio/virtgpu_ioctl.c
++++ b/drivers/gpu/drm/virtio/virtgpu_ioctl.c
+@@ -463,25 +463,29 @@ out:
+ }
+ 
+ static int virtio_gpu_wait_ioctl(struct drm_device *dev, void *data,
+-			    struct drm_file *file)
++				 struct drm_file *file)
+ {
+ 	struct drm_virtgpu_3d_wait *args = data;
+-	struct drm_gem_object *gobj = NULL;
+-	struct virtio_gpu_object *qobj = NULL;
++	struct drm_gem_object *obj;
++	long timeout = 15 * HZ;
+ 	int ret;
+-	bool nowait = false;
+ 
+-	gobj = drm_gem_object_lookup(file, args->handle);
+-	if (gobj == NULL)
++	obj = drm_gem_object_lookup(file, args->handle);
++	if (obj == NULL)
+ 		return -ENOENT;
+ 
+-	qobj = gem_to_virtio_gpu_obj(gobj);
+-
+-	if (args->flags & VIRTGPU_WAIT_NOWAIT)
+-		nowait = true;
+-	ret = virtio_gpu_object_wait(qobj, nowait);
++	if (args->flags & VIRTGPU_WAIT_NOWAIT) {
++		ret = dma_resv_test_signaled_rcu(obj->resv, true);
++	} else {
++		ret = dma_resv_wait_timeout_rcu(obj->resv, true, true,
++						timeout);
++	}
++	if (ret == 0)
++		ret = -EBUSY;
++	else if (ret > 0)
++		ret = 0;
+ 
+-	drm_gem_object_put_unlocked(gobj);
++	drm_gem_object_put_unlocked(obj);
+ 	return ret;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/edac-amd64-set-grain-per-dimm.patch b/queue-5.4/edac-amd64-set-grain-per-dimm.patch
new file mode 100644
index 00000000000..b9747d1e9c9
--- /dev/null
+++ b/queue-5.4/edac-amd64-set-grain-per-dimm.patch
@@ -0,0 +1,57 @@
+From bc6109059a19da8e9139d136f32762d7e27b201a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Oct 2019 20:35:14 +0000
+Subject: EDAC/amd64: Set grain per DIMM
+
+From: Yazen Ghannam <yazen.ghannam@amd.com>
+
+[ Upstream commit 466503d6b1b33be46ab87c6090f0ade6c6011cbc ]
+
+The following commit introduced a warning on error reports without a
+non-zero grain value.
+
+  3724ace582d9 ("EDAC/mc: Fix grain_bits calculation")
+
+The amd64_edac_mod module does not provide a value, so the warning will
+be given on the first reported memory error.
+
+Set the grain per DIMM to cacheline size (64 bytes). This is the current
+recommendation.
+
+Fixes: 3724ace582d9 ("EDAC/mc: Fix grain_bits calculation")
+Signed-off-by: Yazen Ghannam <yazen.ghannam@amd.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Cc: "linux-edac@vger.kernel.org" <linux-edac@vger.kernel.org>
+Cc: James Morse <james.morse@arm.com>
+Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
+Cc: Robert Richter <rrichter@marvell.com>
+Cc: Tony Luck <tony.luck@intel.com>
+Link: https://lkml.kernel.org/r/20191022203448.13962-7-Yazen.Ghannam@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/amd64_edac.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
+index c1d4536ae466..cc5e56d752c8 100644
+--- a/drivers/edac/amd64_edac.c
++++ b/drivers/edac/amd64_edac.c
+@@ -2936,6 +2936,7 @@ static int init_csrows_df(struct mem_ctl_info *mci)
+ 			dimm->mtype = pvt->dram_type;
+ 			dimm->edac_mode = edac_mode;
+ 			dimm->dtype = dev_type;
++			dimm->grain = 64;
+ 		}
+ 	}
+ 
+@@ -3012,6 +3013,7 @@ static int init_csrows(struct mem_ctl_info *mci)
+ 			dimm = csrow->channels[j]->dimm;
+ 			dimm->mtype = pvt->dram_type;
+ 			dimm->edac_mode = edac_mode;
++			dimm->grain = 64;
+ 		}
+ 	}
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/edac-ghes-fix-grain-calculation.patch b/queue-5.4/edac-ghes-fix-grain-calculation.patch
new file mode 100644
index 00000000000..c8e2cd7c5da
--- /dev/null
+++ b/queue-5.4/edac-ghes-fix-grain-calculation.patch
@@ -0,0 +1,95 @@
+From 77a2160ded1cf6bc09a41cc9a2c320e1ad66e0bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Nov 2019 09:33:23 +0000
+Subject: EDAC/ghes: Fix grain calculation
+
+From: Robert Richter <rrichter@marvell.com>
+
+[ Upstream commit 7088e29e0423d3195e09079b4f849ec4837e5a75 ]
+
+The current code to convert a physical address mask to a grain
+(defined as granularity in bytes) is:
+
+	e->grain = ~(mem_err->physical_addr_mask & ~PAGE_MASK);
+
+This is broken in several ways:
+
+1) It calculates to wrong grain values. E.g., a physical address mask
+of ~0xfff should give a grain of 0x1000. Without considering
+PAGE_MASK, there is an off-by-one. Things are worse when also
+filtering it with ~PAGE_MASK. This will calculate to a grain with the
+upper bits set. In the example it even calculates to ~0.
+
+2) The grain does not depend on and is unrelated to the kernel's
+page-size. The page-size only matters when unmapping memory in
+memory_failure(). Smaller grains are wrongly rounded up to the
+page-size, on architectures with a configurable page-size (e.g. arm64)
+this could round up to the even bigger page-size of the hypervisor.
+
+Fix this with:
+
+	e->grain = ~mem_err->physical_addr_mask + 1;
+
+The grain_bits are defined as:
+
+	grain = 1 << grain_bits;
+
+Change also the grain_bits calculation accordingly, it is the same
+formula as in edac_mc.c now and the code can be unified.
+
+The value in ->physical_addr_mask coming from firmware is assumed to
+be contiguous, but this is not sanity-checked. However, in case the
+mask is non-contiguous, a conversion to grain_bits effectively
+converts the grain bit mask to a power of 2 by rounding it up.
+
+Suggested-by: James Morse <james.morse@arm.com>
+Signed-off-by: Robert Richter <rrichter@marvell.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Cc: "linux-edac@vger.kernel.org" <linux-edac@vger.kernel.org>
+Cc: Tony Luck <tony.luck@intel.com>
+Link: https://lkml.kernel.org/r/20191106093239.25517-11-rrichter@marvell.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/ghes_edac.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/edac/ghes_edac.c b/drivers/edac/ghes_edac.c
+index 296e714bf553..523dd56a798c 100644
+--- a/drivers/edac/ghes_edac.c
++++ b/drivers/edac/ghes_edac.c
+@@ -231,6 +231,7 @@ void ghes_edac_report_mem_error(int sev, struct cper_sec_mem_err *mem_err)
+ 	/* Cleans the error report buffer */
+ 	memset(e, 0, sizeof (*e));
+ 	e->error_count = 1;
++	e->grain = 1;
+ 	strcpy(e->label, "unknown label");
+ 	e->msg = pvt->msg;
+ 	e->other_detail = pvt->other_detail;
+@@ -326,7 +327,7 @@ void ghes_edac_report_mem_error(int sev, struct cper_sec_mem_err *mem_err)
+ 
+ 	/* Error grain */
+ 	if (mem_err->validation_bits & CPER_MEM_VALID_PA_MASK)
+-		e->grain = ~(mem_err->physical_addr_mask & ~PAGE_MASK);
++		e->grain = ~mem_err->physical_addr_mask + 1;
+ 
+ 	/* Memory error location, mapped on e->location */
+ 	p = e->location;
+@@ -442,8 +443,13 @@ void ghes_edac_report_mem_error(int sev, struct cper_sec_mem_err *mem_err)
+ 	if (p > pvt->other_detail)
+ 		*(p - 1) = '\0';
+ 
++	/* Sanity-check driver-supplied grain value. */
++	if (WARN_ON_ONCE(!e->grain))
++		e->grain = 1;
++
++	grain_bits = fls_long(e->grain - 1);
++
+ 	/* Generate the trace event */
+-	grain_bits = fls_long(e->grain);
+ 	snprintf(pvt->detail_location, sizeof(pvt->detail_location),
+ 		 "APEI location: %s %s", e->location, e->other_detail);
+ 	trace_mc_event(type, e->msg, e->label, e->error_count,
+-- 
+2.20.1
+
diff --git a/queue-5.4/extcon-sm5502-reset-registers-during-initialization.patch b/queue-5.4/extcon-sm5502-reset-registers-during-initialization.patch
new file mode 100644
index 00000000000..12e3ea9a477
--- /dev/null
+++ b/queue-5.4/extcon-sm5502-reset-registers-during-initialization.patch
@@ -0,0 +1,63 @@
+From f3f66d38cefc75151fc496abf5944d3e41f3ad9a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Oct 2019 17:47:20 +0200
+Subject: extcon: sm5502: Reset registers during initialization
+
+From: Stephan Gerhold <stephan@gerhold.net>
+
+[ Upstream commit 6942635032cfd3e003e980d2dfa4e6323a3ce145 ]
+
+On some devices (e.g. Samsung Galaxy A5 (2015)), the bootloader
+seems to keep interrupts enabled for SM5502 when booting Linux.
+Changing the cable state (i.e. plugging in a cable) - until the driver
+is loaded - will therefore produce an interrupt that is never read.
+
+In this situation, the cable state will be stuck forever on the
+initial state because SM5502 stops sending interrupts.
+This can be avoided by clearing those pending interrupts after
+the driver has been loaded.
+
+One way to do this is to reset all registers to default state
+by writing to SM5502_REG_RESET. This ensures that we start from
+a clean state, with all interrupts disabled.
+
+Suggested-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/extcon/extcon-sm5502.c | 4 ++++
+ drivers/extcon/extcon-sm5502.h | 2 ++
+ 2 files changed, 6 insertions(+)
+
+diff --git a/drivers/extcon/extcon-sm5502.c b/drivers/extcon/extcon-sm5502.c
+index dc43847ad2b0..b3d93baf4fc5 100644
+--- a/drivers/extcon/extcon-sm5502.c
++++ b/drivers/extcon/extcon-sm5502.c
+@@ -65,6 +65,10 @@ struct sm5502_muic_info {
+ /* Default value of SM5502 register to bring up MUIC device. */
+ static struct reg_data sm5502_reg_data[] = {
+ 	{
++		.reg = SM5502_REG_RESET,
++		.val = SM5502_REG_RESET_MASK,
++		.invert = true,
++	}, {
+ 		.reg = SM5502_REG_CONTROL,
+ 		.val = SM5502_REG_CONTROL_MASK_INT_MASK,
+ 		.invert = false,
+diff --git a/drivers/extcon/extcon-sm5502.h b/drivers/extcon/extcon-sm5502.h
+index 9dbb634d213b..ce1f1ec310c4 100644
+--- a/drivers/extcon/extcon-sm5502.h
++++ b/drivers/extcon/extcon-sm5502.h
+@@ -237,6 +237,8 @@ enum sm5502_reg {
+ #define DM_DP_SWITCH_UART			((DM_DP_CON_SWITCH_UART <<SM5502_REG_MANUAL_SW1_DP_SHIFT) \
+ 						| (DM_DP_CON_SWITCH_UART <<SM5502_REG_MANUAL_SW1_DM_SHIFT))
+ 
++#define SM5502_REG_RESET_MASK			(0x1)
++
+ /* SM5502 Interrupts */
+ enum sm5502_irq {
+ 	/* INT1 */
+-- 
+2.20.1
+
diff --git a/queue-5.4/fbtft-make-sure-string-is-null-terminated.patch b/queue-5.4/fbtft-make-sure-string-is-null-terminated.patch
new file mode 100644
index 00000000000..e74c76b50d4
--- /dev/null
+++ b/queue-5.4/fbtft-make-sure-string-is-null-terminated.patch
@@ -0,0 +1,46 @@
+From 572e7595e61aded024a11bf103e53f57aac3680e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Nov 2019 11:57:12 +0200
+Subject: fbtft: Make sure string is NULL terminated
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 21f585480deb4bcf0d92b08879c35d066dfee030 ]
+
+New GCC warns about inappropriate use of strncpy():
+
+drivers/staging/fbtft/fbtft-core.c: In function ‘fbtft_framebuffer_alloc’:
+drivers/staging/fbtft/fbtft-core.c:665:2: warning: ‘strncpy’ specified bound 16 equals destination size [-Wstringop-truncation]
+  665 |  strncpy(info->fix.id, dev->driver->name, 16);
+      |  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Later on the copy is being used with the assumption to be NULL terminated.
+Make sure string is NULL terminated by switching to snprintf().
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20191120095716.26628-1-andriy.shevchenko@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/fbtft/fbtft-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/staging/fbtft/fbtft-core.c b/drivers/staging/fbtft/fbtft-core.c
+index a0a67aa517f0..61f0286fb157 100644
+--- a/drivers/staging/fbtft/fbtft-core.c
++++ b/drivers/staging/fbtft/fbtft-core.c
+@@ -666,7 +666,7 @@ struct fb_info *fbtft_framebuffer_alloc(struct fbtft_display *display,
+ 	fbdefio->deferred_io =     fbtft_deferred_io;
+ 	fb_deferred_io_init(info);
+ 
+-	strncpy(info->fix.id, dev->driver->name, 16);
++	snprintf(info->fix.id, sizeof(info->fix.id), "%s", dev->driver->name);
+ 	info->fix.type =           FB_TYPE_PACKED_PIXELS;
+ 	info->fix.visual =         FB_VISUAL_TRUECOLOR;
+ 	info->fix.xpanstep =	   0;
+-- 
+2.20.1
+
diff --git a/queue-5.4/firmware_loader-fix-labels-with-comma-for-builtin-fi.patch b/queue-5.4/firmware_loader-fix-labels-with-comma-for-builtin-fi.patch
new file mode 100644
index 00000000000..118dcd3cf19
--- /dev/null
+++ b/queue-5.4/firmware_loader-fix-labels-with-comma-for-builtin-fi.patch
@@ -0,0 +1,56 @@
+From da115f77a1d668519fed6c8906f084d41f0030c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Nov 2019 23:59:11 +0100
+Subject: firmware_loader: Fix labels with comma for builtin firmware
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit 553671b7685972ca671da5f71cf6414b54376e13 ]
+
+Some firmware images contain a comma, such as:
+EXTRA_FIRMWARE "brcm/brcmfmac4334-sdio.samsung,gt-s7710.txt"
+as Broadcom firmware simply tags the device tree compatible
+string at the end of the firmware parameter file. And the
+compatible string contains a comma.
+
+This doesn't play well with gas:
+
+drivers/base/firmware_loader/builtin/brcm/brcmfmac4334-sdio.samsung,gt-s7710.txt.gen.S: Assembler messages:
+drivers/base/firmware_loader/builtin/brcm/brcmfmac4334-sdio.samsung,gt-s7710.txt.gen.S:4: Error: bad instruction `_fw_brcm_brcmfmac4334_sdio_samsung,gt_s7710_txt_bin:'
+drivers/base/firmware_loader/builtin/brcm/brcmfmac4334-sdio.samsung,gt-s7710.txt.gen.S:9: Error: bad instruction `_fw_brcm_brcmfmac4334_sdio_samsung,gt_s7710_txt_name:'
+drivers/base/firmware_loader/builtin/brcm/brcmfmac4334-sdio.samsung,gt-s7710.txt.gen.S:15: Error: can't resolve `.rodata' {.rodata section} - `_fw_brcm_brcmfmac4334_sdio_samsung' {*UND* section}
+make[6]: *** [../scripts/Makefile.build:357: drivers/base/firmware_loader/builtin/brcm/brcmfmac4334-sdio.samsung,gt-s7710.txt.gen.o] Error 1
+
+We need to get rid of the comma from the labels used by the
+assembly stub generator.
+
+Replacing a comma using GNU Make subst requires a helper
+variable.
+
+Cc: Stephan Gerhold <stephan@gerhold.net>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20191115225911.3260-1-linus.walleij@linaro.org
+Acked-by: Luis Chamberlain <mcgrof@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/firmware_loader/builtin/Makefile | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/base/firmware_loader/builtin/Makefile b/drivers/base/firmware_loader/builtin/Makefile
+index 37e5ae387400..4a66888e7253 100644
+--- a/drivers/base/firmware_loader/builtin/Makefile
++++ b/drivers/base/firmware_loader/builtin/Makefile
+@@ -8,7 +8,8 @@ fwdir := $(addprefix $(srctree)/,$(filter-out /%,$(fwdir)))$(filter /%,$(fwdir))
+ obj-y  := $(addsuffix .gen.o, $(subst $(quote),,$(CONFIG_EXTRA_FIRMWARE)))
+ 
+ FWNAME    = $(patsubst $(obj)/%.gen.S,%,$@)
+-FWSTR     = $(subst /,_,$(subst .,_,$(subst -,_,$(FWNAME))))
++comma     := ,
++FWSTR     = $(subst $(comma),_,$(subst /,_,$(subst .,_,$(subst -,_,$(FWNAME)))))
+ ASM_WORD  = $(if $(CONFIG_64BIT),.quad,.long)
+ ASM_ALIGN = $(if $(CONFIG_64BIT),3,2)
+ PROGBITS  = $(if $(CONFIG_ARM),%,@)progbits
+-- 
+2.20.1
+
diff --git a/queue-5.4/fsi-core-fix-small-accesses-and-unaligned-offsets-vi.patch b/queue-5.4/fsi-core-fix-small-accesses-and-unaligned-offsets-vi.patch
new file mode 100644
index 00000000000..2d70e1a57a8
--- /dev/null
+++ b/queue-5.4/fsi-core-fix-small-accesses-and-unaligned-offsets-vi.patch
@@ -0,0 +1,110 @@
+From 3712eef64b25846c595b04427d602d6299ff7bef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Nov 2019 15:49:39 +1030
+Subject: fsi: core: Fix small accesses and unaligned offsets via sysfs
+
+From: Andrew Jeffery <andrew@aj.id.au>
+
+[ Upstream commit 9f4c2b516b4f031e3cd0e45957f4150b3c1a083d ]
+
+Subtracting the offset delta from four-byte alignment lead to wrapping
+of the requested length where `count` is less than `off`. Generalise the
+length handling to enable and optimise aligned access sizes for all
+offset and size combinations. The new formula produces the following
+results for given offset and count values:
+
+    offset  count | length
+    --------------+-------
+    0       1     | 1
+    0       2     | 2
+    0       3     | 2
+    0       4     | 4
+    0       5     | 4
+    1       1     | 1
+    1       2     | 1
+    1       3     | 1
+    1       4     | 1
+    1       5     | 1
+    2       1     | 1
+    2       2     | 2
+    2       3     | 2
+    2       4     | 2
+    2       5     | 2
+    3       1     | 1
+    3       2     | 1
+    3       3     | 1
+    3       4     | 1
+    3       5     | 1
+
+We might need something like this for the cfam chardevs as well, for
+example we don't currently implement any alignment restrictions /
+handling in the hardware master driver.
+
+Signed-off-by: Andrew Jeffery <andrew@aj.id.au>
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Link: https://lore.kernel.org/r/20191108051945.7109-6-joel@jms.id.au
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/fsi/fsi-core.c | 31 +++++++++++++++++++++++++++----
+ 1 file changed, 27 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/fsi/fsi-core.c b/drivers/fsi/fsi-core.c
+index 1f76740f33b6..9282239b4d95 100644
+--- a/drivers/fsi/fsi-core.c
++++ b/drivers/fsi/fsi-core.c
+@@ -544,6 +544,31 @@ static int fsi_slave_scan(struct fsi_slave *slave)
+ 	return 0;
+ }
+ 
++static unsigned long aligned_access_size(size_t offset, size_t count)
++{
++	unsigned long offset_unit, count_unit;
++
++	/* Criteria:
++	 *
++	 * 1. Access size must be less than or equal to the maximum access
++	 *    width or the highest power-of-two factor of offset
++	 * 2. Access size must be less than or equal to the amount specified by
++	 *    count
++	 *
++	 * The access width is optimal if we can calculate 1 to be strictly
++	 * equal while still satisfying 2.
++	 */
++
++	/* Find 1 by the bottom bit of offset (with a 4 byte access cap) */
++	offset_unit = BIT(__builtin_ctzl(offset | 4));
++
++	/* Find 2 by the top bit of count */
++	count_unit = BIT(8 * sizeof(unsigned long) - 1 - __builtin_clzl(count));
++
++	/* Constrain the maximum access width to the minimum of both criteria */
++	return BIT(__builtin_ctzl(offset_unit | count_unit));
++}
++
+ static ssize_t fsi_slave_sysfs_raw_read(struct file *file,
+ 		struct kobject *kobj, struct bin_attribute *attr, char *buf,
+ 		loff_t off, size_t count)
+@@ -559,8 +584,7 @@ static ssize_t fsi_slave_sysfs_raw_read(struct file *file,
+ 		return -EINVAL;
+ 
+ 	for (total_len = 0; total_len < count; total_len += read_len) {
+-		read_len = min_t(size_t, count, 4);
+-		read_len -= off & 0x3;
++		read_len = aligned_access_size(off, count - total_len);
+ 
+ 		rc = fsi_slave_read(slave, off, buf + total_len, read_len);
+ 		if (rc)
+@@ -587,8 +611,7 @@ static ssize_t fsi_slave_sysfs_raw_write(struct file *file,
+ 		return -EINVAL;
+ 
+ 	for (total_len = 0; total_len < count; total_len += write_len) {
+-		write_len = min_t(size_t, count, 4);
+-		write_len -= off & 0x3;
++		write_len = aligned_access_size(off, count - total_len);
+ 
+ 		rc = fsi_slave_write(slave, off, buf + total_len, write_len);
+ 		if (rc)
+-- 
+2.20.1
+
diff --git a/queue-5.4/gpu-host1x-allocate-gather-copy-for-host1x.patch b/queue-5.4/gpu-host1x-allocate-gather-copy-for-host1x.patch
new file mode 100644
index 00000000000..0447db45cb7
--- /dev/null
+++ b/queue-5.4/gpu-host1x-allocate-gather-copy-for-host1x.patch
@@ -0,0 +1,75 @@
+From 4c9b1018abf1ed2035c42b97c8b125809bbe4a36 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Oct 2019 13:37:12 +0100
+Subject: gpu: host1x: Allocate gather copy for host1x
+
+From: Thierry Reding <treding@nvidia.com>
+
+[ Upstream commit b78e70c04c149299bd210759d7c7af7c86b89ca8 ]
+
+Currently when the gather buffers are copied, they are copied to a
+buffer that is allocated for the host1x client that wants to execute the
+command streams in the buffers. However, the gather buffers will be read
+by the host1x device, which causes SMMU faults if the DMA API is backed
+by an IOMMU.
+
+Fix this by allocating the gather buffer copy for the host1x device,
+which makes sure that it will be mapped into the host1x's IOVA space if
+the DMA API is backed by an IOMMU.
+
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/host1x/job.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/host1x/job.c b/drivers/gpu/host1x/job.c
+index eaa5c3352c13..22559670faee 100644
+--- a/drivers/gpu/host1x/job.c
++++ b/drivers/gpu/host1x/job.c
+@@ -436,7 +436,8 @@ out:
+ 	return err;
+ }
+ 
+-static inline int copy_gathers(struct host1x_job *job, struct device *dev)
++static inline int copy_gathers(struct device *host, struct host1x_job *job,
++			       struct device *dev)
+ {
+ 	struct host1x_firewall fw;
+ 	size_t size = 0;
+@@ -459,12 +460,12 @@ static inline int copy_gathers(struct host1x_job *job, struct device *dev)
+ 	 * Try a non-blocking allocation from a higher priority pools first,
+ 	 * as awaiting for the allocation here is a major performance hit.
+ 	 */
+-	job->gather_copy_mapped = dma_alloc_wc(dev, size, &job->gather_copy,
++	job->gather_copy_mapped = dma_alloc_wc(host, size, &job->gather_copy,
+ 					       GFP_NOWAIT);
+ 
+ 	/* the higher priority allocation failed, try the generic-blocking */
+ 	if (!job->gather_copy_mapped)
+-		job->gather_copy_mapped = dma_alloc_wc(dev, size,
++		job->gather_copy_mapped = dma_alloc_wc(host, size,
+ 						       &job->gather_copy,
+ 						       GFP_KERNEL);
+ 	if (!job->gather_copy_mapped)
+@@ -512,7 +513,7 @@ int host1x_job_pin(struct host1x_job *job, struct device *dev)
+ 		goto out;
+ 
+ 	if (IS_ENABLED(CONFIG_TEGRA_HOST1X_FIREWALL)) {
+-		err = copy_gathers(job, dev);
++		err = copy_gathers(host->dev, job, dev);
+ 		if (err)
+ 			goto out;
+ 	}
+@@ -573,7 +574,7 @@ void host1x_job_unpin(struct host1x_job *job)
+ 	job->num_unpins = 0;
+ 
+ 	if (job->gather_copy_size)
+-		dma_free_wc(job->channel->dev, job->gather_copy_size,
++		dma_free_wc(host->dev, job->gather_copy_size,
+ 			    job->gather_copy_mapped, job->gather_copy);
+ }
+ EXPORT_SYMBOL(host1x_job_unpin);
+-- 
+2.20.1
+
diff --git a/queue-5.4/hwrng-omap3-rom-call-clk_disable_unprepare-on-exit-o.patch b/queue-5.4/hwrng-omap3-rom-call-clk_disable_unprepare-on-exit-o.patch
new file mode 100644
index 00000000000..eab6e827122
--- /dev/null
+++ b/queue-5.4/hwrng-omap3-rom-call-clk_disable_unprepare-on-exit-o.patch
@@ -0,0 +1,50 @@
+From 5b5df73e7381f5bb2c2122fadc134fb85f627dfd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Sep 2019 14:02:56 -0700
+Subject: hwrng: omap3-rom - Call clk_disable_unprepare() on exit only if not
+ idled
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit eaecce12f5f0d2c35d278e41e1bc4522393861ab ]
+
+When unloading omap3-rom-rng, we'll get the following:
+
+WARNING: CPU: 0 PID: 100 at drivers/clk/clk.c:948 clk_core_disable
+
+This is because the clock may be already disabled by omap3_rom_rng_idle().
+Let's fix the issue by checking for rng_idle on exit.
+
+Cc: Aaro Koskinen <aaro.koskinen@iki.fi>
+Cc: Adam Ford <aford173@gmail.com>
+Cc: Pali Rohár <pali.rohar@gmail.com>
+Cc: Sebastian Reichel <sre@kernel.org>
+Cc: Tero Kristo <t-kristo@ti.com>
+Fixes: 1c6b7c2108bd ("hwrng: OMAP3 ROM Random Number Generator support")
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/hw_random/omap3-rom-rng.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/char/hw_random/omap3-rom-rng.c b/drivers/char/hw_random/omap3-rom-rng.c
+index 38b719017186..648e39ce6bd9 100644
+--- a/drivers/char/hw_random/omap3-rom-rng.c
++++ b/drivers/char/hw_random/omap3-rom-rng.c
+@@ -121,7 +121,8 @@ static int omap3_rom_rng_remove(struct platform_device *pdev)
+ {
+ 	cancel_delayed_work_sync(&idle_work);
+ 	hwrng_unregister(&omap3_rom_rng_ops);
+-	clk_disable_unprepare(rng_clk);
++	if (!rng_idle)
++		clk_disable_unprepare(rng_clk);
+ 	return 0;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/i40e-initialize-itrn-registers-with-correct-values.patch b/queue-5.4/i40e-initialize-itrn-registers-with-correct-values.patch
new file mode 100644
index 00000000000..80341403aef
--- /dev/null
+++ b/queue-5.4/i40e-initialize-itrn-registers-with-correct-values.patch
@@ -0,0 +1,82 @@
+From e5334b106df05a0afdfdb9077757e0e1dd0d0c0a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Sep 2019 02:17:21 -0700
+Subject: i40e: initialize ITRN registers with correct values
+
+From: Nicholas Nunley <nicholas.d.nunley@intel.com>
+
+[ Upstream commit 998e5166e604fd37afe94352f7b8c2d816b11049 ]
+
+Since commit 92418fb14750 ("i40e/i40evf: Use usec value instead of reg
+value for ITR defines") the driver tracks the interrupt throttling
+intervals in single usec units, although the actual ITRN/ITR0 registers are
+programmed in 2 usec units. Most register programming flows in the driver
+correctly handle the conversion, although it is currently not applied when
+the registers are initialized to their default values. Most of the time
+this doesn't present a problem since the default values are usually
+immediately overwritten through the standard adaptive throttling mechanism,
+or updated manually by the user, but if adaptive throttling is disabled and
+the interval values are left alone then the incorrect value will persist.
+
+Since the intended default interval of 50 usecs (vs. 100 usecs as
+programmed) performs better for most traffic workloads, this can lead to
+performance regressions.
+
+This patch adds the correct conversion when writing the initial values to
+the ITRN registers.
+
+Signed-off-by: Nicholas Nunley <nicholas.d.nunley@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_main.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 6031223eafab..339925af0206 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -3534,14 +3534,14 @@ static void i40e_vsi_configure_msix(struct i40e_vsi *vsi)
+ 		q_vector->rx.target_itr =
+ 			ITR_TO_REG(vsi->rx_rings[i]->itr_setting);
+ 		wr32(hw, I40E_PFINT_ITRN(I40E_RX_ITR, vector - 1),
+-		     q_vector->rx.target_itr);
++		     q_vector->rx.target_itr >> 1);
+ 		q_vector->rx.current_itr = q_vector->rx.target_itr;
+ 
+ 		q_vector->tx.next_update = jiffies + 1;
+ 		q_vector->tx.target_itr =
+ 			ITR_TO_REG(vsi->tx_rings[i]->itr_setting);
+ 		wr32(hw, I40E_PFINT_ITRN(I40E_TX_ITR, vector - 1),
+-		     q_vector->tx.target_itr);
++		     q_vector->tx.target_itr >> 1);
+ 		q_vector->tx.current_itr = q_vector->tx.target_itr;
+ 
+ 		wr32(hw, I40E_PFINT_RATEN(vector - 1),
+@@ -3646,11 +3646,11 @@ static void i40e_configure_msi_and_legacy(struct i40e_vsi *vsi)
+ 	/* set the ITR configuration */
+ 	q_vector->rx.next_update = jiffies + 1;
+ 	q_vector->rx.target_itr = ITR_TO_REG(vsi->rx_rings[0]->itr_setting);
+-	wr32(hw, I40E_PFINT_ITR0(I40E_RX_ITR), q_vector->rx.target_itr);
++	wr32(hw, I40E_PFINT_ITR0(I40E_RX_ITR), q_vector->rx.target_itr >> 1);
+ 	q_vector->rx.current_itr = q_vector->rx.target_itr;
+ 	q_vector->tx.next_update = jiffies + 1;
+ 	q_vector->tx.target_itr = ITR_TO_REG(vsi->tx_rings[0]->itr_setting);
+-	wr32(hw, I40E_PFINT_ITR0(I40E_TX_ITR), q_vector->tx.target_itr);
++	wr32(hw, I40E_PFINT_ITR0(I40E_TX_ITR), q_vector->tx.target_itr >> 1);
+ 	q_vector->tx.current_itr = q_vector->tx.target_itr;
+ 
+ 	i40e_enable_misc_int_causes(pf);
+@@ -11396,7 +11396,7 @@ static int i40e_setup_misc_vector(struct i40e_pf *pf)
+ 
+ 	/* associate no queues to the misc vector */
+ 	wr32(hw, I40E_PFINT_LNKLST0, I40E_QUEUE_END_OF_LIST);
+-	wr32(hw, I40E_PFINT_ITR0(I40E_RX_ITR), I40E_ITR_8K);
++	wr32(hw, I40E_PFINT_ITR0(I40E_RX_ITR), I40E_ITR_8K >> 1);
+ 
+ 	i40e_flush(hw);
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/i40e-wrong-advertised-fec-modes-after-set-fec-to-aut.patch b/queue-5.4/i40e-wrong-advertised-fec-modes-after-set-fec-to-aut.patch
new file mode 100644
index 00000000000..5155d570727
--- /dev/null
+++ b/queue-5.4/i40e-wrong-advertised-fec-modes-after-set-fec-to-aut.patch
@@ -0,0 +1,121 @@
+From 15be8578ec99c6aa20e282b1cb9ac73db81ec375 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Sep 2019 02:17:17 -0700
+Subject: i40e: Wrong 'Advertised FEC modes' after set FEC to AUTO
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jaroslaw Gawin <jaroslawx.gawin@intel.com>
+
+[ Upstream commit e42b7e9cefca9dd008cbafffca97285cf264f72d ]
+
+Fix display of parameters "Configured FEC encodings:" and "Advertised
+FEC modes:" in ethtool.  Implemented by setting proper FEC bits in
+“advertising” bitmask of link_modes struct and “fec” bitmask in
+ethtool_fecparam struct. Without this patch wrong FEC settings
+can be shown.
+
+Signed-off-by: Jaroslaw Gawin <jaroslawx.gawin@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_common.c | 13 ++++++--
+ .../net/ethernet/intel/i40e/i40e_ethtool.c    | 32 +++++++++----------
+ 2 files changed, 26 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_common.c b/drivers/net/ethernet/intel/i40e/i40e_common.c
+index 7560f06768e0..3160b5bbe672 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_common.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_common.c
+@@ -2571,9 +2571,16 @@ noinline_for_stack i40e_status i40e_update_link_info(struct i40e_hw *hw)
+ 		if (status)
+ 			return status;
+ 
+-		hw->phy.link_info.req_fec_info =
+-			abilities.fec_cfg_curr_mod_ext_info &
+-			(I40E_AQ_REQUEST_FEC_KR | I40E_AQ_REQUEST_FEC_RS);
++		if (abilities.fec_cfg_curr_mod_ext_info &
++		    I40E_AQ_ENABLE_FEC_AUTO)
++			hw->phy.link_info.req_fec_info =
++				(I40E_AQ_REQUEST_FEC_KR |
++				 I40E_AQ_REQUEST_FEC_RS);
++		else
++			hw->phy.link_info.req_fec_info =
++				abilities.fec_cfg_curr_mod_ext_info &
++				(I40E_AQ_REQUEST_FEC_KR |
++				 I40E_AQ_REQUEST_FEC_RS);
+ 
+ 		memcpy(hw->phy.link_info.module_type, &abilities.module_type,
+ 		       sizeof(hw->phy.link_info.module_type));
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+index 41e1240acaea..b577e6adf3bf 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+@@ -722,7 +722,14 @@ static void i40e_get_settings_link_up_fec(u8 req_fec_info,
+ 	ethtool_link_ksettings_add_link_mode(ks, supported, FEC_RS);
+ 	ethtool_link_ksettings_add_link_mode(ks, supported, FEC_BASER);
+ 
+-	if (I40E_AQ_SET_FEC_REQUEST_RS & req_fec_info) {
++	if ((I40E_AQ_SET_FEC_REQUEST_RS & req_fec_info) &&
++	    (I40E_AQ_SET_FEC_REQUEST_KR & req_fec_info)) {
++		ethtool_link_ksettings_add_link_mode(ks, advertising,
++						     FEC_NONE);
++		ethtool_link_ksettings_add_link_mode(ks, advertising,
++						     FEC_BASER);
++		ethtool_link_ksettings_add_link_mode(ks, advertising, FEC_RS);
++	} else if (I40E_AQ_SET_FEC_REQUEST_RS & req_fec_info) {
+ 		ethtool_link_ksettings_add_link_mode(ks, advertising, FEC_RS);
+ 	} else if (I40E_AQ_SET_FEC_REQUEST_KR & req_fec_info) {
+ 		ethtool_link_ksettings_add_link_mode(ks, advertising,
+@@ -730,12 +737,6 @@ static void i40e_get_settings_link_up_fec(u8 req_fec_info,
+ 	} else {
+ 		ethtool_link_ksettings_add_link_mode(ks, advertising,
+ 						     FEC_NONE);
+-		if (I40E_AQ_SET_FEC_AUTO & req_fec_info) {
+-			ethtool_link_ksettings_add_link_mode(ks, advertising,
+-							     FEC_RS);
+-			ethtool_link_ksettings_add_link_mode(ks, advertising,
+-							     FEC_BASER);
+-		}
+ 	}
+ }
+ 
+@@ -1437,6 +1438,7 @@ static int i40e_get_fec_param(struct net_device *netdev,
+ 	struct i40e_hw *hw = &pf->hw;
+ 	i40e_status status = 0;
+ 	int err = 0;
++	u8 fec_cfg;
+ 
+ 	/* Get the current phy config */
+ 	memset(&abilities, 0, sizeof(abilities));
+@@ -1448,18 +1450,16 @@ static int i40e_get_fec_param(struct net_device *netdev,
+ 	}
+ 
+ 	fecparam->fec = 0;
+-	if (abilities.fec_cfg_curr_mod_ext_info & I40E_AQ_SET_FEC_AUTO)
++	fec_cfg = abilities.fec_cfg_curr_mod_ext_info;
++	if (fec_cfg & I40E_AQ_SET_FEC_AUTO)
+ 		fecparam->fec |= ETHTOOL_FEC_AUTO;
+-	if ((abilities.fec_cfg_curr_mod_ext_info &
+-	     I40E_AQ_SET_FEC_REQUEST_RS) ||
+-	    (abilities.fec_cfg_curr_mod_ext_info &
+-	     I40E_AQ_SET_FEC_ABILITY_RS))
++	else if (fec_cfg & (I40E_AQ_SET_FEC_REQUEST_RS |
++		 I40E_AQ_SET_FEC_ABILITY_RS))
+ 		fecparam->fec |= ETHTOOL_FEC_RS;
+-	if ((abilities.fec_cfg_curr_mod_ext_info &
+-	     I40E_AQ_SET_FEC_REQUEST_KR) ||
+-	    (abilities.fec_cfg_curr_mod_ext_info & I40E_AQ_SET_FEC_ABILITY_KR))
++	else if (fec_cfg & (I40E_AQ_SET_FEC_REQUEST_KR |
++		 I40E_AQ_SET_FEC_ABILITY_KR))
+ 		fecparam->fec |= ETHTOOL_FEC_BASER;
+-	if (abilities.fec_cfg_curr_mod_ext_info == 0)
++	if (fec_cfg == 0)
+ 		fecparam->fec |= ETHTOOL_FEC_OFF;
+ 
+ 	if (hw->phy.link_info.fec_info & I40E_AQ_CONFIG_FEC_KR_ENA)
+-- 
+2.20.1
+
diff --git a/queue-5.4/ib-iser-bound-protection_sg-size-by-data_sg-size.patch b/queue-5.4/ib-iser-bound-protection_sg-size-by-data_sg-size.patch
new file mode 100644
index 00000000000..3f73f5a22a0
--- /dev/null
+++ b/queue-5.4/ib-iser-bound-protection_sg-size-by-data_sg-size.patch
@@ -0,0 +1,40 @@
+From cd404eb215f391edaea57b4f62a0fd4b02047aaf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Sep 2019 00:03:47 +0300
+Subject: IB/iser: bound protection_sg size by data_sg size
+
+From: Max Gurtovoy <maxg@mellanox.com>
+
+[ Upstream commit 7718cf03c3ce4b6ebd90107643ccd01c952a1fce ]
+
+In case we don't set the sg_prot_tablesize, the scsi layer assign the
+default size (65535 entries). We should limit this size since we should
+take into consideration the underlaying device capability. This cap is
+considered when calculating the sg_tablesize. Otherwise, for example,
+we can get that /sys/block/sdb/queue/max_segments is 128 and
+/sys/block/sdb/queue/max_integrity_segments is 65535.
+
+Link: https://lore.kernel.org/r/1569359027-10987-1-git-send-email-maxg@mellanox.com
+Signed-off-by: Max Gurtovoy <maxg@mellanox.com>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/iser/iscsi_iser.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.c b/drivers/infiniband/ulp/iser/iscsi_iser.c
+index 2e72fc5af157..c4c015c60446 100644
+--- a/drivers/infiniband/ulp/iser/iscsi_iser.c
++++ b/drivers/infiniband/ulp/iser/iscsi_iser.c
+@@ -646,6 +646,7 @@ iscsi_iser_session_create(struct iscsi_endpoint *ep,
+ 		if (ib_conn->pi_support) {
+ 			u32 sig_caps = ib_dev->attrs.sig_prot_cap;
+ 
++			shost->sg_prot_tablesize = shost->sg_tablesize;
+ 			scsi_host_set_prot(shost, iser_dif_prot_caps(sig_caps));
+ 			scsi_host_set_guard(shost, SHOST_DIX_GUARD_IP |
+ 						   SHOST_DIX_GUARD_CRC);
+-- 
+2.20.1
+
diff --git a/queue-5.4/ibmvnic-fix-completion-structure-initialization.patch b/queue-5.4/ibmvnic-fix-completion-structure-initialization.patch
new file mode 100644
index 00000000000..c5e733c6cdb
--- /dev/null
+++ b/queue-5.4/ibmvnic-fix-completion-structure-initialization.patch
@@ -0,0 +1,109 @@
+From 76d4f814aeebd82ad36f0a0970599f8ae61dcc7a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Nov 2019 17:12:53 -0600
+Subject: ibmvnic: Fix completion structure initialization
+
+From: Thomas Falcon <tlfalcon@linux.ibm.com>
+
+[ Upstream commit 070eca955c4af1248cb78a216463ff757a5dc511 ]
+
+Fix multiple calls to init_completion for device completion
+structures. Instead, initialize them during device probe and
+reinitialize them later as needed.
+
+Signed-off-by: Thomas Falcon <tlfalcon@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 19 +++++++++++--------
+ 1 file changed, 11 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index 0686ded7ad3a..e1ab2feeae53 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -176,7 +176,7 @@ static int alloc_long_term_buff(struct ibmvnic_adapter *adapter,
+ 	ltb->map_id = adapter->map_id;
+ 	adapter->map_id++;
+ 
+-	init_completion(&adapter->fw_done);
++	reinit_completion(&adapter->fw_done);
+ 	rc = send_request_map(adapter, ltb->addr,
+ 			      ltb->size, ltb->map_id);
+ 	if (rc) {
+@@ -215,7 +215,7 @@ static int reset_long_term_buff(struct ibmvnic_adapter *adapter,
+ 
+ 	memset(ltb->buff, 0, ltb->size);
+ 
+-	init_completion(&adapter->fw_done);
++	reinit_completion(&adapter->fw_done);
+ 	rc = send_request_map(adapter, ltb->addr, ltb->size, ltb->map_id);
+ 	if (rc)
+ 		return rc;
+@@ -943,7 +943,7 @@ static int ibmvnic_get_vpd(struct ibmvnic_adapter *adapter)
+ 	if (adapter->vpd->buff)
+ 		len = adapter->vpd->len;
+ 
+-	init_completion(&adapter->fw_done);
++	reinit_completion(&adapter->fw_done);
+ 	crq.get_vpd_size.first = IBMVNIC_CRQ_CMD;
+ 	crq.get_vpd_size.cmd = GET_VPD_SIZE;
+ 	rc = ibmvnic_send_crq(adapter, &crq);
+@@ -1689,7 +1689,7 @@ static int __ibmvnic_set_mac(struct net_device *netdev, u8 *dev_addr)
+ 	crq.change_mac_addr.cmd = CHANGE_MAC_ADDR;
+ 	ether_addr_copy(&crq.change_mac_addr.mac_addr[0], dev_addr);
+ 
+-	init_completion(&adapter->fw_done);
++	reinit_completion(&adapter->fw_done);
+ 	rc = ibmvnic_send_crq(adapter, &crq);
+ 	if (rc) {
+ 		rc = -EIO;
+@@ -2316,7 +2316,7 @@ static int wait_for_reset(struct ibmvnic_adapter *adapter)
+ 	adapter->fallback.rx_entries = adapter->req_rx_add_entries_per_subcrq;
+ 	adapter->fallback.tx_entries = adapter->req_tx_entries_per_subcrq;
+ 
+-	init_completion(&adapter->reset_done);
++	reinit_completion(&adapter->reset_done);
+ 	adapter->wait_for_reset = true;
+ 	rc = ibmvnic_reset(adapter, VNIC_RESET_CHANGE_PARAM);
+ 	if (rc)
+@@ -2332,7 +2332,7 @@ static int wait_for_reset(struct ibmvnic_adapter *adapter)
+ 		adapter->desired.rx_entries = adapter->fallback.rx_entries;
+ 		adapter->desired.tx_entries = adapter->fallback.tx_entries;
+ 
+-		init_completion(&adapter->reset_done);
++		reinit_completion(&adapter->reset_done);
+ 		adapter->wait_for_reset = true;
+ 		rc = ibmvnic_reset(adapter, VNIC_RESET_CHANGE_PARAM);
+ 		if (rc)
+@@ -2603,7 +2603,7 @@ static void ibmvnic_get_ethtool_stats(struct net_device *dev,
+ 	    cpu_to_be32(sizeof(struct ibmvnic_statistics));
+ 
+ 	/* Wait for data to be written */
+-	init_completion(&adapter->stats_done);
++	reinit_completion(&adapter->stats_done);
+ 	rc = ibmvnic_send_crq(adapter, &crq);
+ 	if (rc)
+ 		return;
+@@ -4408,7 +4408,7 @@ static int send_query_phys_parms(struct ibmvnic_adapter *adapter)
+ 	memset(&crq, 0, sizeof(crq));
+ 	crq.query_phys_parms.first = IBMVNIC_CRQ_CMD;
+ 	crq.query_phys_parms.cmd = QUERY_PHYS_PARMS;
+-	init_completion(&adapter->fw_done);
++	reinit_completion(&adapter->fw_done);
+ 	rc = ibmvnic_send_crq(adapter, &crq);
+ 	if (rc)
+ 		return rc;
+@@ -4960,6 +4960,9 @@ static int ibmvnic_probe(struct vio_dev *dev, const struct vio_device_id *id)
+ 	INIT_LIST_HEAD(&adapter->rwi_list);
+ 	spin_lock_init(&adapter->rwi_lock);
+ 	init_completion(&adapter->init_done);
++	init_completion(&adapter->fw_done);
++	init_completion(&adapter->reset_done);
++	init_completion(&adapter->stats_done);
+ 	clear_bit(0, &adapter->resetting);
+ 
+ 	do {
+-- 
+2.20.1
+
diff --git a/queue-5.4/ice-check-for-null-pointer-dereference-when-setting-.patch b/queue-5.4/ice-check-for-null-pointer-dereference-when-setting-.patch
new file mode 100644
index 00000000000..9234f8ad551
--- /dev/null
+++ b/queue-5.4/ice-check-for-null-pointer-dereference-when-setting-.patch
@@ -0,0 +1,58 @@
+From 49321e359898565deb0dc9761cd588382792a180 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2019 07:09:47 -0700
+Subject: ice: Check for null pointer dereference when setting rings
+
+From: Michal Swiatkowski <michal.swiatkowski@intel.com>
+
+[ Upstream commit eb0ee8abfeb9ff4b98e8e40217b8667bfb08587a ]
+
+Without this check rebuild vsi can lead to kernel panic.
+
+Signed-off-by: Michal Swiatkowski <michal.swiatkowski@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_main.c | 18 ++++++++++++++----
+ 1 file changed, 14 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
+index 214cd6eca405..2408f0de95fc 100644
+--- a/drivers/net/ethernet/intel/ice/ice_main.c
++++ b/drivers/net/ethernet/intel/ice/ice_main.c
+@@ -3970,8 +3970,13 @@ int ice_vsi_setup_tx_rings(struct ice_vsi *vsi)
+ 	}
+ 
+ 	ice_for_each_txq(vsi, i) {
+-		vsi->tx_rings[i]->netdev = vsi->netdev;
+-		err = ice_setup_tx_ring(vsi->tx_rings[i]);
++		struct ice_ring *ring = vsi->tx_rings[i];
++
++		if (!ring)
++			return -EINVAL;
++
++		ring->netdev = vsi->netdev;
++		err = ice_setup_tx_ring(ring);
+ 		if (err)
+ 			break;
+ 	}
+@@ -3996,8 +4001,13 @@ int ice_vsi_setup_rx_rings(struct ice_vsi *vsi)
+ 	}
+ 
+ 	ice_for_each_rxq(vsi, i) {
+-		vsi->rx_rings[i]->netdev = vsi->netdev;
+-		err = ice_setup_rx_ring(vsi->rx_rings[i]);
++		struct ice_ring *ring = vsi->rx_rings[i];
++
++		if (!ring)
++			return -EINVAL;
++
++		ring->netdev = vsi->netdev;
++		err = ice_setup_rx_ring(ring);
+ 		if (err)
+ 			break;
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-5.4/ice-delay-less.patch b/queue-5.4/ice-delay-less.patch
new file mode 100644
index 00000000000..b99de378a1a
--- /dev/null
+++ b/queue-5.4/ice-delay-less.patch
@@ -0,0 +1,60 @@
+From 4095fde4f5d159d05b943f3e3a94713ef57299a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Nov 2019 02:05:36 -0800
+Subject: ice: delay less
+
+From: Mitch Williams <mitch.a.williams@intel.com>
+
+[ Upstream commit 88bb432a55de8ae62106305083a8bfbb23b01ad2 ]
+
+Shorten the delay for SQ responses, but increase the number of loops.
+Max delay time is unchanged, but some operations complete much more
+quickly.
+
+In the process, add a new define to make the delay count and delay time
+more explicit. Add comments to make things more explicit.
+
+This fixes a problem with VF resets failing on with many VFs.
+
+Signed-off-by: Mitch Williams <mitch.a.williams@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_controlq.c | 2 +-
+ drivers/net/ethernet/intel/ice/ice_controlq.h | 5 +++--
+ 2 files changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_controlq.c b/drivers/net/ethernet/intel/ice/ice_controlq.c
+index 2353166c654e..c68709c7ef81 100644
+--- a/drivers/net/ethernet/intel/ice/ice_controlq.c
++++ b/drivers/net/ethernet/intel/ice/ice_controlq.c
+@@ -948,7 +948,7 @@ ice_sq_send_cmd(struct ice_hw *hw, struct ice_ctl_q_info *cq,
+ 		if (ice_sq_done(hw, cq))
+ 			break;
+ 
+-		mdelay(1);
++		udelay(ICE_CTL_Q_SQ_CMD_USEC);
+ 		total_delay++;
+ 	} while (total_delay < cq->sq_cmd_timeout);
+ 
+diff --git a/drivers/net/ethernet/intel/ice/ice_controlq.h b/drivers/net/ethernet/intel/ice/ice_controlq.h
+index 44945c2165d8..4df9da359135 100644
+--- a/drivers/net/ethernet/intel/ice/ice_controlq.h
++++ b/drivers/net/ethernet/intel/ice/ice_controlq.h
+@@ -31,8 +31,9 @@ enum ice_ctl_q {
+ 	ICE_CTL_Q_MAILBOX,
+ };
+ 
+-/* Control Queue default settings */
+-#define ICE_CTL_Q_SQ_CMD_TIMEOUT	250  /* msecs */
++/* Control Queue timeout settings - max delay 250ms */
++#define ICE_CTL_Q_SQ_CMD_TIMEOUT	2500  /* Count 2500 times */
++#define ICE_CTL_Q_SQ_CMD_USEC		100   /* Check every 100usec */
+ 
+ struct ice_ctl_q_ring {
+ 	void *dma_head;			/* Virtual address to DMA head */
+-- 
+2.20.1
+
diff --git a/queue-5.4/ice-fix-setting-coalesce-to-handle-dcb-configuration.patch b/queue-5.4/ice-fix-setting-coalesce-to-handle-dcb-configuration.patch
new file mode 100644
index 00000000000..7094ce6ad63
--- /dev/null
+++ b/queue-5.4/ice-fix-setting-coalesce-to-handle-dcb-configuration.patch
@@ -0,0 +1,51 @@
+From 84e97205b5d4dc40730f14e179558a700cc1eee6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Nov 2019 06:23:23 -0800
+Subject: ice: Fix setting coalesce to handle DCB configuration
+
+From: Brett Creeley <brett.creeley@intel.com>
+
+[ Upstream commit e25f9152bc07de534b2b590ce6c052ea25dd8900 ]
+
+Currently there can be a case where a DCB map is applied and there are
+more interrupt vectors (vsi->num_q_vectors) than Rx queues (vsi->num_rxq)
+and Tx queues (vsi->num_txq). If we try to set coalesce settings in this
+case it will report a false failure. Fix this by checking if vector index
+is valid with respect to the number of Tx and Rx queues configured.
+
+Signed-off-by: Brett Creeley <brett.creeley@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_ethtool.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c
+index 7e23034df955..1fe9f6050635 100644
+--- a/drivers/net/ethernet/intel/ice/ice_ethtool.c
++++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c
+@@ -3368,10 +3368,17 @@ __ice_set_coalesce(struct net_device *netdev, struct ethtool_coalesce *ec,
+ 	struct ice_vsi *vsi = np->vsi;
+ 
+ 	if (q_num < 0) {
+-		int i;
++		int v_idx;
++
++		ice_for_each_q_vector(vsi, v_idx) {
++			/* In some cases if DCB is configured the num_[rx|tx]q
++			 * can be less than vsi->num_q_vectors. This check
++			 * accounts for that so we don't report a false failure
++			 */
++			if (v_idx >= vsi->num_rxq && v_idx >= vsi->num_txq)
++				goto set_complete;
+ 
+-		ice_for_each_q_vector(vsi, i) {
+-			if (ice_set_q_coalesce(vsi, ec, i))
++			if (ice_set_q_coalesce(vsi, ec, v_idx))
+ 				return -EINVAL;
+ 		}
+ 		goto set_complete;
+-- 
+2.20.1
+
diff --git a/queue-5.4/ice-only-disable-vf-state-when-freeing-each-vf-resou.patch b/queue-5.4/ice-only-disable-vf-state-when-freeing-each-vf-resou.patch
new file mode 100644
index 00000000000..277d9df19de
--- /dev/null
+++ b/queue-5.4/ice-only-disable-vf-state-when-freeing-each-vf-resou.patch
@@ -0,0 +1,59 @@
+From 693b9db1fc760c3532c059e33d4760864e62126a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Nov 2019 06:23:22 -0800
+Subject: ice: Only disable VF state when freeing each VF resources
+
+From: Akeem G Abodunrin <akeem.g.abodunrin@intel.com>
+
+[ Upstream commit 1f9639d2fb9188a59acafae9dea626391c442a8d ]
+
+It is wrong to set PF disable state flag for all VFs when freeing VF
+resources - Instead, we should set VF disable state flag for each VF with
+its resources being returned to the device. Right now, all VF opcodes,
+mailbox communication to clear its resources as well fails - since we
+already indicate that PF is in disable state, with all VFs not active. In
+addition, we don't need to notify VF that PF is intending to reset it, if
+it is already in disabled state.
+
+Signed-off-by: Akeem G Abodunrin <akeem.g.abodunrin@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c b/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c
+index b45797f39b2f..c0637a0cbfe8 100644
+--- a/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c
++++ b/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c
+@@ -317,8 +317,9 @@ void ice_free_vfs(struct ice_pf *pf)
+ 	pf->num_alloc_vfs = 0;
+ 	for (i = 0; i < tmp; i++) {
+ 		if (test_bit(ICE_VF_STATE_INIT, pf->vf[i].vf_states)) {
+-			/* disable VF qp mappings */
++			/* disable VF qp mappings and set VF disable state */
+ 			ice_dis_vf_mappings(&pf->vf[i]);
++			set_bit(ICE_VF_STATE_DIS, pf->vf[i].vf_states);
+ 			ice_free_vf_res(&pf->vf[i]);
+ 		}
+ 	}
+@@ -1287,9 +1288,12 @@ static void ice_vc_notify_vf_reset(struct ice_vf *vf)
+ 	if (!vf || vf->vf_id >= vf->pf->num_alloc_vfs)
+ 		return;
+ 
+-	/* verify if the VF is in either init or active before proceeding */
+-	if (!test_bit(ICE_VF_STATE_INIT, vf->vf_states) &&
+-	    !test_bit(ICE_VF_STATE_ACTIVE, vf->vf_states))
++	/* Bail out if VF is in disabled state, neither initialized, nor active
++	 * state - otherwise proceed with notifications
++	 */
++	if ((!test_bit(ICE_VF_STATE_INIT, vf->vf_states) &&
++	     !test_bit(ICE_VF_STATE_ACTIVE, vf->vf_states)) ||
++	    test_bit(ICE_VF_STATE_DIS, vf->vf_states))
+ 		return;
+ 
+ 	pfe.event = VIRTCHNL_EVENT_RESET_IMPENDING;
+-- 
+2.20.1
+
diff --git a/queue-5.4/iio-adc-max1027-reset-the-device-at-probe-time.patch b/queue-5.4/iio-adc-max1027-reset-the-device-at-probe-time.patch
new file mode 100644
index 00000000000..a2fdf6e3ebd
--- /dev/null
+++ b/queue-5.4/iio-adc-max1027-reset-the-device-at-probe-time.patch
@@ -0,0 +1,42 @@
+From 2ca9a2fcfb14dd35ea6b1a0c67f9eaf5163de99d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Oct 2019 16:43:42 +0200
+Subject: iio: adc: max1027: Reset the device at probe time
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+[ Upstream commit db033831b4f5589f9fcbadb837614a7c4eac0308 ]
+
+All the registers are configured by the driver, let's reset the chip
+at probe time, avoiding any conflict with a possible earlier
+configuration.
+
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/max1027.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/iio/adc/max1027.c b/drivers/iio/adc/max1027.c
+index 214883458582..e3be8eedd773 100644
+--- a/drivers/iio/adc/max1027.c
++++ b/drivers/iio/adc/max1027.c
+@@ -458,6 +458,14 @@ static int max1027_probe(struct spi_device *spi)
+ 		return ret;
+ 	}
+ 
++	/* Internal reset */
++	st->reg = MAX1027_RST_REG;
++	ret = spi_write(st->spi, &st->reg, 1);
++	if (ret < 0) {
++		dev_err(&indio_dev->dev, "Failed to reset the ADC\n");
++		return ret;
++	}
++
+ 	/* Disable averaging */
+ 	st->reg = MAX1027_AVG_REG;
+ 	ret = spi_write(st->spi, &st->reg, 1);
+-- 
+2.20.1
+
diff --git a/queue-5.4/iio-cros_ec_baro-set-info_mask_shared_by_all_availab.patch b/queue-5.4/iio-cros_ec_baro-set-info_mask_shared_by_all_availab.patch
new file mode 100644
index 00000000000..d50135b9617
--- /dev/null
+++ b/queue-5.4/iio-cros_ec_baro-set-info_mask_shared_by_all_availab.patch
@@ -0,0 +1,44 @@
+From 8c8f23abf1da977e8f611dee6d4a72a04fbe43f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Nov 2019 09:55:33 -0800
+Subject: iio: cros_ec_baro: set info_mask_shared_by_all_available field
+
+From: Gwendal Grignou <gwendal@chromium.org>
+
+[ Upstream commit e9a4cbcaaa391ef44d623d548ee715e77265030c ]
+
+Field was already set for light/proximity and
+accelerometer/gyroscope/magnetometer sensors.
+
+Fixes: ae7b02ad2f32 ("iio: common: cros_ec_sensors: Expose cros_ec_sensors frequency range via iio sysfs")
+Signed-off-by: Gwendal Grignou <gwendal@chromium.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/pressure/cros_ec_baro.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/iio/pressure/cros_ec_baro.c b/drivers/iio/pressure/cros_ec_baro.c
+index 2354302375de..52f53f3123b1 100644
+--- a/drivers/iio/pressure/cros_ec_baro.c
++++ b/drivers/iio/pressure/cros_ec_baro.c
+@@ -114,6 +114,7 @@ static int cros_ec_baro_write(struct iio_dev *indio_dev,
+ static const struct iio_info cros_ec_baro_info = {
+ 	.read_raw = &cros_ec_baro_read,
+ 	.write_raw = &cros_ec_baro_write,
++	.read_avail = &cros_ec_sensors_core_read_avail,
+ };
+ 
+ static int cros_ec_baro_probe(struct platform_device *pdev)
+@@ -149,6 +150,8 @@ static int cros_ec_baro_probe(struct platform_device *pdev)
+ 		BIT(IIO_CHAN_INFO_SCALE) |
+ 		BIT(IIO_CHAN_INFO_SAMP_FREQ) |
+ 		BIT(IIO_CHAN_INFO_FREQUENCY);
++	channel->info_mask_shared_by_all_available =
++		BIT(IIO_CHAN_INFO_SAMP_FREQ);
+ 	channel->scan_type.realbits = CROS_EC_SENSOR_BITS;
+ 	channel->scan_type.storagebits = CROS_EC_SENSOR_BITS;
+ 	channel->scan_type.shift = 0;
+-- 
+2.20.1
+
diff --git a/queue-5.4/iio-dac-ad5446-add-support-for-new-ad5600-dac.patch b/queue-5.4/iio-dac-ad5446-add-support-for-new-ad5600-dac.patch
new file mode 100644
index 00000000000..22959cf9a1e
--- /dev/null
+++ b/queue-5.4/iio-dac-ad5446-add-support-for-new-ad5600-dac.patch
@@ -0,0 +1,76 @@
+From 333114ee1601dcbf95d24a14c85fb023848a8574 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Nov 2019 11:47:21 +0200
+Subject: iio: dac: ad5446: Add support for new AD5600 DAC
+
+From: Stefan Popa <stefan.popa@analog.com>
+
+[ Upstream commit 6376cbe549fffb378403cee78efd26b8a2c8e450 ]
+
+The AD5600 is a single channel, 16-bit resolution, voltage output digital
+to analog converter (DAC). The AD5600 uses a 3-wire SPI interface. It is
+part of the AD5541 family of DACs.
+
+The ad5446 IIO driver implements support for some of these DACs (in the
+AD5441 family), so the change is a simple entry in this driver.
+
+Link: https://www.analog.com/media/en/technical-documentation/data-sheets/AD5600.pdf
+
+Signed-off-by: Stefan Popa <stefan.popa@analog.com>
+Signed-off-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/dac/Kconfig  | 4 ++--
+ drivers/iio/dac/ad5446.c | 6 ++++++
+ 2 files changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/iio/dac/Kconfig b/drivers/iio/dac/Kconfig
+index cc42219a64f7..979070196da9 100644
+--- a/drivers/iio/dac/Kconfig
++++ b/drivers/iio/dac/Kconfig
+@@ -60,8 +60,8 @@ config AD5446
+ 	help
+ 	  Say yes here to build support for Analog Devices AD5300, AD5301, AD5310,
+ 	  AD5311, AD5320, AD5321, AD5444, AD5446, AD5450, AD5451, AD5452, AD5453,
+-	  AD5512A, AD5541A, AD5542A, AD5543, AD5553, AD5601, AD5602, AD5611, AD5612,
+-	  AD5620, AD5621, AD5622, AD5640, AD5641, AD5660, AD5662 DACs
++	  AD5512A, AD5541A, AD5542A, AD5543, AD5553, AD5600, AD5601, AD5602, AD5611,
++	  AD5612, AD5620, AD5621, AD5622, AD5640, AD5641, AD5660, AD5662 DACs
+ 	  as well as Texas Instruments DAC081S101, DAC101S101, DAC121S101.
+ 
+ 	  To compile this driver as a module, choose M here: the
+diff --git a/drivers/iio/dac/ad5446.c b/drivers/iio/dac/ad5446.c
+index 7df8b4cc295d..61c670f7fc5f 100644
+--- a/drivers/iio/dac/ad5446.c
++++ b/drivers/iio/dac/ad5446.c
+@@ -327,6 +327,7 @@ enum ad5446_supported_spi_device_ids {
+ 	ID_AD5541A,
+ 	ID_AD5512A,
+ 	ID_AD5553,
++	ID_AD5600,
+ 	ID_AD5601,
+ 	ID_AD5611,
+ 	ID_AD5621,
+@@ -381,6 +382,10 @@ static const struct ad5446_chip_info ad5446_spi_chip_info[] = {
+ 		.channel = AD5446_CHANNEL(14, 16, 0),
+ 		.write = ad5446_write,
+ 	},
++	[ID_AD5600] = {
++		.channel = AD5446_CHANNEL(16, 16, 0),
++		.write = ad5446_write,
++	},
+ 	[ID_AD5601] = {
+ 		.channel = AD5446_CHANNEL_POWERDOWN(8, 16, 6),
+ 		.write = ad5446_write,
+@@ -448,6 +453,7 @@ static const struct spi_device_id ad5446_spi_ids[] = {
+ 	{"ad5542a", ID_AD5541A}, /* ad5541a and ad5542a are compatible */
+ 	{"ad5543", ID_AD5541A}, /* ad5541a and ad5543 are compatible */
+ 	{"ad5553", ID_AD5553},
++	{"ad5600", ID_AD5600},
+ 	{"ad5601", ID_AD5601},
+ 	{"ad5611", ID_AD5611},
+ 	{"ad5621", ID_AD5621},
+-- 
+2.20.1
+
diff --git a/queue-5.4/iio-dln2-adc-fix-iio_triggered_buffer_postenable-pos.patch b/queue-5.4/iio-dln2-adc-fix-iio_triggered_buffer_postenable-pos.patch
new file mode 100644
index 00000000000..3be0597799d
--- /dev/null
+++ b/queue-5.4/iio-dln2-adc-fix-iio_triggered_buffer_postenable-pos.patch
@@ -0,0 +1,95 @@
+From 781d115a06c9bd6b9fdfeb57a624d7d2e69a645b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Oct 2019 11:26:34 +0300
+Subject: iio: dln2-adc: fix iio_triggered_buffer_postenable() position
+
+From: Alexandru Ardelean <alexandru.ardelean@analog.com>
+
+[ Upstream commit a7bddfe2dfce1d8859422124abe1964e0ecd386e ]
+
+The iio_triggered_buffer_postenable() hook should be called first to
+attach the poll function. The iio_triggered_buffer_predisable() hook is
+called last (as is it should).
+
+This change moves iio_triggered_buffer_postenable() to be called first. It
+adds iio_triggered_buffer_predisable() on the error paths of the postenable
+hook.
+For the predisable hook, some code-paths have been changed to make sure
+that the iio_triggered_buffer_predisable() hook gets called in case there
+is an error before it.
+
+Signed-off-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/dln2-adc.c | 20 ++++++++++++++------
+ 1 file changed, 14 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/iio/adc/dln2-adc.c b/drivers/iio/adc/dln2-adc.c
+index 5fa78c273a25..65c7c9329b1c 100644
+--- a/drivers/iio/adc/dln2-adc.c
++++ b/drivers/iio/adc/dln2-adc.c
+@@ -524,6 +524,10 @@ static int dln2_adc_triggered_buffer_postenable(struct iio_dev *indio_dev)
+ 	u16 conflict;
+ 	unsigned int trigger_chan;
+ 
++	ret = iio_triggered_buffer_postenable(indio_dev);
++	if (ret)
++		return ret;
++
+ 	mutex_lock(&dln2->mutex);
+ 
+ 	/* Enable ADC */
+@@ -537,6 +541,7 @@ static int dln2_adc_triggered_buffer_postenable(struct iio_dev *indio_dev)
+ 				(int)conflict);
+ 			ret = -EBUSY;
+ 		}
++		iio_triggered_buffer_predisable(indio_dev);
+ 		return ret;
+ 	}
+ 
+@@ -550,6 +555,7 @@ static int dln2_adc_triggered_buffer_postenable(struct iio_dev *indio_dev)
+ 		mutex_unlock(&dln2->mutex);
+ 		if (ret < 0) {
+ 			dev_dbg(&dln2->pdev->dev, "Problem in %s\n", __func__);
++			iio_triggered_buffer_predisable(indio_dev);
+ 			return ret;
+ 		}
+ 	} else {
+@@ -557,12 +563,12 @@ static int dln2_adc_triggered_buffer_postenable(struct iio_dev *indio_dev)
+ 		mutex_unlock(&dln2->mutex);
+ 	}
+ 
+-	return iio_triggered_buffer_postenable(indio_dev);
++	return 0;
+ }
+ 
+ static int dln2_adc_triggered_buffer_predisable(struct iio_dev *indio_dev)
+ {
+-	int ret;
++	int ret, ret2;
+ 	struct dln2_adc *dln2 = iio_priv(indio_dev);
+ 
+ 	mutex_lock(&dln2->mutex);
+@@ -577,12 +583,14 @@ static int dln2_adc_triggered_buffer_predisable(struct iio_dev *indio_dev)
+ 	ret = dln2_adc_set_port_enabled(dln2, false, NULL);
+ 
+ 	mutex_unlock(&dln2->mutex);
+-	if (ret < 0) {
++	if (ret < 0)
+ 		dev_dbg(&dln2->pdev->dev, "Problem in %s\n", __func__);
+-		return ret;
+-	}
+ 
+-	return iio_triggered_buffer_predisable(indio_dev);
++	ret2 = iio_triggered_buffer_predisable(indio_dev);
++	if (ret == 0)
++		ret = ret2;
++
++	return ret;
+ }
+ 
+ static const struct iio_buffer_setup_ops dln2_adc_buffer_setup_ops = {
+-- 
+2.20.1
+
diff --git a/queue-5.4/iio-light-bh1750-resolve-compiler-warning-and-make-c.patch b/queue-5.4/iio-light-bh1750-resolve-compiler-warning-and-make-c.patch
new file mode 100644
index 00000000000..d1065959051
--- /dev/null
+++ b/queue-5.4/iio-light-bh1750-resolve-compiler-warning-and-make-c.patch
@@ -0,0 +1,55 @@
+From 0464d9d8c290d6bf848cf03dac4e8876e76bb7d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Sep 2019 22:24:13 +0200
+Subject: iio: light: bh1750: Resolve compiler warning and make code more
+ readable
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Krzysztof Wilczynski <kw@linux.com>
+
+[ Upstream commit f552fde983d378e7339f9ea74a25f918563bf0d3 ]
+
+Separate the declaration of struct bh1750_chip_info from definition
+of bh1750_chip_info_tbl[] in a single statement as it makes the code
+hard to read, and with the extra newline it makes it look as if the
+bh1750_chip_info_tbl[] had no explicit type.
+
+This change also resolves the following compiler warning about the
+unusual position of the static keyword that can be seen when building
+with warnings enabled (W=1):
+
+drivers/iio/light/bh1750.c:64:1: warning:
+  ‘static’ is not at beginning of declaration [-Wold-style-declaration]
+
+Related to commit 3a11fbb037a1 ("iio: light: add support for ROHM
+BH1710/BH1715/BH1721/BH1750/BH1751 ambient light sensors").
+
+Signed-off-by: Krzysztof Wilczynski <kw@linux.com>
+Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/light/bh1750.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/iio/light/bh1750.c b/drivers/iio/light/bh1750.c
+index 28347df78cff..adb5ab9e3439 100644
+--- a/drivers/iio/light/bh1750.c
++++ b/drivers/iio/light/bh1750.c
+@@ -59,9 +59,9 @@ struct bh1750_chip_info {
+ 
+ 	u16 int_time_low_mask;
+ 	u16 int_time_high_mask;
+-}
++};
+ 
+-static const bh1750_chip_info_tbl[] = {
++static const struct bh1750_chip_info bh1750_chip_info_tbl[] = {
+ 	[BH1710] = { 140, 1022, 300, 400,  250000000, 2, 0x001F, 0x03E0 },
+ 	[BH1721] = { 140, 1020, 300, 400,  250000000, 2, 0x0010, 0x03E0 },
+ 	[BH1750] = { 31,  254,  69,  1740, 57500000,  1, 0x001F, 0x00E0 },
+-- 
+2.20.1
+
diff --git a/queue-5.4/iio-max31856-add-missing-of_node-and-parent-referenc.patch b/queue-5.4/iio-max31856-add-missing-of_node-and-parent-referenc.patch
new file mode 100644
index 00000000000..f2e7bd24e4a
--- /dev/null
+++ b/queue-5.4/iio-max31856-add-missing-of_node-and-parent-referenc.patch
@@ -0,0 +1,36 @@
+From b8a22b5f669899ea98ce3e4eecbea7429972ec5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Sep 2019 14:58:17 +0200
+Subject: iio: max31856: add missing of_node and parent references to iio_dev
+
+From: Andrea Merello <andrea.merello@gmail.com>
+
+[ Upstream commit 505ea3ada665c466d0064b11b6e611b7f995517d ]
+
+Adding missing indio_dev->dev.of_node references so that, in case multiple
+max31856 are present, users can get some clues to being able to distinguish
+each of them. While at it, add also the missing parent reference.
+
+Signed-off-by: Andrea Merello <andrea.merello@gmail.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/temperature/max31856.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/iio/temperature/max31856.c b/drivers/iio/temperature/max31856.c
+index f184ba5601d9..73ed550e3fc9 100644
+--- a/drivers/iio/temperature/max31856.c
++++ b/drivers/iio/temperature/max31856.c
+@@ -284,6 +284,8 @@ static int max31856_probe(struct spi_device *spi)
+ 	spi_set_drvdata(spi, indio_dev);
+ 
+ 	indio_dev->info = &max31856_info;
++	indio_dev->dev.parent = &spi->dev;
++	indio_dev->dev.of_node = spi->dev.of_node;
+ 	indio_dev->name = id->name;
+ 	indio_dev->modes = INDIO_DIRECT_MODE;
+ 	indio_dev->channels = max31856_channels;
+-- 
+2.20.1
+
diff --git a/queue-5.4/ipmi-don-t-allow-device-module-unload-when-in-use.patch b/queue-5.4/ipmi-don-t-allow-device-module-unload-when-in-use.patch
new file mode 100644
index 00000000000..8b76a29439f
--- /dev/null
+++ b/queue-5.4/ipmi-don-t-allow-device-module-unload-when-in-use.patch
@@ -0,0 +1,136 @@
+From 1cd29483df1463f5061d68d1961641ebe95d25c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Oct 2019 10:35:56 -0500
+Subject: ipmi: Don't allow device module unload when in use
+
+From: Corey Minyard <cminyard@mvista.com>
+
+[ Upstream commit cbb79863fc3175ed5ac506465948b02a893a8235 ]
+
+If something has the IPMI driver open, don't allow the device
+module to be unloaded.  Before it would unload and the user would
+get errors on use.
+
+This change is made on user request, and it makes it consistent
+with the I2C driver, which has the same behavior.
+
+It does change things a little bit with respect to kernel users.
+If the ACPI or IPMI watchdog (or any other kernel user) has
+created a user, then the device module cannot be unloaded.  Before
+it could be unloaded,
+
+This does not affect hot-plug.  If the device goes away (it's on
+something removable that is removed or is hot-removed via sysfs)
+then it still behaves as it did before.
+
+Reported-by: tony camuso <tcamuso@redhat.com>
+Signed-off-by: Corey Minyard <cminyard@mvista.com>
+Tested-by: tony camuso <tcamuso@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/ipmi/ipmi_msghandler.c | 23 ++++++++++++++++-------
+ include/linux/ipmi_smi.h            | 12 ++++++++----
+ 2 files changed, 24 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
+index 2aab80e19ae0..3c8a559506e8 100644
+--- a/drivers/char/ipmi/ipmi_msghandler.c
++++ b/drivers/char/ipmi/ipmi_msghandler.c
+@@ -448,6 +448,8 @@ enum ipmi_stat_indexes {
+ 
+ #define IPMI_IPMB_NUM_SEQ	64
+ struct ipmi_smi {
++	struct module *owner;
++
+ 	/* What interface number are we? */
+ 	int intf_num;
+ 
+@@ -1220,6 +1222,11 @@ int ipmi_create_user(unsigned int          if_num,
+ 	if (rv)
+ 		goto out_kfree;
+ 
++	if (!try_module_get(intf->owner)) {
++		rv = -ENODEV;
++		goto out_kfree;
++	}
++
+ 	/* Note that each existing user holds a refcount to the interface. */
+ 	kref_get(&intf->refcount);
+ 
+@@ -1349,6 +1356,7 @@ static void _ipmi_destroy_user(struct ipmi_user *user)
+ 	}
+ 
+ 	kref_put(&intf->refcount, intf_free);
++	module_put(intf->owner);
+ }
+ 
+ int ipmi_destroy_user(struct ipmi_user *user)
+@@ -2459,7 +2467,7 @@ static int __get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc)
+  * been recently fetched, this will just use the cached data.  Otherwise
+  * it will run a new fetch.
+  *
+- * Except for the first time this is called (in ipmi_register_smi()),
++ * Except for the first time this is called (in ipmi_add_smi()),
+  * this will always return good data;
+  */
+ static int __bmc_get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc,
+@@ -3377,10 +3385,11 @@ static void redo_bmc_reg(struct work_struct *work)
+ 	kref_put(&intf->refcount, intf_free);
+ }
+ 
+-int ipmi_register_smi(const struct ipmi_smi_handlers *handlers,
+-		      void		       *send_info,
+-		      struct device            *si_dev,
+-		      unsigned char            slave_addr)
++int ipmi_add_smi(struct module         *owner,
++		 const struct ipmi_smi_handlers *handlers,
++		 void		       *send_info,
++		 struct device         *si_dev,
++		 unsigned char         slave_addr)
+ {
+ 	int              i, j;
+ 	int              rv;
+@@ -3406,7 +3415,7 @@ int ipmi_register_smi(const struct ipmi_smi_handlers *handlers,
+ 		return rv;
+ 	}
+ 
+-
++	intf->owner = owner;
+ 	intf->bmc = &intf->tmp_bmc;
+ 	INIT_LIST_HEAD(&intf->bmc->intfs);
+ 	mutex_init(&intf->bmc->dyn_mutex);
+@@ -3514,7 +3523,7 @@ int ipmi_register_smi(const struct ipmi_smi_handlers *handlers,
+ 
+ 	return rv;
+ }
+-EXPORT_SYMBOL(ipmi_register_smi);
++EXPORT_SYMBOL(ipmi_add_smi);
+ 
+ static void deliver_smi_err_response(struct ipmi_smi *intf,
+ 				     struct ipmi_smi_msg *msg,
+diff --git a/include/linux/ipmi_smi.h b/include/linux/ipmi_smi.h
+index 4dc66157d872..deec18b8944a 100644
+--- a/include/linux/ipmi_smi.h
++++ b/include/linux/ipmi_smi.h
+@@ -224,10 +224,14 @@ static inline int ipmi_demangle_device_id(uint8_t netfn, uint8_t cmd,
+  * is called, and the lower layer must get the interface from that
+  * call.
+  */
+-int ipmi_register_smi(const struct ipmi_smi_handlers *handlers,
+-		      void                     *send_info,
+-		      struct device            *dev,
+-		      unsigned char            slave_addr);
++int ipmi_add_smi(struct module            *owner,
++		 const struct ipmi_smi_handlers *handlers,
++		 void                     *send_info,
++		 struct device            *dev,
++		 unsigned char            slave_addr);
++
++#define ipmi_register_smi(handlers, send_info, dev, slave_addr) \
++	ipmi_add_smi(THIS_MODULE, handlers, send_info, dev, slave_addr)
+ 
+ /*
+  * Remove a low-level interface from the IPMI driver.  This will
+-- 
+2.20.1
+
diff --git a/queue-5.4/iwlwifi-check-kasprintf-return-value.patch b/queue-5.4/iwlwifi-check-kasprintf-return-value.patch
new file mode 100644
index 00000000000..55a7a02f92f
--- /dev/null
+++ b/queue-5.4/iwlwifi-check-kasprintf-return-value.patch
@@ -0,0 +1,52 @@
+From b654ade3160f1d1678d3cfdb3f3adaca7ed2bca7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Nov 2019 14:50:32 +0100
+Subject: iwlwifi: check kasprintf() return value
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 5974fbb5e10b018fdbe3c3b81cb4cc54e1105ab9 ]
+
+kasprintf() can fail, we should check the return value.
+
+Fixes: 5ed540aecc2a ("iwlwifi: use mac80211 throughput trigger")
+Fixes: 8ca151b568b6 ("iwlwifi: add the MVM driver")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/dvm/led.c | 3 +++
+ drivers/net/wireless/intel/iwlwifi/mvm/led.c | 3 +++
+ 2 files changed, 6 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/led.c b/drivers/net/wireless/intel/iwlwifi/dvm/led.c
+index dd387aba3317..e8a4d604b910 100644
+--- a/drivers/net/wireless/intel/iwlwifi/dvm/led.c
++++ b/drivers/net/wireless/intel/iwlwifi/dvm/led.c
+@@ -171,6 +171,9 @@ void iwl_leds_init(struct iwl_priv *priv)
+ 
+ 	priv->led.name = kasprintf(GFP_KERNEL, "%s-led",
+ 				   wiphy_name(priv->hw->wiphy));
++	if (!priv->led.name)
++		return;
++
+ 	priv->led.brightness_set = iwl_led_brightness_set;
+ 	priv->led.blink_set = iwl_led_blink_set;
+ 	priv->led.max_brightness = 1;
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/led.c b/drivers/net/wireless/intel/iwlwifi/mvm/led.c
+index d104da9170ca..72c4b2b8399d 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/led.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/led.c
+@@ -129,6 +129,9 @@ int iwl_mvm_leds_init(struct iwl_mvm *mvm)
+ 
+ 	mvm->led.name = kasprintf(GFP_KERNEL, "%s-led",
+ 				   wiphy_name(mvm->hw->wiphy));
++	if (!mvm->led.name)
++		return -ENOMEM;
++
+ 	mvm->led.brightness_set = iwl_led_brightness_set;
+ 	mvm->led.max_brightness = 1;
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/iwlwifi-mvm-fix-unaligned-read-of-rx_pkt_status.patch b/queue-5.4/iwlwifi-mvm-fix-unaligned-read-of-rx_pkt_status.patch
new file mode 100644
index 00000000000..3a1bffcfb5a
--- /dev/null
+++ b/queue-5.4/iwlwifi-mvm-fix-unaligned-read-of-rx_pkt_status.patch
@@ -0,0 +1,50 @@
+From 8f87aca72af93dde3a9c35f2a15ed263f34ffc04 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Nov 2019 09:28:02 +0200
+Subject: iwlwifi: mvm: fix unaligned read of rx_pkt_status
+
+From: Wang Xuerui <wangxuerui@qiniu.com>
+
+[ Upstream commit c5aaa8be29b25dfe1731e9a8b19fd91b7b789ee3 ]
+
+This is present since the introduction of iwlmvm.
+Example stack trace on MIPS:
+
+[<ffffffffc0789328>] iwl_mvm_rx_rx_mpdu+0xa8/0xb88 [iwlmvm]
+[<ffffffffc0632b40>] iwl_pcie_rx_handle+0x420/0xc48 [iwlwifi]
+
+Tested with a Wireless AC 7265 for ~6 months, confirmed to fix the
+problem. No other unaligned accesses are spotted yet.
+
+Signed-off-by: Wang Xuerui <wangxuerui@qiniu.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/rx.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
+index 0ad8ed23a455..5ee33c8ae9d2 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
+@@ -60,6 +60,7 @@
+  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+  *****************************************************************************/
++#include <asm/unaligned.h>
+ #include <linux/etherdevice.h>
+ #include <linux/skbuff.h>
+ #include "iwl-trans.h"
+@@ -357,7 +358,7 @@ void iwl_mvm_rx_rx_mpdu(struct iwl_mvm *mvm, struct napi_struct *napi,
+ 	rx_res = (struct iwl_rx_mpdu_res_start *)pkt->data;
+ 	hdr = (struct ieee80211_hdr *)(pkt->data + sizeof(*rx_res));
+ 	len = le16_to_cpu(rx_res->byte_count);
+-	rx_pkt_status = le32_to_cpup((__le32 *)
++	rx_pkt_status = get_unaligned_le32((__le32 *)
+ 		(pkt->data + sizeof(*rx_res) + len));
+ 
+ 	/* Dont use dev_alloc_skb(), we'll have enough headroom once
+-- 
+2.20.1
+
diff --git a/queue-5.4/ixgbe-protect-tx-timestamping-from-api-misuse.patch b/queue-5.4/ixgbe-protect-tx-timestamping-from-api-misuse.patch
new file mode 100644
index 00000000000..946bbf18a48
--- /dev/null
+++ b/queue-5.4/ixgbe-protect-tx-timestamping-from-api-misuse.patch
@@ -0,0 +1,46 @@
+From 0f0fb6f4819e3c70ee5b5ba2bf33cae3df8cd875 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Oct 2019 08:20:03 -0700
+Subject: ixgbe: protect TX timestamping from API misuse
+
+From: Manjunath Patil <manjunath.b.patil@oracle.com>
+
+[ Upstream commit 07066d9dc3d2326fbad8f7b0cb0120cff7b7dedb ]
+
+HW timestamping can only be requested for a packet if the NIC is first
+setup via ioctl(SIOCSHWTSTAMP). If this step was skipped, then the ixgbe
+driver still allowed TX packets to request HW timestamping. In this
+situation, we see 'clearing Tx Timestamp hang' noise in the log.
+
+Fix this by checking that the NIC is configured for HW TX timestamping
+before accepting a HW TX timestamping request.
+
+Similar-to:
+   commit 26bd4e2db06b ("igb: protect TX timestamping from API misuse")
+   commit 0a6f2f05a2f5 ("igb: Fix a test with HWTSTAMP_TX_ON")
+
+Signed-off-by: Manjunath Patil <manjunath.b.patil@oracle.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+index 91b3780ddb04..1a7203fede12 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+@@ -8639,7 +8639,8 @@ netdev_tx_t ixgbe_xmit_frame_ring(struct sk_buff *skb,
+ 
+ 	if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) &&
+ 	    adapter->ptp_clock) {
+-		if (!test_and_set_bit_lock(__IXGBE_PTP_TX_IN_PROGRESS,
++		if (adapter->tstamp_config.tx_type == HWTSTAMP_TX_ON &&
++		    !test_and_set_bit_lock(__IXGBE_PTP_TX_IN_PROGRESS,
+ 					   &adapter->state)) {
+ 			skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS;
+ 			tx_flags |= IXGBE_TX_FLAGS_TSTAMP;
+-- 
+2.20.1
+
diff --git a/queue-5.4/libata-ensure-ata_port-probe-has-completed-before-de.patch b/queue-5.4/libata-ensure-ata_port-probe-has-completed-before-de.patch
new file mode 100644
index 00000000000..930e4c1bbaf
--- /dev/null
+++ b/queue-5.4/libata-ensure-ata_port-probe-has-completed-before-de.patch
@@ -0,0 +1,95 @@
+From 9b08e9f5811d861bf475be258450dabc53338ef1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Oct 2019 18:19:52 +0800
+Subject: libata: Ensure ata_port probe has completed before detach
+
+From: John Garry <john.garry@huawei.com>
+
+[ Upstream commit 130f4caf145c3562108b245a576db30b916199d2 ]
+
+With CONFIG_DEBUG_TEST_DRIVER_REMOVE set, we may find the following WARN:
+
+[   23.452574] ------------[ cut here ]------------
+[   23.457190] WARNING: CPU: 59 PID: 1 at drivers/ata/libata-core.c:6676 ata_host_detach+0x15c/0x168
+[   23.466047] Modules linked in:
+[   23.469092] CPU: 59 PID: 1 Comm: swapper/0 Not tainted 5.4.0-rc1-00010-g5b83fd27752b-dirty #296
+[   23.477776] Hardware name: Huawei D06 /D06, BIOS Hisilicon D06 UEFI RC0 - V1.16.01 03/15/2019
+[   23.486286] pstate: a0c00009 (NzCv daif +PAN +UAO)
+[   23.491065] pc : ata_host_detach+0x15c/0x168
+[   23.495322] lr : ata_host_detach+0x88/0x168
+[   23.499491] sp : ffff800011cabb50
+[   23.502792] x29: ffff800011cabb50 x28: 0000000000000007
+[   23.508091] x27: ffff80001137f068 x26: ffff8000112c0c28
+[   23.513390] x25: 0000000000003848 x24: ffff0023ea185300
+[   23.518689] x23: 0000000000000001 x22: 00000000000014c0
+[   23.523987] x21: 0000000000013740 x20: ffff0023bdc20000
+[   23.529286] x19: 0000000000000000 x18: 0000000000000004
+[   23.534584] x17: 0000000000000001 x16: 00000000000000f0
+[   23.539883] x15: ffff0023eac13790 x14: ffff0023eb76c408
+[   23.545181] x13: 0000000000000000 x12: ffff0023eac13790
+[   23.550480] x11: ffff0023eb76c228 x10: 0000000000000000
+[   23.555779] x9 : ffff0023eac13798 x8 : 0000000040000000
+[   23.561077] x7 : 0000000000000002 x6 : 0000000000000001
+[   23.566376] x5 : 0000000000000002 x4 : 0000000000000000
+[   23.571674] x3 : ffff0023bf08a0bc x2 : 0000000000000000
+[   23.576972] x1 : 3099674201f72700 x0 : 0000000000400284
+[   23.582272] Call trace:
+[   23.584706]  ata_host_detach+0x15c/0x168
+[   23.588616]  ata_pci_remove_one+0x10/0x18
+[   23.592615]  ahci_remove_one+0x20/0x40
+[   23.596356]  pci_device_remove+0x3c/0xe0
+[   23.600267]  really_probe+0xdc/0x3e0
+[   23.603830]  driver_probe_device+0x58/0x100
+[   23.608000]  device_driver_attach+0x6c/0x90
+[   23.612169]  __driver_attach+0x84/0xc8
+[   23.615908]  bus_for_each_dev+0x74/0xc8
+[   23.619730]  driver_attach+0x20/0x28
+[   23.623292]  bus_add_driver+0x148/0x1f0
+[   23.627115]  driver_register+0x60/0x110
+[   23.630938]  __pci_register_driver+0x40/0x48
+[   23.635199]  ahci_pci_driver_init+0x20/0x28
+[   23.639372]  do_one_initcall+0x5c/0x1b0
+[   23.643199]  kernel_init_freeable+0x1a4/0x24c
+[   23.647546]  kernel_init+0x10/0x108
+[   23.651023]  ret_from_fork+0x10/0x18
+[   23.654590] ---[ end trace 634a14b675b71c13 ]---
+
+With KASAN also enabled, we may also get many use-after-free reports.
+
+The issue is that when CONFIG_DEBUG_TEST_DRIVER_REMOVE is set, we may
+attempt to detach the ata_port before it has been probed.
+
+This is because the ata_ports are async probed, meaning that there is no
+guarantee that the ata_port has probed prior to detach. When the ata_port
+does probe in this scenario, we get all sorts of issues as the detach may
+have already happened.
+
+Fix by ensuring synchronisation with async_synchronize_full(). We could
+alternatively use the cookie returned from the ata_port probe
+async_schedule() call, but that means managing the cookie, so more
+complicated.
+
+Signed-off-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/libata-core.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 28c492be0a57..74c9b3032d46 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -6708,6 +6708,9 @@ void ata_host_detach(struct ata_host *host)
+ {
+ 	int i;
+ 
++	/* Ensure ata_port probe has completed */
++	async_synchronize_full();
++
+ 	for (i = 0; i < host->n_ports; i++)
+ 		ata_port_detach(host->ports[i]);
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/libbpf-fix-call-relocation-offset-calculation-bug.patch b/queue-5.4/libbpf-fix-call-relocation-offset-calculation-bug.patch
new file mode 100644
index 00000000000..6804c9ba44b
--- /dev/null
+++ b/queue-5.4/libbpf-fix-call-relocation-offset-calculation-bug.patch
@@ -0,0 +1,238 @@
+From 531d1d7713493c034bc5c8bd0f8e4e21fecb556d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Nov 2019 14:44:47 -0800
+Subject: libbpf: Fix call relocation offset calculation bug
+
+From: Andrii Nakryiko <andriin@fb.com>
+
+[ Upstream commit a0d7da26ce86a25e97ae191cb90574ada6daea98 ]
+
+When relocating subprogram call, libbpf doesn't take into account
+relo->text_off, which comes from symbol's value. This generally works fine for
+subprograms implemented as static functions, but breaks for global functions.
+
+Taking a simplified test_pkt_access.c as an example:
+
+__attribute__ ((noinline))
+static int test_pkt_access_subprog1(volatile struct __sk_buff *skb)
+{
+        return skb->len * 2;
+}
+
+__attribute__ ((noinline))
+static int test_pkt_access_subprog2(int val, volatile struct __sk_buff *skb)
+{
+        return skb->len + val;
+}
+
+SEC("classifier/test_pkt_access")
+int test_pkt_access(struct __sk_buff *skb)
+{
+        if (test_pkt_access_subprog1(skb) != skb->len * 2)
+                return TC_ACT_SHOT;
+        if (test_pkt_access_subprog2(2, skb) != skb->len + 2)
+                return TC_ACT_SHOT;
+        return TC_ACT_UNSPEC;
+}
+
+When compiled, we get two relocations, pointing to '.text' symbol. .text has
+st_value set to 0 (it points to the beginning of .text section):
+
+0000000000000008  000000050000000a R_BPF_64_32            0000000000000000 .text
+0000000000000040  000000050000000a R_BPF_64_32            0000000000000000 .text
+
+test_pkt_access_subprog1 and test_pkt_access_subprog2 offsets (targets of two
+calls) are encoded within call instruction's imm32 part as -1 and 2,
+respectively:
+
+0000000000000000 test_pkt_access_subprog1:
+       0:       61 10 00 00 00 00 00 00 r0 = *(u32 *)(r1 + 0)
+       1:       64 00 00 00 01 00 00 00 w0 <<= 1
+       2:       95 00 00 00 00 00 00 00 exit
+
+0000000000000018 test_pkt_access_subprog2:
+       3:       61 10 00 00 00 00 00 00 r0 = *(u32 *)(r1 + 0)
+       4:       04 00 00 00 02 00 00 00 w0 += 2
+       5:       95 00 00 00 00 00 00 00 exit
+
+0000000000000000 test_pkt_access:
+       0:       bf 16 00 00 00 00 00 00 r6 = r1
+===>   1:       85 10 00 00 ff ff ff ff call -1
+       2:       bc 01 00 00 00 00 00 00 w1 = w0
+       3:       b4 00 00 00 02 00 00 00 w0 = 2
+       4:       61 62 00 00 00 00 00 00 r2 = *(u32 *)(r6 + 0)
+       5:       64 02 00 00 01 00 00 00 w2 <<= 1
+       6:       5e 21 08 00 00 00 00 00 if w1 != w2 goto +8 <LBB0_3>
+       7:       bf 61 00 00 00 00 00 00 r1 = r6
+===>   8:       85 10 00 00 02 00 00 00 call 2
+       9:       bc 01 00 00 00 00 00 00 w1 = w0
+      10:       61 62 00 00 00 00 00 00 r2 = *(u32 *)(r6 + 0)
+      11:       04 02 00 00 02 00 00 00 w2 += 2
+      12:       b4 00 00 00 ff ff ff ff w0 = -1
+      13:       1e 21 01 00 00 00 00 00 if w1 == w2 goto +1 <LBB0_3>
+      14:       b4 00 00 00 02 00 00 00 w0 = 2
+0000000000000078 LBB0_3:
+      15:       95 00 00 00 00 00 00 00 exit
+
+Now, if we compile example with global functions, the setup changes.
+Relocations are now against specifically test_pkt_access_subprog1 and
+test_pkt_access_subprog2 symbols, with test_pkt_access_subprog2 pointing 24
+bytes into its respective section (.text), i.e., 3 instructions in:
+
+0000000000000008  000000070000000a R_BPF_64_32            0000000000000000 test_pkt_access_subprog1
+0000000000000048  000000080000000a R_BPF_64_32            0000000000000018 test_pkt_access_subprog2
+
+Calls instructions now encode offsets relative to function symbols and are both
+set ot -1:
+
+0000000000000000 test_pkt_access_subprog1:
+       0:       61 10 00 00 00 00 00 00 r0 = *(u32 *)(r1 + 0)
+       1:       64 00 00 00 01 00 00 00 w0 <<= 1
+       2:       95 00 00 00 00 00 00 00 exit
+
+0000000000000018 test_pkt_access_subprog2:
+       3:       61 20 00 00 00 00 00 00 r0 = *(u32 *)(r2 + 0)
+       4:       0c 10 00 00 00 00 00 00 w0 += w1
+       5:       95 00 00 00 00 00 00 00 exit
+
+0000000000000000 test_pkt_access:
+       0:       bf 16 00 00 00 00 00 00 r6 = r1
+===>   1:       85 10 00 00 ff ff ff ff call -1
+       2:       bc 01 00 00 00 00 00 00 w1 = w0
+       3:       b4 00 00 00 02 00 00 00 w0 = 2
+       4:       61 62 00 00 00 00 00 00 r2 = *(u32 *)(r6 + 0)
+       5:       64 02 00 00 01 00 00 00 w2 <<= 1
+       6:       5e 21 09 00 00 00 00 00 if w1 != w2 goto +9 <LBB2_3>
+       7:       b4 01 00 00 02 00 00 00 w1 = 2
+       8:       bf 62 00 00 00 00 00 00 r2 = r6
+===>   9:       85 10 00 00 ff ff ff ff call -1
+      10:       bc 01 00 00 00 00 00 00 w1 = w0
+      11:       61 62 00 00 00 00 00 00 r2 = *(u32 *)(r6 + 0)
+      12:       04 02 00 00 02 00 00 00 w2 += 2
+      13:       b4 00 00 00 ff ff ff ff w0 = -1
+      14:       1e 21 01 00 00 00 00 00 if w1 == w2 goto +1 <LBB2_3>
+      15:       b4 00 00 00 02 00 00 00 w0 = 2
+0000000000000080 LBB2_3:
+      16:       95 00 00 00 00 00 00 00 exit
+
+Thus the right formula to calculate target call offset after relocation should
+take into account relocation's target symbol value (offset within section),
+call instruction's imm32 offset, and (subtracting, to get relative instruction
+offset) instruction index of call instruction itself. All that is shifted by
+number of instructions in main program, given all sub-programs are copied over
+after main program.
+
+Convert few selftests relying on bpf-to-bpf calls to use global functions
+instead of static ones.
