diff -druNp --no-dereference linux-libre-5.6.13-gnu/arch/arm/boot/dts/dra7.dtsi linux-libre-5.6.14-gnu/arch/arm/boot/dts/dra7.dtsi
--- linux-libre-5.6.13-gnu/arch/arm/boot/dts/dra7.dtsi	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/arch/arm/boot/dts/dra7.dtsi	2020-05-20 02:22:38.000000000 -0400
@@ -172,6 +172,7 @@
 			#address-cells = <1>;
 			ranges = <0x51000000 0x51000000 0x3000
 				  0x0	     0x20000000 0x10000000>;
+			dma-ranges;
 			/**
 			 * To enable PCI endpoint mode, disable the pcie1_rc
 			 * node and enable pcie1_ep mode.
@@ -185,7 +186,6 @@
 				device_type = "pci";
 				ranges = <0x81000000 0 0          0x03000 0 0x00010000
 					  0x82000000 0 0x20013000 0x13000 0 0xffed000>;
-				dma-ranges = <0x02000000 0x0 0x00000000 0x00000000 0x1 0x00000000>;
 				bus-range = <0x00 0xff>;
 				#interrupt-cells = <1>;
 				num-lanes = <1>;
@@ -230,6 +230,7 @@
 			#address-cells = <1>;
 			ranges = <0x51800000 0x51800000 0x3000
 				  0x0	     0x30000000 0x10000000>;
+			dma-ranges;
 			status = "disabled";
 			pcie2_rc: pcie@51800000 {
 				reg = <0x51800000 0x2000>, <0x51802000 0x14c>, <0x1000 0x2000>;
@@ -240,7 +241,6 @@
 				device_type = "pci";
 				ranges = <0x81000000 0 0          0x03000 0 0x00010000
 					  0x82000000 0 0x30013000 0x13000 0 0xffed000>;
-				dma-ranges = <0x02000000 0x0 0x00000000 0x00000000 0x1 0x00000000>;
 				bus-range = <0x00 0xff>;
 				#interrupt-cells = <1>;
 				num-lanes = <1>;
diff -druNp --no-dereference linux-libre-5.6.13-gnu/arch/arm/boot/dts/imx27-phytec-phycard-s-rdk.dts linux-libre-5.6.14-gnu/arch/arm/boot/dts/imx27-phytec-phycard-s-rdk.dts
--- linux-libre-5.6.13-gnu/arch/arm/boot/dts/imx27-phytec-phycard-s-rdk.dts	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/arch/arm/boot/dts/imx27-phytec-phycard-s-rdk.dts	2020-05-20 02:22:38.000000000 -0400
@@ -75,8 +75,8 @@
 	imx27-phycard-s-rdk {
 		pinctrl_i2c1: i2c1grp {
 			fsl,pins = <
-				MX27_PAD_I2C2_SDA__I2C2_SDA 0x0
-				MX27_PAD_I2C2_SCL__I2C2_SCL 0x0
+				MX27_PAD_I2C_DATA__I2C_DATA 0x0
+				MX27_PAD_I2C_CLK__I2C_CLK 0x0
 			>;
 		};
 
diff -druNp --no-dereference linux-libre-5.6.13-gnu/arch/arm/boot/dts/imx6dl-yapp4-ursa.dts linux-libre-5.6.14-gnu/arch/arm/boot/dts/imx6dl-yapp4-ursa.dts
--- linux-libre-5.6.13-gnu/arch/arm/boot/dts/imx6dl-yapp4-ursa.dts	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/arch/arm/boot/dts/imx6dl-yapp4-ursa.dts	2020-05-20 02:22:38.000000000 -0400
@@ -38,7 +38,7 @@
 };
 
 &switch_ports {
-	/delete-node/ port@2;
+	/delete-node/ port@3;
 };
 
 &touchscreen {
diff -druNp --no-dereference linux-libre-5.6.13-gnu/arch/arm/boot/dts/r8a73a4.dtsi linux-libre-5.6.14-gnu/arch/arm/boot/dts/r8a73a4.dtsi
--- linux-libre-5.6.13-gnu/arch/arm/boot/dts/r8a73a4.dtsi	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/arch/arm/boot/dts/r8a73a4.dtsi	2020-05-20 02:22:38.000000000 -0400
@@ -131,7 +131,14 @@
 	cmt1: timer@e6130000 {
 		compatible = "renesas,r8a73a4-cmt1", "renesas,rcar-gen2-cmt1";
 		reg = <0 0xe6130000 0 0x1004>;
-		interrupts = <GIC_SPI 120 IRQ_TYPE_LEVEL_HIGH>;
+		interrupts = <GIC_SPI 120 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 122 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 123 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 124 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 125 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 126 IRQ_TYPE_LEVEL_HIGH>,
+			     <GIC_SPI 127 IRQ_TYPE_LEVEL_HIGH>;
 		clocks = <&mstp3_clks R8A73A4_CLK_CMT1>;
 		clock-names = "fck";
 		power-domains = <&pd_c5>;
diff -druNp --no-dereference linux-libre-5.6.13-gnu/arch/arm/boot/dts/r8a7740.dtsi linux-libre-5.6.14-gnu/arch/arm/boot/dts/r8a7740.dtsi
--- linux-libre-5.6.13-gnu/arch/arm/boot/dts/r8a7740.dtsi	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/arch/arm/boot/dts/r8a7740.dtsi	2020-05-20 02:22:38.000000000 -0400
@@ -479,7 +479,7 @@
 		cpg_clocks: cpg_clocks@e6150000 {
 			compatible = "renesas,r8a7740-cpg-clocks";
 			reg = <0xe6150000 0x10000>;
-			clocks = <&extal1_clk>, <&extalr_clk>;
+			clocks = <&extal1_clk>, <&extal2_clk>, <&extalr_clk>;
 			#clock-cells = <1>;
 			clock-output-names = "system", "pllc0", "pllc1",
 					     "pllc2", "r",
diff -druNp --no-dereference linux-libre-5.6.13-gnu/arch/arm64/boot/dts/amlogic/meson-g12b-khadas-vim3.dtsi linux-libre-5.6.14-gnu/arch/arm64/boot/dts/amlogic/meson-g12b-khadas-vim3.dtsi
--- linux-libre-5.6.13-gnu/arch/arm64/boot/dts/amlogic/meson-g12b-khadas-vim3.dtsi	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/arch/arm64/boot/dts/amlogic/meson-g12b-khadas-vim3.dtsi	2020-05-20 02:22:38.000000000 -0400
@@ -152,6 +152,10 @@
 	clock-latency = <50000>;
 };
 
+&frddr_a {
+	status = "okay";
+};
+
 &frddr_b {
 	status = "okay";
 };
diff -druNp --no-dereference linux-libre-5.6.13-gnu/arch/arm64/boot/dts/amlogic/meson-g12b-ugoos-am6.dts linux-libre-5.6.14-gnu/arch/arm64/boot/dts/amlogic/meson-g12b-ugoos-am6.dts
--- linux-libre-5.6.13-gnu/arch/arm64/boot/dts/amlogic/meson-g12b-ugoos-am6.dts	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/arch/arm64/boot/dts/amlogic/meson-g12b-ugoos-am6.dts	2020-05-20 02:22:38.000000000 -0400
@@ -545,7 +545,7 @@
 &usb {
 	status = "okay";
 	dr_mode = "host";
-	vbus-regulator = <&usb_pwr_en>;
+	vbus-supply = <&usb_pwr_en>;
 };
 
 &usb2_phy0 {
diff -druNp --no-dereference linux-libre-5.6.13-gnu/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi linux-libre-5.6.14-gnu/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi
--- linux-libre-5.6.13-gnu/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi	2020-05-20 02:22:38.000000000 -0400
@@ -2204,7 +2204,7 @@
 				reg = <0x0 0xff400000 0x0 0x40000>;
 				interrupts = <GIC_SPI 31 IRQ_TYPE_LEVEL_HIGH>;
 				clocks = <&clkc CLKID_USB1_DDR_BRIDGE>;
-				clock-names = "ddr";
+				clock-names = "otg";
 				phys = <&usb2_phy1>;
 				phy-names = "usb2-phy";
 				dr_mode = "peripheral";
diff -druNp --no-dereference linux-libre-5.6.13-gnu/arch/arm64/boot/dts/freescale/imx8mn.dtsi linux-libre-5.6.14-gnu/arch/arm64/boot/dts/freescale/imx8mn.dtsi
--- linux-libre-5.6.13-gnu/arch/arm64/boot/dts/freescale/imx8mn.dtsi	2020-05-14 02:42:17.000000000 -0400
+++ linux-libre-5.6.14-gnu/arch/arm64/boot/dts/freescale/imx8mn.dtsi	2020-05-20 05:05:23.000000000 -0400
@@ -661,7 +661,7 @@
 				reg = <0x30bd0000 0x10000>;
 				interrupts = <GIC_SPI 2 IRQ_TYPE_LEVEL_HIGH>;
 				clocks = <&clk IMX8MN_CLK_SDMA1_ROOT>,
-					 <&clk IMX8MN_CLK_SDMA1_ROOT>;
+					 <&clk IMX8MN_CLK_AHB>;
 				clock-names = "ipg", "ahb";
 				#dma-cells = <3>;
 				fsl,sdma-ram-script-name = "/*(DEBLOBBED)*/";
diff -druNp --no-dereference linux-libre-5.6.13-gnu/arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi linux-libre-5.6.14-gnu/arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi
--- linux-libre-5.6.13-gnu/arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi	2020-05-20 02:22:38.000000000 -0400
@@ -658,8 +658,8 @@
 	s11 {
 		qcom,saw-leader;
 		regulator-always-on;
-		regulator-min-microvolt = <1230000>;
-		regulator-max-microvolt = <1230000>;
+		regulator-min-microvolt = <980000>;
+		regulator-max-microvolt = <980000>;
 	};
 };
 
diff -druNp --no-dereference linux-libre-5.6.13-gnu/arch/arm64/boot/dts/renesas/r8a77980.dtsi linux-libre-5.6.14-gnu/arch/arm64/boot/dts/renesas/r8a77980.dtsi
--- linux-libre-5.6.13-gnu/arch/arm64/boot/dts/renesas/r8a77980.dtsi	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/arch/arm64/boot/dts/renesas/r8a77980.dtsi	2020-05-20 02:22:38.000000000 -0400
@@ -1318,6 +1318,7 @@
 		ipmmu_vip0: mmu@e7b00000 {
 			compatible = "renesas,ipmmu-r8a77980";
 			reg = <0 0xe7b00000 0 0x1000>;
+			renesas,ipmmu-main = <&ipmmu_mm 4>;
 			power-domains = <&sysc R8A77980_PD_ALWAYS_ON>;
 			#iommu-cells = <1>;
 		};
@@ -1325,6 +1326,7 @@
 		ipmmu_vip1: mmu@e7960000 {
 			compatible = "renesas,ipmmu-r8a77980";
 			reg = <0 0xe7960000 0 0x1000>;
+			renesas,ipmmu-main = <&ipmmu_mm 11>;
 			power-domains = <&sysc R8A77980_PD_ALWAYS_ON>;
 			#iommu-cells = <1>;
 		};
diff -druNp --no-dereference linux-libre-5.6.13-gnu/arch/arm64/boot/dts/rockchip/rk3328-evb.dts linux-libre-5.6.14-gnu/arch/arm64/boot/dts/rockchip/rk3328-evb.dts
--- linux-libre-5.6.13-gnu/arch/arm64/boot/dts/rockchip/rk3328-evb.dts	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/arch/arm64/boot/dts/rockchip/rk3328-evb.dts	2020-05-20 02:22:38.000000000 -0400
@@ -92,7 +92,7 @@
 &i2c1 {
 	status = "okay";
 
-	rk805: rk805@18 {
+	rk805: pmic@18 {
 		compatible = "rockchip,rk805";
 		reg = <0x18>;
 		interrupt-parent = <&gpio2>;
diff -druNp --no-dereference linux-libre-5.6.13-gnu/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts linux-libre-5.6.14-gnu/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts
--- linux-libre-5.6.13-gnu/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts	2020-05-20 02:22:38.000000000 -0400
@@ -169,7 +169,7 @@
 &i2c1 {
 	status = "okay";
 
-	rk805: rk805@18 {
+	rk805: pmic@18 {
 		compatible = "rockchip,rk805";
 		reg = <0x18>;
 		interrupt-parent = <&gpio2>;
diff -druNp --no-dereference linux-libre-5.6.13-gnu/arch/arm64/boot/dts/rockchip/rk3399.dtsi linux-libre-5.6.14-gnu/arch/arm64/boot/dts/rockchip/rk3399.dtsi
--- linux-libre-5.6.13-gnu/arch/arm64/boot/dts/rockchip/rk3399.dtsi	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/arch/arm64/boot/dts/rockchip/rk3399.dtsi	2020-05-20 02:22:38.000000000 -0400
@@ -410,7 +410,7 @@
 		reset-names = "usb3-otg";
 		status = "disabled";
 
-		usbdrd_dwc3_0: dwc3 {
+		usbdrd_dwc3_0: usb@fe800000 {
 			compatible = "snps,dwc3";
 			reg = <0x0 0xfe800000 0x0 0x100000>;
 			interrupts = <GIC_SPI 105 IRQ_TYPE_LEVEL_HIGH 0>;
@@ -446,7 +446,7 @@
 		reset-names = "usb3-otg";
 		status = "disabled";
 
-		usbdrd_dwc3_1: dwc3 {
+		usbdrd_dwc3_1: usb@fe900000 {
 			compatible = "snps,dwc3";
 			reg = <0x0 0xfe900000 0x0 0x100000>;
 			interrupts = <GIC_SPI 110 IRQ_TYPE_LEVEL_HIGH 0>;
diff -druNp --no-dereference linux-libre-5.6.13-gnu/arch/arm64/kernel/machine_kexec.c linux-libre-5.6.14-gnu/arch/arm64/kernel/machine_kexec.c
--- linux-libre-5.6.13-gnu/arch/arm64/kernel/machine_kexec.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/arch/arm64/kernel/machine_kexec.c	2020-05-20 02:22:38.000000000 -0400
@@ -177,6 +177,7 @@ void machine_kexec(struct kimage *kimage
 	 * the offline CPUs. Therefore, we must use the __* variant here.
 	 */
 	__flush_icache_range((uintptr_t)reboot_code_buffer,
+			     (uintptr_t)reboot_code_buffer +
 			     arm64_relocate_new_kernel_size);
 
 	/* Flush the kimage list and its buffers. */
diff -druNp --no-dereference linux-libre-5.6.13-gnu/arch/powerpc/include/asm/book3s/32/kup.h linux-libre-5.6.14-gnu/arch/powerpc/include/asm/book3s/32/kup.h
--- linux-libre-5.6.13-gnu/arch/powerpc/include/asm/book3s/32/kup.h	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/arch/powerpc/include/asm/book3s/32/kup.h	2020-05-20 02:22:38.000000000 -0400
@@ -75,7 +75,7 @@
 
 .macro kuap_check	current, gpr
 #ifdef CONFIG_PPC_KUAP_DEBUG
-	lwz	\gpr2, KUAP(thread)
+	lwz	\gpr, KUAP(thread)
 999:	twnei	\gpr, 0
 	EMIT_BUG_ENTRY 999b, __FILE__, __LINE__, (BUGFLAG_WARNING | BUGFLAG_ONCE)
 #endif
diff -druNp --no-dereference linux-libre-5.6.13-gnu/arch/powerpc/include/asm/uaccess.h linux-libre-5.6.14-gnu/arch/powerpc/include/asm/uaccess.h
--- linux-libre-5.6.13-gnu/arch/powerpc/include/asm/uaccess.h	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/arch/powerpc/include/asm/uaccess.h	2020-05-20 02:22:38.000000000 -0400
@@ -166,13 +166,17 @@ do {								\
 ({								\
 	long __pu_err;						\
 	__typeof__(*(ptr)) __user *__pu_addr = (ptr);		\
+	__typeof__(*(ptr)) __pu_val = (x);			\
+	__typeof__(size) __pu_size = (size);			\
+								\
 	if (!is_kernel_addr((unsigned long)__pu_addr))		\
 		might_fault();					\
-	__chk_user_ptr(ptr);					\
+	__chk_user_ptr(__pu_addr);				\
 	if (do_allow)								\
-		__put_user_size((x), __pu_addr, (size), __pu_err);		\
+		__put_user_size(__pu_val, __pu_addr, __pu_size, __pu_err);	\
 	else									\
-		__put_user_size_allowed((x), __pu_addr, (size), __pu_err);	\
+		__put_user_size_allowed(__pu_val, __pu_addr, __pu_size, __pu_err); \
+								\
 	__pu_err;						\
 })
 
@@ -180,9 +184,13 @@ do {								\
 ({									\
 	long __pu_err = -EFAULT;					\
 	__typeof__(*(ptr)) __user *__pu_addr = (ptr);			\
+	__typeof__(*(ptr)) __pu_val = (x);				\
+	__typeof__(size) __pu_size = (size);				\
+									\
 	might_fault();							\
-	if (access_ok(__pu_addr, size))			\
-		__put_user_size((x), __pu_addr, (size), __pu_err);	\
+	if (access_ok(__pu_addr, __pu_size))				\
+		__put_user_size(__pu_val, __pu_addr, __pu_size, __pu_err); \
+									\
 	__pu_err;							\
 })
 
@@ -190,8 +198,12 @@ do {								\
 ({								\
 	long __pu_err;						\
 	__typeof__(*(ptr)) __user *__pu_addr = (ptr);		\
-	__chk_user_ptr(ptr);					\
-	__put_user_size((x), __pu_addr, (size), __pu_err);	\
+	__typeof__(*(ptr)) __pu_val = (x);			\
+	__typeof__(size) __pu_size = (size);			\
+								\
+	__chk_user_ptr(__pu_addr);				\
+	__put_user_size(__pu_val, __pu_addr, __pu_size, __pu_err); \
+								\
 	__pu_err;						\
 })
 
@@ -283,15 +295,18 @@ do {								\
 	long __gu_err;						\
 	__long_type(*(ptr)) __gu_val;				\
 	__typeof__(*(ptr)) __user *__gu_addr = (ptr);	\
-	__chk_user_ptr(ptr);					\
+	__typeof__(size) __gu_size = (size);			\
+								\
+	__chk_user_ptr(__gu_addr);				\
 	if (!is_kernel_addr((unsigned long)__gu_addr))		\
 		might_fault();					\
 	barrier_nospec();					\
 	if (do_allow)								\
-		__get_user_size(__gu_val, __gu_addr, (size), __gu_err);		\
+		__get_user_size(__gu_val, __gu_addr, __gu_size, __gu_err);	\
 	else									\
-		__get_user_size_allowed(__gu_val, __gu_addr, (size), __gu_err);	\
+		__get_user_size_allowed(__gu_val, __gu_addr, __gu_size, __gu_err); \
 	(x) = (__typeof__(*(ptr)))__gu_val;			\
+								\
 	__gu_err;						\
 })
 
@@ -300,12 +315,15 @@ do {								\
 	long __gu_err = -EFAULT;					\
 	__long_type(*(ptr)) __gu_val = 0;				\
 	__typeof__(*(ptr)) __user *__gu_addr = (ptr);		\
+	__typeof__(size) __gu_size = (size);				\
+									\
 	might_fault();							\
-	if (access_ok(__gu_addr, (size))) {		\
+	if (access_ok(__gu_addr, __gu_size)) {				\
 		barrier_nospec();					\
-		__get_user_size(__gu_val, __gu_addr, (size), __gu_err);	\
+		__get_user_size(__gu_val, __gu_addr, __gu_size, __gu_err); \
 	}								\
 	(x) = (__force __typeof__(*(ptr)))__gu_val;				\
+									\
 	__gu_err;							\
 })
 
@@ -314,10 +332,13 @@ do {								\
 	long __gu_err;						\
 	__long_type(*(ptr)) __gu_val;				\
 	__typeof__(*(ptr)) __user *__gu_addr = (ptr);	\
-	__chk_user_ptr(ptr);					\
+	__typeof__(size) __gu_size = (size);			\
+								\
+	__chk_user_ptr(__gu_addr);				\
 	barrier_nospec();					\
-	__get_user_size(__gu_val, __gu_addr, (size), __gu_err);	\
+	__get_user_size(__gu_val, __gu_addr, __gu_size, __gu_err); \
 	(x) = (__force __typeof__(*(ptr)))__gu_val;			\
+								\
 	__gu_err;						\
 })
 
diff -druNp --no-dereference linux-libre-5.6.13-gnu/arch/powerpc/kernel/ima_arch.c linux-libre-5.6.14-gnu/arch/powerpc/kernel/ima_arch.c
--- linux-libre-5.6.13-gnu/arch/powerpc/kernel/ima_arch.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/arch/powerpc/kernel/ima_arch.c	2020-05-20 02:22:38.000000000 -0400
@@ -19,12 +19,12 @@ bool arch_ima_get_secureboot(void)
  * to be stored as an xattr or as an appended signature.
  *
  * To avoid duplicate signature verification as much as possible, the IMA
- * policy rule for module appraisal is added only if CONFIG_MODULE_SIG_FORCE
+ * policy rule for module appraisal is added only if CONFIG_MODULE_SIG
  * is not enabled.
  */
 static const char *const secure_rules[] = {
 	"appraise func=KEXEC_KERNEL_CHECK appraise_flag=check_blacklist appraise_type=imasig|modsig",
-#ifndef CONFIG_MODULE_SIG_FORCE
+#ifndef CONFIG_MODULE_SIG
 	"appraise func=MODULE_CHECK appraise_flag=check_blacklist appraise_type=imasig|modsig",
 #endif
 	NULL
@@ -50,7 +50,7 @@ static const char *const secure_and_trus
 	"measure func=KEXEC_KERNEL_CHECK template=ima-modsig",
 	"measure func=MODULE_CHECK template=ima-modsig",
 	"appraise func=KEXEC_KERNEL_CHECK appraise_flag=check_blacklist appraise_type=imasig|modsig",
-#ifndef CONFIG_MODULE_SIG_FORCE
+#ifndef CONFIG_MODULE_SIG
 	"appraise func=MODULE_CHECK appraise_flag=check_blacklist appraise_type=imasig|modsig",
 #endif
 	NULL
diff -druNp --no-dereference linux-libre-5.6.13-gnu/arch/powerpc/kernel/vdso32/gettimeofday.S linux-libre-5.6.14-gnu/arch/powerpc/kernel/vdso32/gettimeofday.S
--- linux-libre-5.6.13-gnu/arch/powerpc/kernel/vdso32/gettimeofday.S	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/arch/powerpc/kernel/vdso32/gettimeofday.S	2020-05-20 02:22:38.000000000 -0400
@@ -218,11 +218,11 @@ V_FUNCTION_BEGIN(__kernel_clock_getres)
 	blr
 
 	/*
-	 * invalid clock
+	 * syscall fallback
 	 */
 99:
-	li	r3, EINVAL
-	crset	so
+	li	r0,__NR_clock_getres
+	sc
 	blr
   .cfi_endproc
 V_FUNCTION_END(__kernel_clock_getres)
diff -druNp --no-dereference linux-libre-5.6.13-gnu/arch/riscv/include/asm/perf_event.h linux-libre-5.6.14-gnu/arch/riscv/include/asm/perf_event.h
--- linux-libre-5.6.13-gnu/arch/riscv/include/asm/perf_event.h	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/arch/riscv/include/asm/perf_event.h	2020-05-20 02:22:38.000000000 -0400
@@ -12,19 +12,14 @@
 #include <linux/ptrace.h>
 #include <linux/interrupt.h>
 
+#ifdef CONFIG_RISCV_BASE_PMU
 #define RISCV_BASE_COUNTERS	2
 
 /*
  * The RISCV_MAX_COUNTERS parameter should be specified.
  */
 
-#ifdef CONFIG_RISCV_BASE_PMU
 #define RISCV_MAX_COUNTERS	2
-#endif
-
-#ifndef RISCV_MAX_COUNTERS
-#error "Please provide a valid RISCV_MAX_COUNTERS for the PMU."
-#endif
 
 /*
  * These are the indexes of bits in counteren register *minus* 1,
@@ -82,6 +77,7 @@ struct riscv_pmu {
 	int		irq;
 };
 
+#endif
 #ifdef CONFIG_PERF_EVENTS
 #define perf_arch_bpf_user_pt_regs(regs) (struct user_regs_struct *)regs
 #endif
diff -druNp --no-dereference linux-libre-5.6.13-gnu/arch/riscv/kernel/Makefile linux-libre-5.6.14-gnu/arch/riscv/kernel/Makefile
--- linux-libre-5.6.13-gnu/arch/riscv/kernel/Makefile	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/arch/riscv/kernel/Makefile	2020-05-20 02:22:38.000000000 -0400
@@ -38,7 +38,7 @@ obj-$(CONFIG_MODULE_SECTIONS)	+= module-
 obj-$(CONFIG_FUNCTION_TRACER)	+= mcount.o ftrace.o
 obj-$(CONFIG_DYNAMIC_FTRACE)	+= mcount-dyn.o
 
-obj-$(CONFIG_PERF_EVENTS)	+= perf_event.o
+obj-$(CONFIG_RISCV_BASE_PMU)	+= perf_event.o
 obj-$(CONFIG_PERF_EVENTS)	+= perf_callchain.o
 obj-$(CONFIG_HAVE_PERF_REGS)	+= perf_regs.o
 obj-$(CONFIG_RISCV_SBI)		+= sbi.o
diff -druNp --no-dereference linux-libre-5.6.13-gnu/arch/riscv/kernel/vdso/Makefile linux-libre-5.6.14-gnu/arch/riscv/kernel/vdso/Makefile
--- linux-libre-5.6.13-gnu/arch/riscv/kernel/vdso/Makefile	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/arch/riscv/kernel/vdso/Makefile	2020-05-20 02:22:38.000000000 -0400
@@ -33,15 +33,15 @@ $(obj)/vdso.so.dbg: $(src)/vdso.lds $(ob
 	$(call if_changed,vdsold)
 
 # We also create a special relocatable object that should mirror the symbol
-# table and layout of the linked DSO.  With ld -R we can then refer to
-# these symbols in the kernel code rather than hand-coded addresses.
+# table and layout of the linked DSO. With ld --just-symbols we can then
+# refer to these symbols in the kernel code rather than hand-coded addresses.
 
 SYSCFLAGS_vdso.so.dbg = -shared -s -Wl,-soname=linux-vdso.so.1 \
 	-Wl,--build-id -Wl,--hash-style=both
 $(obj)/vdso-dummy.o: $(src)/vdso.lds $(obj)/rt_sigreturn.o FORCE
 	$(call if_changed,vdsold)
 
-LDFLAGS_vdso-syms.o := -r -R
+LDFLAGS_vdso-syms.o := -r --just-symbols
 $(obj)/vdso-syms.o: $(obj)/vdso-dummy.o FORCE
 	$(call if_changed,ld)
 
diff -druNp --no-dereference linux-libre-5.6.13-gnu/arch/x86/include/asm/ftrace.h linux-libre-5.6.14-gnu/arch/x86/include/asm/ftrace.h
--- linux-libre-5.6.13-gnu/arch/x86/include/asm/ftrace.h	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/arch/x86/include/asm/ftrace.h	2020-05-20 02:22:38.000000000 -0400
@@ -56,6 +56,12 @@ struct dyn_arch_ftrace {
 
 #ifndef __ASSEMBLY__
 
+#if defined(CONFIG_FUNCTION_TRACER) && defined(CONFIG_DYNAMIC_FTRACE)
+extern void set_ftrace_ops_ro(void);
+#else
+static inline void set_ftrace_ops_ro(void) { }
+#endif
+
 #define ARCH_HAS_SYSCALL_MATCH_SYM_NAME
 static inline bool arch_syscall_match_sym_name(const char *sym, const char *name)
 {
diff -druNp --no-dereference linux-libre-5.6.13-gnu/arch/x86/include/asm/kvm_host.h linux-libre-5.6.14-gnu/arch/x86/include/asm/kvm_host.h
--- linux-libre-5.6.13-gnu/arch/x86/include/asm/kvm_host.h	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/arch/x86/include/asm/kvm_host.h	2020-05-20 02:22:38.000000000 -0400
@@ -574,6 +574,7 @@ struct kvm_vcpu_arch {
 	unsigned long cr4;
 	unsigned long cr4_guest_owned_bits;
 	unsigned long cr8;
+	u32 host_pkru;
 	u32 pkru;
 	u32 hflags;
 	u64 efer;
diff -druNp --no-dereference linux-libre-5.6.13-gnu/arch/x86/include/asm/stackprotector.h linux-libre-5.6.14-gnu/arch/x86/include/asm/stackprotector.h
--- linux-libre-5.6.13-gnu/arch/x86/include/asm/stackprotector.h	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/arch/x86/include/asm/stackprotector.h	2020-05-20 02:22:38.000000000 -0400
@@ -55,8 +55,13 @@
 /*
  * Initialize the stackprotector canary value.
  *
- * NOTE: this must only be called from functions that never return,
+ * NOTE: this must only be called from functions that never return
  * and it must always be inlined.
+ *
+ * In addition, it should be called from a compilation unit for which
+ * stack protector is disabled. Alternatively, the caller should not end
+ * with a function call which gets tail-call optimized as that would
+ * lead to checking a modified canary value.
  */
 static __always_inline void boot_init_stack_canary(void)
 {
diff -druNp --no-dereference linux-libre-5.6.13-gnu/arch/x86/kernel/ftrace.c linux-libre-5.6.14-gnu/arch/x86/kernel/ftrace.c
--- linux-libre-5.6.13-gnu/arch/x86/kernel/ftrace.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/arch/x86/kernel/ftrace.c	2020-05-20 02:22:38.000000000 -0400
@@ -407,7 +407,8 @@ create_trampoline(struct ftrace_ops *ops
 
 	set_vm_flush_reset_perms(trampoline);
 
-	set_memory_ro((unsigned long)trampoline, npages);
+	if (likely(system_state != SYSTEM_BOOTING))
+		set_memory_ro((unsigned long)trampoline, npages);
 	set_memory_x((unsigned long)trampoline, npages);
 	return (unsigned long)trampoline;
 fail:
@@ -415,6 +416,32 @@ fail:
 	return 0;
 }
 
+void set_ftrace_ops_ro(void)
+{
+	struct ftrace_ops *ops;
+	unsigned long start_offset;
+	unsigned long end_offset;
+	unsigned long npages;
+	unsigned long size;
+
+	do_for_each_ftrace_op(ops, ftrace_ops_list) {
+		if (!(ops->flags & FTRACE_OPS_FL_ALLOC_TRAMP))
+			continue;
+
+		if (ops->flags & FTRACE_OPS_FL_SAVE_REGS) {
+			start_offset = (unsigned long)ftrace_regs_caller;
+			end_offset = (unsigned long)ftrace_regs_caller_end;
+		} else {
+			start_offset = (unsigned long)ftrace_caller;
+			end_offset = (unsigned long)ftrace_epilogue;
+		}
+		size = end_offset - start_offset;
+		size = size + RET_SIZE + sizeof(void *);
+		npages = DIV_ROUND_UP(size, PAGE_SIZE);
+		set_memory_ro((unsigned long)ops->trampoline, npages);
+	} while_for_each_ftrace_op(ops);
+}
+
 static unsigned long calc_trampoline_call_offset(bool save_regs)
 {
 	unsigned long start_offset;
diff -druNp --no-dereference linux-libre-5.6.13-gnu/arch/x86/kernel/smpboot.c linux-libre-5.6.14-gnu/arch/x86/kernel/smpboot.c
--- linux-libre-5.6.13-gnu/arch/x86/kernel/smpboot.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/arch/x86/kernel/smpboot.c	2020-05-20 02:22:38.000000000 -0400
@@ -262,6 +262,14 @@ static void notrace start_secondary(void
 
 	wmb();
 	cpu_startup_entry(CPUHP_AP_ONLINE_IDLE);
+
+	/*
+	 * Prevent tail call to cpu_startup_entry() because the stack protector
+	 * guard has been changed a couple of function calls up, in
+	 * boot_init_stack_canary() and must not be checked before tail calling
+	 * another function.
+	 */
+	prevent_tail_call_optimization();
 }
 
 /**
diff -druNp --no-dereference linux-libre-5.6.13-gnu/arch/x86/kernel/unwind_orc.c linux-libre-5.6.14-gnu/arch/x86/kernel/unwind_orc.c
--- linux-libre-5.6.13-gnu/arch/x86/kernel/unwind_orc.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/arch/x86/kernel/unwind_orc.c	2020-05-20 02:22:38.000000000 -0400
@@ -611,23 +611,23 @@ EXPORT_SYMBOL_GPL(unwind_next_frame);
 void __unwind_start(struct unwind_state *state, struct task_struct *task,
 		    struct pt_regs *regs, unsigned long *first_frame)
 {
-	if (!orc_init)
-		goto done;
-
 	memset(state, 0, sizeof(*state));
 	state->task = task;
 
+	if (!orc_init)
+		goto err;
+
 	/*
 	 * Refuse to unwind the stack of a task while it's executing on another
 	 * CPU.  This check is racy, but that's ok: the unwinder has other
 	 * checks to prevent it from going off the rails.
 	 */
 	if (task_on_another_cpu(task))
-		goto done;
+		goto err;
 
 	if (regs) {
 		if (user_mode(regs))
-			goto done;
+			goto the_end;
 
 		state->ip = regs->ip;
 		state->sp = regs->sp;
@@ -660,6 +660,7 @@ void __unwind_start(struct unwind_state
 		 * generate some kind of backtrace if this happens.
 		 */
 		void *next_page = (void *)PAGE_ALIGN((unsigned long)state->sp);
+		state->error = true;
 		if (get_stack_info(next_page, state->task, &state->stack_info,
 				   &state->stack_mask))
 			return;
@@ -685,8 +686,9 @@ void __unwind_start(struct unwind_state
 
 	return;
 
-done:
+err:
+	state->error = true;
+the_end:
 	state->stack_info.type = STACK_TYPE_UNKNOWN;
-	return;
 }
 EXPORT_SYMBOL_GPL(__unwind_start);
diff -druNp --no-dereference linux-libre-5.6.13-gnu/arch/x86/kvm/vmx/nested.c linux-libre-5.6.14-gnu/arch/x86/kvm/vmx/nested.c
--- linux-libre-5.6.13-gnu/arch/x86/kvm/vmx/nested.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/arch/x86/kvm/vmx/nested.c	2020-05-20 02:22:38.000000000 -0400
@@ -5504,6 +5504,23 @@ static bool nested_vmx_exit_handled_vmcs
 	return 1 & (b >> (field & 7));
 }
 
+static bool nested_vmx_exit_handled_mtf(struct vmcs12 *vmcs12)
+{
+	u32 entry_intr_info = vmcs12->vm_entry_intr_info_field;
+
+	if (nested_cpu_has_mtf(vmcs12))
+		return true;
+
+	/*
+	 * An MTF VM-exit may be injected into the guest by setting the
+	 * interruption-type to 7 (other event) and the vector field to 0. Such
+	 * is the case regardless of the 'monitor trap flag' VM-execution
+	 * control.
+	 */
+	return entry_intr_info == (INTR_INFO_VALID_MASK
+				   | INTR_TYPE_OTHER_EVENT);
+}
+
 /*
  * Return 1 if we should exit from L2 to L1 to handle an exit, or 0 if we
  * should handle it ourselves in L0 (and then continue L2). Only call this
@@ -5618,7 +5635,7 @@ bool nested_vmx_exit_reflected(struct kv
 	case EXIT_REASON_MWAIT_INSTRUCTION:
 		return nested_cpu_has(vmcs12, CPU_BASED_MWAIT_EXITING);
 	case EXIT_REASON_MONITOR_TRAP_FLAG:
-		return nested_cpu_has(vmcs12, CPU_BASED_MONITOR_TRAP_FLAG);
+		return nested_vmx_exit_handled_mtf(vmcs12);
 	case EXIT_REASON_MONITOR_INSTRUCTION:
 		return nested_cpu_has(vmcs12, CPU_BASED_MONITOR_EXITING);
 	case EXIT_REASON_PAUSE_INSTRUCTION:
diff -druNp --no-dereference linux-libre-5.6.13-gnu/arch/x86/kvm/vmx/vmx.c linux-libre-5.6.14-gnu/arch/x86/kvm/vmx/vmx.c
--- linux-libre-5.6.13-gnu/arch/x86/kvm/vmx/vmx.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/arch/x86/kvm/vmx/vmx.c	2020-05-20 02:22:38.000000000 -0400
@@ -1380,7 +1380,6 @@ void vmx_vcpu_load(struct kvm_vcpu *vcpu
 
 	vmx_vcpu_pi_load(vcpu, cpu);
 
-	vmx->host_pkru = read_pkru();
 	vmx->host_debugctlmsr = get_debugctlmsr();
 }
 
@@ -6538,11 +6537,6 @@ static void vmx_vcpu_run(struct kvm_vcpu
 
 	kvm_load_guest_xsave_state(vcpu);
 
-	if (static_cpu_has(X86_FEATURE_PKU) &&
-	    kvm_read_cr4_bits(vcpu, X86_CR4_PKE) &&
-	    vcpu->arch.pkru != vmx->host_pkru)
-		__write_pkru(vcpu->arch.pkru);
-
 	pt_guest_enter(vmx);
 
 	atomic_switch_perf_msrs(vmx);
@@ -6631,18 +6625,6 @@ static void vmx_vcpu_run(struct kvm_vcpu
 
 	pt_guest_exit(vmx);
 
-	/*
-	 * eager fpu is enabled if PKEY is supported and CR4 is switched
-	 * back on host, so it is safe to read guest PKRU from current
-	 * XSAVE.
-	 */
-	if (static_cpu_has(X86_FEATURE_PKU) &&
-	    kvm_read_cr4_bits(vcpu, X86_CR4_PKE)) {
-		vcpu->arch.pkru = rdpkru();
-		if (vcpu->arch.pkru != vmx->host_pkru)
-			__write_pkru(vmx->host_pkru);
-	}
-
 	kvm_load_host_xsave_state(vcpu);
 
 	vmx->nested.nested_run_pending = 0;
diff -druNp --no-dereference linux-libre-5.6.13-gnu/arch/x86/kvm/x86.c linux-libre-5.6.14-gnu/arch/x86/kvm/x86.c
--- linux-libre-5.6.13-gnu/arch/x86/kvm/x86.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/arch/x86/kvm/x86.c	2020-05-20 02:22:38.000000000 -0400
@@ -809,11 +809,25 @@ void kvm_load_guest_xsave_state(struct k
 		    vcpu->arch.ia32_xss != host_xss)
 			wrmsrl(MSR_IA32_XSS, vcpu->arch.ia32_xss);
 	}
+
+	if (static_cpu_has(X86_FEATURE_PKU) &&
+	    (kvm_read_cr4_bits(vcpu, X86_CR4_PKE) ||
+	     (vcpu->arch.xcr0 & XFEATURE_MASK_PKRU)) &&
+	    vcpu->arch.pkru != vcpu->arch.host_pkru)
+		__write_pkru(vcpu->arch.pkru);
 }
 EXPORT_SYMBOL_GPL(kvm_load_guest_xsave_state);
 
 void kvm_load_host_xsave_state(struct kvm_vcpu *vcpu)
 {
+	if (static_cpu_has(X86_FEATURE_PKU) &&
+	    (kvm_read_cr4_bits(vcpu, X86_CR4_PKE) ||
+	     (vcpu->arch.xcr0 & XFEATURE_MASK_PKRU))) {
+		vcpu->arch.pkru = rdpkru();
+		if (vcpu->arch.pkru != vcpu->arch.host_pkru)
+			__write_pkru(vcpu->arch.host_pkru);
+	}
+
 	if (kvm_read_cr4_bits(vcpu, X86_CR4_OSXSAVE)) {
 
 		if (vcpu->arch.xcr0 != host_xcr0)
@@ -3529,6 +3543,9 @@ void kvm_arch_vcpu_load(struct kvm_vcpu
 
 	kvm_x86_ops->vcpu_load(vcpu, cpu);
 
+	/* Save host pkru register if supported */
+	vcpu->arch.host_pkru = read_pkru();
+
 	/* Apply any externally detected TSC adjustments (due to suspend) */
 	if (unlikely(vcpu->arch.tsc_offset_adjustment)) {
 		adjust_tsc_offset_host(vcpu, vcpu->arch.tsc_offset_adjustment);
@@ -3722,7 +3739,7 @@ static int kvm_vcpu_ioctl_x86_setup_mce(
 	unsigned bank_num = mcg_cap & 0xff, bank;
 
 	r = -EINVAL;
-	if (!bank_num || bank_num >= KVM_MAX_MCE_BANKS)
+	if (!bank_num || bank_num > KVM_MAX_MCE_BANKS)
 		goto out;
 	if (mcg_cap & ~(kvm_mce_cap_supported | 0xff | 0xff0000))
 		goto out;
diff -druNp --no-dereference linux-libre-5.6.13-gnu/arch/x86/mm/init_64.c linux-libre-5.6.14-gnu/arch/x86/mm/init_64.c
--- linux-libre-5.6.13-gnu/arch/x86/mm/init_64.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/arch/x86/mm/init_64.c	2020-05-20 02:22:38.000000000 -0400
@@ -54,6 +54,7 @@
 #include <asm/init.h>
 #include <asm/uv/uv.h>
 #include <asm/setup.h>
+#include <asm/ftrace.h>
 
 #include "mm_internal.h"
 
@@ -1288,6 +1289,8 @@ void mark_rodata_ro(void)
 	all_end = roundup((unsigned long)_brk_end, PMD_SIZE);
 	set_memory_nx(text_end, (all_end - text_end) >> PAGE_SHIFT);
 
+	set_ftrace_ops_ro();
+
 #ifdef CONFIG_CPA_DEBUG
 	printk(KERN_INFO "Testing CPA: undo %lx-%lx\n", start, end);
 	set_memory_rw(start, (end-start) >> PAGE_SHIFT);
diff -druNp --no-dereference linux-libre-5.6.13-gnu/arch/x86/xen/smp_pv.c linux-libre-5.6.14-gnu/arch/x86/xen/smp_pv.c
--- linux-libre-5.6.13-gnu/arch/x86/xen/smp_pv.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/arch/x86/xen/smp_pv.c	2020-05-20 02:22:38.000000000 -0400
@@ -92,6 +92,7 @@ asmlinkage __visible void cpu_bringup_an
 	cpu_bringup();
 	boot_init_stack_canary();
 	cpu_startup_entry(CPUHP_AP_ONLINE_IDLE);
+	prevent_tail_call_optimization();
 }
 
 void xen_smp_intr_free_pv(unsigned int cpu)
diff -druNp --no-dereference linux-libre-5.6.13-gnu/crypto/lrw.c linux-libre-5.6.14-gnu/crypto/lrw.c
--- linux-libre-5.6.13-gnu/crypto/lrw.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/crypto/lrw.c	2020-05-20 02:22:38.000000000 -0400
@@ -287,7 +287,7 @@ static void exit_tfm(struct crypto_skcip
 	crypto_free_skcipher(ctx->child);
 }
 
-static void free(struct skcipher_instance *inst)
+static void free_inst(struct skcipher_instance *inst)
 {
 	crypto_drop_skcipher(skcipher_instance_ctx(inst));
 	kfree(inst);
@@ -400,7 +400,7 @@ static int create(struct crypto_template
 	inst->alg.encrypt = encrypt;
 	inst->alg.decrypt = decrypt;
 
-	inst->free = free;
+	inst->free = free_inst;
 
 	err = skcipher_register_instance(tmpl, inst);
 	if (err)
diff -druNp --no-dereference linux-libre-5.6.13-gnu/crypto/xts.c linux-libre-5.6.14-gnu/crypto/xts.c
--- linux-libre-5.6.13-gnu/crypto/xts.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/crypto/xts.c	2020-05-20 02:22:38.000000000 -0400
@@ -322,7 +322,7 @@ static void exit_tfm(struct crypto_skcip
 	crypto_free_cipher(ctx->tweak);
 }
 
-static void free(struct skcipher_instance *inst)
+static void free_inst(struct skcipher_instance *inst)
 {
 	crypto_drop_skcipher(skcipher_instance_ctx(inst));
 	kfree(inst);
@@ -434,7 +434,7 @@ static int create(struct crypto_template
 	inst->alg.encrypt = encrypt;
 	inst->alg.decrypt = decrypt;
 
-	inst->free = free;
+	inst->free = free_inst;
 
 	err = skcipher_register_instance(tmpl, inst);
 	if (err)
diff -druNp --no-dereference linux-libre-5.6.13-gnu/Documentation/core-api/printk-formats.rst linux-libre-5.6.14-gnu/Documentation/core-api/printk-formats.rst
--- linux-libre-5.6.13-gnu/Documentation/core-api/printk-formats.rst	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/Documentation/core-api/printk-formats.rst	2020-05-20 02:22:38.000000000 -0400
@@ -112,6 +112,20 @@ used when printing stack backtraces. The
 consideration the effect of compiler optimisations which may occur
 when tail-calls are used and marked with the noreturn GCC attribute.
 
+Probed Pointers from BPF / tracing
+----------------------------------
+
+::
+
+	%pks	kernel string
+	%pus	user string
+
+The ``k`` and ``u`` specifiers are used for printing prior probed memory from
+either kernel memory (k) or user memory (u). The subsequent ``s`` specifier
+results in printing a string. For direct use in regular vsnprintf() the (k)
+and (u) annotation is ignored, however, when used out of BPF's bpf_trace_printk(),
+for example, it reads the memory it is pointing to without faulting.
+
 Kernel Pointers
 ---------------
 
diff -druNp --no-dereference linux-libre-5.6.13-gnu/Documentation/devicetree/bindings/dma/fsl-edma.txt linux-libre-5.6.14-gnu/Documentation/devicetree/bindings/dma/fsl-edma.txt
--- linux-libre-5.6.13-gnu/Documentation/devicetree/bindings/dma/fsl-edma.txt	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/Documentation/devicetree/bindings/dma/fsl-edma.txt	2020-05-20 02:22:38.000000000 -0400
@@ -10,7 +10,8 @@ Required properties:
 - compatible :
 	- "fsl,vf610-edma" for eDMA used similar to that on Vybrid vf610 SoC
 	- "fsl,imx7ulp-edma" for eDMA2 used similar to that on i.mx7ulp
-	- "fsl,fsl,ls1028a-edma" for eDMA used similar to that on Vybrid vf610 SoC
+	- "fsl,ls1028a-edma" followed by "fsl,vf610-edma" for eDMA used on the
+	  LS1028A SoC.
 - reg : Specifies base physical address(s) and size of the eDMA registers.
 	The 1st region is eDMA control register's address and size.
 	The 2nd and the 3rd regions are programmable channel multiplexing
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/acpi/ec.c linux-libre-5.6.14-gnu/drivers/acpi/ec.c
--- linux-libre-5.6.13-gnu/drivers/acpi/ec.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/acpi/ec.c	2020-05-20 02:22:38.000000000 -0400
@@ -2042,23 +2042,31 @@ void acpi_ec_set_gpe_wake_mask(u8 action
 		acpi_set_gpe_wake_mask(NULL, first_ec->gpe, action);
 }
 
-bool acpi_ec_other_gpes_active(void)
-{
-	return acpi_any_gpe_status_set(first_ec ? first_ec->gpe : U32_MAX);
-}
-
 bool acpi_ec_dispatch_gpe(void)
 {
 	u32 ret;
 
 	if (!first_ec)
+		return acpi_any_gpe_status_set(U32_MAX);
+
+	/*
+	 * Report wakeup if the status bit is set for any enabled GPE other
+	 * than the EC one.
+	 */
+	if (acpi_any_gpe_status_set(first_ec->gpe))
+		return true;
+
+	if (ec_no_wakeup)
 		return false;
 
+	/*
+	 * Dispatch the EC GPE in-band, but do not report wakeup in any case
+	 * to allow the caller to process events properly after that.
+	 */
 	ret = acpi_dispatch_gpe(NULL, first_ec->gpe);
-	if (ret == ACPI_INTERRUPT_HANDLED) {
+	if (ret == ACPI_INTERRUPT_HANDLED)
 		pm_pr_dbg("EC GPE dispatched\n");
-		return true;
-	}
+
 	return false;
 }
 #endif /* CONFIG_PM_SLEEP */
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/acpi/internal.h linux-libre-5.6.14-gnu/drivers/acpi/internal.h
--- linux-libre-5.6.13-gnu/drivers/acpi/internal.h	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/acpi/internal.h	2020-05-20 02:22:38.000000000 -0400
@@ -202,7 +202,6 @@ void acpi_ec_remove_query_handler(struct
 
 #ifdef CONFIG_PM_SLEEP
 void acpi_ec_flush_work(void);
-bool acpi_ec_other_gpes_active(void);
 bool acpi_ec_dispatch_gpe(void);
 #endif
 
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/acpi/sleep.c linux-libre-5.6.14-gnu/drivers/acpi/sleep.c
--- linux-libre-5.6.13-gnu/drivers/acpi/sleep.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/acpi/sleep.c	2020-05-20 02:22:38.000000000 -0400
@@ -1013,21 +1013,11 @@ static bool acpi_s2idle_wake(void)
 		if (acpi_check_wakeup_handlers())
 			return true;
 
-		/*
-		 * If the status bit is set for any enabled GPE other than the
-		 * EC one, the wakeup is regarded as a genuine one.
-		 */
-		if (acpi_ec_other_gpes_active())
+		/* Check non-EC GPE wakeups and dispatch the EC GPE. */
+		if (acpi_ec_dispatch_gpe())
 			return true;
 
 		/*
-		 * If the EC GPE status bit has not been set, the wakeup is
-		 * regarded as a spurious one.
-		 */
-		if (!acpi_ec_dispatch_gpe())
-			return false;
-
-		/*
 		 * Cancel the wakeup and process all pending events in case
 		 * there are any wakeup ones in there.
 		 *
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/block/virtio_blk.c linux-libre-5.6.14-gnu/drivers/block/virtio_blk.c
--- linux-libre-5.6.13-gnu/drivers/block/virtio_blk.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/block/virtio_blk.c	2020-05-20 02:22:38.000000000 -0400
@@ -32,6 +32,15 @@ struct virtio_blk_vq {
 } ____cacheline_aligned_in_smp;
 
 struct virtio_blk {
+	/*
+	 * This mutex must be held by anything that may run after
+	 * virtblk_remove() sets vblk->vdev to NULL.
+	 *
+	 * blk-mq, virtqueue processing, and sysfs attribute code paths are
+	 * shut down before vblk->vdev is set to NULL and therefore do not need
+	 * to hold this mutex.
+	 */
+	struct mutex vdev_mutex;
 	struct virtio_device *vdev;
 
 	/* The disk structure for the kernel. */
@@ -43,6 +52,13 @@ struct virtio_blk {
 	/* Process context for config space updates */
 	struct work_struct config_work;
 
+	/*
+	 * Tracks references from block_device_operations open/release and
+	 * virtio_driver probe/remove so this object can be freed once no
+	 * longer in use.
+	 */
+	refcount_t refs;
+
 	/* What host tells us, plus 2 for header & tailer. */
 	unsigned int sg_elems;
 
@@ -294,10 +310,55 @@ out:
 	return err;
 }
 
+static void virtblk_get(struct virtio_blk *vblk)
+{
+	refcount_inc(&vblk->refs);
+}
+
+static void virtblk_put(struct virtio_blk *vblk)
+{
+	if (refcount_dec_and_test(&vblk->refs)) {
+		ida_simple_remove(&vd_index_ida, vblk->index);
+		mutex_destroy(&vblk->vdev_mutex);
+		kfree(vblk);
+	}
+}
+
+static int virtblk_open(struct block_device *bd, fmode_t mode)
+{
+	struct virtio_blk *vblk = bd->bd_disk->private_data;
+	int ret = 0;
+
+	mutex_lock(&vblk->vdev_mutex);
+
+	if (vblk->vdev)
+		virtblk_get(vblk);
+	else
+		ret = -ENXIO;
+
+	mutex_unlock(&vblk->vdev_mutex);
+	return ret;
+}
+
+static void virtblk_release(struct gendisk *disk, fmode_t mode)
+{
+	struct virtio_blk *vblk = disk->private_data;
+
+	virtblk_put(vblk);
+}
+
 /* We provide getgeo only to please some old bootloader/partitioning tools */
 static int virtblk_getgeo(struct block_device *bd, struct hd_geometry *geo)
 {
 	struct virtio_blk *vblk = bd->bd_disk->private_data;
+	int ret = 0;
+
+	mutex_lock(&vblk->vdev_mutex);
+
+	if (!vblk->vdev) {
+		ret = -ENXIO;
+		goto out;
+	}
 
 	/* see if the host passed in geometry config */
 	if (virtio_has_feature(vblk->vdev, VIRTIO_BLK_F_GEOMETRY)) {
@@ -313,11 +374,15 @@ static int virtblk_getgeo(struct block_d
 		geo->sectors = 1 << 5;
 		geo->cylinders = get_capacity(bd->bd_disk) >> 11;
 	}
-	return 0;
+out:
+	mutex_unlock(&vblk->vdev_mutex);
+	return ret;
 }
 
 static const struct block_device_operations virtblk_fops = {
 	.owner  = THIS_MODULE,
+	.open = virtblk_open,
+	.release = virtblk_release,
 	.getgeo = virtblk_getgeo,
 };
 
@@ -657,6 +722,10 @@ static int virtblk_probe(struct virtio_d
 		goto out_free_index;
 	}
 
+	/* This reference is dropped in virtblk_remove(). */
+	refcount_set(&vblk->refs, 1);
+	mutex_init(&vblk->vdev_mutex);
+
 	vblk->vdev = vdev;
 	vblk->sg_elems = sg_elems;
 
@@ -822,8 +891,6 @@ out:
 static void virtblk_remove(struct virtio_device *vdev)
 {
 	struct virtio_blk *vblk = vdev->priv;
-	int index = vblk->index;
-	int refc;
 
 	/* Make sure no work handler is accessing the device. */
 	flush_work(&vblk->config_work);
@@ -833,18 +900,21 @@ static void virtblk_remove(struct virtio
 
 	blk_mq_free_tag_set(&vblk->tag_set);
 
+	mutex_lock(&vblk->vdev_mutex);
+
 	/* Stop all the virtqueues. */
 	vdev->config->reset(vdev);
 
-	refc = kref_read(&disk_to_dev(vblk->disk)->kobj.kref);
+	/* Virtqueues are stopped, nothing can use vblk->vdev anymore. */
+	vblk->vdev = NULL;
+
 	put_disk(vblk->disk);
 	vdev->config->del_vqs(vdev);
 	kfree(vblk->vqs);
-	kfree(vblk);
 
-	/* Only free device id if we don't have any users */
-	if (refc == 1)
-		ida_simple_remove(&vd_index_ida, index);
+	mutex_unlock(&vblk->vdev_mutex);
+
+	virtblk_put(vblk);
 }
 
 #ifdef CONFIG_PM_SLEEP
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/clk/clk.c linux-libre-5.6.14-gnu/drivers/clk/clk.c
--- linux-libre-5.6.13-gnu/drivers/clk/clk.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/clk/clk.c	2020-05-20 02:22:38.000000000 -0400
@@ -3512,6 +3512,9 @@ static int __clk_core_init(struct clk_co
 out:
 	clk_pm_runtime_put(core);
 unlock:
+	if (ret)
+		hlist_del_init(&core->child_node);
+
 	clk_prepare_unlock();
 
 	if (!ret)
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/clk/rockchip/clk-rk3228.c linux-libre-5.6.14-gnu/drivers/clk/rockchip/clk-rk3228.c
--- linux-libre-5.6.13-gnu/drivers/clk/rockchip/clk-rk3228.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/clk/rockchip/clk-rk3228.c	2020-05-20 02:22:38.000000000 -0400
@@ -156,8 +156,6 @@ PNAME(mux_i2s_out_p)		= { "i2s1_pre", "x
 PNAME(mux_i2s2_p)		= { "i2s2_src", "i2s2_frac", "xin12m" };
 PNAME(mux_sclk_spdif_p)		= { "sclk_spdif_src", "spdif_frac", "xin12m" };
 
-PNAME(mux_aclk_gpu_pre_p)	= { "cpll_gpu", "gpll_gpu", "hdmiphy_gpu", "usb480m_gpu" };
-
 PNAME(mux_uart0_p)		= { "uart0_src", "uart0_frac", "xin24m" };
 PNAME(mux_uart1_p)		= { "uart1_src", "uart1_frac", "xin24m" };
 PNAME(mux_uart2_p)		= { "uart2_src", "uart2_frac", "xin24m" };
@@ -468,16 +466,9 @@ static struct rockchip_clk_branch rk3228
 			RK2928_CLKSEL_CON(24), 6, 10, DFLAGS,
 			RK2928_CLKGATE_CON(2), 8, GFLAGS),
 
-	GATE(0, "cpll_gpu", "cpll", 0,
-			RK2928_CLKGATE_CON(3), 13, GFLAGS),
-	GATE(0, "gpll_gpu", "gpll", 0,
-			RK2928_CLKGATE_CON(3), 13, GFLAGS),
-	GATE(0, "hdmiphy_gpu", "hdmiphy", 0,
-			RK2928_CLKGATE_CON(3), 13, GFLAGS),
-	GATE(0, "usb480m_gpu", "usb480m", 0,
+	COMPOSITE(0, "aclk_gpu_pre", mux_pll_src_4plls_p, 0,
+			RK2928_CLKSEL_CON(34), 5, 2, MFLAGS, 0, 5, DFLAGS,
 			RK2928_CLKGATE_CON(3), 13, GFLAGS),
-	COMPOSITE_NOGATE(0, "aclk_gpu_pre", mux_aclk_gpu_pre_p, 0,
-			RK2928_CLKSEL_CON(34), 5, 2, MFLAGS, 0, 5, DFLAGS),
 
 	COMPOSITE(SCLK_SPI0, "sclk_spi0", mux_pll_src_2plls_p, 0,
 			RK2928_CLKSEL_CON(25), 8, 1, MFLAGS, 0, 7, DFLAGS,
@@ -582,8 +573,8 @@ static struct rockchip_clk_branch rk3228
 	GATE(0, "pclk_peri_noc", "pclk_peri", CLK_IGNORE_UNUSED, RK2928_CLKGATE_CON(12), 2, GFLAGS),
 
 	/* PD_GPU */
-	GATE(ACLK_GPU, "aclk_gpu", "aclk_gpu_pre", 0, RK2928_CLKGATE_CON(13), 14, GFLAGS),
-	GATE(0, "aclk_gpu_noc", "aclk_gpu_pre", 0, RK2928_CLKGATE_CON(13), 15, GFLAGS),
+	GATE(ACLK_GPU, "aclk_gpu", "aclk_gpu_pre", 0, RK2928_CLKGATE_CON(7), 14, GFLAGS),
+	GATE(0, "aclk_gpu_noc", "aclk_gpu_pre", 0, RK2928_CLKGATE_CON(7), 15, GFLAGS),
 
 	/* PD_BUS */
 	GATE(0, "sclk_initmem_mbist", "aclk_cpu", 0, RK2928_CLKGATE_CON(8), 1, GFLAGS),
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/clk/ti/clkctrl.c linux-libre-5.6.14-gnu/drivers/clk/ti/clkctrl.c
--- linux-libre-5.6.13-gnu/drivers/clk/ti/clkctrl.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/clk/ti/clkctrl.c	2020-05-20 02:22:38.000000000 -0400
@@ -461,7 +461,6 @@ static char * __init clkctrl_get_name(st
 			return name;
 		}
 	}
-	of_node_put(np);
 
 	return NULL;
 }
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/cpufreq/intel_pstate.c linux-libre-5.6.14-gnu/drivers/cpufreq/intel_pstate.c
--- linux-libre-5.6.13-gnu/drivers/cpufreq/intel_pstate.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/cpufreq/intel_pstate.c	2020-05-20 02:22:38.000000000 -0400
@@ -1058,7 +1058,7 @@ static ssize_t store_no_turbo(struct kob
 
 	update_turbo_state();
 	if (global.turbo_disabled) {
-		pr_warn("Turbo disabled by BIOS or unavailable on processor\n");
+		pr_notice_once("Turbo disabled by BIOS or unavailable on processor\n");
 		mutex_unlock(&intel_pstate_limits_lock);
 		mutex_unlock(&intel_pstate_driver_lock);
 		return -EPERM;
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/dma/mmp_tdma.c linux-libre-5.6.14-gnu/drivers/dma/mmp_tdma.c
--- linux-libre-5.6.13-gnu/drivers/dma/mmp_tdma.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/dma/mmp_tdma.c	2020-05-20 02:22:38.000000000 -0400
@@ -363,6 +363,8 @@ static void mmp_tdma_free_descriptor(str
 		gen_pool_free(gpool, (unsigned long)tdmac->desc_arr,
 				size);
 	tdmac->desc_arr = NULL;
+	if (tdmac->status == DMA_ERROR)
+		tdmac->status = DMA_COMPLETE;
 
 	return;
 }
@@ -443,7 +445,8 @@ static struct dma_async_tx_descriptor *m
 	if (!desc)
 		goto err_out;
 
-	mmp_tdma_config_write(chan, direction, &tdmac->slave_config);
+	if (mmp_tdma_config_write(chan, direction, &tdmac->slave_config))
+		goto err_out;
 
 	while (buf < buf_len) {
 		desc = &tdmac->desc_arr[i];
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/dma/pch_dma.c linux-libre-5.6.14-gnu/drivers/dma/pch_dma.c
--- linux-libre-5.6.13-gnu/drivers/dma/pch_dma.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/dma/pch_dma.c	2020-05-20 02:22:38.000000000 -0400
@@ -865,6 +865,7 @@ static int pch_dma_probe(struct pci_dev
 	}
 
 	pci_set_master(pdev);
+	pd->dma.dev = &pdev->dev;
 
 	err = request_irq(pdev->irq, pd_irq, IRQF_SHARED, DRV_NAME, pd);
 	if (err) {
@@ -880,7 +881,6 @@ static int pch_dma_probe(struct pci_dev
 		goto err_free_irq;
 	}
 
-	pd->dma.dev = &pdev->dev;
 
 	INIT_LIST_HEAD(&pd->dma.channels);
 
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/dma/xilinx/xilinx_dma.c linux-libre-5.6.14-gnu/drivers/dma/xilinx/xilinx_dma.c
--- linux-libre-5.6.13-gnu/drivers/dma/xilinx/xilinx_dma.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/dma/xilinx/xilinx_dma.c	2020-05-20 02:22:38.000000000 -0400
@@ -1229,16 +1229,16 @@ static enum dma_status xilinx_dma_tx_sta
 		return ret;
 
 	spin_lock_irqsave(&chan->lock, flags);
-
-	desc = list_last_entry(&chan->active_list,
-			       struct xilinx_dma_tx_descriptor, node);
-	/*
-	 * VDMA and simple mode do not support residue reporting, so the
-	 * residue field will always be 0.
-	 */
-	if (chan->has_sg && chan->xdev->dma_config->dmatype != XDMA_TYPE_VDMA)
-		residue = xilinx_dma_get_residue(chan, desc);
-
+	if (!list_empty(&chan->active_list)) {
+		desc = list_last_entry(&chan->active_list,
+				       struct xilinx_dma_tx_descriptor, node);
+		/*
+		 * VDMA and simple mode do not support residue reporting, so the
+		 * residue field will always be 0.
+		 */
+		if (chan->has_sg && chan->xdev->dma_config->dmatype != XDMA_TYPE_VDMA)
+			residue = xilinx_dma_get_residue(chan, desc);
+	}
 	spin_unlock_irqrestore(&chan->lock, flags);
 
 	dma_set_residue(txstate, residue);
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/firmware/efi/tpm.c linux-libre-5.6.14-gnu/drivers/firmware/efi/tpm.c
--- linux-libre-5.6.13-gnu/drivers/firmware/efi/tpm.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/firmware/efi/tpm.c	2020-05-20 02:22:38.000000000 -0400
@@ -16,7 +16,7 @@
 int efi_tpm_final_log_size;
 EXPORT_SYMBOL(efi_tpm_final_log_size);
 
-static int tpm2_calc_event_log_size(void *data, int count, void *size_info)
+static int __init tpm2_calc_event_log_size(void *data, int count, void *size_info)
 {
 	struct tcg_pcr_event2_head *header;
 	int event_size, size = 0;
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/gpio/gpio-pca953x.c linux-libre-5.6.14-gnu/drivers/gpio/gpio-pca953x.c
--- linux-libre-5.6.13-gnu/drivers/gpio/gpio-pca953x.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/gpio/gpio-pca953x.c	2020-05-20 02:22:38.000000000 -0400
@@ -531,7 +531,7 @@ static int pca953x_gpio_set_config(struc
 {
 	struct pca953x_chip *chip = gpiochip_get_data(gc);
 
-	switch (config) {
+	switch (pinconf_to_config_param(config)) {
 	case PIN_CONFIG_BIAS_PULL_UP:
 	case PIN_CONFIG_BIAS_PULL_DOWN:
 		return pca953x_gpio_set_pull_up_down(chip, offset, config);
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c linux-libre-5.6.14-gnu/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c
--- linux-libre-5.6.13-gnu/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c	2020-05-20 02:22:38.000000000 -0400
@@ -133,8 +133,7 @@ static int amdgpufb_create_pinned_object
 	u32 cpp;
 	u64 flags = AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED |
 			       AMDGPU_GEM_CREATE_VRAM_CONTIGUOUS     |
-			       AMDGPU_GEM_CREATE_VRAM_CLEARED 	     |
-			       AMDGPU_GEM_CREATE_CPU_GTT_USWC;
+			       AMDGPU_GEM_CREATE_VRAM_CLEARED;
 
 	info = drm_get_format_info(adev->ddev, mode_cmd);
 	cpp = info->cpp[0];
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c linux-libre-5.6.14-gnu/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
--- linux-libre-5.6.13-gnu/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c	2020-05-14 02:37:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c	2020-05-20 05:00:14.000000000 -0400
@@ -1124,6 +1124,8 @@ static const struct amdgpu_gfxoff_quirk
 	{ 0x1002, 0x15dd, 0x1002, 0x15dd, 0xc8 },
 	/* https://bugzilla.kernel.org/show_bug.cgi?id=207171 */
 	{ 0x1002, 0x15dd, 0x103c, 0x83e7, 0xd3 },
+	/* GFXOFF is unstable on C6 parts with a VBIOS 113-RAVEN-114 */
+	{ 0x1002, 0x15dd, 0x1002, 0x15dd, 0xc6 },
 	{ 0, 0, 0, 0, 0 },
 };
 
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c linux-libre-5.6.14-gnu/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
--- linux-libre-5.6.13-gnu/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c	2020-05-14 02:38:34.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c	2020-05-20 05:01:37.000000000 -0400
@@ -7716,6 +7716,7 @@ static int dm_update_plane_state(struct
 	struct drm_crtc_state *old_crtc_state, *new_crtc_state;
 	struct dm_crtc_state *dm_new_crtc_state, *dm_old_crtc_state;
 	struct dm_plane_state *dm_new_plane_state, *dm_old_plane_state;
+	struct amdgpu_crtc *new_acrtc;
 	bool needs_reset;
 	int ret = 0;
 
@@ -7725,9 +7726,30 @@ static int dm_update_plane_state(struct
 	dm_new_plane_state = to_dm_plane_state(new_plane_state);
 	dm_old_plane_state = to_dm_plane_state(old_plane_state);
 
-	/*TODO Implement atomic check for cursor plane */
-	if (plane->type == DRM_PLANE_TYPE_CURSOR)
+	/*TODO Implement better atomic check for cursor plane */
+	if (plane->type == DRM_PLANE_TYPE_CURSOR) {
+		if (!enable || !new_plane_crtc ||
+			drm_atomic_plane_disabling(plane->state, new_plane_state))
+			return 0;
+
+		new_acrtc = to_amdgpu_crtc(new_plane_crtc);
+
+		if ((new_plane_state->crtc_w > new_acrtc->max_cursor_width) ||
+			(new_plane_state->crtc_h > new_acrtc->max_cursor_height)) {
+			DRM_DEBUG_ATOMIC("Bad cursor size %d x %d\n",
+							 new_plane_state->crtc_w, new_plane_state->crtc_h);
+			return -EINVAL;
+		}
+
+		if (new_plane_state->crtc_x <= -new_acrtc->max_cursor_width ||
+			new_plane_state->crtc_y <= -new_acrtc->max_cursor_height) {
+			DRM_DEBUG_ATOMIC("Bad cursor position %d, %d\n",
+							 new_plane_state->crtc_x, new_plane_state->crtc_y);
+			return -EINVAL;
+		}
+
 		return 0;
+	}
 
 	needs_reset = should_reset_plane(state, plane, old_plane_state,
 					 new_plane_state);
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c linux-libre-5.6.14-gnu/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
--- linux-libre-5.6.13-gnu/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c	2020-05-20 02:22:38.000000000 -0400
@@ -2888,6 +2888,12 @@ bool dc_link_handle_hpd_rx_irq(struct dc
 		for (i = 0; i < MAX_PIPES; i++) {
 			pipe_ctx = &link->dc->current_state->res_ctx.pipe_ctx[i];
 			if (pipe_ctx && pipe_ctx->stream && pipe_ctx->stream->link == link)
+				link->dc->hwss.blank_stream(pipe_ctx);
+		}
+
+		for (i = 0; i < MAX_PIPES; i++) {
+			pipe_ctx = &link->dc->current_state->res_ctx.pipe_ctx[i];
+			if (pipe_ctx && pipe_ctx->stream && pipe_ctx->stream->link == link)
 				break;
 		}
 
@@ -2904,6 +2910,12 @@ bool dc_link_handle_hpd_rx_irq(struct dc
 		if (pipe_ctx->stream->signal == SIGNAL_TYPE_DISPLAY_PORT_MST)
 			dc_link_reallocate_mst_payload(link);
 
+		for (i = 0; i < MAX_PIPES; i++) {
+			pipe_ctx = &link->dc->current_state->res_ctx.pipe_ctx[i];
+			if (pipe_ctx && pipe_ctx->stream && pipe_ctx->stream->link == link)
+				link->dc->hwss.unblank_stream(pipe_ctx, &previous_link_settings);
+		}
+
 		status = false;
 		if (out_link_loss)
 			*out_link_loss = true;
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/gpu/drm/amd/display/dc/core/dc_stream.c linux-libre-5.6.14-gnu/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
--- linux-libre-5.6.13-gnu/drivers/gpu/drm/amd/display/dc/core/dc_stream.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/gpu/drm/amd/display/dc/core/dc_stream.c	2020-05-20 02:22:38.000000000 -0400
@@ -239,24 +239,24 @@ static void delay_cursor_until_vupdate(s
 	struct dc_stream_state *stream = pipe_ctx->stream;
 	unsigned int us_per_line;
 
-	if (stream->ctx->asic_id.chip_family == FAMILY_RV &&
-			ASICREV_IS_RAVEN(stream->ctx->asic_id.hw_internal_rev)) {
+	if (!dc->hwss.get_vupdate_offset_from_vsync)
+		return;
 
-		vupdate_line = dc->hwss.get_vupdate_offset_from_vsync(pipe_ctx);
-		if (!dc_stream_get_crtc_position(dc, &stream, 1, &vpos, &nvpos))
-			return;
+	vupdate_line = dc->hwss.get_vupdate_offset_from_vsync(pipe_ctx);
+	if (!dc_stream_get_crtc_position(dc, &stream, 1, &vpos, &nvpos))
+		return;
 
-		if (vpos >= vupdate_line)
-			return;
+	if (vpos >= vupdate_line)
+		return;
 
-		us_per_line = stream->timing.h_total * 10000 / stream->timing.pix_clk_100hz;
-		lines_to_vupdate = vupdate_line - vpos;
-		us_to_vupdate = lines_to_vupdate * us_per_line;
+	us_per_line =
+		stream->timing.h_total * 10000 / stream->timing.pix_clk_100hz;
+	lines_to_vupdate = vupdate_line - vpos;
+	us_to_vupdate = lines_to_vupdate * us_per_line;
 
-		/* 70 us is a conservative estimate of cursor update time*/
-		if (us_to_vupdate < 70)
-			udelay(us_to_vupdate);
-	}
+	/* 70 us is a conservative estimate of cursor update time*/
+	if (us_to_vupdate < 70)
+		udelay(us_to_vupdate);
 #endif
 }
 
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c linux-libre-5.6.14-gnu/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
--- linux-libre-5.6.13-gnu/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c	2020-05-20 02:22:38.000000000 -0400
@@ -2306,7 +2306,8 @@ void dcn20_fpga_init_hw(struct dc *dc)
 
 	REG_UPDATE(DCHUBBUB_GLOBAL_TIMER_CNTL, DCHUBBUB_GLOBAL_TIMER_REFDIV, 2);
 	REG_UPDATE(DCHUBBUB_GLOBAL_TIMER_CNTL, DCHUBBUB_GLOBAL_TIMER_ENABLE, 1);
-	REG_WRITE(REFCLK_CNTL, 0);
+	if (REG(REFCLK_CNTL))
+		REG_WRITE(REFCLK_CNTL, 0);
 	//
 
 
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c linux-libre-5.6.14-gnu/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c
--- linux-libre-5.6.13-gnu/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c	2020-05-20 02:22:38.000000000 -0400
@@ -250,7 +250,7 @@ struct _vcs_dpi_soc_bounding_box_st dcn2
 	.dram_channel_width_bytes = 4,
 	.fabric_datapath_to_dcn_data_return_bytes = 32,
 	.dcn_downspread_percent = 0.5,
-	.downspread_percent = 0.5,
+	.downspread_percent = 0.38,
 	.dram_page_open_time_ns = 50.0,
 	.dram_rw_turnaround_time_ns = 17.5,
 	.dram_return_buffer_per_channel_bytes = 8192,
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/gpu/drm/amd/powerplay/amd_powerplay.c linux-libre-5.6.14-gnu/drivers/gpu/drm/amd/powerplay/amd_powerplay.c
--- linux-libre-5.6.13-gnu/drivers/gpu/drm/amd/powerplay/amd_powerplay.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/gpu/drm/amd/powerplay/amd_powerplay.c	2020-05-20 02:22:38.000000000 -0400
@@ -1435,7 +1435,8 @@ static int pp_get_asic_baco_capability(v
 	if (!hwmgr)
 		return -EINVAL;
 
-	if (!hwmgr->pm_en || !hwmgr->hwmgr_func->get_asic_baco_capability)
+	if (!(hwmgr->not_vf && amdgpu_dpm) ||
+		!hwmgr->hwmgr_func->get_asic_baco_capability)
 		return 0;
 
 	mutex_lock(&hwmgr->smu_lock);
@@ -1469,7 +1470,8 @@ static int pp_set_asic_baco_state(void *
 	if (!hwmgr)
 		return -EINVAL;
 
-	if (!hwmgr->pm_en || !hwmgr->hwmgr_func->set_asic_baco_state)
+	if (!(hwmgr->not_vf && amdgpu_dpm) ||
+		!hwmgr->hwmgr_func->set_asic_baco_state)
 		return 0;
 
 	mutex_lock(&hwmgr->smu_lock);
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/gpu/drm/i915/display/intel_ddi.c linux-libre-5.6.14-gnu/drivers/gpu/drm/i915/display/intel_ddi.c
--- linux-libre-5.6.13-gnu/drivers/gpu/drm/i915/display/intel_ddi.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/gpu/drm/i915/display/intel_ddi.c	2020-05-20 02:22:38.000000000 -0400
@@ -3545,9 +3545,6 @@ static void hsw_ddi_pre_enable_dp(struct
 	intel_dp_set_link_params(intel_dp, crtc_state->port_clock,
 				 crtc_state->lane_count, is_mst);
 
-	intel_dp->regs.dp_tp_ctl = DP_TP_CTL(port);
-	intel_dp->regs.dp_tp_status = DP_TP_STATUS(port);
-
 	intel_edp_panel_on(intel_dp);
 
 	intel_ddi_clk_select(encoder, crtc_state);
@@ -4269,12 +4266,18 @@ void intel_ddi_get_config(struct intel_e
 	struct drm_i915_private *dev_priv = to_i915(encoder->base.dev);
 	struct intel_crtc *intel_crtc = to_intel_crtc(pipe_config->uapi.crtc);
 	enum transcoder cpu_transcoder = pipe_config->cpu_transcoder;
+	struct intel_dp *intel_dp = enc_to_intel_dp(encoder);
 	u32 temp, flags = 0;
 
 	/* XXX: DSI transcoder paranoia */
 	if (WARN_ON(transcoder_is_dsi(cpu_transcoder)))
 		return;
 
+	if (INTEL_GEN(dev_priv) >= 12) {
+		intel_dp->regs.dp_tp_ctl = TGL_DP_TP_CTL(cpu_transcoder);
+		intel_dp->regs.dp_tp_status = TGL_DP_TP_STATUS(cpu_transcoder);
+	}
+
 	intel_dsc_get_config(encoder, pipe_config);
 
 	temp = I915_READ(TRANS_DDI_FUNC_CTL(cpu_transcoder));
@@ -4492,6 +4495,7 @@ static const struct drm_encoder_funcs in
 static struct intel_connector *
 intel_ddi_init_dp_connector(struct intel_digital_port *intel_dig_port)
 {
+	struct drm_i915_private *dev_priv = to_i915(intel_dig_port->base.base.dev);
 	struct intel_connector *connector;
 	enum port port = intel_dig_port->base.port;
 