+
+Fixes: 48cca7e44f9f ("libbpf: add support for bpf_call")
+Reported-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Andrii Nakryiko <andriin@fb.com>
+Acked-by: Yonghong Song <yhs@fb.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Link: https://lore.kernel.org/bpf/20191119224447.3781271-1-andriin@fb.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/libbpf.c                             | 8 ++++++--
+ tools/testing/selftests/bpf/progs/test_btf_haskv.c | 4 ++--
+ tools/testing/selftests/bpf/progs/test_btf_newkv.c | 4 ++--
+ tools/testing/selftests/bpf/progs/test_btf_nokv.c  | 4 ++--
+ 4 files changed, 12 insertions(+), 8 deletions(-)
+
+diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
+index a267cd0c0ce2..6a87ff9936d7 100644
+--- a/tools/lib/bpf/libbpf.c
++++ b/tools/lib/bpf/libbpf.c
+@@ -1791,9 +1791,13 @@ bpf_program__collect_reloc(struct bpf_program *prog, GElf_Shdr *shdr,
+ 				pr_warning("incorrect bpf_call opcode\n");
+ 				return -LIBBPF_ERRNO__RELOC;
+ 			}
++			if (sym.st_value % 8) {
++				pr_warn("bad call relo offset: %lu\n", sym.st_value);
++				return -LIBBPF_ERRNO__RELOC;
++			}
+ 			prog->reloc_desc[i].type = RELO_CALL;
+ 			prog->reloc_desc[i].insn_idx = insn_idx;
+-			prog->reloc_desc[i].text_off = sym.st_value;
++			prog->reloc_desc[i].text_off = sym.st_value / 8;
+ 			obj->has_pseudo_calls = true;
+ 			continue;
+ 		}
+@@ -3239,7 +3243,7 @@ bpf_program__reloc_text(struct bpf_program *prog, struct bpf_object *obj,
+ 			 prog->section_name);
+ 	}
+ 	insn = &prog->insns[relo->insn_idx];
+-	insn->imm += prog->main_prog_cnt - relo->insn_idx;
++	insn->imm += relo->text_off + prog->main_prog_cnt - relo->insn_idx;
+ 	return 0;
+ }
+ 
+diff --git a/tools/testing/selftests/bpf/progs/test_btf_haskv.c b/tools/testing/selftests/bpf/progs/test_btf_haskv.c
+index e5c79fe0ffdb..d65c61e64df2 100644
+--- a/tools/testing/selftests/bpf/progs/test_btf_haskv.c
++++ b/tools/testing/selftests/bpf/progs/test_btf_haskv.c
+@@ -25,7 +25,7 @@ struct dummy_tracepoint_args {
+ };
+ 
+ __attribute__((noinline))
+-static int test_long_fname_2(struct dummy_tracepoint_args *arg)
++int test_long_fname_2(struct dummy_tracepoint_args *arg)
+ {
+ 	struct ipv_counts *counts;
+ 	int key = 0;
+@@ -43,7 +43,7 @@ static int test_long_fname_2(struct dummy_tracepoint_args *arg)
+ }
+ 
+ __attribute__((noinline))
+-static int test_long_fname_1(struct dummy_tracepoint_args *arg)
++int test_long_fname_1(struct dummy_tracepoint_args *arg)
+ {
+ 	return test_long_fname_2(arg);
+ }
+diff --git a/tools/testing/selftests/bpf/progs/test_btf_newkv.c b/tools/testing/selftests/bpf/progs/test_btf_newkv.c
+index 5ee3622ddebb..8e83317db841 100644
+--- a/tools/testing/selftests/bpf/progs/test_btf_newkv.c
++++ b/tools/testing/selftests/bpf/progs/test_btf_newkv.c
+@@ -33,7 +33,7 @@ struct dummy_tracepoint_args {
+ };
+ 
+ __attribute__((noinline))
+-static int test_long_fname_2(struct dummy_tracepoint_args *arg)
++int test_long_fname_2(struct dummy_tracepoint_args *arg)
+ {
+ 	struct ipv_counts *counts;
+ 	int key = 0;
+@@ -56,7 +56,7 @@ static int test_long_fname_2(struct dummy_tracepoint_args *arg)
+ }
+ 
+ __attribute__((noinline))
+-static int test_long_fname_1(struct dummy_tracepoint_args *arg)
++int test_long_fname_1(struct dummy_tracepoint_args *arg)
+ {
+ 	return test_long_fname_2(arg);
+ }
+diff --git a/tools/testing/selftests/bpf/progs/test_btf_nokv.c b/tools/testing/selftests/bpf/progs/test_btf_nokv.c
+index 434188c37774..3f4422044759 100644
+--- a/tools/testing/selftests/bpf/progs/test_btf_nokv.c
++++ b/tools/testing/selftests/bpf/progs/test_btf_nokv.c
+@@ -23,7 +23,7 @@ struct dummy_tracepoint_args {
+ };
+ 
+ __attribute__((noinline))
+-static int test_long_fname_2(struct dummy_tracepoint_args *arg)
++int test_long_fname_2(struct dummy_tracepoint_args *arg)
+ {
+ 	struct ipv_counts *counts;
+ 	int key = 0;
+@@ -41,7 +41,7 @@ static int test_long_fname_2(struct dummy_tracepoint_args *arg)
+ }
+ 
+ __attribute__((noinline))
+-static int test_long_fname_1(struct dummy_tracepoint_args *arg)
++int test_long_fname_1(struct dummy_tracepoint_args *arg)
+ {
+ 	return test_long_fname_2(arg);
+ }
+-- 
+2.20.1
+
diff --git a/queue-5.4/libbpf-fix-error-handling-in-bpf_map__reuse_fd.patch b/queue-5.4/libbpf-fix-error-handling-in-bpf_map__reuse_fd.patch
new file mode 100644
index 00000000000..a73195e5b08
--- /dev/null
+++ b/queue-5.4/libbpf-fix-error-handling-in-bpf_map__reuse_fd.patch
@@ -0,0 +1,68 @@
+From ac948c4c0254fbfe26f6b389b9a9baff3a62956b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Nov 2019 12:09:37 +0100
+Subject: libbpf: Fix error handling in bpf_map__reuse_fd()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Toke Høiland-Jørgensen <toke@redhat.com>
+
+[ Upstream commit d1b4574a4b86565325ef2e545eda8dfc9aa07c60 ]
+
+bpf_map__reuse_fd() was calling close() in the error path before returning
+an error value based on errno. However, close can change errno, so that can
+lead to potentially misleading error messages. Instead, explicitly store
+errno in the err variable before each goto.
+
+Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: Andrii Nakryiko <andriin@fb.com>
+Link: https://lore.kernel.org/bpf/157269297769.394725.12634985106772698611.stgit@toke.dk
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/libbpf.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
+index e0276520171b..a267cd0c0ce2 100644
+--- a/tools/lib/bpf/libbpf.c
++++ b/tools/lib/bpf/libbpf.c
+@@ -1897,16 +1897,22 @@ int bpf_map__reuse_fd(struct bpf_map *map, int fd)
+ 		return -errno;
+ 
+ 	new_fd = open("/", O_RDONLY | O_CLOEXEC);
+-	if (new_fd < 0)
++	if (new_fd < 0) {
++		err = -errno;
+ 		goto err_free_new_name;
++	}
+ 
+ 	new_fd = dup3(fd, new_fd, O_CLOEXEC);
+-	if (new_fd < 0)
++	if (new_fd < 0) {
++		err = -errno;
+ 		goto err_close_new_fd;
++	}
+ 
+ 	err = zclose(map->fd);
+-	if (err)
++	if (err) {
++		err = -errno;
+ 		goto err_close_new_fd;
++	}
+ 	free(map->name);
+ 
+ 	map->fd = new_fd;
+@@ -1925,7 +1931,7 @@ err_close_new_fd:
+ 	close(new_fd);
+ err_free_new_name:
+ 	free(new_name);
+-	return -errno;
++	return err;
+ }
+ 
+ int bpf_map__resize(struct bpf_map *map, __u32 max_entries)
+-- 
+2.20.1
+
diff --git a/queue-5.4/libbpf-fix-negative-fd-close-in-xsk_setup_xdp_prog.patch b/queue-5.4/libbpf-fix-negative-fd-close-in-xsk_setup_xdp_prog.patch
new file mode 100644
index 00000000000..1d732c94824
--- /dev/null
+++ b/queue-5.4/libbpf-fix-negative-fd-close-in-xsk_setup_xdp_prog.patch
@@ -0,0 +1,39 @@
+From ae03f2adde73af209598a422c2383d113d367a7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Nov 2019 21:40:59 -0800
+Subject: libbpf: Fix negative FD close() in xsk_setup_xdp_prog()
+
+From: Andrii Nakryiko <andriin@fb.com>
+
+[ Upstream commit 9656b346b280c3e49c8a116c3a715f966633b161 ]
+
+Fix issue reported by static analysis (Coverity). If bpf_prog_get_fd_by_id()
+fails, xsk_lookup_bpf_maps() will fail as well and clean-up code will attempt
+close() with fd=-1. Fix by checking bpf_prog_get_fd_by_id() return result and
+exiting early.
+
+Fixes: 10a13bb40e54 ("libbpf: remove qidconf and better support external bpf programs.")
+Signed-off-by: Andrii Nakryiko <andriin@fb.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20191107054059.313884-1-andriin@fb.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/xsk.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/lib/bpf/xsk.c b/tools/lib/bpf/xsk.c
+index 9d5348086203..a73b79d29333 100644
+--- a/tools/lib/bpf/xsk.c
++++ b/tools/lib/bpf/xsk.c
+@@ -466,6 +466,8 @@ static int xsk_setup_xdp_prog(struct xsk_socket *xsk)
+ 		}
+ 	} else {
+ 		xsk->prog_fd = bpf_prog_get_fd_by_id(prog_id);
++		if (xsk->prog_fd < 0)
++			return -errno;
+ 		err = xsk_lookup_bpf_maps(xsk);
+ 		if (err) {
+ 			close(xsk->prog_fd);
+-- 
+2.20.1
+
diff --git a/queue-5.4/libbpf-fix-passing-uninitialized-bytes-to-setsockopt.patch b/queue-5.4/libbpf-fix-passing-uninitialized-bytes-to-setsockopt.patch
new file mode 100644
index 00000000000..aca5e6f706d
--- /dev/null
+++ b/queue-5.4/libbpf-fix-passing-uninitialized-bytes-to-setsockopt.patch
@@ -0,0 +1,47 @@
+From 5375f8a92ae38112f57ece55ab9320f4e32f8f87 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2019 18:49:29 +0200
+Subject: libbpf: Fix passing uninitialized bytes to setsockopt
+
+From: Ilya Maximets <i.maximets@ovn.org>
+
+[ Upstream commit 25bfef430e960e695403b5d9c8dcc11b9f5d62be ]
+
+'struct xdp_umem_reg' has 4 bytes of padding at the end that makes
+valgrind complain about passing uninitialized stack memory to the
+syscall:
+
+  Syscall param socketcall.setsockopt() points to uninitialised byte(s)
+    at 0x4E7AB7E: setsockopt (in /usr/lib64/libc-2.29.so)
+    by 0x4BDE035: xsk_umem__create@@LIBBPF_0.0.4 (xsk.c:172)
+  Uninitialised value was created by a stack allocation
+    at 0x4BDDEBA: xsk_umem__create@@LIBBPF_0.0.4 (xsk.c:140)
+
+Padding bytes appeared after introducing of a new 'flags' field.
+memset() is required to clear them.
+
+Fixes: 10d30e301732 ("libbpf: add flags to umem config")
+Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: Andrii Nakryiko <andriin@fb.com>
+Link: https://lore.kernel.org/bpf/20191009164929.17242-1-i.maximets@ovn.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/xsk.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/lib/bpf/xsk.c b/tools/lib/bpf/xsk.c
+index a902838f9fcc..9d5348086203 100644
+--- a/tools/lib/bpf/xsk.c
++++ b/tools/lib/bpf/xsk.c
+@@ -163,6 +163,7 @@ int xsk_umem__create_v0_0_4(struct xsk_umem **umem_ptr, void *umem_area,
+ 	umem->umem_area = umem_area;
+ 	xsk_set_umem_config(&umem->config, usr_config);
+ 
++	memset(&mr, 0, sizeof(mr));
+ 	mr.addr = (uintptr_t)umem_area;
+ 	mr.len = size;
+ 	mr.chunk_size = umem->config.frame_size;
+-- 
+2.20.1
+
diff --git a/queue-5.4/libbpf-fix-struct-end-padding-in-btf_dump.patch b/queue-5.4/libbpf-fix-struct-end-padding-in-btf_dump.patch
new file mode 100644
index 00000000000..4cbc90ad947
--- /dev/null
+++ b/queue-5.4/libbpf-fix-struct-end-padding-in-btf_dump.patch
@@ -0,0 +1,53 @@
+From 88e6db2896e80292a52efbbd956e0b4478c4d7b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2019 16:10:06 -0700
+Subject: libbpf: Fix struct end padding in btf_dump
+
+From: Andrii Nakryiko <andriin@fb.com>
+
+[ Upstream commit b4099769f3321a8d258a47a8b4b9d278dad28a73 ]
+
+Fix a case where explicit padding at the end of a struct is necessary
+due to non-standart alignment requirements of fields (which BTF doesn't
+capture explicitly).
+
+Fixes: 351131b51c7a ("libbpf: add btf_dump API for BTF-to-C conversion")
+Reported-by: John Fastabend <john.fastabend@gmail.com>
+Signed-off-by: Andrii Nakryiko <andriin@fb.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Tested-by: John Fastabend <john.fastabend@gmail.com>
+Link: https://lore.kernel.org/bpf/20191008231009.2991130-2-andriin@fb.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/btf_dump.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/tools/lib/bpf/btf_dump.c b/tools/lib/bpf/btf_dump.c
+index ede55fec3618..87f27e2664c5 100644
+--- a/tools/lib/bpf/btf_dump.c
++++ b/tools/lib/bpf/btf_dump.c
+@@ -876,7 +876,6 @@ static void btf_dump_emit_struct_def(struct btf_dump *d,
+ 	__u16 vlen = btf_vlen(t);
+ 
+ 	packed = is_struct ? btf_is_struct_packed(d->btf, id, t) : 0;
+-	align = packed ? 1 : btf_align_of(d->btf, id);
+ 
+ 	btf_dump_printf(d, "%s%s%s {",
+ 			is_struct ? "struct" : "union",
+@@ -906,6 +905,13 @@ static void btf_dump_emit_struct_def(struct btf_dump *d,
+ 		btf_dump_printf(d, ";");
+ 	}
+ 
++	/* pad at the end, if necessary */
++	if (is_struct) {
++		align = packed ? 1 : btf_align_of(d->btf, id);
++		btf_dump_emit_bit_padding(d, off, t->size * 8, 0, align,
++					  lvl + 1);
++	}
++
+ 	if (vlen)
+ 		btf_dump_printf(d, "\n");
+ 	btf_dump_printf(d, "%s}", pfx(lvl));
+-- 
+2.20.1
+
diff --git a/queue-5.4/libertas-fix-a-potential-null-pointer-dereference.patch b/queue-5.4/libertas-fix-a-potential-null-pointer-dereference.patch
new file mode 100644
index 00000000000..f72f3cbc76b
--- /dev/null
+++ b/queue-5.4/libertas-fix-a-potential-null-pointer-dereference.patch
@@ -0,0 +1,45 @@
+From 96ad83a66a1f87b5f6261aeae10a8d2be75da3ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Sep 2019 22:05:00 +0530
+Subject: libertas: fix a potential NULL pointer dereference
+
+From: Allen Pais <allen.pais@oracle.com>
+
+[ Upstream commit 7da413a18583baaf35dd4a8eb414fa410367d7f2 ]
+
+alloc_workqueue is not checked for errors and as a result,
+a potential NULL dereference could occur.
+
+Signed-off-by: Allen Pais <allen.pais@oracle.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/libertas/if_sdio.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/net/wireless/marvell/libertas/if_sdio.c b/drivers/net/wireless/marvell/libertas/if_sdio.c
+index 242d8845da3f..30f1025ecb9b 100644
+--- a/drivers/net/wireless/marvell/libertas/if_sdio.c
++++ b/drivers/net/wireless/marvell/libertas/if_sdio.c
+@@ -1179,6 +1179,10 @@ static int if_sdio_probe(struct sdio_func *func,
+ 
+ 	spin_lock_init(&card->lock);
+ 	card->workqueue = alloc_workqueue("libertas_sdio", WQ_MEM_RECLAIM, 0);
++	if (unlikely(!card->workqueue)) {
++		ret = -ENOMEM;
++		goto err_queue;
++	}
+ 	INIT_WORK(&card->packet_worker, if_sdio_host_to_card_worker);
+ 	init_waitqueue_head(&card->pwron_waitq);
+ 
+@@ -1230,6 +1234,7 @@ err_activate_card:
+ 	lbs_remove_card(priv);
+ free:
+ 	destroy_workqueue(card->workqueue);
++err_queue:
+ 	while (card->packets) {
+ 		packet = card->packets;
+ 		card->packets = card->packets->next;
+-- 
+2.20.1
+
diff --git a/queue-5.4/libsubcmd-use-o0-with-debug-1.patch b/queue-5.4/libsubcmd-use-o0-with-debug-1.patch
new file mode 100644
index 00000000000..100e6902790
--- /dev/null
+++ b/queue-5.4/libsubcmd-use-o0-with-debug-1.patch
@@ -0,0 +1,46 @@
+From d1b52a48dc8d40eca2b61b8bfa36f4b5993d2b27 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Oct 2019 11:34:01 +0000
+Subject: libsubcmd: Use -O0 with DEBUG=1
+
+From: James Clark <James.Clark@arm.com>
+
+[ Upstream commit 22bd8f1b5a1dd168ba4eba27cb17643a11012f5d ]
+
+When a 'make DEBUG=1' build is done, the command parser is still built
+with -O6 and is hard to step through, fix it making it use -O0 in that
+case.
+
+Signed-off-by: James Clark <james.clark@arm.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: nd <nd@arm.com>
+Link: http://lore.kernel.org/lkml/20191028113340.4282-1-james.clark@arm.com
+[ split from a larger patch ]
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/subcmd/Makefile | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/tools/lib/subcmd/Makefile b/tools/lib/subcmd/Makefile
+index 5b2cd5e58df0..5dbb0dde208c 100644
+--- a/tools/lib/subcmd/Makefile
++++ b/tools/lib/subcmd/Makefile
+@@ -28,7 +28,9 @@ ifeq ($(DEBUG),0)
+   endif
+ endif
+ 
+-ifeq ($(CC_NO_CLANG), 0)
++ifeq ($(DEBUG),1)
++  CFLAGS += -O0
++else ifeq ($(CC_NO_CLANG), 0)
+   CFLAGS += -O3
+ else
+   CFLAGS += -O6
+-- 
+2.20.1
+
diff --git a/queue-5.4/libtraceevent-fix-memory-leakage-in-copy_filter_type.patch b/queue-5.4/libtraceevent-fix-memory-leakage-in-copy_filter_type.patch
new file mode 100644
index 00000000000..1a94e0fa21b
--- /dev/null
+++ b/queue-5.4/libtraceevent-fix-memory-leakage-in-copy_filter_type.patch
@@ -0,0 +1,55 @@
+From 257518569d324104550840320fa4061ce7f23548 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Nov 2019 20:44:15 -0500
+Subject: libtraceevent: Fix memory leakage in copy_filter_type
+
+From: Hewenliang <hewenliang4@huawei.com>
+
+[ Upstream commit 10992af6bf46a2048ad964985a5b77464e5563b1 ]
+
+It is necessary to free the memory that we have allocated when error occurs.
+
+Fixes: ef3072cd1d5c ("tools lib traceevent: Get rid of die in add_filter_type()")
+Signed-off-by: Hewenliang <hewenliang4@huawei.com>
+Reviewed-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Cc: Tzvetomir Stoyanov <tstoyanov@vmware.com>
+Link: http://lore.kernel.org/lkml/20191119014415.57210-1-hewenliang4@huawei.com
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/traceevent/parse-filter.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/tools/lib/traceevent/parse-filter.c b/tools/lib/traceevent/parse-filter.c
+index 552592d153fb..f3cbf86e51ac 100644
+--- a/tools/lib/traceevent/parse-filter.c
++++ b/tools/lib/traceevent/parse-filter.c
+@@ -1473,8 +1473,10 @@ static int copy_filter_type(struct tep_event_filter *filter,
+ 	if (strcmp(str, "TRUE") == 0 || strcmp(str, "FALSE") == 0) {
+ 		/* Add trivial event */
+ 		arg = allocate_arg();
+-		if (arg == NULL)
++		if (arg == NULL) {
++			free(str);
+ 			return -1;
++		}
+ 
+ 		arg->type = TEP_FILTER_ARG_BOOLEAN;
+ 		if (strcmp(str, "TRUE") == 0)
+@@ -1483,8 +1485,11 @@ static int copy_filter_type(struct tep_event_filter *filter,
+ 			arg->boolean.value = 0;
+ 
+ 		filter_type = add_filter_type(filter, event->id);
+-		if (filter_type == NULL)
++		if (filter_type == NULL) {
++			free(str);
++			free_arg(arg);
+ 			return -1;
++		}
+ 
+ 		filter_type->filter = arg;
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/loop-fix-no-unmap-write-zeroes-request-behavior.patch b/queue-5.4/loop-fix-no-unmap-write-zeroes-request-behavior.patch
new file mode 100644
index 00000000000..8f12792576a
--- /dev/null
+++ b/queue-5.4/loop-fix-no-unmap-write-zeroes-request-behavior.patch
@@ -0,0 +1,83 @@
+From 2c142a188d734d568b7e03da0453225cc6873b15 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Oct 2019 20:29:48 -0700
+Subject: loop: fix no-unmap write-zeroes request behavior
+
+From: Darrick J. Wong <darrick.wong@oracle.com>
+
+[ Upstream commit efcfec579f6139528c9e6925eca2bc4a36da65c6 ]
+
+Currently, if the loop device receives a WRITE_ZEROES request, it asks
+the underlying filesystem to punch out the range.  This behavior is
+correct if unmapping is allowed.  However, a NOUNMAP request means that
+the caller doesn't want us to free the storage backing the range, so
+punching out the range is incorrect behavior.
+
+To satisfy a NOUNMAP | WRITE_ZEROES request, loop should ask the
+underlying filesystem to FALLOC_FL_ZERO_RANGE, which is (according to
+the fallocate documentation) required to ensure that the entire range is
+backed by real storage, which suffices for our purposes.
+
+Fixes: 19372e2769179dd ("loop: implement REQ_OP_WRITE_ZEROES")
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/loop.c | 26 ++++++++++++++++++--------
+ 1 file changed, 18 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/block/loop.c b/drivers/block/loop.c
+index f6f77eaa7217..ef6e251857c8 100644
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -417,18 +417,20 @@ out_free_page:
+ 	return ret;
+ }
+ 
+-static int lo_discard(struct loop_device *lo, struct request *rq, loff_t pos)
++static int lo_fallocate(struct loop_device *lo, struct request *rq, loff_t pos,
++			int mode)
+ {
+ 	/*
+-	 * We use punch hole to reclaim the free space used by the
+-	 * image a.k.a. discard. However we do not support discard if
+-	 * encryption is enabled, because it may give an attacker
+-	 * useful information.
++	 * We use fallocate to manipulate the space mappings used by the image
++	 * a.k.a. discard/zerorange. However we do not support this if
++	 * encryption is enabled, because it may give an attacker useful
++	 * information.
+ 	 */
+ 	struct file *file = lo->lo_backing_file;
+-	int mode = FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE;
+ 	int ret;
+ 
++	mode |= FALLOC_FL_KEEP_SIZE;
++
+ 	if ((!file->f_op->fallocate) || lo->lo_encrypt_key_size) {
+ 		ret = -EOPNOTSUPP;
+ 		goto out;
+@@ -596,9 +598,17 @@ static int do_req_filebacked(struct loop_device *lo, struct request *rq)
+ 	switch (req_op(rq)) {
+ 	case REQ_OP_FLUSH:
+ 		return lo_req_flush(lo, rq);
+-	case REQ_OP_DISCARD:
+ 	case REQ_OP_WRITE_ZEROES:
+-		return lo_discard(lo, rq, pos);
++		/*
++		 * If the caller doesn't want deallocation, call zeroout to
++		 * write zeroes the range.  Otherwise, punch them out.
++		 */
++		return lo_fallocate(lo, rq, pos,
++			(rq->cmd_flags & REQ_NOUNMAP) ?
++				FALLOC_FL_ZERO_RANGE :
++				FALLOC_FL_PUNCH_HOLE);
++	case REQ_OP_DISCARD:
++		return lo_fallocate(lo, rq, pos, FALLOC_FL_PUNCH_HOLE);
+ 	case REQ_OP_WRITE:
+ 		if (lo->transfer)
+ 			return lo_write_transfer(lo, rq, pos);
+-- 
+2.20.1
+
diff --git a/queue-5.4/mac80211-consider-qos-null-frames-for-sta_nullfunc_a.patch b/queue-5.4/mac80211-consider-qos-null-frames-for-sta_nullfunc_a.patch
new file mode 100644
index 00000000000..1c1cb2584f5
--- /dev/null
+++ b/queue-5.4/mac80211-consider-qos-null-frames-for-sta_nullfunc_a.patch
@@ -0,0 +1,50 @@
+From 1d61ed4219a403a5e6683a3b499d222f3bc78d3b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Nov 2019 21:35:38 -0800
+Subject: mac80211: consider QoS Null frames for STA_NULLFUNC_ACKED
+
+From: Thomas Pedersen <thomas@adapt-ip.com>
+
+[ Upstream commit 08a5bdde3812993cb8eb7aa9124703df0de28e4b ]
+
+Commit 7b6ddeaf27ec ("mac80211: use QoS NDP for AP probing")
+let STAs send QoS Null frames as PS triggers if the AP was
+a QoS STA.  However, the mac80211 PS stack relies on an
+interface flag IEEE80211_STA_NULLFUNC_ACKED for
+determining trigger frame ACK, which was not being set for
+acked non-QoS Null frames. The effect is an inability to
+trigger hardware sleep via IEEE80211_CONF_PS since the QoS
+Null frame was seemingly never acked.
+
+This bug only applies to drivers which set both
+IEEE80211_HW_REPORTS_TX_ACK_STATUS and
+IEEE80211_HW_PS_NULLFUNC_STACK.
+
+Detect the acked QoS Null frame to restore STA power save.
+
+Fixes: 7b6ddeaf27ec ("mac80211: use QoS NDP for AP probing")
+Signed-off-by: Thomas Pedersen <thomas@adapt-ip.com>
+Link: https://lore.kernel.org/r/20191119053538.25979-4-thomas@adapt-ip.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/status.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/mac80211/status.c b/net/mac80211/status.c
+index ab8ba5835ca0..5a3d645fe1bc 100644
+--- a/net/mac80211/status.c
++++ b/net/mac80211/status.c
+@@ -1030,7 +1030,8 @@ static void __ieee80211_tx_status(struct ieee80211_hw *hw,
+ 			I802_DEBUG_INC(local->dot11FailedCount);
+ 	}
+ 
+-	if (ieee80211_is_nullfunc(fc) && ieee80211_has_pm(fc) &&
++	if ((ieee80211_is_nullfunc(fc) || ieee80211_is_qos_nullfunc(fc)) &&
++	    ieee80211_has_pm(fc) &&
+ 	    ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS) &&
+ 	    !(info->flags & IEEE80211_TX_CTL_INJECTED) &&
+ 	    local->ps_sdata && !(local->scanning)) {
+-- 
+2.20.1
+
diff --git a/queue-5.4/md-bitmap-avoid-race-window-between-md_bitmap_resize.patch b/queue-5.4/md-bitmap-avoid-race-window-between-md_bitmap_resize.patch
new file mode 100644
index 00000000000..3879a13b3e1
--- /dev/null
+++ b/queue-5.4/md-bitmap-avoid-race-window-between-md_bitmap_resize.patch
@@ -0,0 +1,101 @@
+From 8a64e9debeecb870b5829fe5a30af9071faca8b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Sep 2019 13:53:50 +0200
+Subject: md/bitmap: avoid race window between md_bitmap_resize and
+ bitmap_file_clear_bit
+
+From: Guoqing Jiang <guoqing.jiang@cloud.ionos.com>
+
+[ Upstream commit fadcbd2901a0f7c8721f3bdb69eac95c272dc8ed ]
+
+We need to move "spin_lock_irq(&bitmap->counts.lock)" before unmap previous
+storage, otherwise panic like belows could happen as follows.
+
+[  902.353802] sdl: detected capacity change from 1077936128 to 3221225472
+[  902.616948] general protection fault: 0000 [#1] SMP
+[snip]
+[  902.618588] CPU: 12 PID: 33698 Comm: md0_raid1 Tainted: G           O    4.14.144-1-pserver #4.14.144-1.1~deb10
+[  902.618870] Hardware name: Supermicro SBA-7142G-T4/BHQGE, BIOS 3.00       10/24/2012
+[  902.619120] task: ffff9ae1860fc600 task.stack: ffffb52e4c704000
+[  902.619301] RIP: 0010:bitmap_file_clear_bit+0x90/0xd0 [md_mod]
+[  902.619464] RSP: 0018:ffffb52e4c707d28 EFLAGS: 00010087
+[  902.619626] RAX: ffe8008b0d061000 RBX: ffff9ad078c87300 RCX: 0000000000000000
+[  902.619792] RDX: ffff9ad986341868 RSI: 0000000000000803 RDI: ffff9ad078c87300
+[  902.619986] RBP: ffff9ad0ed7a8000 R08: 0000000000000000 R09: 0000000000000000
+[  902.620154] R10: ffffb52e4c707ec0 R11: ffff9ad987d1ed44 R12: ffff9ad0ed7a8360
+[  902.620320] R13: 0000000000000003 R14: 0000000000060000 R15: 0000000000000800
+[  902.620487] FS:  0000000000000000(0000) GS:ffff9ad987d00000(0000) knlGS:0000000000000000
+[  902.620738] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[  902.620901] CR2: 000055ff12aecec0 CR3: 0000001005207000 CR4: 00000000000406e0
+[  902.621068] Call Trace:
+[  902.621256]  bitmap_daemon_work+0x2dd/0x360 [md_mod]
+[  902.621429]  ? find_pers+0x70/0x70 [md_mod]
+[  902.621597]  md_check_recovery+0x51/0x540 [md_mod]
+[  902.621762]  raid1d+0x5c/0xeb0 [raid1]
+[  902.621939]  ? try_to_del_timer_sync+0x4d/0x80
+[  902.622102]  ? del_timer_sync+0x35/0x40
+[  902.622265]  ? schedule_timeout+0x177/0x360
+[  902.622453]  ? call_timer_fn+0x130/0x130
+[  902.622623]  ? find_pers+0x70/0x70 [md_mod]
+[  902.622794]  ? md_thread+0x94/0x150 [md_mod]
+[  902.622959]  md_thread+0x94/0x150 [md_mod]
+[  902.623121]  ? wait_woken+0x80/0x80
+[  902.623280]  kthread+0x119/0x130
+[  902.623437]  ? kthread_create_on_node+0x60/0x60
+[  902.623600]  ret_from_fork+0x22/0x40
+[  902.624225] RIP: bitmap_file_clear_bit+0x90/0xd0 [md_mod] RSP: ffffb52e4c707d28
+
+Because mdadm was running on another cpu to do resize, so bitmap_resize was
+called to replace bitmap as below shows.
+
+PID: 38801  TASK: ffff9ad074a90e00  CPU: 0   COMMAND: "mdadm"
+   [exception RIP: queued_spin_lock_slowpath+56]
+   [snip]
+-- <NMI exception stack> --
+ #5 [ffffb52e60f17c58] queued_spin_lock_slowpath at ffffffff9c0b27b8
+ #6 [ffffb52e60f17c58] bitmap_resize at ffffffffc0399877 [md_mod]
+ #7 [ffffb52e60f17d30] raid1_resize at ffffffffc0285bf9 [raid1]
+ #8 [ffffb52e60f17d50] update_size at ffffffffc038a31a [md_mod]
+ #9 [ffffb52e60f17d70] md_ioctl at ffffffffc0395ca4 [md_mod]
+
+And the procedure to keep resize bitmap safe is allocate new storage
+space, then quiesce, copy bits, replace bitmap, and re-start.
+
+However the daemon (bitmap_daemon_work) could happen even the array is
+quiesced, which means when bitmap_file_clear_bit is triggered by raid1d,
+then it thinks it should be fine to access store->filemap since
+counts->lock is held, but resize could change the storage without the
+protection of the lock.
+
+Cc: Jack Wang <jinpu.wang@cloud.ionos.com>
+Cc: NeilBrown <neilb@suse.com>
+Signed-off-by: Guoqing Jiang <guoqing.jiang@cloud.ionos.com>
+Signed-off-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/md-bitmap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c
+index b092c7b5282f..3ad18246fcb3 100644
+--- a/drivers/md/md-bitmap.c
++++ b/drivers/md/md-bitmap.c
+@@ -2139,6 +2139,7 @@ int md_bitmap_resize(struct bitmap *bitmap, sector_t blocks,
+ 		memcpy(page_address(store.sb_page),
+ 		       page_address(bitmap->storage.sb_page),
+ 		       sizeof(bitmap_super_t));
++	spin_lock_irq(&bitmap->counts.lock);
+ 	md_bitmap_file_unmap(&bitmap->storage);
+ 	bitmap->storage = store;
+ 
+@@ -2154,7 +2155,6 @@ int md_bitmap_resize(struct bitmap *bitmap, sector_t blocks,
+ 	blocks = min(old_counts.chunks << old_counts.chunkshift,
+ 		     chunks << chunkshift);
+ 
+-	spin_lock_irq(&bitmap->counts.lock);
+ 	/* For cluster raid, need to pre-allocate bitmap */
+ 	if (mddev_is_clustered(bitmap->mddev)) {
+ 		unsigned long page;
+-- 
+2.20.1
+
diff --git a/queue-5.4/md-no-longer-compare-spare-disk-superblock-events-in.patch b/queue-5.4/md-no-longer-compare-spare-disk-superblock-events-in.patch
new file mode 100644
index 00000000000..36fddc61f46
--- /dev/null
+++ b/queue-5.4/md-no-longer-compare-spare-disk-superblock-events-in.patch
@@ -0,0 +1,191 @@
+From 93657d728b6c382f2f3bf63fdaa204e5ba229bb5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Oct 2019 16:00:03 +0800
+Subject: md: no longer compare spare disk superblock events in super_load
+
+From: Yufen Yu <yuyufen@huawei.com>
+
+[ Upstream commit 6a5cb53aaa4ef515ddeffa04ce18b771121127b4 ]
+
+We have a test case as follow:
+
+  mdadm -CR /dev/md1 -l 1 -n 4 /dev/sd[a-d] \
+	--assume-clean --bitmap=internal
+  mdadm -S /dev/md1
+  mdadm -A /dev/md1 /dev/sd[b-c] --run --force
+
+  mdadm --zero /dev/sda
+  mdadm /dev/md1 -a /dev/sda
+
+  echo offline > /sys/block/sdc/device/state
+  echo offline > /sys/block/sdb/device/state
+  sleep 5
+  mdadm -S /dev/md1
+
+  echo running > /sys/block/sdb/device/state
+  echo running > /sys/block/sdc/device/state
+  mdadm -A /dev/md1 /dev/sd[a-c] --run --force
+
+When we readd /dev/sda to the array, it started to do recovery.
+After offline the other two disks in md1, the recovery have
+been interrupted and superblock update info cannot be written
+to the offline disks. While the spare disk (/dev/sda) can continue
+to update superblock info.
+
+After stopping the array and assemble it, we found the array
+run fail, with the follow kernel message:
+
+[  172.986064] md: kicking non-fresh sdb from array!
+[  173.004210] md: kicking non-fresh sdc from array!
+[  173.022383] md/raid1:md1: active with 0 out of 4 mirrors
+[  173.022406] md1: failed to create bitmap (-5)
+[  173.023466] md: md1 stopped.
+
+Since both sdb and sdc have the value of 'sb->events' smaller than
+that in sda, they have been kicked from the array. However, the only
+remained disk sda is in 'spare' state before stop and it cannot be
+added to conf->mirrors[] array. In the end, raid array assemble
+and run fail.
+
+In fact, we can use the older disk sdb or sdc to assemble the array.
+That means we should not choose the 'spare' disk as the fresh disk in
+analyze_sbs().
+
+To fix the problem, we do not compare superblock events when it is
+a spare disk, as same as validate_super.
+
+Signed-off-by: Yufen Yu <yuyufen@huawei.com>
+Signed-off-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/md.c | 57 +++++++++++++++++++++++++++++++++++++++++++------
+ 1 file changed, 51 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index b8dd56b746da..6f0ecfe8eab2 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -1156,7 +1156,15 @@ static int super_90_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor
+ 		rdev->desc_nr = sb->this_disk.number;
+ 
+ 	if (!refdev) {
+-		ret = 1;
++		/*
++		 * Insist on good event counter while assembling, except
++		 * for spares (which don't need an event count)
++		 */
++		if (sb->disks[rdev->desc_nr].state & (
++			(1<<MD_DISK_SYNC) | (1 << MD_DISK_ACTIVE)))
++			ret = 1;
++		else
++			ret = 0;
+ 	} else {
+ 		__u64 ev1, ev2;
+ 		mdp_super_t *refsb = page_address(refdev->sb_page);
+@@ -1172,7 +1180,14 @@ static int super_90_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor
+ 		}
+ 		ev1 = md_event(sb);
+ 		ev2 = md_event(refsb);
+-		if (ev1 > ev2)
++
++		/*
++		 * Insist on good event counter while assembling, except
++		 * for spares (which don't need an event count)
++		 */
++		if (sb->disks[rdev->desc_nr].state & (
++			(1<<MD_DISK_SYNC) | (1 << MD_DISK_ACTIVE)) &&
++			(ev1 > ev2))
+ 			ret = 1;
+ 		else
+ 			ret = 0;
+@@ -1532,6 +1547,7 @@ static int super_1_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor_
+ 	sector_t sectors;
+ 	char b[BDEVNAME_SIZE], b2[BDEVNAME_SIZE];
+ 	int bmask;
++	__u64 role;
+ 
+ 	/*
+ 	 * Calculate the position of the superblock in 512byte sectors.
+@@ -1665,8 +1681,20 @@ static int super_1_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor_
+ 	    sb->level != 0)
+ 		return -EINVAL;
+ 
++	role = le16_to_cpu(sb->dev_roles[rdev->desc_nr]);
++
+ 	if (!refdev) {
+-		ret = 1;
++		/*
++		 * Insist of good event counter while assembling, except for
++		 * spares (which don't need an event count)
++		 */
++		if (rdev->desc_nr >= 0 &&
++		    rdev->desc_nr < le32_to_cpu(sb->max_dev) &&
++			(role < MD_DISK_ROLE_MAX ||
++			 role == MD_DISK_ROLE_JOURNAL))
++			ret = 1;
++		else
++			ret = 0;
+ 	} else {
+ 		__u64 ev1, ev2;
+ 		struct mdp_superblock_1 *refsb = page_address(refdev->sb_page);
+@@ -1683,7 +1711,14 @@ static int super_1_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor_
+ 		ev1 = le64_to_cpu(sb->events);
+ 		ev2 = le64_to_cpu(refsb->events);
+ 
+-		if (ev1 > ev2)
++		/*
++		 * Insist of good event counter while assembling, except for
++		 * spares (which don't need an event count)
++		 */
++		if (rdev->desc_nr >= 0 &&
++		    rdev->desc_nr < le32_to_cpu(sb->max_dev) &&
++			(role < MD_DISK_ROLE_MAX ||
++			 role == MD_DISK_ROLE_JOURNAL) && ev1 > ev2)
+ 			ret = 1;
+ 		else
+ 			ret = 0;
+@@ -3604,7 +3639,7 @@ abort_free:
+  * Check a full RAID array for plausibility
+  */
+ 
+-static void analyze_sbs(struct mddev *mddev)
++static int analyze_sbs(struct mddev *mddev)
+ {
+ 	int i;
+ 	struct md_rdev *rdev, *freshest, *tmp;
+@@ -3625,6 +3660,12 @@ static void analyze_sbs(struct mddev *mddev)
+ 			md_kick_rdev_from_array(rdev);
+ 		}
+ 
++	/* Cannot find a valid fresh disk */
++	if (!freshest) {
++		pr_warn("md: cannot find a valid disk\n");
++		return -EINVAL;
++	}
++
+ 	super_types[mddev->major_version].
+ 		validate_super(mddev, freshest);
+ 
+@@ -3659,6 +3700,8 @@ static void analyze_sbs(struct mddev *mddev)
+ 			clear_bit(In_sync, &rdev->flags);
+ 		}
+ 	}
++
++	return 0;
+ }
+ 
+ /* Read a fixed-point number.
+@@ -5577,7 +5620,9 @@ int md_run(struct mddev *mddev)
+ 	if (!mddev->raid_disks) {
+ 		if (!mddev->persistent)
+ 			return -EINVAL;
+-		analyze_sbs(mddev);
++		err = analyze_sbs(mddev);
++		if (err)
++			return -EINVAL;
+ 	}
+ 
+ 	if (mddev->level != LEVEL_NONE)
+-- 
+2.20.1
+
diff --git a/queue-5.4/media-ad5820-define-entity-function.patch b/queue-5.4/media-ad5820-define-entity-function.patch
new file mode 100644
index 00000000000..81b2e32428b
--- /dev/null
+++ b/queue-5.4/media-ad5820-define-entity-function.patch
@@ -0,0 +1,40 @@
+From 374b0dac88b715632767aaa1460ebcf9a0410630 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Oct 2019 10:28:51 -0300
+Subject: media: ad5820: Define entity function
+
+From: Ricardo Ribalda Delgado <ribalda@kernel.org>
+
+[ Upstream commit 801ef7c4919efba6b96b5aed1e72844ca69e26d3 ]
+
+Without this patch, media_device_register_entity throws a warning:
+
+dev_warn(mdev->dev,
+	 "Entity type for entity %s was not initialized!\n",
+	 entity->name);
+
+Signed-off-by: Ricardo Ribalda Delgado <ribalda@kernel.org>
+Acked-by: Pavel Machek <pavel@ucw.cz>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ad5820.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/i2c/ad5820.c b/drivers/media/i2c/ad5820.c
+index 925c171e7797..7a49651f4d1f 100644
+--- a/drivers/media/i2c/ad5820.c
++++ b/drivers/media/i2c/ad5820.c
+@@ -309,6 +309,7 @@ static int ad5820_probe(struct i2c_client *client,
+ 	v4l2_i2c_subdev_init(&coil->subdev, client, &ad5820_ops);
+ 	coil->subdev.flags |= V4L2_SUBDEV_FL_HAS_DEVNODE;
+ 	coil->subdev.internal_ops = &ad5820_internal_ops;
++	coil->subdev.entity.function = MEDIA_ENT_F_LENS;
+ 	strscpy(coil->subdev.name, "ad5820 focus", sizeof(coil->subdev.name));
+ 
+ 	ret = media_entity_pads_init(&coil->subdev.entity, 0, NULL);
+-- 
+2.20.1
+
diff --git a/queue-5.4/media-am437x-vpfe-setting-std-to-current-value-is-no.patch b/queue-5.4/media-am437x-vpfe-setting-std-to-current-value-is-no.patch
new file mode 100644
index 00000000000..9df489260d2
--- /dev/null
+++ b/queue-5.4/media-am437x-vpfe-setting-std-to-current-value-is-no.patch
@@ -0,0 +1,40 @@
+From c167308b4ae32b206f5ebdb965dc24f9cd371965 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Sep 2019 14:05:48 -0300
+Subject: media: am437x-vpfe: Setting STD to current value is not an error
+
+From: Benoit Parrot <bparrot@ti.com>
+
+[ Upstream commit 13aa21cfe92ce9ebb51824029d89f19c33f81419 ]
+
+VIDIOC_S_STD should not return an error if the value is identical
+to the current one.
+This error was highlighted by the v4l2-compliance test.
+
+Signed-off-by: Benoit Parrot <bparrot@ti.com>
+Acked-by: Lad Prabhakar <prabhakar.csengg@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/am437x/am437x-vpfe.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/media/platform/am437x/am437x-vpfe.c b/drivers/media/platform/am437x/am437x-vpfe.c
+index 2b42ba1f5949..e13dbf27a9c2 100644
+--- a/drivers/media/platform/am437x/am437x-vpfe.c
++++ b/drivers/media/platform/am437x/am437x-vpfe.c
+@@ -1830,6 +1830,10 @@ static int vpfe_s_std(struct file *file, void *priv, v4l2_std_id std_id)
+ 	if (!(sdinfo->inputs[0].capabilities & V4L2_IN_CAP_STD))
+ 		return -ENODATA;
+ 
++	/* if trying to set the same std then nothing to do */
++	if (vpfe_standards[vpfe->std_index].std_id == std_id)
++		return 0;
++
+ 	/* If streaming is started, return error */
+ 	if (vb2_is_busy(&vpfe->buffer_queue)) {
+ 		vpfe_err(vpfe, "%s device busy\n", __func__);
+-- 
+2.20.1
+
diff --git a/queue-5.4/media-aspeed-clear-garbage-interrupts.patch b/queue-5.4/media-aspeed-clear-garbage-interrupts.patch
new file mode 100644
index 00000000000..1a7c466cfe6
--- /dev/null
+++ b/queue-5.4/media-aspeed-clear-garbage-interrupts.patch
@@ -0,0 +1,82 @@
+From ad1c67ca3f45fd64a33cfcc742d27d0dc7906cbe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Sep 2019 19:27:43 -0300
+Subject: media: aspeed: clear garbage interrupts
+
+From: Jae Hyun Yoo <jae.hyun.yoo@intel.com>
+
+[ Upstream commit 65d270acb2d662c3346793663ac3a759eb4491b8 ]
+
+CAPTURE_COMPLETE and FRAME_COMPLETE interrupts come even when these
+are disabled in the VE_INTERRUPT_CTRL register and eventually this
+behavior causes disabling irq itself like below:
+
+[10055.108784] irq 23: nobody cared (try booting with the "irqpoll" option)
+[10055.115525] CPU: 0 PID: 331 Comm: swampd Tainted: G        W         5.3.0-4fde000-dirty-d683e2e #1
+[10055.124565] Hardware name: Generic DT based system
+[10055.129355] Backtrace:
+[10055.131854] [<80107d7c>] (dump_backtrace) from [<80107fb0>] (show_stack+0x20/0x24)
+[10055.139431]  r7:00000017 r6:00000001 r5:00000000 r4:9d51dc00
+[10055.145120] [<80107f90>] (show_stack) from [<8074bf50>] (dump_stack+0x20/0x28)
+[10055.152361] [<8074bf30>] (dump_stack) from [<80150ffc>] (__report_bad_irq+0x40/0xc0)
+[10055.160109] [<80150fbc>] (__report_bad_irq) from [<80150f2c>] (note_interrupt+0x23c/0x294)
+[10055.168374]  r9:015b6e60 r8:00000000 r7:00000017 r6:00000001 r5:00000000 r4:9d51dc00
+[10055.176136] [<80150cf0>] (note_interrupt) from [<8014df1c>] (handle_irq_event_percpu+0x88/0x98)
+[10055.184835]  r10:7eff7910 r9:015b6e60 r8:00000000 r7:9d417600 r6:00000001 r5:00000002
+[10055.192657]  r4:9d51dc00 r3:00000000
+[10055.196248] [<8014de94>] (handle_irq_event_percpu) from [<8014df64>] (handle_irq_event+0x38/0x4c)
+[10055.205113]  r5:80b56d50 r4:9d51dc00
+[10055.208697] [<8014df2c>] (handle_irq_event) from [<80151f1c>] (handle_level_irq+0xbc/0x12c)
+[10055.217037]  r5:80b56d50 r4:9d51dc00
+[10055.220623] [<80151e60>] (handle_level_irq) from [<8014d4b8>] (generic_handle_irq+0x30/0x44)
+[10055.229052]  r5:80b56d50 r4:00000017
+[10055.232648] [<8014d488>] (generic_handle_irq) from [<8014d524>] (__handle_domain_irq+0x58/0xb4)
+[10055.241356] [<8014d4cc>] (__handle_domain_irq) from [<801021e4>] (avic_handle_irq+0x68/0x70)
+[10055.249797]  r9:015b6e60 r8:00c5387d r7:00c5387d r6:ffffffff r5:9dd33fb0 r4:9d402380
+[10055.257539] [<8010217c>] (avic_handle_irq) from [<80101e34>] (__irq_usr+0x54/0x80)
+[10055.265105] Exception stack(0x9dd33fb0 to 0x9dd33ff8)
+[10055.270152] 3fa0:                                     015d0530 00000000 00000000 015d0538
+[10055.278328] 3fc0: 015d0530 015b6e60 00000000 00000000 0052c5d0 015b6e60 7eff7910 7eff7918
+[10055.286496] 3fe0: 76ce5614 7eff7908 0050e2f4 76a3a08c 20000010 ffffffff
+[10055.293104]  r5:20000010 r4:76a3a08c
+[10055.296673] handlers:
+[10055.298967] [<79f218a5>] irq_default_primary_handler threaded [<1de88514>] aspeed_video_irq
+[10055.307344] Disabling IRQ #23
+
+To fix this issue, this commit makes the interrupt handler clear
+these garbage interrupts. This driver enables and uses only
+COMP_COMPLETE interrupt instead for frame handling.
+
+Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@intel.com>
+Reviewed-by: Eddie James <eajames@linux.ibm.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/aspeed-video.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/media/platform/aspeed-video.c b/drivers/media/platform/aspeed-video.c
+index 84e0650106f5..096a7c9a8963 100644
+--- a/drivers/media/platform/aspeed-video.c
++++ b/drivers/media/platform/aspeed-video.c
+@@ -606,6 +606,16 @@ static irqreturn_t aspeed_video_irq(int irq, void *arg)
+ 			aspeed_video_start_frame(video);
+ 	}
+ 
++	/*
++	 * CAPTURE_COMPLETE and FRAME_COMPLETE interrupts come even when these
++	 * are disabled in the VE_INTERRUPT_CTRL register so clear them to
++	 * prevent unnecessary interrupt calls.
++	 */
++	if (sts & VE_INTERRUPT_CAPTURE_COMPLETE)
++		sts &= ~VE_INTERRUPT_CAPTURE_COMPLETE;
++	if (sts & VE_INTERRUPT_FRAME_COMPLETE)
++		sts &= ~VE_INTERRUPT_FRAME_COMPLETE;
++
+ 	return sts ? IRQ_NONE : IRQ_HANDLED;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/media-aspeed-set-hsync-and-vsync-polarities-to-norma.patch b/queue-5.4/media-aspeed-set-hsync-and-vsync-polarities-to-norma.patch
new file mode 100644
index 00000000000..7a3647805b6
--- /dev/null
+++ b/queue-5.4/media-aspeed-set-hsync-and-vsync-polarities-to-norma.patch
@@ -0,0 +1,41 @@
+From b906c7eb65f396bfcb376effbee333a6d0179a2e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Sep 2019 15:11:05 -0300
+Subject: media: aspeed: set hsync and vsync polarities to normal before
+ starting mode detection
+
+From: Jae Hyun Yoo <jae.hyun.yoo@linux.intel.com>
+
+[ Upstream commit 5b3f3c41c5c791c1c22cd91655e7ef4b2a1dff7c ]
+
+Sometimes it detects a weird resolution such as 1024x287 when the
+actual resolution is 1024x768. To resolve such an issue, this
+commit adds clearing for hsync and vsync polarity register bits
+at the beginning of the first mode detection. This is recommended
+in the datasheet.
+
+Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@linux.intel.com>
+Reviewed-by: Eddie James <eajames@linux.ibm.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/aspeed-video.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/media/platform/aspeed-video.c b/drivers/media/platform/aspeed-video.c
+index eb12f3793062..84e0650106f5 100644
+--- a/drivers/media/platform/aspeed-video.c
++++ b/drivers/media/platform/aspeed-video.c
+@@ -741,6 +741,8 @@ static void aspeed_video_get_resolution(struct aspeed_video *video)
+ 		}
+ 
+ 		set_bit(VIDEO_RES_DETECT, &video->flags);
++		aspeed_video_update(video, VE_CTRL,
++				    VE_CTRL_VSYNC_POL | VE_CTRL_HSYNC_POL, 0);
+ 		aspeed_video_enable_mode_detect(video);
+ 
+ 		rc = wait_event_interruptible_timeout(video->wait,
+-- 
+2.20.1
+
diff --git a/queue-5.4/media-cec-funcs.h-add-status_req-checks.patch b/queue-5.4/media-cec-funcs.h-add-status_req-checks.patch
new file mode 100644
index 00000000000..e672cb66ba8
--- /dev/null
+++ b/queue-5.4/media-cec-funcs.h-add-status_req-checks.patch
@@ -0,0 +1,54 @@
+From 5559ad34f181640b7fec29147c8ccbe0ada1b1a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Oct 2019 04:56:38 -0300
+Subject: media: cec-funcs.h: add status_req checks
+
+From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+
+[ Upstream commit 9b211f9c5a0b67afc435b86f75d78273b97db1c5 ]
+
+The CEC_MSG_GIVE_DECK_STATUS and CEC_MSG_GIVE_TUNER_DEVICE_STATUS commands
+both have a status_req argument: ON, OFF, ONCE. If ON or ONCE, then the
+follower will reply with a STATUS message. Either once or whenever the
+status changes (status_req == ON).
+
+If status_req == OFF, then it will stop sending continuous status updates,
+but the follower will *not* send a STATUS message in that case.
+
+This means that if status_req == OFF, then msg->reply should be 0 as well
+since no reply is expected in that case.
+
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/cec-funcs.h | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/include/uapi/linux/cec-funcs.h b/include/uapi/linux/cec-funcs.h
+index 8997d5068c08..4511b85c84df 100644
+--- a/include/uapi/linux/cec-funcs.h
++++ b/include/uapi/linux/cec-funcs.h
+@@ -923,7 +923,8 @@ static inline void cec_msg_give_deck_status(struct cec_msg *msg,
+ 	msg->len = 3;
+ 	msg->msg[1] = CEC_MSG_GIVE_DECK_STATUS;
+ 	msg->msg[2] = status_req;
+-	msg->reply = reply ? CEC_MSG_DECK_STATUS : 0;
++	msg->reply = (reply && status_req != CEC_OP_STATUS_REQ_OFF) ?
++				CEC_MSG_DECK_STATUS : 0;
+ }
+ 
+ static inline void cec_ops_give_deck_status(const struct cec_msg *msg,
+@@ -1027,7 +1028,8 @@ static inline void cec_msg_give_tuner_device_status(struct cec_msg *msg,
+ 	msg->len = 3;
+ 	msg->msg[1] = CEC_MSG_GIVE_TUNER_DEVICE_STATUS;
+ 	msg->msg[2] = status_req;
+-	msg->reply = reply ? CEC_MSG_TUNER_DEVICE_STATUS : 0;
++	msg->reply = (reply && status_req != CEC_OP_STATUS_REQ_OFF) ?
++				CEC_MSG_TUNER_DEVICE_STATUS : 0;
+ }
+ 
+ static inline void cec_ops_give_tuner_device_status(const struct cec_msg *msg,
+-- 
+2.20.1
+
diff --git a/queue-5.4/media-cedrus-fill-in-bus_info-for-media-device.patch b/queue-5.4/media-cedrus-fill-in-bus_info-for-media-device.patch
new file mode 100644
index 00000000000..a503ae4d471
--- /dev/null
+++ b/queue-5.4/media-cedrus-fill-in-bus_info-for-media-device.patch
@@ -0,0 +1,53 @@
+From 454e129f526b6853e3ccabe6f5516fade9995fc7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Aug 2019 06:26:22 -0300
+Subject: media: cedrus: fill in bus_info for media device
+
+From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+
+[ Upstream commit ae0688f659adb17ae6ae5710c886b20b5406e5c4 ]
+
+Fixes this compliance warning:
+
+$ v4l2-compliance -m0
+v4l2-compliance SHA: b514d615166bdc0901a4c71261b87db31e89f464, 32 bits
+
+Compliance test for cedrus device /dev/media0:
+
+Media Driver Info:
+        Driver name      : cedrus
+        Model            : cedrus
+        Serial           :
+        Bus info         :
+        Media version    : 5.3.0
+        Hardware revision: 0x00000000 (0)
+        Driver version   : 5.3.0
+
+Required ioctls:
+                warn: v4l2-test-media.cpp(51): empty bus_info
+        test MEDIA_IOC_DEVICE_INFO: OK
+
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Reviewed-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/sunxi/cedrus/cedrus.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/staging/media/sunxi/cedrus/cedrus.c b/drivers/staging/media/sunxi/cedrus/cedrus.c
+index 2d3ea8b74dfd..3439f6ad6338 100644
+--- a/drivers/staging/media/sunxi/cedrus/cedrus.c
++++ b/drivers/staging/media/sunxi/cedrus/cedrus.c
+@@ -357,6 +357,8 @@ static int cedrus_probe(struct platform_device *pdev)
+ 
+ 	dev->mdev.dev = &pdev->dev;
+ 	strscpy(dev->mdev.model, CEDRUS_NAME, sizeof(dev->mdev.model));
++	strscpy(dev->mdev.bus_info, "platform:" CEDRUS_NAME,
++		sizeof(dev->mdev.bus_info));
+ 
+ 	media_device_init(&dev->mdev);
+ 	dev->mdev.ops = &cedrus_m2m_media_ops;
+-- 
+2.20.1
+
diff --git a/queue-5.4/media-cedrus-fix-undefined-shift-with-a-shift_and_ma.patch b/queue-5.4/media-cedrus-fix-undefined-shift-with-a-shift_and_ma.patch
new file mode 100644
index 00000000000..7b2354dcb42
--- /dev/null
+++ b/queue-5.4/media-cedrus-fix-undefined-shift-with-a-shift_and_ma.patch
@@ -0,0 +1,119 @@
+From 5bec4b5b30d96cf99c524a88e2fc7c2ae80681a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Oct 2019 12:26:50 -0300
+Subject: media: cedrus: Fix undefined shift with a SHIFT_AND_MASK_BITS macro
+
+From: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+
+[ Upstream commit 06eff2150d4db991ca236f3d05a9dc0101475aea ]
+
+We need to shift and mask values at different occasions to fill up
+cedrus registers. This was done using macros that don't explicitly
+treat arguments as unsigned, leading to possibly undefined behavior.
+
+Introduce the SHIFT_AND_MASK_BITS macro and use it where possible.
+In cases where it doesn't apply as-is, explicitly cast to unsigned
+instead.
+
+This macro should be moved to include/linux/bits.h eventually.
+
+Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../staging/media/sunxi/cedrus/cedrus_regs.h  | 31 ++++++++++---------
+ 1 file changed, 17 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/staging/media/sunxi/cedrus/cedrus_regs.h b/drivers/staging/media/sunxi/cedrus/cedrus_regs.h
+index ddd29788d685..f9dd8cbf3458 100644
+--- a/drivers/staging/media/sunxi/cedrus/cedrus_regs.h
++++ b/drivers/staging/media/sunxi/cedrus/cedrus_regs.h
+@@ -10,6 +10,9 @@
+ #ifndef _CEDRUS_REGS_H_
+ #define _CEDRUS_REGS_H_
+ 
++#define SHIFT_AND_MASK_BITS(v, h, l) \
++	(((unsigned long)(v) << (l)) & GENMASK(h, l))
++
+ /*
+  * Common acronyms and contractions used in register descriptions:
+  * * VLD : Variable-Length Decoder
+@@ -37,8 +40,8 @@
+ #define VE_PRIMARY_CHROMA_BUF_LEN		0xc4
+ #define VE_PRIMARY_FB_LINE_STRIDE		0xc8
+ 
+-#define VE_PRIMARY_FB_LINE_STRIDE_CHROMA(s)	(((s) << 16) & GENMASK(31, 16))
+-#define VE_PRIMARY_FB_LINE_STRIDE_LUMA(s)	(((s) << 0) & GENMASK(15, 0))
++#define VE_PRIMARY_FB_LINE_STRIDE_CHROMA(s)	SHIFT_AND_MASK_BITS(s, 31, 16)
++#define VE_PRIMARY_FB_LINE_STRIDE_LUMA(s)	SHIFT_AND_MASK_BITS(s, 15, 0)
+ 
+ #define VE_CHROMA_BUF_LEN			0xe8
+ 
+@@ -46,7 +49,7 @@
+ #define VE_SECONDARY_OUT_FMT_EXT		(0x01 << 30)
+ #define VE_SECONDARY_OUT_FMT_YU12		(0x02 << 30)
+ #define VE_SECONDARY_OUT_FMT_YV12		(0x03 << 30)
+-#define VE_CHROMA_BUF_LEN_SDRT(l)		((l) & GENMASK(27, 0))
++#define VE_CHROMA_BUF_LEN_SDRT(l)		SHIFT_AND_MASK_BITS(l, 27, 0)
+ 
+ #define VE_PRIMARY_OUT_FMT			0xec
+ 
+@@ -69,15 +72,15 @@
+ 
+ #define VE_DEC_MPEG_MP12HDR			(VE_ENGINE_DEC_MPEG + 0x00)
+ 
+-#define VE_DEC_MPEG_MP12HDR_SLICE_TYPE(t)	(((t) << 28) & GENMASK(30, 28))
++#define VE_DEC_MPEG_MP12HDR_SLICE_TYPE(t)	SHIFT_AND_MASK_BITS(t, 30, 28)
+ #define VE_DEC_MPEG_MP12HDR_F_CODE_SHIFT(x, y)	(24 - 4 * (y) - 8 * (x))
+ #define VE_DEC_MPEG_MP12HDR_F_CODE(__x, __y, __v) \
+-	(((__v) & GENMASK(3, 0)) << VE_DEC_MPEG_MP12HDR_F_CODE_SHIFT(__x, __y))
++	(((unsigned long)(__v) & GENMASK(3, 0)) << VE_DEC_MPEG_MP12HDR_F_CODE_SHIFT(__x, __y))
+ 
+ #define VE_DEC_MPEG_MP12HDR_INTRA_DC_PRECISION(p) \
+-	(((p) << 10) & GENMASK(11, 10))
++	SHIFT_AND_MASK_BITS(p, 11, 10)
+ #define VE_DEC_MPEG_MP12HDR_INTRA_PICTURE_STRUCTURE(s) \
+-	(((s) << 8) & GENMASK(9, 8))
++	SHIFT_AND_MASK_BITS(s, 9, 8)
+ #define VE_DEC_MPEG_MP12HDR_TOP_FIELD_FIRST(v) \
+ 	((v) ? BIT(7) : 0)
+ #define VE_DEC_MPEG_MP12HDR_FRAME_PRED_FRAME_DCT(v) \
+@@ -98,19 +101,19 @@
+ #define VE_DEC_MPEG_PICCODEDSIZE		(VE_ENGINE_DEC_MPEG + 0x08)
+ 
+ #define VE_DEC_MPEG_PICCODEDSIZE_WIDTH(w) \
+-	((DIV_ROUND_UP((w), 16) << 8) & GENMASK(15, 8))
++	SHIFT_AND_MASK_BITS(DIV_ROUND_UP((w), 16), 15, 8)
+ #define VE_DEC_MPEG_PICCODEDSIZE_HEIGHT(h) \
+-	((DIV_ROUND_UP((h), 16) << 0) & GENMASK(7, 0))
++	SHIFT_AND_MASK_BITS(DIV_ROUND_UP((h), 16), 7, 0)
+ 
+ #define VE_DEC_MPEG_PICBOUNDSIZE		(VE_ENGINE_DEC_MPEG + 0x0c)
+ 
+-#define VE_DEC_MPEG_PICBOUNDSIZE_WIDTH(w)	(((w) << 16) & GENMASK(27, 16))
+-#define VE_DEC_MPEG_PICBOUNDSIZE_HEIGHT(h)	(((h) << 0) & GENMASK(11, 0))
++#define VE_DEC_MPEG_PICBOUNDSIZE_WIDTH(w)	SHIFT_AND_MASK_BITS(w, 27, 16)
++#define VE_DEC_MPEG_PICBOUNDSIZE_HEIGHT(h)	SHIFT_AND_MASK_BITS(h, 11, 0)
+ 
+ #define VE_DEC_MPEG_MBADDR			(VE_ENGINE_DEC_MPEG + 0x10)
+ 
+-#define VE_DEC_MPEG_MBADDR_X(w)			(((w) << 8) & GENMASK(15, 8))
+-#define VE_DEC_MPEG_MBADDR_Y(h)			(((h) << 0) & GENMASK(7, 0))
++#define VE_DEC_MPEG_MBADDR_X(w)			SHIFT_AND_MASK_BITS(w, 15, 8)
++#define VE_DEC_MPEG_MBADDR_Y(h)			SHIFT_AND_MASK_BITS(h, 7, 0)
+ 
+ #define VE_DEC_MPEG_CTRL			(VE_ENGINE_DEC_MPEG + 0x14)
+ 
+@@ -225,7 +228,7 @@
+ #define VE_DEC_MPEG_IQMINPUT_FLAG_INTRA		(0x01 << 14)
+ #define VE_DEC_MPEG_IQMINPUT_FLAG_NON_INTRA	(0x00 << 14)
+ #define VE_DEC_MPEG_IQMINPUT_WEIGHT(i, v) \
+-	(((v) & GENMASK(7, 0)) | (((i) << 8) & GENMASK(13, 8)))
++	(SHIFT_AND_MASK_BITS(i, 13, 8) | SHIFT_AND_MASK_BITS(v, 7, 0))
+ 
+ #define VE_DEC_MPEG_ERROR			(VE_ENGINE_DEC_MPEG + 0xc4)
+ #define VE_DEC_MPEG_CRTMBADDR			(VE_ENGINE_DEC_MPEG + 0xc8)
+-- 
+2.20.1
+
diff --git a/queue-5.4/media-cedrus-use-helpers-to-access-capture-queue.patch b/queue-5.4/media-cedrus-use-helpers-to-access-capture-queue.patch
new file mode 100644
index 00000000000..572a2719d3f
--- /dev/null
+++ b/queue-5.4/media-cedrus-use-helpers-to-access-capture-queue.patch
@@ -0,0 +1,86 @@
+From f9633c8d12b20ec982b4014ce6bdd51ba945f4a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Oct 2019 09:27:52 +0200
+Subject: media: cedrus: Use helpers to access capture queue
+
+From: Jernej Skrabec <jernej.skrabec@siol.net>
+
+[ Upstream commit 1fd50a2c294457508f06b8b631d01a58de81cdd2 ]
+
+Accessing capture queue structue directly is not safe. Use helpers for
+that.
+
+Acked-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/sunxi/cedrus/cedrus.h      | 8 ++++++--
+ drivers/staging/media/sunxi/cedrus/cedrus_h264.c | 8 ++++++--
+ 2 files changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/staging/media/sunxi/cedrus/cedrus.h b/drivers/staging/media/sunxi/cedrus/cedrus.h
+index 2f017a651848..3758a1c4e2d0 100644
+--- a/drivers/staging/media/sunxi/cedrus/cedrus.h
++++ b/drivers/staging/media/sunxi/cedrus/cedrus.h
+@@ -179,12 +179,16 @@ static inline dma_addr_t cedrus_buf_addr(struct vb2_buffer *buf,
+ static inline dma_addr_t cedrus_dst_buf_addr(struct cedrus_ctx *ctx,
+ 					     int index, unsigned int plane)
+ {
+-	struct vb2_buffer *buf;
++	struct vb2_buffer *buf = NULL;
++	struct vb2_queue *vq;
+ 
+ 	if (index < 0)
+ 		return 0;
+ 
+-	buf = ctx->fh.m2m_ctx->cap_q_ctx.q.bufs[index];
++	vq = v4l2_m2m_get_vq(ctx->fh.m2m_ctx, V4L2_BUF_TYPE_VIDEO_CAPTURE);
++	if (vq)
++		buf = vb2_get_buffer(vq, index);
++
+ 	return buf ? cedrus_buf_addr(buf, &ctx->dst_fmt, plane) : 0;
+ }
+ 
+diff --git a/drivers/staging/media/sunxi/cedrus/cedrus_h264.c b/drivers/staging/media/sunxi/cedrus/cedrus_h264.c
+index d6a782703c9b..08c6c9c410cc 100644
+--- a/drivers/staging/media/sunxi/cedrus/cedrus_h264.c
++++ b/drivers/staging/media/sunxi/cedrus/cedrus_h264.c
+@@ -96,7 +96,7 @@ static void cedrus_write_frame_list(struct cedrus_ctx *ctx,
+ 	const struct v4l2_ctrl_h264_decode_params *decode = run->h264.decode_params;
+ 	const struct v4l2_ctrl_h264_slice_params *slice = run->h264.slice_params;
+ 	const struct v4l2_ctrl_h264_sps *sps = run->h264.sps;
+-	struct vb2_queue *cap_q = &ctx->fh.m2m_ctx->cap_q_ctx.q;
++	struct vb2_queue *cap_q;
+ 	struct cedrus_buffer *output_buf;
+ 	struct cedrus_dev *dev = ctx->dev;
+ 	unsigned long used_dpbs = 0;
+@@ -104,6 +104,8 @@ static void cedrus_write_frame_list(struct cedrus_ctx *ctx,
+ 	unsigned int output = 0;
+ 	unsigned int i;
+ 
++	cap_q = v4l2_m2m_get_vq(ctx->fh.m2m_ctx, V4L2_BUF_TYPE_VIDEO_CAPTURE);
++
+ 	memset(pic_list, 0, sizeof(pic_list));
+ 
+ 	for (i = 0; i < ARRAY_SIZE(decode->dpb); i++) {
+@@ -167,12 +169,14 @@ static void _cedrus_write_ref_list(struct cedrus_ctx *ctx,
+ 				   enum cedrus_h264_sram_off sram)
+ {
+ 	const struct v4l2_ctrl_h264_decode_params *decode = run->h264.decode_params;
+-	struct vb2_queue *cap_q = &ctx->fh.m2m_ctx->cap_q_ctx.q;
++	struct vb2_queue *cap_q;
+ 	struct cedrus_dev *dev = ctx->dev;
+ 	u8 sram_array[CEDRUS_MAX_REF_IDX];
+ 	unsigned int i;
+ 	size_t size;
+ 
++	cap_q = v4l2_m2m_get_vq(ctx->fh.m2m_ctx, V4L2_BUF_TYPE_VIDEO_CAPTURE);
++
+ 	memset(sram_array, 0, sizeof(sram_array));
+ 
+ 	for (i = 0; i < num_ref; i++) {
+-- 
+2.20.1
+
diff --git a/queue-5.4/media-cx88-fix-some-error-handling-path-in-cx8800_in.patch b/queue-5.4/media-cx88-fix-some-error-handling-path-in-cx8800_in.patch
new file mode 100644
index 00000000000..b8b82812d6a
--- /dev/null
+++ b/queue-5.4/media-cx88-fix-some-error-handling-path-in-cx8800_in.patch
@@ -0,0 +1,76 @@
+From 15291d30f3f465861bb016caa9679307bc10345f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 22 Sep 2019 04:41:23 -0300
+Subject: media: cx88: Fix some error handling path in 'cx8800_initdev()'
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit e1444e9b0424c70def6352580762d660af50e03f ]
+
+A call to 'pci_disable_device()' is missing in the error handling path.
+In some cases, a call to 'free_irq()' may also be missing.
+
+Reorder the error handling path, add some new labels and fix the 2 issues
+mentionned above.
+
+This way, the error handling path in more in line with 'cx8800_finidev()'
+(i.e. the remove function)
+
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/cx88/cx88-video.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/media/pci/cx88/cx88-video.c b/drivers/media/pci/cx88/cx88-video.c
+index dcc0f02aeb70..b8abcd550604 100644
+--- a/drivers/media/pci/cx88/cx88-video.c
++++ b/drivers/media/pci/cx88/cx88-video.c
+@@ -1277,7 +1277,7 @@ static int cx8800_initdev(struct pci_dev *pci_dev,
+ 	core = cx88_core_get(dev->pci);
+ 	if (!core) {
+ 		err = -EINVAL;
+-		goto fail_free;
++		goto fail_disable;
+ 	}
+ 	dev->core = core;
+ 
+@@ -1323,7 +1323,7 @@ static int cx8800_initdev(struct pci_dev *pci_dev,
+ 				       cc->step, cc->default_value);
+ 		if (!vc) {
+ 			err = core->audio_hdl.error;
+-			goto fail_core;
++			goto fail_irq;
+ 		}
+ 		vc->priv = (void *)cc;
+ 	}
+@@ -1337,7 +1337,7 @@ static int cx8800_initdev(struct pci_dev *pci_dev,
+ 				       cc->step, cc->default_value);
+ 		if (!vc) {
+ 			err = core->video_hdl.error;
+-			goto fail_core;
++			goto fail_irq;
+ 		}
+ 		vc->priv = (void *)cc;
+ 		if (vc->id == V4L2_CID_CHROMA_AGC)
+@@ -1509,11 +1509,14 @@ static int cx8800_initdev(struct pci_dev *pci_dev,
+ 
+ fail_unreg:
+ 	cx8800_unregister_video(dev);
+-	free_irq(pci_dev->irq, dev);
+ 	mutex_unlock(&core->lock);
++fail_irq:
++	free_irq(pci_dev->irq, dev);
+ fail_core:
+ 	core->v4ldev = NULL;
+ 	cx88_core_put(core, dev->pci);
++fail_disable:
++	pci_disable_device(pci_dev);
+ fail_free:
+ 	kfree(dev);
+ 	return err;
+-- 
+2.20.1
+
diff --git a/queue-5.4/media-exynos4-is-fix-wrong-mdev-and-v4l2-dev-order-i.patch b/queue-5.4/media-exynos4-is-fix-wrong-mdev-and-v4l2-dev-order-i.patch
new file mode 100644
index 00000000000..091bb50a057
--- /dev/null
+++ b/queue-5.4/media-exynos4-is-fix-wrong-mdev-and-v4l2-dev-order-i.patch
@@ -0,0 +1,79 @@
+From c1c7cf24785d294f28c1907523edd1bc725d989b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2019 10:46:32 +0100
+Subject: media: exynos4-is: fix wrong mdev and v4l2 dev order in error path
+
+From: Seung-Woo Kim <sw0312.kim@samsung.com>
+
+[ Upstream commit 4d741cbd58bf889c8a68cf6e592a7892b5c2802e ]
+
+When driver is built as module and probe during insmod is deferred
+because of sensor subdevs, there is NULL pointer deference because
+mdev is cleaned up and then access it from v4l2_device_unregister().
+Fix the wrong mdev and v4l2 dev order in error path of probe.
+
+This fixes below null pointer deference:
+   Unable to handle kernel NULL pointer dereference at virtual address 00000000
+   pgd = ca026f68
+   [00000000] *pgd=00000000
+   Internal error: Oops: 5 [#1] PREEMPT SMP ARM
+   [...]
+   Hardware name: SAMSUNG EXYNOS (Flattened Device Tree)
+   PC is at ida_free+0x7c/0x160
+   LR is at xas_start+0x44/0x204
+   [...]
+   [<c0dafd60>] (ida_free) from [<c083c20c>] (__media_device_unregister_entity+0x18/0xc0)
+   [<c083c20c>] (__media_device_unregister_entity) from [<c083c2e0>] (media_device_unregister_entity+0x2c/0x38)
+   [<c083c2e0>] (media_device_unregister_entity) from [<c0843404>] (v4l2_device_release+0xd0/0x104)
+   [<c0843404>] (v4l2_device_release) from [<c0632558>] (device_release+0x28/0x98)
+   [<c0632558>] (device_release) from [<c0db1204>] (kobject_put+0xa4/0x208)
+   [<c0db1204>] (kct_put) from [<bf00bac4>] (fimc_capture_subdev_unregistered+0x58/0x6c [s5p_fimc])
+   [<bf00bac4>] (fimc_capture_subdev_unregistered [s5p_fimc]) from [<c084a1cc>] (v4l2_device_unregister_subdev+0x6c/0xa8)
+   [<c084a1cc>] (v4l2_device_unregister_subdev) from [<c084a350>] (v4l2_device_unregister+0x64/0x94)
+   [<c084a350>] (v4l2_device_unregister) from [<bf0101ac>] (fimc_md_probe+0x4ec/0xaf8 [s5p_fimc])
+   [...]
+
+Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
+Reviewed-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Fixes: 9832e155f1ed ("[media] media-device: split media initialization and registration")
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/exynos4-is/media-dev.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/platform/exynos4-is/media-dev.c b/drivers/media/platform/exynos4-is/media-dev.c
+index a838189d4490..9aaf3b8060d5 100644
+--- a/drivers/media/platform/exynos4-is/media-dev.c
++++ b/drivers/media/platform/exynos4-is/media-dev.c
+@@ -1457,12 +1457,12 @@ static int fimc_md_probe(struct platform_device *pdev)
+ 	ret = v4l2_device_register(dev, &fmd->v4l2_dev);
+ 	if (ret < 0) {
+ 		v4l2_err(v4l2_dev, "Failed to register v4l2_device: %d\n", ret);
+-		return ret;
++		goto err_md;
+ 	}
+ 
+ 	ret = fimc_md_get_clocks(fmd);
+ 	if (ret)
+-		goto err_md;
++		goto err_v4l2dev;
+ 
+ 	ret = fimc_md_get_pinctrl(fmd);
+ 	if (ret < 0) {
+@@ -1519,9 +1519,10 @@ err_m_ent:
+ 	fimc_md_unregister_entities(fmd);
+ err_clk:
+ 	fimc_md_put_clocks(fmd);
++err_v4l2dev:
++	v4l2_device_unregister(&fmd->v4l2_dev);
+ err_md:
+ 	media_device_cleanup(&fmd->media_dev);
+-	v4l2_device_unregister(&fmd->v4l2_dev);
+ 	return ret;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/media-flexcop-usb-fix-null-ptr-deref-in-flexcop_usb_.patch b/queue-5.4/media-flexcop-usb-fix-null-ptr-deref-in-flexcop_usb_.patch
new file mode 100644
index 00000000000..edbdd59f4c3
--- /dev/null
+++ b/queue-5.4/media-flexcop-usb-fix-null-ptr-deref-in-flexcop_usb_.patch
@@ -0,0 +1,46 @@
+From 907e53b04580f74bedf3bc0eaaad5f0368f9cc24 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Sep 2019 06:49:04 -0300
+Subject: media: flexcop-usb: fix NULL-ptr deref in flexcop_usb_transfer_init()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 649cd16c438f51d4cd777e71ca1f47f6e0c5e65d ]
+
+If usb_set_interface() failed, iface->cur_altsetting will
+not be assigned and it will be used in flexcop_usb_transfer_init()
+It may lead a NULL pointer dereference.
+
+Check usb_set_interface() return value in flexcop_usb_init()
+and return failed to avoid using this NULL pointer.
+
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/b2c2/flexcop-usb.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/usb/b2c2/flexcop-usb.c b/drivers/media/usb/b2c2/flexcop-usb.c
+index 1a801dc286f8..d1331f828108 100644
+--- a/drivers/media/usb/b2c2/flexcop-usb.c
++++ b/drivers/media/usb/b2c2/flexcop-usb.c
+@@ -504,7 +504,13 @@ urb_error:
+ static int flexcop_usb_init(struct flexcop_usb *fc_usb)
+ {
+ 	/* use the alternate setting with the larges buffer */
+-	usb_set_interface(fc_usb->udev,0,1);
++	int ret = usb_set_interface(fc_usb->udev, 0, 1);
++
++	if (ret) {
++		err("set interface failed.");
++		return ret;
++	}
++
+ 	switch (fc_usb->udev->speed) {
+ 	case USB_SPEED_LOW:
+ 		err("cannot handle USB speed because it is too slow.");
+-- 
+2.20.1
+
diff --git a/queue-5.4/media-i2c-ov2659-fix-missing-720p-register-config.patch b/queue-5.4/media-i2c-ov2659-fix-missing-720p-register-config.patch
new file mode 100644
index 00000000000..ac6a8ddac3f
--- /dev/null
+++ b/queue-5.4/media-i2c-ov2659-fix-missing-720p-register-config.patch
@@ -0,0 +1,48 @@
+From 75e742233b615135a989b11a06c2c8f8caf2b564 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Sep 2019 10:06:43 -0300
+Subject: media: i2c: ov2659: Fix missing 720p register config
+
+From: Benoit Parrot <bparrot@ti.com>
+
+[ Upstream commit 9d669fbfca20e6035ead814e55d9ef1a6b500540 ]
+
+The initial registers sequence is only loaded at probe
+time. Afterward only the resolution and format specific
+register are modified. Care must be taken to make sure
+registers modified by one resolution setting are reverted
+back when another resolution is programmed.
+
+This was not done properly for the 720p case.
+
+Signed-off-by: Benoit Parrot <bparrot@ti.com>
+Acked-by: Lad, Prabhakar <prabhakar.csengg@gmail.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov2659.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/media/i2c/ov2659.c b/drivers/media/i2c/ov2659.c
+index 70bf63b9dbd0..e1ff38009cf0 100644
+--- a/drivers/media/i2c/ov2659.c
++++ b/drivers/media/i2c/ov2659.c
+@@ -419,10 +419,14 @@ static struct sensor_register ov2659_720p[] = {
+ 	{ REG_TIMING_YINC, 0x11 },
+ 	{ REG_TIMING_VERT_FORMAT, 0x80 },
+ 	{ REG_TIMING_HORIZ_FORMAT, 0x00 },
++	{ 0x370a, 0x12 },
+ 	{ 0x3a03, 0xe8 },
+ 	{ 0x3a09, 0x6f },
+ 	{ 0x3a0b, 0x5d },
+ 	{ 0x3a15, 0x9a },
++	{ REG_VFIFO_READ_START_H, 0x00 },
++	{ REG_VFIFO_READ_START_L, 0x80 },
++	{ REG_ISP_CTRL02, 0x00 },
+ 	{ REG_NULL, 0x00 },
+ };
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/media-i2c-ov2659-fix-s_stream-return-value.patch b/queue-5.4/media-i2c-ov2659-fix-s_stream-return-value.patch
new file mode 100644
index 00000000000..f7a33ba66a3
--- /dev/null
+++ b/queue-5.4/media-i2c-ov2659-fix-s_stream-return-value.patch
@@ -0,0 +1,49 @@
+From 0c8f06228693d4af632bc6d95bd135f5b0347531 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Sep 2019 10:06:40 -0300
+Subject: media: i2c: ov2659: fix s_stream return value
+
+From: Benoit Parrot <bparrot@ti.com>
+
+[ Upstream commit 85c4043f1d403c222d481dfc91846227d66663fb ]
+
+In ov2659_s_stream() return value for invoked function should be checked
+and propagated.
+
+Signed-off-by: Benoit Parrot <bparrot@ti.com>
+Acked-by: Lad, Prabhakar <prabhakar.csengg@gmail.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov2659.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/media/i2c/ov2659.c b/drivers/media/i2c/ov2659.c
+index f4ded0669ff9..70bf63b9dbd0 100644
+--- a/drivers/media/i2c/ov2659.c
++++ b/drivers/media/i2c/ov2659.c
+@@ -1201,11 +1201,15 @@ static int ov2659_s_stream(struct v4l2_subdev *sd, int on)
+ 		goto unlock;
+ 	}
+ 
+-	ov2659_set_pixel_clock(ov2659);
+-	ov2659_set_frame_size(ov2659);
+-	ov2659_set_format(ov2659);
+-	ov2659_set_streaming(ov2659, 1);
+-	ov2659->streaming = on;
++	ret = ov2659_set_pixel_clock(ov2659);
++	if (!ret)
++		ret = ov2659_set_frame_size(ov2659);
++	if (!ret)
++		ret = ov2659_set_format(ov2659);
++	if (!ret) {
++		ov2659_set_streaming(ov2659, 1);
++		ov2659->streaming = on;
++	}
+ 
+ unlock:
+ 	mutex_unlock(&ov2659->lock);
+-- 
+2.20.1
+
diff --git a/queue-5.4/media-imx7-mipi-csis-add-a-check-for-devm_regulator_.patch b/queue-5.4/media-imx7-mipi-csis-add-a-check-for-devm_regulator_.patch
new file mode 100644
index 00000000000..f96e0dbc3dc
--- /dev/null
+++ b/queue-5.4/media-imx7-mipi-csis-add-a-check-for-devm_regulator_.patch
@@ -0,0 +1,52 @@
+From ad8d36832595daa6feb58d8f642cb9c047141cd9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Oct 2019 10:59:15 -0300
+Subject: media: imx7-mipi-csis: Add a check for devm_regulator_get
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+[ Upstream commit a0219deefe9ee5006a28d48522f76b217d198c51 ]
+
+devm_regulator_get may return an error but mipi_csis_phy_init misses
+a check for it.
+This may lead to problems when regulator_set_voltage uses the unchecked
+pointer.
+This patch adds a check for devm_regulator_get to avoid potential risk.
+
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Reviewed-by: Rui Miguel Silva <rmfrfs@gmail.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/imx/imx7-mipi-csis.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/staging/media/imx/imx7-mipi-csis.c b/drivers/staging/media/imx/imx7-mipi-csis.c
+index 73d8354e618c..e50b1f88e25b 100644
+--- a/drivers/staging/media/imx/imx7-mipi-csis.c
++++ b/drivers/staging/media/imx/imx7-mipi-csis.c
+@@ -350,6 +350,8 @@ static void mipi_csis_sw_reset(struct csi_state *state)
+ static int mipi_csis_phy_init(struct csi_state *state)
+ {
+ 	state->mipi_phy_regulator = devm_regulator_get(state->dev, "phy");
++	if (IS_ERR(state->mipi_phy_regulator))
++		return PTR_ERR(state->mipi_phy_regulator);
+ 
+ 	return regulator_set_voltage(state->mipi_phy_regulator, 1000000,
+ 				     1000000);
+@@ -966,7 +968,10 @@ static int mipi_csis_probe(struct platform_device *pdev)
+ 		return ret;
+ 	}
+ 
+-	mipi_csis_phy_init(state);
++	ret = mipi_csis_phy_init(state);
++	if (ret < 0)
++		return ret;
++
+ 	mipi_csis_phy_reset(state);
+ 
+ 	mem_res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+-- 
+2.20.1
+
diff --git a/queue-5.4/media-max2175-fix-build-error-without-config_regmap_.patch b/queue-5.4/media-max2175-fix-build-error-without-config_regmap_.patch
new file mode 100644
index 00000000000..9c79cc43e39
--- /dev/null
+++ b/queue-5.4/media-max2175-fix-build-error-without-config_regmap_.patch
@@ -0,0 +1,41 @@
+From 8b02ae653a28d714d419ca2640efa97e5e6bd8a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Sep 2019 09:09:45 -0300
+Subject: media: max2175: Fix build error without CONFIG_REGMAP_I2C
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 36756fbff1e4a31d71d262ae6a04a20b38efa874 ]
+
+If CONFIG_REGMAP_I2C is not set, building fails:
+
+drivers/media/i2c/max2175.o: In function `max2175_probe':
+max2175.c:(.text+0x1404): undefined reference to `__devm_regmap_init_i2c'
+
+Select REGMAP_I2C to fix this.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Fixes: b47b79d8a231 ("[media] media: i2c: max2175: Add MAX2175 support")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/i2c/Kconfig b/drivers/media/i2c/Kconfig
+index 7eee1812bba3..fcffcc31d168 100644
+--- a/drivers/media/i2c/Kconfig
++++ b/drivers/media/i2c/Kconfig
+@@ -1113,6 +1113,7 @@ comment "SDR tuner chips"
+ config SDR_MAX2175
+ 	tristate "Maxim 2175 RF to Bits tuner"
+ 	depends on VIDEO_V4L2 && MEDIA_SDR_SUPPORT && I2C
++	select REGMAP_I2C
+ 	help
+ 	  Support for Maxim 2175 tuner. It is an advanced analog/digital
+ 	  radio receiver with RF-to-Bits front-end designed for SDR solutions.
+-- 
+2.20.1
+
diff --git a/queue-5.4/media-meson-ao-cec-move-cec_notifier_cec_adap_regist.patch b/queue-5.4/media-meson-ao-cec-move-cec_notifier_cec_adap_regist.patch
new file mode 100644
index 00000000000..1d1dd3f7d91
--- /dev/null
+++ b/queue-5.4/media-meson-ao-cec-move-cec_notifier_cec_adap_regist.patch
@@ -0,0 +1,238 @@
+From 9deb6ee6e61f6ff88bbf1a35950abe2ae00e2e16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Oct 2019 11:47:19 -0300
+Subject: media: meson/ao-cec: move cec_notifier_cec_adap_register after hw
+ setup
+
+From: Neil Armstrong <narmstrong@baylibre.com>
+
+[ Upstream commit 3e84a18a259e1df35e5b549ab92ec3baf82ff010 ]
+
+When probed after the HDMI notifier, calling cec_notifier_cec_adap_register()
+calls the enable() adapter callback, but the HW is not yet set up.
+
+Moving cec_notifier_cec_adap_register() right before cec_register_adapter()
+fixes the following crash:
+Ignoring spurious kernel translation fault at virtual address 0000000000000008
+[...]
+Hardware name: Khadas VIM (DT)
+[...]
+pc : __do_kernel_fault+0xdc/0x120
+lr : __do_kernel_fault+0xdc/0x120
+[...]
+Call trace:
+ __do_kernel_fault+0xdc/0x120
+ do_page_fault+0x180/0x458
+ do_translation_fault+0x64/0x70
+ do_mem_abort+0x3c/0x98
+ el1_da+0x20/0x94
+ meson_ao_cec_adap_enable+0x30/0x218 [ao_cec]
+ __cec_s_phys_addr+0x184/0x270
+ cec_s_phys_addr+0x44/0x60
+ cec_notifier_cec_adap_register+0x68/0x90
+ meson_ao_cec_probe+0xb0/0x288 [ao_cec]
+[...]
+ el0_svc_compat+0x8/0x10
+
+Reported-by: Christian Hewitt <christianshewitt@gmail.com>
+Suggested-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Fixes: 20958f9d5c48 ("media: meson/ao-cec: use cec_notifier_cec_adap_(un)register")
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/meson/ao-cec-g12a.c | 36 +++++++++++-----------
+ drivers/media/platform/meson/ao-cec.c      | 30 +++++++++---------
+ 2 files changed, 33 insertions(+), 33 deletions(-)
+
+diff --git a/drivers/media/platform/meson/ao-cec-g12a.c b/drivers/media/platform/meson/ao-cec-g12a.c
+index 3b39e875292e..3d8fe854feb0 100644
+--- a/drivers/media/platform/meson/ao-cec-g12a.c
++++ b/drivers/media/platform/meson/ao-cec-g12a.c
+@@ -662,34 +662,27 @@ static int meson_ao_cec_g12a_probe(struct platform_device *pdev)
+ 	if (IS_ERR(ao_cec->adap))
+ 		return PTR_ERR(ao_cec->adap);
+ 
+-	ao_cec->notify = cec_notifier_cec_adap_register(hdmi_dev, NULL,
+-							ao_cec->adap);
+-	if (!ao_cec->notify) {
+-		ret = -ENOMEM;
+-		goto out_probe_adapter;
+-	}
+-
+ 	ao_cec->adap->owner = THIS_MODULE;
+ 
+ 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ 	base = devm_ioremap_resource(&pdev->dev, res);
+ 	if (IS_ERR(base)) {
+ 		ret = PTR_ERR(base);
+-		goto out_probe_notify;
++		goto out_probe_adapter;
+ 	}
+ 
+ 	ao_cec->regmap = devm_regmap_init_mmio(&pdev->dev, base,
+ 					       &meson_ao_cec_g12a_regmap_conf);
+ 	if (IS_ERR(ao_cec->regmap)) {
+ 		ret = PTR_ERR(ao_cec->regmap);
+-		goto out_probe_notify;
++		goto out_probe_adapter;
+ 	}
+ 
+ 	ao_cec->regmap_cec = devm_regmap_init(&pdev->dev, NULL, ao_cec,
+ 					   &meson_ao_cec_g12a_cec_regmap_conf);
+ 	if (IS_ERR(ao_cec->regmap_cec)) {
+ 		ret = PTR_ERR(ao_cec->regmap_cec);
+-		goto out_probe_notify;
++		goto out_probe_adapter;
+ 	}
+ 
+ 	irq = platform_get_irq(pdev, 0);
+@@ -699,45 +692,52 @@ static int meson_ao_cec_g12a_probe(struct platform_device *pdev)
+ 					0, NULL, ao_cec);
+ 	if (ret) {
+ 		dev_err(&pdev->dev, "irq request failed\n");
+-		goto out_probe_notify;
++		goto out_probe_adapter;
+ 	}
+ 
+ 	ao_cec->oscin = devm_clk_get(&pdev->dev, "oscin");
+ 	if (IS_ERR(ao_cec->oscin)) {
+ 		dev_err(&pdev->dev, "oscin clock request failed\n");
+ 		ret = PTR_ERR(ao_cec->oscin);
+-		goto out_probe_notify;
++		goto out_probe_adapter;
+ 	}
+ 
+ 	ret = meson_ao_cec_g12a_setup_clk(ao_cec);
+ 	if (ret)
+-		goto out_probe_notify;
++		goto out_probe_adapter;
+ 
+ 	ret = clk_prepare_enable(ao_cec->core);
+ 	if (ret) {
+ 		dev_err(&pdev->dev, "core clock enable failed\n");
+-		goto out_probe_notify;
++		goto out_probe_adapter;
+ 	}
+ 
+ 	device_reset_optional(&pdev->dev);
+ 
+ 	platform_set_drvdata(pdev, ao_cec);
+ 
++	ao_cec->notify = cec_notifier_cec_adap_register(hdmi_dev, NULL,
++							ao_cec->adap);
++	if (!ao_cec->notify) {
++		ret = -ENOMEM;
++		goto out_probe_core_clk;
++	}
++
+ 	ret = cec_register_adapter(ao_cec->adap, &pdev->dev);
+ 	if (ret < 0)
+-		goto out_probe_core_clk;
++		goto out_probe_notify;
+ 
+ 	/* Setup Hardware */
+ 	regmap_write(ao_cec->regmap, CECB_GEN_CNTL_REG, CECB_GEN_CNTL_RESET);
+ 
+ 	return 0;
+ 
+-out_probe_core_clk:
+-	clk_disable_unprepare(ao_cec->core);
+-
+ out_probe_notify:
+ 	cec_notifier_cec_adap_unregister(ao_cec->notify);
+ 
++out_probe_core_clk:
++	clk_disable_unprepare(ao_cec->core);
++
+ out_probe_adapter:
+ 	cec_delete_adapter(ao_cec->adap);
+ 
+diff --git a/drivers/media/platform/meson/ao-cec.c b/drivers/media/platform/meson/ao-cec.c
+index 64ed549bf012..03600e8b3ef0 100644
+--- a/drivers/media/platform/meson/ao-cec.c
++++ b/drivers/media/platform/meson/ao-cec.c
+@@ -624,20 +624,13 @@ static int meson_ao_cec_probe(struct platform_device *pdev)
+ 	if (IS_ERR(ao_cec->adap))
+ 		return PTR_ERR(ao_cec->adap);
+ 
+-	ao_cec->notify = cec_notifier_cec_adap_register(hdmi_dev, NULL,
+-							ao_cec->adap);
+-	if (!ao_cec->notify) {
+-		ret = -ENOMEM;
+-		goto out_probe_adapter;
+-	}
+-
+ 	ao_cec->adap->owner = THIS_MODULE;
+ 
+ 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ 	ao_cec->base = devm_ioremap_resource(&pdev->dev, res);
+ 	if (IS_ERR(ao_cec->base)) {
+ 		ret = PTR_ERR(ao_cec->base);
+-		goto out_probe_notify;
++		goto out_probe_adapter;
+ 	}
+ 
+ 	irq = platform_get_irq(pdev, 0);
+@@ -647,20 +640,20 @@ static int meson_ao_cec_probe(struct platform_device *pdev)
+ 					0, NULL, ao_cec);
+ 	if (ret) {
+ 		dev_err(&pdev->dev, "irq request failed\n");
+-		goto out_probe_notify;
++		goto out_probe_adapter;
+ 	}
+ 
+ 	ao_cec->core = devm_clk_get(&pdev->dev, "core");
+ 	if (IS_ERR(ao_cec->core)) {
+ 		dev_err(&pdev->dev, "core clock request failed\n");
+ 		ret = PTR_ERR(ao_cec->core);
+-		goto out_probe_notify;
++		goto out_probe_adapter;
+ 	}
+ 
+ 	ret = clk_prepare_enable(ao_cec->core);
+ 	if (ret) {
+ 		dev_err(&pdev->dev, "core clock enable failed\n");
+-		goto out_probe_notify;
++		goto out_probe_adapter;
+ 	}
+ 
+ 	ret = clk_set_rate(ao_cec->core, CEC_CLK_RATE);
+@@ -674,9 +667,16 @@ static int meson_ao_cec_probe(struct platform_device *pdev)
+ 	ao_cec->pdev = pdev;
+ 	platform_set_drvdata(pdev, ao_cec);
+ 
++	ao_cec->notify = cec_notifier_cec_adap_register(hdmi_dev, NULL,
++							ao_cec->adap);
++	if (!ao_cec->notify) {
++		ret = -ENOMEM;
++		goto out_probe_clk;
++	}
++
+ 	ret = cec_register_adapter(ao_cec->adap, &pdev->dev);
+ 	if (ret < 0)
+-		goto out_probe_clk;
++		goto out_probe_notify;
+ 
+ 	/* Setup Hardware */
+ 	writel_relaxed(CEC_GEN_CNTL_RESET,
+@@ -684,12 +684,12 @@ static int meson_ao_cec_probe(struct platform_device *pdev)
+ 
+ 	return 0;
+ 
+-out_probe_clk:
+-	clk_disable_unprepare(ao_cec->core);
+-
+ out_probe_notify:
+ 	cec_notifier_cec_adap_unregister(ao_cec->notify);
+ 
++out_probe_clk:
++	clk_disable_unprepare(ao_cec->core);
++
+ out_probe_adapter:
+ 	cec_delete_adapter(ao_cec->adap);
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/media-ov5640-make-2592x1944-mode-only-available-at-1.patch b/queue-5.4/media-ov5640-make-2592x1944-mode-only-available-at-1.patch
new file mode 100644
index 00000000000..125363cb228
--- /dev/null
+++ b/queue-5.4/media-ov5640-make-2592x1944-mode-only-available-at-1.patch
@@ -0,0 +1,41 @@
+From b15f11cade6cd478c370d981207ef39ed9db9755 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2019 09:35:10 -0300
+Subject: media: ov5640: Make 2592x1944 mode only available at 15 fps
+
+From: Benoit Parrot <bparrot@ti.com>
+
+[ Upstream commit 981e445454531c9d5ac5d3fa8c0f1bd55262d001 ]
+
+The sensor data sheet clearly state that 2592x1944 only works at 15 fps
+make sure we don't try to miss configure the pll out of acceptable
+range.