@@ -4502,6 +4506,10 @@ intel_ddi_init_dp_connector(struct intel
 	intel_dig_port->dp.output_reg = DDI_BUF_CTL(port);
 	intel_dig_port->dp.prepare_link_retrain =
 		intel_ddi_prepare_link_retrain;
+	if (INTEL_GEN(dev_priv) < 12) {
+		intel_dig_port->dp.regs.dp_tp_ctl = DP_TP_CTL(port);
+		intel_dig_port->dp.regs.dp_tp_status = DP_TP_STATUS(port);
+	}
 
 	if (!intel_dp_init_connector(intel_dig_port, connector)) {
 		kfree(connector);
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/gpu/drm/i915/display/intel_display_power.c linux-libre-5.6.14-gnu/drivers/gpu/drm/i915/display/intel_display_power.c
--- linux-libre-5.6.13-gnu/drivers/gpu/drm/i915/display/intel_display_power.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/gpu/drm/i915/display/intel_display_power.c	2020-05-20 02:22:38.000000000 -0400
@@ -4068,7 +4068,7 @@ static const struct i915_power_well_desc
 	{
 		.name = "AUX D TBT1",
 		.domains = TGL_AUX_D_TBT1_IO_POWER_DOMAINS,
-		.ops = &hsw_power_well_ops,
+		.ops = &icl_tc_phy_aux_power_well_ops,
 		.id = DISP_PW_ID_NONE,
 		{
 			.hsw.regs = &icl_aux_power_well_regs,
@@ -4079,7 +4079,7 @@ static const struct i915_power_well_desc
 	{
 		.name = "AUX E TBT2",
 		.domains = TGL_AUX_E_TBT2_IO_POWER_DOMAINS,
-		.ops = &hsw_power_well_ops,
+		.ops = &icl_tc_phy_aux_power_well_ops,
 		.id = DISP_PW_ID_NONE,
 		{
 			.hsw.regs = &icl_aux_power_well_regs,
@@ -4090,7 +4090,7 @@ static const struct i915_power_well_desc
 	{
 		.name = "AUX F TBT3",
 		.domains = TGL_AUX_F_TBT3_IO_POWER_DOMAINS,
-		.ops = &hsw_power_well_ops,
+		.ops = &icl_tc_phy_aux_power_well_ops,
 		.id = DISP_PW_ID_NONE,
 		{
 			.hsw.regs = &icl_aux_power_well_regs,
@@ -4101,7 +4101,7 @@ static const struct i915_power_well_desc
 	{
 		.name = "AUX G TBT4",
 		.domains = TGL_AUX_G_TBT4_IO_POWER_DOMAINS,
-		.ops = &hsw_power_well_ops,
+		.ops = &icl_tc_phy_aux_power_well_ops,
 		.id = DISP_PW_ID_NONE,
 		{
 			.hsw.regs = &icl_aux_power_well_regs,
@@ -4112,7 +4112,7 @@ static const struct i915_power_well_desc
 	{
 		.name = "AUX H TBT5",
 		.domains = TGL_AUX_H_TBT5_IO_POWER_DOMAINS,
-		.ops = &hsw_power_well_ops,
+		.ops = &icl_tc_phy_aux_power_well_ops,
 		.id = DISP_PW_ID_NONE,
 		{
 			.hsw.regs = &icl_aux_power_well_regs,
@@ -4123,7 +4123,7 @@ static const struct i915_power_well_desc
 	{
 		.name = "AUX I TBT6",
 		.domains = TGL_AUX_I_TBT6_IO_POWER_DOMAINS,
-		.ops = &hsw_power_well_ops,
+		.ops = &icl_tc_phy_aux_power_well_ops,
 		.id = DISP_PW_ID_NONE,
 		{
 			.hsw.regs = &icl_aux_power_well_regs,
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/gpu/drm/i915/display/intel_dp.c linux-libre-5.6.14-gnu/drivers/gpu/drm/i915/display/intel_dp.c
--- linux-libre-5.6.13-gnu/drivers/gpu/drm/i915/display/intel_dp.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/gpu/drm/i915/display/intel_dp.c	2020-05-20 02:22:38.000000000 -0400
@@ -2492,9 +2492,6 @@ static void intel_dp_prepare(struct inte
 				 intel_crtc_has_type(pipe_config,
 						     INTEL_OUTPUT_DP_MST));
 
-	intel_dp->regs.dp_tp_ctl = DP_TP_CTL(port);
-	intel_dp->regs.dp_tp_status = DP_TP_STATUS(port);
-
 	/*
 	 * There are four kinds of DP registers:
 	 *
@@ -7616,6 +7613,8 @@ bool intel_dp_init(struct drm_i915_priva
 
 	intel_dig_port->dp.output_reg = output_reg;
 	intel_dig_port->max_lanes = 4;
+	intel_dig_port->dp.regs.dp_tp_ctl = DP_TP_CTL(port);
+	intel_dig_port->dp.regs.dp_tp_status = DP_TP_STATUS(port);
 
 	intel_encoder->type = INTEL_OUTPUT_DP;
 	intel_encoder->power_domain = intel_port_to_power_domain(port);
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/gpu/drm/i915/display/intel_fbc.c linux-libre-5.6.14-gnu/drivers/gpu/drm/i915/display/intel_fbc.c
--- linux-libre-5.6.13-gnu/drivers/gpu/drm/i915/display/intel_fbc.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/gpu/drm/i915/display/intel_fbc.c	2020-05-20 02:22:38.000000000 -0400
@@ -478,8 +478,7 @@ static int intel_fbc_alloc_cfb(struct dr
 	if (!ret)
 		goto err_llb;
 	else if (ret > 1) {
-		DRM_INFO("Reducing the compressed framebuffer size. This may lead to less power savings than a non-reduced-size. Try to increase stolen memory size if available in BIOS.\n");
-
+		DRM_INFO_ONCE("Reducing the compressed framebuffer size. This may lead to less power savings than a non-reduced-size. Try to increase stolen memory size if available in BIOS.\n");
 	}
 
 	fbc->threshold = ret;
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/gpu/drm/i915/display/intel_sprite.c linux-libre-5.6.14-gnu/drivers/gpu/drm/i915/display/intel_sprite.c
--- linux-libre-5.6.13-gnu/drivers/gpu/drm/i915/display/intel_sprite.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/gpu/drm/i915/display/intel_sprite.c	2020-05-20 02:22:38.000000000 -0400
@@ -2754,19 +2754,25 @@ static bool skl_plane_format_mod_support
 	}
 }
 
-static bool gen12_plane_supports_mc_ccs(enum plane_id plane_id)
+static bool gen12_plane_supports_mc_ccs(struct drm_i915_private *dev_priv,
+					enum plane_id plane_id)
 {
+	/* Wa_14010477008:tgl[a0..c0] */
+	if (IS_TGL_REVID(dev_priv, TGL_REVID_A0, TGL_REVID_C0))
+		return false;
+
 	return plane_id < PLANE_SPRITE4;
 }
 
 static bool gen12_plane_format_mod_supported(struct drm_plane *_plane,
 					     u32 format, u64 modifier)
 {
+	struct drm_i915_private *dev_priv = to_i915(_plane->dev);
 	struct intel_plane *plane = to_intel_plane(_plane);
 
 	switch (modifier) {
 	case I915_FORMAT_MOD_Y_TILED_GEN12_MC_CCS:
-		if (!gen12_plane_supports_mc_ccs(plane->id))
+		if (!gen12_plane_supports_mc_ccs(dev_priv, plane->id))
 			return false;
 		/* fall through */
 	case DRM_FORMAT_MOD_LINEAR:
@@ -2935,9 +2941,10 @@ static const u32 *icl_get_plane_formats(
 	}
 }
 
-static const u64 *gen12_get_plane_modifiers(enum plane_id plane_id)
+static const u64 *gen12_get_plane_modifiers(struct drm_i915_private *dev_priv,
+					    enum plane_id plane_id)
 {
-	if (gen12_plane_supports_mc_ccs(plane_id))
+	if (gen12_plane_supports_mc_ccs(dev_priv, plane_id))
 		return gen12_plane_format_modifiers_mc_ccs;
 	else
 		return gen12_plane_format_modifiers_rc_ccs;
@@ -3008,7 +3015,7 @@ skl_universal_plane_create(struct drm_i9
 
 	plane->has_ccs = skl_plane_has_ccs(dev_priv, pipe, plane_id);
 	if (INTEL_GEN(dev_priv) >= 12) {
-		modifiers = gen12_get_plane_modifiers(plane_id);
+		modifiers = gen12_get_plane_modifiers(dev_priv, plane_id);
 		plane_funcs = &gen12_plane_funcs;
 	} else {
 		if (plane->has_ccs)
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/gpu/drm/i915/gem/i915_gem_domain.c linux-libre-5.6.14-gnu/drivers/gpu/drm/i915/gem/i915_gem_domain.c
--- linux-libre-5.6.13-gnu/drivers/gpu/drm/i915/gem/i915_gem_domain.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/gpu/drm/i915/gem/i915_gem_domain.c	2020-05-20 02:22:38.000000000 -0400
@@ -368,7 +368,6 @@ static void i915_gem_object_bump_inactiv
 	struct drm_i915_private *i915 = to_i915(obj->base.dev);
 	struct i915_vma *vma;
 
-	GEM_BUG_ON(!i915_gem_object_has_pinned_pages(obj));
 	if (!atomic_read(&obj->bind_count))
 		return;
 
@@ -400,12 +399,8 @@ static void i915_gem_object_bump_inactiv
 void
 i915_gem_object_unpin_from_display_plane(struct i915_vma *vma)
 {
-	struct drm_i915_gem_object *obj = vma->obj;
-
-	assert_object_held(obj);
-
 	/* Bump the LRU to try and avoid premature eviction whilst flipping  */
-	i915_gem_object_bump_inactive_ggtt(obj);
+	i915_gem_object_bump_inactive_ggtt(vma->obj);
 
 	i915_vma_unpin(vma);
 }
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/gpu/drm/i915/gt/intel_engine.h linux-libre-5.6.14-gnu/drivers/gpu/drm/i915/gt/intel_engine.h
--- linux-libre-5.6.13-gnu/drivers/gpu/drm/i915/gt/intel_engine.h	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/gpu/drm/i915/gt/intel_engine.h	2020-05-20 02:22:38.000000000 -0400
@@ -338,13 +338,4 @@ intel_engine_has_preempt_reset(const str
 	return intel_engine_has_preemption(engine);
 }
 
-static inline bool
-intel_engine_has_timeslices(const struct intel_engine_cs *engine)
-{
-	if (!IS_ACTIVE(CONFIG_DRM_I915_TIMESLICE_DURATION))
-		return false;
-
-	return intel_engine_has_semaphores(engine);
-}
-
 #endif /* _INTEL_RINGBUFFER_H_ */
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/gpu/drm/i915/gt/intel_engine_types.h linux-libre-5.6.14-gnu/drivers/gpu/drm/i915/gt/intel_engine_types.h
--- linux-libre-5.6.13-gnu/drivers/gpu/drm/i915/gt/intel_engine_types.h	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/gpu/drm/i915/gt/intel_engine_types.h	2020-05-20 02:22:38.000000000 -0400
@@ -473,10 +473,11 @@ struct intel_engine_cs {
 #define I915_ENGINE_SUPPORTS_STATS   BIT(1)
 #define I915_ENGINE_HAS_PREEMPTION   BIT(2)
 #define I915_ENGINE_HAS_SEMAPHORES   BIT(3)
-#define I915_ENGINE_NEEDS_BREADCRUMB_TASKLET BIT(4)
-#define I915_ENGINE_IS_VIRTUAL       BIT(5)
-#define I915_ENGINE_HAS_RELATIVE_MMIO BIT(6)
-#define I915_ENGINE_REQUIRES_CMD_PARSER BIT(7)
+#define I915_ENGINE_HAS_TIMESLICES   BIT(4)
+#define I915_ENGINE_NEEDS_BREADCRUMB_TASKLET BIT(5)
+#define I915_ENGINE_IS_VIRTUAL       BIT(6)
+#define I915_ENGINE_HAS_RELATIVE_MMIO BIT(7)
+#define I915_ENGINE_REQUIRES_CMD_PARSER BIT(8)
 	unsigned int flags;
 
 	/*
@@ -574,6 +575,15 @@ intel_engine_has_semaphores(const struct
 }
 
 static inline bool
+intel_engine_has_timeslices(const struct intel_engine_cs *engine)
+{
+	if (!IS_ACTIVE(CONFIG_DRM_I915_TIMESLICE_DURATION))
+		return false;
+
+	return engine->flags & I915_ENGINE_HAS_TIMESLICES;
+}
+
+static inline bool
 intel_engine_needs_breadcrumb_tasklet(const struct intel_engine_cs *engine)
 {
 	return engine->flags & I915_ENGINE_NEEDS_BREADCRUMB_TASKLET;
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/gpu/drm/i915/gt/intel_lrc.c linux-libre-5.6.14-gnu/drivers/gpu/drm/i915/gt/intel_lrc.c
--- linux-libre-5.6.13-gnu/drivers/gpu/drm/i915/gt/intel_lrc.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/gpu/drm/i915/gt/intel_lrc.c	2020-05-20 02:22:38.000000000 -0400
@@ -1626,6 +1626,9 @@ static void defer_request(struct i915_re
 			struct i915_request *w =
 				container_of(p->waiter, typeof(*w), sched);
 
+			if (p->flags & I915_DEPENDENCY_WEAK)
+				continue;
+
 			/* Leave semaphores spinning on the other engines */
 			if (w->engine != rq->engine)
 				continue;
@@ -4194,8 +4197,11 @@ void intel_execlists_set_default_submiss
 	engine->flags |= I915_ENGINE_SUPPORTS_STATS;
 	if (!intel_vgpu_active(engine->i915)) {
 		engine->flags |= I915_ENGINE_HAS_SEMAPHORES;
-		if (HAS_LOGICAL_RING_PREEMPTION(engine->i915))
+		if (HAS_LOGICAL_RING_PREEMPTION(engine->i915)) {
 			engine->flags |= I915_ENGINE_HAS_PREEMPTION;
+			if (IS_ACTIVE(CONFIG_DRM_I915_TIMESLICE_DURATION))
+				engine->flags |= I915_ENGINE_HAS_TIMESLICES;
+		}
 	}
 
 	if (INTEL_GEN(engine->i915) >= 12)
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/gpu/drm/i915/gvt/scheduler.c linux-libre-5.6.14-gnu/drivers/gpu/drm/i915/gvt/scheduler.c
--- linux-libre-5.6.13-gnu/drivers/gpu/drm/i915/gvt/scheduler.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/gpu/drm/i915/gvt/scheduler.c	2020-05-20 02:22:38.000000000 -0400
@@ -375,7 +375,11 @@ static void set_context_ppgtt_from_shado
 		for (i = 0; i < GVT_RING_CTX_NR_PDPS; i++) {
 			struct i915_page_directory * const pd =
 				i915_pd_entry(ppgtt->pd, i);
-
+			/* skip now as current i915 ppgtt alloc won't allocate
+			   top level pdp for non 4-level table, won't impact
+			   shadow ppgtt. */
+			if (!pd)
+				break;
 			px_dma(pd) = mm->ppgtt_mm.shadow_pdps[i];
 		}
 	}
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/gpu/drm/i915/i915_drv.h linux-libre-5.6.14-gnu/drivers/gpu/drm/i915/i915_drv.h
--- linux-libre-5.6.13-gnu/drivers/gpu/drm/i915/i915_drv.h	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/gpu/drm/i915/i915_drv.h	2020-05-20 02:22:38.000000000 -0400
@@ -1601,6 +1601,8 @@ IS_SUBPLATFORM(const struct drm_i915_pri
 	(IS_ICELAKE(p) && IS_REVID(p, since, until))
 
 #define TGL_REVID_A0		0x0
+#define TGL_REVID_B0		0x1
+#define TGL_REVID_C0		0x2
 
 #define IS_TGL_REVID(p, since, until) \
 	(IS_TIGERLAKE(p) && IS_REVID(p, since, until))
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/gpu/drm/i915/i915_gem_evict.c linux-libre-5.6.14-gnu/drivers/gpu/drm/i915/i915_gem_evict.c
--- linux-libre-5.6.13-gnu/drivers/gpu/drm/i915/i915_gem_evict.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/gpu/drm/i915/i915_gem_evict.c	2020-05-20 02:22:38.000000000 -0400
@@ -130,6 +130,13 @@ search_again:
 	active = NULL;
 	INIT_LIST_HEAD(&eviction_list);
 	list_for_each_entry_safe(vma, next, &vm->bound_list, vm_link) {
+		if (vma == active) { /* now seen this vma twice */
+			if (flags & PIN_NONBLOCK)
+				break;
+
+			active = ERR_PTR(-EAGAIN);
+		}
+
 		/*
 		 * We keep this list in a rough least-recently scanned order
 		 * of active elements (inactive elements are cheap to reap).
@@ -145,21 +152,12 @@ search_again:
 		 * To notice when we complete one full cycle, we record the
 		 * first active element seen, before moving it to the tail.
 		 */
-		if (i915_vma_is_active(vma)) {
-			if (vma == active) {
-				if (flags & PIN_NONBLOCK)
-					break;
-
-				active = ERR_PTR(-EAGAIN);
-			}
-
-			if (active != ERR_PTR(-EAGAIN)) {
-				if (!active)
-					active = vma;
+		if (active != ERR_PTR(-EAGAIN) && i915_vma_is_active(vma)) {
+			if (!active)
+				active = vma;
 
-				list_move_tail(&vma->vm_link, &vm->bound_list);
-				continue;
-			}
+			list_move_tail(&vma->vm_link, &vm->bound_list);
+			continue;
 		}
 
 		if (mark_free(&scan, vma, flags, &eviction_list))
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/gpu/drm/i915/i915_irq.c linux-libre-5.6.14-gnu/drivers/gpu/drm/i915/i915_irq.c
--- linux-libre-5.6.13-gnu/drivers/gpu/drm/i915/i915_irq.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/gpu/drm/i915/i915_irq.c	2020-05-20 02:22:38.000000000 -0400
@@ -3324,7 +3324,7 @@ static void gen8_de_irq_postinstall(stru
 	u32 de_pipe_masked = gen8_de_pipe_fault_mask(dev_priv) |
 		GEN8_PIPE_CDCLK_CRC_DONE;
 	u32 de_pipe_enables;
-	u32 de_port_masked = GEN8_AUX_CHANNEL_A;
+	u32 de_port_masked = gen8_de_port_aux_mask(dev_priv);
 	u32 de_port_enables;
 	u32 de_misc_masked = GEN8_DE_EDP_PSR;
 	enum pipe pipe;
@@ -3332,18 +3332,8 @@ static void gen8_de_irq_postinstall(stru
 	if (INTEL_GEN(dev_priv) <= 10)
 		de_misc_masked |= GEN8_DE_MISC_GSE;
 
-	if (INTEL_GEN(dev_priv) >= 9) {
-		de_port_masked |= GEN9_AUX_CHANNEL_B | GEN9_AUX_CHANNEL_C |
-				  GEN9_AUX_CHANNEL_D;
-		if (IS_GEN9_LP(dev_priv))
-			de_port_masked |= BXT_DE_PORT_GMBUS;
-	}
-
-	if (INTEL_GEN(dev_priv) >= 11)
-		de_port_masked |= ICL_AUX_CHANNEL_E;
-
-	if (IS_CNL_WITH_PORT_F(dev_priv) || INTEL_GEN(dev_priv) >= 11)
-		de_port_masked |= CNL_AUX_CHANNEL_F;
+	if (IS_GEN9_LP(dev_priv))
+		de_port_masked |= BXT_DE_PORT_GMBUS;
 
 	de_pipe_enables = de_pipe_masked | GEN8_PIPE_VBLANK |
 					   GEN8_PIPE_FIFO_UNDERRUN;
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/gpu/drm/i915/i915_request.c linux-libre-5.6.14-gnu/drivers/gpu/drm/i915/i915_request.c
--- linux-libre-5.6.13-gnu/drivers/gpu/drm/i915/i915_request.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/gpu/drm/i915/i915_request.c	2020-05-20 02:22:38.000000000 -0400
@@ -951,7 +951,9 @@ i915_request_await_request(struct i915_r
 		return 0;
 
 	if (to->engine->schedule) {
-		ret = i915_sched_node_add_dependency(&to->sched, &from->sched);
+		ret = i915_sched_node_add_dependency(&to->sched,
+						     &from->sched,
+						     I915_DEPENDENCY_EXTERNAL);
 		if (ret < 0)
 			return ret;
 	}
@@ -1084,7 +1086,9 @@ __i915_request_await_execution(struct i9
 
 	/* Couple the dependency tree for PI on this exposed to->fence */
 	if (to->engine->schedule) {
-		err = i915_sched_node_add_dependency(&to->sched, &from->sched);
+		err = i915_sched_node_add_dependency(&to->sched,
+						     &from->sched,
+						     I915_DEPENDENCY_WEAK);
 		if (err < 0)
 			return err;
 	}
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/gpu/drm/i915/i915_scheduler.c linux-libre-5.6.14-gnu/drivers/gpu/drm/i915/i915_scheduler.c
--- linux-libre-5.6.13-gnu/drivers/gpu/drm/i915/i915_scheduler.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/gpu/drm/i915/i915_scheduler.c	2020-05-20 02:22:38.000000000 -0400
@@ -455,7 +455,8 @@ bool __i915_sched_node_add_dependency(st
 }
 
 int i915_sched_node_add_dependency(struct i915_sched_node *node,
-				   struct i915_sched_node *signal)
+				   struct i915_sched_node *signal,
+				   unsigned long flags)
 {
 	struct i915_dependency *dep;
 
@@ -464,8 +465,7 @@ int i915_sched_node_add_dependency(struc
 		return -ENOMEM;
 
 	if (!__i915_sched_node_add_dependency(node, signal, dep,
-					      I915_DEPENDENCY_EXTERNAL |
-					      I915_DEPENDENCY_ALLOC))
+					      flags | I915_DEPENDENCY_ALLOC))
 		i915_dependency_free(dep);
 
 	return 0;
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/gpu/drm/i915/i915_scheduler.h linux-libre-5.6.14-gnu/drivers/gpu/drm/i915/i915_scheduler.h
--- linux-libre-5.6.13-gnu/drivers/gpu/drm/i915/i915_scheduler.h	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/gpu/drm/i915/i915_scheduler.h	2020-05-20 02:22:38.000000000 -0400
@@ -34,7 +34,8 @@ bool __i915_sched_node_add_dependency(st
 				      unsigned long flags);
 
 int i915_sched_node_add_dependency(struct i915_sched_node *node,
-				   struct i915_sched_node *signal);
+				   struct i915_sched_node *signal,
+				   unsigned long flags);
 
 void i915_sched_node_fini(struct i915_sched_node *node);
 
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/gpu/drm/i915/i915_scheduler_types.h linux-libre-5.6.14-gnu/drivers/gpu/drm/i915/i915_scheduler_types.h
--- linux-libre-5.6.13-gnu/drivers/gpu/drm/i915/i915_scheduler_types.h	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/gpu/drm/i915/i915_scheduler_types.h	2020-05-20 02:22:38.000000000 -0400
@@ -78,6 +78,7 @@ struct i915_dependency {
 	unsigned long flags;
 #define I915_DEPENDENCY_ALLOC		BIT(0)
 #define I915_DEPENDENCY_EXTERNAL	BIT(1)
+#define I915_DEPENDENCY_WEAK		BIT(2)
 };
 
 #endif /* _I915_SCHEDULER_TYPES_H_ */
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/gpu/drm/i915/intel_pm.c linux-libre-5.6.14-gnu/drivers/gpu/drm/i915/intel_pm.c
--- linux-libre-5.6.13-gnu/drivers/gpu/drm/i915/intel_pm.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/gpu/drm/i915/intel_pm.c	2020-05-20 02:22:38.000000000 -0400
@@ -4722,7 +4722,7 @@ static void skl_compute_plane_wm(const s
 	 * WaIncreaseLatencyIPCEnabled: kbl,cfl
 	 * Display WA #1141: kbl,cfl
 	 */
-	if ((IS_KABYLAKE(dev_priv) || IS_COFFEELAKE(dev_priv)) ||
+	if ((IS_KABYLAKE(dev_priv) || IS_COFFEELAKE(dev_priv)) &&
 	    dev_priv->ipc_enabled)
 		latency += 4;
 
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/gpu/drm/qxl/qxl_image.c linux-libre-5.6.14-gnu/drivers/gpu/drm/qxl/qxl_image.c
--- linux-libre-5.6.13-gnu/drivers/gpu/drm/qxl/qxl_image.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/gpu/drm/qxl/qxl_image.c	2020-05-20 02:22:38.000000000 -0400
@@ -212,7 +212,8 @@ qxl_image_init_helper(struct qxl_device
 		break;
 	default:
 		DRM_ERROR("unsupported image bit depth\n");
-		return -EINVAL; /* TODO: cleanup */
+		qxl_bo_kunmap_atomic_page(qdev, image_bo, ptr);
+		return -EINVAL;
 	}
 	image->u.bitmap.flags = QXL_BITMAP_TOP_DOWN;
 	image->u.bitmap.x = width;
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c linux-libre-5.6.14-gnu/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c
--- linux-libre-5.6.13-gnu/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c	2020-05-20 02:22:38.000000000 -0400
@@ -719,7 +719,7 @@ static void sun6i_dsi_encoder_enable(str
 	struct drm_display_mode *mode = &encoder->crtc->state->adjusted_mode;
 	struct sun6i_dsi *dsi = encoder_to_sun6i_dsi(encoder);
 	struct mipi_dsi_device *device = dsi->device;
-	union phy_configure_opts opts = { 0 };
+	union phy_configure_opts opts = { };
 	struct phy_configure_opts_mipi_dphy *cfg = &opts.mipi_dphy;
 	u16 delay;
 
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/gpu/drm/tegra/drm.c linux-libre-5.6.14-gnu/drivers/gpu/drm/tegra/drm.c
--- linux-libre-5.6.13-gnu/drivers/gpu/drm/tegra/drm.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/gpu/drm/tegra/drm.c	2020-05-20 02:22:38.000000000 -0400
@@ -1039,6 +1039,7 @@ void tegra_drm_free(struct tegra_drm *te
 
 static bool host1x_drm_wants_iommu(struct host1x_device *dev)
 {
+	struct host1x *host1x = dev_get_drvdata(dev->dev.parent);
 	struct iommu_domain *domain;
 
 	/*
@@ -1076,7 +1077,7 @@ static bool host1x_drm_wants_iommu(struc
 	 * sufficient and whether or not the host1x is attached to an IOMMU
 	 * doesn't matter.
 	 */
-	if (!domain && dma_get_mask(dev->dev.parent) <= DMA_BIT_MASK(32))
+	if (!domain && host1x_get_dma_mask(host1x) <= DMA_BIT_MASK(32))
 		return true;
 
 	return domain != NULL;
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/gpu/host1x/dev.c linux-libre-5.6.14-gnu/drivers/gpu/host1x/dev.c
--- linux-libre-5.6.13-gnu/drivers/gpu/host1x/dev.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/gpu/host1x/dev.c	2020-05-20 02:22:38.000000000 -0400
@@ -502,6 +502,19 @@ static void __exit tegra_host1x_exit(voi
 }
 module_exit(tegra_host1x_exit);
 
+/**
+ * host1x_get_dma_mask() - query the supported DMA mask for host1x
+ * @host1x: host1x instance
+ *
+ * Note that this returns the supported DMA mask for host1x, which can be
+ * different from the applicable DMA mask under certain circumstances.
+ */
+u64 host1x_get_dma_mask(struct host1x *host1x)
+{
+	return host1x->info->dma_mask;
+}
+EXPORT_SYMBOL(host1x_get_dma_mask);
+
 MODULE_AUTHOR("Thierry Reding <thierry.reding@avionic-design.de>");
 MODULE_AUTHOR("Terje Bergstrom <tbergstrom@nvidia.com>");
 MODULE_DESCRIPTION("Host1x driver for Tegra products");
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/hwmon/da9052-hwmon.c linux-libre-5.6.14-gnu/drivers/hwmon/da9052-hwmon.c
--- linux-libre-5.6.13-gnu/drivers/hwmon/da9052-hwmon.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/hwmon/da9052-hwmon.c	2020-05-20 02:22:38.000000000 -0400
@@ -244,9 +244,9 @@ static ssize_t da9052_tsi_show(struct de
 	int channel = to_sensor_dev_attr(devattr)->index;
 	int ret;
 
-	mutex_lock(&hwmon->hwmon_lock);
+	mutex_lock(&hwmon->da9052->auxadc_lock);
 	ret = __da9052_read_tsi(dev, channel);
-	mutex_unlock(&hwmon->hwmon_lock);
+	mutex_unlock(&hwmon->da9052->auxadc_lock);
 
 	if (ret < 0)
 		return ret;
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/hwmon/drivetemp.c linux-libre-5.6.14-gnu/drivers/hwmon/drivetemp.c
--- linux-libre-5.6.13-gnu/drivers/hwmon/drivetemp.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/hwmon/drivetemp.c	2020-05-20 02:22:38.000000000 -0400
@@ -346,7 +346,7 @@ static int drivetemp_identify_sata(struc
 	st->have_temp_highest = temp_is_valid(buf[SCT_STATUS_TEMP_HIGHEST]);
 
 	if (!have_sct_data_table)
-		goto skip_sct;
+		goto skip_sct_data;
 
 	/* Request and read temperature history table */
 	memset(buf, '\0', sizeof(st->smartdata));
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/infiniband/core/cache.c linux-libre-5.6.14-gnu/drivers/infiniband/core/cache.c
--- linux-libre-5.6.13-gnu/drivers/infiniband/core/cache.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/infiniband/core/cache.c	2020-05-20 02:22:38.000000000 -0400
@@ -1536,8 +1536,11 @@ int ib_cache_setup_one(struct ib_device
 	if (err)
 		return err;
 
-	rdma_for_each_port (device, p)
-		ib_cache_update(device, p, true);
+	rdma_for_each_port (device, p) {
+		err = ib_cache_update(device, p, true);
+		if (err)
+			return err;
+	}
 
 	return 0;
 }
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/infiniband/core/nldev.c linux-libre-5.6.14-gnu/drivers/infiniband/core/nldev.c
--- linux-libre-5.6.13-gnu/drivers/infiniband/core/nldev.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/infiniband/core/nldev.c	2020-05-20 02:22:38.000000000 -0400
@@ -1292,11 +1292,10 @@ static int res_get_common_doit(struct sk
 	has_cap_net_admin = netlink_capable(skb, CAP_NET_ADMIN);
 
 	ret = fill_func(msg, has_cap_net_admin, res, port);
-
-	rdma_restrack_put(res);
 	if (ret)
 		goto err_free;
 
+	rdma_restrack_put(res);
 	nlmsg_end(msg, nlh);
 	ib_device_put(device);
 	return rdma_nl_unicast(sock_net(skb->sk), msg, NETLINK_CB(skb).portid);
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/infiniband/core/rdma_core.c linux-libre-5.6.14-gnu/drivers/infiniband/core/rdma_core.c
--- linux-libre-5.6.13-gnu/drivers/infiniband/core/rdma_core.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/infiniband/core/rdma_core.c	2020-05-20 02:22:38.000000000 -0400
@@ -459,7 +459,8 @@ alloc_begin_fd_uobject(const struct uver
 	struct ib_uobject *uobj;
 	struct file *filp;
 
-	if (WARN_ON(fd_type->fops->release != &uverbs_uobject_fd_release))
+	if (WARN_ON(fd_type->fops->release != &uverbs_uobject_fd_release &&
+		    fd_type->fops->release != &uverbs_async_event_release))
 		return ERR_PTR(-EINVAL);
 
 	new_fd = get_unused_fd_flags(O_CLOEXEC);
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/infiniband/core/uverbs.h linux-libre-5.6.14-gnu/drivers/infiniband/core/uverbs.h
--- linux-libre-5.6.13-gnu/drivers/infiniband/core/uverbs.h	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/infiniband/core/uverbs.h	2020-05-20 02:22:38.000000000 -0400
@@ -219,6 +219,7 @@ void ib_uverbs_init_event_queue(struct i
 void ib_uverbs_init_async_event_file(struct ib_uverbs_async_event_file *ev_file);
 void ib_uverbs_free_event_queue(struct ib_uverbs_event_queue *event_queue);
 void ib_uverbs_flow_resources_free(struct ib_uflow_resources *uflow_res);
+int uverbs_async_event_release(struct inode *inode, struct file *filp);
 
 int ib_alloc_ucontext(struct uverbs_attr_bundle *attrs);
 int ib_init_ucontext(struct uverbs_attr_bundle *attrs);
@@ -227,6 +228,9 @@ void ib_uverbs_release_ucq(struct ib_uve
 			   struct ib_ucq_object *uobj);
 void ib_uverbs_release_uevent(struct ib_uevent_object *uobj);
 void ib_uverbs_release_file(struct kref *ref);
+void ib_uverbs_async_handler(struct ib_uverbs_async_event_file *async_file,
+			     __u64 element, __u64 event,
+			     struct list_head *obj_list, u32 *counter);
 
 void ib_uverbs_comp_handler(struct ib_cq *cq, void *cq_context);
 void ib_uverbs_cq_event_handler(struct ib_event *event, void *context_ptr);
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/infiniband/core/uverbs_main.c linux-libre-5.6.14-gnu/drivers/infiniband/core/uverbs_main.c
--- linux-libre-5.6.13-gnu/drivers/infiniband/core/uverbs_main.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/infiniband/core/uverbs_main.c	2020-05-20 02:22:38.000000000 -0400
@@ -346,7 +346,7 @@ const struct file_operations uverbs_asyn
 	.owner	 = THIS_MODULE,
 	.read	 = ib_uverbs_async_event_read,
 	.poll    = ib_uverbs_async_event_poll,
-	.release = uverbs_uobject_fd_release,
+	.release = uverbs_async_event_release,
 	.fasync  = ib_uverbs_async_event_fasync,
 	.llseek	 = no_llseek,
 };
@@ -386,10 +386,9 @@ void ib_uverbs_comp_handler(struct ib_cq
 	kill_fasync(&ev_queue->async_queue, SIGIO, POLL_IN);
 }
 
-static void
-ib_uverbs_async_handler(struct ib_uverbs_async_event_file *async_file,
-			__u64 element, __u64 event, struct list_head *obj_list,
-			u32 *counter)
+void ib_uverbs_async_handler(struct ib_uverbs_async_event_file *async_file,
+			     __u64 element, __u64 event,
+			     struct list_head *obj_list, u32 *counter)
 {
 	struct ib_uverbs_event *entry;
 	unsigned long flags;
@@ -1187,9 +1186,6 @@ static void ib_uverbs_free_hw_resources(
 		 */
 		mutex_unlock(&uverbs_dev->lists_mutex);
 
-		ib_uverbs_async_handler(READ_ONCE(file->async_file), 0,
-					IB_EVENT_DEVICE_FATAL, NULL, NULL);
-
 		uverbs_destroy_ufile_hw(file, RDMA_REMOVE_DRIVER_REMOVE);
 		kref_put(&file->ref, ib_uverbs_release_file);
 
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/infiniband/core/uverbs_std_types_async_fd.c linux-libre-5.6.14-gnu/drivers/infiniband/core/uverbs_std_types_async_fd.c
--- linux-libre-5.6.13-gnu/drivers/infiniband/core/uverbs_std_types_async_fd.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/infiniband/core/uverbs_std_types_async_fd.c	2020-05-20 02:22:38.000000000 -0400
@@ -26,10 +26,38 @@ static int uverbs_async_event_destroy_uo
 		container_of(uobj, struct ib_uverbs_async_event_file, uobj);
 
 	ib_unregister_event_handler(&event_file->event_handler);
-	ib_uverbs_free_event_queue(&event_file->ev_queue);
+
+	if (why == RDMA_REMOVE_DRIVER_REMOVE)
+		ib_uverbs_async_handler(event_file, 0, IB_EVENT_DEVICE_FATAL,
+					NULL, NULL);
 	return 0;
 }
 
+int uverbs_async_event_release(struct inode *inode, struct file *filp)
+{
+	struct ib_uverbs_async_event_file *event_file;
+	struct ib_uobject *uobj = filp->private_data;
+	int ret;
+
+	if (!uobj)
+		return uverbs_uobject_fd_release(inode, filp);
+
+	event_file =
+		container_of(uobj, struct ib_uverbs_async_event_file, uobj);
+
+	/*
+	 * The async event FD has to deliver IB_EVENT_DEVICE_FATAL even after
+	 * disassociation, so cleaning the event list must only happen after
+	 * release. The user knows it has reached the end of the event stream
+	 * when it sees IB_EVENT_DEVICE_FATAL.
+	 */
+	uverbs_uobject_get(uobj);
+	ret = uverbs_uobject_fd_release(inode, filp);
+	ib_uverbs_free_event_queue(&event_file->ev_queue);
+	uverbs_uobject_put(uobj);
+	return ret;
+}
+
 DECLARE_UVERBS_NAMED_METHOD(
 	UVERBS_METHOD_ASYNC_EVENT_ALLOC,
 	UVERBS_ATTR_FD(UVERBS_ATTR_ASYNC_EVENT_ALLOC_FD_HANDLE,
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/infiniband/hw/cxgb4/cm.c linux-libre-5.6.14-gnu/drivers/infiniband/hw/cxgb4/cm.c
--- linux-libre-5.6.13-gnu/drivers/infiniband/hw/cxgb4/cm.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/infiniband/hw/cxgb4/cm.c	2020-05-20 02:22:38.000000000 -0400
@@ -2891,8 +2891,7 @@ static int peer_abort(struct c4iw_dev *d
 			srqidx = ABORT_RSS_SRQIDX_G(
 					be32_to_cpu(req->srqidx_status));
 			if (srqidx) {
-				complete_cached_srq_buffers(ep,
-							    req->srqidx_status);
+				complete_cached_srq_buffers(ep, srqidx);
 			} else {
 				/* Hold ep ref until finish_peer_abort() */
 				c4iw_get_ep(&ep->com);
@@ -3878,8 +3877,8 @@ static int read_tcb_rpl(struct c4iw_dev
 		return 0;
 	}
 
-	ep->srqe_idx = t4_tcb_get_field32(tcb, TCB_RQ_START_W, TCB_RQ_START_W,
-			TCB_RQ_START_S);
+	ep->srqe_idx = t4_tcb_get_field32(tcb, TCB_RQ_START_W, TCB_RQ_START_M,
+					  TCB_RQ_START_S);
 cleanup:
 	pr_debug("ep %p tid %u %016x\n", ep, ep->hwtid, ep->srqe_idx);
 
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/infiniband/hw/hfi1/user_sdma.c linux-libre-5.6.14-gnu/drivers/infiniband/hw/hfi1/user_sdma.c
--- linux-libre-5.6.13-gnu/drivers/infiniband/hw/hfi1/user_sdma.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/infiniband/hw/hfi1/user_sdma.c	2020-05-20 02:22:38.000000000 -0400
@@ -589,10 +589,6 @@ int hfi1_user_sdma_process_request(struc
 
 	set_comp_state(pq, cq, info.comp_idx, QUEUED, 0);
 	pq->state = SDMA_PKT_Q_ACTIVE;
-	/* Send the first N packets in the request to buy us some time */
-	ret = user_sdma_send_pkts(req, pcount);
-	if (unlikely(ret < 0 && ret != -EBUSY))
-		goto free_req;
 