+
+Signed-off-by: Benoit Parrot <bparrot@ti.com>
+Reviewed-by: Jacopo Mondi <jacopo@jmondi.org>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov5640.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/media/i2c/ov5640.c b/drivers/media/i2c/ov5640.c
+index 500d9bbff10b..18dd2d717088 100644
+--- a/drivers/media/i2c/ov5640.c
++++ b/drivers/media/i2c/ov5640.c
+@@ -1611,6 +1611,11 @@ ov5640_find_mode(struct ov5640_dev *sensor, enum ov5640_frame_rate fr,
+ 	    !(mode->hact == 640 && mode->vact == 480))
+ 		return NULL;
+ 
++	/* 2592x1944 only works at 15fps max */
++	if ((mode->hact == 2592 && mode->vact == 1944) &&
++	    fr > OV5640_15_FPS)
++		return NULL;
++
+ 	return mode;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/media-ov6650-fix-control-handler-not-freed-on-init-e.patch b/queue-5.4/media-ov6650-fix-control-handler-not-freed-on-init-e.patch
new file mode 100644
index 00000000000..3f9aa4b717d
--- /dev/null
+++ b/queue-5.4/media-ov6650-fix-control-handler-not-freed-on-init-e.patch
@@ -0,0 +1,56 @@
+From 34d8fa5119b485254f5a3a04043762726736e207 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Sep 2019 17:11:37 -0300
+Subject: media: ov6650: Fix control handler not freed on init error
+
+From: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+
+[ Upstream commit c404af950d14b71bfbf574a752b6c29d726baaba ]
+
+Since commit afd9690c72c3 ("[media] ov6650: convert to the control
+framework"), if an error occurs during initialization of a control
+handler, resources possibly allocated to the handler are not freed
+before device initialiaton is aborted.  Fix it.
+
+Fixes: afd9690c72c3 ("[media] ov6650: convert to the control framework")
+Signed-off-by: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov6650.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/media/i2c/ov6650.c b/drivers/media/i2c/ov6650.c
+index 5b9af5e5b7f1..68776b0710f9 100644
+--- a/drivers/media/i2c/ov6650.c
++++ b/drivers/media/i2c/ov6650.c
+@@ -989,8 +989,10 @@ static int ov6650_probe(struct i2c_client *client,
+ 			V4L2_CID_GAMMA, 0, 0xff, 1, 0x12);
+ 
+ 	priv->subdev.ctrl_handler = &priv->hdl;
+-	if (priv->hdl.error)
+-		return priv->hdl.error;
++	if (priv->hdl.error) {
++		ret = priv->hdl.error;
++		goto ectlhdlfree;
++	}
+ 
+ 	v4l2_ctrl_auto_cluster(2, &priv->autogain, 0, true);
+ 	v4l2_ctrl_auto_cluster(3, &priv->autowb, 0, true);
+@@ -1008,8 +1010,10 @@ static int ov6650_probe(struct i2c_client *client,
+ 	priv->subdev.internal_ops = &ov6650_internal_ops;
+ 
+ 	ret = v4l2_async_register_subdev(&priv->subdev);
+-	if (ret)
+-		v4l2_ctrl_handler_free(&priv->hdl);
++	if (!ret)
++		return 0;
++ectlhdlfree:
++	v4l2_ctrl_handler_free(&priv->hdl);
+ 
+ 	return ret;
+ }
+-- 
+2.20.1
+
diff --git a/queue-5.4/media-ov6650-fix-crop-rectangle-alignment-not-passed.patch b/queue-5.4/media-ov6650-fix-crop-rectangle-alignment-not-passed.patch
new file mode 100644
index 00000000000..13d0fd893ad
--- /dev/null
+++ b/queue-5.4/media-ov6650-fix-crop-rectangle-alignment-not-passed.patch
@@ -0,0 +1,93 @@
+From c369c7c59ce044b4bc5075892cc21b38192b6451 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Sep 2019 17:11:38 -0300
+Subject: media: ov6650: Fix crop rectangle alignment not passed back
+
+From: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+
+[ Upstream commit 7b188d6ba27a131e7934a51a14ece331c0491f18 ]
+
+Commit 4f996594ceaf ("[media] v4l2: make vidioc_s_crop const")
+introduced a writable copy of constified user requested crop rectangle
+in order to be able to perform hardware alignments on it.  Later
+on, commit 10d5509c8d50 ("[media] v4l2: remove g/s_crop from video
+ops") replaced s_crop() video operation using that const argument with
+set_selection() pad operation which had a corresponding argument not
+constified, however the original behavior of the driver was not
+restored.  Since that time, any hardware alignment applied on a user
+requested crop rectangle is not passed back to the user calling
+.set_selection() as it should be.
+
+Fix the issue by dropping the copy and replacing all references to it
+with references to the crop rectangle embedded in the user argument.
+
+Fixes: 10d5509c8d50 ("[media] v4l2: remove g/s_crop from video ops")
+Signed-off-by: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov6650.c | 31 +++++++++++++++----------------
+ 1 file changed, 15 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/media/i2c/ov6650.c b/drivers/media/i2c/ov6650.c
+index 68776b0710f9..c6af72553258 100644
+--- a/drivers/media/i2c/ov6650.c
++++ b/drivers/media/i2c/ov6650.c
+@@ -465,38 +465,37 @@ static int ov6650_set_selection(struct v4l2_subdev *sd,
+ {
+ 	struct i2c_client *client = v4l2_get_subdevdata(sd);
+ 	struct ov6650 *priv = to_ov6650(client);
+-	struct v4l2_rect rect = sel->r;
+ 	int ret;
+ 
+ 	if (sel->which != V4L2_SUBDEV_FORMAT_ACTIVE ||
+ 	    sel->target != V4L2_SEL_TGT_CROP)
+ 		return -EINVAL;
+ 
+-	v4l_bound_align_image(&rect.width, 2, W_CIF, 1,
+-			      &rect.height, 2, H_CIF, 1, 0);
+-	v4l_bound_align_image(&rect.left, DEF_HSTRT << 1,
+-			      (DEF_HSTRT << 1) + W_CIF - (__s32)rect.width, 1,
+-			      &rect.top, DEF_VSTRT << 1,
+-			      (DEF_VSTRT << 1) + H_CIF - (__s32)rect.height, 1,
+-			      0);
++	v4l_bound_align_image(&sel->r.width, 2, W_CIF, 1,
++			      &sel->r.height, 2, H_CIF, 1, 0);
++	v4l_bound_align_image(&sel->r.left, DEF_HSTRT << 1,
++			      (DEF_HSTRT << 1) + W_CIF - (__s32)sel->r.width, 1,
++			      &sel->r.top, DEF_VSTRT << 1,
++			      (DEF_VSTRT << 1) + H_CIF - (__s32)sel->r.height,
++			      1, 0);
+ 
+-	ret = ov6650_reg_write(client, REG_HSTRT, rect.left >> 1);
++	ret = ov6650_reg_write(client, REG_HSTRT, sel->r.left >> 1);
+ 	if (!ret) {
+-		priv->rect.left = rect.left;
++		priv->rect.left = sel->r.left;
+ 		ret = ov6650_reg_write(client, REG_HSTOP,
+-				(rect.left + rect.width) >> 1);
++				       (sel->r.left + sel->r.width) >> 1);
+ 	}
+ 	if (!ret) {
+-		priv->rect.width = rect.width;
+-		ret = ov6650_reg_write(client, REG_VSTRT, rect.top >> 1);
++		priv->rect.width = sel->r.width;
++		ret = ov6650_reg_write(client, REG_VSTRT, sel->r.top >> 1);
+ 	}
+ 	if (!ret) {
+-		priv->rect.top = rect.top;
++		priv->rect.top = sel->r.top;
+ 		ret = ov6650_reg_write(client, REG_VSTOP,
+-				(rect.top + rect.height) >> 1);
++				       (sel->r.top + sel->r.height) >> 1);
+ 	}
+ 	if (!ret)
+-		priv->rect.height = rect.height;
++		priv->rect.height = sel->r.height;
+ 
+ 	return ret;
+ }
+-- 
+2.20.1
+
diff --git a/queue-5.4/media-ov6650-fix-stored-crop-rectangle-not-in-sync-w.patch b/queue-5.4/media-ov6650-fix-stored-crop-rectangle-not-in-sync-w.patch
new file mode 100644
index 00000000000..b865be3a2f0
--- /dev/null
+++ b/queue-5.4/media-ov6650-fix-stored-crop-rectangle-not-in-sync-w.patch
@@ -0,0 +1,58 @@
+From 1a1eb866d569af19def63af5c76b39ba472a34a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Sep 2019 17:11:44 -0300
+Subject: media: ov6650: Fix stored crop rectangle not in sync with hardware
+
+From: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+
+[ Upstream commit 1463b371aff0682c70141f7521db13cc4bbf3016 ]
+
+The driver stores crop rectangle settings supposed to be in line with
+hardware state in a device private structure.  Since the driver initial
+submission, crop rectangle width and height settings are not updated
+correctly when rectangle offset settings are applied on hardware.  If
+an error occurs while the device is updated, the stored settings my no
+longer reflect hardware state and consecutive calls to .get_selection()
+as well as .get/set_fmt() may return incorrect information.  That in
+turn may affect ability of a bridge device to use correct DMA transfer
+settings if such incorrect informamtion on active frame format returned
+by .get/set_fmt() is used.
+
+Assuming a failed update of the device means its actual settings haven't
+changed, update crop rectangle width and height settings stored in the
+device private structure correctly while the rectangle offset is
+successfully applied on hardware so the stored values always reflect
+actual hardware state to the extent possible.
+
+Fixes: 2f6e2404799a ("[media] SoC Camera: add driver for OV6650 sensor")
+Signed-off-by: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov6650.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/media/i2c/ov6650.c b/drivers/media/i2c/ov6650.c
+index 5426fed2574e..43c3f1b6e19a 100644
+--- a/drivers/media/i2c/ov6650.c
++++ b/drivers/media/i2c/ov6650.c
+@@ -481,6 +481,7 @@ static int ov6650_set_selection(struct v4l2_subdev *sd,
+ 
+ 	ret = ov6650_reg_write(client, REG_HSTRT, sel->r.left >> 1);
+ 	if (!ret) {
++		priv->rect.width += priv->rect.left - sel->r.left;
+ 		priv->rect.left = sel->r.left;
+ 		ret = ov6650_reg_write(client, REG_HSTOP,
+ 				       (sel->r.left + sel->r.width) >> 1);
+@@ -490,6 +491,7 @@ static int ov6650_set_selection(struct v4l2_subdev *sd,
+ 		ret = ov6650_reg_write(client, REG_VSTRT, sel->r.top >> 1);
+ 	}
+ 	if (!ret) {
++		priv->rect.height += priv->rect.top - sel->r.top;
+ 		priv->rect.top = sel->r.top;
+ 		ret = ov6650_reg_write(client, REG_VSTOP,
+ 				       (sel->r.top + sel->r.height) >> 1);
+-- 
+2.20.1
+
diff --git a/queue-5.4/media-ov6650-fix-stored-frame-format-not-in-sync-wit.patch b/queue-5.4/media-ov6650-fix-stored-frame-format-not-in-sync-wit.patch
new file mode 100644
index 00000000000..8b3ed2df9a8
--- /dev/null
+++ b/queue-5.4/media-ov6650-fix-stored-frame-format-not-in-sync-wit.patch
@@ -0,0 +1,71 @@
+From 014997f80389f15e573854b4327b4f71cfcc5a83 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Sep 2019 17:11:43 -0300
+Subject: media: ov6650: Fix stored frame format not in sync with hardware
+
+From: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+
+[ Upstream commit 3143b459de4cdcce67b36827476c966e93c1cf01 ]
+
+The driver stores frame format settings supposed to be in line with
+hardware state in a device private structure.  Since the driver initial
+submission, those settings are updated before they are actually applied
+on hardware.  If an error occurs on device update, the stored settings
+my not reflect hardware state anymore and consecutive calls to
+.get_fmt() may return incorrect information.  That in turn may affect
+ability of a bridge device to use correct DMA transfer settings if such
+incorrect informmation on active frame format returned by .get_fmt() is
+used.
+
+Assuming a failed device update means its state hasn't changed, update
+frame format related settings stored in the device private structure
+only after they are successfully applied so the stored values always
+reflect hardware state as closely as possible.
+
+Fixes: 2f6e2404799a ("[media] SoC Camera: add driver for OV6650 sensor")
+Signed-off-by: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov6650.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/i2c/ov6650.c b/drivers/media/i2c/ov6650.c
+index c6af72553258..5426fed2574e 100644
+--- a/drivers/media/i2c/ov6650.c
++++ b/drivers/media/i2c/ov6650.c
+@@ -609,7 +609,6 @@ static int ov6650_s_fmt(struct v4l2_subdev *sd, struct v4l2_mbus_framefmt *mf)
+ 		dev_err(&client->dev, "Pixel format not handled: 0x%x\n", code);
+ 		return -EINVAL;
+ 	}
+-	priv->code = code;
+ 
+ 	if (code == MEDIA_BUS_FMT_Y8_1X8 ||
+ 			code == MEDIA_BUS_FMT_SBGGR8_1X8) {
+@@ -635,7 +634,6 @@ static int ov6650_s_fmt(struct v4l2_subdev *sd, struct v4l2_mbus_framefmt *mf)
+ 		dev_dbg(&client->dev, "max resolution: CIF\n");
+ 		coma_mask |= COMA_QCIF;
+ 	}
+-	priv->half_scale = half_scale;
+ 
+ 	clkrc = CLKRC_12MHz;
+ 	mclk = 12000000;
+@@ -653,8 +651,13 @@ static int ov6650_s_fmt(struct v4l2_subdev *sd, struct v4l2_mbus_framefmt *mf)
+ 		ret = ov6650_reg_rmw(client, REG_COMA, coma_set, coma_mask);
+ 	if (!ret)
+ 		ret = ov6650_reg_write(client, REG_CLKRC, clkrc);
+-	if (!ret)
++	if (!ret) {
++		priv->half_scale = half_scale;
++
+ 		ret = ov6650_reg_rmw(client, REG_COML, coml_set, coml_mask);
++	}
++	if (!ret)
++		priv->code = code;
+ 
+ 	if (!ret) {
+ 		mf->colorspace	= priv->colorspace;
+-- 
+2.20.1
+
diff --git a/queue-5.4/media-ov6650-fix-stored-frame-interval-not-in-sync-w.patch b/queue-5.4/media-ov6650-fix-stored-frame-interval-not-in-sync-w.patch
new file mode 100644
index 00000000000..bbc1f0de4f9
--- /dev/null
+++ b/queue-5.4/media-ov6650-fix-stored-frame-interval-not-in-sync-w.patch
@@ -0,0 +1,86 @@
+From ba30daa997985751ace22e8c74dd80f9cea22d7c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 13 Oct 2019 09:50:45 -0300
+Subject: media: ov6650: Fix stored frame interval not in sync with hardware
+
+From: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+
+[ Upstream commit 57822068dd120386b98891cb151dc20107b63ba7 ]
+
+The driver stores a frame interval value supposed to be in line with
+hardware state in a device private structure.  Since the driver initial
+submission, the respective field of the structure has never been
+initialised on device probe.  Moreover, if updated from
+.s_frame_interval(), a new value is stored before it is applied on
+hardware.  If an error occurs during device update, the stored value
+may no longer reflect hardware state and consecutive calls to
+.g_frame_interval() may return incorrect information.
+
+Assuming a failed update of the device means its actual state hasn't
+changed, update the frame interval field of the device private
+structure with a new value only after it is successfully applied on
+hardware so it always reflects actual hardware state to the extent
+possible.  Also, initialise the field with hardware default frame
+interval on device probe.
+
+Signed-off-by: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov6650.c | 21 ++++++++++++---------
+ 1 file changed, 12 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/media/i2c/ov6650.c b/drivers/media/i2c/ov6650.c
+index 43c3f1b6e19a..a5b2448c0abc 100644
+--- a/drivers/media/i2c/ov6650.c
++++ b/drivers/media/i2c/ov6650.c
+@@ -130,6 +130,7 @@
+ #define CLKRC_24MHz		0xc0
+ #define CLKRC_DIV_MASK		0x3f
+ #define GET_CLKRC_DIV(x)	(((x) & CLKRC_DIV_MASK) + 1)
++#define DEF_CLKRC		0x00
+ 
+ #define COMA_RESET		BIT(7)
+ #define COMA_QCIF		BIT(5)
+@@ -758,19 +759,17 @@ static int ov6650_s_frame_interval(struct v4l2_subdev *sd,
+ 	else if (div > GET_CLKRC_DIV(CLKRC_DIV_MASK))
+ 		div = GET_CLKRC_DIV(CLKRC_DIV_MASK);
+ 
+-	/*
+-	 * Keep result to be used as tpf limit
+-	 * for subsequent clock divider calculations
+-	 */
+-	priv->tpf.numerator = div;
+-	priv->tpf.denominator = FRAME_RATE_MAX;
++	tpf->numerator = div;
++	tpf->denominator = FRAME_RATE_MAX;
+ 
+-	clkrc = to_clkrc(&priv->tpf, priv->pclk_limit, priv->pclk_max);
++	clkrc = to_clkrc(tpf, priv->pclk_limit, priv->pclk_max);
+ 
+ 	ret = ov6650_reg_rmw(client, REG_CLKRC, clkrc, CLKRC_DIV_MASK);
+ 	if (!ret) {
+-		tpf->numerator = GET_CLKRC_DIV(clkrc);
+-		tpf->denominator = FRAME_RATE_MAX;
++		priv->tpf.numerator = GET_CLKRC_DIV(clkrc);
++		priv->tpf.denominator = FRAME_RATE_MAX;
++
++		*tpf = priv->tpf;
+ 	}
+ 
+ 	return ret;
+@@ -1011,6 +1010,10 @@ static int ov6650_probe(struct i2c_client *client,
+ 	priv->code	  = MEDIA_BUS_FMT_YUYV8_2X8;
+ 	priv->colorspace  = V4L2_COLORSPACE_JPEG;
+ 
++	/* Hardware default frame interval */
++	priv->tpf.numerator   = GET_CLKRC_DIV(DEF_CLKRC);
++	priv->tpf.denominator = FRAME_RATE_MAX;
++
+ 	priv->subdev.internal_ops = &ov6650_internal_ops;
+ 
+ 	ret = v4l2_async_register_subdev(&priv->subdev);
+-- 
+2.20.1
+
diff --git a/queue-5.4/media-pvrusb2-fix-oops-on-tear-down-when-radio-suppo.patch b/queue-5.4/media-pvrusb2-fix-oops-on-tear-down-when-radio-suppo.patch
new file mode 100644
index 00000000000..6fb726cbd1a
--- /dev/null
+++ b/queue-5.4/media-pvrusb2-fix-oops-on-tear-down-when-radio-suppo.patch
@@ -0,0 +1,60 @@
+From f23158b878b23ec89f5ac2973a24c12e457e6d57 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Nov 2019 12:11:14 +0100
+Subject: media: pvrusb2: Fix oops on tear-down when radio support is not
+ present
+
+From: Mike Isely <isely@pobox.com>
+
+[ Upstream commit 7f404ae9cf2a285f73b3c18ab9303d54b7a3d8e1 ]
+
+In some device configurations there's no radio or radio support in the
+driver.  That's OK, as the driver sets itself up accordingly.  However
+on tear-down in these caes it's still trying to tear down radio
+related context when there isn't anything there, leading to
+dereferences through a null pointer and chaos follows.
+
+How this bug survived unfixed for 11 years in the pvrusb2 driver is a
+mystery to me.
+
+[hverkuil: fix two checkpatch warnings]
+
+Signed-off-by: Mike Isely <isely@pobox.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/pvrusb2/pvrusb2-v4l2.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c b/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c
+index a34717eba409..eaa08c7999d4 100644
+--- a/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c
++++ b/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c
+@@ -898,8 +898,12 @@ static void pvr2_v4l2_internal_check(struct pvr2_channel *chp)
+ 	pvr2_v4l2_dev_disassociate_parent(vp->dev_video);
+ 	pvr2_v4l2_dev_disassociate_parent(vp->dev_radio);
+ 	if (!list_empty(&vp->dev_video->devbase.fh_list) ||
+-	    !list_empty(&vp->dev_radio->devbase.fh_list))
++	    (vp->dev_radio &&
++	     !list_empty(&vp->dev_radio->devbase.fh_list))) {
++		pvr2_trace(PVR2_TRACE_STRUCT,
++			   "pvr2_v4l2 internal_check exit-empty id=%p", vp);
+ 		return;
++	}
+ 	pvr2_v4l2_destroy_no_lock(vp);
+ }
+ 
+@@ -935,7 +939,8 @@ static int pvr2_v4l2_release(struct file *file)
+ 	kfree(fhp);
+ 	if (vp->channel.mc_head->disconnect_flag &&
+ 	    list_empty(&vp->dev_video->devbase.fh_list) &&
+-	    list_empty(&vp->dev_radio->devbase.fh_list)) {
++	    (!vp->dev_radio ||
++	     list_empty(&vp->dev_radio->devbase.fh_list))) {
+ 		pvr2_v4l2_destroy_no_lock(vp);
+ 	}
+ 	return 0;
+-- 
+2.20.1
+
diff --git a/queue-5.4/media-rcar_drif-fix-a-memory-disclosure.patch b/queue-5.4/media-rcar_drif-fix-a-memory-disclosure.patch
new file mode 100644
index 00000000000..e211f2615ec
--- /dev/null
+++ b/queue-5.4/media-rcar_drif-fix-a-memory-disclosure.patch
@@ -0,0 +1,37 @@
+From 34c6f9214e5a0adb283e6575e497714d84278ec7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Oct 2019 01:47:00 -0300
+Subject: media: rcar_drif: fix a memory disclosure
+
+From: Kangjie Lu <kjlu@umn.edu>
+
+[ Upstream commit d39083234c60519724c6ed59509a2129fd2aed41 ]
+
+"f->fmt.sdr.reserved" is uninitialized. As other peer drivers
+like msi2500 and airspy do, the fix initializes it to avoid
+memory disclosures.
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/rcar_drif.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/platform/rcar_drif.c b/drivers/media/platform/rcar_drif.c
+index 608e5217ccd5..0f267a237b42 100644
+--- a/drivers/media/platform/rcar_drif.c
++++ b/drivers/media/platform/rcar_drif.c
+@@ -912,6 +912,7 @@ static int rcar_drif_g_fmt_sdr_cap(struct file *file, void *priv,
+ {
+ 	struct rcar_drif_sdr *sdr = video_drvdata(file);
+ 
++	memset(f->fmt.sdr.reserved, 0, sizeof(f->fmt.sdr.reserved));
+ 	f->fmt.sdr.pixelformat = sdr->fmt->pixelformat;
+ 	f->fmt.sdr.buffersize = sdr->fmt->buffersize;
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/media-seco-cec-add-a-missing-release_region-in-an-er.patch b/queue-5.4/media-seco-cec-add-a-missing-release_region-in-an-er.patch
new file mode 100644
index 00000000000..18b99a00291
--- /dev/null
+++ b/queue-5.4/media-seco-cec-add-a-missing-release_region-in-an-er.patch
@@ -0,0 +1,42 @@
+From fb6e1f9891a98fe12b5cd497dde8d3f9803f4de2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 31 Aug 2019 03:42:58 -0300
+Subject: media: seco-cec: Add a missing 'release_region()' in an error
+ handling path
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit a9cc4cbcdfd378b65fd4e398800cfa14e3855042 ]
+
+At the beginning of the probe function, we have a call to
+'request_muxed_region(BRA_SMB_BASE_ADDR, 7, "CEC00001")()'
+
+A corresponding 'release_region()' is performed in the remove function but
+is lacking in the error handling path.
+
+Add it.
+
+Fixes: b03c2fb97adc ("media: add SECO cec driver")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/seco-cec/seco-cec.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/platform/seco-cec/seco-cec.c b/drivers/media/platform/seco-cec/seco-cec.c
+index 9cd60fe1867c..a86b6e8f9196 100644
+--- a/drivers/media/platform/seco-cec/seco-cec.c
++++ b/drivers/media/platform/seco-cec/seco-cec.c
+@@ -675,6 +675,7 @@ err_notifier:
+ err_delete_adapter:
+ 	cec_delete_adapter(secocec->cec_adap);
+ err:
++	release_region(BRA_SMB_BASE_ADDR, 7);
+ 	dev_err(dev, "%s device probe failed\n", dev_name(dev));
+ 
+ 	return ret;
+-- 
+2.20.1
+
diff --git a/queue-5.4/media-si470x-i2c-add-missed-operations-in-remove.patch b/queue-5.4/media-si470x-i2c-add-missed-operations-in-remove.patch
new file mode 100644
index 00000000000..18cf5f5b8a2
--- /dev/null
+++ b/queue-5.4/media-si470x-i2c-add-missed-operations-in-remove.patch
@@ -0,0 +1,37 @@
+From 65ef2bbc5e9721a2aa406ce619f7cbfd653039d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Nov 2019 07:28:15 +0100
+Subject: media: si470x-i2c: add missed operations in remove
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+[ Upstream commit 2df200ab234a86836a8879a05a8007d6b884eb14 ]
+
+The driver misses calling v4l2_ctrl_handler_free and
+v4l2_device_unregister in remove like what is done in probe failure.
+Add the calls to fix it.
+
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/radio/si470x/radio-si470x-i2c.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/media/radio/si470x/radio-si470x-i2c.c b/drivers/media/radio/si470x/radio-si470x-i2c.c
+index 7541698a0be1..f491420d7b53 100644
+--- a/drivers/media/radio/si470x/radio-si470x-i2c.c
++++ b/drivers/media/radio/si470x/radio-si470x-i2c.c
+@@ -482,6 +482,8 @@ static int si470x_i2c_remove(struct i2c_client *client)
+ 	if (radio->gpio_reset)
+ 		gpiod_set_value(radio->gpio_reset, 0);
+ 
++	v4l2_ctrl_handler_free(&radio->hdl);
++	v4l2_device_unregister(&radio->v4l2_dev);
+ 	return 0;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/media-smiapp-register-sensor-after-enabling-runtime-.patch b/queue-5.4/media-smiapp-register-sensor-after-enabling-runtime-.patch
new file mode 100644
index 00000000000..5c1a169061d
--- /dev/null
+++ b/queue-5.4/media-smiapp-register-sensor-after-enabling-runtime-.patch
@@ -0,0 +1,57 @@
+From 7099626bf00cc09ddf3f894653703c9b8df9a075 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Oct 2019 08:16:02 -0300
+Subject: media: smiapp: Register sensor after enabling runtime PM on the
+ device
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit 90c9e4a4dba9f4de331372e745fb1991c1faa598 ]
+
+Earlier it was possible that the parts of the driver that assumed runtime
+PM was enabled were being called before runtime PM was enabled in the
+driver's probe function. So enable runtime PM before registering the
+sub-device.
+
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/smiapp/smiapp-core.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/media/i2c/smiapp/smiapp-core.c b/drivers/media/i2c/smiapp/smiapp-core.c
+index 9adf8e034e7d..42805dfbffeb 100644
+--- a/drivers/media/i2c/smiapp/smiapp-core.c
++++ b/drivers/media/i2c/smiapp/smiapp-core.c
+@@ -3101,19 +3101,23 @@ static int smiapp_probe(struct i2c_client *client)
+ 	if (rval < 0)
+ 		goto out_media_entity_cleanup;
+ 
+-	rval = v4l2_async_register_subdev_sensor_common(&sensor->src->sd);
+-	if (rval < 0)
+-		goto out_media_entity_cleanup;
+-
+ 	pm_runtime_set_active(&client->dev);
+ 	pm_runtime_get_noresume(&client->dev);
+ 	pm_runtime_enable(&client->dev);
++
++	rval = v4l2_async_register_subdev_sensor_common(&sensor->src->sd);
++	if (rval < 0)
++		goto out_disable_runtime_pm;
++
+ 	pm_runtime_set_autosuspend_delay(&client->dev, 1000);
+ 	pm_runtime_use_autosuspend(&client->dev);
+ 	pm_runtime_put_autosuspend(&client->dev);
+ 
+ 	return 0;
+ 
++out_disable_runtime_pm:
++	pm_runtime_disable(&client->dev);
++
+ out_media_entity_cleanup:
+ 	media_entity_cleanup(&sensor->src->sd.entity);
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/media-st-mipid02-add-a-check-for-devm_gpiod_get_opti.patch b/queue-5.4/media-st-mipid02-add-a-check-for-devm_gpiod_get_opti.patch
new file mode 100644
index 00000000000..01e9a724d3f
--- /dev/null
+++ b/queue-5.4/media-st-mipid02-add-a-check-for-devm_gpiod_get_opti.patch
@@ -0,0 +1,40 @@
+From a116534222ccc138a5ad4a5f2d2c1920364d1521 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Oct 2019 22:46:56 -0300
+Subject: media: st-mipid02: add a check for devm_gpiod_get_optional
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+[ Upstream commit 61c03b631b74a38ab53753f3ee971a55886d4843 ]
+
+mipid02_probe misses a check for devm_gpiod_get_optional and may miss
+the failure.
+Add a check to fix the problem.
+
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/st-mipid02.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/media/i2c/st-mipid02.c b/drivers/media/i2c/st-mipid02.c
+index 81285b8d5cfb..003ba22334cd 100644
+--- a/drivers/media/i2c/st-mipid02.c
++++ b/drivers/media/i2c/st-mipid02.c
+@@ -971,6 +971,11 @@ static int mipid02_probe(struct i2c_client *client)
+ 	bridge->reset_gpio = devm_gpiod_get_optional(dev, "reset",
+ 						     GPIOD_OUT_HIGH);
+ 
++	if (IS_ERR(bridge->reset_gpio)) {
++		dev_err(dev, "failed to get reset GPIO\n");
++		return PTR_ERR(bridge->reset_gpio);
++	}
++
+ 	ret = mipid02_get_regulators(bridge);
+ 	if (ret) {
+ 		dev_err(dev, "failed to get regulators %d", ret);
+-- 
+2.20.1
+
diff --git a/queue-5.4/media-staging-imx-use-a-shorter-name-for-driver.patch b/queue-5.4/media-staging-imx-use-a-shorter-name-for-driver.patch
new file mode 100644
index 00000000000..458329ef7bb
--- /dev/null
+++ b/queue-5.4/media-staging-imx-use-a-shorter-name-for-driver.patch
@@ -0,0 +1,58 @@
+From 8bcf04e14fe963e156d4046cb9d9fa45a8c839ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Oct 2019 14:13:13 -0300
+Subject: media: staging/imx: Use a shorter name for driver
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit ce22c6f242b6d7b5e0318da2c92b5b00b5bbc698 ]
+
+Currently v4l2-compliance tool returns the following output:
+
+Compliance test for imx-media-captu device /dev/video0:
+
+Driver Info:
+        Driver name      : imx-media-captu
+        Card type        : imx-media-capture
+...
+
+The driver name string is limited to 16 characters, so provide
+a shorter name so that we can have a better output.
+
+While at it, use the same shorter name for driver and card.
+
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/imx/imx-media-capture.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/staging/media/imx/imx-media-capture.c b/drivers/staging/media/imx/imx-media-capture.c
+index b33a07bc9105..46576e32581f 100644
+--- a/drivers/staging/media/imx/imx-media-capture.c
++++ b/drivers/staging/media/imx/imx-media-capture.c
+@@ -26,6 +26,8 @@
+ #include <media/imx.h>
+ #include "imx-media.h"
+ 
++#define IMX_CAPTURE_NAME "imx-capture"
++
+ struct capture_priv {
+ 	struct imx_media_video_dev vdev;
+ 
+@@ -69,8 +71,8 @@ static int vidioc_querycap(struct file *file, void *fh,
+ {
+ 	struct capture_priv *priv = video_drvdata(file);
+ 
+-	strscpy(cap->driver, "imx-media-capture", sizeof(cap->driver));
+-	strscpy(cap->card, "imx-media-capture", sizeof(cap->card));
++	strscpy(cap->driver, IMX_CAPTURE_NAME, sizeof(cap->driver));
++	strscpy(cap->card, IMX_CAPTURE_NAME, sizeof(cap->card));
+ 	snprintf(cap->bus_info, sizeof(cap->bus_info),
+ 		 "platform:%s", priv->src_sd->name);
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/media-ti-vpe-vpe-ensure-buffers-are-cleaned-up-prope.patch b/queue-5.4/media-ti-vpe-vpe-ensure-buffers-are-cleaned-up-prope.patch
new file mode 100644
index 00000000000..268b484f9de
--- /dev/null
+++ b/queue-5.4/media-ti-vpe-vpe-ensure-buffers-are-cleaned-up-prope.patch
@@ -0,0 +1,127 @@
+From 08e999f4e5ba131c82d7807adfad68b9d28c6238 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Oct 2019 12:10:01 -0300
+Subject: media: ti-vpe: vpe: ensure buffers are cleaned up properly in abort
+ cases
+
+From: Benoit Parrot <bparrot@ti.com>
+
+[ Upstream commit cf6acb73b050e98b5cc435fae0e8ae0157520410 ]
+
+v4l2-compliance fails with this message:
+
+   fail: v4l2-test-buffers.cpp(691): ret == 0
+   fail: v4l2-test-buffers.cpp(974): captureBufs(node, q, m2m_q,
+frame_count, true)
+   test MMAP: FAIL
+
+This caused the following Kernel Warning:
+
+WARNING: CPU: 0 PID: 961 at
+drivers/media/v4l2-core/videobuf2-core.c:1658
+__vb2_queue_cancel+0x174/0x1d8
+...
+CPU: 0 PID: 961 Comm: v4l2-compliance Not tainted
+4.14.62-01720-g20ecd717e87a #6
+Hardware name: Generic DRA72X (Flattened Device Tree)
+Backtrace:
+[<c020b5bc>] (dump_backtrace) from [<c020b8a0>] (show_stack+0x18/0x1c)
+ r7:00000009 r6:60070013 r5:00000000 r4:c1053824
+[<c020b888>] (show_stack) from [<c09232e8>] (dump_stack+0x90/0xa4)
+[<c0923258>] (dump_stack) from [<c022b740>] (__warn+0xec/0x104)
+  r7:00000009 r6:c0c0ad50 r5:00000000 r4:00000000
+[<c022b654>] (__warn) from [<c022b810>] (warn_slowpath_null+0x28/0x30)
+  r9:00000008 r8:00000000 r7:eced4808 r6:edbc9bac r5:eced4844
+r4:eced4808
+[<c022b7e8>] (warn_slowpath_null) from [<c0726f48>]
+(__vb2_queue_cancel+0x174/0x1d8)
+[<c0726dd4>] (__vb2_queue_cancel) from [<c0727648>]
+(vb2_core_queue_release+0x20/0x40)
+  r10:ecc7bd70 r9:00000008 r8:00000000 r7:edb73010 r6:edbc9bac
+r5:eced4844
+  r4:eced4808 r3:00000004
+[<c0727628>] (vb2_core_queue_release) from [<c0729528>]
+(vb2_queue_release+0x10/0x14)
+  r5:edbc9810 r4:eced4800
+[<c0729518>] (vb2_queue_release) from [<c0724d08>]
+(v4l2_m2m_ctx_release+0x1c/0x30)
+[<c0724cec>] (v4l2_m2m_ctx_release) from [<bf0e8f28>]
+(vpe_release+0x74/0xb0 [ti_vpe])
+  r5:edbc9810 r4:ed67a400
+[<bf0e8eb4>] (vpe_release [ti_vpe]) from [<c070fccc>]
+(v4l2_release+0x3c/0x80)
+  r7:edb73010 r6:ed176aa0 r5:edbc9868 r4:ed5119c0
+[<c070fc90>] (v4l2_release) from [<c033cf1c>] (__fput+0x8c/0x1dc)
+  r5:ecc7bd70 r4:ed5119c0
+[<c033ce90>] (__fput) from [<c033d0cc>] (____fput+0x10/0x14)
+  r10:00000000 r9:ed5119c0 r8:ece392d0 r7:c1059544 r6:ece38d80
+r5:ece392b4
+  r4:00000000
+[<c033d0bc>] (____fput) from [<c0246e00>] (task_work_run+0x98/0xb8)
+[<c0246d68>] (task_work_run) from [<c022f1d8>] (do_exit+0x170/0xa80)
+  r9:ece351fc r8:00000000 r7:ecde3f58 r6:ffffe000 r5:ece351c0
+r4:ece38d80
+[<c022f068>] (do_exit) from [<c022fb6c>] (do_group_exit+0x48/0xc4)
+  r7:000000f8
+[<c022fb24>] (do_group_exit) from [<c022fc00>]
+(__wake_up_parent+0x0/0x28)
+  r7:000000f8 r6:b6c6a798 r5:00000001 r4:00000001
+[<c022fbe8>] (SyS_exit_group) from [<c0207c80>]
+(ret_fast_syscall+0x0/0x4c)
+
+These warnings are caused by buffers which not properly cleaned
+up/release during an abort use case.
+
+In the abort cases the VPDMA desc buffers would still be mapped and the
+in-flight VB2 buffers would not be released properly causing a kernel
+warning from being generated by the videobuf2-core level.
+
+Signed-off-by: Benoit Parrot <bparrot@ti.com>
+Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/ti-vpe/vpe.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/platform/ti-vpe/vpe.c b/drivers/media/platform/ti-vpe/vpe.c
+index 7b321c3b594f..512660b4ee63 100644
+--- a/drivers/media/platform/ti-vpe/vpe.c
++++ b/drivers/media/platform/ti-vpe/vpe.c
+@@ -1404,9 +1404,6 @@ static irqreturn_t vpe_irq(int irq_vpe, void *data)
+ 	 /* the previous dst mv buffer becomes the next src mv buffer */
+ 	ctx->src_mv_buf_selector = !ctx->src_mv_buf_selector;
+ 
+-	if (ctx->aborting)
+-		goto finished;
+-
+ 	s_vb = ctx->src_vbs[0];
+ 	d_vb = ctx->dst_vb;
+ 
+@@ -1471,6 +1468,9 @@ static irqreturn_t vpe_irq(int irq_vpe, void *data)
+ 	ctx->src_vbs[0] = NULL;
+ 	ctx->dst_vb = NULL;
+ 
++	if (ctx->aborting)
++		goto finished;
++
+ 	ctx->bufs_completed++;
+ 	if (ctx->bufs_completed < ctx->bufs_per_job && job_ready(ctx)) {
+ 		device_run(ctx);
+@@ -2366,6 +2366,12 @@ static int vpe_release(struct file *file)
+ 
+ 	mutex_lock(&dev->dev_mutex);
+ 	free_mv_buffers(ctx);
++
++	vpdma_unmap_desc_buf(dev->vpdma, &ctx->desc_list.buf);
++	vpdma_unmap_desc_buf(dev->vpdma, &ctx->mmr_adb);
++	vpdma_unmap_desc_buf(dev->vpdma, &ctx->sc_coeff_h);
++	vpdma_unmap_desc_buf(dev->vpdma, &ctx->sc_coeff_v);
++
+ 	vpdma_free_desc_list(&ctx->desc_list);
+ 	vpdma_free_desc_buf(&ctx->mmr_adb);
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/media-ti-vpe-vpe-fix-a-v4l2-compliance-failure-about.patch b/queue-5.4/media-ti-vpe-vpe-fix-a-v4l2-compliance-failure-about.patch
new file mode 100644
index 00000000000..63d0b811a4b
--- /dev/null
+++ b/queue-5.4/media-ti-vpe-vpe-fix-a-v4l2-compliance-failure-about.patch
@@ -0,0 +1,51 @@
+From 0c2f0dcace8aeec2da9ec028239c15a127090d2e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Oct 2019 12:10:00 -0300
+Subject: media: ti-vpe: vpe: fix a v4l2-compliance failure about frame
+ sequence number
+
+From: Benoit Parrot <bparrot@ti.com>
+
+[ Upstream commit 2444846c0dbfa4ead21b621e4300ec32c90fbf38 ]
+
+v4l2-compliance fails with this message:
+
+   fail: v4l2-test-buffers.cpp(294): \
+	(int)g_sequence() < seq.last_seq + 1
+   fail: v4l2-test-buffers.cpp(740): \
+	buf.check(m2m_q, last_m2m_seq)
+   fail: v4l2-test-buffers.cpp(974): \
+	captureBufs(node, q, m2m_q, frame_count, true)
+   test MMAP: FAIL
+
+The driver is failing to update the source frame sequence number in the
+vb2 buffer object. Only the destination frame sequence was being
+updated.
+
+This is only a reporting issue if the user space app actually cares
+about the frame sequence number. But it is fixed nonetheless.
+
+Signed-off-by: Benoit Parrot <bparrot@ti.com>
+Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/ti-vpe/vpe.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/platform/ti-vpe/vpe.c b/drivers/media/platform/ti-vpe/vpe.c
+index 328976a52941..e44299008a7b 100644
+--- a/drivers/media/platform/ti-vpe/vpe.c
++++ b/drivers/media/platform/ti-vpe/vpe.c
+@@ -1417,6 +1417,7 @@ static irqreturn_t vpe_irq(int irq_vpe, void *data)
+ 		d_vb->timecode = s_vb->timecode;
+ 
+ 	d_vb->sequence = ctx->sequence;
++	s_vb->sequence = ctx->sequence;
+ 
+ 	d_q_data = &ctx->q_data[Q_DATA_DST];
+ 	if (d_q_data->flags & Q_IS_INTERLACED) {
+-- 
+2.20.1
+
diff --git a/queue-5.4/media-ti-vpe-vpe-fix-a-v4l2-compliance-failure-about.patch-8034 b/queue-5.4/media-ti-vpe-vpe-fix-a-v4l2-compliance-failure-about.patch-8034
new file mode 100644
index 00000000000..34a4c9ae21b
--- /dev/null
+++ b/queue-5.4/media-ti-vpe-vpe-fix-a-v4l2-compliance-failure-about.patch-8034
@@ -0,0 +1,65 @@
+From 668781299e854aff5754019d5e7df82dd9074a71 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Oct 2019 12:09:59 -0300
+Subject: media: ti-vpe: vpe: fix a v4l2-compliance failure about invalid
+ sizeimage
+
+From: Benoit Parrot <bparrot@ti.com>
+
+[ Upstream commit 0bac73adea4df8d34048b38f6ff24dc3e73e90b6 ]
+
+v4l2-compliance fails with this message:
+
+   fail: v4l2-test-formats.cpp(463): !pfmt.sizeimage
+   fail: v4l2-test-formats.cpp(736): \
+	Video Capture Multiplanar is valid, \
+	but TRY_FMT failed to return a format
+   test VIDIOC_TRY_FMT: FAIL
+
+This failure is causd by the driver failing to handle out range
+'bytesperline' values from user space applications.
+
+VPDMA hardware is limited to 64k line stride (16 bytes aligned, so 65520
+bytes). So make sure the provided or calculated 'bytesperline' is
+smaller than the maximum value.
+
+Signed-off-by: Benoit Parrot <bparrot@ti.com>
+Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/ti-vpe/vpdma.h | 1 +
+ drivers/media/platform/ti-vpe/vpe.c   | 4 ++++
+ 2 files changed, 5 insertions(+)
+
+diff --git a/drivers/media/platform/ti-vpe/vpdma.h b/drivers/media/platform/ti-vpe/vpdma.h
+index 28bc94129348..9bacfd603250 100644
+--- a/drivers/media/platform/ti-vpe/vpdma.h
++++ b/drivers/media/platform/ti-vpe/vpdma.h
+@@ -57,6 +57,7 @@ struct vpdma_data_format {
+ 						 * line stride of source and dest
+ 						 * buffers should be 16 byte aligned
+ 						 */
++#define VPDMA_MAX_STRIDE		65520	/* Max line stride 16 byte aligned */
+ #define VPDMA_DTD_DESC_SIZE		32	/* 8 words */
+ #define VPDMA_CFD_CTD_DESC_SIZE		16	/* 4 words */
+ 
+diff --git a/drivers/media/platform/ti-vpe/vpe.c b/drivers/media/platform/ti-vpe/vpe.c
+index 512660b4ee63..8b14ba4a3d9e 100644
+--- a/drivers/media/platform/ti-vpe/vpe.c
++++ b/drivers/media/platform/ti-vpe/vpe.c
+@@ -1668,6 +1668,10 @@ static int __vpe_try_fmt(struct vpe_ctx *ctx, struct v4l2_format *f,
+ 		if (stride > plane_fmt->bytesperline)
+ 			plane_fmt->bytesperline = stride;
+ 
++		plane_fmt->bytesperline = clamp_t(u32, plane_fmt->bytesperline,
++						  stride,
++						  VPDMA_MAX_STRIDE);
++
+ 		plane_fmt->bytesperline = ALIGN(plane_fmt->bytesperline,
+ 						VPDMA_STRIDE_ALIGN);
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/media-ti-vpe-vpe-fix-a-v4l2-compliance-failure-causi.patch b/queue-5.4/media-ti-vpe-vpe-fix-a-v4l2-compliance-failure-causi.patch
new file mode 100644
index 00000000000..4bb9036586f
--- /dev/null
+++ b/queue-5.4/media-ti-vpe-vpe-fix-a-v4l2-compliance-failure-causi.patch
@@ -0,0 +1,62 @@
+From a64acf9ce75190983ae844613d2b6caf0102fb35 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Oct 2019 12:09:56 -0300
+Subject: media: ti-vpe: vpe: fix a v4l2-compliance failure causing a kernel
+ panic
+
+From: Benoit Parrot <bparrot@ti.com>
+
+[ Upstream commit a37980ac5be29b83da67bf7d571c6bd9f90f8e45 ]
+
+v4l2-compliance fails with this message:
+
+   warn: v4l2-test-formats.cpp(717): \
+   	TRY_FMT cannot handle an invalid pixelformat.
+   test VIDIOC_TRY_FMT: FAIL
+
+This causes the following kernel panic:
+
+Unable to handle kernel paging request at virtual address 56595561
+pgd = ecd80e00
+*pgd=00000000
+Internal error: Oops: 205 [#1] PREEMPT SMP ARM
+...
+CPU: 0 PID: 930 Comm: v4l2-compliance Not tainted \
+	4.14.62-01715-gc8cd67f49a19 #1
+Hardware name: Generic DRA72X (Flattened Device Tree)
+task: ece44d80 task.stack: ecc6e000
+PC is at __vpe_try_fmt+0x18c/0x2a8 [ti_vpe]
+LR is at 0x8
+
+Because the driver fails to properly check the 'num_planes' values for
+proper ranges it ends up accessing out of bound data causing the kernel
+panic.
+
+Since this driver only handle single or dual plane pixel format, make
+sure the provided value does not exceed 2 planes.
+
+Signed-off-by: Benoit Parrot <bparrot@ti.com>
+Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/ti-vpe/vpe.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/ti-vpe/vpe.c b/drivers/media/platform/ti-vpe/vpe.c
+index 2b731c8f5459..7b321c3b594f 100644
+--- a/drivers/media/platform/ti-vpe/vpe.c
++++ b/drivers/media/platform/ti-vpe/vpe.c
+@@ -1629,7 +1629,7 @@ static int __vpe_try_fmt(struct vpe_ctx *ctx, struct v4l2_format *f,
+ 			      &pix->height, MIN_H, MAX_H, H_ALIGN,
+ 			      S_ALIGN);
+ 
+-	if (!pix->num_planes)
++	if (!pix->num_planes || pix->num_planes > 2)
+ 		pix->num_planes = fmt->coplanar ? 2 : 1;
+ 	else if (pix->num_planes > 1 && !fmt->coplanar)
+ 		pix->num_planes = 1;
+-- 
+2.20.1
+
diff --git a/queue-5.4/media-ti-vpe-vpe-fix-a-v4l2-compliance-warning-about.patch b/queue-5.4/media-ti-vpe-vpe-fix-a-v4l2-compliance-warning-about.patch
new file mode 100644
index 00000000000..0c807e226fe
--- /dev/null
+++ b/queue-5.4/media-ti-vpe-vpe-fix-a-v4l2-compliance-warning-about.patch
@@ -0,0 +1,82 @@
+From 70a90bb9cd6aa4f697bf2725a8753d92c1f7c09a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Oct 2019 12:09:57 -0300
+Subject: media: ti-vpe: vpe: fix a v4l2-compliance warning about invalid pixel
+ format
+
+From: Benoit Parrot <bparrot@ti.com>
+
+[ Upstream commit 06bec72b250b2cb3ba96fa45c2b8e0fb83745517 ]
+
+v4l2-compliance warns with this message:
+
+   warn: v4l2-test-formats.cpp(717): \
+ 	TRY_FMT cannot handle an invalid pixelformat.
+   warn: v4l2-test-formats.cpp(718): \
+ 	This may or may not be a problem. For more information see:
+   warn: v4l2-test-formats.cpp(719): \
+ 	http://www.mail-archive.com/linux-media@vger.kernel.org/msg56550.html
+	...
+   test VIDIOC_TRY_FMT: FAIL
+
+We need to make sure that the returns a valid pixel format in all
+instance. Based on the v4l2 framework convention drivers must return a
+valid pixel format when the requested pixel format is either invalid or
+not supported.
+
+Signed-off-by: Benoit Parrot <bparrot@ti.com>
+Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/ti-vpe/vpe.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/media/platform/ti-vpe/vpe.c b/drivers/media/platform/ti-vpe/vpe.c
+index 5ba72445584d..328976a52941 100644
+--- a/drivers/media/platform/ti-vpe/vpe.c
++++ b/drivers/media/platform/ti-vpe/vpe.c
+@@ -338,20 +338,25 @@ enum {
+ };
+ 
+ /* find our format description corresponding to the passed v4l2_format */
+-static struct vpe_fmt *find_format(struct v4l2_format *f)
++static struct vpe_fmt *__find_format(u32 fourcc)
+ {
+ 	struct vpe_fmt *fmt;
+ 	unsigned int k;
+ 
+ 	for (k = 0; k < ARRAY_SIZE(vpe_formats); k++) {
+ 		fmt = &vpe_formats[k];
+-		if (fmt->fourcc == f->fmt.pix.pixelformat)
++		if (fmt->fourcc == fourcc)
+ 			return fmt;
+ 	}
+ 
+ 	return NULL;
+ }
+ 
++static struct vpe_fmt *find_format(struct v4l2_format *f)
++{
++	return __find_format(f->fmt.pix.pixelformat);
++}
++
+ /*
+  * there is one vpe_dev structure in the driver, it is shared by
+  * all instances.
+@@ -1574,9 +1579,9 @@ static int __vpe_try_fmt(struct vpe_ctx *ctx, struct v4l2_format *f,
+ 	unsigned int stride = 0;
+ 
+ 	if (!fmt || !(fmt->types & type)) {
+-		vpe_err(ctx->dev, "Fourcc format (0x%08x) invalid.\n",
++		vpe_dbg(ctx->dev, "Fourcc format (0x%08x) invalid.\n",
+ 			pix->pixelformat);
+-		return -EINVAL;
++		fmt = __find_format(V4L2_PIX_FMT_YUYV);
+ 	}
+ 
+ 	if (pix->field != V4L2_FIELD_NONE && pix->field != V4L2_FIELD_ALTERNATE
+-- 
+2.20.1
+
diff --git a/queue-5.4/media-ti-vpe-vpe-fix-motion-vector-vpdma-stride.patch b/queue-5.4/media-ti-vpe-vpe-fix-motion-vector-vpdma-stride.patch
new file mode 100644
index 00000000000..66e54581a9e
--- /dev/null
+++ b/queue-5.4/media-ti-vpe-vpe-fix-motion-vector-vpdma-stride.patch
@@ -0,0 +1,105 @@
+From 1de1c7a81795df6cabfd35cbc70c0f96c77b2511 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Oct 2019 12:09:50 -0300
+Subject: media: ti-vpe: vpe: Fix Motion Vector vpdma stride
+
+From: Benoit Parrot <bparrot@ti.com>
+
+[ Upstream commit 102af9b9922f658f705a4b0deaccabac409131bf ]
+
+commit 3dc2046ca78b ("[media] media: ti-vpe: vpe: allow use of user
+specified stride") and commit da4414eaed15 ("[media] media: ti-vpe: vpdma:
+add support for user specified stride") resulted in the Motion Vector
+stride to be the same as the image stride.
+
+This caused memory corruption in the output image as mentioned in
+commit 00db969964c8 ("[media] media: ti-vpe: vpe: Fix line stride
+for output motion vector").
+
+Fixes: 3dc2046ca78b ("[media] media: ti-vpe: vpe: allow use of user specified stride")
+Fixes: da4414eaed15 ("[media] media: ti-vpe: vpdma: add support for user specified stride")
+Signed-off-by: Benoit Parrot <bparrot@ti.com>
+Acked-by: Nikhil Devshatwar <nikhil.nd@ti.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/ti-vpe/vpe.c | 18 +++++++++++++-----
+ 1 file changed, 13 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/media/platform/ti-vpe/vpe.c b/drivers/media/platform/ti-vpe/vpe.c
+index 60b575bb44c4..5ba72445584d 100644
+--- a/drivers/media/platform/ti-vpe/vpe.c
++++ b/drivers/media/platform/ti-vpe/vpe.c
+@@ -1013,11 +1013,14 @@ static void add_out_dtd(struct vpe_ctx *ctx, int port)
+ 	dma_addr_t dma_addr;
+ 	u32 flags = 0;
+ 	u32 offset = 0;
++	u32 stride;
+ 
+ 	if (port == VPE_PORT_MV_OUT) {
+ 		vpdma_fmt = &vpdma_misc_fmts[VPDMA_DATA_FMT_MV];
+ 		dma_addr = ctx->mv_buf_dma[mv_buf_selector];
+ 		q_data = &ctx->q_data[Q_DATA_SRC];
++		stride = ALIGN((q_data->width * vpdma_fmt->depth) >> 3,
++			       VPDMA_STRIDE_ALIGN);
+ 	} else {
+ 		/* to incorporate interleaved formats */
+ 		int plane = fmt->coplanar ? p_data->vb_part : 0;
+@@ -1044,6 +1047,7 @@ static void add_out_dtd(struct vpe_ctx *ctx, int port)
+ 		}
+ 		/* Apply the offset */
+ 		dma_addr += offset;
++		stride = q_data->bytesperline[VPE_LUMA];
+ 	}
+ 
+ 	if (q_data->flags & Q_DATA_FRAME_1D)
+@@ -1055,7 +1059,7 @@ static void add_out_dtd(struct vpe_ctx *ctx, int port)
+ 			   MAX_W, MAX_H);
+ 
+ 	vpdma_add_out_dtd(&ctx->desc_list, q_data->width,
+-			  q_data->bytesperline[VPE_LUMA], &q_data->c_rect,
++			  stride, &q_data->c_rect,
+ 			  vpdma_fmt, dma_addr, MAX_OUT_WIDTH_REG1,
+ 			  MAX_OUT_HEIGHT_REG1, p_data->channel, flags);
+ }
+@@ -1074,10 +1078,13 @@ static void add_in_dtd(struct vpe_ctx *ctx, int port)
+ 	dma_addr_t dma_addr;
+ 	u32 flags = 0;
+ 	u32 offset = 0;
++	u32 stride;
+ 
+ 	if (port == VPE_PORT_MV_IN) {
+ 		vpdma_fmt = &vpdma_misc_fmts[VPDMA_DATA_FMT_MV];
+ 		dma_addr = ctx->mv_buf_dma[mv_buf_selector];
++		stride = ALIGN((q_data->width * vpdma_fmt->depth) >> 3,
++			       VPDMA_STRIDE_ALIGN);
+ 	} else {
+ 		/* to incorporate interleaved formats */
+ 		int plane = fmt->coplanar ? p_data->vb_part : 0;
+@@ -1104,6 +1111,7 @@ static void add_in_dtd(struct vpe_ctx *ctx, int port)
+ 		}
+ 		/* Apply the offset */
+ 		dma_addr += offset;
++		stride = q_data->bytesperline[VPE_LUMA];
+ 
+ 		if (q_data->flags & Q_DATA_INTERLACED_SEQ_TB) {
+ 			/*
+@@ -1139,10 +1147,10 @@ static void add_in_dtd(struct vpe_ctx *ctx, int port)
+ 	if (p_data->vb_part && fmt->fourcc == V4L2_PIX_FMT_NV12)
+ 		frame_height /= 2;
+ 
+-	vpdma_add_in_dtd(&ctx->desc_list, q_data->width,
+-			 q_data->bytesperline[VPE_LUMA], &q_data->c_rect,
+-		vpdma_fmt, dma_addr, p_data->channel, field, flags, frame_width,
+-		frame_height, 0, 0);
++	vpdma_add_in_dtd(&ctx->desc_list, q_data->width, stride,
++			 &q_data->c_rect, vpdma_fmt, dma_addr,
++			 p_data->channel, field, flags, frame_width,
++			 frame_height, 0, 0);
+ }
+ 
+ /*
+-- 
+2.20.1
+
diff --git a/queue-5.4/media-ti-vpe-vpe-make-sure-yuyv-is-set-as-default-fo.patch b/queue-5.4/media-ti-vpe-vpe-make-sure-yuyv-is-set-as-default-fo.patch
new file mode 100644
index 00000000000..dcbd1d811b6
--- /dev/null
+++ b/queue-5.4/media-ti-vpe-vpe-make-sure-yuyv-is-set-as-default-fo.patch
@@ -0,0 +1,53 @@
+From a0ba57e52f3cee6eca305122d2c9eec300c314a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Oct 2019 12:09:58 -0300
+Subject: media: ti-vpe: vpe: Make sure YUYV is set as default format
+
+From: Benoit Parrot <bparrot@ti.com>
+
+[ Upstream commit e20b248051ca0f90d84b4d9378e4780bc31f16c6 ]
+
+v4l2-compliance fails with this message:
+
+   fail: v4l2-test-formats.cpp(672): \
+	Video Capture Multiplanar: TRY_FMT(G_FMT) != G_FMT
+   fail: v4l2-test-formats.cpp(672): \
+	Video Output Multiplanar: TRY_FMT(G_FMT) != G_FMT
+	...
+   test VIDIOC_TRY_FMT: FAIL
+
+The default pixel format was setup as pointing to a specific offset in
+the vpe_formats table assuming it was pointing to the V4L2_PIX_FMT_YUYV
+entry. This became false after the addition on the NV21 format (see
+above commid-id)
+
+So instead of hard-coding an offset which might change over time we need
+to use a lookup helper instead so we know the default will always be what
+we intended.
+
+Signed-off-by: Benoit Parrot <bparrot@ti.com>
+Fixes: 40cc823f7005 ("media: ti-vpe: Add support for NV21 format")
+Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/ti-vpe/vpe.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/ti-vpe/vpe.c b/drivers/media/platform/ti-vpe/vpe.c
+index e44299008a7b..2b731c8f5459 100644
+--- a/drivers/media/platform/ti-vpe/vpe.c
++++ b/drivers/media/platform/ti-vpe/vpe.c
+@@ -2288,7 +2288,7 @@ static int vpe_open(struct file *file)
+ 	v4l2_ctrl_handler_setup(hdl);
+ 
+ 	s_q_data = &ctx->q_data[Q_DATA_SRC];
+-	s_q_data->fmt = &vpe_formats[2];
++	s_q_data->fmt = __find_format(V4L2_PIX_FMT_YUYV);
+ 	s_q_data->width = 1920;
+ 	s_q_data->height = 1080;
+ 	s_q_data->nplanes = 1;
+-- 
+2.20.1
+
diff --git a/queue-5.4/media-v4l2-core-fix-touch-support-in-v4l_g_fmt.patch b/queue-5.4/media-v4l2-core-fix-touch-support-in-v4l_g_fmt.patch
new file mode 100644
index 00000000000..f238c49634a
--- /dev/null
+++ b/queue-5.4/media-v4l2-core-fix-touch-support-in-v4l_g_fmt.patch
@@ -0,0 +1,87 @@
+From b1846be8fd34947d2a97eb3be92aae92d2a3f536 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Oct 2019 04:51:40 -0300
+Subject: media: v4l2-core: fix touch support in v4l_g_fmt
+
+From: Vandana BN <bnvandana@gmail.com>
+
+[ Upstream commit 545b618cfb5cadacd00c25066b9a36540e5ca9e9 ]
+
+v4l_s_fmt, for VFL_TYPE_TOUCH, sets unneeded members of
+the v4l2_pix_format structure to default values.This was
+missing in v4l_g_fmt, which would lead to failures in
+v4l2-compliance tests.
+
+Signed-off-by: Vandana BN <bnvandana@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/v4l2-core/v4l2-ioctl.c | 33 +++++++++++++++-------------
+ 1 file changed, 18 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c
+index 51b912743f0f..21bb96ce4cd6 100644
+--- a/drivers/media/v4l2-core/v4l2-ioctl.c
++++ b/drivers/media/v4l2-core/v4l2-ioctl.c
+@@ -1466,10 +1466,26 @@ static int v4l_enum_fmt(const struct v4l2_ioctl_ops *ops,
+ 	return ret;
+ }
+ 
++static void v4l_pix_format_touch(struct v4l2_pix_format *p)
++{
++	/*
++	 * The v4l2_pix_format structure contains fields that make no sense for
++	 * touch. Set them to default values in this case.
++	 */
++
++	p->field = V4L2_FIELD_NONE;
++	p->colorspace = V4L2_COLORSPACE_RAW;
++	p->flags = 0;
++	p->ycbcr_enc = 0;
++	p->quantization = 0;
++	p->xfer_func = 0;
++}
++
+ static int v4l_g_fmt(const struct v4l2_ioctl_ops *ops,
+ 				struct file *file, void *fh, void *arg)
+ {
+ 	struct v4l2_format *p = arg;
++	struct video_device *vfd = video_devdata(file);
+ 	int ret = check_fmt(file, p->type);
+ 
+ 	if (ret)
+@@ -1507,6 +1523,8 @@ static int v4l_g_fmt(const struct v4l2_ioctl_ops *ops,
+ 		ret = ops->vidioc_g_fmt_vid_cap(file, fh, arg);
+ 		/* just in case the driver zeroed it again */
+ 		p->fmt.pix.priv = V4L2_PIX_FMT_PRIV_MAGIC;
++		if (vfd->vfl_type == VFL_TYPE_TOUCH)
++			v4l_pix_format_touch(&p->fmt.pix);
+ 		return ret;
+ 	case V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE:
+ 		return ops->vidioc_g_fmt_vid_cap_mplane(file, fh, arg);
+@@ -1544,21 +1562,6 @@ static int v4l_g_fmt(const struct v4l2_ioctl_ops *ops,
+ 	return -EINVAL;
+ }
+ 
+-static void v4l_pix_format_touch(struct v4l2_pix_format *p)
+-{
+-	/*
+-	 * The v4l2_pix_format structure contains fields that make no sense for
+-	 * touch. Set them to default values in this case.
+-	 */
+-
+-	p->field = V4L2_FIELD_NONE;
+-	p->colorspace = V4L2_COLORSPACE_RAW;
+-	p->flags = 0;
+-	p->ycbcr_enc = 0;
+-	p->quantization = 0;
+-	p->xfer_func = 0;
+-}
+-
+ static int v4l_s_fmt(const struct v4l2_ioctl_ops *ops,
+ 				struct file *file, void *fh, void *arg)
+ {
+-- 
+2.20.1
+
diff --git a/queue-5.4/media-v4l2-ctrl-lock-main_hdl-on-operations-of-reque.patch b/queue-5.4/media-v4l2-ctrl-lock-main_hdl-on-operations-of-reque.patch
new file mode 100644
index 00000000000..3ae83cee3fa
--- /dev/null
+++ b/queue-5.4/media-v4l2-ctrl-lock-main_hdl-on-operations-of-reque.patch
@@ -0,0 +1,79 @@
+From 62063d6a4e2d1c234e7193f8be9edc64a396697a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Nov 2019 07:29:10 +0100
+Subject: media: v4l2-ctrl: Lock main_hdl on operations of requests_queued.
+
+From: Pi-Hsun Shih <pihsun@chromium.org>
+
+[ Upstream commit df4a3e7f88e3b0d7ae46d70b9ff8e3c0ea730785 ]
+
+There's a race condition between the list_del_init in the
+v4l2_ctrl_request_complete, and the list_add_tail in the
+v4l2_ctrl_request_queue, since they can be called in different thread
+and the requests_queued list is not protected by a lock. This can lead
+to that the v4l2_ctrl_handler is still in the requests_queued list while
+the request_is_queued is already set to false, which would cause
+use-after-free if the v4l2_ctrl_handler is later released.
+
+Fix this by locking the ->lock of main_hdl (which is the owner of the
+requests_queued list) when doing list operations on the
+->requests_queued list.
+
+Signed-off-by: Pi-Hsun Shih <pihsun@chromium.org>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/v4l2-core/v4l2-ctrls.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls.c
+index 1d8f38824631..cd84dbbf6a89 100644
+--- a/drivers/media/v4l2-core/v4l2-ctrls.c
++++ b/drivers/media/v4l2-core/v4l2-ctrls.c
+@@ -3144,6 +3144,7 @@ static void v4l2_ctrl_request_queue(struct media_request_object *obj)
+ 	struct v4l2_ctrl_handler *prev_hdl = NULL;
+ 	struct v4l2_ctrl_ref *ref_ctrl, *ref_ctrl_prev = NULL;
+ 
++	mutex_lock(main_hdl->lock);
+ 	if (list_empty(&main_hdl->requests_queued))
+ 		goto queue;
+ 
+@@ -3175,18 +3176,22 @@ static void v4l2_ctrl_request_queue(struct media_request_object *obj)
+ queue:
+ 	list_add_tail(&hdl->requests_queued, &main_hdl->requests_queued);
+ 	hdl->request_is_queued = true;
++	mutex_unlock(main_hdl->lock);
+ }
+ 
+ static void v4l2_ctrl_request_unbind(struct media_request_object *obj)
+ {
+ 	struct v4l2_ctrl_handler *hdl =
+ 		container_of(obj, struct v4l2_ctrl_handler, req_obj);
++	struct v4l2_ctrl_handler *main_hdl = obj->priv;
+ 
+ 	list_del_init(&hdl->requests);
++	mutex_lock(main_hdl->lock);
+ 	if (hdl->request_is_queued) {
+ 		list_del_init(&hdl->requests_queued);
+ 		hdl->request_is_queued = false;
+ 	}
++	mutex_unlock(main_hdl->lock);
+ }
+ 
+ static void v4l2_ctrl_request_release(struct media_request_object *obj)
+@@ -4128,9 +4133,11 @@ void v4l2_ctrl_request_complete(struct media_request *req,
+ 		v4l2_ctrl_unlock(ctrl);
+ 	}
+ 
++	mutex_lock(main_hdl->lock);
+ 	WARN_ON(!hdl->request_is_queued);
+ 	list_del_init(&hdl->requests_queued);
+ 	hdl->request_is_queued = false;
++	mutex_unlock(main_hdl->lock);
+ 	media_request_object_complete(obj);
+ 	media_request_object_put(obj);
+ }
+-- 
+2.20.1
+
diff --git a/queue-5.4/media-venus-core-fix-msm8996-frequency-table.patch b/queue-5.4/media-venus-core-fix-msm8996-frequency-table.patch
new file mode 100644
index 00000000000..42526ce9d73
--- /dev/null
+++ b/queue-5.4/media-venus-core-fix-msm8996-frequency-table.patch
@@ -0,0 +1,62 @@
+From 8d1b30674ed5e4c0d9a18925cb334dd499ccd461 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Sep 2019 11:45:59 -0300
+Subject: media: venus: core: Fix msm8996 frequency table
+
+From: Loic Poulain <loic.poulain@linaro.org>
+
+[ Upstream commit c690435ed07901737e5c007a65ec59f53b33eb71 ]
+
+In downstream driver, there are two frequency tables defined,
+one for the encoder and one for the decoder:
+
+/* Encoders /
+<972000 490000000 0x55555555>, / 4k UHD @ 30 /
+<489600 320000000 0x55555555>, / 1080p @ 60 /
+<244800 150000000 0x55555555>, / 1080p @ 30 /
+<108000 75000000 0x55555555>, / 720p @ 30 */
+
+/* Decoders /
+<1944000 490000000 0xffffffff>, / 4k UHD @ 60 /
+< 972000 320000000 0xffffffff>, / 4k UHD @ 30 /
+< 489600 150000000 0xffffffff>, / 1080p @ 60 /
+< 244800 75000000 0xffffffff>; / 1080p @ 30 */
+
+It shows that encoder always needs a higher clock than decoder.
+
+In current venus driver, the unified frequency table is aligned
+with the downstream decoder table which causes performance issues
+in encoding scenarios. Fix that by aligning frequency table on
+worst case (encoding).
+
+Signed-off-by: Loic Poulain <loic.poulain@linaro.org>
+Signed-off-by: Stanimir Varbanov <stanimir.varbanov@linaro.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/qcom/venus/core.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/media/platform/qcom/venus/core.c b/drivers/media/platform/qcom/venus/core.c
+index e6eff512a8a1..84e982f259a0 100644
+--- a/drivers/media/platform/qcom/venus/core.c
++++ b/drivers/media/platform/qcom/venus/core.c
+@@ -427,10 +427,11 @@ static const struct venus_resources msm8916_res = {
+ };
+ 
+ static const struct freq_tbl msm8996_freq_table[] = {
+-	{ 1944000, 490000000 },	/* 4k UHD @ 60 */
+-	{  972000, 320000000 },	/* 4k UHD @ 30 */
+-	{  489600, 150000000 },	/* 1080p @ 60 */
+-	{  244800,  75000000 },	/* 1080p @ 30 */
++	{ 1944000, 520000000 },	/* 4k UHD @ 60 (decode only) */
++	{  972000, 520000000 },	/* 4k UHD @ 30 */
++	{  489600, 346666667 },	/* 1080p @ 60 */
++	{  244800, 150000000 },	/* 1080p @ 30 */
++	{  108000,  75000000 },	/* 720p @ 30 */
+ };
+ 
+ static const struct reg_val msm8996_reg_preset[] = {
+-- 
+2.20.1
+
diff --git a/queue-5.4/media-venus-fix-occasionally-failures-to-suspend.patch b/queue-5.4/media-venus-fix-occasionally-failures-to-suspend.patch
new file mode 100644
index 00000000000..8f1dd2f3e23
--- /dev/null
+++ b/queue-5.4/media-venus-fix-occasionally-failures-to-suspend.patch
@@ -0,0 +1,57 @@
+From 4057f672d8664b0a14c020f19363bf00c55c1de5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Sep 2019 09:02:26 -0300
+Subject: media: venus: Fix occasionally failures to suspend
+
+From: Stanimir Varbanov <stanimir.varbanov@linaro.org>
+
+[ Upstream commit 8dbebb2bd01e6f36e9a215dcde99ace70408f2c8 ]
+
+Failure to suspend (venus_suspend_3xx) happens when the system
+is fresh booted and loading venus driver. This happens once and
+after reload the venus driver modules the problem disrepair.
+
+Fix the failure by skipping the check for WFI and IDLE bits if
+PC_READY is on in control status register.
+
+Signed-off-by: Stanimir Varbanov <stanimir.varbanov@linaro.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/qcom/venus/hfi_venus.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/media/platform/qcom/venus/hfi_venus.c b/drivers/media/platform/qcom/venus/hfi_venus.c
+index 7129a2aea09a..0d8855014ab3 100644
+--- a/drivers/media/platform/qcom/venus/hfi_venus.c
++++ b/drivers/media/platform/qcom/venus/hfi_venus.c
+@@ -1472,6 +1472,7 @@ static int venus_suspend_3xx(struct venus_core *core)
+ {
+ 	struct venus_hfi_device *hdev = to_hfi_priv(core);
+ 	struct device *dev = core->dev;
++	u32 ctrl_status;
+ 	bool val;
+ 	int ret;
+ 
+@@ -1487,6 +1488,10 @@ static int venus_suspend_3xx(struct venus_core *core)
+ 		return -EINVAL;
+ 	}
+ 
++	ctrl_status = venus_readl(hdev, CPU_CS_SCIACMDARG0);
++	if (ctrl_status & CPU_CS_SCIACMDARG0_PC_READY)
++		goto power_off;
++
+ 	/*
+ 	 * Power collapse sequence for Venus 3xx and 4xx versions:
+ 	 * 1. Check for ARM9 and video core to be idle by checking WFI bit
+@@ -1511,6 +1516,7 @@ static int venus_suspend_3xx(struct venus_core *core)
+ 	if (ret)
+ 		return ret;
+ 
++power_off:
+ 	mutex_lock(&hdev->lock);
+ 
+ 	ret = venus_power_off(hdev);
+-- 
+2.20.1
+
diff --git a/queue-5.4/media-vicodec-media_device_cleanup-was-called-too-ea.patch b/queue-5.4/media-vicodec-media_device_cleanup-was-called-too-ea.patch
new file mode 100644
index 00000000000..a76d0e5eb05
--- /dev/null
+++ b/queue-5.4/media-vicodec-media_device_cleanup-was-called-too-ea.patch
@@ -0,0 +1,106 @@
+From 51a1d17f8e5dd646bea62460360080bb93198ffb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 9 Nov 2019 15:06:18 +0100
+Subject: media: vicodec: media_device_cleanup was called too early
+
+From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+
+[ Upstream commit 693c5f144aeb9636ae161a3c61a838c50b2ae41c ]
+
+Running the contrib/test/test-media script in v4l-utils with the vicodec argument
+will cause this kernel warning:
+
+[  372.298824] ------------[ cut here ]------------
+[  372.298848] DEBUG_LOCKS_WARN_ON(lock->magic != lock)
+[  372.298896] WARNING: CPU: 11 PID: 2220 at kernel/locking/mutex.c:938 __mutex_lock+0x919/0xc10
+[  372.298907] Modules linked in: vicodec v4l2_mem2mem vivid rc_cec v4l2_tpg videobuf2_dma_contig cec rc_core v4l2_dv_timings videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_common videodev mc vmw_balloon vmw_vmci button vmwgfx [last unloaded: vimc]
+[  372.298961] CPU: 11 PID: 2220 Comm: sleep Not tainted 5.4.0-rc1-test-no #150
+[  372.298970] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/29/2019
+[  372.298983] RIP: 0010:__mutex_lock+0x919/0xc10
+[  372.298995] Code: 59 83 e8 9a fc 16 ff 44 8b 05 23 61 38 01 45 85 c0 0f 85 ef f7 ff ff 48 c7 c6 a0 1f 87 82 48 c7 c7 a0 1e 87 82 e8 cd bb f7 fe <0f> 0b e9 d5 f7 ff ff f6 c3 04 0f 84 3b fd ff ff 49 89 df 41 83 e7
+[  372.299004] RSP: 0018:ffff8881b400fb80 EFLAGS: 00010286
+[  372.299014] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
+[  372.299022] RDX: 0000000000000003 RSI: 0000000000000004 RDI: ffffed1036801f62
+[  372.299030] RBP: ffff8881b400fcf0 R08: ffffffff81217c91 R09: fffffbfff061c271
+[  372.299038] R10: fffffbfff061c270 R11: ffffffff830e1383 R12: ffff88814761dc80
+[  372.299046] R13: 0000000000000000 R14: ffff88814761cbf0 R15: ffff88814761d030
+[  372.299055] FS:  0000000000000000(0000) GS:ffff8881b68c0000(0000) knlGS:0000000000000000
+[  372.299063] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[  372.299071] CR2: 00007f606d78aa20 CR3: 0000000003013002 CR4: 00000000001606e0
+[  372.299153] Call Trace:
+[  372.299176]  ? __kasan_slab_free+0x12f/0x180
+[  372.299187]  ? kmem_cache_free+0x9b/0x250
+[  372.299200]  ? do_exit+0xcdf/0x1200
+[  372.299210]  ? do_group_exit+0x85/0x130
+[  372.299220]  ? __x64_sys_exit_group+0x23/0x30
+[  372.299231]  ? do_syscall_64+0x5e/0x1c0
+[  372.299241]  ? entry_SYSCALL_64_after_hwframe+0x44/0xa9
+[  372.299295]  ? v4l2_release+0xed/0x190 [videodev]
+[  372.299309]  ? mutex_lock_io_nested+0xb80/0xb80
+[  372.299323]  ? find_held_lock+0x85/0xa0
+[  372.299335]  ? fsnotify+0x5b0/0x600
+[  372.299351]  ? locks_remove_file+0x78/0x2b0
+[  372.299363]  ? __fsnotify_update_child_dentry_flags.part.0+0x170/0x170
+[  372.299383]  ? vidioc_querycap+0x50/0x50 [vicodec]
+[  372.299426]  ? v4l2_release+0xed/0x190 [videodev]
+[  372.299467]  v4l2_release+0xed/0x190 [videodev]
+[  372.299484]  __fput+0x15a/0x390
+[  372.299499]  task_work_run+0xb2/0xe0
+[  372.299512]  do_exit+0x4d0/0x1200
+[  372.299528]  ? do_user_addr_fault+0x367/0x610
+[  372.299538]  ? release_task+0x990/0x990
+[  372.299552]  ? rwsem_spin_on_owner+0x170/0x170
+[  372.299567]  ? vmacache_find+0xb2/0x100
+[  372.299580]  do_group_exit+0x85/0x130
+[  372.299592]  __x64_sys_exit_group+0x23/0x30
+[  372.299602]  do_syscall_64+0x5e/0x1c0
+[  372.299614]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
+[  372.299624] RIP: 0033:0x7f606d74a9d6
+[  372.299640] Code: Bad RIP value.
+[  372.299648] RSP: 002b:00007fff65364468 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
+[  372.299658] RAX: ffffffffffffffda RBX: 00007f606d83b760 RCX: 00007f606d74a9d6
+[  372.299666] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
+[  372.299673] RBP: 0000000000000000 R08: 00000000000000e7 R09: ffffffffffffff80
+[  372.299681] R10: 00007fff65364334 R11: 0000000000000246 R12: 00007f606d83b760
+[  372.299689] R13: 0000000000000002 R14: 00007f606d844428 R15: 0000000000000000
+[  372.299704] ---[ end trace add7d62ca4bc65e3 ]---
+
+This is caused by media_device_cleanup() which destroys
+v4l2_dev->mdev->req_queue_mutex. But v4l2_release() tries to lock
+that mutex after media_device_cleanup() is called.
+
+By moving media_device_cleanup() to the v4l2_device's release function it is
+guaranteed that the mutex is valid whenever v4l2_release is called.
+
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/vicodec/vicodec-core.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/vicodec/vicodec-core.c b/drivers/media/platform/vicodec/vicodec-core.c
+index 0ee143ae0f6b..82350097503e 100644
+--- a/drivers/media/platform/vicodec/vicodec-core.c
++++ b/drivers/media/platform/vicodec/vicodec-core.c
+@@ -2139,6 +2139,9 @@ static void vicodec_v4l2_dev_release(struct v4l2_device *v4l2_dev)
+ 	v4l2_m2m_release(dev->stateful_enc.m2m_dev);
+ 	v4l2_m2m_release(dev->stateful_dec.m2m_dev);
+ 	v4l2_m2m_release(dev->stateless_dec.m2m_dev);
++#ifdef CONFIG_MEDIA_CONTROLLER
++	media_device_cleanup(&dev->mdev);
++#endif
+ 	kfree(dev);
+ }
+ 
+@@ -2250,7 +2253,6 @@ static int vicodec_remove(struct platform_device *pdev)
+ 	v4l2_m2m_unregister_media_controller(dev->stateful_enc.m2m_dev);
+ 	v4l2_m2m_unregister_media_controller(dev->stateful_dec.m2m_dev);
+ 	v4l2_m2m_unregister_media_controller(dev->stateless_dec.m2m_dev);
+-	media_device_cleanup(&dev->mdev);
+ #endif
+ 
+ 	video_unregister_device(&dev->stateful_enc.vfd);
+-- 
+2.20.1
+
diff --git a/queue-5.4/media-vim2m-fix-abort-issue.patch b/queue-5.4/media-vim2m-fix-abort-issue.patch
new file mode 100644
index 00000000000..2dcf4311ced
--- /dev/null
+++ b/queue-5.4/media-vim2m-fix-abort-issue.patch
@@ -0,0 +1,42 @@
+From 9cfc08a0469dcb920bd8f28bfcf81b496bb161f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Sep 2019 15:55:55 -0300
+Subject: media: vim2m: Fix abort issue
+
+From: Jernej Skrabec <jernej.skrabec@siol.net>
+
+[ Upstream commit c362f77a243bfd1daec21b6c36491c061ee2f31b ]
+
+Currently, if start streaming -> stop streaming -> start streaming
+sequence is executed, driver will end job prematurely, if ctx->translen
+is higher than 1, because "aborting" flag is still set from previous
+stop streaming command.
+
+Fix that by clearing "aborting" flag in start streaming handler.
+
+Fixes: 96d8eab5d0a1 ("V4L/DVB: [v5,2/2] v4l: Add a mem-to-mem videobuf framework test device")
+Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/vim2m.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/media/platform/vim2m.c b/drivers/media/platform/vim2m.c
+index acd3bd48c7e2..2d79cdc130c5 100644
+--- a/drivers/media/platform/vim2m.c
++++ b/drivers/media/platform/vim2m.c
+@@ -1073,6 +1073,9 @@ static int vim2m_start_streaming(struct vb2_queue *q, unsigned int count)
+ 	if (!q_data)
+ 		return -EINVAL;
+ 
++	if (V4L2_TYPE_IS_OUTPUT(q->type))
++		ctx->aborting = 0;
++
+ 	q_data->sequence = 0;
+ 	return 0;
+ }
+-- 
+2.20.1
+
diff --git a/queue-5.4/media-vim2m-fix-bug_on-in-vim2m_device_release.patch b/queue-5.4/media-vim2m-fix-bug_on-in-vim2m_device_release.patch
new file mode 100644
index 00000000000..4c429aae14a
--- /dev/null
+++ b/queue-5.4/media-vim2m-fix-bug_on-in-vim2m_device_release.patch
@@ -0,0 +1,73 @@
+From 65c6df64a94371d805514d2dd5b5ef39a99ac377 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Sep 2019 01:12:54 -0300
+Subject: media: vim2m: Fix BUG_ON in vim2m_device_release()
+
+From: Kefeng Wang <wangkefeng.wang@huawei.com>
+
+[ Upstream commit 2455d417c03aa0cbafed04c46cbb354643238318 ]
+
+If v4l2_m2m_init() fails, m2m_dev pointer will be set ERR_PTR(-ENOMEM),
+then kfree m2m_dev will trigger BUG_ON, see below, fix it by setting m2m_dev
+to NULL.
+
+  vim2m vim2m.0: Failed to init mem2mem device
+  ------------[ cut here ]------------
+  kernel BUG at mm/slub.c:3944!
+  invalid opcode: 0000 [#1] SMP PTI
+  CPU: 11 PID: 9061 Comm: insmod Tainted: G            E     5.2.0-rc2 #81
+  Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
+  RIP: 0010:kfree+0x11a/0x160
+
+  Call Trace:
+   vim2m_device_release+0x3f/0x50 [vim2m]
+   device_release+0x27/0x80
+   kobject_release+0x68/0x190
+   vim2m_probe+0x20f/0x280 [vim2m]
+   platform_drv_probe+0x37/0x90
+   really_probe+0xef/0x3d0
+   driver_probe_device+0x110/0x120
+   device_driver_attach+0x4f/0x60
+   __driver_attach+0x9a/0x140
+   ? device_driver_attach+0x60/0x60
+   bus_for_each_dev+0x76/0xc0
+   ? klist_add_tail+0x57/0x70
+   bus_add_driver+0x141/0x210
+   driver_register+0x5b/0xe0
+   vim2m_init+0x29/0x1000 [vim2m]
+   do_one_initcall+0x46/0x1f4
+   ? __slab_alloc+0x1c/0x30
+   ? kmem_cache_alloc_trace+0x167/0x1b0
+   do_init_module+0x5b/0x21f
+   load_module+0x1add/0x1fb0
+   ? __do_sys_finit_module+0xe9/0x110
+   __do_sys_finit_module+0xe9/0x110
+   do_syscall_64+0x5b/0x1c0
+   entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Fixes: ea6c7e34f3b2 ("media: vim2m: replace devm_kzalloc by kzalloc")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/vim2m.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/platform/vim2m.c b/drivers/media/platform/vim2m.c
+index 2d79cdc130c5..e17792f837f8 100644
+--- a/drivers/media/platform/vim2m.c
++++ b/drivers/media/platform/vim2m.c
+@@ -1346,6 +1346,7 @@ static int vim2m_probe(struct platform_device *pdev)
+ 	if (IS_ERR(dev->m2m_dev)) {
+ 		v4l2_err(&dev->v4l2_dev, "Failed to init mem2mem device\n");
+ 		ret = PTR_ERR(dev->m2m_dev);
++		dev->m2m_dev = NULL;
+ 		goto error_dev;
+ 	}
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/media-vim2m-media_device_cleanup-was-called-too-earl.patch b/queue-5.4/media-vim2m-media_device_cleanup-was-called-too-earl.patch
new file mode 100644
index 00000000000..9e1d40cc890
--- /dev/null
+++ b/queue-5.4/media-vim2m-media_device_cleanup-was-called-too-earl.patch
@@ -0,0 +1,104 @@
+From 160d553818b623eaeb2c87e9d16de7950e79f8b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 9 Nov 2019 14:03:08 +0100
+Subject: media: vim2m: media_device_cleanup was called too early
+
+From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+
+[ Upstream commit 9f22e88a4bba270d3427684cee84dfbf67489e86 ]
+
+Running the contrib/test/test-media script in v4l-utils with the vim2m argument
+will cause this kernel warning:
+
+[  554.430157] ------------[ cut here ]------------
+[  554.433034] DEBUG_LOCKS_WARN_ON(lock->magic != lock)
+[  554.433064] WARNING: CPU: 0 PID: 616 at kernel/locking/mutex.c:938 __mutex_lock+0xd7a/0x1380
+[  554.439736] Modules linked in: vim2m v4l2_mem2mem vivid rc_cec videobuf2_dma_contig v4l2_dv_timings cec videobuf2_vmalloc videobuf2_memops v4l2_tpg videobuf2_v4l2 videobuf2_common videodev mc rc_core [last unloaded: vivid]
+[  554.445794] CPU: 0 PID: 616 Comm: sleep Not tainted 5.4.0-rc1-virtme #1
+[  554.448481] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-0-ga698c8995f-prebuilt.qemu.org 04/01/2014
+[  554.453088] RIP: 0010:__mutex_lock+0xd7a/0x1380
+[  554.454955] Code: d2 0f 85 de 05 00 00 44 8b 05 82 d9 f7 00 45 85 c0 0f 85 bf f3 ff ff 48 c7 c6 e0 30 a6 b7 48 c7 c7 e0 2e a6 b7 e8 5c 76 36 fe <0f> 0b e9 a5 f3 ff ff 65 48 8b 1c 25 80 ef 01 00 be 08 00 00 00 48
+[  554.462836] RSP: 0018:ffff88803a4cfad0 EFLAGS: 00010282
+[  554.465129] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffffb5a3d24f
+[  554.468143] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffffb85273f4
+[  554.471000] RBP: ffff88803a4cfc50 R08: fffffbfff701e681 R09: fffffbfff701e681
+[  554.473990] R10: fffffbfff701e680 R11: ffffffffb80f3403 R12: 0000000000000000
+[  554.476831] R13: dffffc0000000000 R14: ffffffffb9714f00 R15: ffff888053103fc8
+[  554.479622] FS:  00007fac6358a540(0000) GS:ffff88805d000000(0000) knlGS:0000000000000000
+[  554.482673] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[  554.484949] CR2: 00007fac6343faf0 CR3: 0000000036c22000 CR4: 00000000003406f0
+[  554.487811] Call Trace:
+[  554.488860]  ? v4l2_release+0x1b8/0x390 [videodev]
+[  554.490818]  ? do_exit+0x946/0x2980
+[  554.492269]  ? mutex_lock_io_nested+0x1250/0x1250
+[  554.494128]  ? __lock_acquire+0xe90/0x3c30
+[  554.495774]  ? fsnotify_first_mark+0x120/0x120
+[  554.497487]  ? vim2m_device_release+0x50/0x50 [vim2m]
+[  554.499469]  ? v4l2_release+0x1b8/0x390 [videodev]
+[  554.501493]  v4l2_release+0x1b8/0x390 [videodev]
+[  554.503430]  __fput+0x256/0x790
+[  554.504711]  task_work_run+0x109/0x190
+[  554.506145]  do_exit+0x95e/0x2980
+[  554.507421]  ? vfs_lock_file+0x21/0xf0
+[  554.509013]  ? find_held_lock+0x33/0x1c0
+[  554.510382]  ? __close_fd+0xee/0x190
+[  554.511862]  ? release_task.part.21+0x1310/0x1310
+[  554.513701]  ? lock_downgrade+0x6d0/0x6d0
+[  554.515299]  do_group_exit+0xeb/0x2d0
+[  554.516862]  __x64_sys_exit_group+0x35/0x40
+[  554.518610]  do_syscall_64+0x90/0x450
+[  554.520142]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
+[  554.522289] RIP: 0033:0x7fac6348ecf6
+[  554.523876] Code: Bad RIP value.
+[  554.525294] RSP: 002b:00007ffe6373dc58 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
+[  554.528555] RAX: ffffffffffffffda RBX: 00007fac6357f760 RCX: 00007fac6348ecf6
+[  554.531537] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
+[  554.534709] RBP: 0000000000000000 R08: 00000000000000e7 R09: ffffffffffffff80
+[  554.536752] R10: 00007ffe6373db24 R11: 0000000000000246 R12: 00007fac6357f760
+[  554.538643] R13: 0000000000000002 R14: 00007fac63588428 R15: 0000000000000000
+[  554.540634] irq event stamp: 21731
+[  554.541618] hardirqs last  enabled at (21731): [<ffffffffb75b3cd4>] _raw_spin_unlock_irq+0x24/0x30
+[  554.544145] hardirqs last disabled at (21730): [<ffffffffb75b3ada>] _raw_spin_lock_irq+0xa/0x40
+[  554.547027] softirqs last  enabled at (20148): [<ffffffffb780064d>] __do_softirq+0x64d/0x906
+[  554.550385] softirqs last disabled at (19857): [<ffffffffb5926bd5>] irq_exit+0x175/0x1a0
+[  554.553668] ---[ end trace a389c80c2ca84244 ]---
+
+This is caused by media_device_cleanup() which destroys
+v4l2_dev->mdev->req_queue_mutex. But v4l2_release() tries to lock
+that mutex after media_device_cleanup() is called.
+
+By moving media_device_cleanup() to the video_device's release function it is
+guaranteed that the mutex is valid whenever v4l2_release is called.
+
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/vim2m.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/vim2m.c b/drivers/media/platform/vim2m.c
+index e17792f837f8..8d6b09623d88 100644
+--- a/drivers/media/platform/vim2m.c
++++ b/drivers/media/platform/vim2m.c
+@@ -1275,6 +1275,9 @@ static void vim2m_device_release(struct video_device *vdev)
+ 
+ 	v4l2_device_unregister(&dev->v4l2_dev);
+ 	v4l2_m2m_release(dev->m2m_dev);
++#ifdef CONFIG_MEDIA_CONTROLLER
++	media_device_cleanup(&dev->mdev);
++#endif
+ 	kfree(dev);
+ }
+ 
+@@ -1399,7 +1402,6 @@ static int vim2m_remove(struct platform_device *pdev)
+ #ifdef CONFIG_MEDIA_CONTROLLER
+ 	media_device_unregister(&dev->mdev);
+ 	v4l2_m2m_unregister_media_controller(dev->m2m_dev);
+-	media_device_cleanup(&dev->mdev);
+ #endif
+ 	video_unregister_device(&dev->vfd);
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/media-vimc-fix-gpf-in-rmmod-path-when-stream-is-acti.patch b/queue-5.4/media-vimc-fix-gpf-in-rmmod-path-when-stream-is-acti.patch
new file mode 100644
index 00000000000..340b0cb6ea2
--- /dev/null
+++ b/queue-5.4/media-vimc-fix-gpf-in-rmmod-path-when-stream-is-acti.patch
@@ -0,0 +1,130 @@
+From 2c39740dc55dcff695bd4220f3beb444c3ee87a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Sep 2019 13:35:09 -0300
+Subject: media: vimc: Fix gpf in rmmod path when stream is active
+
+From: Shuah Khan <skhan@linuxfoundation.org>
+
+[ Upstream commit d7fb5c361c2a2666d20e044206e1756bc8e87df2 ]
+
+If vimc module is removed while streaming is in progress, sensor subdev
+unregister runs into general protection fault when it tries to unregister
+media entities. This is a common subdev problem related to releasing
+pads from v4l2_device_unregister_subdev() before calling unregister.
+Unregister references pads during unregistering subdev.
+
+The sd release handler is the right place for releasing all sd resources
+including pads. The release handlers currently release all resources
+except the pads.
+
+Fix v4l2_device_unregister_subdev() not release pads and release pads
+from the sd_int_op release handlers.
+
+kernel: [ 4136.715839] general protection fault: 0000 [#1] SMP PTI
+kernel: [ 4136.715847] CPU: 2 PID: 1972 Comm: bash Not tainted 5.3.0-rc2+ #4
+kernel: [ 4136.715850] Hardware name: Dell Inc. OptiPlex 790/0HY9JP, BIOS A18 09/24/2013
+kernel: [ 4136.715858] RIP: 0010:media_gobj_destroy.part.16+0x1f/0x60
+kernel: [ 4136.715863] Code: ff 66 2e 0f 1f 84 00 00 00 00 00 66 66 66 66 90 55 48 89 fe 48 89 e5 53 48 89 fb 48 c7 c7 00 7f cf b0 e8 24 fa ff ff 48 8b 03 <48> 83 80 a0 00 00 00 01 48 8b 43 18 48 8b 53 10 48 89 42 08 48 89
+kernel: [ 4136.715866] RSP: 0018:ffff9b2248fe3cb0 EFLAGS: 00010246
+kernel: [ 4136.715870] RAX: bcf2bfbfa0d63c2f RBX: ffff88c3eb37e9c0 RCX: 00000000802a0018
+kernel: [ 4136.715873] RDX: ffff88c3e4f6a078 RSI: ffff88c3eb37e9c0 RDI: ffffffffb0cf7f00
+kernel: [ 4136.715876] RBP: ffff9b2248fe3cb8 R08: 0000000001000002 R09: ffffffffb0492b00
+kernel: [ 4136.715879] R10: ffff9b2248fe3c28 R11: 0000000000000001 R12: 0000000000000038
+kernel: [ 4136.715881] R13: ffffffffc09a1628 R14: ffff88c3e4f6a028 R15: fffffffffffffff2
+kernel: [ 4136.715885] FS:  00007f8389647740(0000) GS:ffff88c465500000(0000) knlGS:0000000000000000
+kernel: [ 4136.715888] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+kernel: [ 4136.715891] CR2: 000055d008f80fd8 CR3: 00000001996ec005 CR4: 00000000000606e0
+kernel: [ 4136.715894] Call Trace:
+kernel: [ 4136.715903]  media_gobj_destroy+0x14/0x20
+kernel: [ 4136.715908]  __media_device_unregister_entity+0xb3/0xe0
+kernel: [ 4136.715915]  media_device_unregister_entity+0x30/0x40
+kernel: [ 4136.715920]  v4l2_device_unregister_subdev+0xa8/0xe0
+kernel: [ 4136.715928]  vimc_ent_sd_unregister+0x1e/0x30 [vimc]
+kernel: [ 4136.715933]  vimc_sen_rm+0x16/0x20 [vimc]
+kernel: [ 4136.715938]  vimc_remove+0x3e/0xa0 [vimc]
+kernel: [ 4136.715945]  platform_drv_remove+0x25/0x50
+kernel: [ 4136.715951]  device_release_driver_internal+0xe0/0x1b0
+kernel: [ 4136.715956]  device_driver_detach+0x14/0x20
+kernel: [ 4136.715960]  unbind_store+0xd1/0x130
+kernel: [ 4136.715965]  drv_attr_store+0x27/0x40
+kernel: [ 4136.715971]  sysfs_kf_write+0x48/0x60
+kernel: [ 4136.715976]  kernfs_fop_write+0x128/0x1b0
+kernel: [ 4136.715982]  __vfs_write+0x1b/0x40
+kernel: [ 4136.715987]  vfs_write+0xc3/0x1d0
+kernel: [ 4136.715993]  ksys_write+0xaa/0xe0
+kernel: [ 4136.715999]  __x64_sys_write+0x1a/0x20
+kernel: [ 4136.716005]  do_syscall_64+0x5a/0x130
+kernel: [ 4136.716010]  entry_SYSCALL_64_after_hwframe+0x4
+
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Acked-by: Helen Koike <helen.koike@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/vimc/vimc-common.c  | 3 +--
+ drivers/media/platform/vimc/vimc-debayer.c | 1 +
+ drivers/media/platform/vimc/vimc-scaler.c  | 1 +
+ drivers/media/platform/vimc/vimc-sensor.c  | 1 +
+ 4 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/vimc/vimc-common.c b/drivers/media/platform/vimc/vimc-common.c
+index 7e1ae0b12f1e..a3120f4f7a90 100644
+--- a/drivers/media/platform/vimc/vimc-common.c
++++ b/drivers/media/platform/vimc/vimc-common.c
+@@ -375,7 +375,7 @@ int vimc_ent_sd_register(struct vimc_ent_device *ved,
+ {
+ 	int ret;
+ 
+-	/* Allocate the pads */
++	/* Allocate the pads. Should be released from the sd_int_op release */
+ 	ved->pads = vimc_pads_init(num_pads, pads_flag);
+ 	if (IS_ERR(ved->pads))
+ 		return PTR_ERR(ved->pads);
+@@ -424,7 +424,6 @@ EXPORT_SYMBOL_GPL(vimc_ent_sd_register);
+ void vimc_ent_sd_unregister(struct vimc_ent_device *ved, struct v4l2_subdev *sd)
+ {
+ 	media_entity_cleanup(ved->ent);
+-	vimc_pads_cleanup(ved->pads);
+ 	v4l2_device_unregister_subdev(sd);
+ }
+ EXPORT_SYMBOL_GPL(vimc_ent_sd_unregister);
+diff --git a/drivers/media/platform/vimc/vimc-debayer.c b/drivers/media/platform/vimc/vimc-debayer.c
+index b72b8385067b..baafd9d7fb2c 100644
+--- a/drivers/media/platform/vimc/vimc-debayer.c
++++ b/drivers/media/platform/vimc/vimc-debayer.c
+@@ -484,6 +484,7 @@ static void vimc_deb_release(struct v4l2_subdev *sd)
+ 	struct vimc_deb_device *vdeb =
+ 				container_of(sd, struct vimc_deb_device, sd);
+ 
++	vimc_pads_cleanup(vdeb->ved.pads);
+ 	kfree(vdeb);
+ }
+ 
+diff --git a/drivers/media/platform/vimc/vimc-scaler.c b/drivers/media/platform/vimc/vimc-scaler.c
+index 49ab8d9dd9c9..c0d9f43d5777 100644
+--- a/drivers/media/platform/vimc/vimc-scaler.c
++++ b/drivers/media/platform/vimc/vimc-scaler.c
+@@ -343,6 +343,7 @@ static void vimc_sca_release(struct v4l2_subdev *sd)
+ 	struct vimc_sca_device *vsca =
+ 				container_of(sd, struct vimc_sca_device, sd);
+ 
++	vimc_pads_cleanup(vsca->ved.pads);
+ 	kfree(vsca);
+ }
+ 
+diff --git a/drivers/media/platform/vimc/vimc-sensor.c b/drivers/media/platform/vimc/vimc-sensor.c
+index 4a6a7e8e66c2..420573e5f6d6 100644
+--- a/drivers/media/platform/vimc/vimc-sensor.c
++++ b/drivers/media/platform/vimc/vimc-sensor.c
+@@ -292,6 +292,7 @@ static void vimc_sen_release(struct v4l2_subdev *sd)
+ 
+ 	v4l2_ctrl_handler_free(&vsen->hdl);
+ 	tpg_free(&vsen->tpg);
++	vimc_pads_cleanup(vsen->ved.pads);
+ 	kfree(vsen);
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/media-vivid-media_device_cleanup-was-called-too-earl.patch b/queue-5.4/media-vivid-media_device_cleanup-was-called-too-earl.patch
new file mode 100644
index 00000000000..6de9f7a1bc9
--- /dev/null
+++ b/queue-5.4/media-vivid-media_device_cleanup-was-called-too-earl.patch
@@ -0,0 +1,107 @@
+From 9494d68293d51e27682c99dc8b6431b738038c28 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Nov 2019 14:35:41 -0300
+Subject: media: vivid: media_device_cleanup was called too early
+
+From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+
+[ Upstream commit 8ffd573c25e5fac1daeeffc592e2ed6bc6a3d947 ]
+
+Running the contrib/test/test-media script in v4l-utils with the vivid argument
+will cause this kernel warning:
+
+[  104.748720] videodev: v4l2_release
+[  104.748731] ------------[ cut here ]------------
+[  104.748750] DEBUG_LOCKS_WARN_ON(lock->magic != lock)
+[  104.748790] WARNING: CPU: 6 PID: 1823 at kernel/locking/mutex.c:938 __mutex_lock+0x919/0xc10
+[  104.748800] Modules linked in: rc_cec vivid v4l2_tpg videobuf2_dma_contig cec rc_core v4l2_dv_timings videobuf2_vmalloc videobuf2_memops
+videobuf2_v4l2 videobuf2_common videodev mc vmw_balloon vmw_vmci button vmwgfx
+[  104.748845] CPU: 6 PID: 1823 Comm: sleep Not tainted 5.4.0-rc1-test-no #150
+[  104.748853] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/29/2019
+[  104.748867] RIP: 0010:__mutex_lock+0x919/0xc10
+[  104.748878] Code: 59 83 e8 9a fc 16 ff 44 8b 05 23 61 38 01 45 85 c0 0f 85 ef f7 ff ff 48 c7 c6 a0 1f 87 82 48 c7 c7 a0 1e 87 82 e8 cd bb
+f7 fe <0f> 0b e9 d5 f7 ff ff f6 c3 04 0f 84 3b fd ff ff 49 89 df 41 83 e7
+[  104.748886] RSP: 0018:ffff88811a357b80 EFLAGS: 00010286
+[  104.748895] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
+[  104.748902] RDX: 0000000000000003 RSI: 0000000000000004 RDI: ffffed102346af62
+[  104.748910] RBP: ffff88811a357cf0 R08: ffffffff81217c91 R09: fffffbfff061c271
+[  104.748917] R10: fffffbfff061c270 R11: ffffffff830e1383 R12: ffff8881a46103c0
+[  104.748924] R13: 0000000000000000 R14: ffff8881a4614f90 R15: ffff8881a46153d0
+[  104.748933] FS:  0000000000000000(0000) GS:ffff8881b6780000(0000) knlGS:0000000000000000
+[  104.748940] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[  104.748949] CR2: 00007f163fc9ca20 CR3: 0000000003013004 CR4: 00000000001606e0
+[  104.749036] Call Trace:
+[  104.749051]  ? _raw_spin_unlock+0x1f/0x30
+[  104.749067]  ? llist_add_batch+0x33/0x50
+[  104.749081]  ? tick_nohz_tick_stopped+0x19/0x30
+[  104.749130]  ? v4l2_release.cold+0x6c/0xd6 [videodev]
+[  104.749143]  ? mutex_lock_io_nested+0xb80/0xb80
+[  104.749153]  ? vprintk_emit+0xf2/0x220
+[  104.749191]  ? vivid_req_validate+0x40/0x40 [vivid]
+[  104.749201]  ? printk+0xad/0xde
+[  104.749211]  ? kmsg_dump_rewind_nolock+0x54/0x54
+[  104.749226]  ? locks_remove_file+0x78/0x2b0
+[  104.749248]  ? __fsnotify_update_child_dentry_flags.part.0+0x170/0x170
+[  104.749281]  ? vivid_req_validate+0x40/0x40 [vivid]
+[  104.749321]  ? v4l2_release.cold+0x6c/0xd6 [videodev]
+[  104.749361]  v4l2_release.cold+0x6c/0xd6 [videodev]
+[  104.749378]  __fput+0x15a/0x390
+[  104.749393]  task_work_run+0xb2/0xe0
+[  104.749407]  do_exit+0x4d0/0x1200
+[  104.749422]  ? do_user_addr_fault+0x367/0x610
+[  104.749431]  ? release_task+0x990/0x990
+[  104.749449]  ? rwsem_spin_on_owner+0x170/0x170
+[  104.749463]  ? vmacache_find+0xb2/0x100
+[  104.749476]  do_group_exit+0x85/0x130
+[  104.749487]  __x64_sys_exit_group+0x23/0x30
+[  104.749500]  do_syscall_64+0x5e/0x1c0
+[  104.749511]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
+[  104.749520] RIP: 0033:0x7f163fc5c9d6
+[  104.749536] Code: Bad RIP value.
+[  104.749543] RSP: 002b:00007ffe6f3bec58 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
+[  104.749553] RAX: ffffffffffffffda RBX: 00007f163fd4d760 RCX: 00007f163fc5c9d6
+[  104.749560] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
+[  104.749567] RBP: 0000000000000000 R08: 00000000000000e7 R09: ffffffffffffff80
+[  104.749574] R10: 00007ffe6f3beb24 R11: 0000000000000246 R12: 00007f163fd4d760
+[  104.749581] R13: 0000000000000002 R14: 00007f163fd56428 R15: 0000000000000000
+[  104.749597] ---[ end trace 66f20f73fc0daf79 ]---
+
+This is caused by media_device_cleanup() which destroys
+v4l2_dev->mdev->req_queue_mutex. But v4l2_release() tries to lock
+that mutex after media_device_cleanup() is called.
+
+By moving media_device_cleanup() to the v4l2_device's release function it is
+guaranteed that the mutex is valid whenever v4l2_release is called.
+
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/vivid/vivid-core.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/vivid/vivid-core.c b/drivers/media/platform/vivid/vivid-core.c
+index 53315c8dd2bb..f6a5cdbd74e7 100644
+--- a/drivers/media/platform/vivid/vivid-core.c
++++ b/drivers/media/platform/vivid/vivid-core.c
+@@ -616,6 +616,9 @@ static void vivid_dev_release(struct v4l2_device *v4l2_dev)
+ 
+ 	vivid_free_controls(dev);
+ 	v4l2_device_unregister(&dev->v4l2_dev);
++#ifdef CONFIG_MEDIA_CONTROLLER
++	media_device_cleanup(&dev->mdev);
++#endif
+ 	vfree(dev->scaled_line);
+ 	vfree(dev->blended_line);
+ 	vfree(dev->edid);
+@@ -1580,7 +1583,6 @@ static int vivid_remove(struct platform_device *pdev)
+ 
+ #ifdef CONFIG_MEDIA_CONTROLLER
+ 		media_device_unregister(&dev->mdev);
+-		media_device_cleanup(&dev->mdev);
+ #endif
+ 
+ 		if (dev->has_vid_cap) {
+-- 
+2.20.1
+
diff --git a/queue-5.4/mips-fix-build-when-48-bits-virtual-memory-is-enable.patch b/queue-5.4/mips-fix-build-when-48-bits-virtual-memory-is-enable.patch
new file mode 100644
index 00000000000..5a6fe480c8c
--- /dev/null
+++ b/queue-5.4/mips-fix-build-when-48-bits-virtual-memory-is-enable.patch
@@ -0,0 +1,81 @@
+From 0a4a6b7c60e155929b93acbe447d323e436737eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Nov 2019 18:21:31 +0200
+Subject: mips: fix build when "48 bits virtual memory" is enabled
+
+From: Mike Rapoport <rppt@linux.ibm.com>
+
+[ Upstream commit 3ed6751bb8fa89c3014399bb0414348499ee202a ]
+
+With CONFIG_MIPS_VA_BITS_48=y the build fails miserably:
+
+  CC      arch/mips/kernel/asm-offsets.s
+In file included from arch/mips/include/asm/pgtable.h:644,
+                 from include/linux/mm.h:99,
+                 from arch/mips/kernel/asm-offsets.c:15:
+include/asm-generic/pgtable.h:16:2: error: #error CONFIG_PGTABLE_LEVELS is not consistent with __PAGETABLE_{P4D,PUD,PMD}_FOLDED
+ #error CONFIG_PGTABLE_LEVELS is not consistent with __PAGETABLE_{P4D,PUD,PMD}_FOLDED
+  ^~~~~
+include/asm-generic/pgtable.h:390:28: error: unknown type name 'p4d_t'; did you mean 'pmd_t'?
+ static inline int p4d_same(p4d_t p4d_a, p4d_t p4d_b)
+                            ^~~~~
+                            pmd_t
+
+[ ... more such errors ... ]
+
+scripts/Makefile.build:99: recipe for target 'arch/mips/kernel/asm-offsets.s' failed
+make[2]: *** [arch/mips/kernel/asm-offsets.s] Error 1
+
+This happens because when CONFIG_MIPS_VA_BITS_48 enables 4th level of the
+page tables, but neither pgtable-nop4d.h nor 5level-fixup.h are included to
+cope with the 5th level.
+
+Replace #ifdef conditions around includes of the pgtable-nop{m,u}d.h with
+explicit CONFIG_PGTABLE_LEVELS and add include of 5level-fixup.h for the
+case when CONFIG_PGTABLE_LEVELS==4
+
+Signed-off-by: Mike Rapoport <rppt@linux.ibm.com>
+Signed-off-by: Paul Burton <paulburton@kernel.org>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: James Hogan <jhogan@kernel.org>
+Cc: linux-mips@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Cc: linux-mm@kvack.org
+Cc: Mike Rapoport <rppt@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/include/asm/pgtable-64.h | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/arch/mips/include/asm/pgtable-64.h b/arch/mips/include/asm/pgtable-64.h
+index 93a9dce31f25..813dfe5f45a5 100644
+--- a/arch/mips/include/asm/pgtable-64.h
++++ b/arch/mips/include/asm/pgtable-64.h
+@@ -18,10 +18,12 @@
+ #include <asm/fixmap.h>
+ 
+ #define __ARCH_USE_5LEVEL_HACK
+-#if defined(CONFIG_PAGE_SIZE_64KB) && !defined(CONFIG_MIPS_VA_BITS_48)
++#if CONFIG_PGTABLE_LEVELS == 2
+ #include <asm-generic/pgtable-nopmd.h>
+-#elif !(defined(CONFIG_PAGE_SIZE_4KB) && defined(CONFIG_MIPS_VA_BITS_48))
++#elif CONFIG_PGTABLE_LEVELS == 3
+ #include <asm-generic/pgtable-nopud.h>
++#else
++#include <asm-generic/5level-fixup.h>
+ #endif
+ 
+ /*
+@@ -216,6 +218,9 @@ static inline unsigned long pgd_page_vaddr(pgd_t pgd)
+ 	return pgd_val(pgd);
+ }
+ 
++#define pgd_phys(pgd)		virt_to_phys((void *)pgd_val(pgd))
++#define pgd_page(pgd)		(pfn_to_page(pgd_phys(pgd) >> PAGE_SHIFT))
++
+ static inline pud_t *pud_offset(pgd_t *pgd, unsigned long address)
+ {
+ 	return (pud_t *)pgd_page_vaddr(*pgd) + pud_index(address);
+-- 
+2.20.1
+
diff --git a/queue-5.4/mips-futex-emit-loongson3-sync-workarounds-within-as.patch b/queue-5.4/mips-futex-emit-loongson3-sync-workarounds-within-as.patch
new file mode 100644
index 00000000000..73605406f8a
--- /dev/null
+++ b/queue-5.4/mips-futex-emit-loongson3-sync-workarounds-within-as.patch
@@ -0,0 +1,139 @@
+From 307ca8d0990065a18307ba0f7e70a19e0410cee5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Oct 2019 21:53:38 +0000
+Subject: MIPS: futex: Emit Loongson3 sync workarounds within asm
+
+From: Paul Burton <paul.burton@mips.com>
+
+[ Upstream commit 3c1d3f0979721a39dd2980c97466127ce65aa130 ]
+
+Generate the sync instructions required to workaround Loongson3 LL/SC
+errata within inline asm blocks, which feels a little safer than doing
+it from C where strictly speaking the compiler would be well within its
+rights to insert a memory access between the separate asm statements we
+previously had, containing sync & ll instructions respectively.
+
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Cc: linux-mips@vger.kernel.org
+Cc: Huacai Chen <chenhc@lemote.com>
+Cc: Jiaxun Yang <jiaxun.yang@flygoat.com>
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/include/asm/barrier.h | 13 +++++++------
+ arch/mips/include/asm/futex.h   | 15 +++++++--------
+ 2 files changed, 14 insertions(+), 14 deletions(-)
+
+diff --git a/arch/mips/include/asm/barrier.h b/arch/mips/include/asm/barrier.h
+index 9228f7386220..fb842965d541 100644
+--- a/arch/mips/include/asm/barrier.h
++++ b/arch/mips/include/asm/barrier.h
+@@ -218,13 +218,14 @@
+  * ordering will be done by smp_llsc_mb() and friends.
+  */
+ #if defined(CONFIG_WEAK_REORDERING_BEYOND_LLSC) && defined(CONFIG_SMP)
+-#define __WEAK_LLSC_MB		"	sync	\n"
+-#define smp_llsc_mb()		__asm__ __volatile__(__WEAK_LLSC_MB : : :"memory")
+-#define __LLSC_CLOBBER
++# define __WEAK_LLSC_MB		sync
++# define smp_llsc_mb() \
++	__asm__ __volatile__(__stringify(__WEAK_LLSC_MB) : : :"memory")
++# define __LLSC_CLOBBER
+ #else
+-#define __WEAK_LLSC_MB		"		\n"
+-#define smp_llsc_mb()		do { } while (0)
+-#define __LLSC_CLOBBER		"memory"
++# define __WEAK_LLSC_MB
++# define smp_llsc_mb()		do { } while (0)
++# define __LLSC_CLOBBER		"memory"
+ #endif
+ 
+ #ifdef CONFIG_CPU_CAVIUM_OCTEON
+diff --git a/arch/mips/include/asm/futex.h b/arch/mips/include/asm/futex.h
+index b83b0397462d..54cf20530931 100644
+--- a/arch/mips/include/asm/futex.h
++++ b/arch/mips/include/asm/futex.h
+@@ -16,6 +16,7 @@
+ #include <asm/barrier.h>
+ #include <asm/compiler.h>
+ #include <asm/errno.h>
++#include <asm/sync.h>
+ #include <asm/war.h>
+ 
+ #define __futex_atomic_op(insn, ret, oldval, uaddr, oparg)		\
+@@ -32,7 +33,7 @@
+ 		"	.set	arch=r4000			\n"	\
+ 		"2:	sc	$1, %2				\n"	\
+ 		"	beqzl	$1, 1b				\n"	\
+-		__WEAK_LLSC_MB						\
++		__stringify(__WEAK_LLSC_MB)				\
+ 		"3:						\n"	\
+ 		"	.insn					\n"	\
+ 		"	.set	pop				\n"	\
+@@ -50,19 +51,19 @@
+ 		  "i" (-EFAULT)						\
+ 		: "memory");						\
+ 	} else if (cpu_has_llsc) {					\
+-		loongson_llsc_mb();					\
+ 		__asm__ __volatile__(					\
+ 		"	.set	push				\n"	\
+ 		"	.set	noat				\n"	\
+ 		"	.set	push				\n"	\
+ 		"	.set	"MIPS_ISA_ARCH_LEVEL"		\n"	\
++		"	" __SYNC(full, loongson3_war) "		\n"	\
+ 		"1:	"user_ll("%1", "%4")" # __futex_atomic_op\n"	\
+ 		"	.set	pop				\n"	\
+ 		"	" insn	"				\n"	\
+ 		"	.set	"MIPS_ISA_ARCH_LEVEL"		\n"	\
+ 		"2:	"user_sc("$1", "%2")"			\n"	\
+ 		"	beqz	$1, 1b				\n"	\
+-		__WEAK_LLSC_MB						\
++		__stringify(__WEAK_LLSC_MB)				\
+ 		"3:						\n"	\
+ 		"	.insn					\n"	\
+ 		"	.set	pop				\n"	\
+@@ -147,7 +148,7 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
+ 		"	.set	arch=r4000				\n"
+ 		"2:	sc	$1, %2					\n"
+ 		"	beqzl	$1, 1b					\n"
+-		__WEAK_LLSC_MB
++		__stringify(__WEAK_LLSC_MB)
+ 		"3:							\n"
+ 		"	.insn						\n"
+ 		"	.set	pop					\n"
+@@ -164,13 +165,13 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
+ 		  "i" (-EFAULT)
+ 		: "memory");
+ 	} else if (cpu_has_llsc) {
+-		loongson_llsc_mb();
+ 		__asm__ __volatile__(
+ 		"# futex_atomic_cmpxchg_inatomic			\n"
+ 		"	.set	push					\n"
+ 		"	.set	noat					\n"
+ 		"	.set	push					\n"
+ 		"	.set	"MIPS_ISA_ARCH_LEVEL"			\n"
++		"	" __SYNC(full, loongson3_war) "			\n"
+ 		"1:	"user_ll("%1", "%3")"				\n"
+ 		"	bne	%1, %z4, 3f				\n"
+ 		"	.set	pop					\n"
+@@ -178,8 +179,7 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
+ 		"	.set	"MIPS_ISA_ARCH_LEVEL"			\n"
+ 		"2:	"user_sc("$1", "%2")"				\n"
+ 		"	beqz	$1, 1b					\n"
+-		__WEAK_LLSC_MB
+-		"3:							\n"
++		"3:	" __SYNC_ELSE(full, loongson3_war, __WEAK_LLSC_MB) "\n"
+ 		"	.insn						\n"
+ 		"	.set	pop					\n"
+ 		"	.section .fixup,\"ax\"				\n"
+@@ -194,7 +194,6 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
+ 		: GCC_OFF_SMALL_ASM() (*uaddr), "Jr" (oldval), "Jr" (newval),
+ 		  "i" (-EFAULT)
+ 		: "memory");
+-		loongson_llsc_mb();
+ 	} else
+ 		return -ENOSYS;
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/mips-futex-restore-n-after-sync-instructions.patch b/queue-5.4/mips-futex-restore-n-after-sync-instructions.patch
new file mode 100644
index 00000000000..c99fcfd31c1
--- /dev/null
+++ b/queue-5.4/mips-futex-restore-n-after-sync-instructions.patch
@@ -0,0 +1,64 @@
+From 853a64edad0fab7a690257c13f427beb793de6dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Oct 2019 12:58:44 -0700
+Subject: MIPS: futex: Restore \n after sync instructions
+
+From: Paul Burton <paul.burton@mips.com>
+
+[ Upstream commit fd7710cb491f900eb63d2ce5aac0e682003e84e9 ]
+
+Commit 3c1d3f097972 ("MIPS: futex: Emit Loongson3 sync workarounds
+within asm") inadvertently removed the newlines following
+__WEAK_LLSC_MB, which causes build failures for configurations in which
+__WEAK_LLSC_MB expands to a sync instruction:
+
+  {standard input}: Assembler messages:
+  {standard input}:9346: Error: symbol `sync3' is already defined
+  {standard input}:9380: Error: symbol `sync3' is already defined
+  ...
+
+Fix this by restoring the newlines to separate the sync instruction from
+anything following it (such as the 3: label), preventing inadvertent
+concatenation.
+
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Fixes: 3c1d3f097972 ("MIPS: futex: Emit Loongson3 sync workarounds within asm")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/include/asm/futex.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/mips/include/asm/futex.h b/arch/mips/include/asm/futex.h
+index 54cf20530931..110220705e97 100644
+--- a/arch/mips/include/asm/futex.h
++++ b/arch/mips/include/asm/futex.h
+@@ -33,7 +33,7 @@
+ 		"	.set	arch=r4000			\n"	\
+ 		"2:	sc	$1, %2				\n"	\
+ 		"	beqzl	$1, 1b				\n"	\
+-		__stringify(__WEAK_LLSC_MB)				\
++		__stringify(__WEAK_LLSC_MB) "			\n"	\
+ 		"3:						\n"	\
+ 		"	.insn					\n"	\
+ 		"	.set	pop				\n"	\
+@@ -63,7 +63,7 @@
+ 		"	.set	"MIPS_ISA_ARCH_LEVEL"		\n"	\
+ 		"2:	"user_sc("$1", "%2")"			\n"	\
+ 		"	beqz	$1, 1b				\n"	\
+-		__stringify(__WEAK_LLSC_MB)				\
++		__stringify(__WEAK_LLSC_MB) "			\n"	\
+ 		"3:						\n"	\
+ 		"	.insn					\n"	\
+ 		"	.set	pop				\n"	\
+@@ -148,7 +148,7 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
+ 		"	.set	arch=r4000				\n"
+ 		"2:	sc	$1, %2					\n"
+ 		"	beqzl	$1, 1b					\n"
+-		__stringify(__WEAK_LLSC_MB)
++		__stringify(__WEAK_LLSC_MB) "				\n"
+ 		"3:							\n"
+ 		"	.insn						\n"
+ 		"	.set	pop					\n"
+-- 
+2.20.1
+
diff --git a/queue-5.4/mips-ralink-enable-pci-support-only-if-driver-for-mt.patch b/queue-5.4/mips-ralink-enable-pci-support-only-if-driver-for-mt.patch
new file mode 100644
index 00000000000..bcbd7ff1949
--- /dev/null
+++ b/queue-5.4/mips-ralink-enable-pci-support-only-if-driver-for-mt.patch
@@ -0,0 +1,60 @@
+From 6e4b5ee77f9b3e8544f52233ec3ae81eb682244d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 19 Oct 2019 10:12:33 +0200
+Subject: MIPS: ralink: enable PCI support only if driver for mt7621 SoC is
+ selected
+
+From: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+
+[ Upstream commit 3b2fa0c92686562ac0b8cf00c0326a45814f8e18 ]
+
+Some versions of SoC MT7621 have three PCI express hosts. Some boards
+make use of those PCI through the staging driver mt7621-pci. Recently
+PCI support has been removed from MT7621 Soc kernel configuration due
+to a build error. This makes imposible to compile staging driver and
+produces a regression for gnubee based boards. Enable support for PCI
+again but enable it only if staging mt7621-pci driver is selected.
+
+Fixes: c4d48cf5e2f0 ("MIPS: ralink: deactivate PCI support for SOC_MT7621")
+Cc: Hauke Mehrtens <hauke@hauke-m.de>
+Cc: ralf@linux-mips.org
+Cc: jhogan@kernel.org
+Cc: john@phrozen.org
+Cc: NeilBrown <neil@brown.name>
+Cc: linux-mips@vger.kernel.org
+Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Link: https://lore.kernel.org/r/20191019081233.7337-1-sergio.paracuellos@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/ralink/Kconfig           | 1 +
+ drivers/staging/mt7621-pci/Kconfig | 1 -
+ 2 files changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/mips/ralink/Kconfig b/arch/mips/ralink/Kconfig
+index 1434fa60f3db..94e9ce994494 100644
+--- a/arch/mips/ralink/Kconfig
++++ b/arch/mips/ralink/Kconfig
+@@ -51,6 +51,7 @@ choice
+ 		select MIPS_GIC
+ 		select COMMON_CLK
+ 		select CLKSRC_MIPS_GIC
++		select HAVE_PCI if PCI_MT7621
+ endchoice
+ 
+ choice
+diff --git a/drivers/staging/mt7621-pci/Kconfig b/drivers/staging/mt7621-pci/Kconfig
+index af928b75a940..ce58042f2f21 100644
+--- a/drivers/staging/mt7621-pci/Kconfig
++++ b/drivers/staging/mt7621-pci/Kconfig
+@@ -2,7 +2,6 @@
+ config PCI_MT7621
+ 	tristate "MediaTek MT7621 PCI Controller"
+ 	depends on RALINK
+-	depends on PCI
+ 	select PCI_DRIVERS_GENERIC
+ 	help
+ 	  This selects a driver for the MediaTek MT7621 PCI Controller.
+-- 
+2.20.1
+
diff --git a/queue-5.4/mips-syscall-emit-loongson3-sync-workarounds-within-.patch b/queue-5.4/mips-syscall-emit-loongson3-sync-workarounds-within-.patch
new file mode 100644
index 00000000000..b5b5cd90082
--- /dev/null
+++ b/queue-5.4/mips-syscall-emit-loongson3-sync-workarounds-within-.patch
@@ -0,0 +1,54 @@
+From 92ba4f3b55917057e54b466cce95b23f9b7d2f73 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Oct 2019 21:53:39 +0000
+Subject: MIPS: syscall: Emit Loongson3 sync workarounds within asm
+
+From: Paul Burton <paul.burton@mips.com>
+
+[ Upstream commit e84957e6ae043bb83ad6ae7e949a1ce97b6bbfef ]
+
+Generate the sync instructions required to workaround Loongson3 LL/SC
+errata within inline asm blocks, which feels a little safer than doing
+it from C where strictly speaking the compiler would be well within its
+rights to insert a memory access between the separate asm statements we
+previously had, containing sync & ll instructions respectively.
+
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Cc: linux-mips@vger.kernel.org
+Cc: Huacai Chen <chenhc@lemote.com>
+Cc: Jiaxun Yang <jiaxun.yang@flygoat.com>
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/kernel/syscall.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/mips/kernel/syscall.c b/arch/mips/kernel/syscall.c
+index 3f16f3823031..c333e5788664 100644
+--- a/arch/mips/kernel/syscall.c
++++ b/arch/mips/kernel/syscall.c
+@@ -37,6 +37,7 @@
+ #include <asm/signal.h>
+ #include <asm/sim.h>
+ #include <asm/shmparam.h>
++#include <asm/sync.h>
+ #include <asm/sysmips.h>
+ #include <asm/switch_to.h>
+ 
+@@ -133,12 +134,12 @@ static inline int mips_atomic_set(unsigned long addr, unsigned long new)
+ 		  [efault] "i" (-EFAULT)
+ 		: "memory");
+ 	} else if (cpu_has_llsc) {
+-		loongson_llsc_mb();
+ 		__asm__ __volatile__ (
+ 		"	.set	push					\n"
+ 		"	.set	"MIPS_ISA_ARCH_LEVEL"			\n"
+ 		"	li	%[err], 0				\n"
+ 		"1:							\n"
++		"	" __SYNC(full, loongson3_war) "			\n"
+ 		user_ll("%[old]", "(%[addr])")
+ 		"	move	%[tmp], %[new]				\n"
+ 		"2:							\n"
+-- 
+2.20.1
+
diff --git a/queue-5.4/misc-fastrpc-fix-memory-leak-from-miscdev-name.patch b/queue-5.4/misc-fastrpc-fix-memory-leak-from-miscdev-name.patch
new file mode 100644
index 00000000000..60b8c32526e
--- /dev/null
+++ b/queue-5.4/misc-fastrpc-fix-memory-leak-from-miscdev-name.patch
@@ -0,0 +1,55 @@
+From 89078b3938200aadfcf59854e8d47161e462a4f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2019 15:41:20 +0100
+Subject: misc: fastrpc: fix memory leak from miscdev->name
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+[ Upstream commit 2d10d2d170723e9278282458a6704552dcb77eac ]
+
+Fix a memory leak in miscdev->name by using devm_variant
+
+Orignally reported by kmemleak:
+    [<ffffff80088b74d8>] kmemleak_alloc+0x50/0x84
+    [<ffffff80081e015c>] __kmalloc_track_caller+0xe8/0x168
+    [<ffffff8008371ab0>] kvasprintf+0x78/0x100
+    [<ffffff8008371c6c>] kasprintf+0x50/0x74
+    [<ffffff8008507f2c>] fastrpc_rpmsg_probe+0xd8/0x20c
+    [<ffffff80086b63b4>] rpmsg_dev_probe+0xa8/0x148
+    [<ffffff80084de50c>] really_probe+0x208/0x248
+    [<ffffff80084de2dc>] driver_probe_device+0x98/0xc0
+    [<ffffff80084dec6c>] __device_attach_driver+0x9c/0xac
+    [<ffffff80084dca8c>] bus_for_each_drv+0x60/0x8c
+    [<ffffff80084de64c>] __device_attach+0x8c/0x100
+    [<ffffff80084de6e0>] device_initial_probe+0x20/0x28
+    [<ffffff80084dcbd0>] bus_probe_device+0x34/0x7c
+    [<ffffff80084da32c>] device_add+0x420/0x498
+    [<ffffff80084da680>] device_register+0x24/0x2c
+
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20191009144123.24583-3-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/fastrpc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
+index 1b1a794d639d..842f2210dc7e 100644
+--- a/drivers/misc/fastrpc.c
++++ b/drivers/misc/fastrpc.c
+@@ -1430,8 +1430,8 @@ static int fastrpc_rpmsg_probe(struct rpmsg_device *rpdev)
+ 		return -ENOMEM;
+ 
+ 	data->miscdev.minor = MISC_DYNAMIC_MINOR;
+-	data->miscdev.name = kasprintf(GFP_KERNEL, "fastrpc-%s",
+-				domains[domain_id]);
++	data->miscdev.name = devm_kasprintf(rdev, GFP_KERNEL, "fastrpc-%s",
++					    domains[domain_id]);
+ 	data->miscdev.fops = &fastrpc_fops;
+ 	err = misc_register(&data->miscdev);
+ 	if (err)
+-- 
+2.20.1
+
diff --git a/queue-5.4/mmc-tmio-add-mmc_cap_erase-to-allow-erase-discard-tr.patch b/queue-5.4/mmc-tmio-add-mmc_cap_erase-to-allow-erase-discard-tr.patch
new file mode 100644
index 00000000000..d03703cd4e3
--- /dev/null
+++ b/queue-5.4/mmc-tmio-add-mmc_cap_erase-to-allow-erase-discard-tr.patch
@@ -0,0 +1,73 @@
+From c01e68cded81f52ce74c2905ed65a36bfbffb0aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Nov 2019 14:44:30 +0100
+Subject: mmc: tmio: Add MMC_CAP_ERASE to allow erase/discard/trim requests
+
+From: Eugeniu Rosca <erosca@de.adit-jv.com>
+
+[ Upstream commit c91843463e9e821dc3b48fe37e3155fa38299f6e ]
+
+Isolated initially to renesas_sdhi_internal_dmac [1], Ulf suggested
+adding MMC_CAP_ERASE to the TMIO mmc core:
+
+On Fri, Nov 15, 2019 at 10:27:25AM +0100, Ulf Hansson wrote:
+ -- snip --
+ This test and due to the discussions with Wolfram and you in this
+ thread, I would actually suggest that you enable MMC_CAP_ERASE for all
+ tmio variants, rather than just for this particular one.
+
+ In other words, set the cap in tmio_mmc_host_probe() should be fine,
+ as it seems none of the tmio variants supports HW busy detection at
+ this point.
+ -- snip --
+
+Testing on R-Car H3ULCB-KF doesn't reveal any issues (v5.4-rc7):
+
+root@rcar-gen3:~# lsblk
+NAME         MAJ:MIN RM  SIZE RO TYPE MOUNTPOINT
+mmcblk0      179:0    0 59.2G  0 disk  <--- eMMC
+mmcblk0boot0 179:8    0    4M  1 disk
+mmcblk0boot1 179:16   0    4M  1 disk
+mmcblk1      179:24   0   30G  0 disk  <--- SD card
+
+root@rcar-gen3:~# time blkdiscard /dev/mmcblk0
+real    0m8.659s
+user    0m0.001s
+sys     0m1.920s
+
+root@rcar-gen3:~# time blkdiscard /dev/mmcblk1
+real    0m1.176s
+user    0m0.001s
+sys     0m0.124s
+
+[1] https://lore.kernel.org/linux-renesas-soc/20191112134808.23546-1-erosca@de.adit-jv.com/
+
+Cc: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Cc: Masahiro Yamada <yamada.masahiro@socionext.com>
+Cc: Andrew Gabbasov <andrew_gabbasov@mentor.com>
+Originally-by: Harish Jenny K N <harish_kandiga@mentor.com>
+Suggested-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Eugeniu Rosca <erosca@de.adit-jv.com>
+Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/tmio_mmc_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/host/tmio_mmc_core.c b/drivers/mmc/host/tmio_mmc_core.c
+index 9b6e1001e77c..dec5a99f52cf 100644
+--- a/drivers/mmc/host/tmio_mmc_core.c
++++ b/drivers/mmc/host/tmio_mmc_core.c
+@@ -1184,7 +1184,7 @@ int tmio_mmc_host_probe(struct tmio_mmc_host *_host)
+ 	if (ret == -EPROBE_DEFER)
+ 		return ret;
+ 
+-	mmc->caps |= MMC_CAP_4_BIT_DATA | pdata->capabilities;
++	mmc->caps |= MMC_CAP_ERASE | MMC_CAP_4_BIT_DATA | pdata->capabilities;
+ 	mmc->caps2 |= pdata->capabilities2;
+ 	mmc->max_segs = pdata->max_segs ? : 32;
+ 	mmc->max_blk_size = TMIO_MAX_BLK_SIZE;
+-- 
+2.20.1
+
diff --git a/queue-5.4/mt76-fix-possible-out-of-bound-access-in-mt7615_fill.patch b/queue-5.4/mt76-fix-possible-out-of-bound-access-in-mt7615_fill.patch
new file mode 100644
index 00000000000..82e3ee4e023
--- /dev/null
+++ b/queue-5.4/mt76-fix-possible-out-of-bound-access-in-mt7615_fill.patch
@@ -0,0 +1,58 @@
+From b7cc224cf2dfc0f5c51768a481978610f8343edf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2019 01:01:58 +0200
+Subject: mt76: fix possible out-of-bound access in
+ mt7615_fill_txs/mt7603_fill_txs
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit e8b970c8e367e85fab9b8ac4f36080e5d653c38e ]
+
+Fix possible out-of-bound access of status rates array in
+mt7615_fill_txs/mt7603_fill_txs routines
+
+Fixes: c5211e997eca ("mt76: mt7603: rework and fix tx status reporting")
+Fixes: 4af81f02b49c ("mt76: mt7615: sync with mt7603 rate control changes")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7603/mac.c | 4 +++-
+ drivers/net/wireless/mediatek/mt76/mt7615/mac.c | 4 +++-
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/mac.c b/drivers/net/wireless/mediatek/mt76/mt7603/mac.c
+index c328192307c4..ff3f3d98b625 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7603/mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7603/mac.c
+@@ -1032,8 +1032,10 @@ mt7603_fill_txs(struct mt7603_dev *dev, struct mt7603_sta *sta,
+ 		if (idx && (cur_rate->idx != info->status.rates[i].idx ||
+ 			    cur_rate->flags != info->status.rates[i].flags)) {
+ 			i++;
+-			if (i == ARRAY_SIZE(info->status.rates))
++			if (i == ARRAY_SIZE(info->status.rates)) {
++				i--;
+ 				break;
++			}
+ 
+ 			info->status.rates[i] = *cur_rate;
+ 			info->status.rates[i].count = 0;
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
+index e07ce2c10013..111e38ff954a 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
+@@ -914,8 +914,10 @@ static bool mt7615_fill_txs(struct mt7615_dev *dev, struct mt7615_sta *sta,
+ 		if (idx && (cur_rate->idx != info->status.rates[i].idx ||
+ 			    cur_rate->flags != info->status.rates[i].flags)) {
+ 			i++;
+-			if (i == ARRAY_SIZE(info->status.rates))
++			if (i == ARRAY_SIZE(info->status.rates)) {
++				i--;
+ 				break;
++			}
+ 
+ 			info->status.rates[i] = *cur_rate;
+ 			info->status.rates[i].count = 0;
+-- 
+2.20.1
+
diff --git a/queue-5.4/mwifiex-pcie-fix-memory-leak-in-mwifiex_pcie_init_ev.patch b/queue-5.4/mwifiex-pcie-fix-memory-leak-in-mwifiex_pcie_init_ev.patch
new file mode 100644
index 00000000000..0735a2a77c6
--- /dev/null
+++ b/queue-5.4/mwifiex-pcie-fix-memory-leak-in-mwifiex_pcie_init_ev.patch
@@ -0,0 +1,42 @@
+From 674dc50ed9132868dfe83266bdfd6b64e868adf5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Oct 2019 15:16:48 -0500
+Subject: mwifiex: pcie: Fix memory leak in mwifiex_pcie_init_evt_ring
+
+From: Navid Emamdoost <navid.emamdoost@gmail.com>
+
+[ Upstream commit d10dcb615c8e29d403a24d35f8310a7a53e3050c ]
+
+In mwifiex_pcie_init_evt_ring, a new skb is allocated which should be
+released if mwifiex_map_pci_memory() fails. The release for skb and
+card->evtbd_ring_vbase is added.
+
+Fixes: 0732484b47b5 ("mwifiex: separate ring initialization and ring creation routines")
+Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
+Acked-by: Ganapathi Bhat <gbhat@marvell.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/mwifiex/pcie.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c
+index eff06d59e9df..096334e941a1 100644
+--- a/drivers/net/wireless/marvell/mwifiex/pcie.c
++++ b/drivers/net/wireless/marvell/mwifiex/pcie.c
+@@ -687,8 +687,11 @@ static int mwifiex_pcie_init_evt_ring(struct mwifiex_adapter *adapter)
+ 		skb_put(skb, MAX_EVENT_SIZE);
+ 
+ 		if (mwifiex_map_pci_memory(adapter, skb, MAX_EVENT_SIZE,
+-					   PCI_DMA_FROMDEVICE))
++					   PCI_DMA_FROMDEVICE)) {
++			kfree_skb(skb);
++			kfree(card->evtbd_ring_vbase);
+ 			return -1;
++		}
+ 
+ 		buf_pa = MWIFIEX_SKB_DMA_ADDR(skb);
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/net-af_xdp-use-correct-number-of-channels-from-ethto.patch b/queue-5.4/net-af_xdp-use-correct-number-of-channels-from-ethto.patch
new file mode 100644
index 00000000000..02f795850de
--- /dev/null
+++ b/queue-5.4/net-af_xdp-use-correct-number-of-channels-from-ethto.patch
@@ -0,0 +1,55 @@
+From b8e4dc3cc1606391fd97f2c2ffda391126dcc6f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Nov 2019 16:19:51 -0800
+Subject: net-af_xdp: Use correct number of channels from ethtool
+
+From: Luigi Rizzo <lrizzo@google.com>
+
+[ Upstream commit 3de88c9113f88c04abda339f1aa629397bf89e02 ]
+
+Drivers use different fields to report the number of channels, so take
+the maximum of all data channels (rx, tx, combined) when determining the
+size of the xsk map. The current code used only 'combined' which was set
+to 0 in some drivers e.g. mlx4.
+
+Tested: compiled and run xdpsock -q 3 -r -S on mlx4
+
+Signed-off-by: Luigi Rizzo <lrizzo@google.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Acked-by: Magnus Karlsson <magnus.karlsson@intel.com>
+Link: https://lore.kernel.org/bpf/20191119001951.92930-1-lrizzo@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/xsk.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/tools/lib/bpf/xsk.c b/tools/lib/bpf/xsk.c
+index a73b79d29333..70f9e10de286 100644
+--- a/tools/lib/bpf/xsk.c
++++ b/tools/lib/bpf/xsk.c
+@@ -344,13 +344,18 @@ static int xsk_get_max_queues(struct xsk_socket *xsk)
+ 		goto out;
+ 	}
+ 
+-	if (err || channels.max_combined == 0)
++	if (err) {
+ 		/* If the device says it has no channels, then all traffic
+ 		 * is sent to a single stream, so max queues = 1.
+ 		 */
+ 		ret = 1;
+-	else
+-		ret = channels.max_combined;
++	} else {
++		/* Take the max of rx, tx, combined. Drivers return
++		 * the number of channels in different ways.
++		 */
++		ret = max(channels.max_rx, channels.max_tx);
++		ret = max(ret, (int)channels.max_combined);
++	}
+ 
+ out:
+ 	close(fd);
+-- 
+2.20.1
+
diff --git a/queue-5.4/net-avoid-potential-false-sharing-in-neighbor-relate.patch b/queue-5.4/net-avoid-potential-false-sharing-in-neighbor-relate.patch
new file mode 100644
index 00000000000..566e3e5cb1d
--- /dev/null
+++ b/queue-5.4/net-avoid-potential-false-sharing-in-neighbor-relate.patch
@@ -0,0 +1,101 @@
+From c67d67cfa47b20a6a3591010ed612e5ca8c99c77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Nov 2019 14:11:51 -0800
+Subject: net: avoid potential false sharing in neighbor related code
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 25c7a6d1f90e208ec27ca854b1381ed39842ec57 ]
+
+There are common instances of the following construct :
+
+	if (n->confirmed != now)
+		n->confirmed = now;
+
+A C compiler could legally remove the conditional.
+
+Use READ_ONCE()/WRITE_ONCE() to avoid this problem.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/arp.h   |  4 ++--
+ include/net/ndisc.h |  8 ++++----
+ include/net/sock.h  | 12 ++++++------
+ 3 files changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/include/net/arp.h b/include/net/arp.h
+index c8f580a0e6b1..4950191f6b2b 100644
+--- a/include/net/arp.h
++++ b/include/net/arp.h
+@@ -57,8 +57,8 @@ static inline void __ipv4_confirm_neigh(struct net_device *dev, u32 key)
+ 		unsigned long now = jiffies;
+ 
+ 		/* avoid dirtying neighbour */
+-		if (n->confirmed != now)
+-			n->confirmed = now;
++		if (READ_ONCE(n->confirmed) != now)
++			WRITE_ONCE(n->confirmed, now);
+ 	}
+ 	rcu_read_unlock_bh();
+ }
+diff --git a/include/net/ndisc.h b/include/net/ndisc.h
+index b2f715ca0567..b5ebeb3b0de0 100644
+--- a/include/net/ndisc.h
++++ b/include/net/ndisc.h
+@@ -414,8 +414,8 @@ static inline void __ipv6_confirm_neigh(struct net_device *dev,
+ 		unsigned long now = jiffies;
+ 
+ 		/* avoid dirtying neighbour */
+-		if (n->confirmed != now)
+-			n->confirmed = now;
++		if (READ_ONCE(n->confirmed) != now)
++			WRITE_ONCE(n->confirmed, now);
+ 	}
+ 	rcu_read_unlock_bh();
+ }
+@@ -431,8 +431,8 @@ static inline void __ipv6_confirm_neigh_stub(struct net_device *dev,
+ 		unsigned long now = jiffies;
+ 
+ 		/* avoid dirtying neighbour */
+-		if (n->confirmed != now)
+-			n->confirmed = now;
++		if (READ_ONCE(n->confirmed) != now)
++			WRITE_ONCE(n->confirmed, now);
+ 	}
+ 	rcu_read_unlock_bh();
+ }
+diff --git a/include/net/sock.h b/include/net/sock.h
+index 718e62fbe869..013396e50b91 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -1940,8 +1940,8 @@ struct dst_entry *sk_dst_check(struct sock *sk, u32 cookie);
+ 
+ static inline void sk_dst_confirm(struct sock *sk)
+ {
+-	if (!sk->sk_dst_pending_confirm)
+-		sk->sk_dst_pending_confirm = 1;
++	if (!READ_ONCE(sk->sk_dst_pending_confirm))
++		WRITE_ONCE(sk->sk_dst_pending_confirm, 1);
+ }
+ 
+ static inline void sock_confirm_neigh(struct sk_buff *skb, struct neighbour *n)
+@@ -1951,10 +1951,10 @@ static inline void sock_confirm_neigh(struct sk_buff *skb, struct neighbour *n)
+ 		unsigned long now = jiffies;
+ 
+ 		/* avoid dirtying neighbour */
+-		if (n->confirmed != now)
+-			n->confirmed = now;
+-		if (sk && sk->sk_dst_pending_confirm)
+-			sk->sk_dst_pending_confirm = 0;
++		if (READ_ONCE(n->confirmed) != now)
++			WRITE_ONCE(n->confirmed, now);
++		if (sk && READ_ONCE(sk->sk_dst_pending_confirm))
++			WRITE_ONCE(sk->sk_dst_pending_confirm, 0);
+ 	}
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/net-dsa-lan9303-select-regmap-when-lan9303-enable.patch b/queue-5.4/net-dsa-lan9303-select-regmap-when-lan9303-enable.patch
new file mode 100644
index 00000000000..b196d47f9c6
--- /dev/null
+++ b/queue-5.4/net-dsa-lan9303-select-regmap-when-lan9303-enable.patch
@@ -0,0 +1,43 @@
+From d2c840182fd46b694754aea70204568ad4c44f2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Oct 2019 10:21:39 +0800
+Subject: net: dsa: LAN9303: select REGMAP when LAN9303 enable
+
+From: Mao Wenan <maowenan@huawei.com>
+
+[ Upstream commit b6989d248a2d13f02895bae1a9321b3bbccc0283 ]
+
+When NET_DSA_SMSC_LAN9303=y and NET_DSA_SMSC_LAN9303_MDIO=y,
+below errors can be seen:
+drivers/net/dsa/lan9303_mdio.c:87:23: error: REGMAP_ENDIAN_LITTLE
+undeclared here (not in a function)
+  .reg_format_endian = REGMAP_ENDIAN_LITTLE,
+drivers/net/dsa/lan9303_mdio.c:93:3: error: const struct regmap_config
+has no member named reg_read
+  .reg_read = lan9303_mdio_read,
+
+It should select REGMAP in config NET_DSA_SMSC_LAN9303.
+
+Fixes: dc7005831523 ("net: dsa: LAN9303: add MDIO managed mode support")
+Signed-off-by: Mao Wenan <maowenan@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/dsa/Kconfig b/drivers/net/dsa/Kconfig
+index f6232ce8481f..685e12b05a7c 100644
+--- a/drivers/net/dsa/Kconfig
++++ b/drivers/net/dsa/Kconfig
+@@ -77,6 +77,7 @@ config NET_DSA_REALTEK_SMI
+ config NET_DSA_SMSC_LAN9303
+ 	tristate
+ 	select NET_DSA_TAG_LAN9303
++	select REGMAP
+ 	---help---
+ 	  This enables support for the SMSC/Microchip LAN9303 3 port ethernet
+ 	  switch chips.
+-- 
+2.20.1
+
diff --git a/queue-5.4/net-dsa-sja1105-disallow-management-xmit-during-swit.patch b/queue-5.4/net-dsa-sja1105-disallow-management-xmit-during-swit.patch
new file mode 100644
index 00000000000..800067d35bb
--- /dev/null
+++ b/queue-5.4/net-dsa-sja1105-disallow-management-xmit-during-swit.patch
@@ -0,0 +1,62 @@
+From c82148fdb6783c2be07f2815069d46158237f58e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 9 Nov 2019 13:32:24 +0200
+Subject: net: dsa: sja1105: Disallow management xmit during switch reset
+
+From: Vladimir Oltean <olteanv@gmail.com>
+
+[ Upstream commit af580ae2dcb250719857b4b7024bd4bb0c2e05fb ]
+
+The purpose here is to avoid ptp4l fail due to this condition:
+
+  timed out while polling for tx timestamp
+  increasing tx_timestamp_timeout may correct this issue, but it is likely caused by a driver bug
+  port 1: send peer delay request failed
+
+So either reset the switch before the management frame was sent, or
+after it was timestamped as well, but not in the middle.
+
+The condition may arise either due to a true timeout (i.e. because
+re-uploading the static config takes time), or due to the TX timestamp
+actually getting lost due to reset. For the former we can increase
+tx_timestamp_timeout in userspace, for the latter we need this patch.
+
+Locking all traffic during switch reset does not make sense at all,
+though. Forcing all CPU-originated traffic to potentially block waiting
+for a sleepable context to send > 800 bytes over SPI is not a good idea.
+Flows that are autonomously forwarded by the switch will get dropped
+anyway during switch reset no matter what. So just let all other
+CPU-originated traffic be dropped as well.
+
+Signed-off-by: Vladimir Oltean <olteanv@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/sja1105/sja1105_main.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/dsa/sja1105/sja1105_main.c b/drivers/net/dsa/sja1105/sja1105_main.c
+index aa140662c7c2..4e5a428ab1a4 100644
+--- a/drivers/net/dsa/sja1105/sja1105_main.c
++++ b/drivers/net/dsa/sja1105/sja1105_main.c
+@@ -1389,6 +1389,8 @@ int sja1105_static_config_reload(struct sja1105_private *priv)
+ 	int speed_mbps[SJA1105_NUM_PORTS];
+ 	int rc, i;
+ 
++	mutex_lock(&priv->mgmt_lock);
++
+ 	mac = priv->static_config.tables[BLK_IDX_MAC_CONFIG].entries;
+ 
+ 	/* Back up the dynamic link speed changed by sja1105_adjust_port_config
+@@ -1420,6 +1422,8 @@ int sja1105_static_config_reload(struct sja1105_private *priv)
+ 			goto out;
+ 	}
+ out:
++	mutex_unlock(&priv->mgmt_lock);
++
+ 	return rc;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/net-ethernet-ti-add-dependency-for-ti_davinci_emac.patch b/queue-5.4/net-ethernet-ti-add-dependency-for-ti_davinci_emac.patch
new file mode 100644
index 00000000000..3f442311b87
--- /dev/null
+++ b/queue-5.4/net-ethernet-ti-add-dependency-for-ti_davinci_emac.patch
@@ -0,0 +1,52 @@
+From 2e69ba82561e1cbb9b6d2e2576baf245d5896ae1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Nov 2019 14:33:58 +0800
+Subject: net: ethernet: ti: Add dependency for TI_DAVINCI_EMAC
+
+From: Mao Wenan <maowenan@huawei.com>
+
+[ Upstream commit b2ef81dcdf3835bd55e5f97ff30131bb327be7fa ]
+
+If TI_DAVINCI_EMAC=y and GENERIC_ALLOCATOR is not set,
+below erros can be seen:
+drivers/net/ethernet/ti/davinci_cpdma.o: In function `cpdma_desc_pool_destroy.isra.14':
+davinci_cpdma.c:(.text+0x359): undefined reference to `gen_pool_size'
+davinci_cpdma.c:(.text+0x365): undefined reference to `gen_pool_avail'
+davinci_cpdma.c:(.text+0x373): undefined reference to `gen_pool_avail'
+davinci_cpdma.c:(.text+0x37f): undefined reference to `gen_pool_size'
+drivers/net/ethernet/ti/davinci_cpdma.o: In function `__cpdma_chan_free':
+davinci_cpdma.c:(.text+0x4a2): undefined reference to `gen_pool_free_owner'
+drivers/net/ethernet/ti/davinci_cpdma.o: In function `cpdma_chan_submit_si':
+davinci_cpdma.c:(.text+0x66c): undefined reference to `gen_pool_alloc_algo_owner'
+davinci_cpdma.c:(.text+0x805): undefined reference to `gen_pool_free_owner'
+drivers/net/ethernet/ti/davinci_cpdma.o: In function `cpdma_ctlr_create':
+davinci_cpdma.c:(.text+0xabd): undefined reference to `devm_gen_pool_create'
+davinci_cpdma.c:(.text+0xb79): undefined reference to `gen_pool_add_owner'
+drivers/net/ethernet/ti/davinci_cpdma.o: In function `cpdma_check_free_tx_desc':
+davinci_cpdma.c:(.text+0x16c6): undefined reference to `gen_pool_avail'
+
+This patch mades TI_DAVINCI_EMAC select GENERIC_ALLOCATOR.
+
+Fixes: 99f629718272 ("net: ethernet: ti: cpsw: drop TI_DAVINCI_CPDMA config option")
+Signed-off-by: Mao Wenan <maowenan@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ti/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/ti/Kconfig b/drivers/net/ethernet/ti/Kconfig
+index 834afca3a019..137632b09c72 100644
+--- a/drivers/net/ethernet/ti/Kconfig
++++ b/drivers/net/ethernet/ti/Kconfig
+@@ -22,6 +22,7 @@ config TI_DAVINCI_EMAC
+ 	depends on ARM && ( ARCH_DAVINCI || ARCH_OMAP3 ) || COMPILE_TEST
+ 	select TI_DAVINCI_MDIO
+ 	select PHYLIB
++	select GENERIC_ALLOCATOR
+ 	---help---
+ 	  This driver supports TI's DaVinci Ethernet .
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/net-ethernet-ti-ale-clean-ale-tbl-on-init-and-intf-r.patch b/queue-5.4/net-ethernet-ti-ale-clean-ale-tbl-on-init-and-intf-r.patch
new file mode 100644
index 00000000000..7382d1eaaab
--- /dev/null
+++ b/queue-5.4/net-ethernet-ti-ale-clean-ale-tbl-on-init-and-intf-r.patch
@@ -0,0 +1,42 @@
+From 0a18cc14922060300affb585a8f6fa36e9dfe9d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Nov 2019 00:19:13 +0200
+Subject: net: ethernet: ti: ale: clean ale tbl on init and intf restart
+
+From: Grygorii Strashko <grygorii.strashko@ti.com>
+
+[ Upstream commit 7fe579dfb90fcdf0c7722f33c772d5f0d1bc7cb6 ]
+
+Clean CPSW ALE on init and intf restart (up/down) to avoid reading obsolete
+or garbage entries from ALE table.
+
+Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ti/cpsw_ale.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/ti/cpsw_ale.c b/drivers/net/ethernet/ti/cpsw_ale.c
+index 84025dcc78d5..e7c24396933e 100644
+--- a/drivers/net/ethernet/ti/cpsw_ale.c
++++ b/drivers/net/ethernet/ti/cpsw_ale.c
+@@ -779,6 +779,7 @@ void cpsw_ale_start(struct cpsw_ale *ale)
+ void cpsw_ale_stop(struct cpsw_ale *ale)
+ {
+ 	del_timer_sync(&ale->timer);
++	cpsw_ale_control_set(ale, 0, ALE_CLEAR, 1);
+ 	cpsw_ale_control_set(ale, 0, ALE_ENABLE, 0);
+ }
+ 
+@@ -862,6 +863,7 @@ struct cpsw_ale *cpsw_ale_create(struct cpsw_ale_params *params)
+ 					ALE_UNKNOWNVLAN_FORCE_UNTAG_EGRESS;
+ 	}
+ 
++	cpsw_ale_control_set(ale, 0, ALE_CLEAR, 1);
+ 	return ale;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/net-hns3-add-struct-netdev_queue-debug-info-for-tx-t.patch b/queue-5.4/net-hns3-add-struct-netdev_queue-debug-info-for-tx-t.patch
new file mode 100644
index 00000000000..7d6df3d7d3c
--- /dev/null
+++ b/queue-5.4/net-hns3-add-struct-netdev_queue-debug-info-for-tx-t.patch
@@ -0,0 +1,41 @@
+From 6a2beda7cc96f1c0adbf9907a9c03a4014e9088d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Oct 2019 19:23:17 +0800
+Subject: net: hns3: add struct netdev_queue debug info for TX timeout
+
+From: Yunsheng Lin <linyunsheng@huawei.com>
+
+[ Upstream commit 647522a5ef6401dcdb8ec417421e43fb21910167 ]
+
+When there is a TX timeout, we can tell if the driver or stack
+has stopped the queue by looking at state field, and when has
+the last packet transmited by looking at trans_start field.
+
+So this patch prints these two field in the
+hns3_get_tx_timeo_queue_info().
+
+Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com>
+Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+index 616cad0faa21..84d8816c8681 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+@@ -1692,6 +1692,9 @@ static bool hns3_get_tx_timeo_queue_info(struct net_device *ndev)
+ 		    time_after(jiffies,
+ 			       (trans_start + ndev->watchdog_timeo))) {
+ 			timeout_queue = i;
++			netdev_info(ndev, "queue state: 0x%lx, delta msecs: %u\n",
++				    q->state,
++				    jiffies_to_msecs(jiffies - trans_start));
+ 			break;
+ 		}
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-5.4/net-hns3-log-and-clear-hardware-error-after-reset-co.patch b/queue-5.4/net-hns3-log-and-clear-hardware-error-after-reset-co.patch
new file mode 100644
index 00000000000..d6ba6c81a41
--- /dev/null
+++ b/queue-5.4/net-hns3-log-and-clear-hardware-error-after-reset-co.patch
@@ -0,0 +1,39 @@
+From 29c56147232641da7c36e10d354b580797617163 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 19 Oct 2019 16:03:56 +0800
+Subject: net: hns3: log and clear hardware error after reset complete
+
+From: Jian Shen <shenjian15@huawei.com>
+
+[ Upstream commit 4fdd0bca6152aa201898454e63cbb255a18ae6e9 ]
+
+When device is resetting, the CMDQ service may be stopped until
+reset completed. If a new RAS error occurs at this moment, it
+will no be able to clear the RAS source. This patch fixes it
+by clear the RAS source after reset complete.
+
+Signed-off-by: Jian Shen <shenjian15@huawei.com>
+Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index c052bb33b3d3..162881005a6d 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -9443,6 +9443,9 @@ static int hclge_reset_ae_dev(struct hnae3_ae_dev *ae_dev)
+ 		return ret;
+ 	}
+ 
++	/* Log and clear the hw errors those already occurred */
++	hclge_handle_all_hns_hw_errors(ae_dev);
++
+ 	/* Re-enable the hw error interrupts because
+ 	 * the interrupts get disabled on global reset.
+ 	 */
+-- 
+2.20.1
+
diff --git a/queue-5.4/net-mlx5e-verify-that-rule-has-at-least-one-fwd-drop.patch b/queue-5.4/net-mlx5e-verify-that-rule-has-at-least-one-fwd-drop.patch
new file mode 100644
index 00000000000..a25977eabe1
--- /dev/null
+++ b/queue-5.4/net-mlx5e-verify-that-rule-has-at-least-one-fwd-drop.patch
@@ -0,0 +1,47 @@
+From c602164fc5ecc8f20bb57b4038287f7658516a44 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Sep 2019 21:14:54 +0300
+Subject: net/mlx5e: Verify that rule has at least one fwd/drop action
+
+From: Vlad Buslov <vladbu@mellanox.com>
+
+[ Upstream commit ae2741e2b6ce2bf1b656b1152c4ef147ff35b096 ]
+
+Currently, mlx5 tc layer doesn't verify that rule has at least one forward
+or drop action which leads to following firmware syndrome when user tries
+to offload such action:
+
+[ 1824.860501] mlx5_core 0000:81:00.0: mlx5_cmd_check:753:(pid 29458): SET_FLOW_TABLE_ENTRY(0x936) op_mod(0x0) failed, status bad parameter(0x3), syndrome (0x144b7a)
+
+Add check at the end of parse_tc_fdb_actions() that verifies that resulting
+attribute has action fwd or drop flag set.
+
+Signed-off-by: Vlad Buslov <vladbu@mellanox.com>
+Reviewed-by: Paul Blakey <paulb@mellanox.com>
+Reviewed-by: Roi Dayan <roid@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+index c2c7f214a56a..814a4ba4e7fa 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+@@ -3443,6 +3443,12 @@ static int parse_tc_fdb_actions(struct mlx5e_priv *priv,
+ 		attr->action |= MLX5_FLOW_CONTEXT_ACTION_FWD_DEST;
+ 	}
+ 
++	if (!(attr->action &
++	      (MLX5_FLOW_CONTEXT_ACTION_FWD_DEST | MLX5_FLOW_CONTEXT_ACTION_DROP))) {
++		NL_SET_ERR_MSG(extack, "Rule must have at least one forward/drop action");
++		return -EOPNOTSUPP;
++	}
++
+ 	if (attr->split_count > 0 && !mlx5_esw_has_fwd_fdb(priv->mdev)) {
+ 		NL_SET_ERR_MSG_MOD(extack,
+ 				   "current firmware doesn't support split rule for port mirroring");
+-- 
+2.20.1
+
diff --git a/queue-5.4/net-phy-avoid-matching-all-ones-clause-45-phy-ids.patch b/queue-5.4/net-phy-avoid-matching-all-ones-clause-45-phy-ids.patch
new file mode 100644
index 00000000000..b1766815e83
--- /dev/null
+++ b/queue-5.4/net-phy-avoid-matching-all-ones-clause-45-phy-ids.patch
@@ -0,0 +1,83 @@
+From 765e330e2887c2e41a9b391e663149896b9e6462 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Nov 2019 20:08:37 +0000
+Subject: net: phy: avoid matching all-ones clause 45 PHY IDs
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit b95e86d846b63b02ecdc94802ddbeaf9005fb6d9 ]
+
+We currently match clause 45 PHYs using any ID read from a MMD marked
+as present in the "Devices in package" registers 5 and 6.  However,
+this is incorrect.  45.2 says:
+
+  "The definition of the term package is vendor specific and could be
+   a chip, module, or other similar entity."
+
+so a package could be more or less than the whole PHY - a PHY could be
+made up of several modules instantiated onto a single chip such as the
+Marvell 88x3310, or some of the MMDs could be disabled according to
+chip configuration, such as the Broadcom 84881.
+
+In the case of Broadcom 84881, the "Devices in package" registers
+contain 0xc000009b, meaning that there is a PHYXS present in the
+package, but all registers in MMD 4 return 0xffff.  This leads to our
+matching code incorrectly binding this PHY to one of our generic PHY
+drivers.
+
+This patch changes the way we determine whether to attempt to match a
+MMD identifier, or use it to request a module - if the identifier is
+all-ones, then we skip over it. When reading the identifiers, we
+initialise phydev->c45_ids.device_ids to all-ones, only reading the
+device ID if the "Devices in package" registers indicates we should.
+
+This avoids the generic drivers incorrectly matching on a PHY ID of
+0xffffffff.
+
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/phy_device.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
+index adb66a2fae18..14c6b7597b06 100644
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -488,7 +488,7 @@ static int phy_bus_match(struct device *dev, struct device_driver *drv)
+ 
+ 	if (phydev->is_c45) {
+ 		for (i = 1; i < num_ids; i++) {
+-			if (!(phydev->c45_ids.devices_in_package & (1 << i)))
++			if (phydev->c45_ids.device_ids[i] == 0xffffffff)
+ 				continue;
+ 
+ 			if ((phydrv->phy_id & phydrv->phy_id_mask) ==
+@@ -632,7 +632,7 @@ struct phy_device *phy_device_create(struct mii_bus *bus, int addr, int phy_id,
+ 		int i;
+ 
+ 		for (i = 1; i < num_ids; i++) {
+-			if (!(c45_ids->devices_in_package & (1 << i)))
++			if (c45_ids->device_ids[i] == 0xffffffff)
+ 				continue;
+ 
+ 			ret = phy_request_driver_module(dev,
+@@ -812,10 +812,13 @@ static int get_phy_id(struct mii_bus *bus, int addr, u32 *phy_id,
+  */
+ struct phy_device *get_phy_device(struct mii_bus *bus, int addr, bool is_c45)
+ {
+-	struct phy_c45_device_ids c45_ids = {0};
++	struct phy_c45_device_ids c45_ids;
+ 	u32 phy_id = 0;
+ 	int r;
+ 
++	c45_ids.devices_in_package = 0;
++	memset(c45_ids.device_ids, 0xff, sizeof(c45_ids.device_ids));
++
+ 	r = get_phy_id(bus, addr, &phy_id, is_c45, &c45_ids);
+ 	if (r)
+ 		return ERR_PTR(r);
+-- 
+2.20.1
+
diff --git a/queue-5.4/net-phy-dp83867-enable-robust-auto-mdix.patch b/queue-5.4/net-phy-dp83867-enable-robust-auto-mdix.patch
new file mode 100644
index 00000000000..99caf8b04a9
--- /dev/null
+++ b/queue-5.4/net-phy-dp83867-enable-robust-auto-mdix.patch
@@ -0,0 +1,69 @@
+From fafa0906866b174cabb0f60480cf4efc88440744 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Oct 2019 17:48:45 +0300
+Subject: net: phy: dp83867: enable robust auto-mdix
+
+From: Grygorii Strashko <grygorii.strashko@ti.com>
+
+[ Upstream commit 5a7f08c2abb0efc9d17aff2fc75d6d3b85e622e4 ]
+
+The link detection timeouts can be observed (or link might not be detected
+at all) when dp83867 PHY is configured in manual mode (speed/duplex).
+
+CFG3[9] Robust Auto-MDIX option allows to significantly improve link detection
+in case dp83867 is configured in manual mode and reduce link detection
+time.
+As per DM: "If link partners are configured to operational modes that are
+not supported by normal Auto MDI/MDIX mode (like Auto-Neg versus Force
+100Base-TX or Force 100Base-TX versus Force 100Base-TX), this Robust Auto
+MDI/MDIX mode allows MDI/MDIX resolution and prevents deadlock."
+
+Hence, enable this option by default as there are no known reasons
+not to do so.
+
+Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/dp83867.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/phy/dp83867.c b/drivers/net/phy/dp83867.c
+index 37fceaf9fa10..cf4455bbf888 100644
+--- a/drivers/net/phy/dp83867.c
++++ b/drivers/net/phy/dp83867.c
+@@ -95,6 +95,10 @@
+ #define DP83867_IO_MUX_CFG_CLK_O_SEL_MASK	(0x1f << 8)
+ #define DP83867_IO_MUX_CFG_CLK_O_SEL_SHIFT	8
+ 
++/* CFG3 bits */
++#define DP83867_CFG3_INT_OE			BIT(7)
++#define DP83867_CFG3_ROBUST_AUTO_MDIX		BIT(9)
++
+ /* CFG4 bits */
+ #define DP83867_CFG4_PORT_MIRROR_EN              BIT(0)
+ 
+@@ -410,12 +414,13 @@ static int dp83867_config_init(struct phy_device *phydev)
+ 		phy_write_mmd(phydev, DP83867_DEVADDR, DP83867_SGMIICTL, val);
+ 	}
+ 
++	val = phy_read(phydev, DP83867_CFG3);
+ 	/* Enable Interrupt output INT_OE in CFG3 register */
+-	if (phy_interrupt_is_valid(phydev)) {
+-		val = phy_read(phydev, DP83867_CFG3);
+-		val |= BIT(7);
+-		phy_write(phydev, DP83867_CFG3, val);
+-	}
++	if (phy_interrupt_is_valid(phydev))
++		val |= DP83867_CFG3_INT_OE;
++
++	val |= DP83867_CFG3_ROBUST_AUTO_MDIX;
++	phy_write(phydev, DP83867_CFG3, val);
+ 
+ 	if (dp83867->port_mirroring != DP83867_PORT_MIRROING_KEEP)
+ 		dp83867_config_port_mirroring(phydev);
+-- 
+2.20.1
+
diff --git a/queue-5.4/net-phy-initialise-phydev-speed-and-duplex-sanely.patch b/queue-5.4/net-phy-initialise-phydev-speed-and-duplex-sanely.patch
new file mode 100644
index 00000000000..39a162d07b1
--- /dev/null
+++ b/queue-5.4/net-phy-initialise-phydev-speed-and-duplex-sanely.patch
@@ -0,0 +1,46 @@
+From 7d6b60115d5bb54f27f960b6753b9b26a7bc4b8f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Nov 2019 15:23:23 +0000
+Subject: net: phy: initialise phydev speed and duplex sanely
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit a5d66f810061e2dd70fb7a108dcd14e535bc639f ]
+
+When a phydev is created, the speed and duplex are set to zero and
+-1 respectively, rather than using the predefined SPEED_UNKNOWN and
+DUPLEX_UNKNOWN constants.
+
+There is a window at initialisation time where we may report link
+down using the 0/-1 values.  Tidy this up and use the predefined
+constants, so debug doesn't complain with:
+
+"Unsupported (update phy-core.c)/Unsupported (update phy-core.c)"
+
+when the speed and duplex settings are printed.
+
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/phy_device.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
+index 14c6b7597b06..cee8724caf2d 100644
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -596,8 +596,8 @@ struct phy_device *phy_device_create(struct mii_bus *bus, int addr, int phy_id,
+ 	mdiodev->device_free = phy_mdio_device_free;
+ 	mdiodev->device_remove = phy_mdio_device_remove;
+ 
+-	dev->speed = 0;
+-	dev->duplex = -1;
++	dev->speed = SPEED_UNKNOWN;
++	dev->duplex = DUPLEX_UNKNOWN;
+ 	dev->pause = 0;
+ 	dev->asym_pause = 0;
+ 	dev->link = 0;
+-- 
+2.20.1
+
diff --git a/queue-5.4/net-smc-increase-device-refcount-for-added-link-grou.patch b/queue-5.4/net-smc-increase-device-refcount-for-added-link-grou.patch
new file mode 100644
index 00000000000..f10699a12a3
--- /dev/null
+++ b/queue-5.4/net-smc-increase-device-refcount-for-added-link-grou.patch
@@ -0,0 +1,57 @@
+From 0d852925e1f8cf7e067bd0a868b296926ac1d475 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2019 10:07:45 +0200
+Subject: net/smc: increase device refcount for added link group
+
+From: Ursula Braun <ubraun@linux.ibm.com>
+
+[ Upstream commit b3cb53c05f20c5b4026a36a7bbd3010d1f3e0a55 ]
+
+SMCD link groups belong to certain ISM-devices and SMCR link group
+links belong to certain IB-devices. Increase the refcount for
+these devices, as long as corresponding link groups exist.
+
+Signed-off-by: Ursula Braun <ubraun@linux.ibm.com>
+Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/smc/smc_core.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
+index 2ba97ff325a5..0c5fcb8ed404 100644
+--- a/net/smc/smc_core.c
++++ b/net/smc/smc_core.c
+@@ -231,10 +231,12 @@ static int smc_lgr_create(struct smc_sock *smc, struct smc_init_info *ini)
+ 	lgr->conns_all = RB_ROOT;
+ 	if (ini->is_smcd) {
+ 		/* SMC-D specific settings */
++		get_device(&ini->ism_dev->dev);
+ 		lgr->peer_gid = ini->ism_gid;
+ 		lgr->smcd = ini->ism_dev;
+ 	} else {
+ 		/* SMC-R specific settings */
++		get_device(&ini->ib_dev->ibdev->dev);
+ 		lgr->role = smc->listen_smc ? SMC_SERV : SMC_CLNT;
+ 		memcpy(lgr->peer_systemid, ini->ib_lcl->id_for_peer,
+ 		       SMC_SYSTEMID_LEN);
+@@ -433,10 +435,13 @@ static void smc_lgr_free_bufs(struct smc_link_group *lgr)
+ static void smc_lgr_free(struct smc_link_group *lgr)
+ {
+ 	smc_lgr_free_bufs(lgr);
+-	if (lgr->is_smcd)
++	if (lgr->is_smcd) {
+ 		smc_ism_put_vlan(lgr->smcd, lgr->vlan_id);
+-	else
++		put_device(&lgr->smcd->dev);
++	} else {
+ 		smc_link_clear(&lgr->lnk[SMC_SINGLE_LINK]);
++		put_device(&lgr->lnk[SMC_SINGLE_LINK].smcibdev->ibdev->dev);
++	}
+ 	kfree(lgr);
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/net-wireless-intel-iwlwifi-fix-gro_normal-packet-sta.patch b/queue-5.4/net-wireless-intel-iwlwifi-fix-gro_normal-packet-sta.patch
new file mode 100644
index 00000000000..94264949c84
--- /dev/null
+++ b/queue-5.4/net-wireless-intel-iwlwifi-fix-gro_normal-packet-sta.patch
@@ -0,0 +1,81 @@
+From 4fccadbb6fd8717e27e7f95cb53c7d4d7c5b83ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Nov 2019 12:41:23 +0300
+Subject: net: wireless: intel: iwlwifi: fix GRO_NORMAL packet stalling
+
+From: Alexander Lobakin <alobakin@dlink.ru>
+
+[ Upstream commit b167191e2a851cb2e4c6ef8b91c83ff73ef41872 ]
+
+Commit 6570bc79c0df ("net: core: use listified Rx for GRO_NORMAL in
+napi_gro_receive()") has applied batched GRO_NORMAL packets processing
+to all napi_gro_receive() users, including mac80211-based drivers.
+
+However, this change has led to a regression in iwlwifi driver [1][2] as
+it is required for NAPI users to call napi_complete_done() or
+napi_complete() and the end of every polling iteration, whilst iwlwifi
+doesn't use NAPI scheduling at all and just calls napi_gro_flush().
+In that particular case, packets which have not been already flushed
+from napi->rx_list stall in it until at least next Rx cycle.
+
+Fix this by adding a manual flushing of the list to iwlwifi driver right
+before napi_gro_flush() call to mimic napi_complete() logics.
+
+I prefer to open-code gro_normal_list() rather than exporting it for 2
+reasons:
+* to prevent from using it and napi_gro_flush() in any new drivers,
+  as it is the *really* bad way to use NAPI that should be avoided;
+* to keep gro_normal_list() static and don't lose any CC optimizations.
+
+I also don't add the "Fixes:" tag as the mentioned commit was only a
+trigger that only exposed an improper usage of NAPI in this particular
+driver.
+
+[1] https://lore.kernel.org/netdev/PSXP216MB04388962C411CD0B17A86F47804A0@PSXP216MB0438.KORP216.PROD.OUTLOOK.COM
+[2] https://bugzilla.kernel.org/show_bug.cgi?id=205647
+
+Signed-off-by: Alexander Lobakin <alobakin@dlink.ru>
+Acked-by: Luca Coelho <luciano.coelho@intel.com>
+Reported-by: Nicholas Johnson <nicholas.johnson-opensource@outlook.com.au>
+Tested-by: Nicholas Johnson <nicholas.johnson-opensource@outlook.com.au>
+Reviewed-by: Edward Cree <ecree@solarflare.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/pcie/rx.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+index 19dd075f2f63..041dd75ac72b 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+@@ -1429,6 +1429,7 @@ out_err:
+ static void iwl_pcie_rx_handle(struct iwl_trans *trans, int queue)
+ {
+ 	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
++	struct napi_struct *napi;
+ 	struct iwl_rxq *rxq;
+ 	u32 r, i, count = 0;
+ 	bool emergency = false;
+@@ -1534,8 +1535,16 @@ out:
+ 	if (unlikely(emergency && count))
+ 		iwl_pcie_rxq_alloc_rbs(trans, GFP_ATOMIC, rxq);
+ 
+-	if (rxq->napi.poll)
+-		napi_gro_flush(&rxq->napi, false);
++	napi = &rxq->napi;
++	if (napi->poll) {
++		if (napi->rx_count) {
++			netif_receive_skb_list(&napi->rx_list);
++			INIT_LIST_HEAD(&napi->rx_list);
++			napi->rx_count = 0;
++		}
++
++		napi_gro_flush(napi, false);
++	}
+ 
+ 	iwl_pcie_rxq_restock(trans, rxq);
+ }
+-- 
+2.20.1
+
diff --git a/queue-5.4/nvme-discard-workaround-for-non-conformant-devices.patch b/queue-5.4/nvme-discard-workaround-for-non-conformant-devices.patch
new file mode 100644
index 00000000000..aca38415ed9
--- /dev/null
+++ b/queue-5.4/nvme-discard-workaround-for-non-conformant-devices.patch
@@ -0,0 +1,63 @@
+From b289736c2bfda820efc35224fe80987286737bf2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Nov 2019 21:55:01 +0100
+Subject: nvme: Discard workaround for non-conformant devices
+
+From: Eduard Hasenleithner <eduard@hasenleithner.at>
+
+[ Upstream commit 530436c45ef2e446c12538a400e465929a0b3ade ]
+
+Users observe IOMMU related errors when performing discard on nvme from
+non-compliant nvme devices reading beyond the end of the DMA mapped
+ranges to discard.
+
+Two different variants of this behavior have been observed: SM22XX
+controllers round up the read size to a multiple of 512 bytes, and Phison
+E12 unconditionally reads the maximum discard size allowed by the spec
+(256 segments or 4kB).
+
+Make nvme_setup_discard unconditionally allocate the maximum DSM buffer
+so the driver DMA maps a memory range that will always succeed.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=202665 many
+Signed-off-by: Eduard Hasenleithner <eduard@hasenleithner.at>
+[changelog, use existing define, kernel coding style]
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index b4e1e4379f1f..a6b7b242d516 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -611,8 +611,14 @@ static blk_status_t nvme_setup_discard(struct nvme_ns *ns, struct request *req,
+ 	struct nvme_dsm_range *range;
+ 	struct bio *bio;
+ 
+-	range = kmalloc_array(segments, sizeof(*range),
+-				GFP_ATOMIC | __GFP_NOWARN);
++	/*
++	 * Some devices do not consider the DSM 'Number of Ranges' field when
++	 * determining how much data to DMA. Always allocate memory for maximum
++	 * number of segments to prevent device reading beyond end of buffer.
++	 */
++	static const size_t alloc_size = sizeof(*range) * NVME_DSM_MAX_RANGES;
++
++	range = kzalloc(alloc_size, GFP_ATOMIC | __GFP_NOWARN);
+ 	if (!range) {
+ 		/*
+ 		 * If we fail allocation our range, fallback to the controller
+@@ -652,7 +658,7 @@ static blk_status_t nvme_setup_discard(struct nvme_ns *ns, struct request *req,
+ 
+ 	req->special_vec.bv_page = virt_to_page(range);
+ 	req->special_vec.bv_offset = offset_in_page(range);
+-	req->special_vec.bv_len = sizeof(*range) * segments;
++	req->special_vec.bv_len = alloc_size;
+ 	req->rq_flags |= RQF_SPECIAL_PAYLOAD;
+ 
+ 	return BLK_STS_OK;
+-- 
+2.20.1
+
diff --git a/queue-5.4/nvme-introduce-command-aborted-by-host-status-code.patch b/queue-5.4/nvme-introduce-command-aborted-by-host-status-code.patch
new file mode 100644
index 00000000000..05ac29970c3
--- /dev/null
+++ b/queue-5.4/nvme-introduce-command-aborted-by-host-status-code.patch
@@ -0,0 +1,69 @@
+From 08a3ccb6fa64e65e9642bf73452e6f75b7f3c1c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 13 Oct 2019 19:57:35 +0300
+Subject: nvme: introduce "Command Aborted By host" status code
+
+From: Max Gurtovoy <maxg@mellanox.com>
+
+[ Upstream commit 2dc3947b53f573e8a75ea9cbec5588df88ca502e ]
+
+Fix the status code of canceled requests initiated by the host according
+to TP4028 (Status Code 0x371):
+"Command Aborted By host: The command was aborted as a result of host
+action (e.g., the host disconnected the Fabric connection)."
+
+Also in a multipath environment, unless otherwise specified, errors of
+this type (path related) should be retried using a different path, if
+one is available.
+
+Signed-off-by: Max Gurtovoy <maxg@mellanox.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c      | 2 +-
+ drivers/nvme/host/multipath.c | 1 +
+ include/linux/nvme.h          | 1 +
+ 3 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index af3212aec871..b4e1e4379f1f 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -313,7 +313,7 @@ bool nvme_cancel_request(struct request *req, void *data, bool reserved)
+ 	if (blk_mq_request_completed(req))
+ 		return true;
+ 
+-	nvme_req(req)->status = NVME_SC_HOST_PATH_ERROR;
++	nvme_req(req)->status = NVME_SC_HOST_ABORTED_CMD;
+ 	blk_mq_complete_request(req);
+ 	return true;
+ }
+diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
+index e0f064dcbd02..132ade51ee87 100644
+--- a/drivers/nvme/host/multipath.c
++++ b/drivers/nvme/host/multipath.c
+@@ -95,6 +95,7 @@ void nvme_failover_req(struct request *req)
+ 		}
+ 		break;
+ 	case NVME_SC_HOST_PATH_ERROR:
++	case NVME_SC_HOST_ABORTED_CMD:
+ 		/*
+ 		 * Temporary transport disruption in talking to the controller.
+ 		 * Try to send on a new path.
+diff --git a/include/linux/nvme.h b/include/linux/nvme.h
+index f61d6906e59d..a260cd754f28 100644
+--- a/include/linux/nvme.h
++++ b/include/linux/nvme.h
+@@ -1368,6 +1368,7 @@ enum {
+ 	NVME_SC_ANA_INACCESSIBLE	= 0x302,
+ 	NVME_SC_ANA_TRANSITION		= 0x303,
+ 	NVME_SC_HOST_PATH_ERROR		= 0x370,
++	NVME_SC_HOST_ABORTED_CMD	= 0x371,
+ 
+ 	NVME_SC_CRD			= 0x1800,
+ 	NVME_SC_DNR			= 0x4000,
+-- 
+2.20.1
+
diff --git a/queue-5.4/nvmem-core-fix-nvmem_cell_write-inline-function.patch b/queue-5.4/nvmem-core-fix-nvmem_cell_write-inline-function.patch
new file mode 100644
index 00000000000..28d4fcef370
--- /dev/null
+++ b/queue-5.4/nvmem-core-fix-nvmem_cell_write-inline-function.patch
@@ -0,0 +1,46 @@
+From fa402a89322e800723ff3fc701faa65882e10dde Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Oct 2019 11:42:31 +0000
+Subject: nvmem: core: fix nvmem_cell_write inline function
+
+From: Sebastian Reichel <sebastian.reichel@collabora.com>
+
+[ Upstream commit 9b8303fc6efa724bd6a90656434fbde2cc6ceb2c ]
+
+nvmem_cell_write's buf argument uses different types based on
+the configuration of CONFIG_NVMEM. The function prototype for
+enabled NVMEM uses 'void *' type, but the static dummy function
+for disabled NVMEM uses 'const char *' instead. Fix the different
+behaviour by always expecting a 'void *' typed buf argument.
+
+Fixes: 7a78a7f7695b ("power: reset: nvmem-reboot-mode: use NVMEM as reboot mode write interface")
+Reported-by: kbuild test robot <lkp@intel.com>
+Cc: Han Nandor <nandor.han@vaisala.com>
+Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Reviewed-By: Han Nandor <nandor.han@vaisala.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20191029114240.14905-2-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/nvmem-consumer.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/nvmem-consumer.h b/include/linux/nvmem-consumer.h
+index 8f8be5b00060..5c17cb733224 100644
+--- a/include/linux/nvmem-consumer.h
++++ b/include/linux/nvmem-consumer.h
+@@ -118,7 +118,7 @@ static inline void *nvmem_cell_read(struct nvmem_cell *cell, size_t *len)
+ }
+ 
+ static inline int nvmem_cell_write(struct nvmem_cell *cell,
+-				    const char *buf, size_t len)
++				   void *buf, size_t len)
+ {
+ 	return -EOPNOTSUPP;
+ }
+-- 
+2.20.1
+
diff --git a/queue-5.4/nvmem-imx-ocotp-reset-error-status-on-probe.patch b/queue-5.4/nvmem-imx-ocotp-reset-error-status-on-probe.patch
new file mode 100644
index 00000000000..9b1a346e4d4
--- /dev/null
+++ b/queue-5.4/nvmem-imx-ocotp-reset-error-status-on-probe.patch
@@ -0,0 +1,41 @@
+From 49c564150b1a3817a083bd673dbebb41bfa924b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Oct 2019 11:42:35 +0000
+Subject: nvmem: imx-ocotp: reset error status on probe
+
+From: Lucas Stach <l.stach@pengutronix.de>
+
+[ Upstream commit c33c585f1b3a99d53920bdac614aca461d8db06f ]
+
+If software running before the OCOTP driver is loaded left the
+controller with the error status pending, the driver will never
+be able to complete the read timing setup. Reset the error status
+on probe to make sure the controller is in usable state.
+
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20191029114240.14905-6-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvmem/imx-ocotp.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/nvmem/imx-ocotp.c b/drivers/nvmem/imx-ocotp.c
+index dff2f3c357f5..fc40555ca4cd 100644
+--- a/drivers/nvmem/imx-ocotp.c
++++ b/drivers/nvmem/imx-ocotp.c
+@@ -521,6 +521,10 @@ static int imx_ocotp_probe(struct platform_device *pdev)
+ 	if (IS_ERR(priv->clk))
+ 		return PTR_ERR(priv->clk);
+ 
++	clk_prepare_enable(priv->clk);
++	imx_ocotp_clr_err_if_set(priv->base);
++	clk_disable_unprepare(priv->clk);
++
+ 	priv->params = of_device_get_match_data(&pdev->dev);
+ 	imx_ocotp_nvmem_config.size = 4 * priv->params->nregs;
+ 	imx_ocotp_nvmem_config.dev = dev;
+-- 
+2.20.1
+
diff --git a/queue-5.4/parport-load-lowlevel-driver-if-ports-not-found.patch b/queue-5.4/parport-load-lowlevel-driver-if-ports-not-found.patch
new file mode 100644
index 00000000000..285a325a601
--- /dev/null
+++ b/queue-5.4/parport-load-lowlevel-driver-if-ports-not-found.patch
@@ -0,0 +1,72 @@
+From 4085adf6d7993931e9d56f696dc4a83b3a0f5876 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Oct 2019 15:45:39 +0100
+Subject: parport: load lowlevel driver if ports not found
+
+From: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+
+[ Upstream commit 231ec2f24dad18d021b361045bbd618ba62a274e ]
+
+Usually all the distro will load the parport low level driver as part
+of their initialization. But we can get into a situation where all the
+parallel port drivers are built as module and we unload all the modules
+at a later time. Then if we just do "modprobe parport" it will only
+load the parport module and will not load the low level driver which
+will actually register the ports. So, check the bus if there is any
+parport registered, if not, load the low level driver.
+
+We can get into the above situation with all distro but only Suse has
+setup the alias for "parport_lowlevel" and so it only works in Suse.
+Users of Debian based distro will need to load the lowlevel module
+manually.
+
+Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Link: https://lore.kernel.org/r/20191016144540.18810-3-sudipm.mukherjee@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/parport/share.c | 21 +++++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+diff --git a/drivers/parport/share.c b/drivers/parport/share.c
+index 7b4ee33c1935..15c81cffd2de 100644
+--- a/drivers/parport/share.c
++++ b/drivers/parport/share.c
+@@ -230,6 +230,18 @@ static int port_check(struct device *dev, void *dev_drv)
+ 	return 0;
+ }
+ 
++/*
++ * Iterates through all the devices connected to the bus and return 1
++ * if the device is a parallel port.
++ */
++
++static int port_detect(struct device *dev, void *dev_drv)
++{
++	if (is_parport(dev))
++		return 1;
++	return 0;
++}
++
+ /**
+  *	parport_register_driver - register a parallel port device driver
+  *	@drv: structure describing the driver
+@@ -282,6 +294,15 @@ int __parport_register_driver(struct parport_driver *drv, struct module *owner,
+ 		if (ret)
+ 			return ret;
+ 
++		/*
++		 * check if bus has any parallel port registered, if
++		 * none is found then load the lowlevel driver.
++		 */
++		ret = bus_for_each_dev(&parport_bus_type, NULL, NULL,
++				       port_detect);
++		if (!ret)
++			get_lowlevel_driver();
++
+ 		mutex_lock(&registration_lock);
+ 		if (drv->match_port)
+ 			bus_for_each_dev(&parport_bus_type, NULL, drv,
+-- 
+2.20.1
+
diff --git a/queue-5.4/perf-core-fix-the-mlock-accounting-again.patch b/queue-5.4/perf-core-fix-the-mlock-accounting-again.patch
new file mode 100644
index 00000000000..0bb5f859559
--- /dev/null
+++ b/queue-5.4/perf-core-fix-the-mlock-accounting-again.patch
@@ -0,0 +1,69 @@
+From 5c1f543ca72709d253fabc0d147422951e2d9a4f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Nov 2019 18:08:18 +0200
+Subject: perf/core: Fix the mlock accounting, again
+
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+
+[ Upstream commit 36b3db03b4741b8935b68fffc7e69951d8d70a89 ]
+
+Commit:
+
+  5e6c3c7b1ec2 ("perf/aux: Fix tracking of auxiliary trace buffer allocation")
+
+tried to guess the correct combination of arithmetic operations that would
+undo the AUX buffer's mlock accounting, and failed, leaking the bottom part
+when an allocation needs to be charged partially to both user->locked_vm
+and mm->pinned_vm, eventually leaving the user with no locked bonus:
+
+  $ perf record -e intel_pt//u -m1,128 uname
+  [ perf record: Woken up 1 times to write data ]
+  [ perf record: Captured and wrote 0.061 MB perf.data ]
+
+  $ perf record -e intel_pt//u -m1,128 uname
+  Permission error mapping pages.
+  Consider increasing /proc/sys/kernel/perf_event_mlock_kb,
+  or try again with a smaller value of -m/--mmap_pages.
+  (current value: 1,128)
+
+Fix this by subtracting both locked and pinned counts when AUX buffer is
+unmapped.
+
+Reported-by: Thomas Richter <tmricht@linux.ibm.com>
+Tested-by: Thomas Richter <tmricht@linux.ibm.com>
+Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Acked-by: Peter Zijlstra <peterz@infradead.org>
+Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Stephane Eranian <eranian@google.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Vince Weaver <vincent.weaver@maine.edu>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/events/core.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 00a014670ed0..8f66a4833ded 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -5607,10 +5607,8 @@ static void perf_mmap_close(struct vm_area_struct *vma)
+ 		perf_pmu_output_stop(event);
+ 
+ 		/* now it's safe to free the pages */
+-		if (!rb->aux_mmap_locked)
+-			atomic_long_sub(rb->aux_nr_pages, &mmap_user->locked_vm);
+-		else
+-			atomic64_sub(rb->aux_mmap_locked, &vma->vm_mm->pinned_vm);
++		atomic_long_sub(rb->aux_nr_pages - rb->aux_mmap_locked, &mmap_user->locked_vm);
++		atomic64_sub(rb->aux_mmap_locked, &vma->vm_mm->pinned_vm);
+ 
+ 		/* this has to be the last one */
+ 		rb_free_aux(rb);
+-- 
+2.20.1
+
diff --git a/queue-5.4/perf-cs-etm-fix-definition-of-macro-to_cs_queue_nr.patch b/queue-5.4/perf-cs-etm-fix-definition-of-macro-to_cs_queue_nr.patch
new file mode 100644
index 00000000000..0cb99e041b0
--- /dev/null
+++ b/queue-5.4/perf-cs-etm-fix-definition-of-macro-to_cs_queue_nr.patch
@@ -0,0 +1,66 @@
+From 2945e3a6b5e9648ba20aefb41a49712c5dfce673 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Oct 2019 15:48:08 +0800
+Subject: perf cs-etm: Fix definition of macro TO_CS_QUEUE_NR
+
+From: Leo Yan <leo.yan@linaro.org>
+
+[ Upstream commit 9d604aad4bb022e848dec80d6fe5f73fe87061a2 ]
+
+Macro TO_CS_QUEUE_NR definition has a typo, which uses 'trace_id_chan'
+as its parameter, this doesn't match with its definition body which uses
+'trace_chan_id'.  So renames the parameter to 'trace_chan_id'.
+
+It's luck to have a local variable 'trace_chan_id' in the function
+cs_etm__setup_queue(), even we wrongly define the macro TO_CS_QUEUE_NR,
+the local variable 'trace_chan_id' is used rather than the macro's
+parameter 'trace_id_chan'; so the compiler doesn't complain for this
+before.
+
+After renaming the parameter, it leads to a compiling error due
+cs_etm__setup_queue() has no variable 'trace_id_chan'.  This patch uses
+the variable 'trace_chan_id' for the macro so that fixes the compiling
+error.
+
+Signed-off-by: Leo Yan <leo.yan@linaro.org>
+Reviewed-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Suzuki Poulouse <suzuki.poulose@arm.com>
+Cc: coresight ml <coresight@lists.linaro.org>
+Cc: linux-arm-kernel@lists.infradead.org
+Link: http://lore.kernel.org/lkml/20191021074808.25795-1-leo.yan@linaro.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/cs-etm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/util/cs-etm.c b/tools/perf/util/cs-etm.c
+index 4ba0f871f086..f5f855fff412 100644
+--- a/tools/perf/util/cs-etm.c
++++ b/tools/perf/util/cs-etm.c
+@@ -110,7 +110,7 @@ static int cs_etm__decode_data_block(struct cs_etm_queue *etmq);
+  * encode the etm queue number as the upper 16 bit and the channel as
+  * the lower 16 bit.
+  */
+-#define TO_CS_QUEUE_NR(queue_nr, trace_id_chan)	\
++#define TO_CS_QUEUE_NR(queue_nr, trace_chan_id)	\
+ 		      (queue_nr << 16 | trace_chan_id)
+ #define TO_QUEUE_NR(cs_queue_nr) (cs_queue_nr >> 16)
+ #define TO_TRACE_CHAN_ID(cs_queue_nr) (cs_queue_nr & 0x0000ffff)
+@@ -819,7 +819,7 @@ static int cs_etm__setup_queue(struct cs_etm_auxtrace *etm,
+ 	 * Note that packets decoded above are still in the traceID's packet
+ 	 * queue and will be processed in cs_etm__process_queues().
+ 	 */
+-	cs_queue_nr = TO_CS_QUEUE_NR(queue_nr, trace_id_chan);
++	cs_queue_nr = TO_CS_QUEUE_NR(queue_nr, trace_chan_id);
+ 	ret = auxtrace_heap__add(&etm->heap, cs_queue_nr, timestamp);
+ out:
+ 	return ret;
+-- 
+2.20.1
+
diff --git a/queue-5.4/perf-intel-bts-does-not-support-aux-area-sampling.patch b/queue-5.4/perf-intel-bts-does-not-support-aux-area-sampling.patch
new file mode 100644
index 00000000000..1d0a7b71a36
--- /dev/null
+++ b/queue-5.4/perf-intel-bts-does-not-support-aux-area-sampling.patch
@@ -0,0 +1,54 @@
+From dd0001c28ec58b829183c178c93c49d910a54065 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Nov 2019 14:42:25 +0200
+Subject: perf intel-bts: Does not support AUX area sampling
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+[ Upstream commit 32a1ece4bdbde24734ab16484bad7316f03fc42d ]
+
+Add an error message because Intel BTS does not support AUX area
+sampling.
+
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Link: http://lore.kernel.org/lkml/20191115124225.5247-16-adrian.hunter@intel.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/arch/x86/util/auxtrace.c  | 2 ++
+ tools/perf/arch/x86/util/intel-bts.c | 5 +++++
+ 2 files changed, 7 insertions(+)
+
+diff --git a/tools/perf/arch/x86/util/auxtrace.c b/tools/perf/arch/x86/util/auxtrace.c
+index 96f4a2c11893..61042114a5cc 100644
+--- a/tools/perf/arch/x86/util/auxtrace.c
++++ b/tools/perf/arch/x86/util/auxtrace.c
+@@ -27,6 +27,8 @@ struct auxtrace_record *auxtrace_record__init_intel(struct evlist *evlist,
+ 
+ 	intel_pt_pmu = perf_pmu__find(INTEL_PT_PMU_NAME);
+ 	intel_bts_pmu = perf_pmu__find(INTEL_BTS_PMU_NAME);
++	if (intel_bts_pmu)
++		intel_bts_pmu->auxtrace = true;
+ 
+ 	evlist__for_each_entry(evlist, evsel) {
+ 		if (intel_pt_pmu && evsel->core.attr.type == intel_pt_pmu->type)
+diff --git a/tools/perf/arch/x86/util/intel-bts.c b/tools/perf/arch/x86/util/intel-bts.c
+index f7f68a50a5cd..27d9e214d068 100644
+--- a/tools/perf/arch/x86/util/intel-bts.c
++++ b/tools/perf/arch/x86/util/intel-bts.c
+@@ -113,6 +113,11 @@ static int intel_bts_recording_options(struct auxtrace_record *itr,
+ 	const struct perf_cpu_map *cpus = evlist->core.cpus;
+ 	bool privileged = perf_event_paranoid_check(-1);
+ 
++	if (opts->auxtrace_sample_mode) {
++		pr_err("Intel BTS does not support AUX area sampling\n");
++		return -EINVAL;
++	}
++
+ 	btsr->evlist = evlist;
+ 	btsr->snapshot_mode = opts->auxtrace_snapshot_mode;
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/perf-jevents-fix-resource-leak-in-process_mapfile-an.patch b/queue-5.4/perf-jevents-fix-resource-leak-in-process_mapfile-an.patch
new file mode 100644
index 00000000000..f47216d9ef9
--- /dev/null
+++ b/queue-5.4/perf-jevents-fix-resource-leak-in-process_mapfile-an.patch
@@ -0,0 +1,107 @@
+From d0c893bd65901e6812196a18fdacf6f09a94a66d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Oct 2019 21:50:17 +0800
+Subject: perf jevents: Fix resource leak in process_mapfile() and main()
+
+From: Yunfeng Ye <yeyunfeng@huawei.com>
+
+[ Upstream commit 1785fbb73896dbd9d27a406f0d73047df42db710 ]
+
+There are memory leaks and file descriptor resource leaks in
+process_mapfile() and main().
+
+Fix this by adding free(), fclose() and free_arch_std_events() on the
+error paths.