 	/*
 	 * This is a somewhat blocking send implementation.
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/infiniband/hw/i40iw/i40iw_hw.c linux-libre-5.6.14-gnu/drivers/infiniband/hw/i40iw/i40iw_hw.c
--- linux-libre-5.6.13-gnu/drivers/infiniband/hw/i40iw/i40iw_hw.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/infiniband/hw/i40iw/i40iw_hw.c	2020-05-20 02:22:38.000000000 -0400
@@ -534,7 +534,7 @@ void i40iw_manage_arp_cache(struct i40iw
 	int arp_index;
 
 	arp_index = i40iw_arp_table(iwdev, ip_addr, ipv4, mac_addr, action);
-	if (arp_index == -1)
+	if (arp_index < 0)
 		return;
 	cqp_request = i40iw_get_cqp_request(&iwdev->cqp, false);
 	if (!cqp_request)
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/infiniband/hw/mlx4/qp.c linux-libre-5.6.14-gnu/drivers/infiniband/hw/mlx4/qp.c
--- linux-libre-5.6.13-gnu/drivers/infiniband/hw/mlx4/qp.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/infiniband/hw/mlx4/qp.c	2020-05-20 02:22:38.000000000 -0400
@@ -2891,6 +2891,7 @@ static int build_sriov_qp0_header(struct
 	int send_size;
 	int header_size;
 	int spc;
+	int err;
 	int i;
 
 	if (wr->wr.opcode != IB_WR_SEND)
@@ -2925,7 +2926,9 @@ static int build_sriov_qp0_header(struct
 
 	sqp->ud_header.lrh.virtual_lane    = 0;
 	sqp->ud_header.bth.solicited_event = !!(wr->wr.send_flags & IB_SEND_SOLICITED);
-	ib_get_cached_pkey(ib_dev, sqp->qp.port, 0, &pkey);
+	err = ib_get_cached_pkey(ib_dev, sqp->qp.port, 0, &pkey);
+	if (err)
+		return err;
 	sqp->ud_header.bth.pkey = cpu_to_be16(pkey);
 	if (sqp->qp.mlx4_ib_qp_type == MLX4_IB_QPT_TUN_SMI_OWNER)
 		sqp->ud_header.bth.destination_qpn = cpu_to_be32(wr->remote_qpn);
@@ -3212,9 +3215,14 @@ static int build_mlx_header(struct mlx4_
 	}
 	sqp->ud_header.bth.solicited_event = !!(wr->wr.send_flags & IB_SEND_SOLICITED);
 	if (!sqp->qp.ibqp.qp_num)
-		ib_get_cached_pkey(ib_dev, sqp->qp.port, sqp->pkey_index, &pkey);
+		err = ib_get_cached_pkey(ib_dev, sqp->qp.port, sqp->pkey_index,
+					 &pkey);
 	else
-		ib_get_cached_pkey(ib_dev, sqp->qp.port, wr->pkey_index, &pkey);
+		err = ib_get_cached_pkey(ib_dev, sqp->qp.port, wr->pkey_index,
+					 &pkey);
+	if (err)
+		return err;
+
 	sqp->ud_header.bth.pkey = cpu_to_be16(pkey);
 	sqp->ud_header.bth.destination_qpn = cpu_to_be32(wr->remote_qpn);
 	sqp->ud_header.bth.psn = cpu_to_be32((sqp->send_psn++) & ((1 << 24) - 1));
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/infiniband/sw/rxe/rxe_mmap.c linux-libre-5.6.14-gnu/drivers/infiniband/sw/rxe/rxe_mmap.c
--- linux-libre-5.6.13-gnu/drivers/infiniband/sw/rxe/rxe_mmap.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/infiniband/sw/rxe/rxe_mmap.c	2020-05-20 02:22:38.000000000 -0400
@@ -151,7 +151,7 @@ struct rxe_mmap_info *rxe_create_mmap_in
 
 	ip = kmalloc(sizeof(*ip), GFP_KERNEL);
 	if (!ip)
-		return NULL;
+		return ERR_PTR(-ENOMEM);
 
 	size = PAGE_ALIGN(size);
 
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/infiniband/sw/rxe/rxe_queue.c linux-libre-5.6.14-gnu/drivers/infiniband/sw/rxe/rxe_queue.c
--- linux-libre-5.6.13-gnu/drivers/infiniband/sw/rxe/rxe_queue.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/infiniband/sw/rxe/rxe_queue.c	2020-05-20 02:22:38.000000000 -0400
@@ -45,12 +45,15 @@ int do_mmap_info(struct rxe_dev *rxe, st
 
 	if (outbuf) {
 		ip = rxe_create_mmap_info(rxe, buf_size, udata, buf);
-		if (!ip)
+		if (IS_ERR(ip)) {
+			err = PTR_ERR(ip);
 			goto err1;
+		}
 
-		err = copy_to_user(outbuf, &ip->info, sizeof(ip->info));
-		if (err)
+		if (copy_to_user(outbuf, &ip->info, sizeof(ip->info))) {
+			err = -EFAULT;
 			goto err2;
+		}
 
 		spin_lock_bh(&rxe->pending_lock);
 		list_add(&ip->pending_mmaps, &rxe->pending_mmaps);
@@ -64,7 +67,7 @@ int do_mmap_info(struct rxe_dev *rxe, st
 err2:
 	kfree(ip);
 err1:
-	return -EINVAL;
+	return err;
 }
 
 inline void rxe_queue_reset(struct rxe_queue *q)
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/iommu/amd_iommu.c linux-libre-5.6.14-gnu/drivers/iommu/amd_iommu.c
--- linux-libre-5.6.13-gnu/drivers/iommu/amd_iommu.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/iommu/amd_iommu.c	2020-05-20 02:22:38.000000000 -0400
@@ -101,6 +101,8 @@ struct kmem_cache *amd_iommu_irq_cache;
 static void update_domain(struct protection_domain *domain);
 static int protection_domain_init(struct protection_domain *domain);
 static void detach_device(struct device *dev);
+static void update_and_flush_device_table(struct protection_domain *domain,
+					  struct domain_pgtable *pgtable);
 
 /****************************************************************************
  *
@@ -151,6 +153,26 @@ static struct protection_domain *to_pdom
 	return container_of(dom, struct protection_domain, domain);
 }
 
+static void amd_iommu_domain_get_pgtable(struct protection_domain *domain,
+					 struct domain_pgtable *pgtable)
+{
+	u64 pt_root = atomic64_read(&domain->pt_root);
+
+	pgtable->root = (u64 *)(pt_root & PAGE_MASK);
+	pgtable->mode = pt_root & 7; /* lowest 3 bits encode pgtable mode */
+}
+
+static u64 amd_iommu_domain_encode_pgtable(u64 *root, int mode)
+{
+	u64 pt_root;
+
+	/* lowest 3 bits encode pgtable mode */
+	pt_root = mode & 7;
+	pt_root |= (u64)root;
+
+	return pt_root;
+}
+
 static struct iommu_dev_data *alloc_dev_data(u16 devid)
 {
 	struct iommu_dev_data *dev_data;
@@ -1397,13 +1419,18 @@ static struct page *free_sub_pt(unsigned
 
 static void free_pagetable(struct protection_domain *domain)
 {
-	unsigned long root = (unsigned long)domain->pt_root;
+	struct domain_pgtable pgtable;
 	struct page *freelist = NULL;
+	unsigned long root;
 
-	BUG_ON(domain->mode < PAGE_MODE_NONE ||
-	       domain->mode > PAGE_MODE_6_LEVEL);
+	amd_iommu_domain_get_pgtable(domain, &pgtable);
+	atomic64_set(&domain->pt_root, 0);
 
-	freelist = free_sub_pt(root, domain->mode, freelist);
+	BUG_ON(pgtable.mode < PAGE_MODE_NONE ||
+	       pgtable.mode > PAGE_MODE_6_LEVEL);
+
+	root = (unsigned long)pgtable.root;
+	freelist = free_sub_pt(root, pgtable.mode, freelist);
 
 	free_page_list(freelist);
 }
@@ -1417,24 +1444,36 @@ static bool increase_address_space(struc
 				   unsigned long address,
 				   gfp_t gfp)
 {
+	struct domain_pgtable pgtable;
 	unsigned long flags;
 	bool ret = false;
-	u64 *pte;
+	u64 *pte, root;
 
 	spin_lock_irqsave(&domain->lock, flags);
 
-	if (address <= PM_LEVEL_SIZE(domain->mode) ||
-	    WARN_ON_ONCE(domain->mode == PAGE_MODE_6_LEVEL))
+	amd_iommu_domain_get_pgtable(domain, &pgtable);
+
+	if (address <= PM_LEVEL_SIZE(pgtable.mode) ||
+	    WARN_ON_ONCE(pgtable.mode == PAGE_MODE_6_LEVEL))
 		goto out;
 
 	pte = (void *)get_zeroed_page(gfp);
 	if (!pte)
 		goto out;
 
-	*pte             = PM_LEVEL_PDE(domain->mode,
-					iommu_virt_to_phys(domain->pt_root));
-	domain->pt_root  = pte;
-	domain->mode    += 1;
+	*pte = PM_LEVEL_PDE(pgtable.mode, iommu_virt_to_phys(pgtable.root));
+
+	pgtable.root  = pte;
+	pgtable.mode += 1;
+	update_and_flush_device_table(domain, &pgtable);
+	domain_flush_complete(domain);
+
+	/*
+	 * Device Table needs to be updated and flushed before the new root can
+	 * be published.
+	 */
+	root = amd_iommu_domain_encode_pgtable(pte, pgtable.mode);
+	atomic64_set(&domain->pt_root, root);
 
 	ret = true;
 
@@ -1451,16 +1490,22 @@ static u64 *alloc_pte(struct protection_
 		      gfp_t gfp,
 		      bool *updated)
 {
+	struct domain_pgtable pgtable;
 	int level, end_lvl;
 	u64 *pte, *page;
 
 	BUG_ON(!is_power_of_2(page_size));
 
-	while (address > PM_LEVEL_SIZE(domain->mode))
+	amd_iommu_domain_get_pgtable(domain, &pgtable);
+
+	while (address > PM_LEVEL_SIZE(pgtable.mode)) {
 		*updated = increase_address_space(domain, address, gfp) || *updated;
+		amd_iommu_domain_get_pgtable(domain, &pgtable);
+	}
 
-	level   = domain->mode - 1;
-	pte     = &domain->pt_root[PM_LEVEL_INDEX(level, address)];
+
+	level   = pgtable.mode - 1;
+	pte     = &pgtable.root[PM_LEVEL_INDEX(level, address)];
 	address = PAGE_SIZE_ALIGN(address, page_size);
 	end_lvl = PAGE_SIZE_LEVEL(page_size);
 
@@ -1536,16 +1581,19 @@ static u64 *fetch_pte(struct protection_
 		      unsigned long address,
 		      unsigned long *page_size)
 {
+	struct domain_pgtable pgtable;
 	int level;
 	u64 *pte;
 
 	*page_size = 0;
 
-	if (address > PM_LEVEL_SIZE(domain->mode))
+	amd_iommu_domain_get_pgtable(domain, &pgtable);
+
+	if (address > PM_LEVEL_SIZE(pgtable.mode))
 		return NULL;
 
-	level	   =  domain->mode - 1;
-	pte	   = &domain->pt_root[PM_LEVEL_INDEX(level, address)];
+	level	   =  pgtable.mode - 1;
+	pte	   = &pgtable.root[PM_LEVEL_INDEX(level, address)];
 	*page_size =  PTE_LEVEL_PAGE_SIZE(level);
 
 	while (level > 0) {
@@ -1806,6 +1854,7 @@ static void dma_ops_domain_free(struct p
 static struct protection_domain *dma_ops_domain_alloc(void)
 {
 	struct protection_domain *domain;
+	u64 *pt_root, root;
 
 	domain = kzalloc(sizeof(struct protection_domain), GFP_KERNEL);
 	if (!domain)
@@ -1814,12 +1863,14 @@ static struct protection_domain *dma_ops
 	if (protection_domain_init(domain))
 		goto free_domain;
 
-	domain->mode = PAGE_MODE_3_LEVEL;
-	domain->pt_root = (void *)get_zeroed_page(GFP_KERNEL);
-	domain->flags = PD_DMA_OPS_MASK;
-	if (!domain->pt_root)
+	pt_root = (void *)get_zeroed_page(GFP_KERNEL);
+	if (!pt_root)
 		goto free_domain;
 
+	root = amd_iommu_domain_encode_pgtable(pt_root, PAGE_MODE_3_LEVEL);
+	atomic64_set(&domain->pt_root, root);
+	domain->flags = PD_DMA_OPS_MASK;
+
 	if (iommu_get_dma_cookie(&domain->domain) == -ENOMEM)
 		goto free_domain;
 
@@ -1841,16 +1892,17 @@ static bool dma_ops_domain(struct protec
 }
 
 static void set_dte_entry(u16 devid, struct protection_domain *domain,
+			  struct domain_pgtable *pgtable,
 			  bool ats, bool ppr)
 {
 	u64 pte_root = 0;
 	u64 flags = 0;
 	u32 old_domid;
 
-	if (domain->mode != PAGE_MODE_NONE)
-		pte_root = iommu_virt_to_phys(domain->pt_root);
+	if (pgtable->mode != PAGE_MODE_NONE)
+		pte_root = iommu_virt_to_phys(pgtable->root);
 
-	pte_root |= (domain->mode & DEV_ENTRY_MODE_MASK)
+	pte_root |= (pgtable->mode & DEV_ENTRY_MODE_MASK)
 		    << DEV_ENTRY_MODE_SHIFT;
 	pte_root |= DTE_FLAG_IR | DTE_FLAG_IW | DTE_FLAG_V | DTE_FLAG_TV;
 
@@ -1923,6 +1975,7 @@ static void clear_dte_entry(u16 devid)
 static void do_attach(struct iommu_dev_data *dev_data,
 		      struct protection_domain *domain)
 {
+	struct domain_pgtable pgtable;
 	struct amd_iommu *iommu;
 	bool ats;
 
@@ -1938,7 +1991,9 @@ static void do_attach(struct iommu_dev_d
 	domain->dev_cnt                 += 1;
 
 	/* Update device table */
-	set_dte_entry(dev_data->devid, domain, ats, dev_data->iommu_v2);
+	amd_iommu_domain_get_pgtable(domain, &pgtable);
+	set_dte_entry(dev_data->devid, domain, &pgtable,
+		      ats, dev_data->iommu_v2);
 	clone_aliases(dev_data->pdev);
 
 	device_flush_dte(dev_data);
@@ -2249,22 +2304,34 @@ static int amd_iommu_domain_get_attr(str
  *
  *****************************************************************************/
 
-static void update_device_table(struct protection_domain *domain)
+static void update_device_table(struct protection_domain *domain,
+				struct domain_pgtable *pgtable)
 {
 	struct iommu_dev_data *dev_data;
 
 	list_for_each_entry(dev_data, &domain->dev_list, list) {
-		set_dte_entry(dev_data->devid, domain, dev_data->ats.enabled,
-			      dev_data->iommu_v2);
+		set_dte_entry(dev_data->devid, domain, pgtable,
+			      dev_data->ats.enabled, dev_data->iommu_v2);
 		clone_aliases(dev_data->pdev);
 	}
 }
 
+static void update_and_flush_device_table(struct protection_domain *domain,
+					  struct domain_pgtable *pgtable)
+{
+	update_device_table(domain, pgtable);
+	domain_flush_devices(domain);
+}
+
 static void update_domain(struct protection_domain *domain)
 {
-	update_device_table(domain);
+	struct domain_pgtable pgtable;
 
-	domain_flush_devices(domain);
+	/* Update device table */
+	amd_iommu_domain_get_pgtable(domain, &pgtable);
+	update_and_flush_device_table(domain, &pgtable);
+
+	/* Flush domain TLB(s) and wait for completion */
 	domain_flush_tlb_pde(domain);
 }
 
@@ -2375,6 +2442,7 @@ out_err:
 static struct iommu_domain *amd_iommu_domain_alloc(unsigned type)
 {
 	struct protection_domain *pdomain;
+	u64 *pt_root, root;
 
 	switch (type) {
 	case IOMMU_DOMAIN_UNMANAGED:
@@ -2382,13 +2450,15 @@ static struct iommu_domain *amd_iommu_do
 		if (!pdomain)
 			return NULL;
 
-		pdomain->mode    = PAGE_MODE_3_LEVEL;
-		pdomain->pt_root = (void *)get_zeroed_page(GFP_KERNEL);
-		if (!pdomain->pt_root) {
+		pt_root = (void *)get_zeroed_page(GFP_KERNEL);
+		if (!pt_root) {
 			protection_domain_free(pdomain);
 			return NULL;
 		}
 
+		root = amd_iommu_domain_encode_pgtable(pt_root, PAGE_MODE_3_LEVEL);
+		atomic64_set(&pdomain->pt_root, root);
+
 		pdomain->domain.geometry.aperture_start = 0;
 		pdomain->domain.geometry.aperture_end   = ~0ULL;
 		pdomain->domain.geometry.force_aperture = true;
@@ -2406,7 +2476,7 @@ static struct iommu_domain *amd_iommu_do
 		if (!pdomain)
 			return NULL;
 
-		pdomain->mode = PAGE_MODE_NONE;
+		atomic64_set(&pdomain->pt_root, PAGE_MODE_NONE);
 		break;
 	default:
 		return NULL;
@@ -2418,6 +2488,7 @@ static struct iommu_domain *amd_iommu_do
 static void amd_iommu_domain_free(struct iommu_domain *dom)
 {
 	struct protection_domain *domain;
+	struct domain_pgtable pgtable;
 
 	domain = to_pdomain(dom);
 
@@ -2435,7 +2506,9 @@ static void amd_iommu_domain_free(struct
 		dma_ops_domain_free(domain);
 		break;
 	default:
-		if (domain->mode != PAGE_MODE_NONE)
+		amd_iommu_domain_get_pgtable(domain, &pgtable);
+
+		if (pgtable.mode != PAGE_MODE_NONE)
 			free_pagetable(domain);
 
 		if (domain->flags & PD_IOMMUV2_MASK)
@@ -2518,10 +2591,12 @@ static int amd_iommu_map(struct iommu_do
 			 gfp_t gfp)
 {
 	struct protection_domain *domain = to_pdomain(dom);
+	struct domain_pgtable pgtable;
 	int prot = 0;
 	int ret;
 
-	if (domain->mode == PAGE_MODE_NONE)
+	amd_iommu_domain_get_pgtable(domain, &pgtable);
+	if (pgtable.mode == PAGE_MODE_NONE)
 		return -EINVAL;
 
 	if (iommu_prot & IOMMU_READ)
@@ -2541,8 +2616,10 @@ static size_t amd_iommu_unmap(struct iom
 			      struct iommu_iotlb_gather *gather)
 {
 	struct protection_domain *domain = to_pdomain(dom);
+	struct domain_pgtable pgtable;
 
-	if (domain->mode == PAGE_MODE_NONE)
+	amd_iommu_domain_get_pgtable(domain, &pgtable);
+	if (pgtable.mode == PAGE_MODE_NONE)
 		return 0;
 
 	return iommu_unmap_page(domain, iova, page_size);
@@ -2553,9 +2630,11 @@ static phys_addr_t amd_iommu_iova_to_phy
 {
 	struct protection_domain *domain = to_pdomain(dom);
 	unsigned long offset_mask, pte_pgsize;
+	struct domain_pgtable pgtable;
 	u64 *pte, __pte;
 
-	if (domain->mode == PAGE_MODE_NONE)
+	amd_iommu_domain_get_pgtable(domain, &pgtable);
+	if (pgtable.mode == PAGE_MODE_NONE)
 		return iova;
 
 	pte = fetch_pte(domain, iova, &pte_pgsize);
@@ -2708,16 +2787,26 @@ EXPORT_SYMBOL(amd_iommu_unregister_ppr_n
 void amd_iommu_domain_direct_map(struct iommu_domain *dom)
 {
 	struct protection_domain *domain = to_pdomain(dom);
+	struct domain_pgtable pgtable;
 	unsigned long flags;
+	u64 pt_root;
 
 	spin_lock_irqsave(&domain->lock, flags);
 
+	/* First save pgtable configuration*/
+	amd_iommu_domain_get_pgtable(domain, &pgtable);
+
 	/* Update data structure */
-	domain->mode    = PAGE_MODE_NONE;
+	pt_root = amd_iommu_domain_encode_pgtable(NULL, PAGE_MODE_NONE);
+	atomic64_set(&domain->pt_root, pt_root);
 
 	/* Make changes visible to IOMMUs */
 	update_domain(domain);
 
+	/* Restore old pgtable in domain->ptroot to free page-table */
+	pt_root = amd_iommu_domain_encode_pgtable(pgtable.root, pgtable.mode);
+	atomic64_set(&domain->pt_root, pt_root);
+
 	/* Page-table is not visible to IOMMU anymore, so free it */
 	free_pagetable(domain);
 
@@ -2908,9 +2997,11 @@ static u64 *__get_gcr3_pte(u64 *root, in
 static int __set_gcr3(struct protection_domain *domain, int pasid,
 		      unsigned long cr3)
 {
+	struct domain_pgtable pgtable;
 	u64 *pte;
 
-	if (domain->mode != PAGE_MODE_NONE)
+	amd_iommu_domain_get_pgtable(domain, &pgtable);
+	if (pgtable.mode != PAGE_MODE_NONE)
 		return -EINVAL;
 
 	pte = __get_gcr3_pte(domain->gcr3_tbl, domain->glx, pasid, true);
@@ -2924,9 +3015,11 @@ static int __set_gcr3(struct protection_
 
 static int __clear_gcr3(struct protection_domain *domain, int pasid)
 {
+	struct domain_pgtable pgtable;
 	u64 *pte;
 
-	if (domain->mode != PAGE_MODE_NONE)
+	amd_iommu_domain_get_pgtable(domain, &pgtable);
+	if (pgtable.mode != PAGE_MODE_NONE)
 		return -EINVAL;
 
 	pte = __get_gcr3_pte(domain->gcr3_tbl, domain->glx, pasid, false);
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/iommu/amd_iommu_types.h linux-libre-5.6.14-gnu/drivers/iommu/amd_iommu_types.h
--- linux-libre-5.6.13-gnu/drivers/iommu/amd_iommu_types.h	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/iommu/amd_iommu_types.h	2020-05-20 02:22:38.000000000 -0400
@@ -468,8 +468,7 @@ struct protection_domain {
 				       iommu core code */
 	spinlock_t lock;	/* mostly used to lock the page table*/
 	u16 id;			/* the domain id written to the device table */
-	int mode;		/* paging mode (0-6 levels) */
-	u64 *pt_root;		/* page table root pointer */
+	atomic64_t pt_root;	/* pgtable root and pgtable mode */
 	int glx;		/* Number of levels for GCR3 table */
 	u64 *gcr3_tbl;		/* Guest CR3 table */
 	unsigned long flags;	/* flags to find out type of domain */
@@ -477,6 +476,12 @@ struct protection_domain {
 	unsigned dev_iommu[MAX_IOMMUS]; /* per-IOMMU reference count */
 };
 
+/* For decocded pt_root */
+struct domain_pgtable {
+	int mode;
+	u64 *root;
+};
+
 /*
  * Structure where we save information about one hardware AMD IOMMU in the
  * system.
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/mmc/core/block.c linux-libre-5.6.14-gnu/drivers/mmc/core/block.c
--- linux-libre-5.6.13-gnu/drivers/mmc/core/block.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/mmc/core/block.c	2020-05-20 02:22:38.000000000 -0400
@@ -1417,6 +1417,7 @@ static void mmc_blk_cqe_complete_rq(stru
 	struct mmc_request *mrq = &mqrq->brq.mrq;
 	struct request_queue *q = req->q;
 	struct mmc_host *host = mq->card->host;
+	enum mmc_issue_type issue_type = mmc_issue_type(mq, req);
 	unsigned long flags;
 	bool put_card;
 	int err;
@@ -1446,7 +1447,7 @@ static void mmc_blk_cqe_complete_rq(stru
 
 	spin_lock_irqsave(&mq->lock, flags);
 
-	mq->in_flight[mmc_issue_type(mq, req)] -= 1;
+	mq->in_flight[issue_type] -= 1;
 
 	put_card = (mmc_tot_in_flight(mq) == 0);
 
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/mmc/core/queue.c linux-libre-5.6.14-gnu/drivers/mmc/core/queue.c
--- linux-libre-5.6.13-gnu/drivers/mmc/core/queue.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/mmc/core/queue.c	2020-05-20 02:22:38.000000000 -0400
@@ -107,11 +107,10 @@ static enum blk_eh_timer_return mmc_cqe_
 	case MMC_ISSUE_DCMD:
 		if (host->cqe_ops->cqe_timeout(host, mrq, &recovery_needed)) {
 			if (recovery_needed)
-				__mmc_cqe_recovery_notifier(mq);
+				mmc_cqe_recovery_notifier(mrq);
 			return BLK_EH_RESET_TIMER;
 		}
-		/* No timeout (XXX: huh? comment doesn't make much sense) */
-		blk_mq_complete_request(req);
+		/* The request has gone already */
 		return BLK_EH_DONE;
 	default:
 		/* Timeout is handled by mmc core */
@@ -125,18 +124,13 @@ static enum blk_eh_timer_return mmc_mq_t
 	struct request_queue *q = req->q;
 	struct mmc_queue *mq = q->queuedata;
 	unsigned long flags;
-	int ret;
+	bool ignore_tout;
 
 	spin_lock_irqsave(&mq->lock, flags);
-
-	if (mq->recovery_needed || !mq->use_cqe)
-		ret = BLK_EH_RESET_TIMER;
-	else
-		ret = mmc_cqe_timed_out(req);
-
+	ignore_tout = mq->recovery_needed || !mq->use_cqe;
 	spin_unlock_irqrestore(&mq->lock, flags);
 
-	return ret;
+	return ignore_tout ? BLK_EH_RESET_TIMER : mmc_cqe_timed_out(req);
 }
 
 static void mmc_mq_recovery_handler(struct work_struct *work)
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/mmc/host/alcor.c linux-libre-5.6.14-gnu/drivers/mmc/host/alcor.c
--- linux-libre-5.6.13-gnu/drivers/mmc/host/alcor.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/mmc/host/alcor.c	2020-05-20 02:22:38.000000000 -0400
@@ -1104,7 +1104,7 @@ static int alcor_pci_sdmmc_drv_probe(str
 
 	if (ret) {
 		dev_err(&pdev->dev, "Failed to get irq for data line\n");
-		return ret;
+		goto free_host;
 	}
 
 	mutex_init(&host->cmd_mutex);
@@ -1116,6 +1116,10 @@ static int alcor_pci_sdmmc_drv_probe(str
 	dev_set_drvdata(&pdev->dev, host);
 	mmc_add_host(mmc);
 	return 0;
+
+free_host:
+	mmc_free_host(mmc);
+	return ret;
 }
 
 static int alcor_pci_sdmmc_drv_remove(struct platform_device *pdev)
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/mmc/host/sdhci-acpi.c linux-libre-5.6.14-gnu/drivers/mmc/host/sdhci-acpi.c
--- linux-libre-5.6.13-gnu/drivers/mmc/host/sdhci-acpi.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/mmc/host/sdhci-acpi.c	2020-05-20 02:22:38.000000000 -0400
@@ -605,10 +605,12 @@ static int sdhci_acpi_emmc_amd_probe_slo
 }
 
 static const struct sdhci_acpi_slot sdhci_acpi_slot_amd_emmc = {
-	.chip   = &sdhci_acpi_chip_amd,
-	.caps   = MMC_CAP_8_BIT_DATA | MMC_CAP_NONREMOVABLE,
-	.quirks = SDHCI_QUIRK_32BIT_DMA_ADDR | SDHCI_QUIRK_32BIT_DMA_SIZE |
-			SDHCI_QUIRK_32BIT_ADMA_SIZE,
+	.chip		= &sdhci_acpi_chip_amd,
+	.caps		= MMC_CAP_8_BIT_DATA | MMC_CAP_NONREMOVABLE,
+	.quirks		= SDHCI_QUIRK_32BIT_DMA_ADDR |
+			  SDHCI_QUIRK_32BIT_DMA_SIZE |
+			  SDHCI_QUIRK_32BIT_ADMA_SIZE,
+	.quirks2	= SDHCI_QUIRK2_BROKEN_64_BIT_DMA,
 	.probe_slot     = sdhci_acpi_emmc_amd_probe_slot,
 };
 
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/mmc/host/sdhci-pci-gli.c linux-libre-5.6.14-gnu/drivers/mmc/host/sdhci-pci-gli.c
--- linux-libre-5.6.13-gnu/drivers/mmc/host/sdhci-pci-gli.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/mmc/host/sdhci-pci-gli.c	2020-05-20 02:22:38.000000000 -0400
@@ -26,6 +26,9 @@
 #define   SDHCI_GLI_9750_DRIVING_2    GENMASK(27, 26)
 #define   GLI_9750_DRIVING_1_VALUE    0xFFF
 #define   GLI_9750_DRIVING_2_VALUE    0x3
+#define   SDHCI_GLI_9750_SEL_1        BIT(29)
+#define   SDHCI_GLI_9750_SEL_2        BIT(31)
+#define   SDHCI_GLI_9750_ALL_RST      (BIT(24)|BIT(25)|BIT(28)|BIT(30))
 
 #define SDHCI_GLI_9750_PLL	      0x864
 #define   SDHCI_GLI_9750_PLL_TX2_INV    BIT(23)
@@ -122,6 +125,8 @@ static void gli_set_9750(struct sdhci_ho
 				    GLI_9750_DRIVING_1_VALUE);
 	driving_value |= FIELD_PREP(SDHCI_GLI_9750_DRIVING_2,
 				    GLI_9750_DRIVING_2_VALUE);
+	driving_value &= ~(SDHCI_GLI_9750_SEL_1|SDHCI_GLI_9750_SEL_2|SDHCI_GLI_9750_ALL_RST);
+	driving_value |= SDHCI_GLI_9750_SEL_2;
 	sdhci_writel(host, driving_value, SDHCI_GLI_9750_DRIVING);
 
 	sw_ctrl_value &= ~SDHCI_GLI_9750_SW_CTRL_4;
@@ -334,6 +339,18 @@ static u32 sdhci_gl9750_readl(struct sdh
 	return value;
 }
 
+#ifdef CONFIG_PM_SLEEP
+static int sdhci_pci_gli_resume(struct sdhci_pci_chip *chip)
+{
+	struct sdhci_pci_slot *slot = chip->slots[0];
+
+	pci_free_irq_vectors(slot->chip->pdev);
+	gli_pcie_enable_msi(slot);
+
+	return sdhci_pci_resume_host(chip);
+}
+#endif
+
 static const struct sdhci_ops sdhci_gl9755_ops = {
 	.set_clock		= sdhci_set_clock,
 	.enable_dma		= sdhci_pci_enable_dma,
@@ -348,6 +365,9 @@ const struct sdhci_pci_fixes sdhci_gl975
 	.quirks2	= SDHCI_QUIRK2_BROKEN_DDR50,
 	.probe_slot	= gli_probe_slot_gl9755,
 	.ops            = &sdhci_gl9755_ops,
+#ifdef CONFIG_PM_SLEEP
+	.resume         = sdhci_pci_gli_resume,
+#endif
 };
 
 static const struct sdhci_ops sdhci_gl9750_ops = {
@@ -366,4 +386,7 @@ const struct sdhci_pci_fixes sdhci_gl975
 	.quirks2	= SDHCI_QUIRK2_BROKEN_DDR50,
 	.probe_slot	= gli_probe_slot_gl9750,
 	.ops            = &sdhci_gl9750_ops,
+#ifdef CONFIG_PM_SLEEP
+	.resume         = sdhci_pci_gli_resume,
+#endif
 };
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/net/dsa/dsa_loop.c linux-libre-5.6.14-gnu/drivers/net/dsa/dsa_loop.c
--- linux-libre-5.6.13-gnu/drivers/net/dsa/dsa_loop.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/net/dsa/dsa_loop.c	2020-05-20 02:22:38.000000000 -0400
@@ -360,6 +360,7 @@ static void __exit dsa_loop_exit(void)
 }
 module_exit(dsa_loop_exit);
 
+MODULE_SOFTDEP("pre: dsa_loop_bdinfo");
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Florian Fainelli");
 MODULE_DESCRIPTION("DSA loopback driver");
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/net/dsa/ocelot/felix.c linux-libre-5.6.14-gnu/drivers/net/dsa/ocelot/felix.c
--- linux-libre-5.6.13-gnu/drivers/net/dsa/ocelot/felix.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/net/dsa/ocelot/felix.c	2020-05-20 02:22:38.000000000 -0400
@@ -397,6 +397,7 @@ static int felix_init_structs(struct fel
 	ocelot->stats_layout	= felix->info->stats_layout;
 	ocelot->num_stats	= felix->info->num_stats;
 	ocelot->shared_queue_sz	= felix->info->shared_queue_sz;
+	ocelot->num_mact_rows	= felix->info->num_mact_rows;
 	ocelot->ops		= felix->info->ops;
 
 	port_phy_modes = kcalloc(num_phys_ports, sizeof(phy_interface_t),
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/net/dsa/ocelot/felix.h linux-libre-5.6.14-gnu/drivers/net/dsa/ocelot/felix.h
--- linux-libre-5.6.13-gnu/drivers/net/dsa/ocelot/felix.h	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/net/dsa/ocelot/felix.h	2020-05-20 02:22:38.000000000 -0400
@@ -15,6 +15,7 @@ struct felix_info {
 	const u32 *const		*map;
 	const struct ocelot_ops		*ops;
 	int				shared_queue_sz;
+	int				num_mact_rows;
 	const struct ocelot_stat_layout	*stats_layout;
 	unsigned int			num_stats;
 	int				num_ports;
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/net/dsa/ocelot/felix_vsc9959.c linux-libre-5.6.14-gnu/drivers/net/dsa/ocelot/felix_vsc9959.c
--- linux-libre-5.6.13-gnu/drivers/net/dsa/ocelot/felix_vsc9959.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/net/dsa/ocelot/felix_vsc9959.c	2020-05-20 02:22:38.000000000 -0400
@@ -1090,6 +1090,7 @@ struct felix_info felix_info_vsc9959 = {
 	.stats_layout		= vsc9959_stats_layout,
 	.num_stats		= ARRAY_SIZE(vsc9959_stats_layout),
 	.shared_queue_sz	= 128 * 1024,
+	.num_mact_rows		= 2048,
 	.num_ports		= 6,
 	.switch_pci_bar		= 4,
 	.imdio_pci_bar		= 0,
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/net/ethernet/broadcom/Kconfig linux-libre-5.6.14-gnu/drivers/net/ethernet/broadcom/Kconfig
--- linux-libre-5.6.13-gnu/drivers/net/ethernet/broadcom/Kconfig	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/net/ethernet/broadcom/Kconfig	2020-05-20 02:22:38.000000000 -0400
@@ -69,6 +69,7 @@ config BCMGENET
 	select BCM7XXX_PHY
 	select MDIO_BCM_UNIMAC
 	select DIMLIB
+	select BROADCOM_PHY if ARCH_BCM2835
 	help
 	  This driver supports the built-in Ethernet MACs found in the
 	  Broadcom BCM7xxx Set Top Box family chipset.
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c linux-libre-5.6.14-gnu/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
--- linux-libre-5.6.13-gnu/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c	2020-05-20 02:22:38.000000000 -0400
@@ -86,7 +86,7 @@ static void free_rx_fd(struct dpaa2_eth_
 	for (i = 1; i < DPAA2_ETH_MAX_SG_ENTRIES; i++) {
 		addr = dpaa2_sg_get_addr(&sgt[i]);
 		sg_vaddr = dpaa2_iova_to_virt(priv->iommu_domain, addr);
-		dma_unmap_page(dev, addr, DPAA2_ETH_RX_BUF_SIZE,
+		dma_unmap_page(dev, addr, priv->rx_buf_size,
 			       DMA_BIDIRECTIONAL);
 
 		free_pages((unsigned long)sg_vaddr, 0);
@@ -144,7 +144,7 @@ static struct sk_buff *build_frag_skb(st
 		/* Get the address and length from the S/G entry */
 		sg_addr = dpaa2_sg_get_addr(sge);
 		sg_vaddr = dpaa2_iova_to_virt(priv->iommu_domain, sg_addr);
-		dma_unmap_page(dev, sg_addr, DPAA2_ETH_RX_BUF_SIZE,
+		dma_unmap_page(dev, sg_addr, priv->rx_buf_size,
 			       DMA_BIDIRECTIONAL);
 
 		sg_length = dpaa2_sg_get_len(sge);
@@ -185,7 +185,7 @@ static struct sk_buff *build_frag_skb(st
 				(page_address(page) - page_address(head_page));
 
 			skb_add_rx_frag(skb, i - 1, head_page, page_offset,
-					sg_length, DPAA2_ETH_RX_BUF_SIZE);
+					sg_length, priv->rx_buf_size);
 		}
 
 		if (dpaa2_sg_is_final(sge))
@@ -211,7 +211,7 @@ static void free_bufs(struct dpaa2_eth_p
 
 	for (i = 0; i < count; i++) {
 		vaddr = dpaa2_iova_to_virt(priv->iommu_domain, buf_array[i]);
-		dma_unmap_page(dev, buf_array[i], DPAA2_ETH_RX_BUF_SIZE,
+		dma_unmap_page(dev, buf_array[i], priv->rx_buf_size,
 			       DMA_BIDIRECTIONAL);
 		free_pages((unsigned long)vaddr, 0);
 	}
@@ -335,7 +335,7 @@ static u32 run_xdp(struct dpaa2_eth_priv
 		break;
 	case XDP_REDIRECT:
 		dma_unmap_page(priv->net_dev->dev.parent, addr,
-			       DPAA2_ETH_RX_BUF_SIZE, DMA_BIDIRECTIONAL);
+			       priv->rx_buf_size, DMA_BIDIRECTIONAL);
 		ch->buf_count--;
 		xdp.data_hard_start = vaddr;
 		err = xdp_do_redirect(priv->net_dev, &xdp, xdp_prog);
@@ -374,7 +374,7 @@ static void dpaa2_eth_rx(struct dpaa2_et
 	trace_dpaa2_rx_fd(priv->net_dev, fd);
 
 	vaddr = dpaa2_iova_to_virt(priv->iommu_domain, addr);
-	dma_sync_single_for_cpu(dev, addr, DPAA2_ETH_RX_BUF_SIZE,
+	dma_sync_single_for_cpu(dev, addr, priv->rx_buf_size,
 				DMA_BIDIRECTIONAL);
 
 	fas = dpaa2_get_fas(vaddr, false);
@@ -393,13 +393,13 @@ static void dpaa2_eth_rx(struct dpaa2_et
 			return;
 		}
 