+
+Fixes: 80eeb67fe577 ("perf jevents: Program to convert JSON file")
+Fixes: 3f056b66647b ("perf jevents: Make build fail on JSON parse error")
+Fixes: e9d32c1bf0cd ("perf vendor events: Add support for arch standard events")
+Signed-off-by: Yunfeng Ye <yeyunfeng@huawei.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Feilong Lin <linfeilong@huawei.com>
+Cc: Hu Shiyuan <hushiyuan@huawei.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: John Garry <john.garry@huawei.com>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Luke Mujica <lukemujica@google.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Zenghui Yu <yuzenghui@huawei.com>
+Link: http://lore.kernel.org/lkml/d7907042-ec9c-2bef-25b4-810e14602f89@huawei.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/pmu-events/jevents.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/pmu-events/jevents.c b/tools/perf/pmu-events/jevents.c
+index e2837260ca4d..99e3fd04a5cb 100644
+--- a/tools/perf/pmu-events/jevents.c
++++ b/tools/perf/pmu-events/jevents.c
+@@ -758,6 +758,7 @@ static int process_mapfile(FILE *outfp, char *fpath)
+ 	char *line, *p;
+ 	int line_num;
+ 	char *tblname;
++	int ret = 0;
+ 
+ 	pr_info("%s: Processing mapfile %s\n", prog, fpath);
+ 
+@@ -769,6 +770,7 @@ static int process_mapfile(FILE *outfp, char *fpath)
+ 	if (!mapfp) {
+ 		pr_info("%s: Error %s opening %s\n", prog, strerror(errno),
+ 				fpath);
++		free(line);
+ 		return -1;
+ 	}
+ 
+@@ -795,7 +797,8 @@ static int process_mapfile(FILE *outfp, char *fpath)
+ 			/* TODO Deal with lines longer than 16K */
+ 			pr_info("%s: Mapfile %s: line %d too long, aborting\n",
+ 					prog, fpath, line_num);
+-			return -1;
++			ret = -1;
++			goto out;
+ 		}
+ 		line[strlen(line)-1] = '\0';
+ 
+@@ -825,7 +828,9 @@ static int process_mapfile(FILE *outfp, char *fpath)
+ 
+ out:
+ 	print_mapping_table_suffix(outfp);
+-	return 0;
++	fclose(mapfp);
++	free(line);
++	return ret;
+ }
+ 
+ /*
+@@ -1122,6 +1127,7 @@ int main(int argc, char *argv[])
+ 		goto empty_map;
+ 	} else if (rc < 0) {
+ 		/* Make build fail */
++		fclose(eventsfp);
+ 		free_arch_std_events();
+ 		return 1;
+ 	} else if (rc) {
+@@ -1134,6 +1140,7 @@ int main(int argc, char *argv[])
+ 		goto empty_map;
+ 	} else if (rc < 0) {
+ 		/* Make build fail */
++		fclose(eventsfp);
+ 		free_arch_std_events();
+ 		return 1;
+ 	} else if (rc) {
+@@ -1151,6 +1158,8 @@ int main(int argc, char *argv[])
+ 	if (process_mapfile(eventsfp, mapfile)) {
+ 		pr_info("%s: Error processing mapfile %s\n", prog, mapfile);
+ 		/* Make build fail */
++		fclose(eventsfp);
++		free_arch_std_events();
+ 		return 1;
+ 	}
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/perf-parse-fix-potential-memory-leak-when-handling-t.patch b/queue-5.4/perf-parse-fix-potential-memory-leak-when-handling-t.patch
new file mode 100644
index 00000000000..0e0544ddf48
--- /dev/null
+++ b/queue-5.4/perf-parse-fix-potential-memory-leak-when-handling-t.patch
@@ -0,0 +1,85 @@
+From 41842cd4daff38b7edf87cba15d226ff565aabd8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Nov 2019 10:09:25 -0800
+Subject: perf parse: Fix potential memory leak when handling tracepoint errors
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 4584f084aa9d8033d5911935837dbee7b082d0e9 ]
+
+An error may be in place when tracepoint_error is called, use
+parse_events__handle_error to avoid a memory leak and to capture the
+first and last error. Error detected by LLVM's libFuzzer using the
+following event:
+
+$ perf stat -e 'msr/event/,f:e'
+event syntax error: 'msr/event/,f:e'
+                     \___ can't access trace events
+
+Error:  No permissions to read /sys/kernel/debug/tracing/events/f/e
+Hint:   Try 'sudo mount -o remount,mode=755 /sys/kernel/debug/tracing/'
+
+Initial error:
+event syntax error: 'msr/event/,f:e'
+                                \___ no value assigned for term
+Run 'perf list' for a list of valid events
+
+ Usage: perf stat [<options>] [<command>]
+
+    -e, --event <event>   event selector. use 'perf list' to list available events
+
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Jin Yao <yao.jin@linux.intel.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephane Eranian <eranian@google.com>
+Cc: clang-built-linux@googlegroups.com
+Link: http://lore.kernel.org/lkml/20191120180925.21787-1-irogers@google.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/parse-events.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c
+index 422ad1888e74..9a958ec5a096 100644
+--- a/tools/perf/util/parse-events.c
++++ b/tools/perf/util/parse-events.c
+@@ -480,6 +480,7 @@ int parse_events_add_cache(struct list_head *list, int *idx,
+ static void tracepoint_error(struct parse_events_error *e, int err,
+ 			     const char *sys, const char *name)
+ {
++	const char *str;
+ 	char help[BUFSIZ];
+ 
+ 	if (!e)
+@@ -493,18 +494,18 @@ static void tracepoint_error(struct parse_events_error *e, int err,
+ 
+ 	switch (err) {
+ 	case EACCES:
+-		e->str = strdup("can't access trace events");
++		str = "can't access trace events";
+ 		break;
+ 	case ENOENT:
+-		e->str = strdup("unknown tracepoint");
++		str = "unknown tracepoint";
+ 		break;
+ 	default:
+-		e->str = strdup("failed to add tracepoint");
++		str = "failed to add tracepoint";
+ 		break;
+ 	}
+ 
+ 	tracing_path__strerror_open_tp(err, help, sizeof(help), sys, name);
+-	e->help = strdup(help);
++	parse_events__handle_error(e, 0, strdup(str), strdup(help));
+ }
+ 
+ static int add_tracepoint(struct list_head *list, int *idx,
+-- 
+2.20.1
+
diff --git a/queue-5.4/perf-parse-if-pmu-configuration-fails-free-terms.patch b/queue-5.4/perf-parse-if-pmu-configuration-fails-free-terms.patch
new file mode 100644
index 00000000000..8c1f49c0165
--- /dev/null
+++ b/queue-5.4/perf-parse-if-pmu-configuration-fails-free-terms.patch
@@ -0,0 +1,62 @@
+From 51ff45d509aaf8bca86aa138a26100ff4b918394 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Oct 2019 15:34:46 -0700
+Subject: perf parse: If pmu configuration fails free terms
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 38f2c4226e6bc3e8c41c318242821ba5dc825aba ]
+
+Avoid a memory leak when the configuration fails.
+
+Signed-off-by: Ian Rogers <irogers@google.com>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Alexei Starovoitov <ast@kernel.org>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Daniel Borkmann <daniel@iogearbox.net>
+Cc: Jin Yao <yao.jin@linux.intel.com>
+Cc: John Garry <john.garry@huawei.com>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Martin KaFai Lau <kafai@fb.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Song Liu <songliubraving@fb.com>
+Cc: Stephane Eranian <eranian@google.com>
+Cc: Yonghong Song <yhs@fb.com>
+Cc: bpf@vger.kernel.org
+Cc: clang-built-linux@googlegroups.com
+Cc: netdev@vger.kernel.org
+Link: http://lore.kernel.org/lkml/20191030223448.12930-9-irogers@google.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/parse-events.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c
+index d5ea043d3fc4..422ad1888e74 100644
+--- a/tools/perf/util/parse-events.c
++++ b/tools/perf/util/parse-events.c
+@@ -1365,8 +1365,15 @@ int parse_events_add_pmu(struct parse_events_state *parse_state,
+ 	if (get_config_terms(head_config, &config_terms))
+ 		return -ENOMEM;
+ 
+-	if (perf_pmu__config(pmu, &attr, head_config, parse_state->error))
++	if (perf_pmu__config(pmu, &attr, head_config, parse_state->error)) {
++		struct perf_evsel_config_term *pos, *tmp;
++
++		list_for_each_entry_safe(pos, tmp, &config_terms, list) {
++			list_del_init(&pos->list);
++			free(pos);
++		}
+ 		return -EINVAL;
++	}
+ 
+ 	evsel = __add_event(list, &parse_state->idx, &attr,
+ 			    get_config_name(head_config), pmu,
+-- 
+2.20.1
+
diff --git a/queue-5.4/perf-probe-filter-out-instances-except-for-inlined-s.patch b/queue-5.4/perf-probe-filter-out-instances-except-for-inlined-s.patch
new file mode 100644
index 00000000000..00236404c80
--- /dev/null
+++ b/queue-5.4/perf-probe-filter-out-instances-except-for-inlined-s.patch
@@ -0,0 +1,122 @@
+From a2f04e663f7eff22bfe024f69620712821696779 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Oct 2019 16:09:30 +0900
+Subject: perf probe: Filter out instances except for inlined subroutine and
+ subprogram
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit da6cb952a89efe24bb76c4971370d485737a2d85 ]
+
+Filter out instances except for inlined_subroutine and subprogram DIE in
+die_walk_instances() and die_is_func_instance().
+
+This fixes an issue that perf probe sets some probes on calling address
+instead of a target function itself.
+
+When perf probe walks on instances of an abstruct origin (a kind of
+function prototype of inlined function), die_walk_instances() can also
+pass a GNU_call_site (a GNU extension for call site) to callback. Since
+it is not an inlined instance of target function, we have to filter out
+when searching a probe point.
+
+Without this patch, perf probe sets probes on call site address too.This
+can happen on some function which is marked "inlined", but has actual
+symbol. (I'm not sure why GCC mark it "inlined"):
+
+  # perf probe -D vfs_read
+  p:probe/vfs_read _text+2500017
+  p:probe/vfs_read_1 _text+2499468
+  p:probe/vfs_read_2 _text+2499563
+  p:probe/vfs_read_3 _text+2498876
+  p:probe/vfs_read_4 _text+2498512
+  p:probe/vfs_read_5 _text+2498627
+
+With this patch:
+
+Slightly different results, similar tho:
+
+  # perf probe -D vfs_read
+  p:probe/vfs_read _text+2498512
+
+Committer testing:
+
+  # uname -a
+  Linux quaco 5.3.8-200.fc30.x86_64 #1 SMP Tue Oct 29 14:46:22 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
+
+Before:
+
+  # perf probe -D vfs_read
+  p:probe/vfs_read _text+3131557
+  p:probe/vfs_read_1 _text+3130975
+  p:probe/vfs_read_2 _text+3131047
+  p:probe/vfs_read_3 _text+3130380
+  p:probe/vfs_read_4 _text+3130000
+  # uname -a
+  Linux quaco 5.3.8-200.fc30.x86_64 #1 SMP Tue Oct 29 14:46:22 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
+  #
+
+After:
+
+  # perf probe -D vfs_read
+  p:probe/vfs_read _text+3130000
+  #
+
+Fixes: db0d2c6420ee ("perf probe: Search concrete out-of-line instances")
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Link: http://lore.kernel.org/lkml/157241937063.32002.11024544873990816590.stgit@devnote2
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/dwarf-aux.c | 19 +++++++++++++------
+ 1 file changed, 13 insertions(+), 6 deletions(-)
+
+diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c
+index 0b604f8ab7c8..995607a7b4da 100644
+--- a/tools/perf/util/dwarf-aux.c
++++ b/tools/perf/util/dwarf-aux.c
+@@ -312,18 +312,22 @@ bool die_is_func_def(Dwarf_Die *dw_die)
+  * @dw_die: a DIE
+  *
+  * Ensure that this DIE is an instance (which has an entry address).
+- * This returns true if @dw_die is a function instance. If not, you need to
+- * call die_walk_instances() to find actual instances.
++ * This returns true if @dw_die is a function instance. If not, the @dw_die
++ * must be a prototype. You can use die_walk_instances() to find actual
++ * instances.
+  **/
+ bool die_is_func_instance(Dwarf_Die *dw_die)
+ {
+ 	Dwarf_Addr tmp;
+ 	Dwarf_Attribute attr_mem;
++	int tag = dwarf_tag(dw_die);
+ 
+-	/* Actually gcc optimizes non-inline as like as inlined */
+-	return !dwarf_func_inline(dw_die) &&
+-	       (dwarf_entrypc(dw_die, &tmp) == 0 ||
+-		dwarf_attr(dw_die, DW_AT_ranges, &attr_mem) != NULL);
++	if (tag != DW_TAG_subprogram &&
++	    tag != DW_TAG_inlined_subroutine)
++		return false;
++
++	return dwarf_entrypc(dw_die, &tmp) == 0 ||
++		dwarf_attr(dw_die, DW_AT_ranges, &attr_mem) != NULL;
+ }
+ 
+ /**
+@@ -602,6 +606,9 @@ static int __die_walk_instances_cb(Dwarf_Die *inst, void *data)
+ 	Dwarf_Die *origin;
+ 	int tmp;
+ 
++	if (!die_is_func_instance(inst))
++		return DIE_FIND_CB_CONTINUE;
++
+ 	attr = dwarf_attr(inst, DW_AT_abstract_origin, &attr_mem);
+ 	if (attr == NULL)
+ 		return DIE_FIND_CB_CONTINUE;
+-- 
+2.20.1
+
diff --git a/queue-5.4/perf-probe-fix-to-find-range-only-function-instance.patch b/queue-5.4/perf-probe-fix-to-find-range-only-function-instance.patch
new file mode 100644
index 00000000000..92aa444478a
--- /dev/null
+++ b/queue-5.4/perf-probe-fix-to-find-range-only-function-instance.patch
@@ -0,0 +1,50 @@
+From f18ca067eec1f481d59bac630ccb6e2fc89bf427 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Oct 2019 18:12:36 +0900
+Subject: perf probe: Fix to find range-only function instance
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit b77afa1f810f37bd8a36cb1318178dfe2d7af6b6 ]
+
+Fix die_is_func_instance() to find range-only function instance.
+
+In some case, a function instance can be made without any low PC or
+entry PC, but only with address ranges by optimization.  (e.g. cold text
+partially in "text.unlikely" section) To find such function instance, we
+have to check the range attribute too.
+
+Fixes: e1ecbbc3fa83 ("perf probe: Fix to handle optimized not-inlined functions")
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Link: http://lore.kernel.org/lkml/157190835669.1859.8368628035930950596.stgit@devnote2
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/dwarf-aux.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c
+index df6cee5c071f..2ec24c3bed44 100644
+--- a/tools/perf/util/dwarf-aux.c
++++ b/tools/perf/util/dwarf-aux.c
+@@ -318,10 +318,14 @@ bool die_is_func_def(Dwarf_Die *dw_die)
+ bool die_is_func_instance(Dwarf_Die *dw_die)
+ {
+ 	Dwarf_Addr tmp;
++	Dwarf_Attribute attr_mem;
+ 
+ 	/* Actually gcc optimizes non-inline as like as inlined */
+-	return !dwarf_func_inline(dw_die) && dwarf_entrypc(dw_die, &tmp) == 0;
++	return !dwarf_func_inline(dw_die) &&
++	       (dwarf_entrypc(dw_die, &tmp) == 0 ||
++		dwarf_attr(dw_die, DW_AT_ranges, &attr_mem) != NULL);
+ }
++
+ /**
+  * die_get_data_member_location - Get the data-member offset
+  * @mb_die: a DIE of a member of a data structure
+-- 
+2.20.1
+
diff --git a/queue-5.4/perf-probe-fix-to-list-probe-event-with-correct-line.patch b/queue-5.4/perf-probe-fix-to-list-probe-event-with-correct-line.patch
new file mode 100644
index 00000000000..3cf9e6137e5
--- /dev/null
+++ b/queue-5.4/perf-probe-fix-to-list-probe-event-with-correct-line.patch
@@ -0,0 +1,78 @@
+From f7c8350528d9182442e9d7ba42fd72afa5037803 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Oct 2019 17:46:52 +0900
+Subject: perf probe: Fix to list probe event with correct line number
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit 3895534dd78f0fd4d3f9e05ee52b9cdd444a743e ]
+
+Since debuginfo__find_probe_point() uses dwarf_entrypc() for finding the
+entry address of the function on which a probe is, it will fail when the
+function DIE has only ranges attribute.
+
+To fix this issue, use die_entrypc() instead of dwarf_entrypc().
+
+Without this fix, perf probe -l shows incorrect offset:
+
+  # perf probe -l
+    probe:clear_tasks_mm_cpumask (on clear_tasks_mm_cpumask+18446744071579263632@work/linux/linux/kernel/cpu.c)
+    probe:clear_tasks_mm_cpumask_1 (on clear_tasks_mm_cpumask+18446744071579263752@work/linux/linux/kernel/cpu.c)
+
+With this:
+
+  # perf probe -l
+    probe:clear_tasks_mm_cpumask (on clear_tasks_mm_cpumask@work/linux/linux/kernel/cpu.c)
+    probe:clear_tasks_mm_cpumask_1 (on clear_tasks_mm_cpumask:21@work/linux/linux/kernel/cpu.c)
+
+Committer testing:
+
+Before:
+
+  [root@quaco ~]# perf probe -l
+    probe:clear_tasks_mm_cpumask (on clear_tasks_mm_cpumask+18446744071579765152@kernel/cpu.c)
+  [root@quaco ~]#
+
+After:
+
+  [root@quaco ~]# perf probe -l
+    probe:clear_tasks_mm_cpumask (on clear_tasks_mm_cpumask@kernel/cpu.c)
+  [root@quaco ~]#
+
+Fixes: 1d46ea2a6a40 ("perf probe: Fix listing incorrect line number with inline function")
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Link: http://lore.kernel.org/lkml/157199321227.8075.14655572419136993015.stgit@devnote2
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/probe-finder.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c
+index cd9f95e5044e..7c8d30fb2b99 100644
+--- a/tools/perf/util/probe-finder.c
++++ b/tools/perf/util/probe-finder.c
+@@ -1578,7 +1578,7 @@ int debuginfo__find_probe_point(struct debuginfo *dbg, unsigned long addr,
+ 		/* Get function entry information */
+ 		func = basefunc = dwarf_diename(&spdie);
+ 		if (!func ||
+-		    dwarf_entrypc(&spdie, &baseaddr) != 0 ||
++		    die_entrypc(&spdie, &baseaddr) != 0 ||
+ 		    dwarf_decl_line(&spdie, &baseline) != 0) {
+ 			lineno = 0;
+ 			goto post;
+@@ -1595,7 +1595,7 @@ int debuginfo__find_probe_point(struct debuginfo *dbg, unsigned long addr,
+ 		while (die_find_top_inlinefunc(&spdie, (Dwarf_Addr)addr,
+ 						&indie)) {
+ 			/* There is an inline function */
+-			if (dwarf_entrypc(&indie, &_addr) == 0 &&
++			if (die_entrypc(&indie, &_addr) == 0 &&
+ 			    _addr == addr) {
+ 				/*
+ 				 * addr is at an inline function entry.
+-- 
+2.20.1
+
diff --git a/queue-5.4/perf-probe-fix-to-probe-a-function-which-has-no-entr.patch b/queue-5.4/perf-probe-fix-to-probe-a-function-which-has-no-entr.patch
new file mode 100644
index 00000000000..a15e4f283ff
--- /dev/null
+++ b/queue-5.4/perf-probe-fix-to-probe-a-function-which-has-no-entr.patch
@@ -0,0 +1,96 @@
+From 4ac298e63934dc5215436673141cec59f5852df8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Oct 2019 17:46:34 +0900
+Subject: perf probe: Fix to probe a function which has no entry pc
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit 5d16dbcc311d91267ddb45c6da4f187be320ecee ]
+
+Fix 'perf probe' to probe a function which has no entry pc or low pc but
+only has ranges attribute.
+
+probe_point_search_cb() uses dwarf_entrypc() to get the probe address,
+but that doesn't work for the function DIE which has only ranges
+attribute. Use die_entrypc() instead.
+
+Without this fix:
+
+  # perf probe -k ../build-x86_64/vmlinux -D clear_tasks_mm_cpumask:0
+  Probe point 'clear_tasks_mm_cpumask' not found.
+    Error: Failed to add events.
+
+With this:
+
+  # perf probe -k ../build-x86_64/vmlinux -D clear_tasks_mm_cpumask:0
+  p:probe/clear_tasks_mm_cpumask clear_tasks_mm_cpumask+0
+
+Committer testing:
+
+Before:
+
+  [root@quaco ~]# perf probe clear_tasks_mm_cpumask:0
+  Probe point 'clear_tasks_mm_cpumask' not found.
+    Error: Failed to add events.
+  [root@quaco ~]#
+
+After:
+
+  [root@quaco ~]# perf probe clear_tasks_mm_cpumask:0
+  Added new event:
+    probe:clear_tasks_mm_cpumask (on clear_tasks_mm_cpumask)
+
+  You can now use it in all perf tools, such as:
+
+  	perf record -e probe:clear_tasks_mm_cpumask -aR sleep 1
+
+  [root@quaco ~]#
+
+Using it with 'perf trace':
+
+  [root@quaco ~]# perf trace -e probe:clear_tasks_mm_cpumask
+
+Doesn't seem to be used in x86_64:
+
+  $ find . -name "*.c" | xargs grep clear_tasks_mm_cpumask
+  ./kernel/cpu.c: * clear_tasks_mm_cpumask - Safely clear tasks' mm_cpumask for a CPU
+  ./kernel/cpu.c:void clear_tasks_mm_cpumask(int cpu)
+  ./arch/xtensa/kernel/smp.c:	clear_tasks_mm_cpumask(cpu);
+  ./arch/csky/kernel/smp.c:	clear_tasks_mm_cpumask(cpu);
+  ./arch/sh/kernel/smp.c:	clear_tasks_mm_cpumask(cpu);
+  ./arch/arm/kernel/smp.c:	clear_tasks_mm_cpumask(cpu);
+  ./arch/powerpc/mm/nohash/mmu_context.c:	clear_tasks_mm_cpumask(cpu);
+  $ find . -name "*.h" | xargs grep clear_tasks_mm_cpumask
+  ./include/linux/cpu.h:void clear_tasks_mm_cpumask(int cpu);
+  $ find . -name "*.S" | xargs grep clear_tasks_mm_cpumask
+  $
+
+Fixes: e1ecbbc3fa83 ("perf probe: Fix to handle optimized not-inlined functions")
+Reported-by: Arnaldo Carvalho de Melo <acme@kernel.org>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Link: http://lore.kernel.org/lkml/157199319438.8075.4695576954550638618.stgit@devnote2
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/probe-finder.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c
+index 7857ae7a10b7..4079ed617f53 100644
+--- a/tools/perf/util/probe-finder.c
++++ b/tools/perf/util/probe-finder.c
+@@ -994,7 +994,7 @@ static int probe_point_search_cb(Dwarf_Die *sp_die, void *data)
+ 		param->retval = find_probe_point_by_line(pf);
+ 	} else if (die_is_func_instance(sp_die)) {
+ 		/* Instances always have the entry address */
+-		dwarf_entrypc(sp_die, &pf->addr);
++		die_entrypc(sp_die, &pf->addr);
+ 		/* But in some case the entry address is 0 */
+ 		if (pf->addr == 0) {
+ 			pr_debug("%s has no entry PC. Skipped\n",
+-- 
+2.20.1
+
diff --git a/queue-5.4/perf-probe-fix-to-probe-an-inline-function-which-has.patch b/queue-5.4/perf-probe-fix-to-probe-an-inline-function-which-has.patch
new file mode 100644
index 00000000000..7668bd5a365
--- /dev/null
+++ b/queue-5.4/perf-probe-fix-to-probe-an-inline-function-which-has.patch
@@ -0,0 +1,72 @@
+From accc0289d444c86221ad578804f044acc7d16817 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Oct 2019 17:46:43 +0900
+Subject: perf probe: Fix to probe an inline function which has no entry pc
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit eb6933b29d20bf2c3053883d409a53f462c1a3ac ]
+
+Fix perf probe to probe an inlne function which has no entry pc
+or low pc but only has ranges attribute.
+
+This seems very rare case, but I could find a few examples, as
+same as probe_point_search_cb(), use die_entrypc() to get the
+entry address in probe_point_inline_cb() too.
+
+Without this patch:
+
+  # perf probe -D __amd_put_nb_event_constraints
+  Failed to get entry address of __amd_put_nb_event_constraints.
+  Probe point '__amd_put_nb_event_constraints' not found.
+    Error: Failed to add events.
+
+With this patch:
+
+  # perf probe -D __amd_put_nb_event_constraints
+  p:probe/__amd_put_nb_event_constraints amd_put_event_constraints+43
+
+Committer testing:
+
+Before:
+
+  [root@quaco ~]# perf probe -D __amd_put_nb_event_constraints
+  Failed to get entry address of __amd_put_nb_event_constraints.
+  Probe point '__amd_put_nb_event_constraints' not found.
+    Error: Failed to add events.
+  [root@quaco ~]#
+
+After:
+
+  [root@quaco ~]# perf probe -D __amd_put_nb_event_constraints
+  p:probe/__amd_put_nb_event_constraints _text+33789
+  [root@quaco ~]#
+
+Fixes: 4ea42b181434 ("perf: Add perf probe subcommand, a kprobe-event setup helper")
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Link: http://lore.kernel.org/lkml/157199320336.8075.16189530425277588587.stgit@devnote2
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/probe-finder.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c
+index 7c8d30fb2b99..7857ae7a10b7 100644
+--- a/tools/perf/util/probe-finder.c
++++ b/tools/perf/util/probe-finder.c
+@@ -942,7 +942,7 @@ static int probe_point_inline_cb(Dwarf_Die *in_die, void *data)
+ 		ret = find_probe_point_lazy(in_die, pf);
+ 	else {
+ 		/* Get probe address */
+-		if (dwarf_entrypc(in_die, &addr) != 0) {
++		if (die_entrypc(in_die, &addr) != 0) {
+ 			pr_warning("Failed to get entry address of %s.\n",
+ 				   dwarf_diename(in_die));
+ 			return -ENOENT;
+-- 
+2.20.1
+
diff --git a/queue-5.4/perf-probe-fix-to-show-calling-lines-of-inlined-func.patch b/queue-5.4/perf-probe-fix-to-show-calling-lines-of-inlined-func.patch
new file mode 100644
index 00000000000..b4698fa6d1a
--- /dev/null
+++ b/queue-5.4/perf-probe-fix-to-show-calling-lines-of-inlined-func.patch
@@ -0,0 +1,122 @@
+From 4c35fe8ae3c5a6ac96c7af296754e76093defbd8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Oct 2019 16:09:40 +0900
+Subject: perf probe: Fix to show calling lines of inlined functions
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit 86c0bf8539e7f46d91bd105e55eda96e0064caef ]
+
+Fix to show calling lines of inlined functions (where an inline function
+is called).
+
+die_walk_lines() filtered out the lines inside inlined functions based
+on the address. However this also filtered out the lines which call
+those inlined functions from the target function.
+
+To solve this issue, check the call_file and call_line attributes and do
+not filter out if it matches to the line information.
+
+Without this fix, perf probe -L doesn't show some lines correctly.
+(don't see the lines after 17)
+
+  # perf probe -L vfs_read
+  <vfs_read@/home/mhiramat/ksrc/linux/fs/read_write.c:0>
+        0  ssize_t vfs_read(struct file *file, char __user *buf, size_t count, loff_t *pos)
+        1  {
+        2         ssize_t ret;
+
+        4         if (!(file->f_mode & FMODE_READ))
+                          return -EBADF;
+        6         if (!(file->f_mode & FMODE_CAN_READ))
+                          return -EINVAL;
+        8         if (unlikely(!access_ok(buf, count)))
+                          return -EFAULT;
+
+       11         ret = rw_verify_area(READ, file, pos, count);
+       12         if (!ret) {
+       13                 if (count > MAX_RW_COUNT)
+                                  count =  MAX_RW_COUNT;
+       15                 ret = __vfs_read(file, buf, count, pos);
+       16                 if (ret > 0) {
+                                  fsnotify_access(file);
+                                  add_rchar(current, ret);
+                          }
+
+With this fix:
+
+  # perf probe -L vfs_read
+  <vfs_read@/home/mhiramat/ksrc/linux/fs/read_write.c:0>
+        0  ssize_t vfs_read(struct file *file, char __user *buf, size_t count, loff_t *pos)
+        1  {
+        2         ssize_t ret;
+
+        4         if (!(file->f_mode & FMODE_READ))
+                          return -EBADF;
+        6         if (!(file->f_mode & FMODE_CAN_READ))
+                          return -EINVAL;
+        8         if (unlikely(!access_ok(buf, count)))
+                          return -EFAULT;
+
+       11         ret = rw_verify_area(READ, file, pos, count);
+       12         if (!ret) {
+       13                 if (count > MAX_RW_COUNT)
+                                  count =  MAX_RW_COUNT;
+       15                 ret = __vfs_read(file, buf, count, pos);
+       16                 if (ret > 0) {
+       17                         fsnotify_access(file);
+       18                         add_rchar(current, ret);
+                          }
+       20                 inc_syscr(current);
+                  }
+
+Fixes: 4cc9cec636e7 ("perf probe: Introduce lines walker interface")
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Link: http://lore.kernel.org/lkml/157241937995.32002.17899884017011512577.stgit@devnote2
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/dwarf-aux.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c
+index 08aba015e072..2b718cfd62d9 100644
+--- a/tools/perf/util/dwarf-aux.c
++++ b/tools/perf/util/dwarf-aux.c
+@@ -755,7 +755,7 @@ int die_walk_lines(Dwarf_Die *rt_die, line_walk_callback_t callback, void *data)
+ 	Dwarf_Lines *lines;
+ 	Dwarf_Line *line;
+ 	Dwarf_Addr addr;
+-	const char *fname, *decf = NULL;
++	const char *fname, *decf = NULL, *inf = NULL;
+ 	int lineno, ret = 0;
+ 	int decl = 0, inl;
+ 	Dwarf_Die die_mem, *cu_die;
+@@ -799,13 +799,21 @@ int die_walk_lines(Dwarf_Die *rt_die, line_walk_callback_t callback, void *data)
+ 			 */
+ 			if (!dwarf_haspc(rt_die, addr))
+ 				continue;
++
+ 			if (die_find_inlinefunc(rt_die, addr, &die_mem)) {
++				/* Call-site check */
++				inf = die_get_call_file(&die_mem);
++				if ((inf && !strcmp(inf, decf)) &&
++				    die_get_call_lineno(&die_mem) == lineno)
++					goto found;
++
+ 				dwarf_decl_line(&die_mem, &inl);
+ 				if (inl != decl ||
+ 				    decf != dwarf_decl_file(&die_mem))
+ 					continue;
+ 			}
+ 		}
++found:
+ 		/* Get source line */
+ 		fname = dwarf_linesrc(line, NULL, NULL);
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/perf-probe-fix-to-show-inlined-function-callsite-wit.patch b/queue-5.4/perf-probe-fix-to-show-inlined-function-callsite-wit.patch
new file mode 100644
index 00000000000..940b83da29b
--- /dev/null
+++ b/queue-5.4/perf-probe-fix-to-show-inlined-function-callsite-wit.patch
@@ -0,0 +1,112 @@
+From ca0ebbbf29ba9f689871a789c36cac1abf824650 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Oct 2019 17:47:01 +0900
+Subject: perf probe: Fix to show inlined function callsite without entry_pc
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit 18e21eb671dc87a4f0546ba505a89ea93598a634 ]
+
+Fix 'perf probe --line' option to show inlined function callsite lines
+even if the function DIE has only ranges.
+
+Without this:
+
+  # perf probe -L amd_put_event_constraints
+  ...
+      2  {
+      3         if (amd_has_nb(cpuc) && amd_is_nb_event(&event->hw))
+                        __amd_put_nb_event_constraints(cpuc, event);
+      5  }
+
+With this patch:
+
+  # perf probe -L amd_put_event_constraints
+  ...
+      2  {
+      3         if (amd_has_nb(cpuc) && amd_is_nb_event(&event->hw))
+      4                 __amd_put_nb_event_constraints(cpuc, event);
+      5  }
+
+Committer testing:
+
+Before:
+
+  [root@quaco ~]# perf probe -L amd_put_event_constraints
+  <amd_put_event_constraints@/usr/src/debug/kernel-5.2.fc30/linux-5.2.18-200.fc30.x86_64/arch/x86/events/amd/core.c:0>
+        0  static void amd_put_event_constraints(struct cpu_hw_events *cpuc,
+                                                struct perf_event *event)
+        2  {
+        3         if (amd_has_nb(cpuc) && amd_is_nb_event(&event->hw))
+                          __amd_put_nb_event_constraints(cpuc, event);
+        5  }
+
+           PMU_FORMAT_ATTR(event, "config:0-7,32-35");
+           PMU_FORMAT_ATTR(umask, "config:8-15"   );
+
+  [root@quaco ~]#
+
+After:
+
+  [root@quaco ~]# perf probe -L amd_put_event_constraints
+  <amd_put_event_constraints@/usr/src/debug/kernel-5.2.fc30/linux-5.2.18-200.fc30.x86_64/arch/x86/events/amd/core.c:0>
+        0  static void amd_put_event_constraints(struct cpu_hw_events *cpuc,
+                                                struct perf_event *event)
+        2  {
+        3         if (amd_has_nb(cpuc) && amd_is_nb_event(&event->hw))
+        4                 __amd_put_nb_event_constraints(cpuc, event);
+        5  }
+
+           PMU_FORMAT_ATTR(event, "config:0-7,32-35");
+           PMU_FORMAT_ATTR(umask, "config:8-15"   );
+
+  [root@quaco ~]# perf probe amd_put_event_constraints:4
+  Added new event:
+    probe:amd_put_event_constraints (on amd_put_event_constraints:4)
+
+  You can now use it in all perf tools, such as:
+
+  	perf record -e probe:amd_put_event_constraints -aR sleep 1
+
+  [root@quaco ~]#
+
+  [root@quaco ~]# perf probe -l
+    probe:amd_put_event_constraints (on amd_put_event_constraints:4@arch/x86/events/amd/core.c)
+    probe:clear_tasks_mm_cpumask (on clear_tasks_mm_cpumask@kernel/cpu.c)
+  [root@quaco ~]#
+
+Using it:
+
+  [root@quaco ~]# perf trace -e probe:*
+  ^C[root@quaco ~]#
+
+Ok, Intel system here... :-)
+
+Fixes: 4cc9cec636e7 ("perf probe: Introduce lines walker interface")
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Link: http://lore.kernel.org/lkml/157199322107.8075.12659099000567865708.stgit@devnote2
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/dwarf-aux.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c
+index 4b1890204e99..08aba015e072 100644
+--- a/tools/perf/util/dwarf-aux.c
++++ b/tools/perf/util/dwarf-aux.c
+@@ -673,7 +673,7 @@ static int __die_walk_funclines_cb(Dwarf_Die *in_die, void *data)
+ 	if (dwarf_tag(in_die) == DW_TAG_inlined_subroutine) {
+ 		fname = die_get_call_file(in_die);
+ 		lineno = die_get_call_lineno(in_die);
+-		if (fname && lineno > 0 && dwarf_entrypc(in_die, &addr) == 0) {
++		if (fname && lineno > 0 && die_entrypc(in_die, &addr) == 0) {
+ 			lw->retval = lw->callback(fname, lineno, addr, lw->data);
+ 			if (lw->retval != 0)
+ 				return DIE_FIND_CB_END;
+-- 
+2.20.1
+
diff --git a/queue-5.4/perf-probe-fix-to-show-ranges-of-variables-in-functi.patch b/queue-5.4/perf-probe-fix-to-show-ranges-of-variables-in-functi.patch
new file mode 100644
index 00000000000..427b3e6b94c
--- /dev/null
+++ b/queue-5.4/perf-probe-fix-to-show-ranges-of-variables-in-functi.patch
@@ -0,0 +1,98 @@
+From 8add7dd664c4fcd50e0526b196ce3fae945e8b60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Oct 2019 17:47:10 +0900
+Subject: perf probe: Fix to show ranges of variables in functions without
+ entry_pc
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit af04dd2f8ebaa8fbd46f698714acbf43da14da45 ]
+
+Fix to show ranges of variables (--range and --vars option) in functions
+which DIE has only ranges but no entry_pc attribute.
+
+Without this fix:
+
+  # perf probe --range -V clear_tasks_mm_cpumask
+  Available variables at clear_tasks_mm_cpumask
+  	@<clear_tasks_mm_cpumask+0>
+  		(No matched variables)
+
+With this fix:
+
+  # perf probe --range -V clear_tasks_mm_cpumask
+  Available variables at clear_tasks_mm_cpumask
+	@<clear_tasks_mm_cpumask+0>
+		[VAL]	int	cpu	@<clear_tasks_mm_cpumask+[0-35,317-317,2052-2059]>
+
+Committer testing:
+
+Before:
+
+  [root@quaco ~]# perf probe --range -V clear_tasks_mm_cpumask
+  Available variables at clear_tasks_mm_cpumask
+          @<clear_tasks_mm_cpumask+0>
+                  (No matched variables)
+  [root@quaco ~]#
+
+After:
+
+  [root@quaco ~]# perf probe --range -V clear_tasks_mm_cpumask
+  Available variables at clear_tasks_mm_cpumask
+          @<clear_tasks_mm_cpumask+0>
+                  [VAL]   int     cpu     @<clear_tasks_mm_cpumask+[0-23,23-105,105-106,106-106,1843-1850,1850-1862]>
+  [root@quaco ~]#
+
+Using it:
+
+  [root@quaco ~]# perf probe clear_tasks_mm_cpumask cpu
+  Added new event:
+    probe:clear_tasks_mm_cpumask (on clear_tasks_mm_cpumask with cpu)
+
+  You can now use it in all perf tools, such as:
+
+  	perf record -e probe:clear_tasks_mm_cpumask -aR sleep 1
+
+  [root@quaco ~]# perf probe -l
+    probe:clear_tasks_mm_cpumask (on clear_tasks_mm_cpumask@kernel/cpu.c with cpu)
+  [root@quaco ~]#
+  [root@quaco ~]# perf trace -e probe:*cpumask
+  ^C[root@quaco ~]#
+
+Fixes: 349e8d261131 ("perf probe: Add --range option to show a variable's location range")
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Link: http://lore.kernel.org/lkml/157199323018.8075.8179744380479673672.stgit@devnote2
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/dwarf-aux.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c
+index 929b7c0567f4..4b1890204e99 100644
+--- a/tools/perf/util/dwarf-aux.c
++++ b/tools/perf/util/dwarf-aux.c
+@@ -997,7 +997,7 @@ static int die_get_var_innermost_scope(Dwarf_Die *sp_die, Dwarf_Die *vr_die,
+ 	bool first = true;
+ 	const char *name;
+ 
+-	ret = dwarf_entrypc(sp_die, &entry);
++	ret = die_entrypc(sp_die, &entry);
+ 	if (ret)
+ 		return ret;
+ 
+@@ -1060,7 +1060,7 @@ int die_get_var_range(Dwarf_Die *sp_die, Dwarf_Die *vr_die, struct strbuf *buf)
+ 	bool first = true;
+ 	const char *name;
+ 
+-	ret = dwarf_entrypc(sp_die, &entry);
++	ret = die_entrypc(sp_die, &entry);
+ 	if (ret)
+ 		return ret;
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/perf-probe-return-a-better-scope-die-if-there-is-no-.patch b/queue-5.4/perf-probe-return-a-better-scope-die-if-there-is-no-.patch
new file mode 100644
index 00000000000..c62aeb5f0aa
--- /dev/null
+++ b/queue-5.4/perf-probe-return-a-better-scope-die-if-there-is-no-.patch
@@ -0,0 +1,84 @@
+From d62d3a7be5b6abdc011009bba0c6771a557ec0cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Nov 2019 09:16:49 +0900
+Subject: perf probe: Return a better scope DIE if there is no best scope
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit c701636aeec4c173208697d68da6e4271125564b ]
+
+Make find_best_scope() returns innermost DIE at given address if there
+is no best matched scope DIE. Since Gcc sometimes generates intuitively
+strange line info which is out of inlined function address range, we
+need this fixup.
+
+Without this, sometimes perf probe failed to probe on a line inside an
+inlined function:
+
+  # perf probe -D ksys_open:3
+  Failed to find scope of probe point.
+    Error: Failed to add events.
+
+With this fix, 'perf probe' can probe it:
+
+  # perf probe -D ksys_open:3
+  p:probe/ksys_open _text+25707308
+  p:probe/ksys_open_1 _text+25710596
+  p:probe/ksys_open_2 _text+25711114
+  p:probe/ksys_open_3 _text+25711343
+  p:probe/ksys_open_4 _text+25714058
+  p:probe/ksys_open_5 _text+2819653
+  p:probe/ksys_open_6 _text+2819701
+
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
+Cc: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Cc: Tom Zanussi <tom.zanussi@linux.intel.com>
+Link: http://lore.kernel.org/lkml/157291300887.19771.14936015360963292236.stgit@devnote2
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/probe-finder.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c
+index e4ef8f4935b2..08cccd86447c 100644
+--- a/tools/perf/util/probe-finder.c
++++ b/tools/perf/util/probe-finder.c
+@@ -756,6 +756,16 @@ static int find_best_scope_cb(Dwarf_Die *fn_die, void *data)
+ 	return 0;
+ }
+ 
++/* Return innermost DIE */
++static int find_inner_scope_cb(Dwarf_Die *fn_die, void *data)
++{
++	struct find_scope_param *fsp = data;
++
++	memcpy(fsp->die_mem, fn_die, sizeof(Dwarf_Die));
++	fsp->found = true;
++	return 1;
++}
++
+ /* Find an appropriate scope fits to given conditions */
+ static Dwarf_Die *find_best_scope(struct probe_finder *pf, Dwarf_Die *die_mem)
+ {
+@@ -767,8 +777,13 @@ static Dwarf_Die *find_best_scope(struct probe_finder *pf, Dwarf_Die *die_mem)
+ 		.die_mem = die_mem,
+ 		.found = false,
+ 	};
++	int ret;
+ 
+-	cu_walk_functions_at(&pf->cu_die, pf->addr, find_best_scope_cb, &fsp);
++	ret = cu_walk_functions_at(&pf->cu_die, pf->addr, find_best_scope_cb,
++				   &fsp);
++	if (!ret && !fsp.found)
++		cu_walk_functions_at(&pf->cu_die, pf->addr,
++				     find_inner_scope_cb, &fsp);
+ 
+ 	return fsp.found ? die_mem : NULL;
+ }
+-- 
+2.20.1
+
diff --git a/queue-5.4/perf-probe-skip-end-of-sequence-and-non-statement-li.patch b/queue-5.4/perf-probe-skip-end-of-sequence-and-non-statement-li.patch
new file mode 100644
index 00000000000..6dc3580eca0
--- /dev/null
+++ b/queue-5.4/perf-probe-skip-end-of-sequence-and-non-statement-li.patch
@@ -0,0 +1,145 @@
+From 0fea6e9fc70be2f5ddc11738f884becc8e074b9a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Oct 2019 16:09:21 +0900
+Subject: perf probe: Skip end-of-sequence and non statement lines
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit f4d99bdfd124823a81878b44b5e8750b97f73902 ]
+
+Skip end-of-sequence and non-statement lines while walking through lines
+list.
+
+The "end-of-sequence" line information means:
+
+ "the current address is that of the first byte after the
+  end of a sequence of target machine instructions."
+ (DWARF version 4 spec 6.2.2)
+
+This actually means out of scope and we can not probe on it.
+
+On the other hand, the statement lines (is_stmt) means:
+
+ "the current instruction is a recommended breakpoint location.
+  A recommended breakpoint location is intended to “represent”
+  a line, a statement and/or a semantically distinct subpart
+  of a statement."
+
+ (DWARF version 4 spec 6.2.2)
+
+So, non-statement line info also should be skipped.
+
+These can reduce unneeded probe points and also avoid an error.
+
+E.g. without this patch:
+
+  # perf probe -a "clear_tasks_mm_cpumask:1"
+  Added new events:
+    probe:clear_tasks_mm_cpumask (on clear_tasks_mm_cpumask:1)
+    probe:clear_tasks_mm_cpumask_1 (on clear_tasks_mm_cpumask:1)
+    probe:clear_tasks_mm_cpumask_2 (on clear_tasks_mm_cpumask:1)
+    probe:clear_tasks_mm_cpumask_3 (on clear_tasks_mm_cpumask:1)
+    probe:clear_tasks_mm_cpumask_4 (on clear_tasks_mm_cpumask:1)
+
+  You can now use it in all perf tools, such as:
+
+  	perf record -e probe:clear_tasks_mm_cpumask_4 -aR sleep 1
+
+  #
+
+This puts 5 probes on one line, but acutally it's not inlined function.
+This is because there are many non statement instructions at the
+function prologue.
+
+With this patch:
+
+  # perf probe -a "clear_tasks_mm_cpumask:1"
+  Added new event:
+    probe:clear_tasks_mm_cpumask (on clear_tasks_mm_cpumask:1)
+
+  You can now use it in all perf tools, such as:
+
+  	perf record -e probe:clear_tasks_mm_cpumask -aR sleep 1
+
+  #
+
+Now perf-probe skips unneeded addresses.
+
+Committer testing:
+
+Slightly different results, but similar:
+
+Before:
+
+  # uname -a
+  Linux quaco 5.3.8-200.fc30.x86_64 #1 SMP Tue Oct 29 14:46:22 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
+  #
+  # perf probe -a "clear_tasks_mm_cpumask:1"
+  Added new events:
+    probe:clear_tasks_mm_cpumask (on clear_tasks_mm_cpumask:1)
+    probe:clear_tasks_mm_cpumask_1 (on clear_tasks_mm_cpumask:1)
+    probe:clear_tasks_mm_cpumask_2 (on clear_tasks_mm_cpumask:1)
+
+  You can now use it in all perf tools, such as:
+
+  	perf record -e probe:clear_tasks_mm_cpumask_2 -aR sleep 1
+
+  #
+
+After:
+
+  # perf probe -a "clear_tasks_mm_cpumask:1"
+  Added new event:
+    probe:clear_tasks_mm_cpumask (on clear_tasks_mm_cpumask:1)
+
+  You can now use it in all perf tools, such as:
+
+  	perf record -e probe:clear_tasks_mm_cpumask -aR sleep 1
+
+  # perf probe -l
+    probe:clear_tasks_mm_cpumask (on clear_tasks_mm_cpumask@kernel/cpu.c)
+  #
+
+Fixes: 4cc9cec636e7 ("perf probe: Introduce lines walker interface")
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Link: http://lore.kernel.org/lkml/157241936090.32002.12156347518596111660.stgit@devnote2
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/dwarf-aux.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c
+index 2b718cfd62d9..0b604f8ab7c8 100644
+--- a/tools/perf/util/dwarf-aux.c
++++ b/tools/perf/util/dwarf-aux.c
+@@ -760,6 +760,7 @@ int die_walk_lines(Dwarf_Die *rt_die, line_walk_callback_t callback, void *data)
+ 	int decl = 0, inl;
+ 	Dwarf_Die die_mem, *cu_die;
+ 	size_t nlines, i;
++	bool flag;
+ 
+ 	/* Get the CU die */
+ 	if (dwarf_tag(rt_die) != DW_TAG_compile_unit) {
+@@ -790,6 +791,12 @@ int die_walk_lines(Dwarf_Die *rt_die, line_walk_callback_t callback, void *data)
+ 				  "Possible error in debuginfo.\n");
+ 			continue;
+ 		}
++		/* Skip end-of-sequence */
++		if (dwarf_lineendsequence(line, &flag) != 0 || flag)
++			continue;
++		/* Skip Non statement line-info */
++		if (dwarf_linebeginstatement(line, &flag) != 0 || !flag)
++			continue;
+ 		/* Filter lines based on address */
+ 		if (rt_die != cu_die) {
+ 			/*
+-- 
+2.20.1
+
diff --git a/queue-5.4/perf-probe-skip-overlapped-location-on-searching-var.patch b/queue-5.4/perf-probe-skip-overlapped-location-on-searching-var.patch
new file mode 100644
index 00000000000..8ce8c15ce7e
--- /dev/null
+++ b/queue-5.4/perf-probe-skip-overlapped-location-on-searching-var.patch
@@ -0,0 +1,104 @@
+From 72bb73a1728c62b78c12fd3418da51a4df4ba0c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Oct 2019 16:09:49 +0900
+Subject: perf probe: Skip overlapped location on searching variables
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit dee36a2abb67c175265d49b9a8c7dfa564463d9a ]
+
+Since debuginfo__find_probes() callback function can be called with  the
+location which already passed, the callback function must filter out
+such overlapped locations.
+
+add_probe_trace_event() has already done it by commit 1a375ae7659a
+("perf probe: Skip same probe address for a given line"), but
+add_available_vars() doesn't. Thus perf probe -v shows same address
+repeatedly as below:
+
+  # perf probe -V vfs_read:18
+  Available variables at vfs_read:18
+          @<vfs_read+217>
+                  char*   buf
+                  loff_t* pos
+                  ssize_t ret
+                  struct file*    file
+          @<vfs_read+217>
+                  char*   buf
+                  loff_t* pos
+                  ssize_t ret
+                  struct file*    file
+          @<vfs_read+226>
+                  char*   buf
+                  loff_t* pos
+                  ssize_t ret
+                  struct file*    file
+
+With this fix, perf probe -V shows it correctly:
+
+  # perf probe -V vfs_read:18
+  Available variables at vfs_read:18
+          @<vfs_read+217>
+                  char*   buf
+                  loff_t* pos
+                  ssize_t ret
+                  struct file*    file
+          @<vfs_read+226>
+                  char*   buf
+                  loff_t* pos
+                  ssize_t ret
+                  struct file*    file
+
+Fixes: cf6eb489e5c0 ("perf probe: Show accessible local variables")
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Link: http://lore.kernel.org/lkml/157241938927.32002.4026859017790562751.stgit@devnote2
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/probe-finder.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c
+index 4079ed617f53..e4ef8f4935b2 100644
+--- a/tools/perf/util/probe-finder.c
++++ b/tools/perf/util/probe-finder.c
+@@ -1425,6 +1425,18 @@ error:
+ 	return DIE_FIND_CB_END;
+ }
+ 
++static bool available_var_finder_overlap(struct available_var_finder *af)
++{
++	int i;
++
++	for (i = 0; i < af->nvls; i++) {
++		if (af->pf.addr == af->vls[i].point.address)
++			return true;
++	}
++	return false;
++
++}
++
+ /* Add a found vars into available variables list */
+ static int add_available_vars(Dwarf_Die *sc_die, struct probe_finder *pf)
+ {
+@@ -1435,6 +1447,14 @@ static int add_available_vars(Dwarf_Die *sc_die, struct probe_finder *pf)
+ 	Dwarf_Die die_mem;
+ 	int ret;
+ 
++	/*
++	 * For some reason (e.g. different column assigned to same address),
++	 * this callback can be called with the address which already passed.
++	 * Ignore it first.
++	 */
++	if (available_var_finder_overlap(af))
++		return 0;
++
+ 	/* Check number of tevs */
+ 	if (af->nvls == af->max_vls) {
+ 		pr_warning("Too many( > %d) probe point found.\n", af->max_vls);
+-- 
+2.20.1
+
diff --git a/queue-5.4/perf-probe-walk-function-lines-in-lexical-blocks.patch b/queue-5.4/perf-probe-walk-function-lines-in-lexical-blocks.patch
new file mode 100644
index 00000000000..b1926d36436
--- /dev/null
+++ b/queue-5.4/perf-probe-walk-function-lines-in-lexical-blocks.patch
@@ -0,0 +1,76 @@
+From 30b02aa38e96261f935085b78da896dddeb15898 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Oct 2019 18:12:45 +0900
+Subject: perf probe: Walk function lines in lexical blocks
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit acb6a7047ac2146b723fef69ee1ab6b7143546bf ]
+
+Since some inlined functions are in lexical blocks of given function, we
+have to recursively walk through the DIE tree.  Without this fix,
+perf-probe -L can miss the inlined functions which is in a lexical block
+(like if (..) { func() } case.)
+
+However, even though, to walk the lines in a given function, we don't
+need to follow the children DIE of inlined functions because those do
+not have any lines in the specified function.
+
+We need to walk though whole trees only if we walk all lines in a given
+file, because an inlined function can include another inlined function
+in the same file.
+
+Fixes: b0e9cb2802d4 ("perf probe: Fix to search nested inlined functions in CU")
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Link: http://lore.kernel.org/lkml/157190836514.1859.15996864849678136353.stgit@devnote2
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/dwarf-aux.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c
+index 2ec24c3bed44..929b7c0567f4 100644
+--- a/tools/perf/util/dwarf-aux.c
++++ b/tools/perf/util/dwarf-aux.c
+@@ -678,10 +678,9 @@ static int __die_walk_funclines_cb(Dwarf_Die *in_die, void *data)
+ 			if (lw->retval != 0)
+ 				return DIE_FIND_CB_END;
+ 		}
++		if (!lw->recursive)
++			return DIE_FIND_CB_SIBLING;
+ 	}
+-	if (!lw->recursive)
+-		/* Don't need to search recursively */
+-		return DIE_FIND_CB_SIBLING;
+ 
+ 	if (addr) {
+ 		fname = dwarf_decl_file(in_die);
+@@ -728,6 +727,10 @@ static int __die_walk_culines_cb(Dwarf_Die *sp_die, void *data)
+ {
+ 	struct __line_walk_param *lw = data;
+ 
++	/*
++	 * Since inlined function can include another inlined function in
++	 * the same file, we need to walk in it recursively.
++	 */
+ 	lw->retval = __die_walk_funclines(sp_die, true, lw->callback, lw->data);
+ 	if (lw->retval != 0)
+ 		return DWARF_CB_ABORT;
+@@ -817,8 +820,9 @@ int die_walk_lines(Dwarf_Die *rt_die, line_walk_callback_t callback, void *data)
+ 	 */
+ 	if (rt_die != cu_die)
+ 		/*
+-		 * Don't need walk functions recursively, because nested
+-		 * inlined functions don't have lines of the specified DIE.
++		 * Don't need walk inlined functions recursively, because
++		 * inner inlined functions don't have the lines of the
++		 * specified function.
+ 		 */
+ 		ret = __die_walk_funclines(rt_die, false, callback, data);
+ 	else {
+-- 
+2.20.1
+
diff --git a/queue-5.4/perf-record-add-a-function-to-test-for-kernel-suppor.patch b/queue-5.4/perf-record-add-a-function-to-test-for-kernel-suppor.patch
new file mode 100644
index 00000000000..169f1e5a110
--- /dev/null
+++ b/queue-5.4/perf-record-add-a-function-to-test-for-kernel-suppor.patch
@@ -0,0 +1,105 @@
+From a7b6666fa92b16665b467558ed81142524ac3d30 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Nov 2019 14:42:13 +0200
+Subject: perf record: Add a function to test for kernel support for AUX area
+ sampling
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+[ Upstream commit 9bca1a4ef5034f0a82861ac0375eb0272c5ce04e ]
+
+Architectures are expected to know if AUX area sampling is supported by
+the hardware. Add a function perf_can_aux_sample() which will determine
+whether the kernel supports it.
+
+Committer notes:
+
+I reported that this message was taking place on a kernel without the
+required bits:
+
+  # perf record --aux-sample -e '{intel_pt//u,branch-misses:u}'
+  Error:
+  The sys_perf_event_open() syscall returned with 7 (Argument list too long) for event (branch-misses:u).
+  /bin/dmesg | grep -i perf may provide additional information.
+
+Adrian sent a patch addressing it, with this explanation:
+
+ ----
+  perf_can_aux_sample_size() always returned true because it did not pass
+  the attribute size to sys_perf_event_open, nor correctly check the
+  return value and errno.
+ ----
+
+After applying it I get, later in the series, when --aux-sample is
+added:
+
+  # perf record --aux-sample -e '{intel_pt//u,branch-misses:u}'
+  AUX area sampling is not supported by kernel
+
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Link: http://lore.kernel.org/lkml/20191115124225.5247-4-adrian.hunter@intel.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/evlist.h |  1 +
+ tools/perf/util/record.c | 31 +++++++++++++++++++++++++++++++
+ 2 files changed, 32 insertions(+)
+
+diff --git a/tools/perf/util/evlist.h b/tools/perf/util/evlist.h
+index 7cfe75522ba5..d89e72bd1c81 100644
+--- a/tools/perf/util/evlist.h
++++ b/tools/perf/util/evlist.h
+@@ -164,6 +164,7 @@ void perf_evlist__set_id_pos(struct evlist *evlist);
+ bool perf_can_sample_identifier(void);
+ bool perf_can_record_switch_events(void);
+ bool perf_can_record_cpu_wide(void);
++bool perf_can_aux_sample(void);
+ void perf_evlist__config(struct evlist *evlist, struct record_opts *opts,
+ 			 struct callchain_param *callchain);
+ int record_opts__config(struct record_opts *opts);
+diff --git a/tools/perf/util/record.c b/tools/perf/util/record.c
+index 8579505c29a4..7def66168503 100644
+--- a/tools/perf/util/record.c
++++ b/tools/perf/util/record.c
+@@ -136,6 +136,37 @@ bool perf_can_record_cpu_wide(void)
+ 	return true;
+ }
+ 
++/*
++ * Architectures are expected to know if AUX area sampling is supported by the
++ * hardware. Here we check for kernel support.
++ */
++bool perf_can_aux_sample(void)
++{
++	struct perf_event_attr attr = {
++		.size = sizeof(struct perf_event_attr),
++		.exclude_kernel = 1,
++		/*
++		 * Non-zero value causes the kernel to calculate the effective
++		 * attribute size up to that byte.
++		 */
++		.aux_sample_size = 1,
++	};
++	int fd;
++
++	fd = sys_perf_event_open(&attr, -1, 0, -1, 0);
++	/*
++	 * If the kernel attribute is big enough to contain aux_sample_size
++	 * then we assume that it is supported. We are relying on the kernel to
++	 * validate the attribute size before anything else that could be wrong.
++	 */
++	if (fd < 0 && errno == E2BIG)
++		return false;
++	if (fd >= 0)
++		close(fd);
++
++	return true;
++}
++
+ void perf_evlist__config(struct evlist *evlist, struct record_opts *opts,
+ 			 struct callchain_param *callchain)
+ {
+-- 
+2.20.1
+
diff --git a/queue-5.4/perf-report-add-warning-when-libunwind-not-compiled-.patch b/queue-5.4/perf-report-add-warning-when-libunwind-not-compiled-.patch
new file mode 100644
index 00000000000..0ff293e6a40
--- /dev/null
+++ b/queue-5.4/perf-report-add-warning-when-libunwind-not-compiled-.patch
@@ -0,0 +1,58 @@
+From 1c70fdc9d403450c7a377b7943cd98565d6af94d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Oct 2019 10:21:22 +0800
+Subject: perf report: Add warning when libunwind not compiled in
+
+From: Jin Yao <yao.jin@linux.intel.com>
+
+[ Upstream commit 800d3f561659b5436f8c57e7c26dd1f6928b5615 ]
+
+We received a user report that call-graph DWARF mode was enabled in
+'perf record' but 'perf report' didn't unwind the callstack correctly.
+The reason was, libunwind was not compiled in.
+
+We can use 'perf -vv' to check the compiled libraries but it would be
+valuable to report a warning to user directly (especially valuable for
+a perf newbie).
+
+The warning is:
+
+Warning:
+Please install libunwind development packages during the perf build.
+
+Both TUI and stdio are supported.
+
+Signed-off-by: Jin Yao <yao.jin@linux.intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: http://lore.kernel.org/lkml/20191011022122.26369-1-yao.jin@linux.intel.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-report.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c
+index aae0e57c60fb..7accaf8ef689 100644
+--- a/tools/perf/builtin-report.c
++++ b/tools/perf/builtin-report.c
+@@ -399,6 +399,13 @@ static int report__setup_sample_type(struct report *rep)
+ 				PERF_SAMPLE_BRANCH_ANY))
+ 		rep->nonany_branch_mode = true;
+ 
++#ifndef HAVE_LIBUNWIND_SUPPORT
++	if (dwarf_callchain_users) {
++		ui__warning("Please install libunwind development packages "
++			    "during the perf build.\n");
++	}
++#endif
++
+ 	return 0;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/perf-session-fix-decompression-of-perf_record_compre.patch b/queue-5.4/perf-session-fix-decompression-of-perf_record_compre.patch
new file mode 100644
index 00000000000..0d8e5ceb8f7
--- /dev/null
+++ b/queue-5.4/perf-session-fix-decompression-of-perf_record_compre.patch
@@ -0,0 +1,144 @@
+From 3e3e8003c41c5153e3e320f370ee0920e598ca19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Nov 2019 17:21:03 +0300
+Subject: perf session: Fix decompression of PERF_RECORD_COMPRESSED records
+
+From: Alexey Budankov <alexey.budankov@linux.intel.com>
+
+[ Upstream commit bb1835a3b86c73aa534ef6430ad40223728dfbc0 ]
+
+Avoid termination of trace loading in case the last record in the
+decompressed buffer partly resides in the following mmaped
+PERF_RECORD_COMPRESSED record.
+
+In this case NULL value returned by fetch_mmaped_event() means to
+proceed to the next mmaped record then decompress it and load compressed
+events.
+
+The issue can be reproduced like this:
+
+  $ perf record -z -- some_long_running_workload
+  $ perf report --stdio -vv
+  decomp (B): 44519 to 163000
+  decomp (B): 48119 to 174800
+  decomp (B): 65527 to 131072
+  fetch_mmaped_event: head=0x1ffe0 event->header_size=0x28, mmap_size=0x20000: fuzzed perf.data?
+  Error:
+  failed to process sample
+  ...
+
+Testing:
+
+  71: Zstd perf.data compression/decompression              : Ok
+
+  $ tools/perf/perf report -vv --stdio
+  decomp (B): 59593 to 262160
+  decomp (B): 4438 to 16512
+  decomp (B): 285 to 880
+  Looking at the vmlinux_path (8 entries long)
+  Using vmlinux for symbols
+  decomp (B): 57474 to 261248
+  prefetch_event: head=0x3fc78 event->header_size=0x28, mmap_size=0x3fc80: fuzzed or compressed perf.data?
+  decomp (B): 25 to 32
+  decomp (B): 52 to 120
+  ...
+
+Fixes: 57fc032ad643 ("perf session: Avoid infinite loop when seeing invalid header.size")
+Link: https://marc.info/?l=linux-kernel&m=156580812427554&w=2
+Co-developed-by: Jiri Olsa <jolsa@kernel.org>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Signed-off-by: Alexey Budankov <alexey.budankov@linux.intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: http://lore.kernel.org/lkml/cf782c34-f3f8-2f9f-d6ab-145cee0d5322@linux.intel.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/session.c | 44 ++++++++++++++++++++++++---------------
+ 1 file changed, 27 insertions(+), 17 deletions(-)
+
+diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c
+index 061bb4d6a3f5..5c172845fa5a 100644
+--- a/tools/perf/util/session.c
++++ b/tools/perf/util/session.c
+@@ -1954,8 +1954,8 @@ out_err:
+ }
+ 
+ static union perf_event *
+-fetch_mmaped_event(struct perf_session *session,
+-		   u64 head, size_t mmap_size, char *buf)
++prefetch_event(char *buf, u64 head, size_t mmap_size,
++	       bool needs_swap, union perf_event *error)
+ {
+ 	union perf_event *event;
+ 
+@@ -1967,20 +1967,32 @@ fetch_mmaped_event(struct perf_session *session,
+ 		return NULL;
+ 
+ 	event = (union perf_event *)(buf + head);
++	if (needs_swap)
++		perf_event_header__bswap(&event->header);
+ 
+-	if (session->header.needs_swap)
++	if (head + event->header.size <= mmap_size)
++		return event;
++
++	/* We're not fetching the event so swap back again */
++	if (needs_swap)
+ 		perf_event_header__bswap(&event->header);
+ 
+-	if (head + event->header.size > mmap_size) {
+-		/* We're not fetching the event so swap back again */
+-		if (session->header.needs_swap)
+-			perf_event_header__bswap(&event->header);
+-		pr_debug("%s: head=%#" PRIx64 " event->header_size=%#x, mmap_size=%#zx: fuzzed perf.data?\n",
+-			 __func__, head, event->header.size, mmap_size);
+-		return ERR_PTR(-EINVAL);
+-	}
++	pr_debug("%s: head=%#" PRIx64 " event->header_size=%#x, mmap_size=%#zx:"
++		 " fuzzed or compressed perf.data?\n",__func__, head, event->header.size, mmap_size);
+ 
+-	return event;
++	return error;
++}
++
++static union perf_event *
++fetch_mmaped_event(u64 head, size_t mmap_size, char *buf, bool needs_swap)
++{
++	return prefetch_event(buf, head, mmap_size, needs_swap, ERR_PTR(-EINVAL));
++}
++
++static union perf_event *
++fetch_decomp_event(u64 head, size_t mmap_size, char *buf, bool needs_swap)
++{
++	return prefetch_event(buf, head, mmap_size, needs_swap, NULL);
+ }
+ 
+ static int __perf_session__process_decomp_events(struct perf_session *session)
+@@ -1993,10 +2005,8 @@ static int __perf_session__process_decomp_events(struct perf_session *session)
+ 		return 0;
+ 
+ 	while (decomp->head < decomp->size && !session_done()) {
+-		union perf_event *event = fetch_mmaped_event(session, decomp->head, decomp->size, decomp->data);
+-
+-		if (IS_ERR(event))
+-			return PTR_ERR(event);
++		union perf_event *event = fetch_decomp_event(decomp->head, decomp->size, decomp->data,
++							     session->header.needs_swap);
+ 
+ 		if (!event)
+ 			break;
+@@ -2096,7 +2106,7 @@ remap:
+ 	}
+ 
+ more:
+-	event = fetch_mmaped_event(session, head, mmap_size, buf);
++	event = fetch_mmaped_event(head, mmap_size, buf, session->header.needs_swap);
+ 	if (IS_ERR(event))
+ 		return PTR_ERR(event);
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/perf-test-avoid-infinite-loop-for-task-exit-case.patch b/queue-5.4/perf-test-avoid-infinite-loop-for-task-exit-case.patch
new file mode 100644
index 00000000000..0a2e2a5bea4
--- /dev/null
+++ b/queue-5.4/perf-test-avoid-infinite-loop-for-task-exit-case.patch
@@ -0,0 +1,67 @@
+From 2983397db06466999a10055513fecb57ba2517cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Oct 2019 17:19:42 +0800
+Subject: perf test: Avoid infinite loop for task exit case
+
+From: Leo Yan <leo.yan@linaro.org>
+
+[ Upstream commit 791ce9c48c79210d2ffcdbe69421e7783b32921f ]
+
+When executing the task exit testing case, perf gets stuck in an endless
+loop this case and doesn't return back on Arm64 Juno board.
+
+After digging into this issue, since Juno board has Arm's big.LITTLE
+CPUs, thus the PMUs are not compatible between the big CPUs and little
+CPUs.  This leads to a PMU event that cannot be enabled properly when
+the traced task is migrated from one variant's CPU to another variant.
+Finally, the test case runs into infinite loop for cannot read out any
+event data after return from polling.
+
+Eventually, we need to work out formal solution to allow PMU events can
+be freely migrated from one CPU variant to another, but this is a
+difficult task and a different topic.  This patch tries to fix the Perf
+test case to avoid infinite loop, when the testing detects 1000 times
+retrying for reading empty events, it will directly bail out and return
+failure.  This allows the Perf tool can continue its other test cases.
+
+Signed-off-by: Leo Yan <leo.yan@linaro.org>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Link: http://lore.kernel.org/lkml/20191011091942.29841-2-leo.yan@linaro.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/tests/task-exit.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/tools/perf/tests/task-exit.c b/tools/perf/tests/task-exit.c
+index ca0a6ca43b13..d85c9f608564 100644
+--- a/tools/perf/tests/task-exit.c
++++ b/tools/perf/tests/task-exit.c
+@@ -53,6 +53,7 @@ int test__task_exit(struct test *test __maybe_unused, int subtest __maybe_unused
+ 	struct perf_cpu_map *cpus;
+ 	struct perf_thread_map *threads;
+ 	struct mmap *md;
++	int retry_count = 0;
+ 
+ 	signal(SIGCHLD, sig_handler);
+ 
+@@ -132,6 +133,13 @@ retry:
+ out_init:
+ 	if (!exited || !nr_exit) {
+ 		evlist__poll(evlist, -1);
++
++		if (retry_count++ > 1000) {
++			pr_debug("Failed after retrying 1000 times\n");
++			err = -1;
++			goto out_free_maps;
++		}
++
+ 		goto retry;
+ 	}
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/perf-test-report-failure-for-mmap-events.patch b/queue-5.4/perf-test-report-failure-for-mmap-events.patch
new file mode 100644
index 00000000000..34405f90644
--- /dev/null
+++ b/queue-5.4/perf-test-report-failure-for-mmap-events.patch
@@ -0,0 +1,43 @@
+From 2568ccb702a4ddd76b2564f7956d78faf6af6e2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Oct 2019 17:19:41 +0800
+Subject: perf test: Report failure for mmap events
+
+From: Leo Yan <leo.yan@linaro.org>
+
+[ Upstream commit 6add129c5d9210ada25217abc130df0b7096ee02 ]
+
+When fail to mmap events in task exit case, it misses to set 'err' to
+-1; thus the testing will not report failure for it.
+
+This patch sets 'err' to -1 when fails to mmap events, thus Perf tool
+can report correct result.
+
+Fixes: d723a55096b8 ("perf test: Add test case for checking number of EXIT events")
+Signed-off-by: Leo Yan <leo.yan@linaro.org>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Link: http://lore.kernel.org/lkml/20191011091942.29841-1-leo.yan@linaro.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/tests/task-exit.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/perf/tests/task-exit.c b/tools/perf/tests/task-exit.c
+index bce3a4cb4c89..ca0a6ca43b13 100644
+--- a/tools/perf/tests/task-exit.c
++++ b/tools/perf/tests/task-exit.c
+@@ -110,6 +110,7 @@ int test__task_exit(struct test *test __maybe_unused, int subtest __maybe_unused
+ 	if (evlist__mmap(evlist, 128) < 0) {
+ 		pr_debug("failed to mmap events: %d (%s)\n", errno,
+ 			 str_error_r(errno, sbuf, sizeof(sbuf)));
++		err = -1;
+ 		goto out_delete_evlist;
+ 	}
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/perf-tests-disable-bp_signal-testing-for-arm64.patch b/queue-5.4/perf-tests-disable-bp_signal-testing-for-arm64.patch
new file mode 100644
index 00000000000..d6bc22b111b
--- /dev/null
+++ b/queue-5.4/perf-tests-disable-bp_signal-testing-for-arm64.patch
@@ -0,0 +1,113 @@
+From a3a218281b13a512cfd62fbb8effa2667c532546 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Oct 2019 16:55:31 +0800
+Subject: perf tests: Disable bp_signal testing for arm64
+
+From: Leo Yan <leo.yan@linaro.org>
+
+[ Upstream commit 6a5f3d94cb69a185b921cb92c39888dc31009acb ]
+
+As there are several discussions for enabling perf breakpoint signal
+testing on arm64 platform: arm64 needs to rely on single-step to execute
+the breakpointed instruction and then reinstall the breakpoint exception
+handler.  But if we hook the breakpoint with a signal, the signal
+handler will do the stepping rather than the breakpointed instruction,
+this causes infinite loops as below:
+
+         Kernel space              |            Userspace
+  ---------------------------------|--------------------------------
+                                   |  __test_function() -> hit
+				   |                       breakpoint
+  breakpoint_handler()             |
+    `-> user_enable_single_step()  |
+  do_signal()                      |
+                                   |  sig_handler() -> Step one
+				   |                instruction and
+				   |                trap to kernel
+  single_step_handler()            |
+    `-> reinstall_suspended_bps()  |
+                                   |  __test_function() -> hit
+				   |     breakpoint again and
+				   |     repeat up flow infinitely
+
+As Will Deacon mentioned [1]: "that we require the overflow handler to
+do the stepping on arm/arm64, which is relied upon by GDB/ptrace. The
+hw_breakpoint code is a complete disaster so my preference would be to
+rip out the perf part and just implement something directly in ptrace,
+but it's a pretty horrible job".  Though Will commented this on arm
+architecture, but the comment also can apply on arm64 architecture.
+
+For complete information, I searched online and found a few years back,
+Wang Nan sent one patch 'arm64: Store breakpoint single step state into
+pstate' [2]; the patch tried to resolve this issue by avoiding single
+stepping in signal handler and defer to enable the signal stepping when
+return to __test_function().  The fixing was not merged due to the
+concern for missing to handle different usage cases.
+
+Based on the info, the most feasible way is to skip Perf breakpoint
+signal testing for arm64 and this could avoid the duplicate
+investigation efforts when people see the failure.  This patch skips
+this case on arm64 platform, which is same with arm architecture.
+
+[1] https://lkml.org/lkml/2018/11/15/205
+[2] https://lkml.org/lkml/2015/12/23/477
+
+Signed-off-by: Leo Yan <leo.yan@linaro.org>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Brajeswar Ghosh <brajeswar.linux@gmail.com>
+Cc: Florian Fainelli <f.fainelli@gmail.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Michael Petlan <mpetlan@redhat.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Song Liu <songliubraving@fb.com>
+Cc: Souptick Joarder <jrdr.linux@gmail.com>
+Cc: Will Deacon <will@kernel.org>
+Link: http://lore.kernel.org/lkml/20191018085531.6348-3-leo.yan@linaro.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/tests/bp_signal.c | 15 ++++++---------
+ 1 file changed, 6 insertions(+), 9 deletions(-)
+
+diff --git a/tools/perf/tests/bp_signal.c b/tools/perf/tests/bp_signal.c
+index c1c2c13de254..166f411568a5 100644
+--- a/tools/perf/tests/bp_signal.c
++++ b/tools/perf/tests/bp_signal.c
+@@ -49,14 +49,6 @@ asm (
+ 	"__test_function:\n"
+ 	"incq (%rdi)\n"
+ 	"ret\n");
+-#elif defined (__aarch64__)
+-extern void __test_function(volatile long *ptr);
+-asm (
+-	".globl __test_function\n"
+-	"__test_function:\n"
+-	"str x30, [x0]\n"
+-	"ret\n");
+-
+ #else
+ static void __test_function(volatile long *ptr)
+ {
+@@ -302,10 +294,15 @@ bool test__bp_signal_is_supported(void)
+ 	 * stepping into the SIGIO handler and getting stuck on the
+ 	 * breakpointed instruction.
+ 	 *
++	 * Since arm64 has the same issue with arm for the single-step
++	 * handling, this case also gets suck on the breakpointed
++	 * instruction.
++	 *
+ 	 * Just disable the test for these architectures until these
+ 	 * issues are resolved.
+ 	 */
+-#if defined(__powerpc__) || defined(__s390x__) || defined(__arm__)
++#if defined(__powerpc__) || defined(__s390x__) || defined(__arm__) || \
++    defined(__aarch64__)
+ 	return false;
+ #else
+ 	return true;
+-- 
+2.20.1
+
diff --git a/queue-5.4/perf-tools-fix-cross-compile-for-arm64.patch b/queue-5.4/perf-tools-fix-cross-compile-for-arm64.patch
new file mode 100644
index 00000000000..df6f09a490b
--- /dev/null
+++ b/queue-5.4/perf-tools-fix-cross-compile-for-arm64.patch
@@ -0,0 +1,67 @@
+From d06146d6804945a4e446101fe9a382cfa8ef5421 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Nov 2019 21:00:54 +0800
+Subject: perf tools: Fix cross compile for ARM64
+
+From: John Garry <john.garry@huawei.com>
+
+[ Upstream commit 71f699078b154fcb1c9162fd0208ada9ce532ffc ]
+
+Currently when cross compiling perf tool for ARM64 on my x86 machine I
+get this error:
+
+  arch/arm64/util/sym-handling.c:9:10: fatal error: gelf.h: No such file or directory
+   #include <gelf.h>
+
+For the build, libelf is reported off:
+
+  Auto-detecting system features:
+  ...
+  ...                        libelf: [ OFF ]
+
+Indeed, test-libelf is not built successfully:
+
+  more ./build/feature/test-libelf.make.output
+  test-libelf.c:2:10: fatal error: libelf.h: No such file or directory
+   #include <libelf.h>
+          ^~~~~~~~~~
+  compilation terminated.
+
+I have no such problems natively compiling on ARM64, and I did not
+previously have this issue for cross compiling. Fix by relocating the
+gelf.h include.
+
+Signed-off-by: John Garry <john.garry@huawei.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Will Deacon <will@kernel.org>
+Cc: linux-arm-kernel@lists.infradead.org
+Link: http://lore.kernel.org/lkml/1573045254-39833-1-git-send-email-john.garry@huawei.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/arch/arm64/util/sym-handling.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/tools/perf/arch/arm64/util/sym-handling.c b/tools/perf/arch/arm64/util/sym-handling.c
+index 5df788985130..8dfa3e5229f1 100644
+--- a/tools/perf/arch/arm64/util/sym-handling.c
++++ b/tools/perf/arch/arm64/util/sym-handling.c
+@@ -6,9 +6,10 @@
+ 
+ #include "symbol.h" // for the elf__needs_adjust_symbols() prototype
+ #include <stdbool.h>
+-#include <gelf.h>
+ 
+ #ifdef HAVE_LIBELF_SUPPORT
++#include <gelf.h>
++
+ bool elf__needs_adjust_symbols(GElf_Ehdr ehdr)
+ {
+ 	return ehdr.e_type == ET_EXEC ||
+-- 
+2.20.1
+
diff --git a/queue-5.4/perf-tools-splice-events-onto-evlist-even-on-error.patch b/queue-5.4/perf-tools-splice-events-onto-evlist-even-on-error.patch
new file mode 100644
index 00000000000..3ac1cc6eb11
--- /dev/null
+++ b/queue-5.4/perf-tools-splice-events-onto-evlist-even-on-error.patch
@@ -0,0 +1,76 @@
+From a76305290e90326388e22afb9cb792160c2f274b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Oct 2019 11:08:22 -0700
+Subject: perf tools: Splice events onto evlist even on error
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 8e8714c3d157568b7a769917a5e05573bbaf5af0 ]
+
+If event parsing fails the event list is leaked, instead splice the list
+onto the out result and let the caller cleanup.
+
+An example input for parse_events found by libFuzzer that reproduces
+this memory leak is 'm{'.
+
+Signed-off-by: Ian Rogers <irogers@google.com>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Alexei Starovoitov <ast@kernel.org>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Daniel Borkmann <daniel@iogearbox.net>
+Cc: Jin Yao <yao.jin@linux.intel.com>
+Cc: John Garry <john.garry@huawei.com>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Martin KaFai Lau <kafai@fb.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Song Liu <songliubraving@fb.com>
+Cc: Stephane Eranian <eranian@google.com>
+Cc: Yonghong Song <yhs@fb.com>
+Cc: bpf@vger.kernel.org
+Cc: clang-built-linux@googlegroups.com
+Cc: netdev@vger.kernel.org
+Link: http://lore.kernel.org/lkml/20191025180827.191916-5-irogers@google.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/parse-events.c | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c
+index b5e2adef49de..d5ea043d3fc4 100644
+--- a/tools/perf/util/parse-events.c
++++ b/tools/perf/util/parse-events.c
+@@ -1927,15 +1927,20 @@ int parse_events(struct evlist *evlist, const char *str,
+ 
+ 	ret = parse_events__scanner(str, &parse_state, PE_START_EVENTS);
+ 	perf_pmu__parse_cleanup();
++
++	if (!ret && list_empty(&parse_state.list)) {
++		WARN_ONCE(true, "WARNING: event parser found nothing\n");
++		return -1;
++	}
++
++	/*
++	 * Add list to the evlist even with errors to allow callers to clean up.
++	 */
++	perf_evlist__splice_list_tail(evlist, &parse_state.list);
++
+ 	if (!ret) {
+ 		struct evsel *last;
+ 
+-		if (list_empty(&parse_state.list)) {
+-			WARN_ONCE(true, "WARNING: event parser found nothing\n");
+-			return -1;
+-		}
+-
+-		perf_evlist__splice_list_tail(evlist, &parse_state.list);
+ 		evlist->nr_groups += parse_state.nr_groups;
+ 		last = evlist__last(evlist);
+ 		last->cmdline_group_boundary = true;
+-- 
+2.20.1
+
diff --git a/queue-5.4/perf-trace-filter-own-pid-to-avoid-a-feedback-look-i.patch b/queue-5.4/perf-trace-filter-own-pid-to-avoid-a-feedback-look-i.patch
new file mode 100644
index 00000000000..3bb42fadfb7
--- /dev/null
+++ b/queue-5.4/perf-trace-filter-own-pid-to-avoid-a-feedback-look-i.patch
@@ -0,0 +1,96 @@
+From 8a71ada8e24a7177bff1f451e5a5237d87fbe7f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Oct 2019 20:13:51 -0300
+Subject: perf trace: Filter own pid to avoid a feedback look in 'perf trace
+ record -a'
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Arnaldo Carvalho de Melo <acme@redhat.com>
+
+[ Upstream commit 7fbfe22cf4cfe01a88704dd76ca65d108039d297 ]
+
+When doing a system wide 'perf trace record' we need, just like in 'perf
+trace' live mode, to filter out perf trace's own pid, so set up a
+tracepoint filter for the raw_syscalls tracepoints right after adding
+them to the argv array that is set up to then call cmd_record().
+
+Reported-by: Andi Kleen <ak@linux.intel.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: David Ahern <dsahern@gmail.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Luis Cláudio Gonçalves <lclaudio@redhat.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Link: https://lkml.kernel.org/n/tip-uysx5w8f2y5ndoln5cq370tv@git.kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-trace.c | 24 ++++++++++++++++--------
+ 1 file changed, 16 insertions(+), 8 deletions(-)
+
+diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
+index bb5130d02155..e47a08f6fca8 100644
+--- a/tools/perf/builtin-trace.c
++++ b/tools/perf/builtin-trace.c
+@@ -2576,21 +2576,23 @@ static int trace__record(struct trace *trace, int argc, const char **argv)
+ 		"-m", "1024",
+ 		"-c", "1",
+ 	};
+-
++	pid_t pid = getpid();
++	char *filter = asprintf__tp_filter_pids(1, &pid);
+ 	const char * const sc_args[] = { "-e", };
+ 	unsigned int sc_args_nr = ARRAY_SIZE(sc_args);
+ 	const char * const majpf_args[] = { "-e", "major-faults" };
+ 	unsigned int majpf_args_nr = ARRAY_SIZE(majpf_args);
+ 	const char * const minpf_args[] = { "-e", "minor-faults" };
+ 	unsigned int minpf_args_nr = ARRAY_SIZE(minpf_args);
++	int err = -1;
+ 
+-	/* +1 is for the event string below */
+-	rec_argc = ARRAY_SIZE(record_args) + sc_args_nr + 1 +
++	/* +3 is for the event string below and the pid filter */
++	rec_argc = ARRAY_SIZE(record_args) + sc_args_nr + 3 +
+ 		majpf_args_nr + minpf_args_nr + argc;
+ 	rec_argv = calloc(rec_argc + 1, sizeof(char *));
+ 
+-	if (rec_argv == NULL)
+-		return -ENOMEM;
++	if (rec_argv == NULL || filter == NULL)
++		goto out_free;
+ 
+ 	j = 0;
+ 	for (i = 0; i < ARRAY_SIZE(record_args); i++)
+@@ -2607,11 +2609,13 @@ static int trace__record(struct trace *trace, int argc, const char **argv)
+ 			rec_argv[j++] = "syscalls:sys_enter,syscalls:sys_exit";
+ 		else {
+ 			pr_err("Neither raw_syscalls nor syscalls events exist.\n");
+-			free(rec_argv);
+-			return -1;
++			goto out_free;
+ 		}
+ 	}
+ 
++	rec_argv[j++] = "--filter";
++	rec_argv[j++] = filter;
++
+ 	if (trace->trace_pgfaults & TRACE_PFMAJ)
+ 		for (i = 0; i < majpf_args_nr; i++)
+ 			rec_argv[j++] = majpf_args[i];
+@@ -2623,7 +2627,11 @@ static int trace__record(struct trace *trace, int argc, const char **argv)
+ 	for (i = 0; i < (unsigned int)argc; i++)
+ 		rec_argv[j++] = argv[i];
+ 
+-	return cmd_record(j, rec_argv);
++	err = cmd_record(j, rec_argv);
++out_free:
++	free(filter);
++	free(rec_argv);
++	return err;
+ }
+ 
+ static size_t trace__fprintf_thread_summary(struct trace *trace, FILE *fp);
+-- 
+2.20.1
+
diff --git a/queue-5.4/perf-vendor-events-arm64-fix-hisi-hip08-ddrc-pmu-eve.patch b/queue-5.4/perf-vendor-events-arm64-fix-hisi-hip08-ddrc-pmu-eve.patch
new file mode 100644
index 00000000000..d043a9e3573
--- /dev/null
+++ b/queue-5.4/perf-vendor-events-arm64-fix-hisi-hip08-ddrc-pmu-eve.patch
@@ -0,0 +1,45 @@
+From bd36082a427adf9c7ea6451ca595d4d620f7b3ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Sep 2019 23:54:41 +0800
+Subject: perf vendor events arm64: Fix Hisi hip08 DDRC PMU eventname
+
+From: John Garry <john.garry@huawei.com>
+
+[ Upstream commit 84b0975f4853ba32d2d9b3c19ffa2b947f023fb3 ]
+
+The "EventName" for the DDRC precharge command event is incorrect, so
+fix it.
+
+Fixes: 57cc732479ba ("perf jevents: Add support for Hisi hip08 DDRC PMU aliasing")
+Signed-off-by: John Garry <john.garry@huawei.com>
+Reviewed-by: Shaokun Zhang <zhangshaokun@hisilicon.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Will Deacon <will@kernel.org>
+Cc: linuxarm@huawei.com
+Link: http://lore.kernel.org/lkml/1567612484-195727-2-git-send-email-john.garry@huawei.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../perf/pmu-events/arch/arm64/hisilicon/hip08/uncore-ddrc.json | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/pmu-events/arch/arm64/hisilicon/hip08/uncore-ddrc.json b/tools/perf/pmu-events/arch/arm64/hisilicon/hip08/uncore-ddrc.json
+index 0d1556fcdffe..99f4fc425564 100644
+--- a/tools/perf/pmu-events/arch/arm64/hisilicon/hip08/uncore-ddrc.json
++++ b/tools/perf/pmu-events/arch/arm64/hisilicon/hip08/uncore-ddrc.json
+@@ -15,7 +15,7 @@
+    },
+    {
+ 	    "EventCode": "0x04",
+-	    "EventName": "uncore_hisi_ddrc.flux_wr",
++	    "EventName": "uncore_hisi_ddrc.pre_cmd",
+ 	    "BriefDescription": "DDRC precharge commands",
+ 	    "PublicDescription": "DDRC precharge commands",
+ 	    "Unit": "hisi_sccl,ddrc",
+-- 
+2.20.1
+
diff --git a/queue-5.4/phy-qcom-usb-hs-fix-extcon-double-register-after-pow.patch b/queue-5.4/phy-qcom-usb-hs-fix-extcon-double-register-after-pow.patch
new file mode 100644
index 00000000000..d48147aedfb
--- /dev/null
+++ b/queue-5.4/phy-qcom-usb-hs-fix-extcon-double-register-after-pow.patch
@@ -0,0 +1,71 @@
+From 58ab4ca93a2ede2e5473e9a761f02badcc967515 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2019 13:52:08 +0200
+Subject: phy: qcom-usb-hs: Fix extcon double register after power cycle
+
+From: Stephan Gerhold <stephan@gerhold.net>
+
+[ Upstream commit 64f86b9978449ff05bfa6c64b4c5439e21e9c80b ]
+
+Commit f0b5c2c96370 ("phy: qcom-usb-hs: Replace the extcon API")
+switched from extcon_register_notifier() to the resource-managed
+API, i.e. devm_extcon_register_notifier().
+
+This is problematic in this case, because the extcon notifier
+is dynamically registered/unregistered whenever the PHY is powered
+on/off. The resource-managed API does not unregister the notifier
+until the driver is removed, so as soon as the PHY is power cycled,
+attempting to register the notifier again results in:
+
+	double register detected
+	WARNING: CPU: 1 PID: 182 at kernel/notifier.c:26 notifier_chain_register+0x74/0xa0
+	Call trace:
+	 ...
+	 extcon_register_notifier+0x74/0xb8
+	 devm_extcon_register_notifier+0x54/0xb8
+	 qcom_usb_hs_phy_power_on+0x1fc/0x208
+	 ...
+
+... and USB stops working after plugging the cable out and in
+another time.
+
+The easiest way to fix this is to make a partial revert of
+commit f0b5c2c96370 ("phy: qcom-usb-hs: Replace the extcon API")
+and avoid using the resource-managed API in this case.
+
+Fixes: f0b5c2c96370 ("phy: qcom-usb-hs: Replace the extcon API")
+Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/qualcomm/phy-qcom-usb-hs.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/phy/qualcomm/phy-qcom-usb-hs.c b/drivers/phy/qualcomm/phy-qcom-usb-hs.c
+index b163b3a1558d..61054272a7c8 100644
+--- a/drivers/phy/qualcomm/phy-qcom-usb-hs.c
++++ b/drivers/phy/qualcomm/phy-qcom-usb-hs.c
+@@ -158,8 +158,8 @@ static int qcom_usb_hs_phy_power_on(struct phy *phy)
+ 		/* setup initial state */
+ 		qcom_usb_hs_phy_vbus_notifier(&uphy->vbus_notify, state,
+ 					      uphy->vbus_edev);
+-		ret = devm_extcon_register_notifier(&ulpi->dev, uphy->vbus_edev,
+-				EXTCON_USB, &uphy->vbus_notify);
++		ret = extcon_register_notifier(uphy->vbus_edev, EXTCON_USB,
++					       &uphy->vbus_notify);
+ 		if (ret)
+ 			goto err_ulpi;
+ 	}
+@@ -180,6 +180,9 @@ static int qcom_usb_hs_phy_power_off(struct phy *phy)
+ {
+ 	struct qcom_usb_hs_phy *uphy = phy_get_drvdata(phy);
+ 
++	if (uphy->vbus_edev)
++		extcon_unregister_notifier(uphy->vbus_edev, EXTCON_USB,
++					   &uphy->vbus_notify);
+ 	regulator_disable(uphy->v3p3);
+ 	regulator_disable(uphy->v1p8);
+ 	clk_disable_unprepare(uphy->sleep_clk);
+-- 
+2.20.1
+
diff --git a/queue-5.4/phy-renesas-phy-rcar-gen2-fix-the-array-off-by-one-w.patch b/queue-5.4/phy-renesas-phy-rcar-gen2-fix-the-array-off-by-one-w.patch
new file mode 100644
index 00000000000..c3617edaab4
--- /dev/null
+++ b/queue-5.4/phy-renesas-phy-rcar-gen2-fix-the-array-off-by-one-w.patch
@@ -0,0 +1,63 @@
+From b05f7b7f845dc689a26a953487ca4bac184bb25a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2019 17:12:49 +0100
+Subject: phy: renesas: phy-rcar-gen2: Fix the array off by one warning
+
+From: Biju Das <biju.das@bp.renesas.com>
+
+[ Upstream commit c9baab38fe0e28762d0d67611cbe2aef0fb3fc72 ]
+
+Fix the below smatch warning by adding variable check rather than the
+hardcoded value.
+warn: array off by one? 'data->select_value[channel_num]'
+
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Biju Das <biju.das@bp.renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Reviewed-by: Ulrich Hecht <uli+renesas@fpond.eu>
+Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/renesas/phy-rcar-gen2.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/phy/renesas/phy-rcar-gen2.c b/drivers/phy/renesas/phy-rcar-gen2.c
+index 2926e4937301..2e279ac0fa4d 100644
+--- a/drivers/phy/renesas/phy-rcar-gen2.c
++++ b/drivers/phy/renesas/phy-rcar-gen2.c
+@@ -71,6 +71,7 @@ struct rcar_gen2_phy_driver {
+ struct rcar_gen2_phy_data {
+ 	const struct phy_ops *gen2_phy_ops;
+ 	const u32 (*select_value)[PHYS_PER_CHANNEL];
++	const u32 num_channels;
+ };
+ 
+ static int rcar_gen2_phy_init(struct phy *p)
+@@ -271,11 +272,13 @@ static const u32 usb20_select_value[][PHYS_PER_CHANNEL] = {
+ static const struct rcar_gen2_phy_data rcar_gen2_usb_phy_data = {
+ 	.gen2_phy_ops = &rcar_gen2_phy_ops,
+ 	.select_value = pci_select_value,
++	.num_channels = ARRAY_SIZE(pci_select_value),
+ };
+ 
+ static const struct rcar_gen2_phy_data rz_g1c_usb_phy_data = {
+ 	.gen2_phy_ops = &rz_g1c_phy_ops,
+ 	.select_value = usb20_select_value,
++	.num_channels = ARRAY_SIZE(usb20_select_value),
+ };
+ 
+ static const struct of_device_id rcar_gen2_phy_match_table[] = {
+@@ -389,7 +392,7 @@ static int rcar_gen2_phy_probe(struct platform_device *pdev)
+ 		channel->selected_phy = -1;
+ 
+ 		error = of_property_read_u32(np, "reg", &channel_num);
+-		if (error || channel_num > 2) {
++		if (error || channel_num >= data->num_channels) {
+ 			dev_err(dev, "Invalid \"reg\" property\n");
+ 			of_node_put(np);
+ 			return error;
+-- 
+2.20.1
+
diff --git a/queue-5.4/pinctrl-amd-fix-__iomem-annotation-in-amd_gpio_irq_h.patch b/queue-5.4/pinctrl-amd-fix-__iomem-annotation-in-amd_gpio_irq_h.patch
new file mode 100644
index 00000000000..cdf63609602
--- /dev/null
+++ b/queue-5.4/pinctrl-amd-fix-__iomem-annotation-in-amd_gpio_irq_h.patch
@@ -0,0 +1,50 @@
+From 0a19a1e3578ffc6cd04365815877cffe1a1980de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Oct 2019 16:11:54 +0100
+Subject: pinctrl: amd: fix __iomem annotation in amd_gpio_irq_handler()
+
+From: Ben Dooks (Codethink) <ben.dooks@codethink.co.uk>
+
+[ Upstream commit 10ff58aa3c2e2a093b6ad615a7e3d8bb0dc613e5 ]
+
+The regs pointer in amd_gpio_irq_handler() should have __iomem
+on it, so add that to fix the following sparse warnings:
+
+drivers/pinctrl/pinctrl-amd.c:555:14: warning: incorrect type in assignment (different address spaces)
+drivers/pinctrl/pinctrl-amd.c:555:14:    expected unsigned int [usertype] *regs
+drivers/pinctrl/pinctrl-amd.c:555:14:    got void [noderef] <asn:2> *base
+drivers/pinctrl/pinctrl-amd.c:563:34: warning: incorrect type in argument 1 (different address spaces)
+drivers/pinctrl/pinctrl-amd.c:563:34:    expected void const volatile [noderef] <asn:2> *addr
+drivers/pinctrl/pinctrl-amd.c:563:34:    got unsigned int [usertype] *
+drivers/pinctrl/pinctrl-amd.c:580:34: warning: incorrect type in argument 1 (different address spaces)
+drivers/pinctrl/pinctrl-amd.c:580:34:    expected void const volatile [noderef] <asn:2> *addr
+drivers/pinctrl/pinctrl-amd.c:580:34:    got unsigned int [usertype] *
+drivers/pinctrl/pinctrl-amd.c:587:25: warning: incorrect type in argument 2 (different address spaces)
+drivers/pinctrl/pinctrl-amd.c:587:25:    expected void volatile [noderef] <asn:2> *addr
+drivers/pinctrl/pinctrl-amd.c:587:25:    got unsigned int [usertype] *
+
+Signed-off-by: Ben Dooks (Codethink) <ben.dooks@codethink.co.uk>
+Link: https://lore.kernel.org/r/20191022151154.5986-1-ben.dooks@codethink.co.uk
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-amd.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c
+index 2c61141519f8..eab078244a4c 100644
+--- a/drivers/pinctrl/pinctrl-amd.c
++++ b/drivers/pinctrl/pinctrl-amd.c
+@@ -540,7 +540,8 @@ static irqreturn_t amd_gpio_irq_handler(int irq, void *dev_id)
+ 	irqreturn_t ret = IRQ_NONE;
+ 	unsigned int i, irqnr;
+ 	unsigned long flags;
+-	u32 *regs, regval;
++	u32 __iomem *regs;
++	u32  regval;
+ 	u64 status, mask;
+ 
+ 	/* Read the wake status */
+-- 
+2.20.1
+
diff --git a/queue-5.4/pinctrl-devicetree-avoid-taking-direct-reference-to-.patch b/queue-5.4/pinctrl-devicetree-avoid-taking-direct-reference-to-.patch
new file mode 100644
index 00000000000..6df9576b84f
--- /dev/null
+++ b/queue-5.4/pinctrl-devicetree-avoid-taking-direct-reference-to-.patch
@@ -0,0 +1,112 @@
+From d71e198fb7600db35ebd06f05c0da3bd90ae6037 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Oct 2019 13:42:06 +0100
+Subject: pinctrl: devicetree: Avoid taking direct reference to device name
+ string
+
+From: Will Deacon <will@kernel.org>
+
+[ Upstream commit be4c60b563edee3712d392aaeb0943a768df7023 ]
+
+When populating the pinctrl mapping table entries for a device, the
+'dev_name' field for each entry is initialised to point directly at the
+string returned by 'dev_name()' for the device and subsequently used by
+'create_pinctrl()' when looking up the mappings for the device being
+probed.
+
+This is unreliable in the presence of calls to 'dev_set_name()', which may
+reallocate the device name string leaving the pinctrl mappings with a
+dangling reference. This then leads to a use-after-free every time the
+name is dereferenced by a device probe:
+
+  | BUG: KASAN: invalid-access in strcmp+0x20/0x64
+  | Read of size 1 at addr 13ffffc153494b00 by task modprobe/590
+  | Pointer tag: [13], memory tag: [fe]
+  |
+  | Call trace:
+  |  __kasan_report+0x16c/0x1dc
+  |  kasan_report+0x10/0x18
+  |  check_memory_region
+  |  __hwasan_load1_noabort+0x4c/0x54
+  |  strcmp+0x20/0x64
+  |  create_pinctrl+0x18c/0x7f4
+  |  pinctrl_get+0x90/0x114
+  |  devm_pinctrl_get+0x44/0x98
+  |  pinctrl_bind_pins+0x5c/0x450
+  |  really_probe+0x1c8/0x9a4
+  |  driver_probe_device+0x120/0x1d8
+
+Follow the example of sysfs, and duplicate the device name string before
+stashing it away in the pinctrl mapping entries.
+
+Cc: Linus Walleij <linus.walleij@linaro.org>
+Reported-by: Elena Petrova <lenaptr@google.com>
+Tested-by: Elena Petrova <lenaptr@google.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Link: https://lore.kernel.org/r/20191002124206.22928-1-will@kernel.org
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/devicetree.c | 25 ++++++++++++++++++++-----
+ 1 file changed, 20 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/pinctrl/devicetree.c b/drivers/pinctrl/devicetree.c
+index 5d6d8b1e9062..dbaacde1b36a 100644
+--- a/drivers/pinctrl/devicetree.c
++++ b/drivers/pinctrl/devicetree.c
+@@ -29,6 +29,13 @@ struct pinctrl_dt_map {
+ static void dt_free_map(struct pinctrl_dev *pctldev,
+ 		     struct pinctrl_map *map, unsigned num_maps)
+ {
++	int i;
++
++	for (i = 0; i < num_maps; ++i) {
++		kfree_const(map[i].dev_name);
++		map[i].dev_name = NULL;
++	}
++
+ 	if (pctldev) {
+ 		const struct pinctrl_ops *ops = pctldev->desc->pctlops;
+ 		if (ops->dt_free_map)
+@@ -63,7 +70,13 @@ static int dt_remember_or_free_map(struct pinctrl *p, const char *statename,
+ 
+ 	/* Initialize common mapping table entry fields */
+ 	for (i = 0; i < num_maps; i++) {
+-		map[i].dev_name = dev_name(p->dev);
++		const char *devname;
++
++		devname = kstrdup_const(dev_name(p->dev), GFP_KERNEL);
++		if (!devname)
++			goto err_free_map;
++
++		map[i].dev_name = devname;
+ 		map[i].name = statename;
+ 		if (pctldev)
+ 			map[i].ctrl_dev_name = dev_name(pctldev->dev);
+@@ -71,10 +84,8 @@ static int dt_remember_or_free_map(struct pinctrl *p, const char *statename,
+ 
+ 	/* Remember the converted mapping table entries */
+ 	dt_map = kzalloc(sizeof(*dt_map), GFP_KERNEL);
+-	if (!dt_map) {
+-		dt_free_map(pctldev, map, num_maps);
+-		return -ENOMEM;
+-	}
++	if (!dt_map)
++		goto err_free_map;
+ 
+ 	dt_map->pctldev = pctldev;
+ 	dt_map->map = map;
+@@ -82,6 +93,10 @@ static int dt_remember_or_free_map(struct pinctrl *p, const char *statename,
+ 	list_add_tail(&dt_map->node, &p->dt_maps);
+ 
+ 	return pinctrl_register_map(map, num_maps, false);
++
++err_free_map:
++	dt_free_map(pctldev, map, num_maps);
++	return -ENOMEM;
+ }
+ 
+ struct pinctrl_dev *of_pinctrl_get(struct device_node *np)
+-- 
+2.20.1
+
diff --git a/queue-5.4/pinctrl-qcom-sc7180-add-missing-tile-info-in-sdc_qds.patch b/queue-5.4/pinctrl-qcom-sc7180-add-missing-tile-info-in-sdc_qds.patch
new file mode 100644
index 00000000000..8a33d6b7f8d
--- /dev/null
+++ b/queue-5.4/pinctrl-qcom-sc7180-add-missing-tile-info-in-sdc_qds.patch
@@ -0,0 +1,72 @@
+From 9da053eff524956afd805a1c904b1edfd553b62e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Oct 2019 19:45:07 +0530
+Subject: pinctrl: qcom: sc7180: Add missing tile info in
+ SDC_QDSD_PINGROUP/UFS_RESET
+
+From: Rajendra Nayak <rnayak@codeaurora.org>
+
+[ Upstream commit 81898a44f288607cb3b11a42aed6efb646891c19 ]
+
+The SDC_QDSD_PINGROUP/UFS_RESET macros are missing the .tile info needed to
+calculate the right register offsets. Adding them here and also
+adjusting the offsets accordingly.
+
+Fixes: f2ae04c45b1a ("pinctrl: qcom: Add SC7180 pinctrl driver")
+
+Reported-by: Veerabhadrarao Badiganti <vbadigan@codeaurora.org>
+Signed-off-by: Rajendra Nayak <rnayak@codeaurora.org>
+Link: https://lore.kernel.org/r/20191021141507.24066-1-rnayak@codeaurora.org
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/qcom/pinctrl-sc7180.c | 18 ++++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/pinctrl/qcom/pinctrl-sc7180.c b/drivers/pinctrl/qcom/pinctrl-sc7180.c
+index 6399c8a2bc22..d6cfad7417b1 100644
+--- a/drivers/pinctrl/qcom/pinctrl-sc7180.c
++++ b/drivers/pinctrl/qcom/pinctrl-sc7180.c
+@@ -77,6 +77,7 @@ enum {
+ 		.intr_cfg_reg = 0,			\
+ 		.intr_status_reg = 0,			\
+ 		.intr_target_reg = 0,			\
++		.tile = SOUTH,				\
+ 		.mux_bit = -1,				\
+ 		.pull_bit = pull,			\
+ 		.drv_bit = drv,				\
+@@ -102,6 +103,7 @@ enum {
+ 		.intr_cfg_reg = 0,			\
+ 		.intr_status_reg = 0,			\
+ 		.intr_target_reg = 0,			\
++		.tile = SOUTH,				\
+ 		.mux_bit = -1,				\
+ 		.pull_bit = 3,				\
+ 		.drv_bit = 0,				\
+@@ -1087,14 +1089,14 @@ static const struct msm_pingroup sc7180_groups[] = {
+ 	[116] = PINGROUP(116, WEST, qup04, qup04, _, _, _, _, _, _, _),
+ 	[117] = PINGROUP(117, WEST, dp_hot, _, _, _, _, _, _, _, _),
+ 	[118] = PINGROUP(118, WEST, _, _, _, _, _, _, _, _, _),
+-	[119] = UFS_RESET(ufs_reset, 0x97f000),
+-	[120] = SDC_QDSD_PINGROUP(sdc1_rclk, 0x97a000, 15, 0),
+-	[121] = SDC_QDSD_PINGROUP(sdc1_clk, 0x97a000, 13, 6),
+-	[122] = SDC_QDSD_PINGROUP(sdc1_cmd, 0x97a000, 11, 3),
+-	[123] = SDC_QDSD_PINGROUP(sdc1_data, 0x97a000, 9, 0),
+-	[124] = SDC_QDSD_PINGROUP(sdc2_clk, 0x97b000, 14, 6),
+-	[125] = SDC_QDSD_PINGROUP(sdc2_cmd, 0x97b000, 11, 3),
+-	[126] = SDC_QDSD_PINGROUP(sdc2_data, 0x97b000, 9, 0),
++	[119] = UFS_RESET(ufs_reset, 0x7f000),
++	[120] = SDC_QDSD_PINGROUP(sdc1_rclk, 0x7a000, 15, 0),
++	[121] = SDC_QDSD_PINGROUP(sdc1_clk, 0x7a000, 13, 6),
++	[122] = SDC_QDSD_PINGROUP(sdc1_cmd, 0x7a000, 11, 3),
++	[123] = SDC_QDSD_PINGROUP(sdc1_data, 0x7a000, 9, 0),
++	[124] = SDC_QDSD_PINGROUP(sdc2_clk, 0x7b000, 14, 6),
++	[125] = SDC_QDSD_PINGROUP(sdc2_cmd, 0x7b000, 11, 3),
++	[126] = SDC_QDSD_PINGROUP(sdc2_data, 0x7b000, 9, 0),
+ };
+ 
+ static const struct msm_pinctrl_soc_data sc7180_pinctrl = {
+-- 
+2.20.1
+
diff --git a/queue-5.4/pinctrl-sh-pfc-sh7734-fix-duplicate-tclk1_b.patch b/queue-5.4/pinctrl-sh-pfc-sh7734-fix-duplicate-tclk1_b.patch
new file mode 100644
index 00000000000..a41adc31722
--- /dev/null
+++ b/queue-5.4/pinctrl-sh-pfc-sh7734-fix-duplicate-tclk1_b.patch
@@ -0,0 +1,64 @@
+From e4f4b97c99a2e25a4f7063b1491162366ba6cdc6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Oct 2019 15:13:08 +0200
+Subject: pinctrl: sh-pfc: sh7734: Fix duplicate TCLK1_B
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 884caadad128efad8e00c1cdc3177bc8912ee8ec ]
+
+The definitions for bit field [19:18] of the Peripheral Function Select
+Register 3 were accidentally copied from bit field [20], leading to
+duplicates for the TCLK1_B function, and missing TCLK0, CAN_CLK_B, and
+ET0_ETXD4 functions.
+
+Fix this by adding the missing GPIO_FN_CAN_CLK_B and GPIO_FN_ET0_ETXD4
+enum values, and correcting the functions.
+
+Reported-by: Ben Dooks <ben.dooks@codethink.co.uk>
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20191024131308.16659-1-geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sh/include/cpu-sh4/cpu/sh7734.h | 2 +-
+ drivers/pinctrl/sh-pfc/pfc-sh7734.c  | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/sh/include/cpu-sh4/cpu/sh7734.h b/arch/sh/include/cpu-sh4/cpu/sh7734.h
+index 96f0246ad2f2..82b63208135a 100644
+--- a/arch/sh/include/cpu-sh4/cpu/sh7734.h
++++ b/arch/sh/include/cpu-sh4/cpu/sh7734.h
+@@ -134,7 +134,7 @@ enum {
+ 	GPIO_FN_EX_WAIT1, GPIO_FN_SD1_DAT0_A, GPIO_FN_DREQ2, GPIO_FN_CAN1_TX_C,
+ 		GPIO_FN_ET0_LINK_C, GPIO_FN_ET0_ETXD5_A,
+ 	GPIO_FN_EX_WAIT0, GPIO_FN_TCLK1_B,
+-	GPIO_FN_RD_WR, GPIO_FN_TCLK0,
++	GPIO_FN_RD_WR, GPIO_FN_TCLK0, GPIO_FN_CAN_CLK_B, GPIO_FN_ET0_ETXD4,
+ 	GPIO_FN_EX_CS5, GPIO_FN_SD1_CMD_A, GPIO_FN_ATADIR, GPIO_FN_QSSL_B,
+ 		GPIO_FN_ET0_ETXD3_A,
+ 	GPIO_FN_EX_CS4, GPIO_FN_SD1_WP_A, GPIO_FN_ATAWR, GPIO_FN_QMI_QIO1_B,
+diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7734.c b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
+index 5dfd991ffdaa..dbc36079c381 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-sh7734.c
++++ b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
+@@ -1450,7 +1450,7 @@ static const struct pinmux_func pinmux_func_gpios[] = {
+ 	GPIO_FN(ET0_ETXD2_A),
+ 	GPIO_FN(EX_CS5), GPIO_FN(SD1_CMD_A), GPIO_FN(ATADIR), GPIO_FN(QSSL_B),
+ 	GPIO_FN(ET0_ETXD3_A),
+-	GPIO_FN(RD_WR), GPIO_FN(TCLK1_B),
++	GPIO_FN(RD_WR), GPIO_FN(TCLK0), GPIO_FN(CAN_CLK_B), GPIO_FN(ET0_ETXD4),
+ 	GPIO_FN(EX_WAIT0), GPIO_FN(TCLK1_B),
+ 	GPIO_FN(EX_WAIT1), GPIO_FN(SD1_DAT0_A), GPIO_FN(DREQ2),
+ 		GPIO_FN(CAN1_TX_C), GPIO_FN(ET0_LINK_C), GPIO_FN(ET0_ETXD5_A),
+@@ -1949,7 +1949,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ 	    /* IP3_20 [1] */
+ 		FN_EX_WAIT0, FN_TCLK1_B,
+ 	    /* IP3_19_18 [2] */
+-		FN_RD_WR, FN_TCLK1_B, 0, 0,
++		FN_RD_WR, FN_TCLK0, FN_CAN_CLK_B, FN_ET0_ETXD4,
+ 	    /* IP3_17_15 [3] */
+ 		FN_EX_CS5, FN_SD1_CMD_A, FN_ATADIR, FN_QSSL_B,
+ 		FN_ET0_ETXD3_A, 0, 0, 0,
+-- 
+2.20.1
+
diff --git a/queue-5.4/power-supply-cpcap-battery-check-voltage-before-orde.patch b/queue-5.4/power-supply-cpcap-battery-check-voltage-before-orde.patch
new file mode 100644
index 00000000000..3b468b7040e
--- /dev/null
+++ b/queue-5.4/power-supply-cpcap-battery-check-voltage-before-orde.patch
@@ -0,0 +1,54 @@
+From 7acd77a0148bc1672f6ba7fa7dbc41fa73e58fd4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Oct 2019 15:30:04 -0700
+Subject: power: supply: cpcap-battery: Check voltage before orderly_poweroff
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 639c1524da3b273d20c42ff2387d08eb4b12e903 ]
+
+We can get the low voltage interrupt trigger sometimes way too early,
+maybe because of CPU load spikes. This causes orderly_poweroff() be
+called too easily.
+
+Let's check the voltage before orderly_poweroff in case it was not
+yet a permanent condition. We will be getting more interrupts anyways
+if the condition persists.
+
+Let's also show the measured voltages for low battery and battery
+empty warnings since we have them.
+
+Cc: Merlijn Wajer <merlijn@wizzup.org>
+Cc: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/cpcap-battery.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/power/supply/cpcap-battery.c b/drivers/power/supply/cpcap-battery.c
+index 61d6447d1966..00a96e4a1cdc 100644
+--- a/drivers/power/supply/cpcap-battery.c
++++ b/drivers/power/supply/cpcap-battery.c
+@@ -562,12 +562,14 @@ static irqreturn_t cpcap_battery_irq_thread(int irq, void *data)
+ 	switch (d->action) {
+ 	case CPCAP_BATTERY_IRQ_ACTION_BATTERY_LOW:
+ 		if (latest->current_ua >= 0)
+-			dev_warn(ddata->dev, "Battery low at 3.3V!\n");
++			dev_warn(ddata->dev, "Battery low at %imV!\n",
++				latest->voltage / 1000);
+ 		break;
+ 	case CPCAP_BATTERY_IRQ_ACTION_POWEROFF:
+-		if (latest->current_ua >= 0) {
++		if (latest->current_ua >= 0 && latest->voltage <= 3200000) {
+ 			dev_emerg(ddata->dev,
+-				  "Battery empty at 3.1V, powering off\n");
++				  "Battery empty at %imV, powering off\n",
++				  latest->voltage / 1000);
+ 			orderly_poweroff(true);
+ 		}
+ 		break;
+-- 
+2.20.1
+
diff --git a/queue-5.4/qtnfmac-fix-debugfs-support-for-multiple-cards.patch b/queue-5.4/qtnfmac-fix-debugfs-support-for-multiple-cards.patch
new file mode 100644
index 00000000000..fdb674a33ae
--- /dev/null
+++ b/queue-5.4/qtnfmac-fix-debugfs-support-for-multiple-cards.patch
@@ -0,0 +1,47 @@
+From 738fc5f9a61fad7c06b16117003d93ff09e6a3c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Nov 2019 11:06:49 +0000
+Subject: qtnfmac: fix debugfs support for multiple cards
+
+From: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
+
+[ Upstream commit dd4c2260dab04f5ae7bdb79b9470e7da56f48145 ]
+
+Fix merge artifact for commit 0b68fe10b8e8 ("qtnfmac: modify debugfs
+to support multiple cards") and finally add debugfs support
+for multiple qtnfmac wireless cards.
+
+Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/quantenna/qtnfmac/pcie/pcie.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/quantenna/qtnfmac/pcie/pcie.c b/drivers/net/wireless/quantenna/qtnfmac/pcie/pcie.c
+index 8ae318b5fe54..4824be0c6231 100644
+--- a/drivers/net/wireless/quantenna/qtnfmac/pcie/pcie.c
++++ b/drivers/net/wireless/quantenna/qtnfmac/pcie/pcie.c
+@@ -130,6 +130,8 @@ static int qtnf_dbg_shm_stats(struct seq_file *s, void *data)
+ 
+ int qtnf_pcie_fw_boot_done(struct qtnf_bus *bus)
+ {
++	struct qtnf_pcie_bus_priv *priv = get_bus_priv(bus);
++	char card_id[64];
+ 	int ret;
+ 
+ 	bus->fw_state = QTNF_FW_STATE_BOOT_DONE;
+@@ -137,7 +139,9 @@ int qtnf_pcie_fw_boot_done(struct qtnf_bus *bus)
+ 	if (ret) {
+ 		pr_err("failed to attach core\n");
+ 	} else {
+-		qtnf_debugfs_init(bus, DRV_NAME);
++		snprintf(card_id, sizeof(card_id), "%s:%s",
++			 DRV_NAME, pci_name(priv->pdev));
++		qtnf_debugfs_init(bus, card_id);
+ 		qtnf_debugfs_add_entry(bus, "mps", qtnf_dbg_mps_show);
+ 		qtnf_debugfs_add_entry(bus, "msi_enabled", qtnf_dbg_msi_show);
+ 		qtnf_debugfs_add_entry(bus, "shm_stats", qtnf_dbg_shm_stats);
+-- 
+2.20.1
+
diff --git a/queue-5.4/qtnfmac-fix-invalid-channel-information-output.patch b/queue-5.4/qtnfmac-fix-invalid-channel-information-output.patch
new file mode 100644
index 00000000000..7eab4bbda73
--- /dev/null
+++ b/queue-5.4/qtnfmac-fix-invalid-channel-information-output.patch
@@ -0,0 +1,47 @@
+From d9ee02cb3c942300855b490f52d4a49e9d2fcbda Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Nov 2019 11:06:51 +0000
+Subject: qtnfmac: fix invalid channel information output
+
+From: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
+
+[ Upstream commit 24227a9e956a7c9913a7e6e7199a9ae3f540fe88 ]
+
+Do not attempt to print frequency for an invalid channel
+provided by firmware. That channel may simply not exist.
+
+Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/quantenna/qtnfmac/event.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/quantenna/qtnfmac/event.c b/drivers/net/wireless/quantenna/qtnfmac/event.c
+index b57c8c18a8d0..7846383c8828 100644
+--- a/drivers/net/wireless/quantenna/qtnfmac/event.c
++++ b/drivers/net/wireless/quantenna/qtnfmac/event.c
+@@ -171,8 +171,9 @@ qtnf_event_handle_bss_join(struct qtnf_vif *vif,
+ 		return -EPROTO;
+ 	}
+ 
+-	pr_debug("VIF%u.%u: BSSID:%pM status:%u\n",
+-		 vif->mac->macid, vif->vifid, join_info->bssid, status);
++	pr_debug("VIF%u.%u: BSSID:%pM chan:%u status:%u\n",
++		 vif->mac->macid, vif->vifid, join_info->bssid,
++		 le16_to_cpu(join_info->chan.chan.center_freq), status);
+ 
+ 	if (status != WLAN_STATUS_SUCCESS)
+ 		goto done;
+@@ -181,7 +182,7 @@ qtnf_event_handle_bss_join(struct qtnf_vif *vif,
+ 	if (!cfg80211_chandef_valid(&chandef)) {
+ 		pr_warn("MAC%u.%u: bad channel freq=%u cf1=%u cf2=%u bw=%u\n",
+ 			vif->mac->macid, vif->vifid,
+-			chandef.chan->center_freq,
++			chandef.chan ? chandef.chan->center_freq : 0,
+ 			chandef.center_freq1,
+ 			chandef.center_freq2,
+ 			chandef.width);
+-- 
+2.20.1
+
diff --git a/queue-5.4/qtnfmac-fix-using-skb-after-free.patch b/queue-5.4/qtnfmac-fix-using-skb-after-free.patch
new file mode 100644
index 00000000000..d4df9426bcd
--- /dev/null
+++ b/queue-5.4/qtnfmac-fix-using-skb-after-free.patch
@@ -0,0 +1,60 @@
+From 08ab50253f04f447ced1c36a92ebee5133e156c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Nov 2019 11:06:47 +0000
+Subject: qtnfmac: fix using skb after free
+
+From: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
+
+[ Upstream commit 4a33f21cef84b1b933958c99ed5dac1726214b35 ]
+
+KASAN reported use-after-free error:
+
+[  995.220767] BUG: KASAN: use-after-free in qtnf_cmd_send_with_reply+0x169/0x3e0 [qtnfmac]
+[  995.221098] Read of size 2 at addr ffff888213d1ded0 by task kworker/1:1/71
+
+The issue in qtnf_cmd_send_with_reply impacts all the commands that do
+not need response other then return code. For such commands, consume_skb
+is used for response skb and right after that return code in response
+skb is accessed.
+
+Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/quantenna/qtnfmac/commands.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/quantenna/qtnfmac/commands.c b/drivers/net/wireless/quantenna/qtnfmac/commands.c
+index dc0c7244b60e..c0c32805fb8d 100644
+--- a/drivers/net/wireless/quantenna/qtnfmac/commands.c
++++ b/drivers/net/wireless/quantenna/qtnfmac/commands.c
+@@ -83,6 +83,7 @@ static int qtnf_cmd_send_with_reply(struct qtnf_bus *bus,
+ 	struct qlink_cmd *cmd;
+ 	struct qlink_resp *resp = NULL;
+ 	struct sk_buff *resp_skb = NULL;
++	int resp_res = 0;
+ 	u16 cmd_id;
+ 	u8 mac_id;
+ 	u8 vif_id;
+@@ -113,6 +114,7 @@ static int qtnf_cmd_send_with_reply(struct qtnf_bus *bus,
+ 	}
+ 
+ 	resp = (struct qlink_resp *)resp_skb->data;
++	resp_res = le16_to_cpu(resp->result);
+ 	ret = qtnf_cmd_check_reply_header(resp, cmd_id, mac_id, vif_id,
+ 					  const_resp_size);
+ 	if (ret)
+@@ -128,8 +130,8 @@ out:
+ 	else
+ 		consume_skb(resp_skb);
+ 
+-	if (!ret && resp)
+-		return qtnf_cmd_resp_result_decode(le16_to_cpu(resp->result));
++	if (!ret)
++		return qtnf_cmd_resp_result_decode(resp_res);
+ 
+ 	pr_warn("VIF%u.%u: cmd 0x%.4X failed: %d\n",
+ 		mac_id, vif_id, cmd_id, ret);
+-- 
+2.20.1
+
diff --git a/queue-5.4/r8169-respect-eee-user-setting-when-restarting-netwo.patch b/queue-5.4/r8169-respect-eee-user-setting-when-restarting-netwo.patch
new file mode 100644
index 00000000000..65e444dfb26
--- /dev/null
+++ b/queue-5.4/r8169-respect-eee-user-setting-when-restarting-netwo.patch
@@ -0,0 +1,75 @@
+From 32ae6858eac1488a03baa17e7e3d03a50447c393 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Nov 2019 14:44:54 +0100
+Subject: r8169: respect EEE user setting when restarting network
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+[ Upstream commit 7ec3f872bc85ada93db34448d73bb399d6b82c2c ]
+
+Currently, if network is re-started, we advertise all supported EEE
+modes, thus potentially overriding a manual adjustment the user made
+e.g. via ethtool. Be friendly to the user and preserve a manual
+setting on network re-start.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 18 +++++++++++++++---
+ 1 file changed, 15 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
+index 4fe0977d01fa..5ae0b5663d54 100644
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -680,6 +680,7 @@ struct rtl8169_private {
+ 	struct rtl8169_counters *counters;
+ 	struct rtl8169_tc_offsets tc_offset;
+ 	u32 saved_wolopts;
++	int eee_adv;
+ 
+ 	const char *fw_name;
+ 	struct rtl_fw *rtl_fw;
+@@ -2075,6 +2076,10 @@ static int rtl8169_set_eee(struct net_device *dev, struct ethtool_eee *data)
+ 	}
+ 
+ 	ret = phy_ethtool_set_eee(tp->phydev, data);
++
++	if (!ret)
++		tp->eee_adv = phy_read_mmd(dev->phydev, MDIO_MMD_AN,
++					   MDIO_AN_EEE_ADV);
+ out:
+ 	pm_runtime_put_noidle(d);
+ 	return ret;
+@@ -2105,10 +2110,16 @@ static const struct ethtool_ops rtl8169_ethtool_ops = {
+ static void rtl_enable_eee(struct rtl8169_private *tp)
+ {
+ 	struct phy_device *phydev = tp->phydev;
+-	int supported = phy_read_mmd(phydev, MDIO_MMD_PCS, MDIO_PCS_EEE_ABLE);
++	int adv;
++
++	/* respect EEE advertisement the user may have set */
++	if (tp->eee_adv >= 0)
++		adv = tp->eee_adv;
++	else
++		adv = phy_read_mmd(phydev, MDIO_MMD_PCS, MDIO_PCS_EEE_ABLE);
+ 
+-	if (supported > 0)
+-		phy_write_mmd(phydev, MDIO_MMD_AN, MDIO_AN_EEE_ADV, supported);
++	if (adv >= 0)
++		phy_write_mmd(phydev, MDIO_MMD_AN, MDIO_AN_EEE_ADV, adv);
+ }
+ 
+ static void rtl8169_get_mac_version(struct rtl8169_private *tp)
+@@ -7064,6 +7075,7 @@ static int rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 	tp->pci_dev = pdev;
+ 	tp->msg_enable = netif_msg_init(debug.msg_enable, R8169_MSG_DEFAULT);
+ 	tp->supports_gmii = ent->driver_data == RTL_CFG_NO_GBIT ? 0 : 1;
++	tp->eee_adv = -1;
+ 
+ 	/* Get the *optional* external "ether_clk" used on some boards */
+ 	rc = rtl_get_ether_clk(tp);
+-- 
+2.20.1
+
diff --git a/queue-5.4/rdma-bnxt_re-fix-chip-number-validation-broadcom-s-g.patch b/queue-5.4/rdma-bnxt_re-fix-chip-number-validation-broadcom-s-g.patch
new file mode 100644
index 00000000000..ee73ecaaba1
--- /dev/null
+++ b/queue-5.4/rdma-bnxt_re-fix-chip-number-validation-broadcom-s-g.patch
@@ -0,0 +1,56 @@
+From 6f54c772bdacfb8c026624b4bef05064e4509835 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Nov 2019 01:22:21 -0500
+Subject: RDMA/bnxt_re: Fix chip number validation Broadcom's Gen P5 series
+
+From: Luke Starrett <luke.starrett@broadcom.com>
+
+[ Upstream commit e284b159c6881c8bec9713daba2653268f4c4948 ]
+
+In the first version of Gen P5 ASIC, chip-id was always set to 0x1750 for
+all adaptor port configurations. This has been fixed in the new chip rev.
+
+Due to this missing fix users are not able to use adaptors based on latest
+chip rev of Broadcom's Gen P5 adaptors.
+
+Fixes: ae8637e13185 ("RDMA/bnxt_re: Add chip context to identify 57500 series")
+Link: https://lore.kernel.org/r/1574317343-23300-2-git-send-email-devesh.sharma@broadcom.com
+Signed-off-by: Naresh Kumar PBS <nareshkumar.pbs@broadcom.com>
+Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
+Signed-off-by: Luke Starrett <luke.starrett@broadcom.com>
+Signed-off-by: Devesh Sharma <devesh.sharma@broadcom.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/bnxt_re/qplib_res.h | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/hw/bnxt_re/qplib_res.h b/drivers/infiniband/hw/bnxt_re/qplib_res.h
+index fbda11a7ab1a..aaa76d792185 100644
+--- a/drivers/infiniband/hw/bnxt_re/qplib_res.h
++++ b/drivers/infiniband/hw/bnxt_re/qplib_res.h
+@@ -186,7 +186,9 @@ struct bnxt_qplib_chip_ctx {
+ 	u8	chip_metal;
+ };
+ 
+-#define CHIP_NUM_57500          0x1750
++#define CHIP_NUM_57508		0x1750
++#define CHIP_NUM_57504		0x1751
++#define CHIP_NUM_57502		0x1752
+ 
+ struct bnxt_qplib_res {
+ 	struct pci_dev			*pdev;
+@@ -203,7 +205,9 @@ struct bnxt_qplib_res {
+ 
+ static inline bool bnxt_qplib_is_chip_gen_p5(struct bnxt_qplib_chip_ctx *cctx)
+ {
+-	return (cctx->chip_num == CHIP_NUM_57500);
++	return (cctx->chip_num == CHIP_NUM_57508 ||
++		cctx->chip_num == CHIP_NUM_57504 ||
++		cctx->chip_num == CHIP_NUM_57502);
+ }
+ 
+ static inline u8 bnxt_qplib_get_hwq_type(struct bnxt_qplib_res *res)
+-- 
+2.20.1
+
diff --git a/queue-5.4/rdma-bnxt_re-fix-missing-le16_to_cpu.patch b/queue-5.4/rdma-bnxt_re-fix-missing-le16_to_cpu.patch
new file mode 100644
index 00000000000..504e3b336cc
--- /dev/null
+++ b/queue-5.4/rdma-bnxt_re-fix-missing-le16_to_cpu.patch
@@ -0,0 +1,47 @@
+From b3ad089c7bdce3ed3de9fb32d5f14b0d20af738c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Nov 2019 01:22:23 -0500
+Subject: RDMA/bnxt_re: Fix missing le16_to_cpu
+
+From: Devesh Sharma <devesh.sharma@broadcom.com>
+
+[ Upstream commit fca5b9dc0986aa49b3f0a7cfe24b6c82422ac1d7 ]
+
+From sparse:
+
+drivers/infiniband/hw/bnxt_re/main.c:1274:18: warning: cast from restricted __le16
+drivers/infiniband/hw/bnxt_re/main.c:1275:18: warning: cast from restricted __le16
+drivers/infiniband/hw/bnxt_re/main.c:1276:18: warning: cast from restricted __le16
+drivers/infiniband/hw/bnxt_re/main.c:1277:21: warning: restricted __le16 degrades to integer
+
+Fixes: 2b827ea1926b ("RDMA/bnxt_re: Query HWRM Interface version from FW")
+Link: https://lore.kernel.org/r/1574317343-23300-4-git-send-email-devesh.sharma@broadcom.com
+Signed-off-by: Devesh Sharma <devesh.sharma@broadcom.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/bnxt_re/main.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c
+index 30a54f8aa42c..b31e21588200 100644
+--- a/drivers/infiniband/hw/bnxt_re/main.c
++++ b/drivers/infiniband/hw/bnxt_re/main.c
+@@ -1270,10 +1270,10 @@ static void bnxt_re_query_hwrm_intf_version(struct bnxt_re_dev *rdev)
+ 		return;
+ 	}
+ 	rdev->qplib_ctx.hwrm_intf_ver =
+-		(u64)resp.hwrm_intf_major << 48 |
+-		(u64)resp.hwrm_intf_minor << 32 |
+-		(u64)resp.hwrm_intf_build << 16 |
+-		resp.hwrm_intf_patch;
++		(u64)le16_to_cpu(resp.hwrm_intf_major) << 48 |
++		(u64)le16_to_cpu(resp.hwrm_intf_minor) << 32 |
++		(u64)le16_to_cpu(resp.hwrm_intf_build) << 16 |
++		le16_to_cpu(resp.hwrm_intf_patch);
+ }
+ 
+ static void bnxt_re_ib_unreg(struct bnxt_re_dev *rdev)
+-- 
+2.20.1
+
diff --git a/queue-5.4/rdma-bnxt_re-fix-stat-push-into-dma-buffer-on-gen-p5.patch b/queue-5.4/rdma-bnxt_re-fix-stat-push-into-dma-buffer-on-gen-p5.patch
new file mode 100644
index 00000000000..1466240d8da
--- /dev/null
+++ b/queue-5.4/rdma-bnxt_re-fix-stat-push-into-dma-buffer-on-gen-p5.patch
@@ -0,0 +1,40 @@
+From af6b021ca0b23676a87ea764f85291a3bbb021d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Nov 2019 01:22:22 -0500
+Subject: RDMA/bnxt_re: Fix stat push into dma buffer on gen p5 devices
+
+From: Devesh Sharma <devesh.sharma@broadcom.com>
+
+[ Upstream commit 98998ffe5216c7fa2c0225bb5b049ca5cdf8d195 ]
+
+Due to recent advances in the firmware for Broadcom's gen p5 series of
+adaptors the driver code to report hardware counters has been broken
+w.r.t. roce devices.
+
+The new firmware command expects dma length to be specified during stat
+dma buffer allocation.
+
+Fixes: 2792b5b95ed5 ("bnxt_en: Update firmware interface spec. to 1.10.0.89.")
+Link: https://lore.kernel.org/r/1574317343-23300-3-git-send-email-devesh.sharma@broadcom.com
+Signed-off-by: Devesh Sharma <devesh.sharma@broadcom.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/bnxt_re/main.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c
+index b31e21588200..27e2df44d043 100644
+--- a/drivers/infiniband/hw/bnxt_re/main.c
++++ b/drivers/infiniband/hw/bnxt_re/main.c
+@@ -477,6 +477,7 @@ static int bnxt_re_net_stats_ctx_alloc(struct bnxt_re_dev *rdev,
+ 	bnxt_re_init_hwrm_hdr(rdev, (void *)&req, HWRM_STAT_CTX_ALLOC, -1, -1);
+ 	req.update_period_ms = cpu_to_le32(1000);
+ 	req.stats_dma_addr = cpu_to_le64(dma_map);
++	req.stats_dma_length = cpu_to_le16(sizeof(struct ctx_hw_stats_ext));
+ 	req.stat_ctx_flags = STAT_CTX_ALLOC_REQ_STAT_CTX_FLAGS_ROCE;
+ 	bnxt_re_fill_fw_msg(&fw_msg, (void *)&req, sizeof(req), (void *)&resp,
+ 			    sizeof(resp), DFLT_HWRM_CMD_TIMEOUT);
+-- 
+2.20.1
+
diff --git a/queue-5.4/rdma-core-fix-return-code-when-modify_port-isn-t-sup.patch b/queue-5.4/rdma-core-fix-return-code-when-modify_port-isn-t-sup.patch
new file mode 100644
index 00000000000..d4fbd2230a0
--- /dev/null
+++ b/queue-5.4/rdma-core-fix-return-code-when-modify_port-isn-t-sup.patch
@@ -0,0 +1,47 @@
+From 34d37851d360afb23f7b462c479bb0105d90042d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Oct 2019 17:59:28 +0200
+Subject: RDMA/core: Fix return code when modify_port isn't supported
+
+From: Kamal Heib <kamalheib1@gmail.com>
+
+[ Upstream commit 55bfe905fa97633438c13fb029aed85371d85480 ]
+
+Improve return code from ib_modify_port() by doing the following:
+ - Use "-EOPNOTSUPP" instead "-ENOSYS" which is the proper return code
+
+ - Allow only fake IB_PORT_CM_SUP manipulation for RoCE providers that
+   didn't implement the modify_port callback, otherwise return
+   "-EOPNOTSUPP"
+
+Fixes: 61e0962d5221 ("IB: Avoid ib_modify_port() failure for RoCE devices")
+Link: https://lore.kernel.org/r/20191028155931.1114-2-kamalheib1@gmail.com
+Signed-off-by: Kamal Heib <kamalheib1@gmail.com>
+Reviewed-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/device.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
+index e6327d8f5b79..2b5bd7206fc6 100644
+--- a/drivers/infiniband/core/device.c
++++ b/drivers/infiniband/core/device.c
+@@ -2409,8 +2409,12 @@ int ib_modify_port(struct ib_device *device,
+ 		rc = device->ops.modify_port(device, port_num,
+ 					     port_modify_mask,
+ 					     port_modify);
++	else if (rdma_protocol_roce(device, port_num) &&
++		 ((port_modify->set_port_cap_mask & ~IB_PORT_CM_SUP) == 0 ||
++		  (port_modify->clr_port_cap_mask & ~IB_PORT_CM_SUP) == 0))
++		rc = 0;
+ 	else
+-		rc = rdma_protocol_roce(device, port_num) ? 0 : -ENOSYS;
++		rc = -EOPNOTSUPP;
+ 	return rc;
+ }
+ EXPORT_SYMBOL(ib_modify_port);
+-- 
+2.20.1
+
diff --git a/queue-5.4/rdma-core-set-dma-parameters-correctly.patch b/queue-5.4/rdma-core-set-dma-parameters-correctly.patch
new file mode 100644
index 00000000000..8e1ac638c5f
--- /dev/null
+++ b/queue-5.4/rdma-core-set-dma-parameters-correctly.patch
@@ -0,0 +1,54 @@
+From e7027697ef3573ae15d61db4497b72ee1db4ae89 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Oct 2019 15:58:30 -0700
+Subject: RDMA/core: Set DMA parameters correctly
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit c9121262d57b8a3be4f08073546436ba0128ca6a ]
+
+The dma_set_max_seg_size() call in setup_dma_device() does not have any
+effect since device->dev.dma_parms is NULL. Fix this by initializing
+device->dev.dma_parms first.
+
+Link: https://lore.kernel.org/r/20191025225830.257535-5-bvanassche@acm.org
+Fixes: d10bcf947a3e ("RDMA/umem: Combine contiguous PAGE_SIZE regions in SGEs")
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Reviewed-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/device.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
+index 50a92442c4f7..e6327d8f5b79 100644
+--- a/drivers/infiniband/core/device.c
++++ b/drivers/infiniband/core/device.c
+@@ -1199,9 +1199,21 @@ static void setup_dma_device(struct ib_device *device)
+ 		WARN_ON_ONCE(!parent);
+ 		device->dma_device = parent;
+ 	}
+-	/* Setup default max segment size for all IB devices */
+-	dma_set_max_seg_size(device->dma_device, SZ_2G);
+ 
++	if (!device->dev.dma_parms) {
++		if (parent) {
++			/*
++			 * The caller did not provide DMA parameters, so
++			 * 'parent' probably represents a PCI device. The PCI
++			 * core sets the maximum segment size to 64
++			 * KB. Increase this parameter to 2 GB.
++			 */
++			device->dev.dma_parms = parent->dma_parms;
++			dma_set_max_seg_size(device->dma_device, SZ_2G);
++		} else {
++			WARN_ON_ONCE(true);
++		}
++	}
+ }
+ 
+ /*
+-- 
+2.20.1
+
diff --git a/queue-5.4/rdma-efa-clear-the-admin-command-buffer-prior-to-its.patch b/queue-5.4/rdma-efa-clear-the-admin-command-buffer-prior-to-its.patch
new file mode 100644
index 00000000000..0e0cfbd490a
--- /dev/null
+++ b/queue-5.4/rdma-efa-clear-the-admin-command-buffer-prior-to-its.patch
@@ -0,0 +1,54 @@
+From 7d158ee15ea4e438a23004d282c8b30724cdac28 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Nov 2019 11:26:08 +0200
+Subject: RDMA/efa: Clear the admin command buffer prior to its submission
+
+From: Gal Pressman <galpress@amazon.com>
+
+[ Upstream commit 64c264872b8879e2ab9017eefe9514d4c045c60e ]
+
+We cannot rely on the entry memcpy as we only copy the actual size of the
+command, the rest of the bytes must be memset to zero.
+
+Currently providing non-zero memory will not have any user visible impact.
+However, since admin commands are extendable (in a backwards compatible
+way) everything beyond the size of the command must be cleared to prevent
+issues in the future.
+
+Fixes: 0420e542569b ("RDMA/efa: Implement functions that submit and complete admin commands")
+Link: https://lore.kernel.org/r/20191112092608.46964-1-galpress@amazon.com
+Reviewed-by: Daniel Kranzdorf <dkkranzd@amazon.com>
+Reviewed-by: Firas JahJah <firasj@amazon.com>
+Signed-off-by: Gal Pressman <galpress@amazon.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/efa/efa_com.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/efa/efa_com.c b/drivers/infiniband/hw/efa/efa_com.c
+index 3c412bc5b94f..0778f4f7dccd 100644
+--- a/drivers/infiniband/hw/efa/efa_com.c
++++ b/drivers/infiniband/hw/efa/efa_com.c
+@@ -317,6 +317,7 @@ static struct efa_comp_ctx *__efa_com_submit_admin_cmd(struct efa_com_admin_queu
+ 						       struct efa_admin_acq_entry *comp,
+ 						       size_t comp_size_in_bytes)
+ {
++	struct efa_admin_aq_entry *aqe;
+ 	struct efa_comp_ctx *comp_ctx;
+ 	u16 queue_size_mask;
+ 	u16 cmd_id;
+@@ -350,7 +351,9 @@ static struct efa_comp_ctx *__efa_com_submit_admin_cmd(struct efa_com_admin_queu
+ 
+ 	reinit_completion(&comp_ctx->wait_event);
+ 
+-	memcpy(&aq->sq.entries[pi], cmd, cmd_size_in_bytes);
++	aqe = &aq->sq.entries[pi];
++	memset(aqe, 0, sizeof(*aqe));
++	memcpy(aqe, cmd, cmd_size_in_bytes);
+ 
+ 	aq->sq.pc++;
+ 	atomic64_inc(&aq->stats.submitted_cmd);
+-- 
+2.20.1
+
diff --git a/queue-5.4/rdma-hns-fix-memory-leak-on-context-on-error-return-.patch b/queue-5.4/rdma-hns-fix-memory-leak-on-context-on-error-return-.patch
new file mode 100644
index 00000000000..3297ef73ef9
--- /dev/null
+++ b/queue-5.4/rdma-hns-fix-memory-leak-on-context-on-error-return-.patch
@@ -0,0 +1,61 @@
+From 0390be24d3baa8c03a792c3cdf61218ff4d01db8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Oct 2019 14:10:34 +0100
+Subject: RDMA/hns: Fix memory leak on 'context' on error return path
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 994195e1537074f56df216a9309f6e366cb35b67 ]
+
+Currently, the error return path when the call to function
+dev->dfx->query_cqc_info fails will leak object 'context'. Fix this by
+making the error return path via 'err' return return codes rather than
+-EMSGSIZE, set ret appropriately for all error return paths and for the
+memory leak now return via 'err' rather than just returning without
+freeing context.
+
+Link: https://lore.kernel.org/r/20191024131034.19989-1-colin.king@canonical.com
+Addresses-Coverity: ("Resource leak")
+Fixes: e1c9a0dc2939 ("RDMA/hns: Dump detailed driver-specific CQ")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Reviewed-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_restrack.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_restrack.c b/drivers/infiniband/hw/hns/hns_roce_restrack.c
+index 0a31d0a3d657..06871731ac43 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_restrack.c
++++ b/drivers/infiniband/hw/hns/hns_roce_restrack.c
+@@ -98,11 +98,15 @@ static int hns_roce_fill_res_cq_entry(struct sk_buff *msg,
+ 		goto err;
+ 
+ 	table_attr = nla_nest_start(msg, RDMA_NLDEV_ATTR_DRIVER);
+-	if (!table_attr)
++	if (!table_attr) {
++		ret = -EMSGSIZE;
+ 		goto err;
++	}
+ 
+-	if (hns_roce_fill_cq(msg, context))
++	if (hns_roce_fill_cq(msg, context)) {
++		ret = -EMSGSIZE;
+ 		goto err_cancel_table;
++	}
+ 
+ 	nla_nest_end(msg, table_attr);
+ 	kfree(context);
+@@ -113,7 +117,7 @@ err_cancel_table:
+ 	nla_nest_cancel(msg, table_attr);
+ err:
+ 	kfree(context);
+-	return -EMSGSIZE;
++	return ret;
+ }
+ 
+ int hns_roce_fill_res_entry(struct sk_buff *msg,
+-- 
+2.20.1
+
diff --git a/queue-5.4/rdma-hns-fix-wrong-parameters-when-initial-mtt-of-sr.patch b/queue-5.4/rdma-hns-fix-wrong-parameters-when-initial-mtt-of-sr.patch
new file mode 100644
index 00000000000..d05c7bdcc35
--- /dev/null
+++ b/queue-5.4/rdma-hns-fix-wrong-parameters-when-initial-mtt-of-sr.patch
@@ -0,0 +1,76 @@
+From 71a40e76a8eb97406da3f56dfd528c636f621693 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Sep 2019 11:14:42 +0800
+Subject: RDMA/hns: Fix wrong parameters when initial mtt of srq->idx_que
+
+From: Weihang Li <liweihang@hisilicon.com>
+
+[ Upstream commit e8a07de57ea4ca7c2d604871c52826e66899fc70 ]
+
+The parameters npages used to initial mtt of srq->idx_que shouldn't be
+same with srq's. And page_shift should be calculated from idx_buf_pg_sz.
+This patch fixes above issues and use field named npage and page_shift
+in hns_roce_buf instead of two temporary variables to let us use them
+anywhere.
+
+Fixes: 18df508c7970 ("RDMA/hns: Remove if-else judgment statements for creating srq")
+Signed-off-by: Weihang Li <liweihang@hisilicon.com>
+Link: https://lore.kernel.org/r/1567566885-23088-3-git-send-email-liweihang@hisilicon.com
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_srq.c | 24 ++++++++++++++----------
+ 1 file changed, 14 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_srq.c b/drivers/infiniband/hw/hns/hns_roce_srq.c
+index 43ea2c13b212..108667ae6b14 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_srq.c
++++ b/drivers/infiniband/hw/hns/hns_roce_srq.c
+@@ -180,8 +180,7 @@ static int create_user_srq(struct hns_roce_srq *srq, struct ib_udata *udata,
+ {
+ 	struct hns_roce_dev *hr_dev = to_hr_dev(srq->ibsrq.device);
+ 	struct hns_roce_ib_create_srq  ucmd;
+-	u32 page_shift;
+-	u32 npages;
++	struct hns_roce_buf *buf;
+ 	int ret;
+ 
+ 	if (ib_copy_from_udata(&ucmd, udata, sizeof(ucmd)))
+@@ -191,11 +190,13 @@ static int create_user_srq(struct hns_roce_srq *srq, struct ib_udata *udata,
+ 	if (IS_ERR(srq->umem))
+ 		return PTR_ERR(srq->umem);
+ 
+-	npages = (ib_umem_page_count(srq->umem) +
+-		(1 << hr_dev->caps.srqwqe_buf_pg_sz) - 1) /
+-		(1 << hr_dev->caps.srqwqe_buf_pg_sz);
+-	page_shift = PAGE_SHIFT + hr_dev->caps.srqwqe_buf_pg_sz;
+-	ret = hns_roce_mtt_init(hr_dev, npages, page_shift, &srq->mtt);
++	buf = &srq->buf;
++	buf->npages = (ib_umem_page_count(srq->umem) +
++		       (1 << hr_dev->caps.srqwqe_buf_pg_sz) - 1) /
++		      (1 << hr_dev->caps.srqwqe_buf_pg_sz);
++	buf->page_shift = PAGE_SHIFT + hr_dev->caps.srqwqe_buf_pg_sz;
++	ret = hns_roce_mtt_init(hr_dev, buf->npages, buf->page_shift,
++				&srq->mtt);
+ 	if (ret)
+ 		goto err_user_buf;
+ 
+@@ -212,9 +213,12 @@ static int create_user_srq(struct hns_roce_srq *srq, struct ib_udata *udata,
+ 		goto err_user_srq_mtt;
+ 	}
+ 
+-	ret = hns_roce_mtt_init(hr_dev, ib_umem_page_count(srq->idx_que.umem),
+-				PAGE_SHIFT, &srq->idx_que.mtt);
+-
++	buf = &srq->idx_que.idx_buf;
++	buf->npages = DIV_ROUND_UP(ib_umem_page_count(srq->idx_que.umem),
++				   1 << hr_dev->caps.idx_buf_pg_sz);
++	buf->page_shift = PAGE_SHIFT + hr_dev->caps.idx_buf_pg_sz;
++	ret = hns_roce_mtt_init(hr_dev, buf->npages, buf->page_shift,
++				&srq->idx_que.mtt);
+ 	if (ret) {
+ 		dev_err(hr_dev->dev, "hns_roce_mtt_init error for idx que\n");
+ 		goto err_user_idx_mtt;
+-- 
+2.20.1
+
diff --git a/queue-5.4/rdma-qedr-fix-memory-leak-in-user-qp-and-mr.patch b/queue-5.4/rdma-qedr-fix-memory-leak-in-user-qp-and-mr.patch
new file mode 100644
index 00000000000..3edeadc5c71
--- /dev/null
+++ b/queue-5.4/rdma-qedr-fix-memory-leak-in-user-qp-and-mr.patch
@@ -0,0 +1,55 @@
+From 8b0650599afde380f5701c6c35daefc271b758c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Oct 2019 22:04:51 +0200
+Subject: RDMA/qedr: Fix memory leak in user qp and mr
+
+From: Michal Kalderon <michal.kalderon@marvell.com>
+
+[ Upstream commit 24e412c1e00ebfe73619e6b88cbc26c2c7d41b85 ]
+
+User QPs pbl's weren't freed properly.
+MR pbls weren't freed properly.
+
+Fixes: e0290cce6ac0 ("qedr: Add support for memory registeration verbs")
+Link: https://lore.kernel.org/r/20191027200451.28187-5-michal.kalderon@marvell.com
+Signed-off-by: Ariel Elior <ariel.elior@marvell.com>
+Signed-off-by: Michal Kalderon <michal.kalderon@marvell.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/qedr/verbs.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
+index 6f3ce86019b7..a7ccca3c4f89 100644
+--- a/drivers/infiniband/hw/qedr/verbs.c
++++ b/drivers/infiniband/hw/qedr/verbs.c
+@@ -1577,6 +1577,14 @@ static void qedr_cleanup_user(struct qedr_dev *dev, struct qedr_qp *qp)
+ 
+ 	ib_umem_release(qp->urq.umem);
+ 	qp->urq.umem = NULL;
++
++	if (rdma_protocol_roce(&dev->ibdev, 1)) {
++		qedr_free_pbl(dev, &qp->usq.pbl_info, qp->usq.pbl_tbl);
++		qedr_free_pbl(dev, &qp->urq.pbl_info, qp->urq.pbl_tbl);
++	} else {
++		kfree(qp->usq.pbl_tbl);
++		kfree(qp->urq.pbl_tbl);
++	}
+ }
+ 
+ static int qedr_create_user_qp(struct qedr_dev *dev,
+@@ -2673,8 +2681,8 @@ int qedr_dereg_mr(struct ib_mr *ib_mr, struct ib_udata *udata)
+ 
+ 	dev->ops->rdma_free_tid(dev->rdma_ctx, mr->hw_mr.itid);
+ 
+-	if ((mr->type != QEDR_MR_DMA) && (mr->type != QEDR_MR_FRMR))
+-		qedr_free_pbl(dev, &mr->info.pbl_info, mr->info.pbl_table);
++	if (mr->type != QEDR_MR_DMA)
++		free_mr_info(dev, &mr->info);
+ 
+ 	/* it could be user registered memory. */
+ 	ib_umem_release(mr->umem);
+-- 
+2.20.1
+
diff --git a/queue-5.4/rdma-qedr-fix-srqs-xarray-initialization.patch b/queue-5.4/rdma-qedr-fix-srqs-xarray-initialization.patch
new file mode 100644
index 00000000000..958eb863c07
--- /dev/null
+++ b/queue-5.4/rdma-qedr-fix-srqs-xarray-initialization.patch
@@ -0,0 +1,39 @@
+From 9110c7c08c85d905ca6e86ebbda63d1e006f0801 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Oct 2019 22:04:48 +0200
+Subject: RDMA/qedr: Fix srqs xarray initialization
+
+From: Michal Kalderon <michal.kalderon@marvell.com>
+
+[ Upstream commit 73ab512f720298aabe23b34110e3f6a8545b0ba5 ]
+
+There was a missing initialization for the srqs xarray.
+SRQs xarray can also be called from irq context when searching
+for an element and uses the xa_XXX_irq apis, therefore should
+be initialized with IRQ flags.
+
+Fixes: 9fd15987ed27 ("qedr: Convert srqidr to XArray")
+Link: https://lore.kernel.org/r/20191027200451.28187-2-michal.kalderon@marvell.com
+Signed-off-by: Ariel Elior <ariel.elior@marvell.com>
+Signed-off-by: Michal Kalderon <michal.kalderon@marvell.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/qedr/main.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/infiniband/hw/qedr/main.c b/drivers/infiniband/hw/qedr/main.c
+index dc71b6e16a07..b462eaca1ee3 100644
+--- a/drivers/infiniband/hw/qedr/main.c
++++ b/drivers/infiniband/hw/qedr/main.c
+@@ -357,6 +357,7 @@ static int qedr_alloc_resources(struct qedr_dev *dev)
+ 		return -ENOMEM;
+ 
+ 	spin_lock_init(&dev->sgid_lock);
++	xa_init_flags(&dev->srqs, XA_FLAGS_LOCK_IRQ);
+ 
+ 	if (IS_IWARP(dev)) {
+ 		xa_init_flags(&dev->qps, XA_FLAGS_LOCK_IRQ);
+-- 
+2.20.1
+
diff --git a/queue-5.4/rdma-siw-fix-sq-rq-drain-logic.patch b/queue-5.4/rdma-siw-fix-sq-rq-drain-logic.patch
new file mode 100644
index 00000000000..65c00acab6d
--- /dev/null
+++ b/queue-5.4/rdma-siw-fix-sq-rq-drain-logic.patch
@@ -0,0 +1,253 @@
+From 68b7b719535afca7cfec5a66da1a72c2540e599c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Oct 2019 14:53:56 +0200
+Subject: RDMA/siw: Fix SQ/RQ drain logic
+
+From: Bernard Metzler <bmt@zurich.ibm.com>
+
+[ Upstream commit cf049bb31f7101d9672eaf97ade4fdd5171ddf26 ]
+
+Storage ULPs (e.g. iSER & NVMeOF) use ib_drain_qp() to drain
+QP/CQ. Current SIW's own drain routines do not properly wait until all
+SQ/RQ elements are completed and reaped from the CQ. This may cause touch
+after free issues.  New logic relies on generic
+__ib_drain_sq()/__ib_drain_rq() posting a final work request, which SIW
+immediately flushes to CQ.
+
+Fixes: 303ae1cdfdf7 ("rdma/siw: application interface")
+Link: https://lore.kernel.org/r/20191004125356.20673-1-bmt@zurich.ibm.com
+Signed-off-by: Krishnamraju Eraparaju <krishna2@chelsio.com>
+Signed-off-by: Bernard Metzler <bmt@zurich.ibm.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/siw/siw_main.c  |  20 ----
+ drivers/infiniband/sw/siw/siw_verbs.c | 144 ++++++++++++++++++++++----
+ 2 files changed, 122 insertions(+), 42 deletions(-)
+
+diff --git a/drivers/infiniband/sw/siw/siw_main.c b/drivers/infiniband/sw/siw/siw_main.c
+index 05a92f997f60..fb01407a310f 100644
+--- a/drivers/infiniband/sw/siw/siw_main.c
++++ b/drivers/infiniband/sw/siw/siw_main.c
+@@ -248,24 +248,6 @@ static struct ib_qp *siw_get_base_qp(struct ib_device *base_dev, int id)
+ 	return NULL;
+ }
+ 
+-static void siw_verbs_sq_flush(struct ib_qp *base_qp)
+-{
+-	struct siw_qp *qp = to_siw_qp(base_qp);
+-
+-	down_write(&qp->state_lock);
+-	siw_sq_flush(qp);
+-	up_write(&qp->state_lock);
+-}
+-
+-static void siw_verbs_rq_flush(struct ib_qp *base_qp)
+-{
+-	struct siw_qp *qp = to_siw_qp(base_qp);
+-
+-	down_write(&qp->state_lock);
+-	siw_rq_flush(qp);
+-	up_write(&qp->state_lock);
+-}
+-
+ static const struct ib_device_ops siw_device_ops = {
+ 	.owner = THIS_MODULE,
+ 	.uverbs_abi_ver = SIW_ABI_VERSION,
+@@ -284,8 +266,6 @@ static const struct ib_device_ops siw_device_ops = {
+ 	.destroy_cq = siw_destroy_cq,
+ 	.destroy_qp = siw_destroy_qp,
+ 	.destroy_srq = siw_destroy_srq,
+-	.drain_rq = siw_verbs_rq_flush,
+-	.drain_sq = siw_verbs_sq_flush,
+ 	.get_dma_mr = siw_get_dma_mr,
+ 	.get_port_immutable = siw_get_port_immutable,
+ 	.iw_accept = siw_accept,
+diff --git a/drivers/infiniband/sw/siw/siw_verbs.c b/drivers/infiniband/sw/siw/siw_verbs.c
+index b18a677832e1..7d0a7edc533d 100644
+--- a/drivers/infiniband/sw/siw/siw_verbs.c
++++ b/drivers/infiniband/sw/siw/siw_verbs.c
+@@ -685,6 +685,47 @@ static int siw_copy_inline_sgl(const struct ib_send_wr *core_wr,
+ 	return bytes;
+ }
+ 
++/* Complete SQ WR's without processing */
++static int siw_sq_flush_wr(struct siw_qp *qp, const struct ib_send_wr *wr,
++			   const struct ib_send_wr **bad_wr)
++{
++	struct siw_sqe sqe = {};
++	int rv = 0;
++
++	while (wr) {
++		sqe.id = wr->wr_id;
++		sqe.opcode = wr->opcode;
++		rv = siw_sqe_complete(qp, &sqe, 0, SIW_WC_WR_FLUSH_ERR);
++		if (rv) {
++			if (bad_wr)
++				*bad_wr = wr;
++			break;
++		}
++		wr = wr->next;
++	}
++	return rv;
++}
++
++/* Complete RQ WR's without processing */
++static int siw_rq_flush_wr(struct siw_qp *qp, const struct ib_recv_wr *wr,
++			   const struct ib_recv_wr **bad_wr)
++{
++	struct siw_rqe rqe = {};
++	int rv = 0;
++
++	while (wr) {
++		rqe.id = wr->wr_id;
++		rv = siw_rqe_complete(qp, &rqe, 0, 0, SIW_WC_WR_FLUSH_ERR);
++		if (rv) {
++			if (bad_wr)
++				*bad_wr = wr;
++			break;
++		}
++		wr = wr->next;
++	}
++	return rv;
++}
++
+ /*
+  * siw_post_send()
+  *
+@@ -703,26 +744,54 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,
+ 	unsigned long flags;
+ 	int rv = 0;
+ 
++	if (wr && !qp->kernel_verbs) {
++		siw_dbg_qp(qp, "wr must be empty for user mapped sq\n");
++		*bad_wr = wr;
++		return -EINVAL;
++	}
++
+ 	/*
+ 	 * Try to acquire QP state lock. Must be non-blocking
+ 	 * to accommodate kernel clients needs.
+ 	 */
+ 	if (!down_read_trylock(&qp->state_lock)) {
+-		*bad_wr = wr;
+-		siw_dbg_qp(qp, "QP locked, state %d\n", qp->attrs.state);
+-		return -ENOTCONN;
++		if (qp->attrs.state == SIW_QP_STATE_ERROR) {
++			/*
++			 * ERROR state is final, so we can be sure
++			 * this state will not change as long as the QP
++			 * exists.
++			 *
++			 * This handles an ib_drain_sq() call with
++			 * a concurrent request to set the QP state
++			 * to ERROR.
++			 */
++			rv = siw_sq_flush_wr(qp, wr, bad_wr);
++		} else {
++			siw_dbg_qp(qp, "QP locked, state %d\n",
++				   qp->attrs.state);
++			*bad_wr = wr;
++			rv = -ENOTCONN;
++		}
++		return rv;
+ 	}
+ 	if (unlikely(qp->attrs.state != SIW_QP_STATE_RTS)) {
++		if (qp->attrs.state == SIW_QP_STATE_ERROR) {
++			/*
++			 * Immediately flush this WR to CQ, if QP
++			 * is in ERROR state. SQ is guaranteed to
++			 * be empty, so WR complets in-order.
++			 *
++			 * Typically triggered by ib_drain_sq().
++			 */
++			rv = siw_sq_flush_wr(qp, wr, bad_wr);
++		} else {
++			siw_dbg_qp(qp, "QP out of state %d\n",
++				   qp->attrs.state);
++			*bad_wr = wr;
++			rv = -ENOTCONN;
++		}
+ 		up_read(&qp->state_lock);
+-		*bad_wr = wr;
+-		siw_dbg_qp(qp, "QP out of state %d\n", qp->attrs.state);
+-		return -ENOTCONN;
+-	}
+-	if (wr && !qp->kernel_verbs) {
+-		siw_dbg_qp(qp, "wr must be empty for user mapped sq\n");
+-		up_read(&qp->state_lock);
+-		*bad_wr = wr;
+-		return -EINVAL;
++		return rv;
+ 	}
+ 	spin_lock_irqsave(&qp->sq_lock, flags);
+ 
+@@ -917,24 +986,55 @@ int siw_post_receive(struct ib_qp *base_qp, const struct ib_recv_wr *wr,
+ 		*bad_wr = wr;
+ 		return -EOPNOTSUPP; /* what else from errno.h? */
+ 	}
+-	/*
+-	 * Try to acquire QP state lock. Must be non-blocking
+-	 * to accommodate kernel clients needs.
+-	 */
+-	if (!down_read_trylock(&qp->state_lock)) {
+-		*bad_wr = wr;
+-		return -ENOTCONN;
+-	}
+ 	if (!qp->kernel_verbs) {
+ 		siw_dbg_qp(qp, "no kernel post_recv for user mapped sq\n");
+ 		up_read(&qp->state_lock);
+ 		*bad_wr = wr;
+ 		return -EINVAL;
+ 	}
++
++	/*
++	 * Try to acquire QP state lock. Must be non-blocking
++	 * to accommodate kernel clients needs.
++	 */
++	if (!down_read_trylock(&qp->state_lock)) {
++		if (qp->attrs.state == SIW_QP_STATE_ERROR) {
++			/*
++			 * ERROR state is final, so we can be sure
++			 * this state will not change as long as the QP
++			 * exists.
++			 *
++			 * This handles an ib_drain_rq() call with
++			 * a concurrent request to set the QP state
++			 * to ERROR.
++			 */
++			rv = siw_rq_flush_wr(qp, wr, bad_wr);
++		} else {
++			siw_dbg_qp(qp, "QP locked, state %d\n",
++				   qp->attrs.state);
++			*bad_wr = wr;
++			rv = -ENOTCONN;
++		}
++		return rv;
++	}
+ 	if (qp->attrs.state > SIW_QP_STATE_RTS) {
++		if (qp->attrs.state == SIW_QP_STATE_ERROR) {
++			/*
++			 * Immediately flush this WR to CQ, if QP
++			 * is in ERROR state. RQ is guaranteed to
++			 * be empty, so WR complets in-order.
++			 *
++			 * Typically triggered by ib_drain_rq().
++			 */
++			rv = siw_rq_flush_wr(qp, wr, bad_wr);
++		} else {
++			siw_dbg_qp(qp, "QP out of state %d\n",
++				   qp->attrs.state);
++			*bad_wr = wr;
++			rv = -ENOTCONN;
++		}
+ 		up_read(&qp->state_lock);
+-		*bad_wr = wr;
+-		return -EINVAL;
++		return rv;
+ 	}
+ 	/*
+ 	 * Serialize potentially multiple producers.
+-- 
+2.20.1
+
diff --git a/queue-5.4/regulator-core-let-boot-on-regulators-be-powered-off.patch b/queue-5.4/regulator-core-let-boot-on-regulators-be-powered-off.patch
new file mode 100644
index 00000000000..7081d25654b
--- /dev/null
+++ b/queue-5.4/regulator-core-let-boot-on-regulators-be-powered-off.patch
@@ -0,0 +1,43 @@
+From 7229b2a41a41d8d07bc91948d66d51d8f05b7158 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Nov 2019 11:27:37 +0100
+Subject: regulator: core: Let boot-on regulators be powered off
+
+From: Pascal Paillet <p.paillet@st.com>
+
+[ Upstream commit 089b3f61ecfc43ca4ea26d595e1d31ead6de3f7b ]
+
+Boot-on regulators are always kept on because their use_count value
+is now incremented at boot time and never cleaned.
+
+Only increment count value for alway-on regulators.
+regulator_late_cleanup() is now able to power off boot-on regulators
+when unused.
+
+Fixes: 05f224ca6693 ("regulator: core: Clean enabling always-on regulators + their supplies")
+Signed-off-by: Pascal Paillet <p.paillet@st.com>
+Link: https://lore.kernel.org/r/20191113102737.27831-1-p.paillet@st.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/core.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index 51ce280c1ce1..87bc06b386a0 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -1403,7 +1403,9 @@ static int set_machine_constraints(struct regulator_dev *rdev,
+ 			rdev_err(rdev, "failed to enable\n");
+ 			return ret;
+ 		}
+-		rdev->use_count++;
++
++		if (rdev->constraints->always_on)
++			rdev->use_count++;
+ 	}
+ 
+ 	print_constraints(rdev);
+-- 
+2.20.1
+
diff --git a/queue-5.4/regulator-core-release-coupled_rdevs-on-regulator_in.patch b/queue-5.4/regulator-core-release-coupled_rdevs-on-regulator_in.patch
new file mode 100644
index 00000000000..3d4c3401785
--- /dev/null
+++ b/queue-5.4/regulator-core-release-coupled_rdevs-on-regulator_in.patch
@@ -0,0 +1,37 @@
+From c362af85d27906c0c581e4d62232b0c7039d1e5b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Oct 2019 03:22:39 +0300
+Subject: regulator: core: Release coupled_rdevs on regulator_init_coupling()
+ error
+
+From: Dmitry Osipenko <digetx@gmail.com>
+
+[ Upstream commit 26c2c997aa1a6c5522f6619910ba025e53e69763 ]
+
+This patch fixes memory leak which should happen if regulator's coupling
+fails to initialize.
+
+Fixes: d8ca7d184b33 ("regulator: core: Introduce API for regulators coupling customization")
+Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
+Link: https://lore.kernel.org/r/20191025002240.25288-1-digetx@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index a46be221dbdc..51ce280c1ce1 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -5198,6 +5198,7 @@ unset_supplies:
+ 	regulator_remove_coupling(rdev);
+ 	mutex_unlock(&regulator_list_mutex);
+ wash:
++	kfree(rdev->coupling_desc.coupled_rdevs);
+ 	kfree(rdev->constraints);
+ 	mutex_lock(&regulator_list_mutex);
+ 	regulator_ena_gpio_free(rdev);
+-- 
+2.20.1
+
diff --git a/queue-5.4/regulator-max8907-fix-the-usage-of-uninitialized-var.patch b/queue-5.4/regulator-max8907-fix-the-usage-of-uninitialized-var.patch
new file mode 100644
index 00000000000..afe0bbcb434
--- /dev/null
+++ b/queue-5.4/regulator-max8907-fix-the-usage-of-uninitialized-var.patch
@@ -0,0 +1,65 @@
+From a119a1c7d70c2d8528062084648b895882586317 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Oct 2019 10:58:13 -0700
+Subject: regulator: max8907: Fix the usage of uninitialized variable in
+ max8907_regulator_probe()
+
+From: Yizhuo <yzhai003@ucr.edu>
+
+[ Upstream commit 472b39c3d1bba0616eb0e9a8fa3ad0f56927c7d7 ]
+
+Inside function max8907_regulator_probe(), variable val could
+be uninitialized if regmap_read() fails. However, val is used
+later in the if statement to decide the content written to
+"pmic", which is potentially unsafe.
+
+Signed-off-by: Yizhuo <yzhai003@ucr.edu>
+Link: https://lore.kernel.org/r/20191003175813.16415-1-yzhai003@ucr.edu
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/max8907-regulator.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/regulator/max8907-regulator.c b/drivers/regulator/max8907-regulator.c
+index 76152aaa330b..96dc0eea7659 100644
+--- a/drivers/regulator/max8907-regulator.c
++++ b/drivers/regulator/max8907-regulator.c
+@@ -296,7 +296,10 @@ static int max8907_regulator_probe(struct platform_device *pdev)
+ 	memcpy(pmic->desc, max8907_regulators, sizeof(pmic->desc));
+ 
+ 	/* Backwards compatibility with MAX8907B; SD1 uses different voltages */
+-	regmap_read(max8907->regmap_gen, MAX8907_REG_II2RR, &val);
++	ret = regmap_read(max8907->regmap_gen, MAX8907_REG_II2RR, &val);
++	if (ret)
++		return ret;
++
+ 	if ((val & MAX8907_II2RR_VERSION_MASK) ==
+ 	    MAX8907_II2RR_VERSION_REV_B) {
+ 		pmic->desc[MAX8907_SD1].min_uV = 637500;
+@@ -333,14 +336,20 @@ static int max8907_regulator_probe(struct platform_device *pdev)
+ 		}
+ 
+ 		if (pmic->desc[i].ops == &max8907_ldo_ops) {
+-			regmap_read(config.regmap, pmic->desc[i].enable_reg,
++			ret = regmap_read(config.regmap, pmic->desc[i].enable_reg,
+ 				    &val);
++			if (ret)
++				return ret;
++
+ 			if ((val & MAX8907_MASK_LDO_SEQ) !=
+ 			    MAX8907_MASK_LDO_SEQ)
+ 				pmic->desc[i].ops = &max8907_ldo_hwctl_ops;
+ 		} else if (pmic->desc[i].ops == &max8907_out5v_ops) {
+-			regmap_read(config.regmap, pmic->desc[i].enable_reg,
++			ret = regmap_read(config.regmap, pmic->desc[i].enable_reg,
+ 				    &val);
++			if (ret)
++				return ret;
++
+ 			if ((val & (MAX8907_MASK_OUT5V_VINEN |
+ 						MAX8907_MASK_OUT5V_ENSRC)) !=
+ 			    MAX8907_MASK_OUT5V_ENSRC)
+-- 
+2.20.1
+
diff --git a/queue-5.4/revert-pinctrl-sh-pfc-r8a77990-fix-mod_sel1-bit30-wh.patch b/queue-5.4/revert-pinctrl-sh-pfc-r8a77990-fix-mod_sel1-bit30-wh.patch
new file mode 100644
index 00000000000..c4fb051f023
--- /dev/null
+++ b/queue-5.4/revert-pinctrl-sh-pfc-r8a77990-fix-mod_sel1-bit30-wh.patch
@@ -0,0 +1,106 @@
+From 35f0bbe746ac6ac68ebc4fd3e3956eb4b36d54fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Sep 2019 14:16:57 +0200
+Subject: Revert "pinctrl: sh-pfc: r8a77990: Fix MOD_SEL1 bit30 when using
+ SSI_SCK2 and SSI_WS2"
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 3672bc7093434621c83299ef27ea3b3225a67600 ]
+
+This reverts commit e87882eb9be10b2b9e28156922c2a47d877f5db4.
+
+According to the R-Car Gen3 Hardware Manual Errata for Rev 1.00 of Aug
+24, 2018, the SEL_SSI2_{0,1} definition was to be deleted.  However,
+this errata merely fixed an accidental double definition in the Hardware
+User's Manual Rev. 1.00.  The real definition is still present in later
+revisions of the manual (Rev. 1.50 and Rev. 2.00).
+
+Hence revert the commit to recover the definition.
+
+Based on a patch in the BSP by Takeshi Kihara
+<takeshi.kihara.df@renesas.com>.
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Link: https://lore.kernel.org/r/20190904121658.2617-3-geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-r8a77990.c | 20 +++++++++++---------
+ 1 file changed, 11 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a77990.c b/drivers/pinctrl/sh-pfc/pfc-r8a77990.c
+index 2dfb8d9cfda1..3808409cab38 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a77990.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a77990.c
+@@ -448,6 +448,7 @@ FM(IP12_31_28)	IP12_31_28	FM(IP13_31_28)	IP13_31_28	FM(IP14_31_28)	IP14_31_28	FM
+ #define MOD_SEL0_1_0	   REV4(FM(SEL_SPEED_PULSE_IF_0),	FM(SEL_SPEED_PULSE_IF_1),	FM(SEL_SPEED_PULSE_IF_2),	F_(0, 0))
+ 
+ /* MOD_SEL1 */			/* 0 */				/* 1 */				/* 2 */				/* 3 */			/* 4 */			/* 5 */		/* 6 */		/* 7 */
++#define MOD_SEL1_30		FM(SEL_SSI2_0)			FM(SEL_SSI2_1)
+ #define MOD_SEL1_29		FM(SEL_TIMER_TMU_0)		FM(SEL_TIMER_TMU_1)
+ #define MOD_SEL1_28		FM(SEL_USB_20_CH0_0)		FM(SEL_USB_20_CH0_1)
+ #define MOD_SEL1_26		FM(SEL_DRIF2_0)			FM(SEL_DRIF2_1)
+@@ -468,7 +469,7 @@ FM(IP12_31_28)	IP12_31_28	FM(IP13_31_28)	IP13_31_28	FM(IP14_31_28)	IP14_31_28	FM
+ 
+ #define PINMUX_MOD_SELS	\
+ \
+-MOD_SEL0_30_29 \
++MOD_SEL0_30_29		MOD_SEL1_30 \
+ 			MOD_SEL1_29 \
+ MOD_SEL0_28		MOD_SEL1_28 \
+ MOD_SEL0_27_26 \
+@@ -1058,7 +1059,7 @@ static const u16 pinmux_data[] = {
+ 	PINMUX_IPSR_MSEL(IP10_27_24,		RIF0_CLK_B,	SEL_DRIF0_1),
+ 	PINMUX_IPSR_MSEL(IP10_27_24,		SCL2_B,		SEL_I2C2_1),
+ 	PINMUX_IPSR_MSEL(IP10_27_24,		TCLK1_A,	SEL_TIMER_TMU_0),
+-	PINMUX_IPSR_GPSR(IP10_27_24,		SSI_SCK2_B),
++	PINMUX_IPSR_MSEL(IP10_27_24,		SSI_SCK2_B,	SEL_SSI2_1),
+ 	PINMUX_IPSR_GPSR(IP10_27_24,		TS_SCK0),
+ 
+ 	PINMUX_IPSR_GPSR(IP10_31_28,		SD0_WP),
+@@ -1067,7 +1068,7 @@ static const u16 pinmux_data[] = {
+ 	PINMUX_IPSR_MSEL(IP10_31_28,		RIF0_D0_B,	SEL_DRIF0_1),
+ 	PINMUX_IPSR_MSEL(IP10_31_28,		SDA2_B,		SEL_I2C2_1),
+ 	PINMUX_IPSR_MSEL(IP10_31_28,		TCLK2_A,	SEL_TIMER_TMU_0),
+-	PINMUX_IPSR_GPSR(IP10_31_28,		SSI_WS2_B),
++	PINMUX_IPSR_MSEL(IP10_31_28,		SSI_WS2_B,	SEL_SSI2_1),
+ 	PINMUX_IPSR_GPSR(IP10_31_28,		TS_SDAT0),
+ 
+ 	/* IPSR11 */
+@@ -1085,13 +1086,13 @@ static const u16 pinmux_data[] = {
+ 
+ 	PINMUX_IPSR_MSEL(IP11_11_8,		RX0_A,		SEL_SCIF0_0),
+ 	PINMUX_IPSR_MSEL(IP11_11_8,		HRX1_A,		SEL_HSCIF1_0),
+-	PINMUX_IPSR_GPSR(IP11_11_8,		SSI_SCK2_A),
++	PINMUX_IPSR_MSEL(IP11_11_8,		SSI_SCK2_A,	SEL_SSI2_0),
+ 	PINMUX_IPSR_GPSR(IP11_11_8,		RIF1_SYNC),
+ 	PINMUX_IPSR_GPSR(IP11_11_8,		TS_SCK1),
+ 
+ 	PINMUX_IPSR_MSEL(IP11_15_12,		TX0_A,		SEL_SCIF0_0),
+ 	PINMUX_IPSR_GPSR(IP11_15_12,		HTX1_A),
+-	PINMUX_IPSR_GPSR(IP11_15_12,		SSI_WS2_A),
++	PINMUX_IPSR_MSEL(IP11_15_12,		SSI_WS2_A,	SEL_SSI2_0),
+ 	PINMUX_IPSR_GPSR(IP11_15_12,		RIF1_D0),
+ 	PINMUX_IPSR_GPSR(IP11_15_12,		TS_SDAT1),
+ 
+@@ -4957,11 +4958,12 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ 		MOD_SEL0_1_0 ))
+ 	},
+ 	{ PINMUX_CFG_REG_VAR("MOD_SEL1", 0xe6060504, 32,
+-			     GROUP(2, 1, 1, 1, 1, 1, 3, 3, 1, 1, 1, 1,
+-				   2, 2, 2, 1, 1, 2, 1, 4),
++			     GROUP(1, 1, 1, 1, 1, 1, 1, 3, 3, 1, 1, 1,
++				   1, 2, 2, 2, 1, 1, 2, 1, 4),
+ 			     GROUP(
+-		/* RESERVED 31, 30 */
+-		0, 0, 0, 0,
++		/* RESERVED 31 */
++		0, 0,
++		MOD_SEL1_30
+ 		MOD_SEL1_29
+ 		MOD_SEL1_28
+ 		/* RESERVED 27 */
+-- 
+2.20.1
+
diff --git a/queue-5.4/revert-pinctrl-sh-pfc-r8a77990-fix-mod_sel1-bit31-wh.patch b/queue-5.4/revert-pinctrl-sh-pfc-r8a77990-fix-mod_sel1-bit31-wh.patch
new file mode 100644
index 00000000000..87fb0250df7
--- /dev/null
+++ b/queue-5.4/revert-pinctrl-sh-pfc-r8a77990-fix-mod_sel1-bit31-wh.patch
@@ -0,0 +1,82 @@
+From 37a7f0fed9502962860095f257c7d293c97bab4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Sep 2019 14:16:58 +0200
+Subject: Revert "pinctrl: sh-pfc: r8a77990: Fix MOD_SEL1 bit31 when using
+ SIM0_D"
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 7666dfd533d4c55733037775d47a8e3551b341a2 ]
+
+This reverts commit e167d723e1a472d252e5c4baf823b77ce5543b05.
+
+According to the R-Car Gen3 Hardware Manual Errata for Rev 1.00 of Aug
+24, 2018, the SEL_SIMCARD_{0,1} definition was to be deleted.  However,
+this errata merely fixed an accidental double definition in the Hardware
+User's Manual Rev. 1.00.  The real definition is still present in later
+revisions of the manual (Rev. 1.50 and Rev. 2.00).
+
+Hence revert the commit to recover the definition.
+
+Based on a patch in the BSP by Takeshi Kihara
+<takeshi.kihara.df@renesas.com>.
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Link: https://lore.kernel.org/r/20190904121658.2617-4-geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-r8a77990.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a77990.c b/drivers/pinctrl/sh-pfc/pfc-r8a77990.c
+index 3808409cab38..5200dadd6b3e 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a77990.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a77990.c
+@@ -448,6 +448,7 @@ FM(IP12_31_28)	IP12_31_28	FM(IP13_31_28)	IP13_31_28	FM(IP14_31_28)	IP14_31_28	FM
+ #define MOD_SEL0_1_0	   REV4(FM(SEL_SPEED_PULSE_IF_0),	FM(SEL_SPEED_PULSE_IF_1),	FM(SEL_SPEED_PULSE_IF_2),	F_(0, 0))
+ 
+ /* MOD_SEL1 */			/* 0 */				/* 1 */				/* 2 */				/* 3 */			/* 4 */			/* 5 */		/* 6 */		/* 7 */
++#define MOD_SEL1_31		FM(SEL_SIMCARD_0)		FM(SEL_SIMCARD_1)
+ #define MOD_SEL1_30		FM(SEL_SSI2_0)			FM(SEL_SSI2_1)
+ #define MOD_SEL1_29		FM(SEL_TIMER_TMU_0)		FM(SEL_TIMER_TMU_1)
+ #define MOD_SEL1_28		FM(SEL_USB_20_CH0_0)		FM(SEL_USB_20_CH0_1)
+@@ -469,6 +470,7 @@ FM(IP12_31_28)	IP12_31_28	FM(IP13_31_28)	IP13_31_28	FM(IP14_31_28)	IP14_31_28	FM
+ 
+ #define PINMUX_MOD_SELS	\
+ \
++			MOD_SEL1_31 \
+ MOD_SEL0_30_29		MOD_SEL1_30 \
+ 			MOD_SEL1_29 \
+ MOD_SEL0_28		MOD_SEL1_28 \
+@@ -1197,7 +1199,7 @@ static const u16 pinmux_data[] = {
+ 	PINMUX_IPSR_MSEL(IP13_19_16,		RIF0_D1_A,	SEL_DRIF0_0),
+ 	PINMUX_IPSR_MSEL(IP13_19_16,		SDA1_B,		SEL_I2C1_1),
+ 	PINMUX_IPSR_MSEL(IP13_19_16,		TCLK2_B,	SEL_TIMER_TMU_1),
+-	PINMUX_IPSR_GPSR(IP13_19_16,		SIM0_D_A),
++	PINMUX_IPSR_MSEL(IP13_19_16,		SIM0_D_A,	SEL_SIMCARD_0),
+ 
+ 	PINMUX_IPSR_GPSR(IP13_23_20,		MLB_DAT),
+ 	PINMUX_IPSR_MSEL(IP13_23_20,		TX0_B,		SEL_SCIF0_1),
+@@ -1265,7 +1267,7 @@ static const u16 pinmux_data[] = {
+ 	PINMUX_IPSR_GPSR(IP15_15_12,		TPU0TO2),
+ 	PINMUX_IPSR_MSEL(IP15_15_12,		SDA1_D,		SEL_I2C1_3),
+ 	PINMUX_IPSR_MSEL(IP15_15_12,		FSO_CFE_1_N_B,	SEL_FSO_1),
+-	PINMUX_IPSR_GPSR(IP15_15_12,		SIM0_D_B),
++	PINMUX_IPSR_MSEL(IP15_15_12,		SIM0_D_B,	SEL_SIMCARD_1),
+ 
+ 	PINMUX_IPSR_GPSR(IP15_19_16,		SSI_SDATA6),
+ 	PINMUX_IPSR_MSEL(IP15_19_16,		HRTS2_N_A,	SEL_HSCIF2_0),
+@@ -4961,8 +4963,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ 			     GROUP(1, 1, 1, 1, 1, 1, 1, 3, 3, 1, 1, 1,
+ 				   1, 2, 2, 2, 1, 1, 2, 1, 4),
+ 			     GROUP(
+-		/* RESERVED 31 */
+-		0, 0,
++		MOD_SEL1_31
+ 		MOD_SEL1_30
+ 		MOD_SEL1_29
+ 		MOD_SEL1_28
+-- 
+2.20.1
+
diff --git a/queue-5.4/rtl8xxxu-fix-rtl8723bu-connection-failure-issue-afte.patch b/queue-5.4/rtl8xxxu-fix-rtl8723bu-connection-failure-issue-afte.patch
new file mode 100644
index 00000000000..31943b916bc
--- /dev/null
+++ b/queue-5.4/rtl8xxxu-fix-rtl8723bu-connection-failure-issue-afte.patch
@@ -0,0 +1,73 @@
+From 6583bbbbfeac868ab3c9f6636c6281bfb7241b38 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Oct 2019 09:54:08 +0800
+Subject: rtl8xxxu: fix RTL8723BU connection failure issue after warm reboot
+
+From: Chris Chiu <chiu@endlessm.com>
+
+[ Upstream commit 0eeb91ade90ce06d2fa1e2fcb55e3316b64c203c ]
+
+The RTL8723BU has problems connecting to AP after each warm reboot.
+Sometimes it returns no scan result, and in most cases, it fails
+the authentication for unknown reason. However, it works totally
+fine after cold reboot.
+
+Compare the value of register SYS_CR and SYS_CLK_MAC_CLK_ENABLE
+for cold reboot and warm reboot, the registers imply that the MAC
+is already powered and thus some procedures are skipped during
+driver initialization. Double checked the vendor driver, it reads
+the SYS_CR and SYS_CLK_MAC_CLK_ENABLE also but doesn't skip any
+during initialization based on them. This commit only tells the
+RTL8723BU to do full initialization without checking MAC status.
+
+Signed-off-by: Chris Chiu <chiu@endlessm.com>
+Signed-off-by: Jes Sorensen <Jes.Sorensen@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h       | 1 +
+ drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c | 1 +
+ drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c  | 3 +++
+ 3 files changed, 5 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
+index ade057d868f7..5e9ce03067de 100644
+--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
+@@ -1341,6 +1341,7 @@ struct rtl8xxxu_fileops {
+ 	u8 has_s0s1:1;
+ 	u8 has_tx_report:1;
+ 	u8 gen2_thermal_meter:1;
++	u8 needs_full_init:1;
+ 	u32 adda_1t_init;
+ 	u32 adda_1t_path_on;
+ 	u32 adda_2t_path_on_a;
+diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c
+index ceffe05bd65b..f3cd314d1a9c 100644
+--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c
++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c
+@@ -1670,6 +1670,7 @@ struct rtl8xxxu_fileops rtl8723bu_fops = {
+ 	.has_s0s1 = 1,
+ 	.has_tx_report = 1,
+ 	.gen2_thermal_meter = 1,
++	.needs_full_init = 1,
+ 	.adda_1t_init = 0x01c00014,
+ 	.adda_1t_path_on = 0x01c00014,
+ 	.adda_2t_path_on_a = 0x01c00014,
+diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+index c6c41fb962ff..361248e97568 100644
+--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+@@ -3902,6 +3902,9 @@ static int rtl8xxxu_init_device(struct ieee80211_hw *hw)
+ 	else
+ 		macpower = true;
+ 
++	if (fops->needs_full_init)
++		macpower = false;
++
+ 	ret = fops->power_on(priv);
+ 	if (ret < 0) {
+ 		dev_warn(dev, "%s: Failed power on\n", __func__);
+-- 
+2.20.1
+
diff --git a/queue-5.4/rtlwifi-fix-memory-leak-in-rtl92c_set_fw_rsvdpagepkt.patch b/queue-5.4/rtlwifi-fix-memory-leak-in-rtl92c_set_fw_rsvdpagepkt.patch
new file mode 100644
index 00000000000..dbae2471f73
--- /dev/null
+++ b/queue-5.4/rtlwifi-fix-memory-leak-in-rtl92c_set_fw_rsvdpagepkt.patch
@@ -0,0 +1,64 @@
+From bd1b21f71f8d6c9a73c94ffd14b159f771e62142 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Nov 2019 10:18:38 +0800
+Subject: rtlwifi: fix memory leak in rtl92c_set_fw_rsvdpagepkt()
+
+From: Ping-Ke Shih <pkshih@realtek.com>
+
+[ Upstream commit 5174f1e41074b5186608badc2e89441d021e8c08 ]
+
+This leak was found by testing the EDIMAX EW-7612 on Raspberry Pi 3B+ with
+Linux 5.4-rc5 (multi_v7_defconfig + rtlwifi + kmemleak) and noticed a
+single memory leak during probe:
+
+unreferenced object 0xec13ee40 (size 176):
+  comm "kworker/u8:1", pid 36, jiffies 4294939321 (age 5580.790s)
+  hex dump (first 32 bytes):
+    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
+    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
+  backtrace:
+    [<fc1bbb3e>] __netdev_alloc_skb+0x9c/0x164
+    [<863dfa6e>] rtl92c_set_fw_rsvdpagepkt+0x254/0x340 [rtl8192c_common]
+    [<9572be0d>] rtl92cu_set_hw_reg+0xf48/0xfa4 [rtl8192cu]
+    [<116df4d8>] rtl_op_bss_info_changed+0x234/0x96c [rtlwifi]
+    [<8933575f>] ieee80211_bss_info_change_notify+0xb8/0x264 [mac80211]
+    [<d4061e86>] ieee80211_assoc_success+0x934/0x1798 [mac80211]
+    [<e55adb56>] ieee80211_rx_mgmt_assoc_resp+0x174/0x314 [mac80211]
+    [<5974629e>] ieee80211_sta_rx_queued_mgmt+0x3f4/0x7f0 [mac80211]
+    [<d91091c6>] ieee80211_iface_work+0x208/0x318 [mac80211]
+    [<ac5fcae4>] process_one_work+0x22c/0x564
+    [<f5e6d3b6>] worker_thread+0x44/0x5d8
+    [<82c7b073>] kthread+0x150/0x154
+    [<b43e1b7d>] ret_from_fork+0x14/0x2c
+    [<794dff30>] 0x0
+
+It is because 8192cu doesn't implement usb_cmd_send_packet(), and this
+patch just frees the skb within the function to resolve memleak problem
+by now. Since 8192cu doesn't turn on fwctrl_lps that needs to download
+command packet for firmware via the function, applying this patch doesn't
+affect driver behavior.
+
+Reported-by: Stefan Wahren <wahrenst@gmx.net>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c
+index 56cc3bc30860..f070f25bb735 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c
+@@ -1540,6 +1540,8 @@ static bool usb_cmd_send_packet(struct ieee80211_hw *hw, struct sk_buff *skb)
+    * This is maybe necessary:
+    * rtlpriv->cfg->ops->fill_tx_cmddesc(hw, buffer, 1, 1, skb);
+    */
++	dev_kfree_skb(skb);
++
+ 	return true;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/rtlwifi-prevent-memory-leak-in-rtl_usb_probe.patch b/queue-5.4/rtlwifi-prevent-memory-leak-in-rtl_usb_probe.patch
new file mode 100644
index 00000000000..142ba9d7b14
--- /dev/null
+++ b/queue-5.4/rtlwifi-prevent-memory-leak-in-rtl_usb_probe.patch
@@ -0,0 +1,47 @@
+From f9d3a37d09808bc1cb4dcb7d2b11deda7960dbd3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Sep 2019 20:20:21 -0500
+Subject: rtlwifi: prevent memory leak in rtl_usb_probe
+
+From: Navid Emamdoost <navid.emamdoost@gmail.com>
+
+[ Upstream commit 3f93616951138a598d930dcaec40f2bfd9ce43bb ]
+
+In rtl_usb_probe if allocation for usb_data fails the allocated hw
+should be released. In addition the allocated rtlpriv->usb_data should
+be released on error handling path.
+
+Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/usb.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c
+index 4b59f3b46b28..348b0072cdd6 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/usb.c
++++ b/drivers/net/wireless/realtek/rtlwifi/usb.c
+@@ -1021,8 +1021,10 @@ int rtl_usb_probe(struct usb_interface *intf,
+ 	rtlpriv->hw = hw;
+ 	rtlpriv->usb_data = kcalloc(RTL_USB_MAX_RX_COUNT, sizeof(u32),
+ 				    GFP_KERNEL);
+-	if (!rtlpriv->usb_data)
++	if (!rtlpriv->usb_data) {
++		ieee80211_free_hw(hw);
+ 		return -ENOMEM;
++	}
+ 
+ 	/* this spin lock must be initialized early */
+ 	spin_lock_init(&rtlpriv->locks.usb_lock);
+@@ -1083,6 +1085,7 @@ error_out2:
+ 	_rtl_usb_io_handler_release(hw);
+ 	usb_put_dev(udev);
+ 	complete(&rtlpriv->firmware_loading_complete);
++	kfree(rtlpriv->usb_data);
+ 	return -ENODEV;
+ }
+ EXPORT_SYMBOL(rtl_usb_probe);
+-- 
+2.20.1
+
diff --git a/queue-5.4/rtw88-coex-set-4-slot-mode-for-a2dp.patch b/queue-5.4/rtw88-coex-set-4-slot-mode-for-a2dp.patch
new file mode 100644
index 00000000000..3b9f55c3938
--- /dev/null
+++ b/queue-5.4/rtw88-coex-set-4-slot-mode-for-a2dp.patch
@@ -0,0 +1,127 @@
+From f97f2fdcfde7222f00d2d36195bbe58c8c7b4e58 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2019 16:21:00 +0800
+Subject: rtw88: coex: Set 4 slot mode for A2DP
+
+From: Ping-Ke Shih <pkshih@realtek.com>
+
+[ Upstream commit 12078aae453556a88fb46777b7cc5fc97f867b7c ]
+
+With shallow buffer size, certain BT devices have active
+A2DP flow control to fill buffer frequently. If the slot
+is not at BT side, data can't be sent successfully to BT
+devices, and will cause audio glitch.
+
+To resolve this issue, this commit splits TUs into 4-slots
+instead of 2-slot for all of the A2DP related coexistence
+strategies. That makes BT have higher opportunity to fill
+the A2DP buffer in time, and the audio quality could be
+more stable and smooth.
+
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/coex.c | 24 ++++++++++++++---------
+ 1 file changed, 15 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/coex.c b/drivers/net/wireless/realtek/rtw88/coex.c
+index 793b40bdbf7c..3e95ad198912 100644
+--- a/drivers/net/wireless/realtek/rtw88/coex.c
++++ b/drivers/net/wireless/realtek/rtw88/coex.c
+@@ -1308,6 +1308,7 @@ static void rtw_coex_action_bt_inquiry(struct rtw_dev *rtwdev)
+ 	struct rtw_chip_info *chip = rtwdev->chip;
+ 	bool wl_hi_pri = false;
+ 	u8 table_case, tdma_case;
++	u32 slot_type = 0;
+ 
+ 	if (coex_stat->wl_linkscan_proc || coex_stat->wl_hi_pri_task1 ||
+ 	    coex_stat->wl_hi_pri_task2)
+@@ -1318,14 +1319,16 @@ static void rtw_coex_action_bt_inquiry(struct rtw_dev *rtwdev)
+ 		if (wl_hi_pri) {
+ 			table_case = 15;
+ 			if (coex_stat->bt_a2dp_exist &&
+-			    !coex_stat->bt_pan_exist)
++			    !coex_stat->bt_pan_exist) {
++				slot_type = TDMA_4SLOT;
+ 				tdma_case = 11;
+-			else if (coex_stat->wl_hi_pri_task1)
++			} else if (coex_stat->wl_hi_pri_task1) {
+ 				tdma_case = 6;
+-			else if (!coex_stat->bt_page)
++			} else if (!coex_stat->bt_page) {
+ 				tdma_case = 8;
+-			else
++			} else {
+ 				tdma_case = 9;
++			}
+ 		} else if (coex_stat->wl_connected) {
+ 			table_case = 10;
+ 			tdma_case = 10;
+@@ -1361,7 +1364,7 @@ static void rtw_coex_action_bt_inquiry(struct rtw_dev *rtwdev)
+ 	rtw_coex_set_ant_path(rtwdev, false, COEX_SET_ANT_2G);
+ 	rtw_coex_set_rf_para(rtwdev, chip->wl_rf_para_rx[0]);
+ 	rtw_coex_table(rtwdev, table_case);
+-	rtw_coex_tdma(rtwdev, false, tdma_case);
++	rtw_coex_tdma(rtwdev, false, tdma_case | slot_type);
+ }
+ 
+ static void rtw_coex_action_bt_hfp(struct rtw_dev *rtwdev)
+@@ -1475,13 +1478,13 @@ static void rtw_coex_action_bt_a2dp(struct rtw_dev *rtwdev)
+ 
+ 	if (efuse->share_ant) {
+ 		/* Shared-Ant */
++		slot_type = TDMA_4SLOT;
++
+ 		if (coex_stat->wl_gl_busy && coex_stat->wl_noisy_level == 0)
+ 			table_case = 10;
+ 		else
+ 			table_case = 9;
+ 
+-		slot_type = TDMA_4SLOT;
+-
+ 		if (coex_stat->wl_gl_busy)
+ 			tdma_case = 13;
+ 		else
+@@ -1585,13 +1588,14 @@ static void rtw_coex_action_bt_a2dp_hid(struct rtw_dev *rtwdev)
+ 
+ 	if (efuse->share_ant) {
+ 		/* Shared-Ant */
++		slot_type = TDMA_4SLOT;
++
+ 		if (coex_stat->bt_ble_exist)
+ 			table_case = 26;
+ 		else
+ 			table_case = 9;
+ 
+ 		if (coex_stat->wl_gl_busy) {
+-			slot_type = TDMA_4SLOT;
+ 			tdma_case = 13;
+ 		} else {
+ 			tdma_case = 14;
+@@ -1794,10 +1798,12 @@ static void rtw_coex_action_wl_linkscan(struct rtw_dev *rtwdev)
+ 	struct rtw_efuse *efuse = &rtwdev->efuse;
+ 	struct rtw_chip_info *chip = rtwdev->chip;
+ 	u8 table_case, tdma_case;
++	u32 slot_type = 0;
+ 
+ 	if (efuse->share_ant) {
+ 		/* Shared-Ant */
+ 		if (coex_stat->bt_a2dp_exist) {
++			slot_type = TDMA_4SLOT;
+ 			table_case = 9;
+ 			tdma_case = 11;
+ 		} else {
+@@ -1818,7 +1824,7 @@ static void rtw_coex_action_wl_linkscan(struct rtw_dev *rtwdev)
+ 	rtw_coex_set_ant_path(rtwdev, true, COEX_SET_ANT_2G);
+ 	rtw_coex_set_rf_para(rtwdev, chip->wl_rf_para_rx[0]);
+ 	rtw_coex_table(rtwdev, table_case);
+-	rtw_coex_tdma(rtwdev, false, tdma_case);
++	rtw_coex_tdma(rtwdev, false, tdma_case | slot_type);
+ }
+ 
+ static void rtw_coex_action_wl_not_connected(struct rtw_dev *rtwdev)
+-- 
+2.20.1
+
diff --git a/queue-5.4/rtw88-fix-nss-of-hw_cap.patch b/queue-5.4/rtw88-fix-nss-of-hw_cap.patch
new file mode 100644
index 00000000000..4c3197a45f8
--- /dev/null
+++ b/queue-5.4/rtw88-fix-nss-of-hw_cap.patch
@@ -0,0 +1,43 @@
+From 693c3be157d09bf081511f46afecaad21bfcec69 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Oct 2019 14:35:30 +0800
+Subject: rtw88: fix NSS of hw_cap
+
+From: Ping-Ke Shih <pkshih@realtek.com>
+
+[ Upstream commit 4f5bb7ff8b8d4bafd91243fc969ed240e67aa1ca ]
+
+8822C is a 2x2 11ac chip, and then NSS must be less or equal to 2. However,
+current nss of hw cap is 3, likes
+	hw cap: hci=0x0f, bw=0x07, ptcl=0x03, ant_num=7, nss=3
+
+This commit adds constraint to make sure NSS <= rf_path_num, and result
+looks like
+	hw cap: hci=0x0f, bw=0x07, ptcl=0x03, ant_num=7, nss=2
+
+Fixes: e3037485c68e ("rtw88: new Realtek 802.11ac driver")
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/main.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c
+index 6dd457741b15..7a3a4911bde2 100644
+--- a/drivers/net/wireless/realtek/rtw88/main.c
++++ b/drivers/net/wireless/realtek/rtw88/main.c
+@@ -1020,7 +1020,8 @@ static int rtw_dump_hw_feature(struct rtw_dev *rtwdev)
+ 
+ 	rtw_hw_config_rf_ant_num(rtwdev, efuse->hw_cap.ant_num);
+ 
+-	if (efuse->hw_cap.nss == EFUSE_HW_CAP_IGNORE)
++	if (efuse->hw_cap.nss == EFUSE_HW_CAP_IGNORE ||
++	    efuse->hw_cap.nss > rtwdev->hal.rf_path_num)
+ 		efuse->hw_cap.nss = rtwdev->hal.rf_path_num;
+ 
+ 	rtw_dbg(rtwdev, RTW_DBG_EFUSE,
+-- 
+2.20.1
+
diff --git a/queue-5.4/s390-add-error-handling-to-perf_callchain_kernel.patch b/queue-5.4/s390-add-error-handling-to-perf_callchain_kernel.patch
new file mode 100644
index 00000000000..990175c3ee1
--- /dev/null
+++ b/queue-5.4/s390-add-error-handling-to-perf_callchain_kernel.patch
@@ -0,0 +1,43 @@
+From 7bf6cd8c9aabf41ef656970ae7e0ddbe4099f02a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Oct 2019 14:20:32 +0100
+Subject: s390: add error handling to perf_callchain_kernel
+
+From: Ilya Leoshkevich <iii@linux.ibm.com>
+
+[ Upstream commit effb83ccc83a97dbbe5214f4c443522719f05f3a ]
+
+perf_callchain_kernel stops neither when it encounters a garbage
+address, nor when it runs out of space. Fix both issues using x86
+version as an inspiration.