-		dma_unmap_page(dev, addr, DPAA2_ETH_RX_BUF_SIZE,
+		dma_unmap_page(dev, addr, priv->rx_buf_size,
 			       DMA_BIDIRECTIONAL);
 		skb = build_linear_skb(ch, fd, vaddr);
 	} else if (fd_format == dpaa2_fd_sg) {
 		WARN_ON(priv->xdp_prog);
 
-		dma_unmap_page(dev, addr, DPAA2_ETH_RX_BUF_SIZE,
+		dma_unmap_page(dev, addr, priv->rx_buf_size,
 			       DMA_BIDIRECTIONAL);
 		skb = build_frag_skb(priv, ch, buf_data);
 		free_pages((unsigned long)vaddr, 0);
@@ -974,7 +974,7 @@ static int add_bufs(struct dpaa2_eth_pri
 		if (!page)
 			goto err_alloc;
 
-		addr = dma_map_page(dev, page, 0, DPAA2_ETH_RX_BUF_SIZE,
+		addr = dma_map_page(dev, page, 0, priv->rx_buf_size,
 				    DMA_BIDIRECTIONAL);
 		if (unlikely(dma_mapping_error(dev, addr)))
 			goto err_map;
@@ -984,7 +984,7 @@ static int add_bufs(struct dpaa2_eth_pri
 		/* tracing point */
 		trace_dpaa2_eth_buf_seed(priv->net_dev,
 					 page, DPAA2_ETH_RX_BUF_RAW_SIZE,
-					 addr, DPAA2_ETH_RX_BUF_SIZE,
+					 addr, priv->rx_buf_size,
 					 bpid);
 	}
 
@@ -1715,7 +1715,7 @@ static bool xdp_mtu_valid(struct dpaa2_e
 	int mfl, linear_mfl;
 
 	mfl = DPAA2_ETH_L2_MAX_FRM(mtu);
-	linear_mfl = DPAA2_ETH_RX_BUF_SIZE - DPAA2_ETH_RX_HWA_SIZE -
+	linear_mfl = priv->rx_buf_size - DPAA2_ETH_RX_HWA_SIZE -
 		     dpaa2_eth_rx_head_room(priv) - XDP_PACKET_HEADROOM;
 
 	if (mfl > linear_mfl) {
@@ -2457,6 +2457,11 @@ static int set_buffer_layout(struct dpaa
 	else
 		rx_buf_align = DPAA2_ETH_RX_BUF_ALIGN;
 
+	/* We need to ensure that the buffer size seen by WRIOP is a multiple
+	 * of 64 or 256 bytes depending on the WRIOP version.
+	 */
+	priv->rx_buf_size = ALIGN_DOWN(DPAA2_ETH_RX_BUF_SIZE, rx_buf_align);
+
 	/* tx buffer */
 	buf_layout.private_data_size = DPAA2_ETH_SWA_SIZE;
 	buf_layout.pass_timestamp = true;
@@ -3121,7 +3126,7 @@ static int bind_dpni(struct dpaa2_eth_pr
 	pools_params.num_dpbp = 1;
 	pools_params.pools[0].dpbp_id = priv->dpbp_dev->obj_desc.id;
 	pools_params.pools[0].backup_pool = 0;
-	pools_params.pools[0].buffer_size = DPAA2_ETH_RX_BUF_SIZE;
+	pools_params.pools[0].buffer_size = priv->rx_buf_size;
 	err = dpni_set_pools(priv->mc_io, 0, priv->mc_token, &pools_params);
 	if (err) {
 		dev_err(dev, "dpni_set_pools() failed\n");
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.h linux-libre-5.6.14-gnu/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.h
--- linux-libre-5.6.13-gnu/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.h	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.h	2020-05-20 02:22:38.000000000 -0400
@@ -382,6 +382,7 @@ struct dpaa2_eth_priv {
 	u16 tx_data_offset;
 
 	struct fsl_mc_device *dpbp_dev;
+	u16 rx_buf_size;
 	u16 bpid;
 	struct iommu_domain *iommu_domain;
 
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/net/ethernet/freescale/dpaa2/dpaa2-ethtool.c linux-libre-5.6.14-gnu/drivers/net/ethernet/freescale/dpaa2/dpaa2-ethtool.c
--- linux-libre-5.6.13-gnu/drivers/net/ethernet/freescale/dpaa2/dpaa2-ethtool.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/net/ethernet/freescale/dpaa2/dpaa2-ethtool.c	2020-05-20 02:22:38.000000000 -0400
@@ -625,7 +625,7 @@ static int num_rules(struct dpaa2_eth_pr
 
 static int update_cls_rule(struct net_device *net_dev,
 			   struct ethtool_rx_flow_spec *new_fs,
-			   int location)
+			   unsigned int location)
 {
 	struct dpaa2_eth_priv *priv = netdev_priv(net_dev);
 	struct dpaa2_eth_cls_rule *rule;
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/net/ethernet/huawei/hinic/hinic_hw_mgmt.c linux-libre-5.6.14-gnu/drivers/net/ethernet/huawei/hinic/hinic_hw_mgmt.c
--- linux-libre-5.6.13-gnu/drivers/net/ethernet/huawei/hinic/hinic_hw_mgmt.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/net/ethernet/huawei/hinic/hinic_hw_mgmt.c	2020-05-20 02:22:38.000000000 -0400
@@ -45,6 +45,8 @@
 
 #define MGMT_MSG_TIMEOUT                5000
 
+#define SET_FUNC_PORT_MGMT_TIMEOUT	25000
+
 #define mgmt_to_pfhwdev(pf_mgmt)        \
 		container_of(pf_mgmt, struct hinic_pfhwdev, pf_to_mgmt)
 
@@ -238,12 +240,13 @@ static int msg_to_mgmt_sync(struct hinic
 			    u8 *buf_in, u16 in_size,
 			    u8 *buf_out, u16 *out_size,
 			    enum mgmt_direction_type direction,
-			    u16 resp_msg_id)
+			    u16 resp_msg_id, u32 timeout)
 {
 	struct hinic_hwif *hwif = pf_to_mgmt->hwif;
 	struct pci_dev *pdev = hwif->pdev;
 	struct hinic_recv_msg *recv_msg;
 	struct completion *recv_done;
+	unsigned long timeo;
 	u16 msg_id;
 	int err;
 
@@ -267,8 +270,9 @@ static int msg_to_mgmt_sync(struct hinic
 		goto unlock_sync_msg;
 	}
 
-	if (!wait_for_completion_timeout(recv_done,
-					 msecs_to_jiffies(MGMT_MSG_TIMEOUT))) {
+	timeo = msecs_to_jiffies(timeout ? timeout : MGMT_MSG_TIMEOUT);
+
+	if (!wait_for_completion_timeout(recv_done, timeo)) {
 		dev_err(&pdev->dev, "MGMT timeout, MSG id = %d\n", msg_id);
 		err = -ETIMEDOUT;
 		goto unlock_sync_msg;
@@ -342,6 +346,7 @@ int hinic_msg_to_mgmt(struct hinic_pf_to
 {
 	struct hinic_hwif *hwif = pf_to_mgmt->hwif;
 	struct pci_dev *pdev = hwif->pdev;
+	u32 timeout = 0;
 
 	if (sync != HINIC_MGMT_MSG_SYNC) {
 		dev_err(&pdev->dev, "Invalid MGMT msg type\n");
@@ -353,9 +358,12 @@ int hinic_msg_to_mgmt(struct hinic_pf_to
 		return -EINVAL;
 	}
 
+	if (cmd == HINIC_PORT_CMD_SET_FUNC_STATE)
+		timeout = SET_FUNC_PORT_MGMT_TIMEOUT;
+
 	return msg_to_mgmt_sync(pf_to_mgmt, mod, cmd, buf_in, in_size,
 				buf_out, out_size, MGMT_DIRECT_SEND,
-				MSG_NOT_RESP);
+				MSG_NOT_RESP, timeout);
 }
 
 /**
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/net/ethernet/huawei/hinic/hinic_main.c linux-libre-5.6.14-gnu/drivers/net/ethernet/huawei/hinic/hinic_main.c
--- linux-libre-5.6.13-gnu/drivers/net/ethernet/huawei/hinic/hinic_main.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/net/ethernet/huawei/hinic/hinic_main.c	2020-05-20 02:22:38.000000000 -0400
@@ -483,7 +483,6 @@ static int hinic_close(struct net_device
 {
 	struct hinic_dev *nic_dev = netdev_priv(netdev);
 	unsigned int flags;
-	int err;
 
 	down(&nic_dev->mgmt_lock);
 
@@ -497,20 +496,9 @@ static int hinic_close(struct net_device
 
 	up(&nic_dev->mgmt_lock);
 
-	err = hinic_port_set_func_state(nic_dev, HINIC_FUNC_PORT_DISABLE);
-	if (err) {
-		netif_err(nic_dev, drv, netdev,
-			  "Failed to set func port state\n");
-		nic_dev->flags |= (flags & HINIC_INTF_UP);
-		return err;
-	}
+	hinic_port_set_state(nic_dev, HINIC_PORT_DISABLE);
 
-	err = hinic_port_set_state(nic_dev, HINIC_PORT_DISABLE);
-	if (err) {
-		netif_err(nic_dev, drv, netdev, "Failed to set port state\n");
-		nic_dev->flags |= (flags & HINIC_INTF_UP);
-		return err;
-	}
+	hinic_port_set_func_state(nic_dev, HINIC_FUNC_PORT_DISABLE);
 
 	if (nic_dev->flags & HINIC_RSS_ENABLE) {
 		hinic_rss_deinit(nic_dev);
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/net/ethernet/moxa/moxart_ether.c linux-libre-5.6.14-gnu/drivers/net/ethernet/moxa/moxart_ether.c
--- linux-libre-5.6.13-gnu/drivers/net/ethernet/moxa/moxart_ether.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/net/ethernet/moxa/moxart_ether.c	2020-05-20 02:22:38.000000000 -0400
@@ -564,7 +564,7 @@ static int moxart_remove(struct platform
 	struct net_device *ndev = platform_get_drvdata(pdev);
 
 	unregister_netdev(ndev);
-	free_irq(ndev->irq, ndev);
+	devm_free_irq(&pdev->dev, ndev->irq, ndev);
 	moxart_mac_free_memory(ndev);
 	free_netdev(ndev);
 
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/net/ethernet/mscc/ocelot.c linux-libre-5.6.14-gnu/drivers/net/ethernet/mscc/ocelot.c
--- linux-libre-5.6.13-gnu/drivers/net/ethernet/mscc/ocelot.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/net/ethernet/mscc/ocelot.c	2020-05-20 02:22:38.000000000 -0400
@@ -1016,10 +1016,8 @@ int ocelot_fdb_dump(struct ocelot *ocelo
 {
 	int i, j;
 
-	/* Loop through all the mac tables entries. There are 1024 rows of 4
-	 * entries.
-	 */
-	for (i = 0; i < 1024; i++) {
+	/* Loop through all the mac tables entries. */
+	for (i = 0; i < ocelot->num_mact_rows; i++) {
 		for (j = 0; j < 4; j++) {
 			struct ocelot_mact_entry entry;
 			bool is_static;
@@ -1446,8 +1444,15 @@ static void ocelot_port_attr_stp_state_s
 
 void ocelot_set_ageing_time(struct ocelot *ocelot, unsigned int msecs)
 {
-	ocelot_write(ocelot, ANA_AUTOAGE_AGE_PERIOD(msecs / 2),
-		     ANA_AUTOAGE);
+	unsigned int age_period = ANA_AUTOAGE_AGE_PERIOD(msecs / 2000);
+
+	/* Setting AGE_PERIOD to zero effectively disables automatic aging,
+	 * which is clearly not what our intention is. So avoid that.
+	 */
+	if (!age_period)
+		age_period = 1;
+
+	ocelot_rmw(ocelot, age_period, ANA_AUTOAGE_AGE_PERIOD_M, ANA_AUTOAGE);
 }
 EXPORT_SYMBOL(ocelot_set_ageing_time);
 
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/net/ethernet/mscc/ocelot_regs.c linux-libre-5.6.14-gnu/drivers/net/ethernet/mscc/ocelot_regs.c
--- linux-libre-5.6.13-gnu/drivers/net/ethernet/mscc/ocelot_regs.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/net/ethernet/mscc/ocelot_regs.c	2020-05-20 02:22:38.000000000 -0400
@@ -431,6 +431,7 @@ int ocelot_chip_init(struct ocelot *ocel
 	ocelot->stats_layout = ocelot_stats_layout;
 	ocelot->num_stats = ARRAY_SIZE(ocelot_stats_layout);
 	ocelot->shared_queue_sz = 224 * 1024;
+	ocelot->num_mact_rows = 1024;
 	ocelot->ops = ops;
 
 	ret = ocelot_regfields_init(ocelot, ocelot_regfields);
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/net/ethernet/natsemi/jazzsonic.c linux-libre-5.6.14-gnu/drivers/net/ethernet/natsemi/jazzsonic.c
--- linux-libre-5.6.13-gnu/drivers/net/ethernet/natsemi/jazzsonic.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/net/ethernet/natsemi/jazzsonic.c	2020-05-20 02:22:38.000000000 -0400
@@ -235,11 +235,13 @@ static int jazz_sonic_probe(struct platf
 
 	err = register_netdev(dev);
 	if (err)
-		goto out1;
+		goto undo_probe1;
 
 	return 0;
 
-out1:
+undo_probe1:
+	dma_free_coherent(lp->device, SIZEOF_SONIC_DESC * SONIC_BUS_SCALE(lp->dma_bitmode),
+			  lp->descriptors, lp->descriptors_laddr);
 	release_mem_region(dev->base_addr, SONIC_MEM_SIZE);
 out:
 	free_netdev(dev);
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/net/ethernet/netronome/nfp/abm/main.c linux-libre-5.6.14-gnu/drivers/net/ethernet/netronome/nfp/abm/main.c
--- linux-libre-5.6.13-gnu/drivers/net/ethernet/netronome/nfp/abm/main.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/net/ethernet/netronome/nfp/abm/main.c	2020-05-20 02:22:38.000000000 -0400
@@ -333,8 +333,10 @@ nfp_abm_vnic_alloc(struct nfp_app *app,
 		goto err_free_alink;
 
 	alink->prio_map = kzalloc(abm->prio_map_len, GFP_KERNEL);
-	if (!alink->prio_map)
+	if (!alink->prio_map) {
+		err = -ENOMEM;
 		goto err_free_alink;
+	}
 
 	/* This is a multi-host app, make sure MAC/PHY is up, but don't
 	 * make the MAC/PHY state follow the state of any of the ports.
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/net/ethernet/realtek/r8169_main.c linux-libre-5.6.14-gnu/drivers/net/ethernet/realtek/r8169_main.c
--- linux-libre-5.6.13-gnu/drivers/net/ethernet/realtek/r8169_main.c	2020-05-14 02:50:49.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/net/ethernet/realtek/r8169_main.c	2020-05-20 05:13:59.000000000 -0400
@@ -2107,6 +2107,8 @@ static void rtl8169_get_mac_version(stru
 		{ 0x7cf, 0x348,	RTL_GIGA_MAC_VER_07 },
 		{ 0x7cf, 0x248,	RTL_GIGA_MAC_VER_07 },
 		{ 0x7cf, 0x340,	RTL_GIGA_MAC_VER_13 },
+		/* RTL8401, reportedly works if treated as RTL8101e */
+		{ 0x7cf, 0x240,	RTL_GIGA_MAC_VER_13 },
 		{ 0x7cf, 0x343,	RTL_GIGA_MAC_VER_10 },
 		{ 0x7cf, 0x342,	RTL_GIGA_MAC_VER_16 },
 		{ 0x7c8, 0x348,	RTL_GIGA_MAC_VER_09 },
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/net/ethernet/stmicro/stmmac/dwmac5.c linux-libre-5.6.14-gnu/drivers/net/ethernet/stmicro/stmmac/dwmac5.c
--- linux-libre-5.6.13-gnu/drivers/net/ethernet/stmicro/stmmac/dwmac5.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/net/ethernet/stmicro/stmmac/dwmac5.c	2020-05-20 02:22:38.000000000 -0400
@@ -624,7 +624,7 @@ int dwmac5_est_configure(void __iomem *i
 		total_offset += offset;
 	}
 
-	total_ctr = cfg->ctr[0] + cfg->ctr[1] * 1000000000;
+	total_ctr = cfg->ctr[0] + cfg->ctr[1] * 1000000000ULL;
 	total_ctr += total_offset;
 
 	ctr_low = do_div(total_ctr, 1000000000);
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c linux-libre-5.6.14-gnu/drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c
--- linux-libre-5.6.13-gnu/drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c	2020-05-20 02:22:38.000000000 -0400
@@ -75,6 +75,11 @@ struct ethqos_emac_por {
 	unsigned int value;
 };
 
+struct ethqos_emac_driver_data {
+	const struct ethqos_emac_por *por;
+	unsigned int num_por;
+};
+
 struct qcom_ethqos {
 	struct platform_device *pdev;
 	void __iomem *rgmii_base;
@@ -171,6 +176,11 @@ static const struct ethqos_emac_por emac
 	{ .offset = RGMII_IO_MACRO_CONFIG2,	.value = 0x00002060 },
 };
 
+static const struct ethqos_emac_driver_data emac_v2_3_0_data = {
+	.por = emac_v2_3_0_por,
+	.num_por = ARRAY_SIZE(emac_v2_3_0_por),
+};
+
 static int ethqos_dll_configure(struct qcom_ethqos *ethqos)
 {
 	unsigned int val;
@@ -442,6 +452,7 @@ static int qcom_ethqos_probe(struct plat
 	struct device_node *np = pdev->dev.of_node;
 	struct plat_stmmacenet_data *plat_dat;
 	struct stmmac_resources stmmac_res;
+	const struct ethqos_emac_driver_data *data;
 	struct qcom_ethqos *ethqos;
 	struct resource *res;
 	int ret;
@@ -471,7 +482,9 @@ static int qcom_ethqos_probe(struct plat
 		goto err_mem;
 	}
 
-	ethqos->por = of_device_get_match_data(&pdev->dev);
+	data = of_device_get_match_data(&pdev->dev);
+	ethqos->por = data->por;
+	ethqos->num_por = data->num_por;
 
 	ethqos->rgmii_clk = devm_clk_get(&pdev->dev, "rgmii");
 	if (IS_ERR(ethqos->rgmii_clk)) {
@@ -526,7 +539,7 @@ static int qcom_ethqos_remove(struct pla
 }
 
 static const struct of_device_id qcom_ethqos_match[] = {
-	{ .compatible = "qcom,qcs404-ethqos", .data = &emac_v2_3_0_por},
+	{ .compatible = "qcom,qcs404-ethqos", .data = &emac_v2_3_0_data},
 	{ }
 };
 MODULE_DEVICE_TABLE(of, qcom_ethqos_match);
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/net/hyperv/netvsc_drv.c linux-libre-5.6.14-gnu/drivers/net/hyperv/netvsc_drv.c
--- linux-libre-5.6.13-gnu/drivers/net/hyperv/netvsc_drv.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/net/hyperv/netvsc_drv.c	2020-05-20 02:22:38.000000000 -0400
@@ -710,7 +710,8 @@ no_memory:
 	goto drop;
 }
 
-static int netvsc_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+static netdev_tx_t netvsc_start_xmit(struct sk_buff *skb,
+				     struct net_device *ndev)
 {
 	return netvsc_xmit(skb, ndev, false);
 }
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/net/phy/microchip_t1.c linux-libre-5.6.14-gnu/drivers/net/phy/microchip_t1.c
--- linux-libre-5.6.13-gnu/drivers/net/phy/microchip_t1.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/net/phy/microchip_t1.c	2020-05-20 02:22:38.000000000 -0400
@@ -3,9 +3,21 @@
 
 #include <linux/kernel.h>
 #include <linux/module.h>
+#include <linux/delay.h>
 #include <linux/mii.h>
 #include <linux/phy.h>
 
+/* External Register Control Register */
+#define LAN87XX_EXT_REG_CTL                     (0x14)
+#define LAN87XX_EXT_REG_CTL_RD_CTL              (0x1000)
+#define LAN87XX_EXT_REG_CTL_WR_CTL              (0x0800)
+
+/* External Register Read Data Register */
+#define LAN87XX_EXT_REG_RD_DATA                 (0x15)
+
+/* External Register Write Data Register */
+#define LAN87XX_EXT_REG_WR_DATA                 (0x16)
+
 /* Interrupt Source Register */
 #define LAN87XX_INTERRUPT_SOURCE                (0x18)
 
@@ -14,9 +26,160 @@
 #define LAN87XX_MASK_LINK_UP                    (0x0004)
 #define LAN87XX_MASK_LINK_DOWN                  (0x0002)
 
+/* phyaccess nested types */
+#define	PHYACC_ATTR_MODE_READ		0
+#define	PHYACC_ATTR_MODE_WRITE		1
+#define	PHYACC_ATTR_MODE_MODIFY		2
+
+#define	PHYACC_ATTR_BANK_SMI		0
+#define	PHYACC_ATTR_BANK_MISC		1
+#define	PHYACC_ATTR_BANK_PCS		2
+#define	PHYACC_ATTR_BANK_AFE		3
+#define	PHYACC_ATTR_BANK_MAX		7
+
 #define DRIVER_AUTHOR	"Nisar Sayed <nisar.sayed@microchip.com>"
 #define DRIVER_DESC	"Microchip LAN87XX T1 PHY driver"
 
+struct access_ereg_val {
+	u8  mode;
+	u8  bank;
+	u8  offset;
+	u16 val;
+	u16 mask;
+};
+
+static int access_ereg(struct phy_device *phydev, u8 mode, u8 bank,
+		       u8 offset, u16 val)
+{
+	u16 ereg = 0;
+	int rc = 0;
+
+	if (mode > PHYACC_ATTR_MODE_WRITE || bank > PHYACC_ATTR_BANK_MAX)
+		return -EINVAL;
+
+	if (bank == PHYACC_ATTR_BANK_SMI) {
+		if (mode == PHYACC_ATTR_MODE_WRITE)
+			rc = phy_write(phydev, offset, val);
+		else
+			rc = phy_read(phydev, offset);
+		return rc;
+	}
+
+	if (mode == PHYACC_ATTR_MODE_WRITE) {
+		ereg = LAN87XX_EXT_REG_CTL_WR_CTL;
+		rc = phy_write(phydev, LAN87XX_EXT_REG_WR_DATA, val);
+		if (rc < 0)
+			return rc;
+	} else {
+		ereg = LAN87XX_EXT_REG_CTL_RD_CTL;
+	}
+
+	ereg |= (bank << 8) | offset;
+
+	rc = phy_write(phydev, LAN87XX_EXT_REG_CTL, ereg);
+	if (rc < 0)
+		return rc;
+
+	if (mode == PHYACC_ATTR_MODE_READ)
+		rc = phy_read(phydev, LAN87XX_EXT_REG_RD_DATA);
+
+	return rc;
+}
+
+static int access_ereg_modify_changed(struct phy_device *phydev,
+				      u8 bank, u8 offset, u16 val, u16 mask)
+{
+	int new = 0, rc = 0;
+
+	if (bank > PHYACC_ATTR_BANK_MAX)
+		return -EINVAL;
+
+	rc = access_ereg(phydev, PHYACC_ATTR_MODE_READ, bank, offset, val);
+	if (rc < 0)
+		return rc;
+
+	new = val | (rc & (mask ^ 0xFFFF));
+	rc = access_ereg(phydev, PHYACC_ATTR_MODE_WRITE, bank, offset, new);
+
+	return rc;
+}
+
+static int lan87xx_phy_init(struct phy_device *phydev)
+{
+	static const struct access_ereg_val init[] = {
+		/* TX Amplitude = 5 */
+		{PHYACC_ATTR_MODE_MODIFY, PHYACC_ATTR_BANK_AFE, 0x0B,
+		 0x000A, 0x001E},
+		/* Clear SMI interrupts */
+		{PHYACC_ATTR_MODE_READ, PHYACC_ATTR_BANK_SMI, 0x18,
+		 0, 0},
+		/* Clear MISC interrupts */
+		{PHYACC_ATTR_MODE_READ, PHYACC_ATTR_BANK_MISC, 0x08,
+		 0, 0},
+		/* Turn on TC10 Ring Oscillator (ROSC) */
+		{PHYACC_ATTR_MODE_MODIFY, PHYACC_ATTR_BANK_MISC, 0x20,
+		 0x0020, 0x0020},
+		/* WUR Detect Length to 1.2uS, LPC Detect Length to 1.09uS */
+		{PHYACC_ATTR_MODE_WRITE, PHYACC_ATTR_BANK_PCS, 0x20,
+		 0x283C, 0},
+		/* Wake_In Debounce Length to 39uS, Wake_Out Length to 79uS */
+		{PHYACC_ATTR_MODE_WRITE, PHYACC_ATTR_BANK_MISC, 0x21,
+		 0x274F, 0},
+		/* Enable Auto Wake Forward to Wake_Out, ROSC on, Sleep,
+		 * and Wake_In to wake PHY
+		 */
+		{PHYACC_ATTR_MODE_WRITE, PHYACC_ATTR_BANK_MISC, 0x20,
+		 0x80A7, 0},
+		/* Enable WUP Auto Fwd, Enable Wake on MDI, Wakeup Debouncer
+		 * to 128 uS
+		 */
+		{PHYACC_ATTR_MODE_WRITE, PHYACC_ATTR_BANK_MISC, 0x24,
+		 0xF110, 0},
+		/* Enable HW Init */
+		{PHYACC_ATTR_MODE_MODIFY, PHYACC_ATTR_BANK_SMI, 0x1A,
+		 0x0100, 0x0100},
+	};
+	int rc, i;
+
+	/* Start manual initialization procedures in Managed Mode */
+	rc = access_ereg_modify_changed(phydev, PHYACC_ATTR_BANK_SMI,
+					0x1a, 0x0000, 0x0100);
+	if (rc < 0)
+		return rc;
+
+	/* Soft Reset the SMI block */
+	rc = access_ereg_modify_changed(phydev, PHYACC_ATTR_BANK_SMI,
+					0x00, 0x8000, 0x8000);
+	if (rc < 0)
+		return rc;
+
+	/* Check to see if the self-clearing bit is cleared */
+	usleep_range(1000, 2000);
+	rc = access_ereg(phydev, PHYACC_ATTR_MODE_READ,
+			 PHYACC_ATTR_BANK_SMI, 0x00, 0);
+	if (rc < 0)
+		return rc;
+	if ((rc & 0x8000) != 0)
+		return -ETIMEDOUT;
+
+	/* PHY Initialization */
+	for (i = 0; i < ARRAY_SIZE(init); i++) {
+		if (init[i].mode == PHYACC_ATTR_MODE_MODIFY) {
+			rc = access_ereg_modify_changed(phydev, init[i].bank,
+							init[i].offset,
+							init[i].val,
+							init[i].mask);
+		} else {
+			rc = access_ereg(phydev, init[i].mode, init[i].bank,
+					 init[i].offset, init[i].val);
+		}
+		if (rc < 0)
+			return rc;
+	}
+
+	return 0;
+}
+
 static int lan87xx_phy_config_intr(struct phy_device *phydev)
 {
 	int rc, val = 0;
@@ -40,6 +203,13 @@ static int lan87xx_phy_ack_interrupt(str
 	return rc < 0 ? rc : 0;
 }
 
+static int lan87xx_config_init(struct phy_device *phydev)
+{
+	int rc = lan87xx_phy_init(phydev);
+
+	return rc < 0 ? rc : 0;
+}
+
 static struct phy_driver microchip_t1_phy_driver[] = {
 	{
 		.phy_id         = 0x0007c150,
@@ -48,6 +218,7 @@ static struct phy_driver microchip_t1_ph
 
 		.features       = PHY_BASIC_T1_FEATURES,
 
+		.config_init	= lan87xx_config_init,
 		.config_aneg    = genphy_config_aneg,
 
 		.ack_interrupt  = lan87xx_phy_ack_interrupt,
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/net/phy/phy.c linux-libre-5.6.14-gnu/drivers/net/phy/phy.c
--- linux-libre-5.6.13-gnu/drivers/net/phy/phy.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/net/phy/phy.c	2020-05-20 02:22:38.000000000 -0400
@@ -1132,9 +1132,11 @@ int phy_ethtool_set_eee(struct phy_devic
 		/* Restart autonegotiation so the new modes get sent to the
 		 * link partner.
 		 */
-		ret = phy_restart_aneg(phydev);
-		if (ret < 0)
-			return ret;
+		if (phydev->autoneg == AUTONEG_ENABLE) {
+			ret = phy_restart_aneg(phydev);
+			if (ret < 0)
+				return ret;
+		}
 	}
 
 	return 0;
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/net/ppp/pppoe.c linux-libre-5.6.14-gnu/drivers/net/ppp/pppoe.c
--- linux-libre-5.6.13-gnu/drivers/net/ppp/pppoe.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/net/ppp/pppoe.c	2020-05-20 02:22:38.000000000 -0400
@@ -490,6 +490,9 @@ static int pppoe_disc_rcv(struct sk_buff
 	if (!skb)
 		goto out;
 
+	if (skb->pkt_type != PACKET_HOST)
+		goto abort;
+
 	if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr)))
 		goto abort;
 
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/net/virtio_net.c linux-libre-5.6.14-gnu/drivers/net/virtio_net.c
--- linux-libre-5.6.13-gnu/drivers/net/virtio_net.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/net/virtio_net.c	2020-05-20 02:22:38.000000000 -0400
@@ -1231,9 +1231,11 @@ static bool try_fill_recv(struct virtnet
 			break;
 	} while (rq->vq->num_free);
 	if (virtqueue_kick_prepare(rq->vq) && virtqueue_notify(rq->vq)) {
-		u64_stats_update_begin(&rq->stats.syncp);
+		unsigned long flags;
+
+		flags = u64_stats_update_begin_irqsave(&rq->stats.syncp);
 		rq->stats.kicks++;
-		u64_stats_update_end(&rq->stats.syncp);
+		u64_stats_update_end_irqrestore(&rq->stats.syncp, flags);
 	}
 
 	return !oom;
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/pinctrl/intel/pinctrl-baytrail.c linux-libre-5.6.14-gnu/drivers/pinctrl/intel/pinctrl-baytrail.c
--- linux-libre-5.6.13-gnu/drivers/pinctrl/intel/pinctrl-baytrail.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/pinctrl/intel/pinctrl-baytrail.c	2020-05-20 02:22:38.000000000 -0400
@@ -1286,6 +1286,7 @@ static const struct gpio_chip byt_gpio_c
 	.direction_output	= byt_gpio_direction_output,
 	.get			= byt_gpio_get,
 	.set			= byt_gpio_set,
+	.set_config		= gpiochip_generic_config,
 	.dbg_show		= byt_gpio_dbg_show,
 };
 
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/pinctrl/intel/pinctrl-cherryview.c linux-libre-5.6.14-gnu/drivers/pinctrl/intel/pinctrl-cherryview.c
--- linux-libre-5.6.13-gnu/drivers/pinctrl/intel/pinctrl-cherryview.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/pinctrl/intel/pinctrl-cherryview.c	2020-05-20 02:22:38.000000000 -0400
@@ -1479,11 +1479,15 @@ static void chv_gpio_irq_handler(struct
 	struct chv_pinctrl *pctrl = gpiochip_get_data(gc);
 	struct irq_chip *chip = irq_desc_get_chip(desc);
 	unsigned long pending;
+	unsigned long flags;
 	u32 intr_line;
 
 	chained_irq_enter(chip, desc);
 
+	raw_spin_lock_irqsave(&chv_lock, flags);
 	pending = readl(pctrl->regs + CHV_INTSTAT);
+	raw_spin_unlock_irqrestore(&chv_lock, flags);
+
 	for_each_set_bit(intr_line, &pending, pctrl->community->nirqs) {
 		unsigned int irq, offset;
 
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/pinctrl/intel/pinctrl-sunrisepoint.c linux-libre-5.6.14-gnu/drivers/pinctrl/intel/pinctrl-sunrisepoint.c
--- linux-libre-5.6.13-gnu/drivers/pinctrl/intel/pinctrl-sunrisepoint.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/pinctrl/intel/pinctrl-sunrisepoint.c	2020-05-20 02:22:38.000000000 -0400
@@ -15,17 +15,18 @@
 
 #include "pinctrl-intel.h"
 
-#define SPT_PAD_OWN	0x020
-#define SPT_PADCFGLOCK	0x0a0
-#define SPT_HOSTSW_OWN	0x0d0
-#define SPT_GPI_IS	0x100
-#define SPT_GPI_IE	0x120
+#define SPT_PAD_OWN		0x020
+#define SPT_H_PADCFGLOCK	0x090
+#define SPT_LP_PADCFGLOCK	0x0a0
+#define SPT_HOSTSW_OWN		0x0d0
+#define SPT_GPI_IS		0x100
+#define SPT_GPI_IE		0x120
 
 #define SPT_COMMUNITY(b, s, e)				\
 	{						\
 		.barno = (b),				\
 		.padown_offset = SPT_PAD_OWN,		\
-		.padcfglock_offset = SPT_PADCFGLOCK,	\
+		.padcfglock_offset = SPT_LP_PADCFGLOCK,	\
 		.hostown_offset = SPT_HOSTSW_OWN,	\
 		.is_offset = SPT_GPI_IS,		\
 		.ie_offset = SPT_GPI_IE,		\
@@ -47,7 +48,7 @@
 	{						\
 		.barno = (b),				\
 		.padown_offset = SPT_PAD_OWN,		\
-		.padcfglock_offset = SPT_PADCFGLOCK,	\
+		.padcfglock_offset = SPT_H_PADCFGLOCK,	\
 		.hostown_offset = SPT_HOSTSW_OWN,	\
 		.is_offset = SPT_GPI_IS,		\
 		.ie_offset = SPT_GPI_IE,		\
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/pinctrl/qcom/pinctrl-msm.c linux-libre-5.6.14-gnu/drivers/pinctrl/qcom/pinctrl-msm.c
--- linux-libre-5.6.13-gnu/drivers/pinctrl/qcom/pinctrl-msm.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/pinctrl/qcom/pinctrl-msm.c	2020-05-20 02:22:38.000000000 -0400
@@ -692,7 +692,7 @@ static void msm_gpio_update_dual_edge_po
 
 		pol = msm_readl_intr_cfg(pctrl, g);
 		pol ^= BIT(g->intr_polarity_bit);
-		msm_writel_intr_cfg(val, pctrl, g);
+		msm_writel_intr_cfg(pol, pctrl, g);
 
 		val2 = msm_readl_io(pctrl, g) & BIT(g->in_bit);
 		intstat = msm_readl_intr_status(pctrl, g);
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/s390/net/ism_drv.c linux-libre-5.6.14-gnu/drivers/s390/net/ism_drv.c
--- linux-libre-5.6.13-gnu/drivers/s390/net/ism_drv.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/s390/net/ism_drv.c	2020-05-20 02:22:38.000000000 -0400
@@ -521,8 +521,10 @@ static int ism_probe(struct pci_dev *pde
 
 	ism->smcd = smcd_alloc_dev(&pdev->dev, dev_name(&pdev->dev), &ism_ops,
 				   ISM_NR_DMBS);
-	if (!ism->smcd)
+	if (!ism->smcd) {
+		ret = -ENOMEM;
 		goto err_resource;
+	}
 
 	ism->smcd->priv = ism;
 	ret = ism_dev_init(ism);
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/usb/cdns3/gadget.c linux-libre-5.6.14-gnu/drivers/usb/cdns3/gadget.c
--- linux-libre-5.6.13-gnu/drivers/usb/cdns3/gadget.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/usb/cdns3/gadget.c	2020-05-20 02:22:38.000000000 -0400
@@ -2548,7 +2548,7 @@ found:
 	link_trb = priv_req->trb;
 
 	/* Update ring only if removed request is on pending_req_list list */
-	if (req_on_hw_ring) {
+	if (req_on_hw_ring && link_trb) {
 		link_trb->buffer = TRB_BUFFER(priv_ep->trb_pool_dma +
 			((priv_req->end_trb + 1) * TRB_SIZE));
 		link_trb->control = (link_trb->control & TRB_CYCLE) |
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/usb/core/devio.c linux-libre-5.6.14-gnu/drivers/usb/core/devio.c
--- linux-libre-5.6.13-gnu/drivers/usb/core/devio.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/usb/core/devio.c	2020-05-20 02:22:38.000000000 -0400
@@ -217,6 +217,7 @@ static int usbdev_mmap(struct file *file
 {
 	struct usb_memory *usbm = NULL;
 	struct usb_dev_state *ps = file->private_data;
+	struct usb_hcd *hcd = bus_to_hcd(ps->dev->bus);
 	size_t size = vma->vm_end - vma->vm_start;
 	void *mem;
 	unsigned long flags;
@@ -250,11 +251,19 @@ static int usbdev_mmap(struct file *file
 	usbm->vma_use_count = 1;
 	INIT_LIST_HEAD(&usbm->memlist);
 
-	if (remap_pfn_range(vma, vma->vm_start,
-			virt_to_phys(usbm->mem) >> PAGE_SHIFT,
-			size, vma->vm_page_prot) < 0) {
-		dec_usb_memory_use_count(usbm, &usbm->vma_use_count);
-		return -EAGAIN;
+	if (hcd->localmem_pool || !hcd_uses_dma(hcd)) {
+		if (remap_pfn_range(vma, vma->vm_start,
+				    virt_to_phys(usbm->mem) >> PAGE_SHIFT,
+				    size, vma->vm_page_prot) < 0) {
+			dec_usb_memory_use_count(usbm, &usbm->vma_use_count);
+			return -EAGAIN;
+		}
+	} else {
+		if (dma_mmap_coherent(hcd->self.sysdev, vma, mem, dma_handle,
+				      size)) {
+			dec_usb_memory_use_count(usbm, &usbm->vma_use_count);
+			return -EAGAIN;
+		}
 	}
 
 	vma->vm_flags |= VM_IO;
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/usb/core/hub.c linux-libre-5.6.14-gnu/drivers/usb/core/hub.c
--- linux-libre-5.6.13-gnu/drivers/usb/core/hub.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/usb/core/hub.c	2020-05-20 02:22:38.000000000 -0400
@@ -39,6 +39,7 @@
 
 #define USB_VENDOR_GENESYS_LOGIC		0x05e3
 #define USB_VENDOR_SMSC				0x0424
+#define USB_PRODUCT_USB5534B			0x5534
 #define HUB_QUIRK_CHECK_PORT_AUTOSUSPEND	0x01
 #define HUB_QUIRK_DISABLE_AUTOSUSPEND		0x02
 