+
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/perf_event.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/arch/s390/kernel/perf_event.c b/arch/s390/kernel/perf_event.c
+index fcb6c2e92b07..1e75cc983546 100644
+--- a/arch/s390/kernel/perf_event.c
++++ b/arch/s390/kernel/perf_event.c
+@@ -224,9 +224,13 @@ void perf_callchain_kernel(struct perf_callchain_entry_ctx *entry,
+ 			   struct pt_regs *regs)
+ {
+ 	struct unwind_state state;
++	unsigned long addr;
+ 
+-	unwind_for_each_frame(&state, current, regs, 0)
+-		perf_callchain_store(entry, state.ip);
++	unwind_for_each_frame(&state, current, regs, 0) {
++		addr = unwind_get_return_address(&state);
++		if (!addr || perf_callchain_store(entry, addr))
++			return;
++	}
+ }
+ 
+ /* Perf definitions for PMU event attributes in sysfs */
+-- 
+2.20.1
+
diff --git a/queue-5.4/s390-bpf-use-kvcalloc-for-addrs-array.patch b/queue-5.4/s390-bpf-use-kvcalloc-for-addrs-array.patch
new file mode 100644
index 00000000000..cd2a966bd56
--- /dev/null
+++ b/queue-5.4/s390-bpf-use-kvcalloc-for-addrs-array.patch
@@ -0,0 +1,60 @@
+From 08617d8012ebf2132bbaaf22b7f427b5874e2651 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2019 15:18:38 +0100
+Subject: s390/bpf: Use kvcalloc for addrs array
+
+From: Ilya Leoshkevich <iii@linux.ibm.com>
+
+[ Upstream commit 166f11d11f6f70439830d09bfa5552ec1b368494 ]
+
+A BPF program may consist of 1m instructions, which means JIT
+instruction-address mapping can be as large as 4m. s390 has
+FORCE_MAX_ZONEORDER=9 (for memory hotplug reasons), which means maximum
+kmalloc size is 1m. This makes it impossible to JIT programs with more
+than 256k instructions.
+
+Fix by using kvcalloc, which falls back to vmalloc for larger
+allocations. An alternative would be to use a radix tree, but that is
+not supported by bpf_prog_fill_jited_linfo.
+
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20191107141838.92202-1-iii@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/net/bpf_jit_comp.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
+index ce88211b9c6c..c8c16b5eed6b 100644
+--- a/arch/s390/net/bpf_jit_comp.c
++++ b/arch/s390/net/bpf_jit_comp.c
+@@ -23,6 +23,7 @@
+ #include <linux/filter.h>
+ #include <linux/init.h>
+ #include <linux/bpf.h>
++#include <linux/mm.h>
+ #include <asm/cacheflush.h>
+ #include <asm/dis.h>
+ #include <asm/facility.h>
+@@ -1369,7 +1370,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp)
+ 	}
+ 
+ 	memset(&jit, 0, sizeof(jit));
+-	jit.addrs = kcalloc(fp->len + 1, sizeof(*jit.addrs), GFP_KERNEL);
++	jit.addrs = kvcalloc(fp->len + 1, sizeof(*jit.addrs), GFP_KERNEL);
+ 	if (jit.addrs == NULL) {
+ 		fp = orig_fp;
+ 		goto out;
+@@ -1422,7 +1423,7 @@ skip_init_ctx:
+ 	if (!fp->is_func || extra_pass) {
+ 		bpf_prog_fill_jited_linfo(fp, jit.addrs + 1);
+ free_addrs:
+-		kfree(jit.addrs);
++		kvfree(jit.addrs);
+ 		kfree(jit_data);
+ 		fp->aux->jit_data = NULL;
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-5.4/s390-cpumf-adjust-registration-of-s390-pmu-device-dr.patch b/queue-5.4/s390-cpumf-adjust-registration-of-s390-pmu-device-dr.patch
new file mode 100644
index 00000000000..1b52f8c1429
--- /dev/null
+++ b/queue-5.4/s390-cpumf-adjust-registration-of-s390-pmu-device-dr.patch
@@ -0,0 +1,135 @@
+From 49bca0633ae7d3b51857fd5a70cce417ac14dd22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Nov 2019 12:50:46 +0100
+Subject: s390/cpumf: Adjust registration of s390 PMU device drivers
+
+From: Thomas Richter <tmricht@linux.ibm.com>
+
+[ Upstream commit 6a82e23f45fe0aa821e7a935e39d0acb20c275c0 ]
+
+Linux-next commit titled "perf/core: Optimize perf_init_event()"
+changed the semantics of PMU device driver registration.
+It was done to speed up the lookup/handling of PMU device driver
+specific events. It also enforces that only one PMU device
+driver will be registered of type PERF_EVENT_RAW.
+
+This change added these line in function perf_pmu_register():
+
+  ...
+  +       ret = idr_alloc(&pmu_idr, pmu, max, 0, GFP_KERNEL);
+  +       if (ret < 0)
+                goto free_pdc;
+  +
+  +       WARN_ON(type >= 0 && ret != type);
+
+The warn_on generates a message. We have 3 PMU device drivers,
+each registered as type PERF_TYPE_RAW.
+The cf_diag device driver (arch/s390/kernel/perf_cpumf_cf_diag.c)
+always hits the WARN_ON because it is the second PMU device driver
+(after sampling device driver arch/s390/kernel/perf_cpumf_sf.c)
+which is registered as type 4 (PERF_TYPE_RAW).
+So when the sampling device driver is registered, ret has value 4.
+When cf_diag device driver is registered with type 4,
+ret has value of 5 and WARN_ON fires.
+
+Adjust the PMU device drivers for s390 to support the new
+semantics required by perf_pmu_register().
+
+Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/perf_cpum_cf.c      | 21 ++++++++++-----------
+ arch/s390/kernel/perf_cpum_cf_diag.c | 10 +++++-----
+ 2 files changed, 15 insertions(+), 16 deletions(-)
+
+diff --git a/arch/s390/kernel/perf_cpum_cf.c b/arch/s390/kernel/perf_cpum_cf.c
+index 48d48b6187c0..0eb1d1cc53a8 100644
+--- a/arch/s390/kernel/perf_cpum_cf.c
++++ b/arch/s390/kernel/perf_cpum_cf.c
+@@ -199,7 +199,7 @@ static const int cpumf_generic_events_user[] = {
+ 	[PERF_COUNT_HW_BUS_CYCLES]	    = -1,
+ };
+ 
+-static int __hw_perf_event_init(struct perf_event *event)
++static int __hw_perf_event_init(struct perf_event *event, unsigned int type)
+ {
+ 	struct perf_event_attr *attr = &event->attr;
+ 	struct hw_perf_event *hwc = &event->hw;
+@@ -207,7 +207,7 @@ static int __hw_perf_event_init(struct perf_event *event)
+ 	int err = 0;
+ 	u64 ev;
+ 
+-	switch (attr->type) {
++	switch (type) {
+ 	case PERF_TYPE_RAW:
+ 		/* Raw events are used to access counters directly,
+ 		 * hence do not permit excludes */
+@@ -294,17 +294,16 @@ static int __hw_perf_event_init(struct perf_event *event)
+ 
+ static int cpumf_pmu_event_init(struct perf_event *event)
+ {
++	unsigned int type = event->attr.type;
+ 	int err;
+ 
+-	switch (event->attr.type) {
+-	case PERF_TYPE_HARDWARE:
+-	case PERF_TYPE_HW_CACHE:
+-	case PERF_TYPE_RAW:
+-		err = __hw_perf_event_init(event);
+-		break;
+-	default:
++	if (type == PERF_TYPE_HARDWARE || type == PERF_TYPE_RAW)
++		err = __hw_perf_event_init(event, type);
++	else if (event->pmu->type == type)
++		/* Registered as unknown PMU */
++		err = __hw_perf_event_init(event, PERF_TYPE_RAW);
++	else
+ 		return -ENOENT;
+-	}
+ 
+ 	if (unlikely(err) && event->destroy)
+ 		event->destroy(event);
+@@ -553,7 +552,7 @@ static int __init cpumf_pmu_init(void)
+ 		return -ENODEV;
+ 
+ 	cpumf_pmu.attr_groups = cpumf_cf_event_group();
+-	rc = perf_pmu_register(&cpumf_pmu, "cpum_cf", PERF_TYPE_RAW);
++	rc = perf_pmu_register(&cpumf_pmu, "cpum_cf", -1);
+ 	if (rc)
+ 		pr_err("Registering the cpum_cf PMU failed with rc=%i\n", rc);
+ 	return rc;
+diff --git a/arch/s390/kernel/perf_cpum_cf_diag.c b/arch/s390/kernel/perf_cpum_cf_diag.c
+index 2654e348801a..e949ab832ed7 100644
+--- a/arch/s390/kernel/perf_cpum_cf_diag.c
++++ b/arch/s390/kernel/perf_cpum_cf_diag.c
+@@ -243,13 +243,13 @@ static int cf_diag_event_init(struct perf_event *event)
+ 	int err = -ENOENT;
+ 
+ 	debug_sprintf_event(cf_diag_dbg, 5,
+-			    "%s event %p cpu %d config %#llx "
++			    "%s event %p cpu %d config %#llx type:%u "
+ 			    "sample_type %#llx cf_diag_events %d\n", __func__,
+-			    event, event->cpu, attr->config, attr->sample_type,
+-			    atomic_read(&cf_diag_events));
++			    event, event->cpu, attr->config, event->pmu->type,
++			    attr->sample_type, atomic_read(&cf_diag_events));
+ 
+ 	if (event->attr.config != PERF_EVENT_CPUM_CF_DIAG ||
+-	    event->attr.type != PERF_TYPE_RAW)
++	    event->attr.type != event->pmu->type)
+ 		goto out;
+ 
+ 	/* Raw events are used to access counters directly,
+@@ -693,7 +693,7 @@ static int __init cf_diag_init(void)
+ 	}
+ 	debug_register_view(cf_diag_dbg, &debug_sprintf_view);
+ 
+-	rc = perf_pmu_register(&cf_diag, "cpum_cf_diag", PERF_TYPE_RAW);
++	rc = perf_pmu_register(&cf_diag, "cpum_cf_diag", -1);
+ 	if (rc) {
+ 		debug_unregister_view(cf_diag_dbg, &debug_sprintf_view);
+ 		debug_unregister(cf_diag_dbg);
+-- 
+2.20.1
+
diff --git a/queue-5.4/s390-crypto-fix-unsigned-variable-compared-with-zero.patch b/queue-5.4/s390-crypto-fix-unsigned-variable-compared-with-zero.patch
new file mode 100644
index 00000000000..acbfa41de6a
--- /dev/null
+++ b/queue-5.4/s390-crypto-fix-unsigned-variable-compared-with-zero.patch
@@ -0,0 +1,50 @@
+From 4cc834294973eb8b55314d0416df3aa7f18f13f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Nov 2019 15:30:05 +0800
+Subject: s390/crypto: Fix unsigned variable compared with zero
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 0398d4ab1677f7d8cd43aac2aa29a93dfcf9e2e3 ]
+
+s390_crypto_shash_parmsize() return type is int, it
+should not be stored in a unsigned variable, which
+compared with zero.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Fixes: 3c2eb6b76cab ("s390/crypto: Support for SHA3 via CPACF (MSA6)")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Joerg Schmidbauer <jschmidb@linux.vnet.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/crypto/sha_common.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/arch/s390/crypto/sha_common.c b/arch/s390/crypto/sha_common.c
+index d39e0f079217..686fe7aa192f 100644
+--- a/arch/s390/crypto/sha_common.c
++++ b/arch/s390/crypto/sha_common.c
+@@ -74,14 +74,17 @@ int s390_sha_final(struct shash_desc *desc, u8 *out)
+ 	struct s390_sha_ctx *ctx = shash_desc_ctx(desc);
+ 	unsigned int bsize = crypto_shash_blocksize(desc->tfm);
+ 	u64 bits;
+-	unsigned int n, mbl_offset;
++	unsigned int n;
++	int mbl_offset;
+ 
+ 	n = ctx->count % bsize;
+ 	bits = ctx->count * 8;
+-	mbl_offset = s390_crypto_shash_parmsize(ctx->func) / sizeof(u32);
++	mbl_offset = s390_crypto_shash_parmsize(ctx->func);
+ 	if (mbl_offset < 0)
+ 		return -EINVAL;
+ 
++	mbl_offset = mbl_offset / sizeof(u32);
++
+ 	/* set total msg bit length (mbl) in CPACF parmblock */
+ 	switch (ctx->func) {
+ 	case CPACF_KLMD_SHA_1:
+-- 
+2.20.1
+
diff --git a/queue-5.4/s390-disassembler-don-t-hide-instruction-addresses.patch b/queue-5.4/s390-disassembler-don-t-hide-instruction-addresses.patch
new file mode 100644
index 00000000000..e275e1bd8e9
--- /dev/null
+++ b/queue-5.4/s390-disassembler-don-t-hide-instruction-addresses.patch
@@ -0,0 +1,73 @@
+From 62f66976d32153ab4361da4675fa353bb440a259 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Oct 2019 18:25:16 +0100
+Subject: s390/disassembler: don't hide instruction addresses
+
+From: Ilya Leoshkevich <iii@linux.ibm.com>
+
+[ Upstream commit 544f1d62e3e6c6e6d17a5e56f6139208acb5ff46 ]
+
+Due to kptr_restrict, JITted BPF code is now displayed like this:
+
+000000000b6ed1b2: ebdff0800024  stmg    %r13,%r15,128(%r15)
+000000004cde2ba0: 41d0f040      la      %r13,64(%r15)
+00000000fbad41b0: a7fbffa0      aghi    %r15,-96
+
+Leaking kernel addresses to dmesg is not a concern in this case, because
+this happens only when JIT debugging is explicitly activated, which only
+root can do.
+
+Use %px in this particular instance, and also to print an instruction
+address in show_code and PCREL (e.g. brasl) arguments in print_insn.
+While at present functionally equivalent to %016lx, %px is recommended
+by Documentation/core-api/printk-formats.rst for such cases.
+
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Reviewed-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/dis.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/arch/s390/kernel/dis.c b/arch/s390/kernel/dis.c
+index 7abe6ae261b4..f304802ecf7b 100644
+--- a/arch/s390/kernel/dis.c
++++ b/arch/s390/kernel/dis.c
+@@ -461,10 +461,11 @@ static int print_insn(char *buffer, unsigned char *code, unsigned long addr)
+ 				ptr += sprintf(ptr, "%%c%i", value);
+ 			else if (operand->flags & OPERAND_VR)
+ 				ptr += sprintf(ptr, "%%v%i", value);
+-			else if (operand->flags & OPERAND_PCREL)
+-				ptr += sprintf(ptr, "%lx", (signed int) value
+-								      + addr);
+-			else if (operand->flags & OPERAND_SIGNED)
++			else if (operand->flags & OPERAND_PCREL) {
++				void *pcrel = (void *)((int)value + addr);
++
++				ptr += sprintf(ptr, "%px", pcrel);
++			} else if (operand->flags & OPERAND_SIGNED)
+ 				ptr += sprintf(ptr, "%i", value);
+ 			else
+ 				ptr += sprintf(ptr, "%u", value);
+@@ -536,7 +537,7 @@ void show_code(struct pt_regs *regs)
+ 		else
+ 			*ptr++ = ' ';
+ 		addr = regs->psw.addr + start - 32;
+-		ptr += sprintf(ptr, "%016lx: ", addr);
++		ptr += sprintf(ptr, "%px: ", (void *)addr);
+ 		if (start + opsize >= end)
+ 			break;
+ 		for (i = 0; i < opsize; i++)
+@@ -564,7 +565,7 @@ void print_fn_code(unsigned char *code, unsigned long len)
+ 		opsize = insn_length(*code);
+ 		if (opsize > len)
+ 			break;
+-		ptr += sprintf(ptr, "%p: ", code);
++		ptr += sprintf(ptr, "%px: ", code);
+ 		for (i = 0; i < opsize; i++)
+ 			ptr += sprintf(ptr, "%02x", code[i]);
+ 		*ptr++ = '\t';
+-- 
+2.20.1
+
diff --git a/queue-5.4/s390-kasan-support-memcpy_real-with-trace_irqflags.patch b/queue-5.4/s390-kasan-support-memcpy_real-with-trace_irqflags.patch
new file mode 100644
index 00000000000..55cf7e85ef9
--- /dev/null
+++ b/queue-5.4/s390-kasan-support-memcpy_real-with-trace_irqflags.patch
@@ -0,0 +1,76 @@
+From 65c7f8a0d28ed0547f924930ac0ac7b90df40847 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Nov 2019 17:33:20 +0100
+Subject: s390/kasan: support memcpy_real with TRACE_IRQFLAGS
+
+From: Vasily Gorbik <gor@linux.ibm.com>
+
+[ Upstream commit 13f9bae579c6bd051e58f326913dd09af1291208 ]
+
+Currently if the kernel is built with CONFIG_TRACE_IRQFLAGS and KASAN
+and used as crash kernel it crashes itself due to
+trace_hardirqs_off/trace_hardirqs_on being called with DAT off. This
+happens because trace_hardirqs_off/trace_hardirqs_on are instrumented and
+kasan code tries to perform access to shadow memory to validate memory
+accesses. Kasan shadow memory is populated with vmemmap, so all accesses
+require DAT on.
+
+memcpy_real could be called with DAT on or off (with kasan enabled DAT
+is set even before early code is executed).
+
+Make sure that trace_hardirqs_off/trace_hardirqs_on are called with DAT
+on and only actual __memcpy_real is called with DAT off.
+
+Also annotate __memcpy_real and _memcpy_real with __no_sanitize_address
+to avoid further problems due to switching DAT off.
+
+Reviewed-by: Philipp Rudo <prudo@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/mm/maccess.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/arch/s390/mm/maccess.c b/arch/s390/mm/maccess.c
+index 1864a8bb9622..59ad7997fed1 100644
+--- a/arch/s390/mm/maccess.c
++++ b/arch/s390/mm/maccess.c
+@@ -70,7 +70,7 @@ void notrace s390_kernel_write(void *dst, const void *src, size_t size)
+ 	spin_unlock_irqrestore(&s390_kernel_write_lock, flags);
+ }
+ 
+-static int __memcpy_real(void *dest, void *src, size_t count)
++static int __no_sanitize_address __memcpy_real(void *dest, void *src, size_t count)
+ {
+ 	register unsigned long _dest asm("2") = (unsigned long) dest;
+ 	register unsigned long _len1 asm("3") = (unsigned long) count;
+@@ -91,19 +91,23 @@ static int __memcpy_real(void *dest, void *src, size_t count)
+ 	return rc;
+ }
+ 
+-static unsigned long _memcpy_real(unsigned long dest, unsigned long src,
+-				  unsigned long count)
++static unsigned long __no_sanitize_address _memcpy_real(unsigned long dest,
++							unsigned long src,
++							unsigned long count)
+ {
+ 	int irqs_disabled, rc;
+ 	unsigned long flags;
+ 
+ 	if (!count)
+ 		return 0;
+-	flags = __arch_local_irq_stnsm(0xf8UL);
++	flags = arch_local_irq_save();
+ 	irqs_disabled = arch_irqs_disabled_flags(flags);
+ 	if (!irqs_disabled)
+ 		trace_hardirqs_off();
++	__arch_local_irq_stnsm(0xf8); // disable DAT
+ 	rc = __memcpy_real((void *) dest, (void *) src, (size_t) count);
++	if (flags & PSW_MASK_DAT)
++		__arch_local_irq_stosm(0x04); // enable DAT
+ 	if (!irqs_disabled)
+ 		trace_hardirqs_on();
+ 	__arch_local_irq_ssm(flags);
+-- 
+2.20.1
+
diff --git a/queue-5.4/s390-mm-add-mm_pxd_folded-checks-to-pxd_free.patch b/queue-5.4/s390-mm-add-mm_pxd_folded-checks-to-pxd_free.patch
new file mode 100644
index 00000000000..1012f7d13e3
--- /dev/null
+++ b/queue-5.4/s390-mm-add-mm_pxd_folded-checks-to-pxd_free.patch
@@ -0,0 +1,72 @@
+From 97df5dba595bdec32ae861a240ac6218af3dbe67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Oct 2019 14:38:08 +0200
+Subject: s390/mm: add mm_pxd_folded() checks to pxd_free()
+
+From: Gerald Schaefer <gerald.schaefer@de.ibm.com>
+
+[ Upstream commit 2416cefc504ba8ae9b17e3e6b40afc72708f96be ]
+
+Unlike pxd_free_tlb(), the pxd_free() functions do not check for folded
+page tables. This is not an issue so far, as those functions will actually
+never be called, since no code will reach them when page tables are folded.
+
+In order to avoid future issues, and to make the s390 code more similar to
+other architectures, add mm_pxd_folded() checks, similar to how it is done
+in pxd_free_tlb().
+
+This was found by testing a patch from from Anshuman Khandual, which is
+currently discussed on LKML ("mm/debug: Add tests validating architecture
+page table helpers").
+
+Signed-off-by: Gerald Schaefer <gerald.schaefer@de.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/include/asm/pgalloc.h | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/arch/s390/include/asm/pgalloc.h b/arch/s390/include/asm/pgalloc.h
+index bccb8f4a63e2..77606c4acd58 100644
+--- a/arch/s390/include/asm/pgalloc.h
++++ b/arch/s390/include/asm/pgalloc.h
+@@ -56,7 +56,12 @@ static inline p4d_t *p4d_alloc_one(struct mm_struct *mm, unsigned long address)
+ 		crst_table_init(table, _REGION2_ENTRY_EMPTY);
+ 	return (p4d_t *) table;
+ }
+-#define p4d_free(mm, p4d) crst_table_free(mm, (unsigned long *) p4d)
++
++static inline void p4d_free(struct mm_struct *mm, p4d_t *p4d)
++{
++	if (!mm_p4d_folded(mm))
++		crst_table_free(mm, (unsigned long *) p4d);
++}
+ 
+ static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long address)
+ {
+@@ -65,7 +70,12 @@ static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long address)
+ 		crst_table_init(table, _REGION3_ENTRY_EMPTY);
+ 	return (pud_t *) table;
+ }
+-#define pud_free(mm, pud) crst_table_free(mm, (unsigned long *) pud)
++
++static inline void pud_free(struct mm_struct *mm, pud_t *pud)
++{
++	if (!mm_pud_folded(mm))
++		crst_table_free(mm, (unsigned long *) pud);
++}
+ 
+ static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long vmaddr)
+ {
+@@ -83,6 +93,8 @@ static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long vmaddr)
+ 
+ static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
+ {
++	if (mm_pmd_folded(mm))
++		return;
+ 	pgtable_pmd_page_dtor(virt_to_page(pmd));
+ 	crst_table_free(mm, (unsigned long *) pmd);
+ }
+-- 
+2.20.1
+
diff --git a/queue-5.4/s390-time-ensure-get_clock_monotonic-returns-monoton.patch b/queue-5.4/s390-time-ensure-get_clock_monotonic-returns-monoton.patch
new file mode 100644
index 00000000000..d571af4d087
--- /dev/null
+++ b/queue-5.4/s390-time-ensure-get_clock_monotonic-returns-monoton.patch
@@ -0,0 +1,65 @@
+From c88867f4112dba7505ca7125854258595216e9e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Oct 2019 14:09:47 +0100
+Subject: s390/time: ensure get_clock_monotonic() returns monotonic values
+
+From: Heiko Carstens <heiko.carstens@de.ibm.com>
+
+[ Upstream commit 011620688a71f2f1fe9901dbc2479a7c01053196 ]
+
+The current implementation of get_clock_monotonic() leaves it up to
+the caller to call the function with preemption disabled. The only
+core kernel caller (sched_clock) however does not disable preemption.
+
+In order to make sure that all callers of this function see monotonic
+values handle disabling preemption within the function itself.
+
+Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/include/asm/timex.h | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/arch/s390/include/asm/timex.h b/arch/s390/include/asm/timex.h
+index 64539c221672..0f12a3f91282 100644
+--- a/arch/s390/include/asm/timex.h
++++ b/arch/s390/include/asm/timex.h
+@@ -10,8 +10,9 @@
+ #ifndef _ASM_S390_TIMEX_H
+ #define _ASM_S390_TIMEX_H
+ 
+-#include <asm/lowcore.h>
++#include <linux/preempt.h>
+ #include <linux/time64.h>
++#include <asm/lowcore.h>
+ 
+ /* The value of the TOD clock for 1.1.1970. */
+ #define TOD_UNIX_EPOCH 0x7d91048bca000000ULL
+@@ -186,15 +187,18 @@ extern unsigned char tod_clock_base[16] __aligned(8);
+ /**
+  * get_clock_monotonic - returns current time in clock rate units
+  *
+- * The caller must ensure that preemption is disabled.
+  * The clock and tod_clock_base get changed via stop_machine.
+- * Therefore preemption must be disabled when calling this
+- * function, otherwise the returned value is not guaranteed to
+- * be monotonic.
++ * Therefore preemption must be disabled, otherwise the returned
++ * value is not guaranteed to be monotonic.
+  */
+ static inline unsigned long long get_tod_clock_monotonic(void)
+ {
+-	return get_tod_clock() - *(unsigned long long *) &tod_clock_base[1];
++	unsigned long long tod;
++
++	preempt_disable();
++	tod = get_tod_clock() - *(unsigned long long *) &tod_clock_base[1];
++	preempt_enable();
++	return tod;
+ }
+ 
+ /**
+-- 
+2.20.1
+
diff --git a/queue-5.4/samples-pktgen-fix-proc_cmd-command-result-check-log.patch b/queue-5.4/samples-pktgen-fix-proc_cmd-command-result-check-log.patch
new file mode 100644
index 00000000000..e8569141b83
--- /dev/null
+++ b/queue-5.4/samples-pktgen-fix-proc_cmd-command-result-check-log.patch
@@ -0,0 +1,82 @@
+From 003684da00ce55cc2abdb51adce2c5b8077c09a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Oct 2019 17:25:07 +0900
+Subject: samples: pktgen: fix proc_cmd command result check logic
+
+From: Daniel T. Lee <danieltimlee@gmail.com>
+
+[ Upstream commit 3cad8f911575191fb3b81d8ed0e061e30f922223 ]
+
+Currently, proc_cmd is used to dispatch command to 'pg_ctrl', 'pg_thread',
+'pg_set'. proc_cmd is designed to check command result with grep the
+"Result:", but this might fail since this string is only shown in
+'pg_thread' and 'pg_set'.
+
+This commit fixes this logic by grep-ing the "Result:" string only when
+the command is not for 'pg_ctrl'.
+
+For clarity of an execution flow, 'errexit' flag has been set.
+
+To cleanup pktgen on exit, trap has been added for EXIT signal.
+
+Signed-off-by: Daniel T. Lee <danieltimlee@gmail.com>
+Acked-by: Jesper Dangaard Brouer <brouer@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ samples/pktgen/functions.sh | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+diff --git a/samples/pktgen/functions.sh b/samples/pktgen/functions.sh
+index 4af4046d71be..40873a5d1461 100644
+--- a/samples/pktgen/functions.sh
++++ b/samples/pktgen/functions.sh
+@@ -5,6 +5,8 @@
+ # Author: Jesper Dangaaard Brouer
+ # License: GPL
+ 
++set -o errexit
++
+ ## -- General shell logging cmds --
+ function err() {
+     local exitcode=$1
+@@ -58,6 +60,7 @@ function pg_set() {
+ function proc_cmd() {
+     local result
+     local proc_file=$1
++    local status=0
+     # after shift, the remaining args are contained in $@
+     shift
+     local proc_ctrl=${PROC_DIR}/$proc_file
+@@ -73,13 +76,13 @@ function proc_cmd() {
+ 	echo "cmd: $@ > $proc_ctrl"
+     fi
+     # Quoting of "$@" is important for space expansion
+-    echo "$@" > "$proc_ctrl"
+-    local status=$?
++    echo "$@" > "$proc_ctrl" || status=$?
+ 
+-    result=$(grep "Result: OK:" $proc_ctrl)
+-    # Due to pgctrl, cannot use exit code $? from grep
+-    if [[ "$result" == "" ]]; then
+-	grep "Result:" $proc_ctrl >&2
++    if [[ "$proc_file" != "pgctrl" ]]; then
++        result=$(grep "Result: OK:" $proc_ctrl) || true
++        if [[ "$result" == "" ]]; then
++            grep "Result:" $proc_ctrl >&2
++        fi
+     fi
+     if (( $status != 0 )); then
+ 	err 5 "Write error($status) occurred cmd: \"$@ > $proc_ctrl\""
+@@ -105,6 +108,8 @@ function pgset() {
+     fi
+ }
+ 
++[[ $EUID -eq 0 ]] && trap 'pg_ctrl "reset"' EXIT
++
+ ## -- General shell tricks --
+ 
+ function root_check_run_with_sudo() {
+-- 
+2.20.1
+
diff --git a/queue-5.4/sched-uclamp-fix-overzealous-type-replacement.patch b/queue-5.4/sched-uclamp-fix-overzealous-type-replacement.patch
new file mode 100644
index 00000000000..c01255198fc
--- /dev/null
+++ b/queue-5.4/sched-uclamp-fix-overzealous-type-replacement.patch
@@ -0,0 +1,91 @@
+From 13d5c64fc63d1d69341a9cac258ede4c5bf507ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Nov 2019 10:39:08 +0000
+Subject: sched/uclamp: Fix overzealous type replacement
+
+From: Valentin Schneider <valentin.schneider@arm.com>
+
+[ Upstream commit 7763baace1b738d65efa46d68326c9406311c6bf ]
+
+Some uclamp helpers had their return type changed from 'unsigned int' to
+'enum uclamp_id' by commit
+
+  0413d7f33e60 ("sched/uclamp: Always use 'enum uclamp_id' for clamp_id values")
+
+but it happens that some do return a value in the [0, SCHED_CAPACITY_SCALE]
+range, which should really be unsigned int. The affected helpers are
+uclamp_none(), uclamp_rq_max_value() and uclamp_eff_value(). Fix those up.
+
+Note that this doesn't lead to any obj diff using a relatively recent
+aarch64 compiler (8.3-2019.03). The current code of e.g. uclamp_eff_value()
+properly returns an 11 bit value (bits_per(1024)) and doesn't seem to do
+anything funny. I'm still marking this as fixing the above commit to be on
+the safe side.
+
+Signed-off-by: Valentin Schneider <valentin.schneider@arm.com>
+Reviewed-by: Qais Yousef <qais.yousef@arm.com>
+Acked-by: Vincent Guittot <vincent.guittot@linaro.org>
+Cc: Dietmar.Eggemann@arm.com
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: patrick.bellasi@matbug.net
+Cc: qperret@google.com
+Cc: surenb@google.com
+Cc: tj@kernel.org
+Fixes: 0413d7f33e60 ("sched/uclamp: Always use 'enum uclamp_id' for clamp_id values")
+Link: https://lkml.kernel.org/r/20191115103908.27610-1-valentin.schneider@arm.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/core.c  | 6 +++---
+ kernel/sched/sched.h | 2 +-
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 44123b4d14e8..8dacda4b0362 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -810,7 +810,7 @@ static inline unsigned int uclamp_bucket_base_value(unsigned int clamp_value)
+ 	return UCLAMP_BUCKET_DELTA * uclamp_bucket_id(clamp_value);
+ }
+ 
+-static inline enum uclamp_id uclamp_none(enum uclamp_id clamp_id)
++static inline unsigned int uclamp_none(enum uclamp_id clamp_id)
+ {
+ 	if (clamp_id == UCLAMP_MIN)
+ 		return 0;
+@@ -853,7 +853,7 @@ static inline void uclamp_idle_reset(struct rq *rq, enum uclamp_id clamp_id,
+ }
+ 
+ static inline
+-enum uclamp_id uclamp_rq_max_value(struct rq *rq, enum uclamp_id clamp_id,
++unsigned int uclamp_rq_max_value(struct rq *rq, enum uclamp_id clamp_id,
+ 				   unsigned int clamp_value)
+ {
+ 	struct uclamp_bucket *bucket = rq->uclamp[clamp_id].bucket;
+@@ -918,7 +918,7 @@ uclamp_eff_get(struct task_struct *p, enum uclamp_id clamp_id)
+ 	return uc_req;
+ }
+ 
+-enum uclamp_id uclamp_eff_value(struct task_struct *p, enum uclamp_id clamp_id)
++unsigned int uclamp_eff_value(struct task_struct *p, enum uclamp_id clamp_id)
+ {
+ 	struct uclamp_se uc_eff;
+ 
+diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
+index c8870c5bd7df..49ed949f850c 100644
+--- a/kernel/sched/sched.h
++++ b/kernel/sched/sched.h
+@@ -2309,7 +2309,7 @@ static inline void cpufreq_update_util(struct rq *rq, unsigned int flags) {}
+ #endif /* CONFIG_CPU_FREQ */
+ 
+ #ifdef CONFIG_UCLAMP_TASK
+-enum uclamp_id uclamp_eff_value(struct task_struct *p, enum uclamp_id clamp_id);
++unsigned int uclamp_eff_value(struct task_struct *p, enum uclamp_id clamp_id);
+ 
+ static __always_inline
+ unsigned int uclamp_util_with(struct rq *rq, unsigned int util,
+-- 
+2.20.1
+
diff --git a/queue-5.4/selftests-bpf-correct-path-to-include-msg-path.patch b/queue-5.4/selftests-bpf-correct-path-to-include-msg-path.patch
new file mode 100644
index 00000000000..558ca35c579
--- /dev/null
+++ b/queue-5.4/selftests-bpf-correct-path-to-include-msg-path.patch
@@ -0,0 +1,72 @@
+From ba928fb4df8870aeb8a3d831fcdec396faee2044 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Oct 2019 15:04:04 +0300
+Subject: selftests/bpf: Correct path to include msg + path
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ivan Khoronzhuk <ivan.khoronzhuk@linaro.org>
+
+[ Upstream commit c588146378962786ddeec817f7736a53298a7b01 ]
+
+The "path" buf is supposed to contain path + printf msg up to 24 bytes.
+It will be cut anyway, but compiler generates truncation warns like:
+
+"
+samples/bpf/../../tools/testing/selftests/bpf/cgroup_helpers.c: In
+function ‘setup_cgroup_environment’:
+samples/bpf/../../tools/testing/selftests/bpf/cgroup_helpers.c:52:34:
+warning: ‘/cgroup.controllers’ directive output may be truncated
+writing 19 bytes into a region of size between 1 and 4097
+[-Wformat-truncation=]
+snprintf(path, sizeof(path), "%s/cgroup.controllers", cgroup_path);
+				  ^~~~~~~~~~~~~~~~~~~
+samples/bpf/../../tools/testing/selftests/bpf/cgroup_helpers.c:52:2:
+note: ‘snprintf’ output between 20 and 4116 bytes into a destination
+of size 4097
+snprintf(path, sizeof(path), "%s/cgroup.controllers", cgroup_path);
+^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+samples/bpf/../../tools/testing/selftests/bpf/cgroup_helpers.c:72:34:
+warning: ‘/cgroup.subtree_control’ directive output may be truncated
+writing 23 bytes into a region of size between 1 and 4097
+[-Wformat-truncation=]
+snprintf(path, sizeof(path), "%s/cgroup.subtree_control",
+				  ^~~~~~~~~~~~~~~~~~~~~~~
+cgroup_path);
+samples/bpf/../../tools/testing/selftests/bpf/cgroup_helpers.c:72:2:
+note: ‘snprintf’ output between 24 and 4120 bytes into a destination
+of size 4097
+snprintf(path, sizeof(path), "%s/cgroup.subtree_control",
+cgroup_path);
+"
+
+In order to avoid warns, lets decrease buf size for cgroup workdir on
+24 bytes with assumption to include also "/cgroup.subtree_control" to
+the address. The cut will never happen anyway.
+
+Signed-off-by: Ivan Khoronzhuk <ivan.khoronzhuk@linaro.org>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Song Liu <songliubraving@fb.com>
+Link: https://lore.kernel.org/bpf/20191002120404.26962-3-ivan.khoronzhuk@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/cgroup_helpers.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/cgroup_helpers.c b/tools/testing/selftests/bpf/cgroup_helpers.c
+index e95c33e333a4..b29a73fe64db 100644
+--- a/tools/testing/selftests/bpf/cgroup_helpers.c
++++ b/tools/testing/selftests/bpf/cgroup_helpers.c
+@@ -98,7 +98,7 @@ int enable_all_controllers(char *cgroup_path)
+  */
+ int setup_cgroup_environment(void)
+ {
+-	char cgroup_workdir[PATH_MAX + 1];
++	char cgroup_workdir[PATH_MAX - 24];
+ 
+ 	format_cgroup_path(cgroup_workdir, "");
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/selftests-bpf-fix-btf_dump-padding-test-case.patch b/queue-5.4/selftests-bpf-fix-btf_dump-padding-test-case.patch
new file mode 100644
index 00000000000..cc62621c69a
--- /dev/null
+++ b/queue-5.4/selftests-bpf-fix-btf_dump-padding-test-case.patch
@@ -0,0 +1,49 @@
+From c364fcdbda1c559de0c82df2a7eb6b1b7baa08e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2019 16:10:08 -0700
+Subject: selftests/bpf: Fix btf_dump padding test case
+
+From: Andrii Nakryiko <andriin@fb.com>
+
+[ Upstream commit 76790c7c66ccc8695afc75e73f54c0ca86267ed2 ]
+
+Existing padding test case for btf_dump has a good test that was
+supposed to test padding generation at the end of a struct, but its
+expected output was specified incorrectly. Fix this.
+
+Fixes: 2d2a3ad872f8 ("selftests/bpf: add btf_dump BTF-to-C conversion tests")
+Reported-by: John Fastabend <john.fastabend@gmail.com>
+Signed-off-by: Andrii Nakryiko <andriin@fb.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Link: https://lore.kernel.org/bpf/20191008231009.2991130-4-andriin@fb.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../testing/selftests/bpf/progs/btf_dump_test_case_padding.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/progs/btf_dump_test_case_padding.c b/tools/testing/selftests/bpf/progs/btf_dump_test_case_padding.c
+index 3a62119c7498..35c512818a56 100644
+--- a/tools/testing/selftests/bpf/progs/btf_dump_test_case_padding.c
++++ b/tools/testing/selftests/bpf/progs/btf_dump_test_case_padding.c
+@@ -62,6 +62,10 @@ struct padded_a_lot {
+  *	long: 64;
+  *	long: 64;
+  *	int b;
++ *	long: 32;
++ *	long: 64;
++ *	long: 64;
++ *	long: 64;
+  *};
+  *
+  */
+@@ -95,7 +99,6 @@ struct zone_padding {
+ struct zone {
+ 	int a;
+ 	short b;
+-	short: 16;
+ 	struct zone_padding __pad__;
+ };
+ 
+-- 
+2.20.1
+
diff --git a/queue-5.4/selftests-bpf-fix-test_tc_tunnel-hanging.patch b/queue-5.4/selftests-bpf-fix-test_tc_tunnel-hanging.patch
new file mode 100644
index 00000000000..c5d6260fe36
--- /dev/null
+++ b/queue-5.4/selftests-bpf-fix-test_tc_tunnel-hanging.patch
@@ -0,0 +1,58 @@
+From f9a3baf100167385f33876a10d7850c294d94b0f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Nov 2019 13:43:23 +0100
+Subject: selftests, bpf: Fix test_tc_tunnel hanging
+
+From: Jiri Benc <jbenc@redhat.com>
+
+[ Upstream commit 3b054b7133b4ad93671c82e8d6185258e3f1a7a5 ]
+
+When run_kselftests.sh is run, it hangs after test_tc_tunnel.sh. The reason
+is test_tc_tunnel.sh ensures the server ('nc -l') is run all the time,
+starting it again every time it is expected to terminate. The exception is
+the final client_connect: the server is not started anymore, which ensures
+no process is kept running after the test is finished.
+
+For a sit test, though, the script is terminated prematurely without the
+final client_connect and the 'nc' process keeps running. This in turn causes
+the run_one function in kselftest/runner.sh to hang forever, waiting for the
+runaway process to finish.
+
+Ensure a remaining server is terminated on cleanup.
+
+Fixes: f6ad6accaa99 ("selftests/bpf: expand test_tc_tunnel with SIT encap")
+Signed-off-by: Jiri Benc <jbenc@redhat.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Willem de Bruijn <willemb@google.com>
+Link: https://lore.kernel.org/bpf/60919291657a9ee89c708d8aababc28ebe1420be.1573821780.git.jbenc@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_tc_tunnel.sh | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/tools/testing/selftests/bpf/test_tc_tunnel.sh b/tools/testing/selftests/bpf/test_tc_tunnel.sh
+index ff0d31d38061..7c76b841b17b 100755
+--- a/tools/testing/selftests/bpf/test_tc_tunnel.sh
++++ b/tools/testing/selftests/bpf/test_tc_tunnel.sh
+@@ -62,6 +62,10 @@ cleanup() {
+ 	if [[ -f "${infile}" ]]; then
+ 		rm "${infile}"
+ 	fi
++
++	if [[ -n $server_pid ]]; then
++		kill $server_pid 2> /dev/null
++	fi
+ }
+ 
+ server_listen() {
+@@ -77,6 +81,7 @@ client_connect() {
+ 
+ verify_data() {
+ 	wait "${server_pid}"
++	server_pid=
+ 	# sha1sum returns two fields [sha1] [filepath]
+ 	# convert to bash array and access first elem
+ 	insum=($(sha1sum ${infile}))
+-- 
+2.20.1
+
diff --git a/queue-5.4/selftests-bpf-make-a-copy-of-subtest-name.patch b/queue-5.4/selftests-bpf-make-a-copy-of-subtest-name.patch
new file mode 100644
index 00000000000..4686818a423
--- /dev/null
+++ b/queue-5.4/selftests-bpf-make-a-copy-of-subtest-name.patch
@@ -0,0 +1,74 @@
+From aec5b007a064c3aac3d75041d6365f96d24b959d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 20 Oct 2019 20:39:00 -0700
+Subject: selftests/bpf: Make a copy of subtest name
+
+From: Andrii Nakryiko <andriin@fb.com>
+
+[ Upstream commit f90415e9600c5227131531c0ed11514a2d3bbe62 ]
+
+test_progs never created a copy of subtest name, rather just stored
+pointer to whatever string test provided. This is bad as that string
+might be freed or modified by the end of subtest. Fix this by creating
+a copy of given subtest name when subtest starts.
+
+Signed-off-by: Andrii Nakryiko <andriin@fb.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20191021033902.3856966-6-andriin@fb.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_progs.c | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c
+index af75a1c7a458..3bf18364c67c 100644
+--- a/tools/testing/selftests/bpf/test_progs.c
++++ b/tools/testing/selftests/bpf/test_progs.c
+@@ -20,7 +20,7 @@ struct prog_test_def {
+ 	bool tested;
+ 	bool need_cgroup_cleanup;
+ 
+-	const char *subtest_name;
++	char *subtest_name;
+ 	int subtest_num;
+ 
+ 	/* store counts before subtest started */
+@@ -81,16 +81,17 @@ void test__end_subtest()
+ 	fprintf(env.stdout, "#%d/%d %s:%s\n",
+ 	       test->test_num, test->subtest_num,
+ 	       test->subtest_name, sub_error_cnt ? "FAIL" : "OK");
++
++	free(test->subtest_name);
++	test->subtest_name = NULL;
+ }
+ 
+ bool test__start_subtest(const char *name)
+ {
+ 	struct prog_test_def *test = env.test;
+ 
+-	if (test->subtest_name) {
++	if (test->subtest_name)
+ 		test__end_subtest();
+-		test->subtest_name = NULL;
+-	}
+ 
+ 	test->subtest_num++;
+ 
+@@ -104,7 +105,13 @@ bool test__start_subtest(const char *name)
+ 	if (!should_run(&env.subtest_selector, test->subtest_num, name))
+ 		return false;
+ 
+-	test->subtest_name = name;
++	test->subtest_name = strdup(name);
++	if (!test->subtest_name) {
++		fprintf(env.stderr,
++			"Subtest #%d: failed to copy subtest name!\n",
++			test->subtest_num);
++		return false;
++	}
+ 	env.test->old_error_cnt = env.test->error_cnt;
+ 
+ 	return true;
+-- 
+2.20.1
+
diff --git a/queue-5.4/selftests-bpf-workaround-an-alu32-sub-register-spill.patch b/queue-5.4/selftests-bpf-workaround-an-alu32-sub-register-spill.patch
new file mode 100644
index 00000000000..5263e34ac18
--- /dev/null
+++ b/queue-5.4/selftests-bpf-workaround-an-alu32-sub-register-spill.patch
@@ -0,0 +1,82 @@
+From 3fefd2213c41e5e0f0dc45455bf169c239b61102 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 17 Nov 2019 13:40:36 -0800
+Subject: selftests, bpf: Workaround an alu32 sub-register spilling issue
+
+From: Yonghong Song <yhs@fb.com>
+
+[ Upstream commit 2ea2612b987ad703235c92be21d4e98ee9c2c67c ]
+
+Currently, with latest llvm trunk, selftest test_progs failed obj
+file test_seg6_loop.o with the following error in verifier:
+
+  infinite loop detected at insn 76
+
+The byte code sequence looks like below, and noted that alu32 has been
+turned off by default for better generated codes in general:
+
+      48:       w3 = 100
+      49:       *(u32 *)(r10 - 68) = r3
+      ...
+  ;             if (tlv.type == SR6_TLV_PADDING) {
+      76:       if w3 == 5 goto -18 <LBB0_19>
+      ...
+      85:       r1 = *(u32 *)(r10 - 68)
+  ;     for (int i = 0; i < 100; i++) {
+      86:       w1 += -1
+      87:       if w1 == 0 goto +5 <LBB0_20>
+      88:       *(u32 *)(r10 - 68) = r1
+
+The main reason for verification failure is due to partial spills at
+r10 - 68 for induction variable "i".
+
+Current verifier only handles spills with 8-byte values. The above 4-byte
+value spill to stack is treated to STACK_MISC and its content is not
+saved. For the above example:
+
+    w3 = 100
+      R3_w=inv100 fp-64_w=inv1086626730498
+    *(u32 *)(r10 - 68) = r3
+      R3_w=inv100 fp-64_w=inv1086626730498
+    ...
+    r1 = *(u32 *)(r10 - 68)
+      R1_w=inv(id=0,umax_value=4294967295,var_off=(0x0; 0xffffffff))
+      fp-64=inv1086626730498
+
+To resolve this issue, verifier needs to be extended to track sub-registers
+in spilling, or llvm needs to enhanced to prevent sub-register spilling
+in register allocation phase. The former will increase verifier complexity
+and the latter will need some llvm "hacking".
+
+Let us workaround this issue by declaring the induction variable as "long"
+type so spilling will happen at non sub-register level. We can revisit this
+later if sub-register spilling causes similar or other verification issues.
+
+Signed-off-by: Yonghong Song <yhs@fb.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Andrii Nakryiko <andriin@fb.com>
+Link: https://lore.kernel.org/bpf/20191117214036.1309510-1-yhs@fb.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/progs/test_seg6_loop.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/progs/test_seg6_loop.c b/tools/testing/selftests/bpf/progs/test_seg6_loop.c
+index c4d104428643..69880c1e7700 100644
+--- a/tools/testing/selftests/bpf/progs/test_seg6_loop.c
++++ b/tools/testing/selftests/bpf/progs/test_seg6_loop.c
+@@ -132,8 +132,10 @@ static __always_inline int is_valid_tlv_boundary(struct __sk_buff *skb,
+ 	*pad_off = 0;
+ 
+ 	// we can only go as far as ~10 TLVs due to the BPF max stack size
++	// workaround: define induction variable "i" as "long" instead
++	// of "int" to prevent alu32 sub-register spilling.
+ 	#pragma clang loop unroll(disable)
+-	for (int i = 0; i < 100; i++) {
++	for (long i = 0; i < 100; i++) {
+ 		struct sr6_tlv_t tlv;
+ 
+ 		if (cur_off == *tlv_off)
+-- 
+2.20.1
+
diff --git a/queue-5.4/selftests-fix-o-and-kbuild_output-handling-for-relat.patch b/queue-5.4/selftests-fix-o-and-kbuild_output-handling-for-relat.patch
new file mode 100644
index 00000000000..4ac81983507
--- /dev/null
+++ b/queue-5.4/selftests-fix-o-and-kbuild_output-handling-for-relat.patch
@@ -0,0 +1,74 @@
+From 708656e3c5fcad36fab328b7849f356702562002 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Oct 2019 19:45:05 -0600
+Subject: selftests: Fix O= and KBUILD_OUTPUT handling for relative paths
+
+From: Shuah Khan <skhan@linuxfoundation.org>
+
+[ Upstream commit 303e6218ecec475d5bc3e5922dec770ee5baf107 ]
+
+Fix O= and KBUILD_OUTPUT handling for relative paths.
+
+export KBUILD_OUTPUT=../kselftest_size
+make TARGETS=size kselftest-all
+
+or
+
+make O=../kselftest_size TARGETS=size kselftest-all
+
+In both of these cases, targets get built in ../kselftest_size which is
+a one level up from the size test directory.
+
+make[1]: Entering directory '/mnt/data/lkml/kselftest_size'
+make --no-builtin-rules INSTALL_HDR_PATH=$BUILD/usr \
+        ARCH=x86 -C ../../.. headers_install
+  INSTALL ../kselftest_size/usr/include
+gcc -static -ffreestanding -nostartfiles -s    get_size.c  -o ../kselftest_size/size/get_size
+/usr/bin/ld: cannot open output file ../kselftest_size/size/get_size: No such file or directory
+collect2: error: ld returned 1 exit status
+make[3]: *** [../lib.mk:138: ../kselftest_size/size/get_size] Error 1
+make[2]: *** [Makefile:143: all] Error 2
+make[1]: *** [/mnt/data/lkml/linux_5.4/Makefile:1221: kselftest-all] Error 2
+make[1]: Leaving directory '/mnt/data/lkml/kselftest_size'
+make: *** [Makefile:179: sub-make] Error 2
+
+Use abs_objtree exported by the main Makefile.
+
+Reported-by: Tim Bird <Tim.Bird@sony.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Tested-by: Tim Bird <tim.bird@sony.com>
+Acked-by: Tim Bird <tim.bird@sony.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/Makefile | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile
+index 612f6757015d..a3e253e49bb4 100644
+--- a/tools/testing/selftests/Makefile
++++ b/tools/testing/selftests/Makefile
+@@ -86,10 +86,10 @@ override LDFLAGS =
+ endif
+ 
+ ifneq ($(O),)
+-	BUILD := $(O)
++	BUILD := $(abs_objtree)
+ else
+ 	ifneq ($(KBUILD_OUTPUT),)
+-		BUILD := $(KBUILD_OUTPUT)/kselftest
++		BUILD := $(abs_objtree)/kselftest
+ 	else
+ 		BUILD := $(shell pwd)
+ 		DEFAULT_INSTALL_HDR_PATH := 1
+@@ -102,6 +102,7 @@ include $(top_srcdir)/scripts/subarch.include
+ ARCH           ?= $(SUBARCH)
+ export KSFT_KHDR_INSTALL_DONE := 1
+ export BUILD
++#$(info abd_objtree = $(abs_objtree) BUILD = $(BUILD))
+ 
+ # build and run gpio when output directory is the src dir.
+ # gpio has dependency on tools/gpio and builds tools/gpio
+-- 
+2.20.1
+
diff --git a/queue-5.4/selftests-net-fix-printf-format-warnings-on-arm.patch b/queue-5.4/selftests-net-fix-printf-format-warnings-on-arm.patch
new file mode 100644
index 00000000000..f77eaa21b17
--- /dev/null
+++ b/queue-5.4/selftests-net-fix-printf-format-warnings-on-arm.patch
@@ -0,0 +1,74 @@
+From b9250ba49e711359af498e60ba63380c6c537adc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Oct 2019 13:58:07 +0900
+Subject: selftests: net: Fix printf format warnings on arm
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit 670cd6849ea36ea4df2f2941cf4717dff8755abe ]
+
+Fix printf format warnings on arm (and other 32bit arch).
+
+ - udpgso.c and udpgso_bench_tx use %lu for size_t but it
+   should be unsigned long long on 32bit arch.
+
+ - so_txtime.c uses %ld for int64_t, but it should be
+   unsigned long long on 32bit arch.
+
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Willem de Bruijn <willemb@google.com>
+Cc: David S. Miller <davem@davemloft.net>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/so_txtime.c       | 4 ++--
+ tools/testing/selftests/net/udpgso.c          | 3 ++-
+ tools/testing/selftests/net/udpgso_bench_tx.c | 3 ++-
+ 3 files changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/tools/testing/selftests/net/so_txtime.c b/tools/testing/selftests/net/so_txtime.c
+index 53f598f06647..34df4c8882af 100644
+--- a/tools/testing/selftests/net/so_txtime.c
++++ b/tools/testing/selftests/net/so_txtime.c
+@@ -105,8 +105,8 @@ static void do_recv_one(int fdr, struct timed_send *ts)
+ 	tstop = (gettime_ns() - glob_tstart) / 1000;
+ 	texpect = ts->delay_us >= 0 ? ts->delay_us : 0;
+ 
+-	fprintf(stderr, "payload:%c delay:%ld expected:%ld (us)\n",
+-			rbuf[0], tstop, texpect);
++	fprintf(stderr, "payload:%c delay:%lld expected:%lld (us)\n",
++			rbuf[0], (long long)tstop, (long long)texpect);
+ 
+ 	if (rbuf[0] != ts->data)
+ 		error(1, 0, "payload mismatch. expected %c", ts->data);
+diff --git a/tools/testing/selftests/net/udpgso.c b/tools/testing/selftests/net/udpgso.c
+index 614b31aad168..c66da6ffd6d8 100644
+--- a/tools/testing/selftests/net/udpgso.c
++++ b/tools/testing/selftests/net/udpgso.c
+@@ -440,7 +440,8 @@ static bool __send_one(int fd, struct msghdr *msg, int flags)
+ 	if (ret == -1)
+ 		error(1, errno, "sendmsg");
+ 	if (ret != msg->msg_iov->iov_len)
+-		error(1, 0, "sendto: %d != %lu", ret, msg->msg_iov->iov_len);
++		error(1, 0, "sendto: %d != %llu", ret,
++			(unsigned long long)msg->msg_iov->iov_len);
+ 	if (msg->msg_flags)
+ 		error(1, 0, "sendmsg: return flags 0x%x\n", msg->msg_flags);
+ 
+diff --git a/tools/testing/selftests/net/udpgso_bench_tx.c b/tools/testing/selftests/net/udpgso_bench_tx.c
+index ada99496634a..17512a43885e 100644
+--- a/tools/testing/selftests/net/udpgso_bench_tx.c
++++ b/tools/testing/selftests/net/udpgso_bench_tx.c
+@@ -405,7 +405,8 @@ static int send_udp_segment(int fd, char *data)
+ 	if (ret == -1)
+ 		error(1, errno, "sendmsg");
+ 	if (ret != iov.iov_len)
+-		error(1, 0, "sendmsg: %u != %lu\n", ret, iov.iov_len);
++		error(1, 0, "sendmsg: %u != %llu\n", ret,
++			(unsigned long long)iov.iov_len);
+ 
+ 	return 1;
+ }
+-- 
+2.20.1
+
diff --git a/queue-5.4/selftests-proc-make-va_max-1mb.patch b/queue-5.4/selftests-proc-make-va_max-1mb.patch
new file mode 100644
index 00000000000..3b0329ae8ae
--- /dev/null
+++ b/queue-5.4/selftests-proc-make-va_max-1mb.patch
@@ -0,0 +1,45 @@
+From da7326f4ecbc42ba32a77658e9f02834e59e958d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Oct 2019 13:57:40 +0900
+Subject: selftests: proc: Make va_max 1MB
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit 2f3571ea71311bbb2cbb9c3bbefc9c1969a3e889 ]
+
+Currently proc-self-map-files-002.c sets va_max (max test address
+of user virtual address) to 4GB, but it is too big for 32bit
+arch and 1UL << 32 is overflow on 32bit long.
+Also since this value should be enough bigger than vm.mmap_min_addr
+(64KB or 32KB by default), 1MB should be enough.
+
+Make va_max 1MB unconditionally.
+
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Alexey Dobriyan <adobriyan@gmail.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/proc/proc-self-map-files-002.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/proc/proc-self-map-files-002.c b/tools/testing/selftests/proc/proc-self-map-files-002.c
+index 47b7473dedef..e6aa00a183bc 100644
+--- a/tools/testing/selftests/proc/proc-self-map-files-002.c
++++ b/tools/testing/selftests/proc/proc-self-map-files-002.c
+@@ -47,7 +47,11 @@ static void fail(const char *fmt, unsigned long a, unsigned long b)
+ int main(void)
+ {
+ 	const int PAGE_SIZE = sysconf(_SC_PAGESIZE);
+-	const unsigned long va_max = 1UL << 32;
++	/*
++	 * va_max must be enough bigger than vm.mmap_min_addr, which is
++	 * 64KB/32KB by default. (depends on CONFIG_LSM_MMAP_MIN_ADDR)
++	 */
++	const unsigned long va_max = 1UL << 20;
+ 	unsigned long va;
+ 	void *p;
+ 	int fd;
+-- 
+2.20.1
+
diff --git a/queue-5.4/series b/queue-5.4/series
new file mode 100644
index 00000000000..f4e7a8ab922
--- /dev/null
+++ b/queue-5.4/series
@@ -0,0 +1,326 @@
+drm-vc4-vc4_hdmi-fill-in-connector-info.patch
+drm-virtio-switch-virtio_gpu_wait_ioctl-to-gem-helpe.patch
+drm-mst-fix-query_payload-ack-reply-struct.patch
+drm-mipi-dbi-fix-a-loop-in-debugfs-code.patch
+drm-panel-add-missing-drm_panel_init-in-panel-driver.patch
+drm-exynos-exynos_hdmi-use-cec_notifier_conn_-un-reg.patch
+drm-use-eopnotsupp-not-enotsupp.patch
+drm-amd-display-verify-stream-link-before-link-test.patch
+drm-bridge-analogix-anx78xx-silence-eprobe_defer-war.patch
+drm-amd-display-otc-underflow-fix.patch
+iio-max31856-add-missing-of_node-and-parent-referenc.patch
+iio-light-bh1750-resolve-compiler-warning-and-make-c.patch
+drm-amdgpu-sriov-add-ring_stop-before-ring_create-in.patch
+drm-amdgpu-grab-the-id-mgr-lock-while-accessing-pass.patch
+drm-ttm-return-ebusy-on-pipelining-with-no_gpu_wait-.patch
+drm-amd-display-rebuild-mapped-resources-after-pipe-.patch
+ath10k-add-cleanup-in-ath10k_sta_state.patch
+drm-amd-display-handle-virtual-signal-type-in-disabl.patch
+ath10k-check-if-station-exists-before-forwarding-tx-.patch
+spi-add-call-to-spi_slave_abort-function-when-spidev.patch
+drm-meson-vclk-use-the-correct-g12a-frac-max-value.patch
+staging-rtl8192u-fix-multiple-memory-leaks-on-error-.patch
+staging-rtl8188eu-fix-possible-null-dereference.patch
+rtlwifi-prevent-memory-leak-in-rtl_usb_probe.patch
+libertas-fix-a-potential-null-pointer-dereference.patch
+revert-pinctrl-sh-pfc-r8a77990-fix-mod_sel1-bit30-wh.patch
+revert-pinctrl-sh-pfc-r8a77990-fix-mod_sel1-bit31-wh.patch
+ath10k-fix-backtrace-on-coredump.patch
+ib-iser-bound-protection_sg-size-by-data_sg-size.patch
+drm-komeda-workaround-for-broken-flip_complete-times.patch
+spi-gpio-prevent-memory-leak-in-spi_gpio_probe.patch
+media-am437x-vpfe-setting-std-to-current-value-is-no.patch
+media-cedrus-fill-in-bus_info-for-media-device.patch
+media-seco-cec-add-a-missing-release_region-in-an-er.patch
+media-vim2m-fix-abort-issue.patch
+media-vim2m-fix-bug_on-in-vim2m_device_release.patch
+media-max2175-fix-build-error-without-config_regmap_.patch
+media-ov6650-fix-control-handler-not-freed-on-init-e.patch
+media-i2c-ov2659-fix-s_stream-return-value.patch
+media-ov6650-fix-crop-rectangle-alignment-not-passed.patch
+media-i2c-ov2659-fix-missing-720p-register-config.patch
+media-ov6650-fix-stored-frame-format-not-in-sync-wit.patch
+media-ov6650-fix-stored-crop-rectangle-not-in-sync-w.patch
+tools-power-cpupower-fix-initializer-override-in-hsw.patch
+media-venus-core-fix-msm8996-frequency-table.patch
+ath10k-fix-offchannel-tx-failure-when-no-ath10k_mac_.patch
+media-vimc-fix-gpf-in-rmmod-path-when-stream-is-acti.patch
+drm-amd-display-set-number-of-pipes-to-1-if-the-seco.patch
+pinctrl-devicetree-avoid-taking-direct-reference-to-.patch
+drm-sun4i-dsi-fix-tcon-drq-set-bits.patch
+drm-amdkfd-fix-a-potential-null-pointer-dereference-.patch
+x86-math-emu-check-__copy_from_user-result.patch
+drm-amd-powerplay-a-workaround-to-gpu-reset-on-apu.patch
+selftests-bpf-correct-path-to-include-msg-path.patch
+drm-amd-display-set-minimum-abm-backlight-level.patch
+media-venus-fix-occasionally-failures-to-suspend.patch
+rtw88-fix-nss-of-hw_cap.patch
+drm-amd-display-fix-struct-init-in-update_bounding_b.patch
+usb-renesas_usbhs-add-suspend-event-support-in-gadge.patch
+crypto-aegis128-neon-use-clang-compatible-cflags-for.patch
+hwrng-omap3-rom-call-clk_disable_unprepare-on-exit-o.patch
+regulator-max8907-fix-the-usage-of-uninitialized-var.patch
+tools-memory-model-fix-data-race-detection-for-unord.patch
+media-flexcop-usb-fix-null-ptr-deref-in-flexcop_usb_.patch
+media-cec-funcs.h-add-status_req-checks.patch
+media-meson-ao-cec-move-cec_notifier_cec_adap_regist.patch
+drm-bridge-dw-hdmi-refuse-ddc-ci-transfers-on-the-in.patch
+samples-pktgen-fix-proc_cmd-command-result-check-log.patch
+block-fix-writeback-throttling-w-1-compiler-warnings.patch
+mips-syscall-emit-loongson3-sync-workarounds-within-.patch
+drm-amdkfd-fix-mqd-size-calculation.patch
+mips-futex-emit-loongson3-sync-workarounds-within-as.patch
+mwifiex-pcie-fix-memory-leak-in-mwifiex_pcie_init_ev.patch
+drm-drm_vblank-change-einval-by-the-correct-errno.patch
+selftests-bpf-fix-btf_dump-padding-test-case.patch
+libbpf-fix-struct-end-padding-in-btf_dump.patch
+libbpf-fix-passing-uninitialized-bytes-to-setsockopt.patch
+net-smc-increase-device-refcount-for-added-link-grou.patch
+team-call-rcu-read-lock-when-walking-the-port_list.patch
+media-cx88-fix-some-error-handling-path-in-cx8800_in.patch
+crypto-inside-secure-fix-a-maybe-uninitialized-warni.patch
+crypto-aegis128-simd-build-32-bit-arm-for-v8-archite.patch
+misc-fastrpc-fix-memory-leak-from-miscdev-name.patch
+asoc-sof-enable-sync_write-in-hdac_bus.patch
+media-ti-vpe-vpe-fix-motion-vector-vpdma-stride.patch
+media-ti-vpe-vpe-fix-a-v4l2-compliance-warning-about.patch
+media-ti-vpe-vpe-fix-a-v4l2-compliance-failure-about.patch
+media-ti-vpe-vpe-make-sure-yuyv-is-set-as-default-fo.patch
+media-ti-vpe-vpe-fix-a-v4l2-compliance-failure-causi.patch
+media-ti-vpe-vpe-ensure-buffers-are-cleaned-up-prope.patch
+drm-amd-display-properly-round-nominal-frequency-for.patch
+drm-amd-display-wait-for-set-pipe-mcp-command-comple.patch
+media-ti-vpe-vpe-fix-a-v4l2-compliance-failure-about.patch-8034
+drm-amd-display-add-new-active-dongle-to-existent-w-.patch
+syscalls-x86-use-the-correct-function-type-in-syscal.patch
+drm-amd-display-fix-dongle_caps-containing-stale-inf.patch
+extcon-sm5502-reset-registers-during-initialization.patch
+drm-amd-display-program-dwb-watermarks-from-correct-.patch
+x86-mm-use-the-correct-function-type-for-native_set_.patch
+ath10k-correct-error-handling-of-dma_map_single.patch
+rtw88-coex-set-4-slot-mode-for-a2dp.patch
+drm-bridge-dw-hdmi-restore-audio-when-setting-a-mode.patch
+perf-test-report-failure-for-mmap-events.patch
+perf-report-add-warning-when-libunwind-not-compiled-.patch
+perf-test-avoid-infinite-loop-for-task-exit-case.patch
+perf-vendor-events-arm64-fix-hisi-hip08-ddrc-pmu-eve.patch
+perf-trace-filter-own-pid-to-avoid-a-feedback-look-i.patch
+usb-usbfs-suppress-problematic-bind-and-unbind-ueven.patch
+drm-amd-powerplay-avoid-disabling-ecc-if-ras-is-enab.patch
+iio-adc-max1027-reset-the-device-at-probe-time.patch
+bluetooth-btusb-avoid-unused-function-warning.patch
+bluetooth-missed-cpu_to_le16-conversion-in-hci_init4.patch
+bluetooth-workaround-directed-advertising-bug-in-bro.patch
+bluetooth-hci_core-fix-init-for-hci_user_channel.patch
+selftests-fix-o-and-kbuild_output-handling-for-relat.patch
+bpf-stackmap-fix-deadlock-with-rq_lock-in-bpf_get_st.patch
+x86-mce-lower-throttling-mce-messages-priority-to-wa.patch
+drm-amd-display-enable-hostvm-based-on-roimmu-active.patch
+drm-amd-display-fix-header-for-rn-clk-mgr.patch
+drm-amdgpu-fix-amdgpu-trace-event-print-string-forma.patch
+staging-iio-ad9834-add-a-check-for-devm_clk_get.patch
+power-supply-cpcap-battery-check-voltage-before-orde.patch
+perf-tests-disable-bp_signal-testing-for-arm64.patch
+selftests-bpf-make-a-copy-of-subtest-name.patch
+net-hns3-log-and-clear-hardware-error-after-reset-co.patch
+rdma-hns-fix-wrong-parameters-when-initial-mtt-of-sr.patch
+drm-gma500-fix-memory-disclosures-due-to-uninitializ.patch
+asoc-soc-pcm-fixup-dpcm_prune_paths-loop-continue.patch
+rtl8xxxu-fix-rtl8723bu-connection-failure-issue-afte.patch
+rdma-siw-fix-sq-rq-drain-logic.patch
+ipmi-don-t-allow-device-module-unload-when-in-use.patch
+x86-ioapic-prevent-inconsistent-state-when-moving-an.patch
+media-cedrus-fix-undefined-shift-with-a-shift_and_ma.patch
+media-aspeed-set-hsync-and-vsync-polarities-to-norma.patch
+drm-nouveau-don-t-grab-runtime-pm-refs-for-hpd-irqs.patch
+media-ov6650-fix-stored-frame-interval-not-in-sync-w.patch
+media-ad5820-define-entity-function.patch
+media-ov5640-make-2592x1944-mode-only-available-at-1.patch
+media-st-mipid02-add-a-check-for-devm_gpiod_get_opti.patch
+media-imx7-mipi-csis-add-a-check-for-devm_regulator_.patch
+media-aspeed-clear-garbage-interrupts.patch
+media-smiapp-register-sensor-after-enabling-runtime-.patch
+md-no-longer-compare-spare-disk-superblock-events-in.patch
+staging-wilc1000-potential-corruption-in-wilc_parse_.patch
+md-bitmap-avoid-race-window-between-md_bitmap_resize.patch
+drm-don-t-free-jobs-in-wait_event_interruptible.patch
+edac-amd64-set-grain-per-dimm.patch
+arm64-psci-reduce-the-waiting-time-for-cpu_psci_cpu_.patch
+drm-amd-display-setting-the-dig_mode-to-the-correct-.patch
+i40e-initialize-itrn-registers-with-correct-values.patch
+drm-amd-display-correctly-populate-dpp-refclk-in-fpg.patch
+i40e-wrong-advertised-fec-modes-after-set-fec-to-aut.patch
+net-phy-dp83867-enable-robust-auto-mdix.patch
+drm-tegra-sor-use-correct-sor-index-on-tegra210.patch
+regulator-core-release-coupled_rdevs-on-regulator_in.patch
+ubsan-x86-annotate-and-allow-__ubsan_handle_shift_ou.patch
+spi-sprd-adi-add-missing-lock-protection-when-reboot.patch
+acpi-button-add-dmi-quirk-for-medion-akoya-e2215t.patch
+rdma-qedr-fix-memory-leak-in-user-qp-and-mr.patch
+rdma-hns-fix-memory-leak-on-context-on-error-return-.patch
+rdma-qedr-fix-srqs-xarray-initialization.patch
+rdma-core-set-dma-parameters-correctly.patch
+staging-wilc1000-check-if-device-is-initialzied-befo.patch
+gpu-host1x-allocate-gather-copy-for-host1x.patch
+net-dsa-lan9303-select-regmap-when-lan9303-enable.patch
+alsa-hda-hdmi-implement-mst_no_extra_pcms-flag.patch
+phy-renesas-phy-rcar-gen2-fix-the-array-off-by-one-w.patch
+phy-qcom-usb-hs-fix-extcon-double-register-after-pow.patch
+s390-time-ensure-get_clock_monotonic-returns-monoton.patch
+s390-add-error-handling-to-perf_callchain_kernel.patch
+s390-mm-add-mm_pxd_folded-checks-to-pxd_free.patch
+net-hns3-add-struct-netdev_queue-debug-info-for-tx-t.patch
+libata-ensure-ata_port-probe-has-completed-before-de.patch
+loop-fix-no-unmap-write-zeroes-request-behavior.patch
+net-mlx5e-verify-that-rule-has-at-least-one-fwd-drop.patch
+pinctrl-sh-pfc-sh7734-fix-duplicate-tclk1_b.patch
+alsa-bebob-expand-sleep-just-after-breaking-connecti.patch
+iio-dln2-adc-fix-iio_triggered_buffer_postenable-pos.patch
+libbpf-fix-error-handling-in-bpf_map__reuse_fd.patch
+bluetooth-fix-advertising-duplicated-flags.patch
+alsa-pcm-fix-missing-check-of-the-new-non-cached-buf.patch
+spi-sifive-disable-clk-when-probe-fails-and-remove.patch
+asoc-sof-imx-fix-reverse-config_snd_soc_sof_of-depen.patch
+pinctrl-qcom-sc7180-add-missing-tile-info-in-sdc_qds.patch
+pinctrl-amd-fix-__iomem-annotation-in-amd_gpio_irq_h.patch
+ixgbe-protect-tx-timestamping-from-api-misuse.patch
+cpufreq-sun50i-fix-cpu-speed-bin-detection.patch
+media-rcar_drif-fix-a-memory-disclosure.patch
+media-v4l2-core-fix-touch-support-in-v4l_g_fmt.patch
+nvme-introduce-command-aborted-by-host-status-code.patch
+media-staging-imx-use-a-shorter-name-for-driver.patch
+nvmem-imx-ocotp-reset-error-status-on-probe.patch
+nvmem-core-fix-nvmem_cell_write-inline-function.patch
+asoc-sof-topology-set-trigger-order-for-fe-dai-link.patch
+media-vivid-media_device_cleanup-was-called-too-earl.patch
+spi-dw-fix-designware-spi-loopback.patch
+bnx2x-fix-pf-vf-communication-over-multi-cos-queues.patch
+spi-img-spfi-fix-potential-double-release.patch
+alsa-timer-limit-max-amount-of-slave-instances.patch
+rdma-core-fix-return-code-when-modify_port-isn-t-sup.patch
+drm-msm-a6xx-fix-debug-bus-register-configuration.patch
+rtlwifi-fix-memory-leak-in-rtl92c_set_fw_rsvdpagepkt.patch
+perf-probe-fix-to-find-range-only-function-instance.patch
+perf-cs-etm-fix-definition-of-macro-to_cs_queue_nr.patch
+perf-probe-fix-to-list-probe-event-with-correct-line.patch
+perf-jevents-fix-resource-leak-in-process_mapfile-an.patch
+perf-probe-walk-function-lines-in-lexical-blocks.patch
+perf-probe-fix-to-probe-an-inline-function-which-has.patch
+perf-probe-fix-to-show-ranges-of-variables-in-functi.patch
+perf-probe-fix-to-show-inlined-function-callsite-wit.patch
+libsubcmd-use-o0-with-debug-1.patch
+perf-probe-fix-to-probe-a-function-which-has-no-entr.patch
+perf-tools-fix-cross-compile-for-arm64.patch
+perf-tools-splice-events-onto-evlist-even-on-error.patch
+drm-amdgpu-disallow-direct-upload-save-restore-list-.patch
+drm-amd-powerplay-fix-struct-init-in-renoir_print_cl.patch
+drm-amdgpu-fix-potential-double-drop-fence-reference.patch
+ice-check-for-null-pointer-dereference-when-setting-.patch
+xen-gntdev-use-select-for-dma_shared_buffer.patch
+perf-parse-if-pmu-configuration-fails-free-terms.patch
+perf-probe-skip-overlapped-location-on-searching-var.patch
+net-avoid-potential-false-sharing-in-neighbor-relate.patch
+perf-probe-return-a-better-scope-die-if-there-is-no-.patch
+perf-probe-fix-to-show-calling-lines-of-inlined-func.patch
+perf-probe-skip-end-of-sequence-and-non-statement-li.patch
+perf-probe-filter-out-instances-except-for-inlined-s.patch
+libbpf-fix-negative-fd-close-in-xsk_setup_xdp_prog.patch
+s390-bpf-use-kvcalloc-for-addrs-array.patch
+cgroup-freezer-don-t-change-task-and-cgroups-status-.patch
+selftests-proc-make-va_max-1mb.patch
+drm-amdgpu-avoid-accidental-thread-reactivation.patch
+media-exynos4-is-fix-wrong-mdev-and-v4l2-dev-order-i.patch
+ath10k-fix-get-invalid-tx-rate-for-mesh-metric.patch
+fsi-core-fix-small-accesses-and-unaligned-offsets-vi.patch
+selftests-net-fix-printf-format-warnings-on-arm.patch
+media-pvrusb2-fix-oops-on-tear-down-when-radio-suppo.patch
+soundwire-intel-fix-pdi-stream-mapping-for-bulk.patch
+crypto-atmel-fix-authenc-support-when-it-is-set-to-m.patch
+ice-delay-less.patch
+media-si470x-i2c-add-missed-operations-in-remove.patch
+media-cedrus-use-helpers-to-access-capture-queue.patch
+media-v4l2-ctrl-lock-main_hdl-on-operations-of-reque.patch
+iio-cros_ec_baro-set-info_mask_shared_by_all_availab.patch
+edac-ghes-fix-grain-calculation.patch
+media-vicodec-media_device_cleanup-was-called-too-ea.patch
+media-vim2m-media_device_cleanup-was-called-too-earl.patch
+spi-pxa2xx-add-missed-security-checks.patch
+asoc-rt5677-mark-reg-rt5677_pwr_anlg2-as-volatile.patch
+iio-dac-ad5446-add-support-for-new-ad5600-dac.patch
+bpf-testing-workaround-a-verifier-failure-for-test_p.patch
+asoc-intel-kbl_rt5663_rt5514_max98927-add-dmic-forma.patch
+net-dsa-sja1105-disallow-management-xmit-during-swit.patch
+r8169-respect-eee-user-setting-when-restarting-netwo.patch
+s390-disassembler-don-t-hide-instruction-addresses.patch
+net-ethernet-ti-add-dependency-for-ti_davinci_emac.patch
+nvme-discard-workaround-for-non-conformant-devices.patch
+parport-load-lowlevel-driver-if-ports-not-found.patch
+bcache-fix-static-checker-warning-in-bcache_device_f.patch
+cpufreq-register-drivers-only-after-cpu-devices-have.patch
+qtnfmac-fix-debugfs-support-for-multiple-cards.patch
+qtnfmac-fix-invalid-channel-information-output.patch
+x86-crash-add-a-forward-declaration-of-struct-kimage.patch
+qtnfmac-fix-using-skb-after-free.patch
+rdma-efa-clear-the-admin-command-buffer-prior-to-its.patch
+tracing-use-kvcalloc-for-tgid_map-array-allocation.patch
+mips-ralink-enable-pci-support-only-if-driver-for-mt.patch
+tracing-kprobe-check-whether-the-non-suffixed-symbol.patch
+bcache-fix-deadlock-in-bcache_allocator.patch
+iwlwifi-mvm-fix-unaligned-read-of-rx_pkt_status.patch
+asoc-wm8904-fix-regcache-handling.patch
+regulator-core-let-boot-on-regulators-be-powered-off.patch
+spi-tegra20-slink-add-missed-clk_unprepare.patch
+tun-fix-data-race-in-gro_normal_list.patch
+xhci-pci-allow-host-runtime-pm-as-default-also-for-i.patch
+crypto-virtio-deal-with-unsupported-input-sizes.patch
+mmc-tmio-add-mmc_cap_erase-to-allow-erase-discard-tr.patch
+btrfs-don-t-prematurely-free-work-in-end_workqueue_f.patch
+btrfs-don-t-prematurely-free-work-in-run_ordered_wor.patch
+sched-uclamp-fix-overzealous-type-replacement.patch
+asoc-wm2200-add-missed-operations-in-remove-and-prob.patch
+spi-st-ssc4-add-missed-pm_runtime_disable.patch
+asoc-wm5100-add-missed-pm_runtime_disable.patch
+perf-core-fix-the-mlock-accounting-again.patch
+selftests-bpf-fix-test_tc_tunnel-hanging.patch
+selftests-bpf-workaround-an-alu32-sub-register-spill.patch
+bnxt_en-return-proper-error-code-for-non-existent-nv.patch
+net-phy-avoid-matching-all-ones-clause-45-phy-ids.patch
+firmware_loader-fix-labels-with-comma-for-builtin-fi.patch
+asoc-intel-bytcr_rt5640-update-quirk-for-acer-switch.patch
+x86-insn-add-some-intel-instructions-to-the-opcode-m.patch
+net-af_xdp-use-correct-number-of-channels-from-ethto.patch
+brcmfmac-remove-monitor-interface-when-detaching.patch
+perf-session-fix-decompression-of-perf_record_compre.patch
+s390-crypto-fix-unsigned-variable-compared-with-zero.patch
+s390-kasan-support-memcpy_real-with-trace_irqflags.patch
+bnxt_en-improve-rx-buffer-error-handling.patch
+iwlwifi-check-kasprintf-return-value.patch
+fbtft-make-sure-string-is-null-terminated.patch
+asoc-soc-pcm-check-symmetry-before-hw_params.patch
+net-ethernet-ti-ale-clean-ale-tbl-on-init-and-intf-r.patch
+mt76-fix-possible-out-of-bound-access-in-mt7615_fill.patch
+s390-cpumf-adjust-registration-of-s390-pmu-device-dr.patch
+libbpf-fix-call-relocation-offset-calculation-bug.patch
+crypto-sun4i-ss-fix-64-bit-size_t-warnings.patch
+crypto-sun4i-ss-fix-64-bit-size_t-warnings-on-sun4i-.patch
+mac80211-consider-qos-null-frames-for-sta_nullfunc_a.patch
+crypto-vmx-avoid-weird-build-failures.patch
+libtraceevent-fix-memory-leakage-in-copy_filter_type.patch
+perf-parse-fix-potential-memory-leak-when-handling-t.patch
+mips-fix-build-when-48-bits-virtual-memory-is-enable.patch
+drm-amdgpu-fix-bad-dma-from-interrupt_cntl2.patch
+ice-only-disable-vf-state-when-freeing-each-vf-resou.patch
+ice-fix-setting-coalesce-to-handle-dcb-configuration.patch
+perf-intel-bts-does-not-support-aux-area-sampling.patch
+perf-record-add-a-function-to-test-for-kernel-suppor.patch
+net-phy-initialise-phydev-speed-and-duplex-sanely.patch
+tools-bpf-fix-build-for-make-s-tools-bpf-o-dir.patch
+rdma-bnxt_re-fix-missing-le16_to_cpu.patch
+rdma-bnxt_re-fix-stat-push-into-dma-buffer-on-gen-p5.patch
+bpf-provide-better-register-bounds-after-jmp32-instr.patch
+rdma-bnxt_re-fix-chip-number-validation-broadcom-s-g.patch
+ibmvnic-fix-completion-structure-initialization.patch
+net-wireless-intel-iwlwifi-fix-gro_normal-packet-sta.patch
+mips-futex-restore-n-after-sync-instructions.patch
+btrfs-don-t-prematurely-free-work-in-reada_start_mac.patch
+btrfs-don-t-prematurely-free-work-in-scrub_missing_r.patch
diff --git a/queue-5.4/soundwire-intel-fix-pdi-stream-mapping-for-bulk.patch b/queue-5.4/soundwire-intel-fix-pdi-stream-mapping-for-bulk.patch
new file mode 100644
index 00000000000..dd0416bc675
--- /dev/null
+++ b/queue-5.4/soundwire-intel-fix-pdi-stream-mapping-for-bulk.patch
@@ -0,0 +1,53 @@
+From ea8a32d41fcdbbb368f339685ed25e6cf49d4ec8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Oct 2019 18:29:48 -0500
+Subject: soundwire: intel: fix PDI/stream mapping for Bulk
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit c134f914e9f55b7817e2bae625ec0e5f1379f7cd ]
+
+The previous formula is incorrect for PDI0/1, the mapping is not
+linear but has a discontinuity between PDI1 and PDI2.
+
+This change has no effect on PCM PDIs (same mapping).
+
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20191022232948.17156-1-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soundwire/intel.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/soundwire/intel.c b/drivers/soundwire/intel.c
+index 13c54eac0cc3..d1839707128a 100644
+--- a/drivers/soundwire/intel.c
++++ b/drivers/soundwire/intel.c
+@@ -479,7 +479,10 @@ intel_pdi_shim_configure(struct sdw_intel *sdw, struct sdw_cdns_pdi *pdi)
+ 	unsigned int link_id = sdw->instance;
+ 	int pdi_conf = 0;
+ 
+-	pdi->intel_alh_id = (link_id * 16) + pdi->num + 5;
++	/* the Bulk and PCM streams are not contiguous */
++	pdi->intel_alh_id = (link_id * 16) + pdi->num + 3;
++	if (pdi->num >= 2)
++		pdi->intel_alh_id += 2;
+ 
+ 	/*
+ 	 * Program stream parameters to stream SHIM register
+@@ -508,7 +511,10 @@ intel_pdi_alh_configure(struct sdw_intel *sdw, struct sdw_cdns_pdi *pdi)
+ 	unsigned int link_id = sdw->instance;
+ 	unsigned int conf;
+ 
+-	pdi->intel_alh_id = (link_id * 16) + pdi->num + 5;
++	/* the Bulk and PCM streams are not contiguous */
++	pdi->intel_alh_id = (link_id * 16) + pdi->num + 3;
++	if (pdi->num >= 2)
++		pdi->intel_alh_id += 2;
+ 
+ 	/* Program Stream config ALH register */
+ 	conf = intel_readl(alh, SDW_ALH_STRMZCFG(pdi->intel_alh_id));
+-- 
+2.20.1
+
diff --git a/queue-5.4/spi-add-call-to-spi_slave_abort-function-when-spidev.patch b/queue-5.4/spi-add-call-to-spi_slave_abort-function-when-spidev.patch
new file mode 100644
index 00000000000..017422caacc
--- /dev/null
+++ b/queue-5.4/spi-add-call-to-spi_slave_abort-function-when-spidev.patch
@@ -0,0 +1,50 @@
+From 69ebcb8c895f10409ebb7cd99042e2f98c37c505 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Sep 2019 11:11:42 +0200
+Subject: spi: Add call to spi_slave_abort() function when spidev driver is
+ released
+
+From: Lukasz Majewski <lukma@denx.de>
+
+[ Upstream commit 9f918a728cf86b2757b6a7025e1f46824bfe3155 ]
+
+This change is necessary for spidev devices (e.g. /dev/spidev3.0) working
+in the slave mode (like NXP's dspi driver for Vybrid SoC).
+
+When SPI HW works in this mode - the master is responsible for providing
+CS and CLK signals. However, when some fault happens - like for example
+distortion on SPI lines - the SPI Linux driver needs a chance to recover
+from this abnormal situation and prepare itself for next (correct)
+transmission.
+
+This change doesn't pose any threat on drivers working in master mode as
+spi_slave_abort() function checks if SPI slave mode is supported.
+
+Signed-off-by: Lukasz Majewski <lukma@denx.de>
+Link: https://lore.kernel.org/r/20190924110547.14770-2-lukma@denx.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Reported-by: kbuild test robot <lkp@intel.com>
+Link: https://lore.kernel.org/r/20190925091143.15468-2-lukma@denx.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spidev.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c
+index 255786f2e844..3ea9d8a3e6e8 100644
+--- a/drivers/spi/spidev.c
++++ b/drivers/spi/spidev.c
+@@ -627,6 +627,9 @@ static int spidev_release(struct inode *inode, struct file *filp)
+ 		if (dofree)
+ 			kfree(spidev);
+ 	}
++#ifdef CONFIG_SPI_SLAVE
++	spi_slave_abort(spidev->spi);
++#endif
+ 	mutex_unlock(&device_list_lock);
+ 
+ 	return 0;
+-- 
+2.20.1
+
diff --git a/queue-5.4/spi-dw-fix-designware-spi-loopback.patch b/queue-5.4/spi-dw-fix-designware-spi-loopback.patch
new file mode 100644
index 00000000000..d8e0e397712
--- /dev/null
+++ b/queue-5.4/spi-dw-fix-designware-spi-loopback.patch
@@ -0,0 +1,38 @@
+From 62122b15f36f3e4d6f32b32adf94bdbe8c6d9e99 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Nov 2019 14:22:10 -0600
+Subject: spi: dw: Fix Designware SPI loopback
+
+From: Thor Thayer <thor.thayer@linux.intel.com>
+
+[ Upstream commit 1403cfa69d310781f9548951c97725c67ffcf613 ]
+
+The SPI_LOOP is set in spi->mode but not propagated to the register.
+A previous patch removed the bit during a cleanup.
+
+Fixes: e1bc204894ea ("spi: dw: fix potential variable assignment error")
+Signed-off-by: Thor Thayer <thor.thayer@linux.intel.com>
+Link: https://lore.kernel.org/r/1572985330-5525-1-git-send-email-thor.thayer@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-dw.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-dw.c b/drivers/spi/spi-dw.c
+index 9a49e073e8b7..076652d3d051 100644
+--- a/drivers/spi/spi-dw.c
++++ b/drivers/spi/spi-dw.c
+@@ -308,7 +308,8 @@ static int dw_spi_transfer_one(struct spi_controller *master,
+ 	cr0 = (transfer->bits_per_word - 1)
+ 		| (chip->type << SPI_FRF_OFFSET)
+ 		| ((((spi->mode & SPI_CPOL) ? 1 : 0) << SPI_SCOL_OFFSET) |
+-			(((spi->mode & SPI_CPHA) ? 1 : 0) << SPI_SCPH_OFFSET))
++			(((spi->mode & SPI_CPHA) ? 1 : 0) << SPI_SCPH_OFFSET) |
++			(((spi->mode & SPI_LOOP) ? 1 : 0) << SPI_SRL_OFFSET))
+ 		| (chip->tmode << SPI_TMOD_OFFSET);
+ 
+ 	/*
+-- 
+2.20.1
+
diff --git a/queue-5.4/spi-gpio-prevent-memory-leak-in-spi_gpio_probe.patch b/queue-5.4/spi-gpio-prevent-memory-leak-in-spi_gpio_probe.patch
new file mode 100644
index 00000000000..f0869972237
--- /dev/null
+++ b/queue-5.4/spi-gpio-prevent-memory-leak-in-spi_gpio_probe.patch
@@ -0,0 +1,42 @@
+From fe322325d2f7c1bcc95c333f7a5f1edea2b2b2e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Sep 2019 15:52:40 -0500
+Subject: spi: gpio: prevent memory leak in spi_gpio_probe
+
+From: Navid Emamdoost <navid.emamdoost@gmail.com>
+
+[ Upstream commit d3b0ffa1d75d5305ebe34735598993afbb8a869d ]
+
+In spi_gpio_probe an SPI master is allocated via spi_alloc_master, but
+this controller should be released if devm_add_action_or_reset fails,
+otherwise memory leaks. In order to avoid leak spi_contriller_put must
+be called in case of failure for devm_add_action_or_reset.
+
+Fixes: 8b797490b4db ("spi: gpio: Make sure spi_master_put() is called in every error path")
+Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
+Link: https://lore.kernel.org/r/20190930205241.5483-1-navid.emamdoost@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-gpio.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-gpio.c b/drivers/spi/spi-gpio.c
+index 1d3e23ec20a6..f9c5bbb74714 100644
+--- a/drivers/spi/spi-gpio.c
++++ b/drivers/spi/spi-gpio.c
+@@ -371,8 +371,10 @@ static int spi_gpio_probe(struct platform_device *pdev)
+ 		return -ENOMEM;
+ 
+ 	status = devm_add_action_or_reset(&pdev->dev, spi_gpio_put, master);
+-	if (status)
++	if (status) {
++		spi_master_put(master);
+ 		return status;
++	}
+ 
+ 	if (of_id)
+ 		status = spi_gpio_probe_dt(pdev, master);
+-- 
+2.20.1
+
diff --git a/queue-5.4/spi-img-spfi-fix-potential-double-release.patch b/queue-5.4/spi-img-spfi-fix-potential-double-release.patch
new file mode 100644
index 00000000000..e548d93aa72
--- /dev/null
+++ b/queue-5.4/spi-img-spfi-fix-potential-double-release.patch
@@ -0,0 +1,39 @@
+From 4f2088ae7deee9c1de035c3b82059e3a4a77d511 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Nov 2019 10:36:09 +0800
+Subject: spi: img-spfi: fix potential double release
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit e9a8ba9769a0e354341bc6cc01b98aadcea1dfe9 ]
+
+The channels spfi->tx_ch and spfi->rx_ch are not set to NULL after they
+are released. As a result, they will be released again, either on the
+error handling branch in the same function or in the corresponding
+remove function, i.e. img_spfi_remove(). This patch fixes the bug by
+setting the two members to NULL.
+
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Link: https://lore.kernel.org/r/1573007769-20131-1-git-send-email-bianpan2016@163.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-img-spfi.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/spi/spi-img-spfi.c b/drivers/spi/spi-img-spfi.c
+index 439b01e4a2c8..f4a8f470aecc 100644
+--- a/drivers/spi/spi-img-spfi.c
++++ b/drivers/spi/spi-img-spfi.c
+@@ -673,6 +673,8 @@ static int img_spfi_probe(struct platform_device *pdev)
+ 			dma_release_channel(spfi->tx_ch);
+ 		if (spfi->rx_ch)
+ 			dma_release_channel(spfi->rx_ch);
++		spfi->tx_ch = NULL;
++		spfi->rx_ch = NULL;
+ 		dev_warn(spfi->dev, "Failed to get DMA channels, falling back to PIO mode\n");
+ 	} else {
+ 		master->dma_tx = spfi->tx_ch;
+-- 
+2.20.1
+
diff --git a/queue-5.4/spi-pxa2xx-add-missed-security-checks.patch b/queue-5.4/spi-pxa2xx-add-missed-security-checks.patch
new file mode 100644
index 00000000000..fdf70c43e59
--- /dev/null
+++ b/queue-5.4/spi-pxa2xx-add-missed-security-checks.patch
@@ -0,0 +1,45 @@
+From dba9f8ccf844453c6f216cddb0198406e619e9e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 9 Nov 2019 16:09:43 +0800
+Subject: spi: pxa2xx: Add missed security checks
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+[ Upstream commit 5eb263ef08b5014cfc2539a838f39d2fd3531423 ]
+
+pxa2xx_spi_init_pdata misses checks for devm_clk_get and
+platform_get_irq.
+Add checks for them to fix the bugs.
+
+Since ssp->clk and ssp->irq are used in probe, they are mandatory here.
+So we cannot use _optional() for devm_clk_get and platform_get_irq.
+
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Link: https://lore.kernel.org/r/20191109080943.30428-1-hslester96@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-pxa2xx.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
+index bb6a14d1ab0f..2e73d75a6ac5 100644
+--- a/drivers/spi/spi-pxa2xx.c
++++ b/drivers/spi/spi-pxa2xx.c
+@@ -1565,7 +1565,13 @@ pxa2xx_spi_init_pdata(struct platform_device *pdev)
+ #endif
+ 
+ 	ssp->clk = devm_clk_get(&pdev->dev, NULL);
++	if (IS_ERR(ssp->clk))
++		return NULL;
++
+ 	ssp->irq = platform_get_irq(pdev, 0);
++	if (ssp->irq < 0)
++		return NULL;
++
+ 	ssp->type = type;
+ 	ssp->pdev = pdev;
+ 	ssp->port_id = pxa2xx_spi_get_port_id(adev);
+-- 
+2.20.1
+
diff --git a/queue-5.4/spi-sifive-disable-clk-when-probe-fails-and-remove.patch b/queue-5.4/spi-sifive-disable-clk-when-probe-fails-and-remove.patch
new file mode 100644
index 00000000000..924993f516c
--- /dev/null
+++ b/queue-5.4/spi-sifive-disable-clk-when-probe-fails-and-remove.patch
@@ -0,0 +1,78 @@
+From e60782574daf02626eb06122b7b1aa9f8d08cd2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Nov 2019 20:17:45 +0800
+Subject: spi: sifive: disable clk when probe fails and remove
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+[ Upstream commit a725272bda77e61c1b4de85c7b0c875b2ea639b6 ]
+
+The driver forgets to disable and unprepare clk when probe fails and
+remove.
+Add the calls to fix the problem.
+
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Reviewed-by: Palmer Dabbelt <palmer@dabbelt.com>
+Link: https://lore.kernel.org/r/20191101121745.13413-1-hslester96@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-sifive.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/spi/spi-sifive.c b/drivers/spi/spi-sifive.c
+index 35254bdc42c4..f7c1e20432e0 100644
+--- a/drivers/spi/spi-sifive.c
++++ b/drivers/spi/spi-sifive.c
+@@ -357,14 +357,14 @@ static int sifive_spi_probe(struct platform_device *pdev)
+ 	if (!cs_bits) {
+ 		dev_err(&pdev->dev, "Could not auto probe CS lines\n");
+ 		ret = -EINVAL;
+-		goto put_master;
++		goto disable_clk;
+ 	}
+ 
+ 	num_cs = ilog2(cs_bits) + 1;
+ 	if (num_cs > SIFIVE_SPI_MAX_CS) {
+ 		dev_err(&pdev->dev, "Invalid number of spi slaves\n");
+ 		ret = -EINVAL;
+-		goto put_master;
++		goto disable_clk;
+ 	}
+ 
+ 	/* Define our master */
+@@ -393,7 +393,7 @@ static int sifive_spi_probe(struct platform_device *pdev)
+ 			       dev_name(&pdev->dev), spi);
+ 	if (ret) {
+ 		dev_err(&pdev->dev, "Unable to bind to interrupt\n");
+-		goto put_master;
++		goto disable_clk;
+ 	}
+ 
+ 	dev_info(&pdev->dev, "mapped; irq=%d, cs=%d\n",
+@@ -402,11 +402,13 @@ static int sifive_spi_probe(struct platform_device *pdev)
+ 	ret = devm_spi_register_master(&pdev->dev, master);
+ 	if (ret < 0) {
+ 		dev_err(&pdev->dev, "spi_register_master failed\n");
+-		goto put_master;
++		goto disable_clk;
+ 	}
+ 
+ 	return 0;
+ 
++disable_clk:
++	clk_disable_unprepare(spi->clk);
+ put_master:
+ 	spi_master_put(master);
+ 
+@@ -420,6 +422,7 @@ static int sifive_spi_remove(struct platform_device *pdev)
+ 
+ 	/* Disable all the interrupts just in case */
+ 	sifive_spi_write(spi, SIFIVE_SPI_REG_IE, 0);
++	clk_disable_unprepare(spi->clk);
+ 
+ 	return 0;
+ }
+-- 
+2.20.1
+
diff --git a/queue-5.4/spi-sprd-adi-add-missing-lock-protection-when-reboot.patch b/queue-5.4/spi-sprd-adi-add-missing-lock-protection-when-reboot.patch
new file mode 100644
index 00000000000..2a0c025e379
--- /dev/null
+++ b/queue-5.4/spi-sprd-adi-add-missing-lock-protection-when-reboot.patch
@@ -0,0 +1,39 @@
+From 53cb6e2191555a2eca9ca370ad8ef7f4994b13a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Oct 2019 18:10:30 +0800
+Subject: spi: sprd: adi: Add missing lock protection when rebooting
+
+From: Lingling Xu <ling_ling.xu@unisoc.com>
+
+[ Upstream commit 91ea1d70607e374b014b4b9bea771ce661f9f64b ]
+
+When rebooting the system, we should lock the watchdog after
+configuration to make sure the watchdog can reboot the system
+successfully.