@@ -5621,8 +5622,11 @@ out_hdev_lock:
 }
 
 static const struct usb_device_id hub_id_table[] = {
-    { .match_flags = USB_DEVICE_ID_MATCH_VENDOR | USB_DEVICE_ID_MATCH_INT_CLASS,
+    { .match_flags = USB_DEVICE_ID_MATCH_VENDOR
+                   | USB_DEVICE_ID_MATCH_PRODUCT
+                   | USB_DEVICE_ID_MATCH_INT_CLASS,
       .idVendor = USB_VENDOR_SMSC,
+      .idProduct = USB_PRODUCT_USB5534B,
       .bInterfaceClass = USB_CLASS_HUB,
       .driver_info = HUB_QUIRK_DISABLE_AUTOSUSPEND},
     { .match_flags = USB_DEVICE_ID_MATCH_VENDOR
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/usb/dwc3/gadget.c linux-libre-5.6.14-gnu/drivers/usb/dwc3/gadget.c
--- linux-libre-5.6.13-gnu/drivers/usb/dwc3/gadget.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/usb/dwc3/gadget.c	2020-05-20 02:22:38.000000000 -0400
@@ -2483,9 +2483,6 @@ static int dwc3_gadget_ep_reclaim_trb_sg
 	for_each_sg(sg, s, pending, i) {
 		trb = &dep->trb_pool[dep->trb_dequeue];
 
-		if (trb->ctrl & DWC3_TRB_CTRL_HWO)
-			break;
-
 		req->sg = sg_next(s);
 		req->num_pending_sgs--;
 
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/usb/gadget/configfs.c linux-libre-5.6.14-gnu/drivers/usb/gadget/configfs.c
--- linux-libre-5.6.13-gnu/drivers/usb/gadget/configfs.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/usb/gadget/configfs.c	2020-05-20 02:22:38.000000000 -0400
@@ -260,6 +260,9 @@ static ssize_t gadget_dev_desc_UDC_store
 	char *name;
 	int ret;
 
+	if (strlen(page) < len)
+		return -EOVERFLOW;
+
 	name = kstrdup(page, GFP_KERNEL);
 	if (!name)
 		return -ENOMEM;
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/usb/gadget/legacy/audio.c linux-libre-5.6.14-gnu/drivers/usb/gadget/legacy/audio.c
--- linux-libre-5.6.13-gnu/drivers/usb/gadget/legacy/audio.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/usb/gadget/legacy/audio.c	2020-05-20 02:22:38.000000000 -0400
@@ -300,8 +300,10 @@ static int audio_bind(struct usb_composi
 		struct usb_descriptor_header *usb_desc;
 
 		usb_desc = usb_otg_descriptor_alloc(cdev->gadget);
-		if (!usb_desc)
+		if (!usb_desc) {
+			status = -ENOMEM;
 			goto fail;
+		}
 		usb_otg_descriptor_init(cdev->gadget, usb_desc);
 		otg_desc[0] = usb_desc;
 		otg_desc[1] = NULL;
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/usb/gadget/legacy/cdc2.c linux-libre-5.6.14-gnu/drivers/usb/gadget/legacy/cdc2.c
--- linux-libre-5.6.13-gnu/drivers/usb/gadget/legacy/cdc2.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/usb/gadget/legacy/cdc2.c	2020-05-20 02:22:38.000000000 -0400
@@ -179,8 +179,10 @@ static int cdc_bind(struct usb_composite
 		struct usb_descriptor_header *usb_desc;
 
 		usb_desc = usb_otg_descriptor_alloc(gadget);
-		if (!usb_desc)
+		if (!usb_desc) {
+			status = -ENOMEM;
 			goto fail1;
+		}
 		usb_otg_descriptor_init(gadget, usb_desc);
 		otg_desc[0] = usb_desc;
 		otg_desc[1] = NULL;
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/usb/gadget/legacy/ncm.c linux-libre-5.6.14-gnu/drivers/usb/gadget/legacy/ncm.c
--- linux-libre-5.6.13-gnu/drivers/usb/gadget/legacy/ncm.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/usb/gadget/legacy/ncm.c	2020-05-20 02:22:38.000000000 -0400
@@ -156,8 +156,10 @@ static int gncm_bind(struct usb_composit
 		struct usb_descriptor_header *usb_desc;
 
 		usb_desc = usb_otg_descriptor_alloc(gadget);
-		if (!usb_desc)
+		if (!usb_desc) {
+			status = -ENOMEM;
 			goto fail;
+		}
 		usb_otg_descriptor_init(gadget, usb_desc);
 		otg_desc[0] = usb_desc;
 		otg_desc[1] = NULL;
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/usb/gadget/udc/net2272.c linux-libre-5.6.14-gnu/drivers/usb/gadget/udc/net2272.c
--- linux-libre-5.6.13-gnu/drivers/usb/gadget/udc/net2272.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/usb/gadget/udc/net2272.c	2020-05-20 02:22:38.000000000 -0400
@@ -2647,6 +2647,8 @@ net2272_plat_probe(struct platform_devic
  err_req:
 	release_mem_region(base, len);
  err:
+	kfree(dev);
+
 	return ret;
 }
 
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/usb/gadget/udc/tegra-xudc.c linux-libre-5.6.14-gnu/drivers/usb/gadget/udc/tegra-xudc.c
--- linux-libre-5.6.13-gnu/drivers/usb/gadget/udc/tegra-xudc.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/usb/gadget/udc/tegra-xudc.c	2020-05-20 02:22:38.000000000 -0400
@@ -3740,11 +3740,11 @@ static int __maybe_unused tegra_xudc_sus
 
 	flush_work(&xudc->usb_role_sw_work);
 
-	/* Forcibly disconnect before powergating. */
-	tegra_xudc_device_mode_off(xudc);
-
-	if (!pm_runtime_status_suspended(dev))
+	if (!pm_runtime_status_suspended(dev)) {
+		/* Forcibly disconnect before powergating. */
+		tegra_xudc_device_mode_off(xudc);
 		tegra_xudc_powergate(xudc);
+	}
 
 	pm_runtime_disable(dev);
 
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/usb/host/xhci-plat.c linux-libre-5.6.14-gnu/drivers/usb/host/xhci-plat.c
--- linux-libre-5.6.13-gnu/drivers/usb/host/xhci-plat.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/usb/host/xhci-plat.c	2020-05-20 02:22:38.000000000 -0400
@@ -363,6 +363,7 @@ static int xhci_plat_remove(struct platf
 	struct clk *reg_clk = xhci->reg_clk;
 	struct usb_hcd *shared_hcd = xhci->shared_hcd;
 
+	pm_runtime_get_sync(&dev->dev);
 	xhci->xhc_state |= XHCI_STATE_REMOVING;
 
 	usb_remove_hcd(shared_hcd);
@@ -376,8 +377,9 @@ static int xhci_plat_remove(struct platf
 	clk_disable_unprepare(reg_clk);
 	usb_put_hcd(hcd);
 
-	pm_runtime_set_suspended(&dev->dev);
 	pm_runtime_disable(&dev->dev);
+	pm_runtime_put_noidle(&dev->dev);
+	pm_runtime_set_suspended(&dev->dev);
 
 	return 0;
 }
diff -druNp --no-dereference linux-libre-5.6.13-gnu/drivers/usb/host/xhci-ring.c linux-libre-5.6.14-gnu/drivers/usb/host/xhci-ring.c
--- linux-libre-5.6.13-gnu/drivers/usb/host/xhci-ring.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/drivers/usb/host/xhci-ring.c	2020-05-20 02:22:38.000000000 -0400
@@ -3425,8 +3425,8 @@ int xhci_queue_bulk_tx(struct xhci_hcd *
 			/* New sg entry */
 			--num_sgs;
 			sent_len -= block_len;
-			if (num_sgs != 0) {
-				sg = sg_next(sg);
+			sg = sg_next(sg);
+			if (num_sgs != 0 && sg) {
 				block_len = sg_dma_len(sg);
 				addr = (u64) sg_dma_address(sg);
 				addr += sent_len;
diff -druNp --no-dereference linux-libre-5.6.13-gnu/fs/cachefiles/rdwr.c linux-libre-5.6.14-gnu/fs/cachefiles/rdwr.c
--- linux-libre-5.6.13-gnu/fs/cachefiles/rdwr.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/fs/cachefiles/rdwr.c	2020-05-20 02:22:38.000000000 -0400
@@ -398,7 +398,7 @@ int cachefiles_read_or_alloc_page(struct
 	struct inode *inode;
 	sector_t block;
 	unsigned shift;
-	int ret;
+	int ret, ret2;
 
 	object = container_of(op->op.object,
 			      struct cachefiles_object, fscache);
@@ -430,8 +430,8 @@ int cachefiles_read_or_alloc_page(struct
 	block = page->index;
 	block <<= shift;
 
-	ret = bmap(inode, &block);
-	ASSERT(ret < 0);
+	ret2 = bmap(inode, &block);
+	ASSERT(ret2 == 0);
 
 	_debug("%llx -> %llx",
 	       (unsigned long long) (page->index << shift),
@@ -739,8 +739,8 @@ int cachefiles_read_or_alloc_pages(struc
 		block = page->index;
 		block <<= shift;
 
-		ret = bmap(inode, &block);
-		ASSERT(!ret);
+		ret2 = bmap(inode, &block);
+		ASSERT(ret2 == 0);
 
 		_debug("%llx -> %llx",
 		       (unsigned long long) (page->index << shift),
diff -druNp --no-dereference linux-libre-5.6.13-gnu/fs/cifs/cifssmb.c linux-libre-5.6.14-gnu/fs/cifs/cifssmb.c
--- linux-libre-5.6.13-gnu/fs/cifs/cifssmb.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/fs/cifs/cifssmb.c	2020-05-20 02:22:38.000000000 -0400
@@ -2138,8 +2138,8 @@ cifs_writev_requeue(struct cifs_writedat
 			}
 		}
 
+		kref_put(&wdata2->refcount, cifs_writedata_release);
 		if (rc) {
-			kref_put(&wdata2->refcount, cifs_writedata_release);
 			if (is_retryable_error(rc))
 				continue;
 			i += nr_pages;
diff -druNp --no-dereference linux-libre-5.6.13-gnu/fs/eventpoll.c linux-libre-5.6.14-gnu/fs/eventpoll.c
--- linux-libre-5.6.13-gnu/fs/eventpoll.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/fs/eventpoll.c	2020-05-20 02:22:38.000000000 -0400
@@ -1857,34 +1857,33 @@ fetch_events:
 		 * event delivery.
 		 */
 		init_wait(&wait);
-		write_lock_irq(&ep->lock);
-		__add_wait_queue_exclusive(&ep->wq, &wait);
-		write_unlock_irq(&ep->lock);
 
+		write_lock_irq(&ep->lock);
 		/*
-		 * We don't want to sleep if the ep_poll_callback() sends us
-		 * a wakeup in between. That's why we set the task state
-		 * to TASK_INTERRUPTIBLE before doing the checks.
+		 * Barrierless variant, waitqueue_active() is called under
+		 * the same lock on wakeup ep_poll_callback() side, so it
+		 * is safe to avoid an explicit barrier.
 		 */
-		set_current_state(TASK_INTERRUPTIBLE);
+		__set_current_state(TASK_INTERRUPTIBLE);
+
 		/*
-		 * Always short-circuit for fatal signals to allow
-		 * threads to make a timely exit without the chance of
-		 * finding more events available and fetching
-		 * repeatedly.
+		 * Do the final check under the lock. ep_scan_ready_list()
+		 * plays with two lists (->rdllist and ->ovflist) and there
+		 * is always a race when both lists are empty for short
+		 * period of time although events are pending, so lock is
+		 * important.
 		 */
-		if (fatal_signal_pending(current)) {
-			res = -EINTR;
-			break;
+		eavail = ep_events_available(ep);
+		if (!eavail) {
+			if (signal_pending(current))
+				res = -EINTR;
+			else
+				__add_wait_queue_exclusive(&ep->wq, &wait);
 		}
+		write_unlock_irq(&ep->lock);
 
-		eavail = ep_events_available(ep);
-		if (eavail)
-			break;
-		if (signal_pending(current)) {
-			res = -EINTR;
+		if (eavail || res)
 			break;
-		}
 
 		if (!schedule_hrtimeout_range(to, slack, HRTIMER_MODE_ABS)) {
 			timed_out = 1;
@@ -1905,6 +1904,15 @@ fetch_events:
 	}
 
 send_events:
+	if (fatal_signal_pending(current)) {
+		/*
+		 * Always short-circuit for fatal signals to allow
+		 * threads to make a timely exit without the chance of
+		 * finding more events available and fetching
+		 * repeatedly.
+		 */
+		res = -EINTR;
+	}
 	/*
 	 * Try to transfer events to user space. In case we get 0 events and
 	 * there's still timeout left over, we go trying again in search of
diff -druNp --no-dereference linux-libre-5.6.13-gnu/fs/exec.c linux-libre-5.6.14-gnu/fs/exec.c
--- linux-libre-5.6.13-gnu/fs/exec.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/fs/exec.c	2020-05-20 02:22:38.000000000 -0400
@@ -1277,6 +1277,8 @@ int flush_old_exec(struct linux_binprm *
 	 */
 	set_mm_exe_file(bprm->mm, bprm->file);
 
+	would_dump(bprm, bprm->file);
+
 	/*
 	 * Release all of the old mmap stuff
 	 */
@@ -1820,8 +1822,6 @@ static int __do_execve_file(int fd, stru
 	if (retval < 0)
 		goto out;
 
-	would_dump(bprm, bprm->file);
-
 	retval = exec_binprm(bprm);
 	if (retval < 0)
 		goto out;
diff -druNp --no-dereference linux-libre-5.6.13-gnu/fs/gfs2/bmap.c linux-libre-5.6.14-gnu/fs/gfs2/bmap.c
--- linux-libre-5.6.13-gnu/fs/gfs2/bmap.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/fs/gfs2/bmap.c	2020-05-20 02:22:38.000000000 -0400
@@ -528,10 +528,12 @@ lower_metapath:
 
 		/* Advance in metadata tree. */
 		(mp->mp_list[hgt])++;
-		if (mp->mp_list[hgt] >= sdp->sd_inptrs) {
-			if (!hgt)
+		if (hgt) {
+			if (mp->mp_list[hgt] >= sdp->sd_inptrs)
+				goto lower_metapath;
+		} else {
+			if (mp->mp_list[hgt] >= sdp->sd_diptrs)
 				break;
-			goto lower_metapath;
 		}
 
 fill_up_metapath:
@@ -876,10 +878,9 @@ static int gfs2_iomap_get(struct inode *
 					ret = -ENOENT;
 					goto unlock;
 				} else {
-					/* report a hole */
 					iomap->offset = pos;
 					iomap->length = length;
-					goto do_alloc;
+					goto hole_found;
 				}
 			}
 			iomap->length = size;
@@ -933,8 +934,6 @@ unlock:
 	return ret;
 
 do_alloc:
-	iomap->addr = IOMAP_NULL_ADDR;
-	iomap->type = IOMAP_HOLE;
 	if (flags & IOMAP_REPORT) {
 		if (pos >= size)
 			ret = -ENOENT;
@@ -956,6 +955,9 @@ do_alloc:
 		if (pos < size && height == ip->i_height)
 			ret = gfs2_hole_size(inode, lblock, len, mp, iomap);
 	}
+hole_found:
+	iomap->addr = IOMAP_NULL_ADDR;
+	iomap->type = IOMAP_HOLE;
 	goto out;
 }
 
diff -druNp --no-dereference linux-libre-5.6.13-gnu/fs/gfs2/lops.c linux-libre-5.6.14-gnu/fs/gfs2/lops.c
--- linux-libre-5.6.13-gnu/fs/gfs2/lops.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/fs/gfs2/lops.c	2020-05-20 02:22:38.000000000 -0400
@@ -259,7 +259,7 @@ static struct bio *gfs2_log_alloc_bio(st
 	struct super_block *sb = sdp->sd_vfs;
 	struct bio *bio = bio_alloc(GFP_NOIO, BIO_MAX_PAGES);
 
-	bio->bi_iter.bi_sector = blkno << (sb->s_blocksize_bits - 9);
+	bio->bi_iter.bi_sector = blkno << sdp->sd_fsb2bb_shift;
 	bio_set_dev(bio, sb->s_bdev);
 	bio->bi_end_io = end_io;
 	bio->bi_private = sdp;
@@ -505,7 +505,7 @@ int gfs2_find_jhead(struct gfs2_jdesc *j
 	unsigned int bsize = sdp->sd_sb.sb_bsize, off;
 	unsigned int bsize_shift = sdp->sd_sb.sb_bsize_shift;
 	unsigned int shift = PAGE_SHIFT - bsize_shift;
-	unsigned int readahead_blocks = BIO_MAX_PAGES << shift;
+	unsigned int max_bio_size = 2 * 1024 * 1024;
 	struct gfs2_journal_extent *je;
 	int sz, ret = 0;
 	struct bio *bio = NULL;
@@ -533,12 +533,17 @@ int gfs2_find_jhead(struct gfs2_jdesc *j
 				off = 0;
 			}
 
-			if (!bio || (bio_chained && !off)) {
+			if (!bio || (bio_chained && !off) ||
+			    bio->bi_iter.bi_size >= max_bio_size) {
 				/* start new bio */
 			} else {
-				sz = bio_add_page(bio, page, bsize, off);
-				if (sz == bsize)
-					goto block_added;
+				sector_t sector = dblock << sdp->sd_fsb2bb_shift;
+
+				if (bio_end_sector(bio) == sector) {
+					sz = bio_add_page(bio, page, bsize, off);
+					if (sz == bsize)
+						goto block_added;
+				}
 				if (off) {
 					unsigned int blocks =
 						(PAGE_SIZE - off) >> bsize_shift;
@@ -564,7 +569,7 @@ block_added:
 			off += bsize;
 			if (off == PAGE_SIZE)
 				page = NULL;
-			if (blocks_submitted < blocks_read + readahead_blocks) {
+			if (blocks_submitted < 2 * max_bio_size >> bsize_shift) {
 				/* Keep at least one bio in flight */
 				continue;
 			}
diff -druNp --no-dereference linux-libre-5.6.13-gnu/fs/ioctl.c linux-libre-5.6.14-gnu/fs/ioctl.c
--- linux-libre-5.6.13-gnu/fs/ioctl.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/fs/ioctl.c	2020-05-20 02:22:38.000000000 -0400
@@ -55,6 +55,7 @@ EXPORT_SYMBOL(vfs_ioctl);
 static int ioctl_fibmap(struct file *filp, int __user *p)
 {
 	struct inode *inode = file_inode(filp);
+	struct super_block *sb = inode->i_sb;
 	int error, ur_block;
 	sector_t block;
 
@@ -71,6 +72,13 @@ static int ioctl_fibmap(struct file *fil
 	block = ur_block;
 	error = bmap(inode, &block);
 
+	if (block > INT_MAX) {
+		error = -ERANGE;
+		pr_warn_ratelimited("[%s/%d] FS: %s File: %pD4 would truncate fibmap result\n",
+				    current->comm, task_pid_nr(current),
+				    sb->s_id, filp);
+	}
+
 	if (error)
 		ur_block = 0;
 	else
diff -druNp --no-dereference linux-libre-5.6.13-gnu/fs/iomap/fiemap.c linux-libre-5.6.14-gnu/fs/iomap/fiemap.c
--- linux-libre-5.6.13-gnu/fs/iomap/fiemap.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/fs/iomap/fiemap.c	2020-05-20 02:22:38.000000000 -0400
@@ -117,10 +117,7 @@ iomap_bmap_actor(struct inode *inode, lo
 
 	if (iomap->type == IOMAP_MAPPED) {
 		addr = (pos - iomap->offset + iomap->addr) >> inode->i_blkbits;
-		if (addr > INT_MAX)
-			WARN(1, "would truncate bmap result\n");
-		else
-			*bno = addr;
+		*bno = addr;
 	}
 	return 0;
 }
diff -druNp --no-dereference linux-libre-5.6.13-gnu/fs/io_uring.c linux-libre-5.6.14-gnu/fs/io_uring.c
--- linux-libre-5.6.13-gnu/fs/io_uring.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/fs/io_uring.c	2020-05-20 02:22:38.000000000 -0400
@@ -4258,7 +4258,7 @@ static int io_req_defer(struct io_kiocb
 	int ret;
 
 	/* Still need defer if there is pending req in defer list. */
-	if (!req_need_defer(req) && list_empty(&ctx->defer_list))
+	if (!req_need_defer(req) && list_empty_careful(&ctx->defer_list))
 		return 0;
 
 	if (!req->io && io_alloc_async_ctx(req))
@@ -6451,7 +6451,7 @@ static void io_ring_ctx_wait_and_kill(st
 	 * it could cause shutdown to hang.
 	 */
 	while (ctx->sqo_thread && !wq_has_sleeper(&ctx->sqo_wait))
-		cpu_relax();
+		cond_resched();
 
 	io_kill_timeouts(ctx);
 	io_poll_remove_all(ctx);
diff -druNp --no-dereference linux-libre-5.6.13-gnu/fs/nfs/fscache.c linux-libre-5.6.14-gnu/fs/nfs/fscache.c
--- linux-libre-5.6.13-gnu/fs/nfs/fscache.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/fs/nfs/fscache.c	2020-05-20 02:22:38.000000000 -0400
@@ -118,8 +118,6 @@ void nfs_fscache_get_super_cookie(struct
 
 	nfss->fscache_key = NULL;
 	nfss->fscache = NULL;
-	if (!(nfss->options & NFS_OPTION_FSCACHE))
-		return;
 	if (!uniq) {
 		uniq = "";
 		ulen = 1;
@@ -188,7 +186,8 @@ void nfs_fscache_get_super_cookie(struct
 	/* create a cache index for looking up filehandles */
 	nfss->fscache = fscache_acquire_cookie(nfss->nfs_client->fscache,
 					       &nfs_fscache_super_index_def,
-					       key, sizeof(*key) + ulen,
+					       &key->key,
+					       sizeof(key->key) + ulen,
 					       NULL, 0,
 					       nfss, 0, true);
 	dfprintk(FSCACHE, "NFS: get superblock cookie (0x%p/0x%p)\n",
@@ -226,6 +225,19 @@ void nfs_fscache_release_super_cookie(st
 	}
 }
 
+static void nfs_fscache_update_auxdata(struct nfs_fscache_inode_auxdata *auxdata,
+				  struct nfs_inode *nfsi)
+{
+	memset(auxdata, 0, sizeof(*auxdata));
+	auxdata->mtime_sec  = nfsi->vfs_inode.i_mtime.tv_sec;
+	auxdata->mtime_nsec = nfsi->vfs_inode.i_mtime.tv_nsec;
+	auxdata->ctime_sec  = nfsi->vfs_inode.i_ctime.tv_sec;
+	auxdata->ctime_nsec = nfsi->vfs_inode.i_ctime.tv_nsec;
+
+	if (NFS_SERVER(&nfsi->vfs_inode)->nfs_client->rpc_ops->version == 4)
+		auxdata->change_attr = inode_peek_iversion_raw(&nfsi->vfs_inode);
+}
+
 /*
  * Initialise the per-inode cache cookie pointer for an NFS inode.
  */
@@ -239,14 +251,7 @@ void nfs_fscache_init_inode(struct inode
 	if (!(nfss->fscache && S_ISREG(inode->i_mode)))
 		return;
 
-	memset(&auxdata, 0, sizeof(auxdata));
-	auxdata.mtime_sec  = nfsi->vfs_inode.i_mtime.tv_sec;
-	auxdata.mtime_nsec = nfsi->vfs_inode.i_mtime.tv_nsec;
-	auxdata.ctime_sec  = nfsi->vfs_inode.i_ctime.tv_sec;
-	auxdata.ctime_nsec = nfsi->vfs_inode.i_ctime.tv_nsec;
-
-	if (NFS_SERVER(&nfsi->vfs_inode)->nfs_client->rpc_ops->version == 4)
-		auxdata.change_attr = inode_peek_iversion_raw(&nfsi->vfs_inode);
+	nfs_fscache_update_auxdata(&auxdata, nfsi);
 
 	nfsi->fscache = fscache_acquire_cookie(NFS_SB(inode->i_sb)->fscache,
 					       &nfs_fscache_inode_object_def,
@@ -266,11 +271,7 @@ void nfs_fscache_clear_inode(struct inod
 
 	dfprintk(FSCACHE, "NFS: clear cookie (0x%p/0x%p)\n", nfsi, cookie);
 
-	memset(&auxdata, 0, sizeof(auxdata));
-	auxdata.mtime_sec  = nfsi->vfs_inode.i_mtime.tv_sec;
-	auxdata.mtime_nsec = nfsi->vfs_inode.i_mtime.tv_nsec;
-	auxdata.ctime_sec  = nfsi->vfs_inode.i_ctime.tv_sec;
-	auxdata.ctime_nsec = nfsi->vfs_inode.i_ctime.tv_nsec;
+	nfs_fscache_update_auxdata(&auxdata, nfsi);
 	fscache_relinquish_cookie(cookie, &auxdata, false);
 	nfsi->fscache = NULL;
 }
@@ -310,11 +311,7 @@ void nfs_fscache_open_file(struct inode
 	if (!fscache_cookie_valid(cookie))
 		return;
 
-	memset(&auxdata, 0, sizeof(auxdata));
-	auxdata.mtime_sec  = nfsi->vfs_inode.i_mtime.tv_sec;
-	auxdata.mtime_nsec = nfsi->vfs_inode.i_mtime.tv_nsec;
-	auxdata.ctime_sec  = nfsi->vfs_inode.i_ctime.tv_sec;
-	auxdata.ctime_nsec = nfsi->vfs_inode.i_ctime.tv_nsec;
+	nfs_fscache_update_auxdata(&auxdata, nfsi);
 
 	if (inode_is_open_for_write(inode)) {
 		dfprintk(FSCACHE, "NFS: nfsi 0x%p disabling cache\n", nfsi);
diff -druNp --no-dereference linux-libre-5.6.13-gnu/fs/nfs/mount_clnt.c linux-libre-5.6.14-gnu/fs/nfs/mount_clnt.c
--- linux-libre-5.6.13-gnu/fs/nfs/mount_clnt.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/fs/nfs/mount_clnt.c	2020-05-20 02:22:38.000000000 -0400
@@ -30,6 +30,7 @@
 #define encode_dirpath_sz	(1 + XDR_QUADLEN(MNTPATHLEN))
 #define MNT_status_sz		(1)
 #define MNT_fhandle_sz		XDR_QUADLEN(NFS2_FHSIZE)
+#define MNT_fhandlev3_sz	XDR_QUADLEN(NFS3_FHSIZE)
 #define MNT_authflav3_sz	(1 + NFS_MAX_SECFLAVORS)
 
 /*
@@ -37,7 +38,7 @@
  */
 #define MNT_enc_dirpath_sz	encode_dirpath_sz
 #define MNT_dec_mountres_sz	(MNT_status_sz + MNT_fhandle_sz)
-#define MNT_dec_mountres3_sz	(MNT_status_sz + MNT_fhandle_sz + \
+#define MNT_dec_mountres3_sz	(MNT_status_sz + MNT_fhandlev3_sz + \
 				 MNT_authflav3_sz)
 
 /*
diff -druNp --no-dereference linux-libre-5.6.13-gnu/fs/nfs/nfs4state.c linux-libre-5.6.14-gnu/fs/nfs/nfs4state.c
--- linux-libre-5.6.13-gnu/fs/nfs/nfs4state.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/fs/nfs/nfs4state.c	2020-05-20 02:22:38.000000000 -0400
@@ -734,9 +734,9 @@ nfs4_get_open_state(struct inode *inode,
 		state = new;
 		state->owner = owner;
 		atomic_inc(&owner->so_count);
-		list_add_rcu(&state->inode_states, &nfsi->open_states);
 		ihold(inode);
 		state->inode = inode;
+		list_add_rcu(&state->inode_states, &nfsi->open_states);
 		spin_unlock(&inode->i_lock);
 		/* Note: The reclaim code dictates that we add stateless
 		 * and read-only stateids to the end of the list */
diff -druNp --no-dereference linux-libre-5.6.13-gnu/fs/nfs/super.c linux-libre-5.6.14-gnu/fs/nfs/super.c
--- linux-libre-5.6.13-gnu/fs/nfs/super.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/fs/nfs/super.c	2020-05-20 02:22:38.000000000 -0400
@@ -1154,7 +1154,6 @@ static void nfs_get_cache_cookie(struct
 			uniq = ctx->fscache_uniq;
 			ulen = strlen(ctx->fscache_uniq);
 		}
-		return;
 	}
 
 	nfs_fscache_get_super_cookie(sb, uniq, ulen);
diff -druNp --no-dereference linux-libre-5.6.13-gnu/fs/notify/fanotify/fanotify.c linux-libre-5.6.14-gnu/fs/notify/fanotify/fanotify.c
--- linux-libre-5.6.13-gnu/fs/notify/fanotify/fanotify.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/fs/notify/fanotify/fanotify.c	2020-05-20 02:22:38.000000000 -0400
@@ -172,6 +172,13 @@ static u32 fanotify_group_event_mask(str
 			continue;
 		mark = iter_info->marks[type];
 		/*
+		 * If the event is on dir and this mark doesn't care about
+		 * events on dir, don't send it!
+		 */
+		if (event_mask & FS_ISDIR && !(mark->mask & FS_ISDIR))
+			continue;
+
+		/*
 		 * If the event is for a child and this mark doesn't care about
 		 * events on a child, don't send it!
 		 */
@@ -203,10 +210,6 @@ static u32 fanotify_group_event_mask(str
 		user_mask &= ~FAN_ONDIR;
 	}
 
-	if (event_mask & FS_ISDIR &&
-	    !(marks_mask & FS_ISDIR & ~marks_ignored_mask))
-		return 0;
-
 	return test_mask & user_mask;
 }
 
diff -druNp --no-dereference linux-libre-5.6.13-gnu/include/linux/compiler.h linux-libre-5.6.14-gnu/include/linux/compiler.h
--- linux-libre-5.6.13-gnu/include/linux/compiler.h	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/include/linux/compiler.h	2020-05-20 02:22:38.000000000 -0400
@@ -356,4 +356,10 @@ static inline void *offset_to_ptr(const
 /* &a[0] degrades to a pointer: a different type from an array */
 #define __must_be_array(a)	BUILD_BUG_ON_ZERO(__same_type((a), &(a)[0]))
 
+/*
+ * This is needed in functions which generate the stack canary, see
+ * arch/x86/kernel/smpboot.c::start_secondary() for an example.
+ */
+#define prevent_tail_call_optimization()	mb()
+
 #endif /* __LINUX_COMPILER_H */
diff -druNp --no-dereference linux-libre-5.6.13-gnu/include/linux/fs.h linux-libre-5.6.14-gnu/include/linux/fs.h
--- linux-libre-5.6.13-gnu/include/linux/fs.h	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/include/linux/fs.h	2020-05-20 02:22:38.000000000 -0400
@@ -978,7 +978,7 @@ struct file_handle {
 	__u32 handle_bytes;
 	int handle_type;
 	/* file identifier */
-	unsigned char f_handle[0];
+	unsigned char f_handle[];
 };
 
 static inline struct file *get_file(struct file *f)
diff -druNp --no-dereference linux-libre-5.6.13-gnu/include/linux/ftrace.h linux-libre-5.6.14-gnu/include/linux/ftrace.h
--- linux-libre-5.6.13-gnu/include/linux/ftrace.h	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/include/linux/ftrace.h	2020-05-20 02:22:38.000000000 -0400
@@ -210,6 +210,29 @@ struct ftrace_ops {
 #endif
 };
 
+extern struct ftrace_ops __rcu *ftrace_ops_list;
+extern struct ftrace_ops ftrace_list_end;
+
+/*
+ * Traverse the ftrace_global_list, invoking all entries.  The reason that we
+ * can use rcu_dereference_raw_check() is that elements removed from this list
+ * are simply leaked, so there is no need to interact with a grace-period
+ * mechanism.  The rcu_dereference_raw_check() calls are needed to handle
+ * concurrent insertions into the ftrace_global_list.
+ *
+ * Silly Alpha and silly pointer-speculation compiler optimizations!
+ */
+#define do_for_each_ftrace_op(op, list)			\
+	op = rcu_dereference_raw_check(list);			\
+	do
+
+/*
+ * Optimized for just a single item in the list (as that is the normal case).
+ */
+#define while_for_each_ftrace_op(op)				\
+	while (likely(op = rcu_dereference_raw_check((op)->next)) &&	\
+	       unlikely((op) != &ftrace_list_end))
+
 /*
  * Type of the current tracing.
  */
diff -druNp --no-dereference linux-libre-5.6.13-gnu/include/linux/host1x.h linux-libre-5.6.14-gnu/include/linux/host1x.h
--- linux-libre-5.6.13-gnu/include/linux/host1x.h	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/include/linux/host1x.h	2020-05-20 02:22:38.000000000 -0400
@@ -17,9 +17,12 @@ enum host1x_class {
 	HOST1X_CLASS_GR3D = 0x60,
 };
 
+struct host1x;
 struct host1x_client;
 struct iommu_group;
 
+u64 host1x_get_dma_mask(struct host1x *host1x);
+
 /**
  * struct host1x_client_ops - host1x client operations
  * @init: host1x client initialization code
diff -druNp --no-dereference linux-libre-5.6.13-gnu/include/linux/memcontrol.h linux-libre-5.6.14-gnu/include/linux/memcontrol.h
--- linux-libre-5.6.13-gnu/include/linux/memcontrol.h	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/include/linux/memcontrol.h	2020-05-20 02:22:38.000000000 -0400
@@ -783,6 +783,8 @@ static inline void memcg_memory_event(st
 		atomic_long_inc(&memcg->memory_events[event]);
 		cgroup_file_notify(&memcg->events_file);
 
+		if (!cgroup_subsys_on_dfl(memory_cgrp_subsys))
+			break;
 		if (cgrp_dfl_root.flags & CGRP_ROOT_MEMORY_LOCAL_EVENTS)
 			break;
 	} while ((memcg = parent_mem_cgroup(memcg)) &&
diff -druNp --no-dereference linux-libre-5.6.13-gnu/include/linux/pnp.h linux-libre-5.6.14-gnu/include/linux/pnp.h
--- linux-libre-5.6.13-gnu/include/linux/pnp.h	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/include/linux/pnp.h	2020-05-20 02:22:38.000000000 -0400
@@ -220,10 +220,8 @@ struct pnp_card {
 #define global_to_pnp_card(n) list_entry(n, struct pnp_card, global_list)
 #define protocol_to_pnp_card(n) list_entry(n, struct pnp_card, protocol_list)
 #define to_pnp_card(n) container_of(n, struct pnp_card, dev)
-#define pnp_for_each_card(card) \
-	for((card) = global_to_pnp_card(pnp_cards.next); \
-	(card) != global_to_pnp_card(&pnp_cards); \
-	(card) = global_to_pnp_card((card)->global_list.next))
+#define pnp_for_each_card(card)	\
+	list_for_each_entry(card, &pnp_cards, global_list)
 
 struct pnp_card_link {
 	struct pnp_card *card;
@@ -276,14 +274,9 @@ struct pnp_dev {
 #define card_to_pnp_dev(n) list_entry(n, struct pnp_dev, card_list)
 #define protocol_to_pnp_dev(n) list_entry(n, struct pnp_dev, protocol_list)
 #define	to_pnp_dev(n) container_of(n, struct pnp_dev, dev)
-#define pnp_for_each_dev(dev) \
-	for((dev) = global_to_pnp_dev(pnp_global.next); \
-	(dev) != global_to_pnp_dev(&pnp_global); \
-	(dev) = global_to_pnp_dev((dev)->global_list.next))
-#define card_for_each_dev(card,dev) \
-	for((dev) = card_to_pnp_dev((card)->devices.next); \
-	(dev) != card_to_pnp_dev(&(card)->devices); \
-	(dev) = card_to_pnp_dev((dev)->card_list.next))
+#define pnp_for_each_dev(dev) list_for_each_entry(dev, &pnp_global, global_list)
+#define card_for_each_dev(card, dev)	\
+	list_for_each_entry(dev, &(card)->devices, card_list)
 #define pnp_dev_name(dev) (dev)->name
 
 static inline void *pnp_get_drvdata(struct pnp_dev *pdev)
@@ -437,14 +430,10 @@ struct pnp_protocol {
 };
 
 #define to_pnp_protocol(n) list_entry(n, struct pnp_protocol, protocol_list)
-#define protocol_for_each_card(protocol,card) \
-	for((card) = protocol_to_pnp_card((protocol)->cards.next); \
-	(card) != protocol_to_pnp_card(&(protocol)->cards); \
-	(card) = protocol_to_pnp_card((card)->protocol_list.next))
-#define protocol_for_each_dev(protocol,dev) \
-	for((dev) = protocol_to_pnp_dev((protocol)->devices.next); \
-	(dev) != protocol_to_pnp_dev(&(protocol)->devices); \
-	(dev) = protocol_to_pnp_dev((dev)->protocol_list.next))
+#define protocol_for_each_card(protocol, card)	\
+	list_for_each_entry(card, &(protocol)->cards, protocol_list)
+#define protocol_for_each_dev(protocol, dev)	\
+	list_for_each_entry(dev, &(protocol)->devices, protocol_list)
 
 extern struct bus_type pnp_bus_type;
 
diff -druNp --no-dereference linux-libre-5.6.13-gnu/include/linux/skmsg.h linux-libre-5.6.14-gnu/include/linux/skmsg.h
--- linux-libre-5.6.13-gnu/include/linux/skmsg.h	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/include/linux/skmsg.h	2020-05-20 02:22:38.000000000 -0400
@@ -187,6 +187,7 @@ static inline void sk_msg_xfer(struct sk
 	dst->sg.data[which] = src->sg.data[which];
 	dst->sg.data[which].length  = size;
 	dst->sg.size		   += size;
+	src->sg.size		   -= size;
 	src->sg.data[which].length -= size;
 	src->sg.data[which].offset += size;
 }
diff -druNp --no-dereference linux-libre-5.6.13-gnu/include/linux/sunrpc/gss_api.h linux-libre-5.6.14-gnu/include/linux/sunrpc/gss_api.h
--- linux-libre-5.6.13-gnu/include/linux/sunrpc/gss_api.h	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/include/linux/sunrpc/gss_api.h	2020-05-20 02:22:38.000000000 -0400
@@ -21,6 +21,7 @@
 struct gss_ctx {
 	struct gss_api_mech	*mech_type;
 	void			*internal_ctx_id;
+	unsigned int		slack, align;
 };
 
 #define GSS_C_NO_BUFFER		((struct xdr_netobj) 0)
@@ -66,6 +67,7 @@ u32 gss_wrap(
 u32 gss_unwrap(
 		struct gss_ctx		*ctx_id,
 		int			offset,
+		int			len,
 		struct xdr_buf		*inbuf);
 u32 gss_delete_sec_context(
 		struct gss_ctx		**ctx_id);
@@ -126,6 +128,7 @@ struct gss_api_ops {
 	u32 (*gss_unwrap)(
 			struct gss_ctx		*ctx_id,
 			int			offset,
+			int			len,
 			struct xdr_buf		*buf);
 	void (*gss_delete_sec_context)(
 			void			*internal_ctx_id);
diff -druNp --no-dereference linux-libre-5.6.13-gnu/include/linux/sunrpc/gss_krb5.h linux-libre-5.6.14-gnu/include/linux/sunrpc/gss_krb5.h
--- linux-libre-5.6.13-gnu/include/linux/sunrpc/gss_krb5.h	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/include/linux/sunrpc/gss_krb5.h	2020-05-20 02:22:38.000000000 -0400
@@ -83,7 +83,7 @@ struct gss_krb5_enctype {
 	u32 (*encrypt_v2) (struct krb5_ctx *kctx, u32 offset,
 			   struct xdr_buf *buf,
 			   struct page **pages); /* v2 encryption function */
-	u32 (*decrypt_v2) (struct krb5_ctx *kctx, u32 offset,
+	u32 (*decrypt_v2) (struct krb5_ctx *kctx, u32 offset, u32 len,
 			   struct xdr_buf *buf, u32 *headskip,
 			   u32 *tailskip);	/* v2 decryption function */
 };
@@ -255,7 +255,7 @@ gss_wrap_kerberos(struct gss_ctx *ctx_id
 		struct xdr_buf *outbuf, struct page **pages);
 
 u32
-gss_unwrap_kerberos(struct gss_ctx *ctx_id, int offset,
+gss_unwrap_kerberos(struct gss_ctx *ctx_id, int offset, int len,
 		struct xdr_buf *buf);
 
 
@@ -312,7 +312,7 @@ gss_krb5_aes_encrypt(struct krb5_ctx *kc
 		     struct page **pages);
 
 u32
-gss_krb5_aes_decrypt(struct krb5_ctx *kctx, u32 offset,
+gss_krb5_aes_decrypt(struct krb5_ctx *kctx, u32 offset, u32 len,
 		     struct xdr_buf *buf, u32 *plainoffset,
 		     u32 *plainlen);
 
diff -druNp --no-dereference linux-libre-5.6.13-gnu/include/linux/sunrpc/xdr.h linux-libre-5.6.14-gnu/include/linux/sunrpc/xdr.h
--- linux-libre-5.6.13-gnu/include/linux/sunrpc/xdr.h	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/include/linux/sunrpc/xdr.h	2020-05-20 02:22:38.000000000 -0400
@@ -184,6 +184,7 @@ xdr_adjust_iovec(struct kvec *iov, __be3
 extern void xdr_shift_buf(struct xdr_buf *, size_t);
 extern void xdr_buf_from_iov(struct kvec *, struct xdr_buf *);
 extern int xdr_buf_subsegment(struct xdr_buf *, struct xdr_buf *, unsigned int, unsigned int);
+extern void xdr_buf_trim(struct xdr_buf *, unsigned int);
 extern int xdr_buf_read_mic(struct xdr_buf *, struct xdr_netobj *, unsigned int);
 extern int read_bytes_from_xdr_buf(struct xdr_buf *, unsigned int, void *, unsigned int);
 extern int write_bytes_to_xdr_buf(struct xdr_buf *, unsigned int, void *, unsigned int);
diff -druNp --no-dereference linux-libre-5.6.13-gnu/include/linux/tty.h linux-libre-5.6.14-gnu/include/linux/tty.h
--- linux-libre-5.6.13-gnu/include/linux/tty.h	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/include/linux/tty.h	2020-05-20 02:22:38.000000000 -0400
@@ -66,7 +66,7 @@ struct tty_buffer {
 	int read;
 	int flags;
 	/* Data points here */
-	unsigned long data[0];
+	unsigned long data[];
 };
 
 /* Values for .flags field of tty_buffer */
diff -druNp --no-dereference linux-libre-5.6.13-gnu/include/net/netfilter/nf_conntrack.h linux-libre-5.6.14-gnu/include/net/netfilter/nf_conntrack.h
--- linux-libre-5.6.13-gnu/include/net/netfilter/nf_conntrack.h	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/include/net/netfilter/nf_conntrack.h	2020-05-20 02:22:38.000000000 -0400
@@ -87,7 +87,7 @@ struct nf_conn {
 	struct hlist_node	nat_bysource;
 #endif
 	/* all members below initialized via memset */
-	u8 __nfct_init_offset[0];
+	struct { } __nfct_init_offset;
 
 	/* If we were expected by an expectation, this will be it */
 	struct nf_conn *master;
diff -druNp --no-dereference linux-libre-5.6.13-gnu/include/net/sch_generic.h linux-libre-5.6.14-gnu/include/net/sch_generic.h
--- linux-libre-5.6.13-gnu/include/net/sch_generic.h	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/include/net/sch_generic.h	2020-05-20 02:22:38.000000000 -0400
@@ -407,6 +407,7 @@ struct tcf_block {
 	struct mutex lock;
 	struct list_head chain_list;
 	u32 index; /* block index for shared blocks */
+	u32 classid; /* which class this block belongs to */
 	refcount_t refcnt;
 	struct net *net;
 	struct Qdisc *q;
diff -druNp --no-dereference linux-libre-5.6.13-gnu/include/net/tcp.h linux-libre-5.6.14-gnu/include/net/tcp.h
--- linux-libre-5.6.13-gnu/include/net/tcp.h	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/include/net/tcp.h	2020-05-20 02:22:38.000000000 -0400
@@ -1421,6 +1421,19 @@ static inline int tcp_full_space(const s
 	return tcp_win_from_space(sk, READ_ONCE(sk->sk_rcvbuf));
 }
 
+/* We provision sk_rcvbuf around 200% of sk_rcvlowat.
+ * If 87.5 % (7/8) of the space has been consumed, we want to override
+ * SO_RCVLOWAT constraint, since we are receiving skbs with too small
+ * len/truesize ratio.
+ */
+static inline bool tcp_rmem_pressure(const struct sock *sk)
+{
+	int rcvbuf = READ_ONCE(sk->sk_rcvbuf);
+	int threshold = rcvbuf - (rcvbuf >> 3);
+
+	return atomic_read(&sk->sk_rmem_alloc) > threshold;
+}
+
 extern void tcp_openreq_init_rwin(struct request_sock *req,
 				  const struct sock *sk_listener,
 				  const struct dst_entry *dst);
diff -druNp --no-dereference linux-libre-5.6.13-gnu/include/soc/mscc/ocelot.h linux-libre-5.6.14-gnu/include/soc/mscc/ocelot.h
--- linux-libre-5.6.13-gnu/include/soc/mscc/ocelot.h	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/include/soc/mscc/ocelot.h	2020-05-20 02:22:38.000000000 -0400
@@ -437,6 +437,7 @@ struct ocelot {
 	unsigned int			num_stats;
 
 	int				shared_queue_sz;
+	int				num_mact_rows;
 
 	struct net_device		*hw_bridge_dev;
 	u16				bridge_mask;
diff -druNp --no-dereference linux-libre-5.6.13-gnu/include/sound/rawmidi.h linux-libre-5.6.14-gnu/include/sound/rawmidi.h
--- linux-libre-5.6.13-gnu/include/sound/rawmidi.h	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/include/sound/rawmidi.h	2020-05-20 02:22:38.000000000 -0400
@@ -61,6 +61,7 @@ struct snd_rawmidi_runtime {
 	size_t avail_min;	/* min avail for wakeup */
 	size_t avail;		/* max used buffer for wakeup */
 	size_t xruns;		/* over/underruns counter */
+	int buffer_ref;		/* buffer reference count */
 	/* misc */
 	spinlock_t lock;
 	wait_queue_head_t sleep;
diff -druNp --no-dereference linux-libre-5.6.13-gnu/include/trace/events/rpcrdma.h linux-libre-5.6.14-gnu/include/trace/events/rpcrdma.h
--- linux-libre-5.6.13-gnu/include/trace/events/rpcrdma.h	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/include/trace/events/rpcrdma.h	2020-05-20 02:22:38.000000000 -0400
@@ -721,11 +721,10 @@ TRACE_EVENT(xprtrdma_prepsend_failed,
 
 TRACE_EVENT(xprtrdma_post_send,
 	TP_PROTO(
-		const struct rpcrdma_req *req,
-		int status
+		const struct rpcrdma_req *req
 	),
 
-	TP_ARGS(req, status),
+	TP_ARGS(req),
 
 	TP_STRUCT__entry(
 		__field(const void *, req)
@@ -734,7 +733,6 @@ TRACE_EVENT(xprtrdma_post_send,
 		__field(unsigned int, client_id)
 		__field(int, num_sge)
 		__field(int, signaled)
-		__field(int, status)
 	),
 
 	TP_fast_assign(
@@ -747,15 +745,13 @@ TRACE_EVENT(xprtrdma_post_send,
 		__entry->sc = req->rl_sendctx;
 		__entry->num_sge = req->rl_wr.num_sge;
 		__entry->signaled = req->rl_wr.send_flags & IB_SEND_SIGNALED;
-		__entry->status = status;
 	),
 
-	TP_printk("task:%u@%u req=%p sc=%p (%d SGE%s) %sstatus=%d",
+	TP_printk("task:%u@%u req=%p sc=%p (%d SGE%s) %s",
 		__entry->task_id, __entry->client_id,
 		__entry->req, __entry->sc, __entry->num_sge,
 		(__entry->num_sge == 1 ? "" : "s"),
-		(__entry->signaled ? "signaled " : ""),
-		__entry->status
+		(__entry->signaled ? "signaled" : "")
 	)
 );
 
diff -druNp --no-dereference linux-libre-5.6.13-gnu/init/initramfs.c linux-libre-5.6.14-gnu/init/initramfs.c
--- linux-libre-5.6.13-gnu/init/initramfs.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/init/initramfs.c	2020-05-20 02:22:38.000000000 -0400
@@ -542,7 +542,7 @@ void __weak free_initrd_mem(unsigned lon
 }
 
 #ifdef CONFIG_KEXEC_CORE
-static bool kexec_free_initrd(void)
+static bool __init kexec_free_initrd(void)
 {
 	unsigned long crashk_start = (unsigned long)__va(crashk_res.start);
 	unsigned long crashk_end   = (unsigned long)__va(crashk_res.end);
diff -druNp --no-dereference linux-libre-5.6.13-gnu/init/Kconfig linux-libre-5.6.14-gnu/init/Kconfig
--- linux-libre-5.6.13-gnu/init/Kconfig	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/init/Kconfig	2020-05-20 02:22:38.000000000 -0400
@@ -36,22 +36,6 @@ config TOOLS_SUPPORT_RELR
 config CC_HAS_ASM_INLINE
 	def_bool $(success,echo 'void foo(void) { asm inline (""); }' | $(CC) -x c - -c -o /dev/null)
 
-config CC_HAS_WARN_MAYBE_UNINITIALIZED
-	def_bool $(cc-option,-Wmaybe-uninitialized)
-	help
-	  GCC >= 4.7 supports this option.
-
-config CC_DISABLE_WARN_MAYBE_UNINITIALIZED
-	bool
-	depends on CC_HAS_WARN_MAYBE_UNINITIALIZED
-	default CC_IS_GCC && GCC_VERSION < 40900  # unreliable for GCC < 4.9
-	help
-	  GCC's -Wmaybe-uninitialized is not reliable by definition.
-	  Lots of false positive warnings are produced in some cases.
-
-	  If this option is enabled, -Wno-maybe-uninitialzed is passed
-	  to the compiler to suppress maybe-uninitialized warnings.
-
 config CONSTRUCTORS
 	bool
 	depends on !UML
@@ -1249,14 +1233,12 @@ config CC_OPTIMIZE_FOR_PERFORMANCE
 config CC_OPTIMIZE_FOR_PERFORMANCE_O3
 	bool "Optimize more for performance (-O3)"
 	depends on ARC
-	imply CC_DISABLE_WARN_MAYBE_UNINITIALIZED  # avoid false positives
 	help
 	  Choosing this option will pass "-O3" to your compiler to optimize
 	  the kernel yet more for performance.
 
 config CC_OPTIMIZE_FOR_SIZE
 	bool "Optimize for size (-Os)"
-	imply CC_DISABLE_WARN_MAYBE_UNINITIALIZED  # avoid false positives
 	help
 	  Choosing this option will pass "-Os" to your compiler resulting
 	  in a smaller kernel.
diff -druNp --no-dereference linux-libre-5.6.13-gnu/init/main.c linux-libre-5.6.14-gnu/init/main.c
--- linux-libre-5.6.13-gnu/init/main.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/init/main.c	2020-05-20 02:22:38.000000000 -0400
@@ -257,6 +257,47 @@ static int __init loglevel(char *str)
 
 early_param("loglevel", loglevel);
 
+#ifdef CONFIG_BLK_DEV_INITRD
+static void * __init get_boot_config_from_initrd(u32 *_size, u32 *_csum)
+{
+	u32 size, csum;
+	char *data;
+	u32 *hdr;
+
+	if (!initrd_end)
+		return NULL;
+
+	data = (char *)initrd_end - BOOTCONFIG_MAGIC_LEN;
+	if (memcmp(data, BOOTCONFIG_MAGIC, BOOTCONFIG_MAGIC_LEN))
+		return NULL;
+
+	hdr = (u32 *)(data - 8);
+	size = hdr[0];
+	csum = hdr[1];
+
+	data = ((void *)hdr) - size;
+	if ((unsigned long)data < initrd_start) {
+		pr_err("bootconfig size %d is greater than initrd size %ld\n",
+			size, initrd_end - initrd_start);
+		return NULL;
+	}
+
+	/* Remove bootconfig from initramfs/initrd */
+	initrd_end = (unsigned long)data;
+	if (_size)
+		*_size = size;
+	if (_csum)
+		*_csum = csum;
+
+	return data;
+}
+#else
+static void * __init get_boot_config_from_initrd(u32 *_size, u32 *_csum)
+{
+	return NULL;
+}
+#endif
+
 #ifdef CONFIG_BOOT_CONFIG
 
 char xbc_namebuf[XBC_KEYLEN_MAX] __initdata;
@@ -355,9 +396,11 @@ static void __init setup_boot_config(con
 	static char tmp_cmdline[COMMAND_LINE_SIZE] __initdata;
 	u32 size, csum;
 	char *data, *copy;
-	u32 *hdr;
 	int ret;
 
+	/* Cut out the bootconfig data even if we have no bootconfig option */
+	data = get_boot_config_from_initrd(&size, &csum);
+
 	strlcpy(tmp_cmdline, boot_command_line, COMMAND_LINE_SIZE);
 	parse_args("bootconfig", tmp_cmdline, NULL, 0, 0, 0, NULL,
 		   bootconfig_params);
@@ -365,16 +408,10 @@ static void __init setup_boot_config(con
 	if (!bootconfig_found)
 		return;
 
-	if (!initrd_end)
-		goto not_found;
-
-	data = (char *)initrd_end - BOOTCONFIG_MAGIC_LEN;
-	if (memcmp(data, BOOTCONFIG_MAGIC, BOOTCONFIG_MAGIC_LEN))
-		goto not_found;
-
-	hdr = (u32 *)(data - 8);
-	size = hdr[0];
-	csum = hdr[1];
+	if (!data) {
+		pr_err("'bootconfig' found on command line, but no bootconfig found\n");
+		return;
+	}
 
 	if (size >= XBC_DATA_MAX) {
 		pr_err("bootconfig size %d greater than max size %d\n",
@@ -382,10 +419,6 @@ static void __init setup_boot_config(con
 		return;
 	}
 
-	data = ((void *)hdr) - size;
-	if ((unsigned long)data < initrd_start)
-		goto not_found;
-
 	if (boot_config_checksum((unsigned char *)data, size) != csum) {
 		pr_err("bootconfig checksum failed\n");
 		return;
@@ -411,11 +444,15 @@ static void __init setup_boot_config(con
 		extra_init_args = xbc_make_cmdline("init");
 	}
 	return;
-not_found:
-	pr_err("'bootconfig' found on command line, but no bootconfig found\n");
 }
+
 #else
-#define setup_boot_config(cmdline)	do { } while (0)
+
+static void __init setup_boot_config(const char *cmdline)
+{
+	/* Remove bootconfig data from initrd */
+	get_boot_config_from_initrd(NULL, NULL);
+}
 
 static int __init warn_bootconfig(char *str)
 {
@@ -995,6 +1032,8 @@ asmlinkage __visible void __init start_k
 
 	/* Do the rest non-__init'ed, we're now alive */
 	arch_call_rest_init();
+
+	prevent_tail_call_optimization();
 }
 
 /* Call all constructor functions linked into the kernel. */
diff -druNp --no-dereference linux-libre-5.6.13-gnu/ipc/util.c linux-libre-5.6.14-gnu/ipc/util.c
--- linux-libre-5.6.13-gnu/ipc/util.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/ipc/util.c	2020-05-20 02:22:38.000000000 -0400
@@ -764,21 +764,21 @@ static struct kern_ipc_perm *sysvipc_fin
 			total++;
 	}
 
-	*new_pos = pos + 1;
+	ipc = NULL;
 	if (total >= ids->in_use)
-		return NULL;
+		goto out;
 
 	for (; pos < ipc_mni; pos++) {
 		ipc = idr_find(&ids->ipcs_idr, pos);
 		if (ipc != NULL) {
 			rcu_read_lock();
 			ipc_lock_object(ipc);
-			return ipc;
+			break;
 		}
 	}
-
-	/* Out of range - return NULL to terminate iteration */
-	return NULL;
+out:
+	*new_pos = pos + 1;
+	return ipc;
 }
 
 static void *sysvipc_proc_next(struct seq_file *s, void *it, loff_t *pos)
diff -druNp --no-dereference linux-libre-5.6.13-gnu/kernel/bpf/arraymap.c linux-libre-5.6.14-gnu/kernel/bpf/arraymap.c
--- linux-libre-5.6.13-gnu/kernel/bpf/arraymap.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/kernel/bpf/arraymap.c	2020-05-20 02:22:38.000000000 -0400
@@ -486,7 +486,12 @@ static int array_map_mmap(struct bpf_map
 	if (!(map->map_flags & BPF_F_MMAPABLE))
 		return -EINVAL;
 
-	return remap_vmalloc_range(vma, array_map_vmalloc_addr(array), pgoff);
+	if (vma->vm_pgoff * PAGE_SIZE + (vma->vm_end - vma->vm_start) >
+	    PAGE_ALIGN((u64)array->map.max_entries * array->elem_size))
+		return -EINVAL;
+
+	return remap_vmalloc_range(vma, array_map_vmalloc_addr(array),
+				   vma->vm_pgoff + pgoff);
 }
 
 const struct bpf_map_ops array_map_ops = {
diff -druNp --no-dereference linux-libre-5.6.13-gnu/kernel/bpf/syscall.c linux-libre-5.6.14-gnu/kernel/bpf/syscall.c
--- linux-libre-5.6.13-gnu/kernel/bpf/syscall.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/kernel/bpf/syscall.c	2020-05-20 02:22:38.000000000 -0400
@@ -1480,8 +1480,10 @@ static int map_lookup_and_delete_elem(un
 	if (err)
 		goto free_value;
 
-	if (copy_to_user(uvalue, value, value_size) != 0)
+	if (copy_to_user(uvalue, value, value_size) != 0) {
+		err = -EFAULT;
 		goto free_value;
+	}
 
 	err = 0;
 
diff -druNp --no-dereference linux-libre-5.6.13-gnu/kernel/bpf/verifier.c linux-libre-5.6.14-gnu/kernel/bpf/verifier.c
--- linux-libre-5.6.13-gnu/kernel/bpf/verifier.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/kernel/bpf/verifier.c	2020-05-20 02:22:38.000000000 -0400
@@ -6498,6 +6498,22 @@ static int check_return_code(struct bpf_
 			return 0;
 		range = tnum_const(0);
 		break;
+	case BPF_PROG_TYPE_TRACING:
+		switch (env->prog->expected_attach_type) {
+		case BPF_TRACE_FENTRY:
+		case BPF_TRACE_FEXIT:
+			range = tnum_const(0);
+			break;
+		case BPF_TRACE_RAW_TP:
+			return 0;
+		default:
+			return -ENOTSUPP;
+		}
+		break;
+	case BPF_PROG_TYPE_EXT:
+		/* freplace program can return anything as its return value
+		 * depends on the to-be-replaced kernel func or bpf program.
+		 */
 	default:
 		return 0;
 	}
diff -druNp --no-dereference linux-libre-5.6.13-gnu/kernel/fork.c linux-libre-5.6.14-gnu/kernel/fork.c
--- linux-libre-5.6.13-gnu/kernel/fork.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/kernel/fork.c	2020-05-20 02:22:38.000000000 -0400
@@ -2486,11 +2486,11 @@ long do_fork(unsigned long clone_flags,
 	      int __user *child_tidptr)
 {
 	struct kernel_clone_args args = {
-		.flags		= (clone_flags & ~CSIGNAL),
+		.flags		= (lower_32_bits(clone_flags) & ~CSIGNAL),
 		.pidfd		= parent_tidptr,
 		.child_tid	= child_tidptr,
 		.parent_tid	= parent_tidptr,
-		.exit_signal	= (clone_flags & CSIGNAL),
+		.exit_signal	= (lower_32_bits(clone_flags) & CSIGNAL),
 		.stack		= stack_start,
 		.stack_size	= stack_size,
 	};
@@ -2508,8 +2508,9 @@ long do_fork(unsigned long clone_flags,
 pid_t kernel_thread(int (*fn)(void *), void *arg, unsigned long flags)
 {
 	struct kernel_clone_args args = {
-		.flags		= ((flags | CLONE_VM | CLONE_UNTRACED) & ~CSIGNAL),
-		.exit_signal	= (flags & CSIGNAL),
+		.flags		= ((lower_32_bits(flags) | CLONE_VM |
+				    CLONE_UNTRACED) & ~CSIGNAL),
+		.exit_signal	= (lower_32_bits(flags) & CSIGNAL),
 		.stack		= (unsigned long)fn,
 		.stack_size	= (unsigned long)arg,
 	};
@@ -2570,11 +2571,11 @@ SYSCALL_DEFINE5(clone, unsigned long, cl
 #endif
 {
 	struct kernel_clone_args args = {
-		.flags		= (clone_flags & ~CSIGNAL),
+		.flags		= (lower_32_bits(clone_flags) & ~CSIGNAL),
 		.pidfd		= parent_tidptr,
 		.child_tid	= child_tidptr,
 		.parent_tid	= parent_tidptr,
-		.exit_signal	= (clone_flags & CSIGNAL),
+		.exit_signal	= (lower_32_bits(clone_flags) & CSIGNAL),
 		.stack		= newsp,
 		.tls		= tls,
 	};
diff -druNp --no-dereference linux-libre-5.6.13-gnu/kernel/trace/bpf_trace.c linux-libre-5.6.14-gnu/kernel/trace/bpf_trace.c
--- linux-libre-5.6.13-gnu/kernel/trace/bpf_trace.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/kernel/trace/bpf_trace.c	2020-05-20 02:22:38.000000000 -0400
@@ -325,17 +325,15 @@ static const struct bpf_func_proto *bpf_
 
 /*
  * Only limited trace_printk() conversion specifiers allowed:
- * %d %i %u %x %ld %li %lu %lx %lld %lli %llu %llx %p %s
+ * %d %i %u %x %ld %li %lu %lx %lld %lli %llu %llx %p %pks %pus %s
  */
 BPF_CALL_5(bpf_trace_printk, char *, fmt, u32, fmt_size, u64, arg1,
 	   u64, arg2, u64, arg3)
 {
+	int i, mod[3] = {}, fmt_cnt = 0;
+	char buf[64], fmt_ptype;
+	void *unsafe_ptr = NULL;
 	bool str_seen = false;
-	int mod[3] = {};
-	int fmt_cnt = 0;
-	u64 unsafe_addr;
-	char buf[64];
-	int i;
 
 	/*
 	 * bpf_check()->check_func_arg()->check_stack_boundary()
@@ -361,40 +359,71 @@ BPF_CALL_5(bpf_trace_printk, char *, fmt
 		if (fmt[i] == 'l') {
 			mod[fmt_cnt]++;
 			i++;
-		} else if (fmt[i] == 'p' || fmt[i] == 's') {
+		} else if (fmt[i] == 'p') {
 			mod[fmt_cnt]++;
+			if ((fmt[i + 1] == 'k' ||
+			     fmt[i + 1] == 'u') &&
+			    fmt[i + 2] == 's') {
+				fmt_ptype = fmt[i + 1];
+				i += 2;
+				goto fmt_str;
+			}
+
 			/* disallow any further format extensions */
 			if (fmt[i + 1] != 0 &&
 			    !isspace(fmt[i + 1]) &&
 			    !ispunct(fmt[i + 1]))
 				return -EINVAL;
-			fmt_cnt++;
-			if (fmt[i] == 's') {
-				if (str_seen)
-					/* allow only one '%s' per fmt string */
-					return -EINVAL;
-				str_seen = true;
 
-				switch (fmt_cnt) {
-				case 1:
-					unsafe_addr = arg1;
-					arg1 = (long) buf;
-					break;
-				case 2:
-					unsafe_addr = arg2;
-					arg2 = (long) buf;
-					break;
-				case 3:
-					unsafe_addr = arg3;
-					arg3 = (long) buf;
-					break;
-				}
-				buf[0] = 0;
-				strncpy_from_unsafe(buf,
-						    (void *) (long) unsafe_addr,
+			goto fmt_next;
+		} else if (fmt[i] == 's') {
+			mod[fmt_cnt]++;
+			fmt_ptype = fmt[i];
+fmt_str:
+			if (str_seen)
+				/* allow only one '%s' per fmt string */
+				return -EINVAL;
+			str_seen = true;
+
+			if (fmt[i + 1] != 0 &&
+			    !isspace(fmt[i + 1]) &&
+			    !ispunct(fmt[i + 1]))
+				return -EINVAL;
+
+			switch (fmt_cnt) {
+			case 0:
+				unsafe_ptr = (void *)(long)arg1;
+				arg1 = (long)buf;
+				break;
+			case 1:
+				unsafe_ptr = (void *)(long)arg2;
+				arg2 = (long)buf;
+				break;
+			case 2:
+				unsafe_ptr = (void *)(long)arg3;
+				arg3 = (long)buf;
+				break;
+			}
+
+			buf[0] = 0;
+			switch (fmt_ptype) {
+			case 's':
+#ifdef CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE
+				strncpy_from_unsafe(buf, unsafe_ptr,
 						    sizeof(buf));
+				break;
+#endif
+			case 'k':
+				strncpy_from_unsafe_strict(buf, unsafe_ptr,
+							   sizeof(buf));
+				break;
+			case 'u':
+				strncpy_from_unsafe_user(buf,
+					(__force void __user *)unsafe_ptr,
+							 sizeof(buf));
+				break;
 			}
-			continue;
+			goto fmt_next;
 		}
 
 		if (fmt[i] == 'l') {
@@ -405,6 +434,7 @@ BPF_CALL_5(bpf_trace_printk, char *, fmt
 		if (fmt[i] != 'i' && fmt[i] != 'd' &&
 		    fmt[i] != 'u' && fmt[i] != 'x')
 			return -EINVAL;
+fmt_next:
 		fmt_cnt++;
 	}
 
diff -druNp --no-dereference linux-libre-5.6.13-gnu/kernel/trace/ftrace_internal.h linux-libre-5.6.14-gnu/kernel/trace/ftrace_internal.h
--- linux-libre-5.6.13-gnu/kernel/trace/ftrace_internal.h	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/kernel/trace/ftrace_internal.h	2020-05-20 02:22:38.000000000 -0400
@@ -4,28 +4,6 @@
 
 #ifdef CONFIG_FUNCTION_TRACER
 
-/*
- * Traverse the ftrace_global_list, invoking all entries.  The reason that we
- * can use rcu_dereference_raw_check() is that elements removed from this list
- * are simply leaked, so there is no need to interact with a grace-period
- * mechanism.  The rcu_dereference_raw_check() calls are needed to handle
- * concurrent insertions into the ftrace_global_list.
- *
- * Silly Alpha and silly pointer-speculation compiler optimizations!
- */
-#define do_for_each_ftrace_op(op, list)			\
-	op = rcu_dereference_raw_check(list);			\
-	do
-
-/*
- * Optimized for just a single item in the list (as that is the normal case).
- */
-#define while_for_each_ftrace_op(op)				\
-	while (likely(op = rcu_dereference_raw_check((op)->next)) &&	\
-	       unlikely((op) != &ftrace_list_end))
-
-extern struct ftrace_ops __rcu *ftrace_ops_list;
-extern struct ftrace_ops ftrace_list_end;
 extern struct mutex ftrace_lock;
 extern struct ftrace_ops global_ops;
 
diff -druNp --no-dereference linux-libre-5.6.13-gnu/kernel/trace/Kconfig linux-libre-5.6.14-gnu/kernel/trace/Kconfig
--- linux-libre-5.6.13-gnu/kernel/trace/Kconfig	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/kernel/trace/Kconfig	2020-05-20 02:22:38.000000000 -0400
@@ -466,7 +466,6 @@ config PROFILE_ANNOTATED_BRANCHES
 config PROFILE_ALL_BRANCHES
 	bool "Profile all if conditionals" if !FORTIFY_SOURCE
 	select TRACE_BRANCH_PROFILING
-	imply CC_DISABLE_WARN_MAYBE_UNINITIALIZED  # avoid false positives
 	help
 	  This tracer profiles all branch conditions. Every if ()
 	  taken in the kernel is recorded whether it hit or miss.
diff -druNp --no-dereference linux-libre-5.6.13-gnu/kernel/trace/preemptirq_delay_test.c linux-libre-5.6.14-gnu/kernel/trace/preemptirq_delay_test.c
--- linux-libre-5.6.13-gnu/kernel/trace/preemptirq_delay_test.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/kernel/trace/preemptirq_delay_test.c	2020-05-20 02:22:38.000000000 -0400
@@ -16,6 +16,7 @@
 #include <linux/printk.h>
 #include <linux/string.h>
 #include <linux/sysfs.h>
+#include <linux/completion.h>
 
 static ulong delay = 100;
 static char test_mode[12] = "irq";
@@ -28,6 +29,8 @@ MODULE_PARM_DESC(delay, "Period in micro
 MODULE_PARM_DESC(test_mode, "Mode of the test such as preempt, irq, or alternate (default irq)");
 MODULE_PARM_DESC(burst_size, "The size of a burst (default 1)");
 
+static struct completion done;
+
 #define MIN(x, y) ((x) < (y) ? (x) : (y))
 
 static void busy_wait(ulong time)
@@ -114,6 +117,8 @@ static int preemptirq_delay_run(void *da
 	for (i = 0; i < s; i++)
 		(testfuncs[i])(i);
 
+	complete(&done);
+
 	set_current_state(TASK_INTERRUPTIBLE);
 	while (!kthread_should_stop()) {
 		schedule();
@@ -128,15 +133,18 @@ static int preemptirq_delay_run(void *da
 static int preemptirq_run_test(void)
 {
 	struct task_struct *task;
-
 	char task_name[50];
 
+	init_completion(&done);
+
 	snprintf(task_name, sizeof(task_name), "%s_test", test_mode);
 	task =  kthread_run(preemptirq_delay_run, NULL, task_name);
 	if (IS_ERR(task))
 		return PTR_ERR(task);
-	if (task)
+	if (task) {
+		wait_for_completion(&done);
 		kthread_stop(task);
+	}
 	return 0;
 }
 
diff -druNp --no-dereference linux-libre-5.6.13-gnu/kernel/umh.c linux-libre-5.6.14-gnu/kernel/umh.c
--- linux-libre-5.6.13-gnu/kernel/umh.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/kernel/umh.c	2020-05-20 02:22:38.000000000 -0400
@@ -475,6 +475,12 @@ static void umh_clean_and_save_pid(struc
 {
 	struct umh_info *umh_info = info->data;
 
+	/* cleanup if umh_pipe_setup() was successful but exec failed */
+	if (info->pid && info->retval) {
+		fput(umh_info->pipe_to_umh);
+		fput(umh_info->pipe_from_umh);
+	}
+
 	argv_free(info->argv);
 	umh_info->pid = info->pid;
 }
diff -druNp --no-dereference linux-libre-5.6.13-gnu/lib/vsprintf.c linux-libre-5.6.14-gnu/lib/vsprintf.c
--- linux-libre-5.6.13-gnu/lib/vsprintf.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/lib/vsprintf.c	2020-05-20 02:22:38.000000000 -0400
@@ -2168,6 +2168,10 @@ char *fwnode_string(char *buf, char *end
  *		f full name
  *		P node name, including a possible unit address
  * - 'x' For printing the address. Equivalent to "%lx".
+ * - '[ku]s' For a BPF/tracing related format specifier, e.g. used out of
+ *           bpf_trace_printk() where [ku] prefix specifies either kernel (k)
+ *           or user (u) memory to probe, and:
+ *              s a string, equivalent to "%s" on direct vsnprintf() use
  *
  * ** When making changes please also update:
  *	Documentation/core-api/printk-formats.rst
@@ -2251,6 +2255,14 @@ char *pointer(const char *fmt, char *buf
 		if (!IS_ERR(ptr))
 			break;
 		return err_ptr(buf, end, ptr, spec);
+	case 'u':
+	case 'k':
+		switch (fmt[1]) {
+		case 's':
+			return string(buf, end, ptr, spec);
+		default:
+			return error_string(buf, end, "(einval)", spec);
+		}
 	}
 
 	/* default is to _not_ leak addresses, hash before printing */
diff -druNp --no-dereference linux-libre-5.6.13-gnu/Makefile linux-libre-5.6.14-gnu/Makefile
--- linux-libre-5.6.13-gnu/Makefile	2020-05-14 02:34:36.000000000 -0400
+++ linux-libre-5.6.14-gnu/Makefile	2020-05-20 04:57:00.000000000 -0400
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 5
 PATCHLEVEL = 6
-SUBLEVEL = 13
+SUBLEVEL = 14
 EXTRAVERSION = -gnu
 NAME = Kleptomaniac Octopus
 
@@ -708,12 +708,9 @@ else ifdef CONFIG_CC_OPTIMIZE_FOR_SIZE
 KBUILD_CFLAGS += -Os
 endif
 
-ifdef CONFIG_CC_DISABLE_WARN_MAYBE_UNINITIALIZED
-KBUILD_CFLAGS   += -Wno-maybe-uninitialized
-endif
-
 # Tell gcc to never replace conditional load with a non-conditional one
 KBUILD_CFLAGS	+= $(call cc-option,--param=allow-store-data-races=0)
+KBUILD_CFLAGS	+= $(call cc-option,-fno-allow-store-data-races)
 
 include scripts/Makefile.kcov
 include scripts/Makefile.gcc-plugins
@@ -861,6 +858,17 @@ KBUILD_CFLAGS += -Wno-pointer-sign
 # disable stringop warnings in gcc 8+
 KBUILD_CFLAGS += $(call cc-disable-warning, stringop-truncation)
 
+# We'll want to enable this eventually, but it's not going away for 5.7 at least
+KBUILD_CFLAGS += $(call cc-disable-warning, zero-length-bounds)
+KBUILD_CFLAGS += $(call cc-disable-warning, array-bounds)
+KBUILD_CFLAGS += $(call cc-disable-warning, stringop-overflow)
+
+# Another good warning that we'll want to enable eventually
+KBUILD_CFLAGS += $(call cc-disable-warning, restrict)
+
+# Enabled with W=2, disabled by default as noisy
+KBUILD_CFLAGS += $(call cc-disable-warning, maybe-uninitialized)
+
 # disable invalid "can't wrap" optimizations for signed / pointers
 KBUILD_CFLAGS	+= $(call cc-option,-fno-strict-overflow)
 
diff -druNp --no-dereference linux-libre-5.6.13-gnu/mm/shmem.c linux-libre-5.6.14-gnu/mm/shmem.c
--- linux-libre-5.6.13-gnu/mm/shmem.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/mm/shmem.c	2020-05-20 02:22:38.000000000 -0400
@@ -2184,7 +2184,11 @@ int shmem_lock(struct file *file, int lo
 	struct shmem_inode_info *info = SHMEM_I(inode);
 	int retval = -ENOMEM;
 
-	spin_lock_irq(&info->lock);
+	/*
+	 * What serializes the accesses to info->flags?
+	 * ipc_lock_object() when called from shmctl_do_lock(),
+	 * no serialization needed when called from shm_destroy().
+	 */
 	if (lock && !(info->flags & VM_LOCKED)) {
 		if (!user_shm_lock(inode->i_size, user))
 			goto out_nomem;
@@ -2199,7 +2203,6 @@ int shmem_lock(struct file *file, int lo
 	retval = 0;
 
 out_nomem:
-	spin_unlock_irq(&info->lock);
 	return retval;
 }
 
diff -druNp --no-dereference linux-libre-5.6.13-gnu/net/core/dev.c linux-libre-5.6.14-gnu/net/core/dev.c
--- linux-libre-5.6.13-gnu/net/core/dev.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/net/core/dev.c	2020-05-20 02:22:38.000000000 -0400
@@ -8890,11 +8890,13 @@ static void netdev_sync_lower_features(s
 			netdev_dbg(upper, "Disabling feature %pNF on lower dev %s.\n",
 				   &feature, lower->name);
 			lower->wanted_features &= ~feature;
-			netdev_update_features(lower);
+			__netdev_update_features(lower);
 
 			if (unlikely(lower->features & feature))
 				netdev_WARN(upper, "failed to disable %pNF on %s!\n",
 					    &feature, lower->name);
+			else
+				netdev_features_change(lower);
 		}
 	}
 }
diff -druNp --no-dereference linux-libre-5.6.13-gnu/net/core/drop_monitor.c linux-libre-5.6.14-gnu/net/core/drop_monitor.c
--- linux-libre-5.6.13-gnu/net/core/drop_monitor.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/net/core/drop_monitor.c	2020-05-20 02:22:38.000000000 -0400
@@ -212,6 +212,7 @@ static void sched_send_work(struct timer
 static void trace_drop_common(struct sk_buff *skb, void *location)
 {
 	struct net_dm_alert_msg *msg;
+	struct net_dm_drop_point *point;
 	struct nlmsghdr *nlh;
 	struct nlattr *nla;
 	int i;
@@ -230,11 +231,13 @@ static void trace_drop_common(struct sk_
 	nlh = (struct nlmsghdr *)dskb->data;
 	nla = genlmsg_data(nlmsg_data(nlh));
 	msg = nla_data(nla);
+	point = msg->points;
 	for (i = 0; i < msg->entries; i++) {
-		if (!memcmp(&location, msg->points[i].pc, sizeof(void *))) {
-			msg->points[i].count++;
+		if (!memcmp(&location, &point->pc, sizeof(void *))) {
+			point->count++;
 			goto out;
 		}
+		point++;
 	}
 	if (msg->entries == dm_hit_limit)
 		goto out;
@@ -243,8 +246,8 @@ static void trace_drop_common(struct sk_
 	 */
 	__nla_reserve_nohdr(dskb, sizeof(struct net_dm_drop_point));
 	nla->nla_len += NLA_ALIGN(sizeof(struct net_dm_drop_point));
-	memcpy(msg->points[msg->entries].pc, &location, sizeof(void *));
-	msg->points[msg->entries].count = 1;
+	memcpy(point->pc, &location, sizeof(void *));
+	point->count = 1;
 	msg->entries++;
 
 	if (!timer_pending(&data->send_timer)) {
diff -druNp --no-dereference linux-libre-5.6.13-gnu/net/core/filter.c linux-libre-5.6.14-gnu/net/core/filter.c
--- linux-libre-5.6.13-gnu/net/core/filter.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/net/core/filter.c	2020-05-20 02:22:38.000000000 -0400
@@ -2590,8 +2590,8 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_m
 			}
 			pop = 0;
 		} else if (pop >= sge->length - a) {
-			sge->length = a;
 			pop -= (sge->length - a);
+			sge->length = a;
 		}
 	}
 
diff -druNp --no-dereference linux-libre-5.6.13-gnu/net/core/netprio_cgroup.c linux-libre-5.6.14-gnu/net/core/netprio_cgroup.c
--- linux-libre-5.6.13-gnu/net/core/netprio_cgroup.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/net/core/netprio_cgroup.c	2020-05-20 02:22:38.000000000 -0400
@@ -236,6 +236,8 @@ static void net_prio_attach(struct cgrou
 	struct task_struct *p;
 	struct cgroup_subsys_state *css;
 