+
+Signed-off-by: Lingling Xu <ling_ling.xu@unisoc.com>
+Signed-off-by: Baolin Wang <baolin.wang@linaro.org>
+Link: https://lore.kernel.org/r/7b04711127434555e3a1a86bc6be99860cd86668.1572257085.git.baolin.wang@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-sprd-adi.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/spi/spi-sprd-adi.c b/drivers/spi/spi-sprd-adi.c
+index 9a051286f120..9613cfe3c0a2 100644
+--- a/drivers/spi/spi-sprd-adi.c
++++ b/drivers/spi/spi-sprd-adi.c
+@@ -393,6 +393,9 @@ static int sprd_adi_restart_handler(struct notifier_block *this,
+ 	val |= BIT_WDG_RUN | BIT_WDG_RST;
+ 	sprd_adi_write(sadi, sadi->slave_pbase + REG_WDG_CTRL, val);
+ 
++	/* Lock the watchdog */
++	sprd_adi_write(sadi, sadi->slave_pbase + REG_WDG_LOCK, ~WDG_UNLOCK_KEY);
++
+ 	mdelay(1000);
+ 
+ 	dev_emerg(sadi->dev, "Unable to restart system\n");
+-- 
+2.20.1
+
diff --git a/queue-5.4/spi-st-ssc4-add-missed-pm_runtime_disable.patch b/queue-5.4/spi-st-ssc4-add-missed-pm_runtime_disable.patch
new file mode 100644
index 00000000000..0834fbfa5b1
--- /dev/null
+++ b/queue-5.4/spi-st-ssc4-add-missed-pm_runtime_disable.patch
@@ -0,0 +1,45 @@
+From c550961589f5a19dfb5b794d601b5e009433a582 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Nov 2019 10:48:48 +0800
+Subject: spi: st-ssc4: add missed pm_runtime_disable
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+[ Upstream commit cd050abeba2a95fe5374eec28ad2244617bcbab6 ]
+
+The driver forgets to call pm_runtime_disable in probe failure
+and remove.
+Add the missed calls to fix it.
+
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Link: https://lore.kernel.org/r/20191118024848.21645-1-hslester96@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-st-ssc4.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/spi/spi-st-ssc4.c b/drivers/spi/spi-st-ssc4.c
+index 0c24c494f386..77d26d64541a 100644
+--- a/drivers/spi/spi-st-ssc4.c
++++ b/drivers/spi/spi-st-ssc4.c
+@@ -381,6 +381,7 @@ static int spi_st_probe(struct platform_device *pdev)
+ 	return 0;
+ 
+ clk_disable:
++	pm_runtime_disable(&pdev->dev);
+ 	clk_disable_unprepare(spi_st->clk);
+ put_master:
+ 	spi_master_put(master);
+@@ -392,6 +393,8 @@ static int spi_st_remove(struct platform_device *pdev)
+ 	struct spi_master *master = platform_get_drvdata(pdev);
+ 	struct spi_st *spi_st = spi_master_get_devdata(master);
+ 
++	pm_runtime_disable(&pdev->dev);
++
+ 	clk_disable_unprepare(spi_st->clk);
+ 
+ 	pinctrl_pm_select_sleep_state(&pdev->dev);
+-- 
+2.20.1
+
diff --git a/queue-5.4/spi-tegra20-slink-add-missed-clk_unprepare.patch b/queue-5.4/spi-tegra20-slink-add-missed-clk_unprepare.patch
new file mode 100644
index 00000000000..b946a3ab3ba
--- /dev/null
+++ b/queue-5.4/spi-tegra20-slink-add-missed-clk_unprepare.patch
@@ -0,0 +1,53 @@
+From ccbd8b7a9d9abf37d435ff3b389181b88005bf4d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Nov 2019 16:31:22 +0800
+Subject: spi: tegra20-slink: add missed clk_unprepare
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+[ Upstream commit 04358e40ba96d687c0811c21d9dede73f5244a98 ]
+
+The driver misses calling clk_unprepare in probe failure and remove.
+Add the calls to fix it.
+
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Link: https://lore.kernel.org/r/20191115083122.12278-1-hslester96@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-tegra20-slink.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-tegra20-slink.c b/drivers/spi/spi-tegra20-slink.c
+index 111fffc91435..374a2a32edcd 100644
+--- a/drivers/spi/spi-tegra20-slink.c
++++ b/drivers/spi/spi-tegra20-slink.c
+@@ -1073,7 +1073,7 @@ static int tegra_slink_probe(struct platform_device *pdev)
+ 	ret = clk_enable(tspi->clk);
+ 	if (ret < 0) {
+ 		dev_err(&pdev->dev, "Clock enable failed %d\n", ret);
+-		goto exit_free_master;
++		goto exit_clk_unprepare;
+ 	}
+ 
+ 	spi_irq = platform_get_irq(pdev, 0);
+@@ -1146,6 +1146,8 @@ exit_free_irq:
+ 	free_irq(spi_irq, tspi);
+ exit_clk_disable:
+ 	clk_disable(tspi->clk);
++exit_clk_unprepare:
++	clk_unprepare(tspi->clk);
+ exit_free_master:
+ 	spi_master_put(master);
+ 	return ret;
+@@ -1159,6 +1161,7 @@ static int tegra_slink_remove(struct platform_device *pdev)
+ 	free_irq(tspi->irq, tspi);
+ 
+ 	clk_disable(tspi->clk);
++	clk_unprepare(tspi->clk);
+ 
+ 	if (tspi->tx_dma_chan)
+ 		tegra_slink_deinit_dma_param(tspi, false);
+-- 
+2.20.1
+
diff --git a/queue-5.4/staging-iio-ad9834-add-a-check-for-devm_clk_get.patch b/queue-5.4/staging-iio-ad9834-add-a-check-for-devm_clk_get.patch
new file mode 100644
index 00000000000..6f39383f069
--- /dev/null
+++ b/queue-5.4/staging-iio-ad9834-add-a-check-for-devm_clk_get.patch
@@ -0,0 +1,39 @@
+From 07107eeaf8687f8f3fd501e2eefef12a503a679b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Oct 2019 22:25:40 +0800
+Subject: staging: iio: ad9834: add a check for devm_clk_get
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+[ Upstream commit a96de139301385e5992768c0f60240ddfbb33325 ]
+
+ad9834_probe misses a check for devm_clk_get and may cause problems.
+Add a check like what ad9832 does to fix it.
+
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/iio/frequency/ad9834.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/staging/iio/frequency/ad9834.c b/drivers/staging/iio/frequency/ad9834.c
+index 038d6732c3fd..23026978a5a5 100644
+--- a/drivers/staging/iio/frequency/ad9834.c
++++ b/drivers/staging/iio/frequency/ad9834.c
+@@ -417,6 +417,10 @@ static int ad9834_probe(struct spi_device *spi)
+ 	st = iio_priv(indio_dev);
+ 	mutex_init(&st->lock);
+ 	st->mclk = devm_clk_get(&spi->dev, NULL);
++	if (IS_ERR(st->mclk)) {
++		ret = PTR_ERR(st->mclk);
++		goto error_disable_reg;
++	}
+ 
+ 	ret = clk_prepare_enable(st->mclk);
+ 	if (ret) {
+-- 
+2.20.1
+
diff --git a/queue-5.4/staging-rtl8188eu-fix-possible-null-dereference.patch b/queue-5.4/staging-rtl8188eu-fix-possible-null-dereference.patch
new file mode 100644
index 00000000000..99ab9db70bc
--- /dev/null
+++ b/queue-5.4/staging-rtl8188eu-fix-possible-null-dereference.patch
@@ -0,0 +1,54 @@
+From f9818d87738723a1d57ddcb3205897a85121d6e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Sep 2019 08:03:17 -0700
+Subject: staging: rtl8188eu: fix possible null dereference
+
+From: Connor Kuehl <connor.kuehl@canonical.com>
+
+[ Upstream commit 228241944a48113470d3c3b46c88ba7fbe0a274b ]
+
+Inside a nested 'else' block at the beginning of this function is a
+call that assigns 'psta' to the return value of 'rtw_get_stainfo()'.
+If 'rtw_get_stainfo()' returns NULL and the flow of control reaches
+the 'else if' where 'psta' is dereferenced, then we will dereference
+a NULL pointer.
+
+Fix this by checking if 'psta' is not NULL before reading its
+'psta->qos_option' data member.
+
+Addresses-Coverity: ("Dereference null return value")
+
+Signed-off-by: Connor Kuehl <connor.kuehl@canonical.com>
+Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
+Link: https://lore.kernel.org/r/20190926150317.5894-1-connor.kuehl@canonical.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/rtl8188eu/core/rtw_xmit.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/staging/rtl8188eu/core/rtw_xmit.c b/drivers/staging/rtl8188eu/core/rtw_xmit.c
+index 952f2ab51347..c37591657bac 100644
+--- a/drivers/staging/rtl8188eu/core/rtw_xmit.c
++++ b/drivers/staging/rtl8188eu/core/rtw_xmit.c
+@@ -776,7 +776,7 @@ s32 rtw_make_wlanhdr(struct adapter *padapter, u8 *hdr, struct pkt_attrib *pattr
+ 			memcpy(pwlanhdr->addr2, get_bssid(pmlmepriv), ETH_ALEN);
+ 			memcpy(pwlanhdr->addr3, pattrib->src, ETH_ALEN);
+ 
+-			if (psta->qos_option)
++			if (psta && psta->qos_option)
+ 				qos_option = true;
+ 		} else if (check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) ||
+ 			   check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)) {
+@@ -784,7 +784,7 @@ s32 rtw_make_wlanhdr(struct adapter *padapter, u8 *hdr, struct pkt_attrib *pattr
+ 			memcpy(pwlanhdr->addr2, pattrib->src, ETH_ALEN);
+ 			memcpy(pwlanhdr->addr3, get_bssid(pmlmepriv), ETH_ALEN);
+ 
+-			if (psta->qos_option)
++			if (psta && psta->qos_option)
+ 				qos_option = true;
+ 		} else {
+ 			RT_TRACE(_module_rtl871x_xmit_c_, _drv_err_, ("fw_state:%x is not allowed to xmit frame\n", get_fwstate(pmlmepriv)));
+-- 
+2.20.1
+
diff --git a/queue-5.4/staging-rtl8192u-fix-multiple-memory-leaks-on-error-.patch b/queue-5.4/staging-rtl8192u-fix-multiple-memory-leaks-on-error-.patch
new file mode 100644
index 00000000000..d6b446baf24
--- /dev/null
+++ b/queue-5.4/staging-rtl8192u-fix-multiple-memory-leaks-on-error-.patch
@@ -0,0 +1,72 @@
+From f303dee15eab35ac71f02c37e66f4681b0013694 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Sep 2019 21:51:33 -0500
+Subject: staging: rtl8192u: fix multiple memory leaks on error path
+
+From: Navid Emamdoost <navid.emamdoost@gmail.com>
+
+[ Upstream commit ca312438cf176a16d4b89350cade8789ba8d7133 ]
+
+In rtl8192_tx on error handling path allocated urbs and also skb should
+be released.
+
+Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
+Link: https://lore.kernel.org/r/20190920025137.29407-1-navid.emamdoost@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/rtl8192u/r8192U_core.c | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/staging/rtl8192u/r8192U_core.c b/drivers/staging/rtl8192u/r8192U_core.c
+index 2821411878ce..511136dce3a4 100644
+--- a/drivers/staging/rtl8192u/r8192U_core.c
++++ b/drivers/staging/rtl8192u/r8192U_core.c
+@@ -1422,7 +1422,7 @@ short rtl8192_tx(struct net_device *dev, struct sk_buff *skb)
+ 		(struct tx_fwinfo_819x_usb *)(skb->data + USB_HWDESC_HEADER_LEN);
+ 	struct usb_device *udev = priv->udev;
+ 	int pend;
+-	int status;
++	int status, rt = -1;
+ 	struct urb *tx_urb = NULL, *tx_urb_zero = NULL;
+ 	unsigned int idx_pipe;
+ 
+@@ -1566,8 +1566,10 @@ short rtl8192_tx(struct net_device *dev, struct sk_buff *skb)
+ 		}
+ 		if (bSend0Byte) {
+ 			tx_urb_zero = usb_alloc_urb(0, GFP_ATOMIC);
+-			if (!tx_urb_zero)
+-				return -ENOMEM;
++			if (!tx_urb_zero) {
++				rt = -ENOMEM;
++				goto error;
++			}
+ 			usb_fill_bulk_urb(tx_urb_zero, udev,
+ 					  usb_sndbulkpipe(udev, idx_pipe),
+ 					  &zero, 0, tx_zero_isr, dev);
+@@ -1577,7 +1579,7 @@ short rtl8192_tx(struct net_device *dev, struct sk_buff *skb)
+ 					 "Error TX URB for zero byte %d, error %d",
+ 					 atomic_read(&priv->tx_pending[tcb_desc->queue_index]),
+ 					 status);
+-				return -1;
++				goto error;
+ 			}
+ 		}
+ 		netif_trans_update(dev);
+@@ -1588,7 +1590,12 @@ short rtl8192_tx(struct net_device *dev, struct sk_buff *skb)
+ 	RT_TRACE(COMP_ERR, "Error TX URB %d, error %d",
+ 		 atomic_read(&priv->tx_pending[tcb_desc->queue_index]),
+ 		 status);
+-	return -1;
++
++error:
++	dev_kfree_skb_any(skb);
++	usb_free_urb(tx_urb);
++	usb_free_urb(tx_urb_zero);
++	return rt;
+ }
+ 
+ static short rtl8192_usb_initendpoints(struct net_device *dev)
+-- 
+2.20.1
+
diff --git a/queue-5.4/staging-wilc1000-check-if-device-is-initialzied-befo.patch b/queue-5.4/staging-wilc1000-check-if-device-is-initialzied-befo.patch
new file mode 100644
index 00000000000..41f6c533dc7
--- /dev/null
+++ b/queue-5.4/staging-wilc1000-check-if-device-is-initialzied-befo.patch
@@ -0,0 +1,68 @@
+From 18526fe83ab7de5253a193b3692f8df9b42c34ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Oct 2019 18:40:26 +0000
+Subject: staging: wilc1000: check if device is initialzied before changing vif
+
+From: Adham Abozaeid <adham.abozaeid@microchip.com>
+
+[ Upstream commit 6df6f3849bb8f317bf2d52711aacea4292237ede ]
+
+When killing hostapd, the interface is closed which deinitializes the
+device, then change virtual interface is called.
+This change checks if the device is initialized before sending the
+interface change command to the device
+
+Signed-off-by: Adham Abozaeid <adham.abozaeid@microchip.com>
+Link: https://lore.kernel.org/r/20191028184019.31194-1-adham.abozaeid@microchip.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../staging/wilc1000/wilc_wfi_cfgoperations.c  | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c b/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c
+index 22f21831649b..c3cd6f389a98 100644
+--- a/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c
++++ b/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c
+@@ -1419,8 +1419,10 @@ static int change_virtual_intf(struct wiphy *wiphy, struct net_device *dev,
+ 		if (vif->iftype == WILC_AP_MODE || vif->iftype == WILC_GO_MODE)
+ 			wilc_wfi_deinit_mon_interface(wl, true);
+ 		vif->iftype = WILC_STATION_MODE;
+-		wilc_set_operation_mode(vif, wilc_get_vif_idx(vif),
+-					WILC_STATION_MODE, vif->idx);
++
++		if (wl->initialized)
++			wilc_set_operation_mode(vif, wilc_get_vif_idx(vif),
++						WILC_STATION_MODE, vif->idx);
+ 
+ 		memset(priv->assoc_stainfo.sta_associated_bss, 0,
+ 		       WILC_MAX_NUM_STA * ETH_ALEN);
+@@ -1432,8 +1434,10 @@ static int change_virtual_intf(struct wiphy *wiphy, struct net_device *dev,
+ 		priv->wdev.iftype = type;
+ 		vif->monitor_flag = 0;
+ 		vif->iftype = WILC_CLIENT_MODE;
+-		wilc_set_operation_mode(vif, wilc_get_vif_idx(vif),
+-					WILC_STATION_MODE, vif->idx);
++
++		if (wl->initialized)
++			wilc_set_operation_mode(vif, wilc_get_vif_idx(vif),
++						WILC_STATION_MODE, vif->idx);
+ 		break;
+ 
+ 	case NL80211_IFTYPE_AP:
+@@ -1450,8 +1454,10 @@ static int change_virtual_intf(struct wiphy *wiphy, struct net_device *dev,
+ 		dev->ieee80211_ptr->iftype = type;
+ 		priv->wdev.iftype = type;
+ 		vif->iftype = WILC_GO_MODE;
+-		wilc_set_operation_mode(vif, wilc_get_vif_idx(vif),
+-					WILC_AP_MODE, vif->idx);
++
++		if (wl->initialized)
++			wilc_set_operation_mode(vif, wilc_get_vif_idx(vif),
++						WILC_AP_MODE, vif->idx);
+ 		break;
+ 
+ 	default:
+-- 
+2.20.1
+
diff --git a/queue-5.4/staging-wilc1000-potential-corruption-in-wilc_parse_.patch b/queue-5.4/staging-wilc1000-potential-corruption-in-wilc_parse_.patch
new file mode 100644
index 00000000000..5b4f4a733cf
--- /dev/null
+++ b/queue-5.4/staging-wilc1000-potential-corruption-in-wilc_parse_.patch
@@ -0,0 +1,39 @@
+From 44ac7029446dd9c958edf14371695c67785bd2b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Oct 2019 12:18:32 +0300
+Subject: staging: wilc1000: potential corruption in
+ wilc_parse_join_bss_param()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit d59dc92f1bccd5acde793aebdbb4f7121cf3f9af ]
+
+The "rates_len" value needs to be capped so that the memcpy() doesn't
+copy beyond the end of the array.
+
+Fixes: c5c77ba18ea6 ("staging: wilc1000: Add SDIO/SPI 802.11 driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Adham Abozaeid <adham.abozaeid@microchip.com>
+Link: https://lore.kernel.org/r/20191017091832.GB31278@mwanda
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/wilc1000/wilc_hif.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/staging/wilc1000/wilc_hif.c b/drivers/staging/wilc1000/wilc_hif.c
+index d3d9ea284816..77d0732f451b 100644
+--- a/drivers/staging/wilc1000/wilc_hif.c
++++ b/drivers/staging/wilc1000/wilc_hif.c
+@@ -473,6 +473,8 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss,
+ 	rates_ie = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies->data, ies->len);
+ 	if (rates_ie) {
+ 		rates_len = rates_ie[1];
++		if (rates_len > WILC_MAX_RATES_SUPPORTED)
++			rates_len = WILC_MAX_RATES_SUPPORTED;
+ 		param->supp_rates[0] = rates_len;
+ 		memcpy(&param->supp_rates[1], rates_ie + 2, rates_len);
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-5.4/syscalls-x86-use-the-correct-function-type-in-syscal.patch b/queue-5.4/syscalls-x86-use-the-correct-function-type-in-syscal.patch
new file mode 100644
index 00000000000..667a3f605d0
--- /dev/null
+++ b/queue-5.4/syscalls-x86-use-the-correct-function-type-in-syscal.patch
@@ -0,0 +1,72 @@
+From 3799eccf4caf874c4ee0db008ec5435c7fbdb2d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2019 15:40:45 -0700
+Subject: syscalls/x86: Use the correct function type in SYSCALL_DEFINE0
+
+From: Sami Tolvanen <samitolvanen@google.com>
+
+[ Upstream commit 8661d769ab77c675b5eb6c3351a372b9fbc1bf40 ]
+
+Although a syscall defined using SYSCALL_DEFINE0 doesn't accept
+parameters, use the correct function type to avoid type mismatches
+with Control-Flow Integrity (CFI) checking.
+
+Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
+Acked-by: Andy Lutomirski <luto@kernel.org>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: H . Peter Anvin <hpa@zytor.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lkml.kernel.org/r/20191008224049.115427-2-samitolvanen@google.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/syscall_wrapper.h | 23 ++++++++++++-----------
+ 1 file changed, 12 insertions(+), 11 deletions(-)
+
+diff --git a/arch/x86/include/asm/syscall_wrapper.h b/arch/x86/include/asm/syscall_wrapper.h
+index e046a405743d..90eb70df0b18 100644
+--- a/arch/x86/include/asm/syscall_wrapper.h
++++ b/arch/x86/include/asm/syscall_wrapper.h
+@@ -48,12 +48,13 @@
+  * To keep the naming coherent, re-define SYSCALL_DEFINE0 to create an alias
+  * named __ia32_sys_*()
+  */
+-#define SYSCALL_DEFINE0(sname)					\
+-	SYSCALL_METADATA(_##sname, 0);				\
+-	asmlinkage long __x64_sys_##sname(void);		\
+-	ALLOW_ERROR_INJECTION(__x64_sys_##sname, ERRNO);	\
+-	SYSCALL_ALIAS(__ia32_sys_##sname, __x64_sys_##sname);	\
+-	asmlinkage long __x64_sys_##sname(void)
++
++#define SYSCALL_DEFINE0(sname)						\
++	SYSCALL_METADATA(_##sname, 0);					\
++	asmlinkage long __x64_sys_##sname(const struct pt_regs *__unused);\
++	ALLOW_ERROR_INJECTION(__x64_sys_##sname, ERRNO);		\
++	SYSCALL_ALIAS(__ia32_sys_##sname, __x64_sys_##sname);		\
++	asmlinkage long __x64_sys_##sname(const struct pt_regs *__unused)
+ 
+ #define COND_SYSCALL(name)						\
+ 	cond_syscall(__x64_sys_##name);					\
+@@ -181,11 +182,11 @@
+  * macros to work correctly.
+  */
+ #ifndef SYSCALL_DEFINE0
+-#define SYSCALL_DEFINE0(sname)					\
+-	SYSCALL_METADATA(_##sname, 0);				\
+-	asmlinkage long __x64_sys_##sname(void);		\
+-	ALLOW_ERROR_INJECTION(__x64_sys_##sname, ERRNO);	\
+-	asmlinkage long __x64_sys_##sname(void)
++#define SYSCALL_DEFINE0(sname)						\
++	SYSCALL_METADATA(_##sname, 0);					\
++	asmlinkage long __x64_sys_##sname(const struct pt_regs *__unused);\
++	ALLOW_ERROR_INJECTION(__x64_sys_##sname, ERRNO);		\
++	asmlinkage long __x64_sys_##sname(const struct pt_regs *__unused)
+ #endif
+ 
+ #ifndef COND_SYSCALL
+-- 
+2.20.1
+
diff --git a/queue-5.4/team-call-rcu-read-lock-when-walking-the-port_list.patch b/queue-5.4/team-call-rcu-read-lock-when-walking-the-port_list.patch
new file mode 100644
index 00000000000..6101fb08909
--- /dev/null
+++ b/queue-5.4/team-call-rcu-read-lock-when-walking-the-port_list.patch
@@ -0,0 +1,52 @@
+From 8a35062f634953002edd96d5d9a0ca951502394e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2019 20:18:28 +0800
+Subject: team: call RCU read lock when walking the port_list
+
+From: Hangbin Liu <liuhangbin@gmail.com>
+
+[ Upstream commit c17e26ddc79596230834345be80fcad6c619e9ec ]
+
+Before reading the team port list, we need to acquire the RCU read lock.
+Also change list_for_each_entry() to list_for_each_entry_rcu().
+
+v2:
+repost the patch to net-next and remove fixes flag as this is a cosmetic
+change.
+
+Suggested-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
+Acked-by: Paolo Abeni <pabeni@redhat.com>
+Acked-by: Jiri Pirko <jiri@mellanox.com>
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/team/team.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
+index 8156b33ee3e7..ca70a1d840eb 100644
+--- a/drivers/net/team/team.c
++++ b/drivers/net/team/team.c
+@@ -2074,7 +2074,8 @@ static int team_ethtool_get_link_ksettings(struct net_device *dev,
+ 	cmd->base.duplex = DUPLEX_UNKNOWN;
+ 	cmd->base.port = PORT_OTHER;
+ 
+-	list_for_each_entry(port, &team->port_list, list) {
++	rcu_read_lock();
++	list_for_each_entry_rcu(port, &team->port_list, list) {
+ 		if (team_port_txable(port)) {
+ 			if (port->state.speed != SPEED_UNKNOWN)
+ 				speed += port->state.speed;
+@@ -2083,6 +2084,8 @@ static int team_ethtool_get_link_ksettings(struct net_device *dev,
+ 				cmd->base.duplex = port->state.duplex;
+ 		}
+ 	}
++	rcu_read_unlock();
++
+ 	cmd->base.speed = speed ? : SPEED_UNKNOWN;
+ 
+ 	return 0;
+-- 
+2.20.1
+
diff --git a/queue-5.4/tools-bpf-fix-build-for-make-s-tools-bpf-o-dir.patch b/queue-5.4/tools-bpf-fix-build-for-make-s-tools-bpf-o-dir.patch
new file mode 100644
index 00000000000..5cb5eb30e4d
--- /dev/null
+++ b/queue-5.4/tools-bpf-fix-build-for-make-s-tools-bpf-o-dir.patch
@@ -0,0 +1,55 @@
+From ccd721a0ff1ff60ba24e511decf4db0d1003a632 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Nov 2019 10:56:26 +0000
+Subject: tools, bpf: Fix build for 'make -s tools/bpf O=<dir>'
+
+From: Quentin Monnet <quentin.monnet@netronome.com>
+
+[ Upstream commit a89b2cbf71d64b61e79bbe5cb7ff4664797eeaaf ]
+
+Building selftests with 'make TARGETS=bpf kselftest' was fixed in commit
+55d554f5d140 ("tools: bpf: Use !building_out_of_srctree to determine
+srctree"). However, by updating $(srctree) in tools/bpf/Makefile for
+in-tree builds only, we leave out the case where we pass an output
+directory to build BPF tools, but $(srctree) is not set. This
+typically happens for:
+
+    $ make -s tools/bpf O=/tmp/foo
+    Makefile:40: /tools/build/Makefile.feature: No such file or directory
+
+Fix it by updating $(srctree) in the Makefile not only for out-of-tree
+builds, but also if $(srctree) is empty.
+
+Detected with test_bpftool_build.sh.
+
+Fixes: 55d554f5d140 ("tools: bpf: Use !building_out_of_srctree to determine srctree")
+Signed-off-by: Quentin Monnet <quentin.monnet@netronome.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Link: https://lore.kernel.org/bpf/20191119105626.21453-1-quentin.monnet@netronome.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/Makefile | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/tools/bpf/Makefile b/tools/bpf/Makefile
+index 5d1995fd369c..5535650800ab 100644
+--- a/tools/bpf/Makefile
++++ b/tools/bpf/Makefile
+@@ -16,7 +16,13 @@ CFLAGS += -D__EXPORTED_HEADERS__ -I$(srctree)/include/uapi -I$(srctree)/include
+ # isn't set and when invoked from selftests build, where srctree
+ # is set to ".". building_out_of_srctree is undefined for in srctree
+ # builds
++ifeq ($(srctree),)
++update_srctree := 1
++endif
+ ifndef building_out_of_srctree
++update_srctree := 1
++endif
++ifeq ($(update_srctree),1)
+ srctree := $(patsubst %/,%,$(dir $(CURDIR)))
+ srctree := $(patsubst %/,%,$(dir $(srctree)))
+ endif
+-- 
+2.20.1
+
diff --git a/queue-5.4/tools-memory-model-fix-data-race-detection-for-unord.patch b/queue-5.4/tools-memory-model-fix-data-race-detection-for-unord.patch
new file mode 100644
index 00000000000..976727f4174
--- /dev/null
+++ b/queue-5.4/tools-memory-model-fix-data-race-detection-for-unord.patch
@@ -0,0 +1,90 @@
+From e48e9cbff8de43d50c8f12bcafe9b3a6545d3fb5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Sep 2019 16:57:22 -0400
+Subject: tools/memory-model: Fix data race detection for unordered store and
+ load
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+[ Upstream commit daebf24a8e8c6064cba3a330db9fe9376a137d2c ]
+
+Currently the Linux Kernel Memory Model gives an incorrect response
+for the following litmus test:
+
+C plain-WWC
+
+{}
+
+P0(int *x)
+{
+	WRITE_ONCE(*x, 2);
+}
+
+P1(int *x, int *y)
+{
+	int r1;
+	int r2;
+	int r3;
+
+	r1 = READ_ONCE(*x);
+	if (r1 == 2) {
+		smp_rmb();
+		r2 = *x;
+	}
+	smp_rmb();
+	r3 = READ_ONCE(*x);
+	WRITE_ONCE(*y, r3 - 1);
+}
+
+P2(int *x, int *y)
+{
+	int r4;
+
+	r4 = READ_ONCE(*y);
+	if (r4 > 0)
+		WRITE_ONCE(*x, 1);
+}
+
+exists (x=2 /\ 1:r2=2 /\ 2:r4=1)
+
+The memory model says that the plain read of *x in P1 races with the
+WRITE_ONCE(*x) in P2.
+
+The problem is that we have a write W and a read R related by neither
+fre or rfe, but rather W ->coe W' ->rfe R, where W' is an intermediate
+write (the WRITE_ONCE() in P0).  In this situation there is no
+particular ordering between W and R, so either a wr-vis link from W to
+R or an rw-xbstar link from R to W would prove that the accesses
+aren't concurrent.
+
+But the LKMM only looks for a wr-vis link, which is equivalent to
+assuming that W must execute before R.  This is not necessarily true
+on non-multicopy-atomic systems, as the WWC pattern demonstrates.
+
+This patch changes the LKMM to accept either a wr-vis or a reverse
+rw-xbstar link as a proof of non-concurrency.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Acked-by: Andrea Parri <parri.andrea@gmail.com>
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/memory-model/linux-kernel.cat | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/memory-model/linux-kernel.cat b/tools/memory-model/linux-kernel.cat
+index ea2ff4b94074..2a9b4fe4a84e 100644
+--- a/tools/memory-model/linux-kernel.cat
++++ b/tools/memory-model/linux-kernel.cat
+@@ -197,7 +197,7 @@ empty (wr-incoh | rw-incoh | ww-incoh) as plain-coherence
+ (* Actual races *)
+ let ww-nonrace = ww-vis & ((Marked * W) | rw-xbstar) & ((W * Marked) | wr-vis)
+ let ww-race = (pre-race & co) \ ww-nonrace
+-let wr-race = (pre-race & (co? ; rf)) \ wr-vis
++let wr-race = (pre-race & (co? ; rf)) \ wr-vis \ rw-xbstar^-1
+ let rw-race = (pre-race & fr) \ rw-xbstar
+ 
+ flag ~empty (ww-race | wr-race | rw-race) as data-race
+-- 
+2.20.1
+
diff --git a/queue-5.4/tools-power-cpupower-fix-initializer-override-in-hsw.patch b/queue-5.4/tools-power-cpupower-fix-initializer-override-in-hsw.patch
new file mode 100644
index 00000000000..aa9b9ebfb25
--- /dev/null
+++ b/queue-5.4/tools-power-cpupower-fix-initializer-override-in-hsw.patch
@@ -0,0 +1,63 @@
+From f100920cb80a8063f07ee39fef737ce5734fef6d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Sep 2019 09:26:42 -0700
+Subject: tools/power/cpupower: Fix initializer override in hsw_ext_cstates
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit 7e5705c635ecfccde559ebbbe1eaf05b5cc60529 ]
+
+When building cpupower with clang, the following warning appears:
+
+ utils/idle_monitor/hsw_ext_idle.c:42:16: warning: initializer overrides
+ prior initialization of this subobject [-Winitializer-overrides]
+                 .desc                   = N_("Processor Package C2"),
+                                              ^~~~~~~~~~~~~~~~~~~~~~
+ ./utils/helpers/helpers.h:25:33: note: expanded from macro 'N_'
+ #define N_(String) gettext_noop(String)
+                                 ^~~~~~
+ ./utils/helpers/helpers.h:23:30: note: expanded from macro
+ 'gettext_noop'
+ #define gettext_noop(String) String
+                              ^~~~~~
+ utils/idle_monitor/hsw_ext_idle.c:41:16: note: previous initialization
+ is here
+                 .desc                   = N_("Processor Package C9"),
+                                              ^~~~~~~~~~~~~~~~~~~~~~
+ ./utils/helpers/helpers.h:25:33: note: expanded from macro 'N_'
+ #define N_(String) gettext_noop(String)
+                                 ^~~~~~
+ ./utils/helpers/helpers.h:23:30: note: expanded from macro
+ 'gettext_noop'
+ #define gettext_noop(String) String
+                             ^~~~~~
+ 1 warning generated.
+
+This appears to be a copy and paste or merge mistake because the name
+and id fields both have PC9 in them, not PC2. Remove the second
+assignment to fix the warning.
+
+Fixes: 7ee767b69b68 ("cpupower: Add Haswell family 0x45 specific idle monitor to show PC8,9,10 states")
+Link: https://github.com/ClangBuiltLinux/linux/issues/718
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/power/cpupower/utils/idle_monitor/hsw_ext_idle.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/tools/power/cpupower/utils/idle_monitor/hsw_ext_idle.c b/tools/power/cpupower/utils/idle_monitor/hsw_ext_idle.c
+index 7c7451d3f494..58dbdfd4fa13 100644
+--- a/tools/power/cpupower/utils/idle_monitor/hsw_ext_idle.c
++++ b/tools/power/cpupower/utils/idle_monitor/hsw_ext_idle.c
+@@ -39,7 +39,6 @@ static cstate_t hsw_ext_cstates[HSW_EXT_CSTATE_COUNT] = {
+ 	{
+ 		.name			= "PC9",
+ 		.desc			= N_("Processor Package C9"),
+-		.desc			= N_("Processor Package C2"),
+ 		.id			= PC9,
+ 		.range			= RANGE_PACKAGE,
+ 		.get_count_percent	= hsw_ext_get_count_percent,
+-- 
+2.20.1
+
diff --git a/queue-5.4/tracing-kprobe-check-whether-the-non-suffixed-symbol.patch b/queue-5.4/tracing-kprobe-check-whether-the-non-suffixed-symbol.patch
new file mode 100644
index 00000000000..48c0f6590a7
--- /dev/null
+++ b/queue-5.4/tracing-kprobe-check-whether-the-non-suffixed-symbol.patch
@@ -0,0 +1,95 @@
+From 9830bda4301c61c11780d989af25d56560a926da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Oct 2019 17:31:44 +0900
+Subject: tracing/kprobe: Check whether the non-suffixed symbol is notrace
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit c7411a1a126f649be71526a36d4afac9e5aefa13 ]
+
+Check whether the non-suffixed symbol is notrace, since suffixed
+symbols are generated by the compilers for optimization. Based on
+these suffixed symbols, notrace check might not work because
+some of them are just a partial code of the original function.
+(e.g. cold-cache (unlikely) code is separated from original
+ function as FUNCTION.cold.XX)
+
+For example, without this fix,
+  # echo p device_add.cold.67 > /sys/kernel/debug/tracing/kprobe_events
+  sh: write error: Invalid argument
+
+  # cat /sys/kernel/debug/tracing/error_log
+  [  135.491035] trace_kprobe: error: Failed to register probe event
+    Command: p device_add.cold.67
+               ^
+  # dmesg | tail -n 1
+  [  135.488599] trace_kprobe: Could not probe notrace function device_add.cold.67
+
+With this,
+  # echo p device_add.cold.66 > /sys/kernel/debug/tracing/kprobe_events
+  # cat /sys/kernel/debug/kprobes/list
+  ffffffff81599de9  k  device_add.cold.66+0x0    [DISABLED]
+
+Actually, kprobe blacklist already did similar thing,
+see within_kprobe_blacklist().
+
+Link: http://lkml.kernel.org/r/157233790394.6706.18243942030937189679.stgit@devnote2
+
+Fixes: 45408c4f9250 ("tracing: kprobes: Prohibit probing on notrace function")
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/trace_kprobe.c | 27 ++++++++++++++++++++++++---
+ 1 file changed, 24 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
+index 1552a95c743b..7f890262c8a3 100644
+--- a/kernel/trace/trace_kprobe.c
++++ b/kernel/trace/trace_kprobe.c
+@@ -435,11 +435,10 @@ static int disable_trace_kprobe(struct trace_event_call *call,
+ 
+ #if defined(CONFIG_KPROBES_ON_FTRACE) && \
+ 	!defined(CONFIG_KPROBE_EVENTS_ON_NOTRACE)
+-static bool within_notrace_func(struct trace_kprobe *tk)
++static bool __within_notrace_func(unsigned long addr)
+ {
+-	unsigned long offset, size, addr;
++	unsigned long offset, size;
+ 
+-	addr = trace_kprobe_address(tk);
+ 	if (!addr || !kallsyms_lookup_size_offset(addr, &size, &offset))
+ 		return false;
+ 
+@@ -452,6 +451,28 @@ static bool within_notrace_func(struct trace_kprobe *tk)
+ 	 */
+ 	return !ftrace_location_range(addr, addr + size - 1);
+ }
++
++static bool within_notrace_func(struct trace_kprobe *tk)
++{
++	unsigned long addr = addr = trace_kprobe_address(tk);
++	char symname[KSYM_NAME_LEN], *p;
++
++	if (!__within_notrace_func(addr))
++		return false;
++
++	/* Check if the address is on a suffixed-symbol */
++	if (!lookup_symbol_name(addr, symname)) {
++		p = strchr(symname, '.');
++		if (!p)
++			return true;
++		*p = '\0';
++		addr = (unsigned long)kprobe_lookup_name(symname, 0);
++		if (addr)
++			return __within_notrace_func(addr);
++	}
++
++	return true;
++}
+ #else
+ #define within_notrace_func(tk)	(false)
+ #endif
+-- 
+2.20.1
+
diff --git a/queue-5.4/tracing-use-kvcalloc-for-tgid_map-array-allocation.patch b/queue-5.4/tracing-use-kvcalloc-for-tgid_map-array-allocation.patch
new file mode 100644
index 00000000000..6af7ee6d1a6
--- /dev/null
+++ b/queue-5.4/tracing-use-kvcalloc-for-tgid_map-array-allocation.patch
@@ -0,0 +1,59 @@
+From e4913d992ad4f40e648a94773bdb1c18dafb51ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Oct 2019 11:34:30 +0800
+Subject: tracing: use kvcalloc for tgid_map array allocation
+
+From: Yuming Han <yuming.han@unisoc.com>
+
+[ Upstream commit 6ee40511cb838f9ced002dff7131bca87e3ccbdd ]
+
+Fail to allocate memory for tgid_map, because it requires order-6 page.
+detail as:
+
+c3 sh: page allocation failure: order:6,
+   mode:0x140c0c0(GFP_KERNEL), nodemask=(null)
+c3 sh cpuset=/ mems_allowed=0
+c3 CPU: 3 PID: 5632 Comm: sh Tainted: G        W  O    4.14.133+ #10
+c3 Hardware name: Generic DT based system
+c3 Backtrace:
+c3 [<c010bdbc>] (dump_backtrace) from [<c010c08c>](show_stack+0x18/0x1c)
+c3 [<c010c074>] (show_stack) from [<c0993c54>](dump_stack+0x84/0xa4)
+c3 [<c0993bd0>] (dump_stack) from [<c0229858>](warn_alloc+0xc4/0x19c)
+c3 [<c0229798>] (warn_alloc) from [<c022a6e4>](__alloc_pages_nodemask+0xd18/0xf28)
+c3 [<c02299cc>] (__alloc_pages_nodemask) from [<c0248344>](kmalloc_order+0x20/0x38)
+c3 [<c0248324>] (kmalloc_order) from [<c0248380>](kmalloc_order_trace+0x24/0x108)
+c3 [<c024835c>] (kmalloc_order_trace) from [<c01e6078>](set_tracer_flag+0xb0/0x158)
+c3 [<c01e5fc8>] (set_tracer_flag) from [<c01e6404>](trace_options_core_write+0x7c/0xcc)
+c3 [<c01e6388>] (trace_options_core_write) from [<c0278b1c>](__vfs_write+0x40/0x14c)
+c3 [<c0278adc>] (__vfs_write) from [<c0278e10>](vfs_write+0xc4/0x198)
+c3 [<c0278d4c>] (vfs_write) from [<c027906c>](SyS_write+0x6c/0xd0)
+c3 [<c0279000>] (SyS_write) from [<c01079a0>](ret_fast_syscall+0x0/0x54)
+
+Switch to use kvcalloc to avoid unexpected allocation failures.
+
+Link: http://lkml.kernel.org/r/1571888070-24425-1-git-send-email-chunyan.zhang@unisoc.com
+
+Signed-off-by: Yuming Han <yuming.han@unisoc.com>
+Signed-off-by: Chunyan Zhang <chunyan.zhang@unisoc.com>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/trace.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 6a0ee9178365..2fa72419bbd7 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -4609,7 +4609,7 @@ int set_tracer_flag(struct trace_array *tr, unsigned int mask, int enabled)
+ 
+ 	if (mask == TRACE_ITER_RECORD_TGID) {
+ 		if (!tgid_map)
+-			tgid_map = kcalloc(PID_MAX_DEFAULT + 1,
++			tgid_map = kvcalloc(PID_MAX_DEFAULT + 1,
+ 					   sizeof(*tgid_map),
+ 					   GFP_KERNEL);
+ 		if (!tgid_map) {
+-- 
+2.20.1
+
diff --git a/queue-5.4/tun-fix-data-race-in-gro_normal_list.patch b/queue-5.4/tun-fix-data-race-in-gro_normal_list.patch
new file mode 100644
index 00000000000..2d92ba7de95
--- /dev/null
+++ b/queue-5.4/tun-fix-data-race-in-gro_normal_list.patch
@@ -0,0 +1,92 @@
+From 77e572d9e9a33eb2b136d59f262c5b5995c99076 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Nov 2019 09:52:09 -0800
+Subject: tun: fix data-race in gro_normal_list()
+
+From: Petar Penkov <ppenkov@google.com>
+
+[ Upstream commit c39e342a050a4425348e6fe7f75827c0a1a7ebc5 ]
+
+There is a race in the TUN driver between napi_busy_loop and
+napi_gro_frags. This commit resolves the race by adding the NAPI struct
+via netif_tx_napi_add, instead of netif_napi_add, which disables polling
+for the NAPI struct.
+
+KCSAN reported:
+BUG: KCSAN: data-race in gro_normal_list.part.0 / napi_busy_loop
+
+write to 0xffff8880b5d474b0 of 4 bytes by task 11205 on cpu 0:
+ gro_normal_list.part.0+0x77/0xb0 net/core/dev.c:5682
+ gro_normal_list net/core/dev.c:5678 [inline]
+ gro_normal_one net/core/dev.c:5692 [inline]
+ napi_frags_finish net/core/dev.c:5705 [inline]
+ napi_gro_frags+0x625/0x770 net/core/dev.c:5778
+ tun_get_user+0x2150/0x26a0 drivers/net/tun.c:1976
+ tun_chr_write_iter+0x79/0xd0 drivers/net/tun.c:2022
+ call_write_iter include/linux/fs.h:1895 [inline]
+ do_iter_readv_writev+0x487/0x5b0 fs/read_write.c:693
+ do_iter_write fs/read_write.c:970 [inline]
+ do_iter_write+0x13b/0x3c0 fs/read_write.c:951
+ vfs_writev+0x118/0x1c0 fs/read_write.c:1015
+ do_writev+0xe3/0x250 fs/read_write.c:1058
+ __do_sys_writev fs/read_write.c:1131 [inline]
+ __se_sys_writev fs/read_write.c:1128 [inline]
+ __x64_sys_writev+0x4e/0x60 fs/read_write.c:1128
+ do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+read to 0xffff8880b5d474b0 of 4 bytes by task 11168 on cpu 1:
+ gro_normal_list net/core/dev.c:5678 [inline]
+ napi_busy_loop+0xda/0x4f0 net/core/dev.c:6126
+ sk_busy_loop include/net/busy_poll.h:108 [inline]
+ __skb_recv_udp+0x4ad/0x560 net/ipv4/udp.c:1689
+ udpv6_recvmsg+0x29e/0xe90 net/ipv6/udp.c:288
+ inet6_recvmsg+0xbb/0x240 net/ipv6/af_inet6.c:592
+ sock_recvmsg_nosec net/socket.c:871 [inline]
+ sock_recvmsg net/socket.c:889 [inline]
+ sock_recvmsg+0x92/0xb0 net/socket.c:885
+ sock_read_iter+0x15f/0x1e0 net/socket.c:967
+ call_read_iter include/linux/fs.h:1889 [inline]
+ new_sync_read+0x389/0x4f0 fs/read_write.c:414
+ __vfs_read+0xb1/0xc0 fs/read_write.c:427
+ vfs_read fs/read_write.c:461 [inline]
+ vfs_read+0x143/0x2c0 fs/read_write.c:446
+ ksys_read+0xd5/0x1b0 fs/read_write.c:587
+ __do_sys_read fs/read_write.c:597 [inline]
+ __se_sys_read fs/read_write.c:595 [inline]
+ __x64_sys_read+0x4c/0x60 fs/read_write.c:595
+ do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Reported by Kernel Concurrency Sanitizer on:
+CPU: 1 PID: 11168 Comm: syz-executor.0 Not tainted 5.4.0-rc6+ #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
+
+Fixes: 943170998b20 ("tun: enable NAPI for TUN/TAP driver")
+Signed-off-by: Petar Penkov <ppenkov@google.com>
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/tun.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index a8d3141582a5..16564ebcde50 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -313,8 +313,8 @@ static void tun_napi_init(struct tun_struct *tun, struct tun_file *tfile,
+ 	tfile->napi_enabled = napi_en;
+ 	tfile->napi_frags_enabled = napi_en && napi_frags;
+ 	if (napi_en) {
+-		netif_napi_add(tun->dev, &tfile->napi, tun_napi_poll,
+-			       NAPI_POLL_WEIGHT);
++		netif_tx_napi_add(tun->dev, &tfile->napi, tun_napi_poll,
++				  NAPI_POLL_WEIGHT);
+ 		napi_enable(&tfile->napi);
+ 	}
+ }
+-- 
+2.20.1
+
diff --git a/queue-5.4/ubsan-x86-annotate-and-allow-__ubsan_handle_shift_ou.patch b/queue-5.4/ubsan-x86-annotate-and-allow-__ubsan_handle_shift_ou.patch
new file mode 100644
index 00000000000..46b2213e676
--- /dev/null
+++ b/queue-5.4/ubsan-x86-annotate-and-allow-__ubsan_handle_shift_ou.patch
@@ -0,0 +1,82 @@
+From 20187b2b77aee3b04301adb6791c9112c7f2dfc9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Oct 2019 15:11:49 +0200
+Subject: ubsan, x86: Annotate and allow __ubsan_handle_shift_out_of_bounds()
+ in uaccess regions
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit 9a50dcaf0416a43e1fe411dc61a99c8333c90119 ]
+
+The new check_zeroed_user() function uses variable shifts inside of a
+user_access_begin()/user_access_end() section and that results in GCC
+emitting __ubsan_handle_shift_out_of_bounds() calls, even though
+through value range analysis it would be able to see that the UB in
+question is impossible.
+
+Annotate and whitelist this UBSAN function; continued use of
+user_access_begin()/user_access_end() will undoubtedly result in
+further uses of function.
+
+Reported-by: Randy Dunlap <rdunlap@infradead.org>
+Tested-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Acked-by: Randy Dunlap <rdunlap@infradead.org>
+Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephen Rothwell <sfr@canb.auug.org.au>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: cyphar@cyphar.com
+Cc: keescook@chromium.org
+Cc: linux@rasmusvillemoes.dk
+Fixes: f5a1a536fa14 ("lib: introduce copy_struct_from_user() helper")
+Link: https://lkml.kernel.org/r/20191021131149.GA19358@hirez.programming.kicks-ass.net
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/ubsan.c           | 5 ++++-
+ tools/objtool/check.c | 1 +
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/lib/ubsan.c b/lib/ubsan.c
+index e7d31735950d..0c4681118fcd 100644
+--- a/lib/ubsan.c
++++ b/lib/ubsan.c
+@@ -374,9 +374,10 @@ void __ubsan_handle_shift_out_of_bounds(struct shift_out_of_bounds_data *data,
+ 	struct type_descriptor *lhs_type = data->lhs_type;
+ 	char rhs_str[VALUE_LENGTH];
+ 	char lhs_str[VALUE_LENGTH];
++	unsigned long ua_flags = user_access_save();
+ 
+ 	if (suppress_report(&data->location))
+-		return;
++		goto out;
+ 
+ 	ubsan_prologue(&data->location, &flags);
+ 
+@@ -402,6 +403,8 @@ void __ubsan_handle_shift_out_of_bounds(struct shift_out_of_bounds_data *data,
+ 			lhs_type->type_name);
+ 
+ 	ubsan_epilogue(&flags);
++out:
++	user_access_restore(ua_flags);
+ }
+ EXPORT_SYMBOL(__ubsan_handle_shift_out_of_bounds);
+ 
+diff --git a/tools/objtool/check.c b/tools/objtool/check.c
+index 044c9a3cb247..f53d3c515cdc 100644
+--- a/tools/objtool/check.c
++++ b/tools/objtool/check.c
+@@ -481,6 +481,7 @@ static const char *uaccess_safe_builtin[] = {
+ 	"ubsan_type_mismatch_common",
+ 	"__ubsan_handle_type_mismatch",
+ 	"__ubsan_handle_type_mismatch_v1",
++	"__ubsan_handle_shift_out_of_bounds",
+ 	/* misc */
+ 	"csum_partial_copy_generic",
+ 	"__memcpy_mcsafe",
+-- 
+2.20.1
+
diff --git a/queue-5.4/usb-renesas_usbhs-add-suspend-event-support-in-gadge.patch b/queue-5.4/usb-renesas_usbhs-add-suspend-event-support-in-gadge.patch
new file mode 100644
index 00000000000..6466a927485
--- /dev/null
+++ b/queue-5.4/usb-renesas_usbhs-add-suspend-event-support-in-gadge.patch
@@ -0,0 +1,89 @@
+From ab63b611848bdd05659024c2ad7b37c2fb6a0c4b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Sep 2019 15:15:56 +0200
+Subject: usb: renesas_usbhs: add suspend event support in gadget mode
+
+From: Veeraiyan Chidambaram <veeraiyan.chidambaram@in.bosch.com>
+
+[ Upstream commit 39abcc84846bbc0538f13c190b6a9c7e36890cd2 ]
+
+When R-Car Gen3 USB 2.0 is in Gadget mode, if host is detached an interrupt
+will be generated and Suspended state bit is set in interrupt status
+register. Interrupt handler will call driver->suspend(composite_suspend)
+if suspended state bit is set. composite_suspend will call
+ffs_func_suspend which will post FUNCTIONFS_SUSPEND and will be consumed
+by user space application via /dev/ep0.
+
+To be able to detect host detach, extend the DVSQ_MASK to cover the
+Suspended bit of the DVSQ[2:0] bitfield from the Interrupt Status
+Register 0 (INTSTS0) register and perform appropriate action in the
+DVST interrupt handler (usbhsg_irq_dev_state).
+
+Without this commit, disconnection of the phone from R-Car-H3 ES2.0
+Salvator-X CN9 port is not recognized and reverse role switch does
+not happen. If phone is connected again it does not enumerate.
+
+With this commit, disconnection will be recognized and reverse role
+switch will happen by a user space application. If phone is connected
+again it will enumerate properly and will become visible in the output
+of 'lsusb'.
+
+Signed-off-by: Veeraiyan Chidambaram <veeraiyan.chidambaram@in.bosch.com>
+Signed-off-by: Eugeniu Rosca <erosca@de.adit-jv.com>
+Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Tested-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Link: https://lore.kernel.org/r/1568207756-22325-3-git-send-email-external.veeraiyan.c@de.adit-jv.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/renesas_usbhs/common.h     |  3 ++-
+ drivers/usb/renesas_usbhs/mod_gadget.c | 12 +++++++++---
+ 2 files changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/usb/renesas_usbhs/common.h b/drivers/usb/renesas_usbhs/common.h
+index 0824099b905e..ef1735d014da 100644
+--- a/drivers/usb/renesas_usbhs/common.h
++++ b/drivers/usb/renesas_usbhs/common.h
+@@ -161,11 +161,12 @@ struct usbhs_priv;
+ #define VBSTS	(1 << 7)	/* VBUS_0 and VBUSIN_0 Input Status */
+ #define VALID	(1 << 3)	/* USB Request Receive */
+ 
+-#define DVSQ_MASK		(0x3 << 4)	/* Device State */
++#define DVSQ_MASK		(0x7 << 4)	/* Device State */
+ #define  POWER_STATE		(0 << 4)
+ #define  DEFAULT_STATE		(1 << 4)
+ #define  ADDRESS_STATE		(2 << 4)
+ #define  CONFIGURATION_STATE	(3 << 4)
++#define  SUSPENDED_STATE	(4 << 4)
+ 
+ #define CTSQ_MASK		(0x7)	/* Control Transfer Stage */
+ #define  IDLE_SETUP_STAGE	0	/* Idle stage or setup stage */
+diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c
+index cd38d74b3223..53489cafecc1 100644
+--- a/drivers/usb/renesas_usbhs/mod_gadget.c
++++ b/drivers/usb/renesas_usbhs/mod_gadget.c
+@@ -457,12 +457,18 @@ static int usbhsg_irq_dev_state(struct usbhs_priv *priv,
+ {
+ 	struct usbhsg_gpriv *gpriv = usbhsg_priv_to_gpriv(priv);
+ 	struct device *dev = usbhsg_gpriv_to_dev(gpriv);
++	int state = usbhs_status_get_device_state(irq_state);
+ 
+ 	gpriv->gadget.speed = usbhs_bus_get_speed(priv);
+ 
+-	dev_dbg(dev, "state = %x : speed : %d\n",
+-		usbhs_status_get_device_state(irq_state),
+-		gpriv->gadget.speed);
++	dev_dbg(dev, "state = %x : speed : %d\n", state, gpriv->gadget.speed);
++
++	if (gpriv->gadget.speed != USB_SPEED_UNKNOWN &&
++	    (state & SUSPENDED_STATE)) {
++		if (gpriv->driver && gpriv->driver->suspend)
++			gpriv->driver->suspend(&gpriv->gadget);
++		usb_gadget_set_state(&gpriv->gadget, USB_STATE_SUSPENDED);
++	}
+ 
+ 	return 0;
+ }
+-- 
+2.20.1
+
diff --git a/queue-5.4/usb-usbfs-suppress-problematic-bind-and-unbind-ueven.patch b/queue-5.4/usb-usbfs-suppress-problematic-bind-and-unbind-ueven.patch
new file mode 100644
index 00000000000..a59f77ff31f
--- /dev/null
+++ b/queue-5.4/usb-usbfs-suppress-problematic-bind-and-unbind-ueven.patch
@@ -0,0 +1,82 @@
+From bc33c30fc21aab4db033cbe997ec15068afb7611 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Oct 2019 13:55:18 +0200
+Subject: usb: usbfs: Suppress problematic bind and unbind uevents.
+
+From: Ingo Rohloff <ingo.rohloff@lauterbach.com>
+
+[ Upstream commit abb0b3d96a1f9407dd66831ae33985a386d4200d ]
+
+commit 1455cf8dbfd0 ("driver core: emit uevents when device is bound
+to a driver") added bind and unbind uevents when a driver is bound or
+unbound to a physical device.
+
+For USB devices which are handled via the generic usbfs layer (via
+libusb for example), this is problematic:
+Each time a user space program calls
+   ioctl(usb_fd, USBDEVFS_CLAIMINTERFACE, &usb_intf_nr);
+and then later
+   ioctl(usb_fd, USBDEVFS_RELEASEINTERFACE, &usb_intf_nr);
+The kernel will now produce a bind or unbind event, which does not
+really contain any useful information.
+
+This allows a user space program to run a DoS attack against programs
+which listen to uevents (in particular systemd/eudev/upowerd):
+A malicious user space program just has to call in a tight loop
+
+   ioctl(usb_fd, USBDEVFS_CLAIMINTERFACE, &usb_intf_nr);
+   ioctl(usb_fd, USBDEVFS_RELEASEINTERFACE, &usb_intf_nr);
+
+With this loop the malicious user space program floods the kernel and
+all programs listening to uevents with tons of bind and unbind
+events.
+
+This patch suppresses uevents for ioctls USBDEVFS_CLAIMINTERFACE and
+USBDEVFS_RELEASEINTERFACE.
+
+Signed-off-by: Ingo Rohloff <ingo.rohloff@lauterbach.com>
+Link: https://lore.kernel.org/r/20191011115518.2801-1-ingo.rohloff@lauterbach.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/core/devio.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
+index 3f899552f6e3..6ca40d135430 100644
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -764,8 +764,15 @@ static int claimintf(struct usb_dev_state *ps, unsigned int ifnum)
+ 	intf = usb_ifnum_to_if(dev, ifnum);
+ 	if (!intf)
+ 		err = -ENOENT;
+-	else
++	else {
++		unsigned int old_suppress;
++
++		/* suppress uevents while claiming interface */
++		old_suppress = dev_get_uevent_suppress(&intf->dev);
++		dev_set_uevent_suppress(&intf->dev, 1);
+ 		err = usb_driver_claim_interface(&usbfs_driver, intf, ps);
++		dev_set_uevent_suppress(&intf->dev, old_suppress);
++	}
+ 	if (err == 0)
+ 		set_bit(ifnum, &ps->ifclaimed);
+ 	return err;
+@@ -785,7 +792,13 @@ static int releaseintf(struct usb_dev_state *ps, unsigned int ifnum)
+ 	if (!intf)
+ 		err = -ENOENT;
+ 	else if (test_and_clear_bit(ifnum, &ps->ifclaimed)) {
++		unsigned int old_suppress;
++
++		/* suppress uevents while releasing interface */
++		old_suppress = dev_get_uevent_suppress(&intf->dev);
++		dev_set_uevent_suppress(&intf->dev, 1);
+ 		usb_driver_release_interface(&usbfs_driver, intf);
++		dev_set_uevent_suppress(&intf->dev, old_suppress);
+ 		err = 0;
+ 	}
+ 	return err;
+-- 
+2.20.1
+
diff --git a/queue-5.4/x86-crash-add-a-forward-declaration-of-struct-kimage.patch b/queue-5.4/x86-crash-add-a-forward-declaration-of-struct-kimage.patch
new file mode 100644
index 00000000000..b327b0310f8
--- /dev/null
+++ b/queue-5.4/x86-crash-add-a-forward-declaration-of-struct-kimage.patch
@@ -0,0 +1,72 @@
+From a75f2601aee62570893a6f2d6dcdfb4d9a150db4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Nov 2019 17:00:27 +0800
+Subject: x86/crash: Add a forward declaration of struct kimage
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Lianbo Jiang <lijiang@redhat.com>
+
+[ Upstream commit 112eee5d06007dae561f14458bde7f2a4879ef4e ]
+
+Add a forward declaration of struct kimage to the crash.h header because
+future changes will invoke a crash-specific function from the realmode
+init path and the compiler will complain otherwise like this:
+
+  In file included from arch/x86/realmode/init.c:11:
+  ./arch/x86/include/asm/crash.h:5:32: warning: ‘struct kimage’ declared inside\
+   parameter list will not be visible outside of this definition or declaration
+      5 | int crash_load_segments(struct kimage *image);
+        |                                ^~~~~~
+  ./arch/x86/include/asm/crash.h:6:37: warning: ‘struct kimage’ declared inside\
+   parameter list will not be visible outside of this definition or declaration
+      6 | int crash_copy_backup_region(struct kimage *image);
+        |                                     ^~~~~~
+  ./arch/x86/include/asm/crash.h:7:39: warning: ‘struct kimage’ declared inside\
+   parameter list will not be visible outside of this definition or declaration
+      7 | int crash_setup_memmap_entries(struct kimage *image,
+        |
+
+ [ bp: Rewrite the commit message. ]
+
+Reported-by: kbuild test robot <lkp@intel.com>
+Signed-off-by: Lianbo Jiang <lijiang@redhat.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Cc: bhe@redhat.com
+Cc: d.hatayama@fujitsu.com
+Cc: dhowells@redhat.com
+Cc: dyoung@redhat.com
+Cc: ebiederm@xmission.com
+Cc: horms@verge.net.au
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jürgen Gross <jgross@suse.com>
+Cc: kexec@lists.infradead.org
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Tom Lendacky <thomas.lendacky@amd.com>
+Cc: vgoyal@redhat.com
+Cc: x86-ml <x86@kernel.org>
+Link: https://lkml.kernel.org/r/20191108090027.11082-4-lijiang@redhat.com
+Link: https://lkml.kernel.org/r/201910310233.EJRtTMWP%25lkp@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/crash.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/x86/include/asm/crash.h b/arch/x86/include/asm/crash.h
+index 0acf5ee45a21..ef5638f641f2 100644
+--- a/arch/x86/include/asm/crash.h
++++ b/arch/x86/include/asm/crash.h
+@@ -2,6 +2,8 @@
+ #ifndef _ASM_X86_CRASH_H
+ #define _ASM_X86_CRASH_H
+ 
++struct kimage;
++
+ int crash_load_segments(struct kimage *image);
+ int crash_copy_backup_region(struct kimage *image);
+ int crash_setup_memmap_entries(struct kimage *image,
+-- 
+2.20.1
+
diff --git a/queue-5.4/x86-insn-add-some-intel-instructions-to-the-opcode-m.patch b/queue-5.4/x86-insn-add-some-intel-instructions-to-the-opcode-m.patch
new file mode 100644
index 00000000000..7d96086b303
--- /dev/null
+++ b/queue-5.4/x86-insn-add-some-intel-instructions-to-the-opcode-m.patch
@@ -0,0 +1,258 @@
+From 8833de7d676b43c2685d30183c867a582aaeedac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Nov 2019 15:54:47 +0200
+Subject: x86/insn: Add some Intel instructions to the opcode map
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+[ Upstream commit b980be189c9badba50634671e2303e92bf28e35a ]
+
+Add to the opcode map the following instructions:
+        cldemote
+        tpause
+        umonitor
+        umwait
+        movdiri
+        movdir64b
+        enqcmd
+        enqcmds
+        encls
+        enclu
+        enclv
+        pconfig
+        wbnoinvd
+
+For information about the instructions, refer Intel SDM May 2019
+(325462-070US) and Intel Architecture Instruction Set Extensions
+May 2019 (319433-037).
+
+The instruction decoding can be tested using the perf tools'
+"x86 instruction decoder - new instructions" test as folllows:
+
+  $ perf test -v "new " 2>&1 | grep -i cldemote
+  Decoded ok: 0f 1c 00                    cldemote (%eax)
+  Decoded ok: 0f 1c 05 78 56 34 12        cldemote 0x12345678
+  Decoded ok: 0f 1c 84 c8 78 56 34 12     cldemote 0x12345678(%eax,%ecx,8)
+  Decoded ok: 0f 1c 00                    cldemote (%rax)
+  Decoded ok: 41 0f 1c 00                 cldemote (%r8)
+  Decoded ok: 0f 1c 04 25 78 56 34 12     cldemote 0x12345678
+  Decoded ok: 0f 1c 84 c8 78 56 34 12     cldemote 0x12345678(%rax,%rcx,8)
+  Decoded ok: 41 0f 1c 84 c8 78 56 34 12  cldemote 0x12345678(%r8,%rcx,8)
+  $ perf test -v "new " 2>&1 | grep -i tpause
+  Decoded ok: 66 0f ae f3                 tpause %ebx
+  Decoded ok: 66 0f ae f3                 tpause %ebx
+  Decoded ok: 66 41 0f ae f0              tpause %r8d
+  $ perf test -v "new " 2>&1 | grep -i umonitor
+  Decoded ok: 67 f3 0f ae f0              umonitor %ax
+  Decoded ok: f3 0f ae f0                 umonitor %eax
+  Decoded ok: 67 f3 0f ae f0              umonitor %eax
+  Decoded ok: f3 0f ae f0                 umonitor %rax
+  Decoded ok: 67 f3 41 0f ae f0           umonitor %r8d
+  $ perf test -v "new " 2>&1 | grep -i umwait
+  Decoded ok: f2 0f ae f0                 umwait %eax
+  Decoded ok: f2 0f ae f0                 umwait %eax
+  Decoded ok: f2 41 0f ae f0              umwait %r8d
+  $ perf test -v "new " 2>&1 | grep -i movdiri
+  Decoded ok: 0f 38 f9 03                 movdiri %eax,(%ebx)
+  Decoded ok: 0f 38 f9 88 78 56 34 12     movdiri %ecx,0x12345678(%eax)
+  Decoded ok: 48 0f 38 f9 03              movdiri %rax,(%rbx)
+  Decoded ok: 48 0f 38 f9 88 78 56 34 12  movdiri %rcx,0x12345678(%rax)
+  $ perf test -v "new " 2>&1 | grep -i movdir64b
+  Decoded ok: 66 0f 38 f8 18              movdir64b (%eax),%ebx
+  Decoded ok: 66 0f 38 f8 88 78 56 34 12  movdir64b 0x12345678(%eax),%ecx
+  Decoded ok: 67 66 0f 38 f8 1c           movdir64b (%si),%bx
+  Decoded ok: 67 66 0f 38 f8 8c 34 12     movdir64b 0x1234(%si),%cx
+  Decoded ok: 66 0f 38 f8 18              movdir64b (%rax),%rbx
+  Decoded ok: 66 0f 38 f8 88 78 56 34 12  movdir64b 0x12345678(%rax),%rcx
+  Decoded ok: 67 66 0f 38 f8 18           movdir64b (%eax),%ebx
+  Decoded ok: 67 66 0f 38 f8 88 78 56 34 12       movdir64b 0x12345678(%eax),%ecx
+  $ perf test -v "new " 2>&1 | grep -i enqcmd
+  Decoded ok: f2 0f 38 f8 18              enqcmd (%eax),%ebx
+  Decoded ok: f2 0f 38 f8 88 78 56 34 12  enqcmd 0x12345678(%eax),%ecx
+  Decoded ok: 67 f2 0f 38 f8 1c           enqcmd (%si),%bx
+  Decoded ok: 67 f2 0f 38 f8 8c 34 12     enqcmd 0x1234(%si),%cx
+  Decoded ok: f3 0f 38 f8 18              enqcmds (%eax),%ebx
+  Decoded ok: f3 0f 38 f8 88 78 56 34 12  enqcmds 0x12345678(%eax),%ecx
+  Decoded ok: 67 f3 0f 38 f8 1c           enqcmds (%si),%bx
+  Decoded ok: 67 f3 0f 38 f8 8c 34 12     enqcmds 0x1234(%si),%cx
+  Decoded ok: f2 0f 38 f8 18              enqcmd (%rax),%rbx
+  Decoded ok: f2 0f 38 f8 88 78 56 34 12  enqcmd 0x12345678(%rax),%rcx
+  Decoded ok: 67 f2 0f 38 f8 18           enqcmd (%eax),%ebx
+  Decoded ok: 67 f2 0f 38 f8 88 78 56 34 12       enqcmd 0x12345678(%eax),%ecx
+  Decoded ok: f3 0f 38 f8 18              enqcmds (%rax),%rbx
+  Decoded ok: f3 0f 38 f8 88 78 56 34 12  enqcmds 0x12345678(%rax),%rcx
+  Decoded ok: 67 f3 0f 38 f8 18           enqcmds (%eax),%ebx
+  Decoded ok: 67 f3 0f 38 f8 88 78 56 34 12       enqcmds 0x12345678(%eax),%ecx
+  $ perf test -v "new " 2>&1 | grep -i enqcmds
+  Decoded ok: f3 0f 38 f8 18              enqcmds (%eax),%ebx
+  Decoded ok: f3 0f 38 f8 88 78 56 34 12  enqcmds 0x12345678(%eax),%ecx
+  Decoded ok: 67 f3 0f 38 f8 1c           enqcmds (%si),%bx
+  Decoded ok: 67 f3 0f 38 f8 8c 34 12     enqcmds 0x1234(%si),%cx
+  Decoded ok: f3 0f 38 f8 18              enqcmds (%rax),%rbx
+  Decoded ok: f3 0f 38 f8 88 78 56 34 12  enqcmds 0x12345678(%rax),%rcx
+  Decoded ok: 67 f3 0f 38 f8 18           enqcmds (%eax),%ebx
+  Decoded ok: 67 f3 0f 38 f8 88 78 56 34 12       enqcmds 0x12345678(%eax),%ecx
+  $ perf test -v "new " 2>&1 | grep -i encls
+  Decoded ok: 0f 01 cf                    encls
+  Decoded ok: 0f 01 cf                    encls
+  $ perf test -v "new " 2>&1 | grep -i enclu
+  Decoded ok: 0f 01 d7                    enclu
+  Decoded ok: 0f 01 d7                    enclu
+  $ perf test -v "new " 2>&1 | grep -i enclv
+  Decoded ok: 0f 01 c0                    enclv
+  Decoded ok: 0f 01 c0                    enclv
+  $ perf test -v "new " 2>&1 | grep -i pconfig
+  Decoded ok: 0f 01 c5                    pconfig
+  Decoded ok: 0f 01 c5                    pconfig
+  $ perf test -v "new " 2>&1 | grep -i wbnoinvd
+  Decoded ok: f3 0f 09                    wbnoinvd
+  Decoded ok: f3 0f 09                    wbnoinvd
+
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Reviewed-by: Andi Kleen <ak@linux.intel.com>
+Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: H. Peter Anvin <hpa@zytor.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: x86@kernel.org
+Link: http://lore.kernel.org/lkml/20191115135447.6519-3-adrian.hunter@intel.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/lib/x86-opcode-map.txt       | 18 ++++++++++++------
+ tools/arch/x86/lib/x86-opcode-map.txt | 18 ++++++++++++------
+ 2 files changed, 24 insertions(+), 12 deletions(-)
+
+diff --git a/arch/x86/lib/x86-opcode-map.txt b/arch/x86/lib/x86-opcode-map.txt
+index e0b85930dd77..0a0e9112f284 100644
+--- a/arch/x86/lib/x86-opcode-map.txt
++++ b/arch/x86/lib/x86-opcode-map.txt
+@@ -333,7 +333,7 @@ AVXcode: 1
+ 06: CLTS
+ 07: SYSRET (o64)
+ 08: INVD
+-09: WBINVD
++09: WBINVD | WBNOINVD (F3)
+ 0a:
+ 0b: UD2 (1B)
+ 0c:
+@@ -364,7 +364,7 @@ AVXcode: 1
+ # a ModR/M byte.
+ 1a: BNDCL Gv,Ev (F3) | BNDCU Gv,Ev (F2) | BNDMOV Gv,Ev (66) | BNDLDX Gv,Ev
+ 1b: BNDCN Gv,Ev (F2) | BNDMOV Ev,Gv (66) | BNDMK Gv,Ev (F3) | BNDSTX Ev,Gv
+-1c:
++1c: Grp20 (1A),(1C)
+ 1d:
+ 1e:
+ 1f: NOP Ev
+@@ -792,6 +792,8 @@ f3: Grp17 (1A)
+ f5: BZHI Gy,Ey,By (v) | PEXT Gy,By,Ey (F3),(v) | PDEP Gy,By,Ey (F2),(v)
+ f6: ADCX Gy,Ey (66) | ADOX Gy,Ey (F3) | MULX By,Gy,rDX,Ey (F2),(v)
+ f7: BEXTR Gy,Ey,By (v) | SHLX Gy,Ey,By (66),(v) | SARX Gy,Ey,By (F3),(v) | SHRX Gy,Ey,By (F2),(v)
++f8: MOVDIR64B Gv,Mdqq (66) | ENQCMD Gv,Mdqq (F2) | ENQCMDS Gv,Mdqq (F3)
++f9: MOVDIRI My,Gy
+ EndTable
+ 
+ Table: 3-byte opcode 2 (0x0f 0x3a)
+@@ -943,9 +945,9 @@ GrpTable: Grp6
+ EndTable
+ 
+ GrpTable: Grp7
+-0: SGDT Ms | VMCALL (001),(11B) | VMLAUNCH (010),(11B) | VMRESUME (011),(11B) | VMXOFF (100),(11B)
+-1: SIDT Ms | MONITOR (000),(11B) | MWAIT (001),(11B) | CLAC (010),(11B) | STAC (011),(11B)
+-2: LGDT Ms | XGETBV (000),(11B) | XSETBV (001),(11B) | VMFUNC (100),(11B) | XEND (101)(11B) | XTEST (110)(11B)
++0: SGDT Ms | VMCALL (001),(11B) | VMLAUNCH (010),(11B) | VMRESUME (011),(11B) | VMXOFF (100),(11B) | PCONFIG (101),(11B) | ENCLV (000),(11B)
++1: SIDT Ms | MONITOR (000),(11B) | MWAIT (001),(11B) | CLAC (010),(11B) | STAC (011),(11B) | ENCLS (111),(11B)
++2: LGDT Ms | XGETBV (000),(11B) | XSETBV (001),(11B) | VMFUNC (100),(11B) | XEND (101)(11B) | XTEST (110)(11B) | ENCLU (111),(11B)
+ 3: LIDT Ms
+ 4: SMSW Mw/Rv
+ 5: rdpkru (110),(11B) | wrpkru (111),(11B)
+@@ -1020,7 +1022,7 @@ GrpTable: Grp15
+ 3: vstmxcsr Md (v1) | WRGSBASE Ry (F3),(11B)
+ 4: XSAVE | ptwrite Ey (F3),(11B)
+ 5: XRSTOR | lfence (11B)
+-6: XSAVEOPT | clwb (66) | mfence (11B)
++6: XSAVEOPT | clwb (66) | mfence (11B) | TPAUSE Rd (66),(11B) | UMONITOR Rv (F3),(11B) | UMWAIT Rd (F2),(11B)
+ 7: clflush | clflushopt (66) | sfence (11B)
+ EndTable
+ 
+@@ -1051,6 +1053,10 @@ GrpTable: Grp19
+ 6: vscatterpf1qps/d Wx (66),(ev)
+ EndTable
+ 
++GrpTable: Grp20
++0: cldemote Mb
++EndTable
++
+ # AMD's Prefetch Group
+ GrpTable: GrpP
+ 0: PREFETCH
+diff --git a/tools/arch/x86/lib/x86-opcode-map.txt b/tools/arch/x86/lib/x86-opcode-map.txt
+index e0b85930dd77..0a0e9112f284 100644
+--- a/tools/arch/x86/lib/x86-opcode-map.txt
++++ b/tools/arch/x86/lib/x86-opcode-map.txt
+@@ -333,7 +333,7 @@ AVXcode: 1
+ 06: CLTS
+ 07: SYSRET (o64)
+ 08: INVD
+-09: WBINVD
++09: WBINVD | WBNOINVD (F3)
+ 0a:
+ 0b: UD2 (1B)
+ 0c:
+@@ -364,7 +364,7 @@ AVXcode: 1
+ # a ModR/M byte.
+ 1a: BNDCL Gv,Ev (F3) | BNDCU Gv,Ev (F2) | BNDMOV Gv,Ev (66) | BNDLDX Gv,Ev
+ 1b: BNDCN Gv,Ev (F2) | BNDMOV Ev,Gv (66) | BNDMK Gv,Ev (F3) | BNDSTX Ev,Gv
+-1c:
++1c: Grp20 (1A),(1C)
+ 1d:
+ 1e:
+ 1f: NOP Ev
+@@ -792,6 +792,8 @@ f3: Grp17 (1A)
+ f5: BZHI Gy,Ey,By (v) | PEXT Gy,By,Ey (F3),(v) | PDEP Gy,By,Ey (F2),(v)
+ f6: ADCX Gy,Ey (66) | ADOX Gy,Ey (F3) | MULX By,Gy,rDX,Ey (F2),(v)
+ f7: BEXTR Gy,Ey,By (v) | SHLX Gy,Ey,By (66),(v) | SARX Gy,Ey,By (F3),(v) | SHRX Gy,Ey,By (F2),(v)
++f8: MOVDIR64B Gv,Mdqq (66) | ENQCMD Gv,Mdqq (F2) | ENQCMDS Gv,Mdqq (F3)
++f9: MOVDIRI My,Gy
+ EndTable
+ 
+ Table: 3-byte opcode 2 (0x0f 0x3a)
+@@ -943,9 +945,9 @@ GrpTable: Grp6
+ EndTable
+ 
+ GrpTable: Grp7
+-0: SGDT Ms | VMCALL (001),(11B) | VMLAUNCH (010),(11B) | VMRESUME (011),(11B) | VMXOFF (100),(11B)
+-1: SIDT Ms | MONITOR (000),(11B) | MWAIT (001),(11B) | CLAC (010),(11B) | STAC (011),(11B)
+-2: LGDT Ms | XGETBV (000),(11B) | XSETBV (001),(11B) | VMFUNC (100),(11B) | XEND (101)(11B) | XTEST (110)(11B)
++0: SGDT Ms | VMCALL (001),(11B) | VMLAUNCH (010),(11B) | VMRESUME (011),(11B) | VMXOFF (100),(11B) | PCONFIG (101),(11B) | ENCLV (000),(11B)
++1: SIDT Ms | MONITOR (000),(11B) | MWAIT (001),(11B) | CLAC (010),(11B) | STAC (011),(11B) | ENCLS (111),(11B)
++2: LGDT Ms | XGETBV (000),(11B) | XSETBV (001),(11B) | VMFUNC (100),(11B) | XEND (101)(11B) | XTEST (110)(11B) | ENCLU (111),(11B)
+ 3: LIDT Ms
+ 4: SMSW Mw/Rv
+ 5: rdpkru (110),(11B) | wrpkru (111),(11B)
+@@ -1020,7 +1022,7 @@ GrpTable: Grp15
+ 3: vstmxcsr Md (v1) | WRGSBASE Ry (F3),(11B)
+ 4: XSAVE | ptwrite Ey (F3),(11B)
+ 5: XRSTOR | lfence (11B)
+-6: XSAVEOPT | clwb (66) | mfence (11B)
++6: XSAVEOPT | clwb (66) | mfence (11B) | TPAUSE Rd (66),(11B) | UMONITOR Rv (F3),(11B) | UMWAIT Rd (F2),(11B)
+ 7: clflush | clflushopt (66) | sfence (11B)
+ EndTable
+ 
+@@ -1051,6 +1053,10 @@ GrpTable: Grp19
+ 6: vscatterpf1qps/d Wx (66),(ev)
+ EndTable
+ 
++GrpTable: Grp20
++0: cldemote Mb
++EndTable
++
+ # AMD's Prefetch Group
+ GrpTable: GrpP
+ 0: PREFETCH
+-- 
+2.20.1
+
diff --git a/queue-5.4/x86-ioapic-prevent-inconsistent-state-when-moving-an.patch b/queue-5.4/x86-ioapic-prevent-inconsistent-state-when-moving-an.patch
new file mode 100644
index 00000000000..a3d67ab05a7
--- /dev/null
+++ b/queue-5.4/x86-ioapic-prevent-inconsistent-state-when-moving-an.patch
@@ -0,0 +1,81 @@
+From 3d5b1cc4a5c872d5e8ed0ce50db38979880ea26c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Oct 2019 12:19:01 +0200
+Subject: x86/ioapic: Prevent inconsistent state when moving an interrupt
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+[ Upstream commit df4393424af3fbdcd5c404077176082a8ce459c4 ]
+
+There is an issue with threaded interrupts which are marked ONESHOT
+and using the fasteoi handler:
+
+  if (IS_ONESHOT())
+    mask_irq();
+  ....
+  cond_unmask_eoi_irq()
+    chip->irq_eoi();
+      if (setaffinity_pending) {
+         mask_ioapic();
+         ...
+	 move_affinity();
+	 unmask_ioapic();
+      }
+
+So if setaffinity is pending the interrupt will be moved and then
+unconditionally unmasked at the ioapic level, which is wrong in two
+aspects:
+
+ 1) It should be kept masked up to the point where the threaded handler
+    finished.
+
+ 2) The physical chip state and the software masked state are inconsistent
+
+Guard both the mask and the unmask with a check for the software masked
+state. If the line is marked masked then the ioapic line is also masked, so
+both mask_ioapic() and unmask_ioapic() can be skipped safely.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Andy Shevchenko <andy.shevchenko@gmail.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Sebastian Siewior <bigeasy@linutronix.de>
+Fixes: 3aa551c9b4c4 ("genirq: add threaded interrupt handler support")
+Link: https://lkml.kernel.org/r/20191017101938.321393687@linutronix.de
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/apic/io_apic.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
+index d6af97fd170a..f0262cb5657a 100644
+--- a/arch/x86/kernel/apic/io_apic.c
++++ b/arch/x86/kernel/apic/io_apic.c
+@@ -1727,9 +1727,10 @@ static bool io_apic_level_ack_pending(struct mp_chip_data *data)
+ 
+ static inline bool ioapic_irqd_mask(struct irq_data *data)
+ {
+-	/* If we are moving the irq we need to mask it */
++	/* If we are moving the IRQ we need to mask it */
+ 	if (unlikely(irqd_is_setaffinity_pending(data))) {
+-		mask_ioapic_irq(data);
++		if (!irqd_irq_masked(data))
++			mask_ioapic_irq(data);
+ 		return true;
+ 	}
+ 	return false;
+@@ -1766,7 +1767,9 @@ static inline void ioapic_irqd_unmask(struct irq_data *data, bool masked)
+ 		 */
+ 		if (!io_apic_level_ack_pending(data->chip_data))
+ 			irq_move_masked_irq(data);
+-		unmask_ioapic_irq(data);
++		/* If the IRQ is masked in the core, leave it: */
++		if (!irqd_irq_masked(data))
++			unmask_ioapic_irq(data);
+ 	}
+ }
+ #else
+-- 
+2.20.1
+
diff --git a/queue-5.4/x86-math-emu-check-__copy_from_user-result.patch b/queue-5.4/x86-math-emu-check-__copy_from_user-result.patch
new file mode 100644
index 00000000000..218eb75c0ed
--- /dev/null
+++ b/queue-5.4/x86-math-emu-check-__copy_from_user-result.patch
@@ -0,0 +1,107 @@
+From c72b437b45a244320c3d7ffa28f56ff7c2d9fac1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Oct 2019 16:23:34 +0200
+Subject: x86/math-emu: Check __copy_from_user() result
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit e6b44ce1925a8329a937c57f0d60ba0d9bb5d226 ]
+
+The new __must_check annotation on __copy_from_user() successfully
+identified some code that has lacked the check since at least
+linux-2.1.73:
+
+  arch/x86/math-emu/reg_ld_str.c:88:2: error: ignoring return value of \
+  function declared with 'warn_unused_result' attribute [-Werror,-Wunused-result]
+          __copy_from_user(sti_ptr, s, 10);
+          ^~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~
+  arch/x86/math-emu/reg_ld_str.c:1129:2: error: ignoring return value of \
+  function declared with 'warn_unused_result' attribute [-Werror,-Wunused-result]
+          __copy_from_user(register_base + offset, s, other);
+          ^~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+  arch/x86/math-emu/reg_ld_str.c:1131:3: error: ignoring return value of \
+  function declared with 'warn_unused_result' attribute [-Werror,-Wunused-result]
+                  __copy_from_user(register_base, s + other, offset);
+                ^~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+In addition, the get_user()/put_user() helpers do not enforce a return
+value check, but actually still require one. These have been missing for
+even longer.
+
+Change the internal wrappers around get_user()/put_user() to force
+a signal and add a corresponding wrapper around __copy_from_user()
+to check all such cases.
+
+ [ bp: Break long lines. ]
+
+Fixes: 257e458057e5 ("Import 2.1.73")
+Fixes: 9dd819a15162 ("uaccess: add missing __must_check attributes")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Bill Metzenthen <billm@melbpc.org.au>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: x86-ml <x86@kernel.org>
+Link: https://lkml.kernel.org/r/20191001142344.1274185-1-arnd@arndb.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/math-emu/fpu_system.h | 6 ++++--
+ arch/x86/math-emu/reg_ld_str.c | 6 +++---
+ 2 files changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/arch/x86/math-emu/fpu_system.h b/arch/x86/math-emu/fpu_system.h
+index f98a0c956764..9b41391867dc 100644
+--- a/arch/x86/math-emu/fpu_system.h
++++ b/arch/x86/math-emu/fpu_system.h
+@@ -107,6 +107,8 @@ static inline bool seg_writable(struct desc_struct *d)
+ #define FPU_access_ok(y,z)	if ( !access_ok(y,z) ) \
+ 				math_abort(FPU_info,SIGSEGV)
+ #define FPU_abort		math_abort(FPU_info, SIGSEGV)
++#define FPU_copy_from_user(to, from, n)	\
++		do { if (copy_from_user(to, from, n)) FPU_abort; } while (0)
+ 
+ #undef FPU_IGNORE_CODE_SEGV
+ #ifdef FPU_IGNORE_CODE_SEGV
+@@ -122,7 +124,7 @@ static inline bool seg_writable(struct desc_struct *d)
+ #define	FPU_code_access_ok(z) FPU_access_ok((void __user *)FPU_EIP,z)
+ #endif
+ 
+-#define FPU_get_user(x,y)       get_user((x),(y))
+-#define FPU_put_user(x,y)       put_user((x),(y))
++#define FPU_get_user(x,y) do { if (get_user((x),(y))) FPU_abort; } while (0)
++#define FPU_put_user(x,y) do { if (put_user((x),(y))) FPU_abort; } while (0)
+ 
+ #endif
+diff --git a/arch/x86/math-emu/reg_ld_str.c b/arch/x86/math-emu/reg_ld_str.c
+index f3779743d15e..fe6246ff9887 100644
+--- a/arch/x86/math-emu/reg_ld_str.c
++++ b/arch/x86/math-emu/reg_ld_str.c
+@@ -85,7 +85,7 @@ int FPU_load_extended(long double __user *s, int stnr)
+ 
+ 	RE_ENTRANT_CHECK_OFF;
+ 	FPU_access_ok(s, 10);
+-	__copy_from_user(sti_ptr, s, 10);
++	FPU_copy_from_user(sti_ptr, s, 10);
+ 	RE_ENTRANT_CHECK_ON;
+ 
+ 	return FPU_tagof(sti_ptr);
+@@ -1126,9 +1126,9 @@ void frstor(fpu_addr_modes addr_modes, u_char __user *data_address)
+ 	/* Copy all registers in stack order. */
+ 	RE_ENTRANT_CHECK_OFF;
+ 	FPU_access_ok(s, 80);
+-	__copy_from_user(register_base + offset, s, other);
++	FPU_copy_from_user(register_base + offset, s, other);
+ 	if (offset)
+-		__copy_from_user(register_base, s + other, offset);
++		FPU_copy_from_user(register_base, s + other, offset);
+ 	RE_ENTRANT_CHECK_ON;
+ 
+ 	for (i = 0; i < 8; i++) {
+-- 
+2.20.1
+
diff --git a/queue-5.4/x86-mce-lower-throttling-mce-messages-priority-to-wa.patch b/queue-5.4/x86-mce-lower-throttling-mce-messages-priority-to-wa.patch
new file mode 100644
index 00000000000..17601d7c915
--- /dev/null
+++ b/queue-5.4/x86-mce-lower-throttling-mce-messages-priority-to-wa.patch
@@ -0,0 +1,67 @@
+From 83cada2566d09337fca1517ef7af74e5cbc1985a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2019 17:54:24 +0200
+Subject: x86/mce: Lower throttling MCE messages' priority to warning
+
+From: Benjamin Berg <bberg@redhat.com>
+
+[ Upstream commit 9c3bafaa1fd88e4dd2dba3735a1f1abb0f2c7bb7 ]
+
+On modern CPUs it is quite normal that the temperature limits are
+reached and the CPU is throttled. In fact, often the thermal design is
+not sufficient to cool the CPU at full load and limits can quickly be
+reached when a burst in load happens. This will even happen with
+technologies like RAPL limitting the long term power consumption of
+the package.
+
+Also, these limits are "softer", as Srinivas explains:
+
+"CPU temperature doesn't have to hit max(TjMax) to get these warnings.
+OEMs ha[ve] an ability to program a threshold where a thermal interrupt
+can be generated. In some systems the offset is 20C+ (Read only value).
+
+In recent systems, there is another offset on top of it which can be
+programmed by OS, once some agent can adjust power limits dynamically.
+By default this is set to low by the firmware, which I guess the
+prime motivation of Benjamin to submit the patch."
+
+So these messages do not usually indicate a hardware issue (e.g.
+insufficient cooling). Log them as warnings to avoid confusion about
+their severity.
+
+ [ bp: Massage commit mesage. ]
+
+Signed-off-by: Benjamin Berg <bberg@redhat.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Tested-by: Christian Kellner <ckellner@redhat.com>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: linux-edac <linux-edac@vger.kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Tony Luck <tony.luck@intel.com>
+Cc: x86-ml <x86@kernel.org>
+Link: https://lkml.kernel.org/r/20191009155424.249277-1-bberg@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/cpu/mce/therm_throt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/kernel/cpu/mce/therm_throt.c b/arch/x86/kernel/cpu/mce/therm_throt.c
+index 6e2becf547c5..bc441d68d060 100644
+--- a/arch/x86/kernel/cpu/mce/therm_throt.c
++++ b/arch/x86/kernel/cpu/mce/therm_throt.c
+@@ -188,7 +188,7 @@ static void therm_throt_process(bool new_event, int event, int level)
+ 	/* if we just entered the thermal event */
+ 	if (new_event) {
+ 		if (event == THERMAL_THROTTLING_EVENT)
+-			pr_crit("CPU%d: %s temperature above threshold, cpu clock throttled (total events = %lu)\n",
++			pr_warn("CPU%d: %s temperature above threshold, cpu clock throttled (total events = %lu)\n",
+ 				this_cpu,
+ 				level == CORE_LEVEL ? "Core" : "Package",
+ 				state->count);
+-- 
+2.20.1
+
diff --git a/queue-5.4/x86-mm-use-the-correct-function-type-for-native_set_.patch b/queue-5.4/x86-mm-use-the-correct-function-type-for-native_set_.patch
new file mode 100644
index 00000000000..29c7499428f
--- /dev/null
+++ b/queue-5.4/x86-mm-use-the-correct-function-type-for-native_set_.patch
@@ -0,0 +1,65 @@
+From b36aeb710e3d9c211ba8e08109628f7630bee15e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Sep 2019 14:14:02 -0700
+Subject: x86/mm: Use the correct function type for native_set_fixmap()
+
+From: Sami Tolvanen <samitolvanen@google.com>
+
+[ Upstream commit f53e2cd0b8ab7d9e390414470bdbd830f660133f ]
+
+We call native_set_fixmap indirectly through the function pointer
+struct pv_mmu_ops::set_fixmap, which expects the first parameter to be
+'unsigned' instead of 'enum fixed_addresses'. This patch changes the
+function type for native_set_fixmap to match the pointer, which fixes
+indirect call mismatches with Control-Flow Integrity (CFI) checking.
+
+Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Dave Hansen <dave.hansen@linux.intel.com>
+Cc: H . Peter Anvin <hpa@zytor.com>
+Cc: H. Peter Anvin <hpa@zytor.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Rik van Riel <riel@surriel.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lkml.kernel.org/r/20190913211402.193018-1-samitolvanen@google.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/fixmap.h | 2 +-
+ arch/x86/mm/pgtable.c         | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/include/asm/fixmap.h b/arch/x86/include/asm/fixmap.h
+index 0c47aa82e2e2..28183ee3cc42 100644
+--- a/arch/x86/include/asm/fixmap.h
++++ b/arch/x86/include/asm/fixmap.h
+@@ -156,7 +156,7 @@ extern pte_t *kmap_pte;
+ extern pte_t *pkmap_page_table;
+ 
+ void __native_set_fixmap(enum fixed_addresses idx, pte_t pte);
+-void native_set_fixmap(enum fixed_addresses idx,
++void native_set_fixmap(unsigned /* enum fixed_addresses */ idx,
+ 		       phys_addr_t phys, pgprot_t flags);
+ 
+ #ifndef CONFIG_PARAVIRT_XXL
+diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
+index 3e4b9035bb9a..7bd2c3a52297 100644
+--- a/arch/x86/mm/pgtable.c
++++ b/arch/x86/mm/pgtable.c
+@@ -643,8 +643,8 @@ void __native_set_fixmap(enum fixed_addresses idx, pte_t pte)
+ 	fixmaps_set++;
+ }
+ 
+-void native_set_fixmap(enum fixed_addresses idx, phys_addr_t phys,
+-		       pgprot_t flags)
++void native_set_fixmap(unsigned /* enum fixed_addresses */ idx,
++		       phys_addr_t phys, pgprot_t flags)
+ {
+ 	/* Sanitize 'prot' against any unsupported bits: */
+ 	pgprot_val(flags) &= __default_kernel_pte_mask;
+-- 
+2.20.1
+
diff --git a/queue-5.4/xen-gntdev-use-select-for-dma_shared_buffer.patch b/queue-5.4/xen-gntdev-use-select-for-dma_shared_buffer.patch
new file mode 100644
index 00000000000..9cf9d17317a
--- /dev/null
+++ b/queue-5.4/xen-gntdev-use-select-for-dma_shared_buffer.patch
@@ -0,0 +1,48 @@
+From d7eab726449ae7ae230fbeecd50b92ff4dacea29 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Oct 2019 17:10:25 -0300
+Subject: xen/gntdev: Use select for DMA_SHARED_BUFFER
+
+From: Jason Gunthorpe <jgg@mellanox.com>
+
+[ Upstream commit fa6614d8ef13c63aac52ad7c07c5e69ce4aba3dd ]
+
+DMA_SHARED_BUFFER can not be enabled by the user (it represents a library
+set in the kernel). The kconfig convention is to use select for such
+symbols so they are turned on implicitly when the user enables a kconfig
+that needs them.
+
+Otherwise the XEN_GNTDEV_DMABUF kconfig is overly difficult to enable.
+
+Fixes: 932d6562179e ("xen/gntdev: Add initial support for dma-buf UAPI")
+Cc: Oleksandr Andrushchenko <oleksandr_andrushchenko@epam.com>
+Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Cc: xen-devel@lists.xenproject.org
+Cc: Juergen Gross <jgross@suse.com>
+Cc: Stefano Stabellini <sstabellini@kernel.org>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Reviewed-by: Oleksandr Andrushchenko <oleksandr_andrushchenko@epam.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/Kconfig | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/xen/Kconfig b/drivers/xen/Kconfig
+index 79cc75096f42..a50dadd01093 100644
+--- a/drivers/xen/Kconfig
++++ b/drivers/xen/Kconfig
+@@ -141,7 +141,8 @@ config XEN_GNTDEV
+ 
+ config XEN_GNTDEV_DMABUF
+ 	bool "Add support for dma-buf grant access device driver extension"
+-	depends on XEN_GNTDEV && XEN_GRANT_DMA_ALLOC && DMA_SHARED_BUFFER
++	depends on XEN_GNTDEV && XEN_GRANT_DMA_ALLOC
++	select DMA_SHARED_BUFFER
+ 	help
+ 	  Allows userspace processes and kernel modules to use Xen backed
+ 	  dma-buf implementation. With this extension grant references to
+-- 
+2.20.1
+
diff --git a/queue-5.4/xhci-pci-allow-host-runtime-pm-as-default-also-for-i.patch b/queue-5.4/xhci-pci-allow-host-runtime-pm-as-default-also-for-i.patch
new file mode 100644
index 00000000000..c2364fb0389
--- /dev/null
+++ b/queue-5.4/xhci-pci-allow-host-runtime-pm-as-default-also-for-i.patch
@@ -0,0 +1,53 @@
+From f9e1a340473ae7c9eb560aa3c970c05c3ed6e3ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Nov 2019 18:50:03 +0200
+Subject: xhci-pci: Allow host runtime PM as default also for Intel Ice Lake
+ xHCI
+
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+
+[ Upstream commit 07a594f353655b1628f598add352e7e754f44869 ]
+
+Intel Ice Lake has two xHCI controllers one on PCH and the other as part
+of the CPU itself. The latter is also part of the so called Type C
+Subsystem (TCSS) sharing ACPI power resources with the PCIe root ports
+and the Thunderbolt controllers. In order to put the whole TCSS block
+into D3cold the xHCI needs to be runtime suspended as well when idle.
+
+For this reason allow runtime PM as default for Ice Lake TCSS xHCI
+controller.
+
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/1573836603-10871-5-git-send-email-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-pci.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 1904ef56f61c..2907fe4d78dd 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -48,6 +48,7 @@
+ #define PCI_DEVICE_ID_INTEL_TITAN_RIDGE_2C_XHCI		0x15e9
+ #define PCI_DEVICE_ID_INTEL_TITAN_RIDGE_4C_XHCI		0x15ec
+ #define PCI_DEVICE_ID_INTEL_TITAN_RIDGE_DD_XHCI		0x15f0
++#define PCI_DEVICE_ID_INTEL_ICE_LAKE_XHCI		0x8a13
+ 
+ #define PCI_DEVICE_ID_AMD_PROMONTORYA_4			0x43b9
+ #define PCI_DEVICE_ID_AMD_PROMONTORYA_3			0x43ba
+@@ -212,7 +213,8 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ 	     pdev->device == PCI_DEVICE_ID_INTEL_ALPINE_RIDGE_C_4C_XHCI ||
+ 	     pdev->device == PCI_DEVICE_ID_INTEL_TITAN_RIDGE_2C_XHCI ||
+ 	     pdev->device == PCI_DEVICE_ID_INTEL_TITAN_RIDGE_4C_XHCI ||
+-	     pdev->device == PCI_DEVICE_ID_INTEL_TITAN_RIDGE_DD_XHCI))
++	     pdev->device == PCI_DEVICE_ID_INTEL_TITAN_RIDGE_DD_XHCI ||
++	     pdev->device == PCI_DEVICE_ID_INTEL_ICE_LAKE_XHCI))
+ 		xhci->quirks |= XHCI_DEFAULT_PM_RUNTIME_ALLOW;
+ 
+ 	if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
+-- 
+2.20.1
+
-- 
2.47.3