+	cgroup_sk_alloc_disable();
+
 	cgroup_taskset_for_each(p, css, tset) {
 		void *v = (void *)(unsigned long)css->id;
 
diff -druNp --no-dereference linux-libre-5.6.13-gnu/net/ipv4/cipso_ipv4.c linux-libre-5.6.14-gnu/net/ipv4/cipso_ipv4.c
--- linux-libre-5.6.13-gnu/net/ipv4/cipso_ipv4.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/net/ipv4/cipso_ipv4.c	2020-05-20 02:22:38.000000000 -0400
@@ -1258,7 +1258,8 @@ static int cipso_v4_parsetag_rbm(const s
 			return ret_val;
 		}
 
-		secattr->flags |= NETLBL_SECATTR_MLS_CAT;
+		if (secattr->attr.mls.cat)
+			secattr->flags |= NETLBL_SECATTR_MLS_CAT;
 	}
 
 	return 0;
@@ -1439,7 +1440,8 @@ static int cipso_v4_parsetag_rng(const s
 			return ret_val;
 		}
 
-		secattr->flags |= NETLBL_SECATTR_MLS_CAT;
+		if (secattr->attr.mls.cat)
+			secattr->flags |= NETLBL_SECATTR_MLS_CAT;
 	}
 
 	return 0;
diff -druNp --no-dereference linux-libre-5.6.13-gnu/net/ipv4/route.c linux-libre-5.6.14-gnu/net/ipv4/route.c
--- linux-libre-5.6.13-gnu/net/ipv4/route.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/net/ipv4/route.c	2020-05-20 02:22:38.000000000 -0400
@@ -915,7 +915,7 @@ void ip_rt_send_redirect(struct sk_buff
 	/* Check for load limit; set rate_last to the latest sent
 	 * redirect.
 	 */
-	if (peer->rate_tokens == 0 ||
+	if (peer->n_redirects == 0 ||
 	    time_after(jiffies,
 		       (peer->rate_last +
 			(ip_rt_redirect_load << peer->n_redirects)))) {
diff -druNp --no-dereference linux-libre-5.6.13-gnu/net/ipv4/tcp_bpf.c linux-libre-5.6.14-gnu/net/ipv4/tcp_bpf.c
--- linux-libre-5.6.13-gnu/net/ipv4/tcp_bpf.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/net/ipv4/tcp_bpf.c	2020-05-20 02:22:38.000000000 -0400
@@ -121,14 +121,17 @@ int tcp_bpf_recvmsg(struct sock *sk, str
 	struct sk_psock *psock;
 	int copied, ret;
 
+	if (unlikely(flags & MSG_ERRQUEUE))
+		return inet_recv_error(sk, msg, len, addr_len);
+
 	psock = sk_psock_get(sk);
 	if (unlikely(!psock))
 		return tcp_recvmsg(sk, msg, len, nonblock, flags, addr_len);
-	if (unlikely(flags & MSG_ERRQUEUE))
-		return inet_recv_error(sk, msg, len, addr_len);
 	if (!skb_queue_empty(&sk->sk_receive_queue) &&
-	    sk_psock_queue_empty(psock))
+	    sk_psock_queue_empty(psock)) {
+		sk_psock_put(sk, psock);
 		return tcp_recvmsg(sk, msg, len, nonblock, flags, addr_len);
+	}
 	lock_sock(sk);
 msg_bytes_ready:
 	copied = __tcp_bpf_recvmsg(sk, psock, msg, len, flags);
@@ -200,7 +203,6 @@ static int bpf_tcp_ingress(struct sock *
 
 	if (!ret) {
 		msg->sg.start = i;
-		msg->sg.size -= apply_bytes;
 		sk_psock_queue_msg(psock, tmp);
 		sk_psock_data_ready(sk, psock);
 	} else {
diff -druNp --no-dereference linux-libre-5.6.13-gnu/net/ipv4/tcp.c linux-libre-5.6.14-gnu/net/ipv4/tcp.c
--- linux-libre-5.6.13-gnu/net/ipv4/tcp.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/net/ipv4/tcp.c	2020-05-20 02:22:38.000000000 -0400
@@ -476,9 +476,17 @@ static void tcp_tx_timestamp(struct sock
 static inline bool tcp_stream_is_readable(const struct tcp_sock *tp,
 					  int target, struct sock *sk)
 {
-	return (READ_ONCE(tp->rcv_nxt) - READ_ONCE(tp->copied_seq) >= target) ||
-		(sk->sk_prot->stream_memory_read ?
-		sk->sk_prot->stream_memory_read(sk) : false);
+	int avail = READ_ONCE(tp->rcv_nxt) - READ_ONCE(tp->copied_seq);
+
+	if (avail > 0) {
+		if (avail >= target)
+			return true;
+		if (tcp_rmem_pressure(sk))
+			return true;
+	}
+	if (sk->sk_prot->stream_memory_read)
+		return sk->sk_prot->stream_memory_read(sk);
+	return false;
 }
 
 /*
@@ -1756,10 +1764,11 @@ static int tcp_zerocopy_receive(struct s
 
 	down_read(&current->mm->mmap_sem);
 
-	ret = -EINVAL;
 	vma = find_vma(current->mm, address);
-	if (!vma || vma->vm_start > address || vma->vm_ops != &tcp_vm_ops)
-		goto out;
+	if (!vma || vma->vm_start > address || vma->vm_ops != &tcp_vm_ops) {
+		up_read(&current->mm->mmap_sem);
+		return -EINVAL;
+	}
 	zc->length = min_t(unsigned long, zc->length, vma->vm_end - address);
 
 	tp = tcp_sk(sk);
@@ -2154,13 +2163,15 @@ skip_copy:
 			tp->urg_data = 0;
 			tcp_fast_path_check(sk);
 		}
-		if (used + offset < skb->len)
-			continue;
 
 		if (TCP_SKB_CB(skb)->has_rxtstamp) {
 			tcp_update_recv_tstamps(skb, &tss);
 			cmsg_flags |= 2;
 		}
+
+		if (used + offset < skb->len)
+			continue;
+
 		if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)
 			goto found_fin_ok;
 		if (!(flags & MSG_PEEK))
diff -druNp --no-dereference linux-libre-5.6.13-gnu/net/ipv4/tcp_input.c linux-libre-5.6.14-gnu/net/ipv4/tcp_input.c
--- linux-libre-5.6.13-gnu/net/ipv4/tcp_input.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/net/ipv4/tcp_input.c	2020-05-20 02:22:38.000000000 -0400
@@ -4761,7 +4761,8 @@ void tcp_data_ready(struct sock *sk)
 	const struct tcp_sock *tp = tcp_sk(sk);
 	int avail = tp->rcv_nxt - tp->copied_seq;
 
-	if (avail < sk->sk_rcvlowat && !sock_flag(sk, SOCK_DONE))
+	if (avail < sk->sk_rcvlowat && !tcp_rmem_pressure(sk) &&
+	    !sock_flag(sk, SOCK_DONE))
 		return;
 
 	sk->sk_data_ready(sk);
diff -druNp --no-dereference linux-libre-5.6.13-gnu/net/ipv6/calipso.c linux-libre-5.6.14-gnu/net/ipv6/calipso.c
--- linux-libre-5.6.13-gnu/net/ipv6/calipso.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/net/ipv6/calipso.c	2020-05-20 02:22:38.000000000 -0400
@@ -1047,7 +1047,8 @@ static int calipso_opt_getattr(const uns
 			goto getattr_return;
 		}
 
-		secattr->flags |= NETLBL_SECATTR_MLS_CAT;
+		if (secattr->attr.mls.cat)
+			secattr->flags |= NETLBL_SECATTR_MLS_CAT;
 	}
 
 	secattr->type = NETLBL_NLTYPE_CALIPSO;
diff -druNp --no-dereference linux-libre-5.6.13-gnu/net/ipv6/route.c linux-libre-5.6.14-gnu/net/ipv6/route.c
--- linux-libre-5.6.13-gnu/net/ipv6/route.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/net/ipv6/route.c	2020-05-20 02:22:38.000000000 -0400
@@ -2725,8 +2725,10 @@ static void __ip6_rt_update_pmtu(struct
 	const struct in6_addr *daddr, *saddr;
 	struct rt6_info *rt6 = (struct rt6_info *)dst;
 
-	if (dst_metric_locked(dst, RTAX_MTU))
-		return;
+	/* Note: do *NOT* check dst_metric_locked(dst, RTAX_MTU)
+	 * IPv6 pmtu discovery isn't optional, so 'mtu lock' cannot disable it.
+	 * [see also comment in rt6_mtu_change_route()]
+	 */
 
 	if (iph) {
 		daddr = &iph->daddr;
diff -druNp --no-dereference linux-libre-5.6.13-gnu/net/mptcp/subflow.c linux-libre-5.6.14-gnu/net/mptcp/subflow.c
--- linux-libre-5.6.13-gnu/net/mptcp/subflow.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/net/mptcp/subflow.c	2020-05-20 02:22:38.000000000 -0400
@@ -633,6 +633,16 @@ int mptcp_subflow_create_socket(struct s
 	if (err)
 		return err;
 
+	/* the newly created socket really belongs to the owning MPTCP master
+	 * socket, even if for additional subflows the allocation is performed
+	 * by a kernel workqueue. Adjust inode references, so that the
+	 * procfs/diag interaces really show this one belonging to the correct
+	 * user.
+	 */
+	SOCK_INODE(sf)->i_ino = SOCK_INODE(sk->sk_socket)->i_ino;
+	SOCK_INODE(sf)->i_uid = SOCK_INODE(sk->sk_socket)->i_uid;
+	SOCK_INODE(sf)->i_gid = SOCK_INODE(sk->sk_socket)->i_gid;
+
 	subflow = mptcp_subflow_ctx(sf->sk);
 	pr_debug("subflow=%p", subflow);
 
diff -druNp --no-dereference linux-libre-5.6.13-gnu/net/netfilter/nf_conntrack_core.c linux-libre-5.6.14-gnu/net/netfilter/nf_conntrack_core.c
--- linux-libre-5.6.13-gnu/net/netfilter/nf_conntrack_core.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/net/netfilter/nf_conntrack_core.c	2020-05-20 02:22:38.000000000 -0400
@@ -1517,9 +1517,9 @@ __nf_conntrack_alloc(struct net *net,
 	ct->status = 0;
 	ct->timeout = 0;
 	write_pnet(&ct->ct_net, net);
-	memset(&ct->__nfct_init_offset[0], 0,
+	memset(&ct->__nfct_init_offset, 0,
 	       offsetof(struct nf_conn, proto) -
-	       offsetof(struct nf_conn, __nfct_init_offset[0]));
+	       offsetof(struct nf_conn, __nfct_init_offset));
 
 	nf_ct_zone_add(ct, zone);
 
@@ -2137,8 +2137,19 @@ get_next_corpse(int (*iter)(struct nf_co
 		nf_conntrack_lock(lockp);
 		if (*bucket < nf_conntrack_htable_size) {
 			hlist_nulls_for_each_entry(h, n, &nf_conntrack_hash[*bucket], hnnode) {
-				if (NF_CT_DIRECTION(h) != IP_CT_DIR_ORIGINAL)
+				if (NF_CT_DIRECTION(h) != IP_CT_DIR_REPLY)
 					continue;
+				/* All nf_conn objects are added to hash table twice, one
+				 * for original direction tuple, once for the reply tuple.
+				 *
+				 * Exception: In the IPS_NAT_CLASH case, only the reply
+				 * tuple is added (the original tuple already existed for
+				 * a different object).
+				 *
+				 * We only need to call the iterator once for each
+				 * conntrack, so we just use the 'reply' direction
+				 * tuple while iterating.
+				 */
 				ct = nf_ct_tuplehash_to_ctrack(h);
 				if (iter(ct, data))
 					goto found;
diff -druNp --no-dereference linux-libre-5.6.13-gnu/net/netfilter/nf_flow_table_core.c linux-libre-5.6.14-gnu/net/netfilter/nf_flow_table_core.c
--- linux-libre-5.6.13-gnu/net/netfilter/nf_flow_table_core.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/net/netfilter/nf_flow_table_core.c	2020-05-20 02:22:38.000000000 -0400
@@ -271,7 +271,7 @@ static void flow_offload_del(struct nf_f
 
 	if (nf_flow_has_expired(flow))
 		flow_offload_fixup_ct(flow->ct);
-	else if (test_bit(NF_FLOW_TEARDOWN, &flow->flags))
+	else
 		flow_offload_fixup_ct_timeout(flow->ct);
 
 	flow_offload_free(flow);
@@ -348,8 +348,10 @@ static void nf_flow_offload_gc_step(stru
 {
 	struct nf_flowtable *flow_table = data;
 
-	if (nf_flow_has_expired(flow) || nf_ct_is_dying(flow->ct) ||
-	    test_bit(NF_FLOW_TEARDOWN, &flow->flags)) {
+	if (nf_flow_has_expired(flow) || nf_ct_is_dying(flow->ct))
+		set_bit(NF_FLOW_TEARDOWN, &flow->flags);
+
+	if (test_bit(NF_FLOW_TEARDOWN, &flow->flags)) {
 		if (test_bit(NF_FLOW_HW, &flow->flags)) {
 			if (!test_bit(NF_FLOW_HW_DYING, &flow->flags))
 				nf_flow_offload_del(flow_table, flow);
diff -druNp --no-dereference linux-libre-5.6.13-gnu/net/netfilter/nft_set_rbtree.c linux-libre-5.6.14-gnu/net/netfilter/nft_set_rbtree.c
--- linux-libre-5.6.13-gnu/net/netfilter/nft_set_rbtree.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/net/netfilter/nft_set_rbtree.c	2020-05-20 02:22:38.000000000 -0400
@@ -79,6 +79,10 @@ static bool __nft_rbtree_lookup(const st
 				parent = rcu_dereference_raw(parent->rb_left);
 				continue;
 			}
+
+			if (nft_set_elem_expired(&rbe->ext))
+				return false;
+
 			if (nft_rbtree_interval_end(rbe)) {
 				if (nft_set_is_anonymous(set))
 					return false;
@@ -94,6 +98,7 @@ static bool __nft_rbtree_lookup(const st
 
 	if (set->flags & NFT_SET_INTERVAL && interval != NULL &&
 	    nft_set_elem_active(&interval->ext, genmask) &&
+	    !nft_set_elem_expired(&interval->ext) &&
 	    nft_rbtree_interval_start(interval)) {
 		*ext = &interval->ext;
 		return true;
@@ -154,6 +159,9 @@ static bool __nft_rbtree_get(const struc
 				continue;
 			}
 
+			if (nft_set_elem_expired(&rbe->ext))
+				return false;
+
 			if (!nft_set_ext_exists(&rbe->ext, NFT_SET_EXT_FLAGS) ||
 			    (*nft_set_ext_flags(&rbe->ext) & NFT_SET_ELEM_INTERVAL_END) ==
 			    (flags & NFT_SET_ELEM_INTERVAL_END)) {
@@ -170,6 +178,7 @@ static bool __nft_rbtree_get(const struc
 
 	if (set->flags & NFT_SET_INTERVAL && interval != NULL &&
 	    nft_set_elem_active(&interval->ext, genmask) &&
+	    !nft_set_elem_expired(&interval->ext) &&
 	    ((!nft_rbtree_interval_end(interval) &&
 	      !(flags & NFT_SET_ELEM_INTERVAL_END)) ||
 	     (nft_rbtree_interval_end(interval) &&
@@ -418,6 +427,8 @@ static void nft_rbtree_walk(const struct
 
 		if (iter->count < iter->skip)
 			goto cont;
+		if (nft_set_elem_expired(&rbe->ext))
+			goto cont;
 		if (!nft_set_elem_active(&rbe->ext, iter->genmask))
 			goto cont;
 
diff -druNp --no-dereference linux-libre-5.6.13-gnu/net/netlabel/netlabel_kapi.c linux-libre-5.6.14-gnu/net/netlabel/netlabel_kapi.c
--- linux-libre-5.6.13-gnu/net/netlabel/netlabel_kapi.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/net/netlabel/netlabel_kapi.c	2020-05-20 02:22:38.000000000 -0400
@@ -734,6 +734,12 @@ int netlbl_catmap_getlong(struct netlbl_
 	if ((off & (BITS_PER_LONG - 1)) != 0)
 		return -EINVAL;
 
+	/* a null catmap is equivalent to an empty one */
+	if (!catmap) {
+		*offset = (u32)-1;
+		return 0;
+	}
+
 	if (off < catmap->startbit) {
 		off = catmap->startbit;
 		*offset = off;
diff -druNp --no-dereference linux-libre-5.6.13-gnu/net/rds/message.c linux-libre-5.6.14-gnu/net/rds/message.c
--- linux-libre-5.6.13-gnu/net/rds/message.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/net/rds/message.c	2020-05-20 02:22:38.000000000 -0400
@@ -308,26 +308,20 @@ out:
 /*
  * RDS ops use this to grab SG entries from the rm's sg pool.
  */
-struct scatterlist *rds_message_alloc_sgs(struct rds_message *rm, int nents,
-					  int *ret)
+struct scatterlist *rds_message_alloc_sgs(struct rds_message *rm, int nents)
 {
 	struct scatterlist *sg_first = (struct scatterlist *) &rm[1];
 	struct scatterlist *sg_ret;
 
-	if (WARN_ON(!ret))
-		return NULL;
-
 	if (nents <= 0) {
 		pr_warn("rds: alloc sgs failed! nents <= 0\n");
-		*ret = -EINVAL;
-		return NULL;
+		return ERR_PTR(-EINVAL);
 	}
 
 	if (rm->m_used_sgs + nents > rm->m_total_sgs) {
 		pr_warn("rds: alloc sgs failed! total %d used %d nents %d\n",
 			rm->m_total_sgs, rm->m_used_sgs, nents);
-		*ret = -ENOMEM;
-		return NULL;
+		return ERR_PTR(-ENOMEM);
 	}
 
 	sg_ret = &sg_first[rm->m_used_sgs];
@@ -343,7 +337,6 @@ struct rds_message *rds_message_map_page
 	unsigned int i;
 	int num_sgs = DIV_ROUND_UP(total_len, PAGE_SIZE);
 	int extra_bytes = num_sgs * sizeof(struct scatterlist);
-	int ret;
 
 	rm = rds_message_alloc(extra_bytes, GFP_NOWAIT);
 	if (!rm)
@@ -352,10 +345,10 @@ struct rds_message *rds_message_map_page
 	set_bit(RDS_MSG_PAGEVEC, &rm->m_flags);
 	rm->m_inc.i_hdr.h_len = cpu_to_be32(total_len);
 	rm->data.op_nents = DIV_ROUND_UP(total_len, PAGE_SIZE);
-	rm->data.op_sg = rds_message_alloc_sgs(rm, num_sgs, &ret);
-	if (!rm->data.op_sg) {
+	rm->data.op_sg = rds_message_alloc_sgs(rm, num_sgs);
+	if (IS_ERR(rm->data.op_sg)) {
 		rds_message_put(rm);
-		return ERR_PTR(ret);
+		return ERR_CAST(rm->data.op_sg);
 	}
 
 	for (i = 0; i < rm->data.op_nents; ++i) {
diff -druNp --no-dereference linux-libre-5.6.13-gnu/net/rds/rdma.c linux-libre-5.6.14-gnu/net/rds/rdma.c
--- linux-libre-5.6.13-gnu/net/rds/rdma.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/net/rds/rdma.c	2020-05-20 02:22:38.000000000 -0400
@@ -664,9 +664,11 @@ int rds_cmsg_rdma_args(struct rds_sock *
 	op->op_odp_mr = NULL;
 
 	WARN_ON(!nr_pages);
-	op->op_sg = rds_message_alloc_sgs(rm, nr_pages, &ret);
-	if (!op->op_sg)
+	op->op_sg = rds_message_alloc_sgs(rm, nr_pages);
+	if (IS_ERR(op->op_sg)) {
+		ret = PTR_ERR(op->op_sg);
 		goto out_pages;
+	}
 
 	if (op->op_notify || op->op_recverr) {
 		/* We allocate an uninitialized notifier here, because
@@ -905,9 +907,11 @@ int rds_cmsg_atomic(struct rds_sock *rs,
 	rm->atomic.op_silent = !!(args->flags & RDS_RDMA_SILENT);
 	rm->atomic.op_active = 1;
 	rm->atomic.op_recverr = rs->rs_recverr;
-	rm->atomic.op_sg = rds_message_alloc_sgs(rm, 1, &ret);
-	if (!rm->atomic.op_sg)
+	rm->atomic.op_sg = rds_message_alloc_sgs(rm, 1);
+	if (IS_ERR(rm->atomic.op_sg)) {
+		ret = PTR_ERR(rm->atomic.op_sg);
 		goto err;
+	}
 
 	/* verify 8 byte-aligned */
 	if (args->local_addr & 0x7) {
diff -druNp --no-dereference linux-libre-5.6.13-gnu/net/rds/rds.h linux-libre-5.6.14-gnu/net/rds/rds.h
--- linux-libre-5.6.13-gnu/net/rds/rds.h	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/net/rds/rds.h	2020-05-20 02:22:38.000000000 -0400
@@ -852,8 +852,7 @@ rds_conn_connecting(struct rds_connectio
 
 /* message.c */
 struct rds_message *rds_message_alloc(unsigned int nents, gfp_t gfp);
-struct scatterlist *rds_message_alloc_sgs(struct rds_message *rm, int nents,
-					  int *ret);
+struct scatterlist *rds_message_alloc_sgs(struct rds_message *rm, int nents);
 int rds_message_copy_from_user(struct rds_message *rm, struct iov_iter *from,
 			       bool zcopy);
 struct rds_message *rds_message_map_pages(unsigned long *page_addrs, unsigned int total_len);
diff -druNp --no-dereference linux-libre-5.6.13-gnu/net/rds/send.c linux-libre-5.6.14-gnu/net/rds/send.c
--- linux-libre-5.6.13-gnu/net/rds/send.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/net/rds/send.c	2020-05-20 02:22:38.000000000 -0400
@@ -1274,9 +1274,11 @@ int rds_sendmsg(struct socket *sock, str
 
 	/* Attach data to the rm */
 	if (payload_len) {
-		rm->data.op_sg = rds_message_alloc_sgs(rm, num_sgs, &ret);
-		if (!rm->data.op_sg)
+		rm->data.op_sg = rds_message_alloc_sgs(rm, num_sgs);
+		if (IS_ERR(rm->data.op_sg)) {
+			ret = PTR_ERR(rm->data.op_sg);
 			goto out;
+		}
 		ret = rds_message_copy_from_user(rm, &msg->msg_iter, zcopy);
 		if (ret)
 			goto out;
diff -druNp --no-dereference linux-libre-5.6.13-gnu/net/sched/cls_api.c linux-libre-5.6.14-gnu/net/sched/cls_api.c
--- linux-libre-5.6.13-gnu/net/sched/cls_api.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/net/sched/cls_api.c	2020-05-20 02:22:38.000000000 -0400
@@ -2005,6 +2005,7 @@ replay:
 		err = PTR_ERR(block);
 		goto errout;
 	}
+	block->classid = parent;
 
 	chain_index = tca[TCA_CHAIN] ? nla_get_u32(tca[TCA_CHAIN]) : 0;
 	if (chain_index > TC_ACT_EXT_VAL_MASK) {
@@ -2547,12 +2548,10 @@ static int tc_dump_tfilter(struct sk_buf
 			return skb->len;
 
 		parent = tcm->tcm_parent;
-		if (!parent) {
+		if (!parent)
 			q = dev->qdisc;
-			parent = q->handle;
-		} else {
+		else
 			q = qdisc_lookup(dev, TC_H_MAJ(tcm->tcm_parent));
-		}
 		if (!q)
 			goto out;
 		cops = q->ops->cl_ops;
@@ -2568,6 +2567,7 @@ static int tc_dump_tfilter(struct sk_buf
 		block = cops->tcf_block(q, cl, NULL);
 		if (!block)
 			goto out;
+		parent = block->classid;
 		if (tcf_block_shared(block))
 			q = NULL;
 	}
diff -druNp --no-dereference linux-libre-5.6.13-gnu/net/sunrpc/auth_gss/auth_gss.c linux-libre-5.6.14-gnu/net/sunrpc/auth_gss/auth_gss.c
--- linux-libre-5.6.13-gnu/net/sunrpc/auth_gss/auth_gss.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/net/sunrpc/auth_gss/auth_gss.c	2020-05-20 02:22:38.000000000 -0400
@@ -2030,7 +2030,6 @@ gss_unwrap_resp_priv(struct rpc_task *ta
 	struct xdr_buf *rcv_buf = &rqstp->rq_rcv_buf;
 	struct kvec *head = rqstp->rq_rcv_buf.head;
 	struct rpc_auth *auth = cred->cr_auth;
-	unsigned int savedlen = rcv_buf->len;
 	u32 offset, opaque_len, maj_stat;
 	__be32 *p;
 
@@ -2041,9 +2040,9 @@ gss_unwrap_resp_priv(struct rpc_task *ta
 	offset = (u8 *)(p) - (u8 *)head->iov_base;
 	if (offset + opaque_len > rcv_buf->len)
 		goto unwrap_failed;
-	rcv_buf->len = offset + opaque_len;
 
-	maj_stat = gss_unwrap(ctx->gc_gss_ctx, offset, rcv_buf);
+	maj_stat = gss_unwrap(ctx->gc_gss_ctx, offset,
+			      offset + opaque_len, rcv_buf);
 	if (maj_stat == GSS_S_CONTEXT_EXPIRED)
 		clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
 	if (maj_stat != GSS_S_COMPLETE)
@@ -2057,10 +2056,9 @@ gss_unwrap_resp_priv(struct rpc_task *ta
 	 */
 	xdr_init_decode(xdr, rcv_buf, p, rqstp);
 
-	auth->au_rslack = auth->au_verfsize + 2 +
-			  XDR_QUADLEN(savedlen - rcv_buf->len);
-	auth->au_ralign = auth->au_verfsize + 2 +
-			  XDR_QUADLEN(savedlen - rcv_buf->len);
+	auth->au_rslack = auth->au_verfsize + 2 + ctx->gc_gss_ctx->slack;
+	auth->au_ralign = auth->au_verfsize + 2 + ctx->gc_gss_ctx->align;
+
 	return 0;
 unwrap_failed:
 	trace_rpcgss_unwrap_failed(task);
diff -druNp --no-dereference linux-libre-5.6.13-gnu/net/sunrpc/auth_gss/gss_krb5_crypto.c linux-libre-5.6.14-gnu/net/sunrpc/auth_gss/gss_krb5_crypto.c
--- linux-libre-5.6.13-gnu/net/sunrpc/auth_gss/gss_krb5_crypto.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/net/sunrpc/auth_gss/gss_krb5_crypto.c	2020-05-20 02:22:38.000000000 -0400
@@ -851,8 +851,8 @@ out_err:
 }
 
 u32
-gss_krb5_aes_decrypt(struct krb5_ctx *kctx, u32 offset, struct xdr_buf *buf,
-		     u32 *headskip, u32 *tailskip)
+gss_krb5_aes_decrypt(struct krb5_ctx *kctx, u32 offset, u32 len,
+		     struct xdr_buf *buf, u32 *headskip, u32 *tailskip)
 {
 	struct xdr_buf subbuf;
 	u32 ret = 0;
@@ -881,7 +881,7 @@ gss_krb5_aes_decrypt(struct krb5_ctx *kc
 
 	/* create a segment skipping the header and leaving out the checksum */
 	xdr_buf_subsegment(buf, &subbuf, offset + GSS_KRB5_TOK_HDR_LEN,
-				    (buf->len - offset - GSS_KRB5_TOK_HDR_LEN -
+				    (len - offset - GSS_KRB5_TOK_HDR_LEN -
 				     kctx->gk5e->cksumlength));
 
 	nblocks = (subbuf.len + blocksize - 1) / blocksize;
@@ -926,7 +926,7 @@ gss_krb5_aes_decrypt(struct krb5_ctx *kc
 		goto out_err;
 
 	/* Get the packet's hmac value */
-	ret = read_bytes_from_xdr_buf(buf, buf->len - kctx->gk5e->cksumlength,
+	ret = read_bytes_from_xdr_buf(buf, len - kctx->gk5e->cksumlength,
 				      pkt_hmac, kctx->gk5e->cksumlength);
 	if (ret)
 		goto out_err;
diff -druNp --no-dereference linux-libre-5.6.13-gnu/net/sunrpc/auth_gss/gss_krb5_wrap.c linux-libre-5.6.14-gnu/net/sunrpc/auth_gss/gss_krb5_wrap.c
--- linux-libre-5.6.13-gnu/net/sunrpc/auth_gss/gss_krb5_wrap.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/net/sunrpc/auth_gss/gss_krb5_wrap.c	2020-05-20 02:22:38.000000000 -0400
@@ -261,7 +261,9 @@ gss_wrap_kerberos_v1(struct krb5_ctx *kc
 }
 
 static u32
-gss_unwrap_kerberos_v1(struct krb5_ctx *kctx, int offset, struct xdr_buf *buf)
+gss_unwrap_kerberos_v1(struct krb5_ctx *kctx, int offset, int len,
+		       struct xdr_buf *buf, unsigned int *slack,
+		       unsigned int *align)
 {
 	int			signalg;
 	int			sealalg;
@@ -279,12 +281,13 @@ gss_unwrap_kerberos_v1(struct krb5_ctx *
 	u32			conflen = kctx->gk5e->conflen;
 	int			crypt_offset;
 	u8			*cksumkey;
+	unsigned int		saved_len = buf->len;
 
 	dprintk("RPC:       gss_unwrap_kerberos\n");
 
 	ptr = (u8 *)buf->head[0].iov_base + offset;
 	if (g_verify_token_header(&kctx->mech_used, &bodysize, &ptr,
-					buf->len - offset))
+					len - offset))
 		return GSS_S_DEFECTIVE_TOKEN;
 
 	if ((ptr[0] != ((KG_TOK_WRAP_MSG >> 8) & 0xff)) ||
@@ -324,6 +327,7 @@ gss_unwrap_kerberos_v1(struct krb5_ctx *
 	    (!kctx->initiate && direction != 0))
 		return GSS_S_BAD_SIG;
 
+	buf->len = len;
 	if (kctx->enctype == ENCTYPE_ARCFOUR_HMAC) {
 		struct crypto_sync_skcipher *cipher;
 		int err;
@@ -376,11 +380,15 @@ gss_unwrap_kerberos_v1(struct krb5_ctx *
 	data_len = (buf->head[0].iov_base + buf->head[0].iov_len) - data_start;
 	memmove(orig_start, data_start, data_len);
 	buf->head[0].iov_len -= (data_start - orig_start);
-	buf->len -= (data_start - orig_start);
+	buf->len = len - (data_start - orig_start);
 
 	if (gss_krb5_remove_padding(buf, blocksize))
 		return GSS_S_DEFECTIVE_TOKEN;
 
+	/* slack must include room for krb5 padding */
+	*slack = XDR_QUADLEN(saved_len - buf->len);
+	/* The GSS blob always precedes the RPC message payload */
+	*align = *slack;
 	return GSS_S_COMPLETE;
 }
 
@@ -486,7 +494,9 @@ gss_wrap_kerberos_v2(struct krb5_ctx *kc
 }
 
 static u32
-gss_unwrap_kerberos_v2(struct krb5_ctx *kctx, int offset, struct xdr_buf *buf)
+gss_unwrap_kerberos_v2(struct krb5_ctx *kctx, int offset, int len,
+		       struct xdr_buf *buf, unsigned int *slack,
+		       unsigned int *align)
 {
 	time64_t	now;
 	u8		*ptr;
@@ -532,7 +542,7 @@ gss_unwrap_kerberos_v2(struct krb5_ctx *
 	if (rrc != 0)
 		rotate_left(offset + 16, buf, rrc);
 
-	err = (*kctx->gk5e->decrypt_v2)(kctx, offset, buf,
+	err = (*kctx->gk5e->decrypt_v2)(kctx, offset, len, buf,
 					&headskip, &tailskip);
 	if (err)
 		return GSS_S_FAILURE;
@@ -542,7 +552,7 @@ gss_unwrap_kerberos_v2(struct krb5_ctx *
 	 * it against the original
 	 */
 	err = read_bytes_from_xdr_buf(buf,
-				buf->len - GSS_KRB5_TOK_HDR_LEN - tailskip,
+				len - GSS_KRB5_TOK_HDR_LEN - tailskip,
 				decrypted_hdr, GSS_KRB5_TOK_HDR_LEN);
 	if (err) {
 		dprintk("%s: error %u getting decrypted_hdr\n", __func__, err);
@@ -568,18 +578,19 @@ gss_unwrap_kerberos_v2(struct krb5_ctx *
 	 * Note that buf->head[0].iov_len may indicate the available
 	 * head buffer space rather than that actually occupied.
 	 */
-	movelen = min_t(unsigned int, buf->head[0].iov_len, buf->len);
+	movelen = min_t(unsigned int, buf->head[0].iov_len, len);
 	movelen -= offset + GSS_KRB5_TOK_HDR_LEN + headskip;
-	if (offset + GSS_KRB5_TOK_HDR_LEN + headskip + movelen >
-	    buf->head[0].iov_len)
-		return GSS_S_FAILURE;
+	BUG_ON(offset + GSS_KRB5_TOK_HDR_LEN + headskip + movelen >
+							buf->head[0].iov_len);
 	memmove(ptr, ptr + GSS_KRB5_TOK_HDR_LEN + headskip, movelen);
 	buf->head[0].iov_len -= GSS_KRB5_TOK_HDR_LEN + headskip;
-	buf->len -= GSS_KRB5_TOK_HDR_LEN + headskip;
+	buf->len = len - GSS_KRB5_TOK_HDR_LEN + headskip;
 
 	/* Trim off the trailing "extra count" and checksum blob */
-	buf->len -= ec + GSS_KRB5_TOK_HDR_LEN + tailskip;
+	xdr_buf_trim(buf, ec + GSS_KRB5_TOK_HDR_LEN + tailskip);
 
+	*align = XDR_QUADLEN(GSS_KRB5_TOK_HDR_LEN + headskip);
+	*slack = *align + XDR_QUADLEN(ec + GSS_KRB5_TOK_HDR_LEN + tailskip);
 	return GSS_S_COMPLETE;
 }
 
@@ -603,7 +614,8 @@ gss_wrap_kerberos(struct gss_ctx *gctx,
 }
 
 u32
-gss_unwrap_kerberos(struct gss_ctx *gctx, int offset, struct xdr_buf *buf)
+gss_unwrap_kerberos(struct gss_ctx *gctx, int offset,
+		    int len, struct xdr_buf *buf)
 {
 	struct krb5_ctx	*kctx = gctx->internal_ctx_id;
 
@@ -613,9 +625,11 @@ gss_unwrap_kerberos(struct gss_ctx *gctx
 	case ENCTYPE_DES_CBC_RAW:
 	case ENCTYPE_DES3_CBC_RAW:
 	case ENCTYPE_ARCFOUR_HMAC:
-		return gss_unwrap_kerberos_v1(kctx, offset, buf);
+		return gss_unwrap_kerberos_v1(kctx, offset, len, buf,
+					      &gctx->slack, &gctx->align);
 	case ENCTYPE_AES128_CTS_HMAC_SHA1_96:
 	case ENCTYPE_AES256_CTS_HMAC_SHA1_96:
-		return gss_unwrap_kerberos_v2(kctx, offset, buf);
+		return gss_unwrap_kerberos_v2(kctx, offset, len, buf,
+					      &gctx->slack, &gctx->align);
 	}
 }
diff -druNp --no-dereference linux-libre-5.6.13-gnu/net/sunrpc/auth_gss/gss_mech_switch.c linux-libre-5.6.14-gnu/net/sunrpc/auth_gss/gss_mech_switch.c
--- linux-libre-5.6.13-gnu/net/sunrpc/auth_gss/gss_mech_switch.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/net/sunrpc/auth_gss/gss_mech_switch.c	2020-05-20 02:22:38.000000000 -0400
@@ -411,10 +411,11 @@ gss_wrap(struct gss_ctx	*ctx_id,
 u32
 gss_unwrap(struct gss_ctx	*ctx_id,
 	   int			offset,
+	   int			len,
 	   struct xdr_buf	*buf)
 {
 	return ctx_id->mech_type->gm_ops
-		->gss_unwrap(ctx_id, offset, buf);
+		->gss_unwrap(ctx_id, offset, len, buf);
 }
 
 
diff -druNp --no-dereference linux-libre-5.6.13-gnu/net/sunrpc/auth_gss/svcauth_gss.c linux-libre-5.6.14-gnu/net/sunrpc/auth_gss/svcauth_gss.c
--- linux-libre-5.6.13-gnu/net/sunrpc/auth_gss/svcauth_gss.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/net/sunrpc/auth_gss/svcauth_gss.c	2020-05-20 02:22:38.000000000 -0400
@@ -900,7 +900,7 @@ unwrap_integ_data(struct svc_rqst *rqstp
 	if (svc_getnl(&buf->head[0]) != seq)
 		goto out;
 	/* trim off the mic and padding at the end before returning */
-	buf->len -= 4 + round_up_to_quad(mic.len);
+	xdr_buf_trim(buf, round_up_to_quad(mic.len) + 4);
 	stat = 0;
 out:
 	kfree(mic.data);
@@ -928,7 +928,7 @@ static int
 unwrap_priv_data(struct svc_rqst *rqstp, struct xdr_buf *buf, u32 seq, struct gss_ctx *ctx)
 {
 	u32 priv_len, maj_stat;
-	int pad, saved_len, remaining_len, offset;
+	int pad, remaining_len, offset;
 
 	clear_bit(RQ_SPLICE_OK, &rqstp->rq_flags);
 
@@ -948,12 +948,8 @@ unwrap_priv_data(struct svc_rqst *rqstp,
 	buf->len -= pad;
 	fix_priv_head(buf, pad);
 
-	/* Maybe it would be better to give gss_unwrap a length parameter: */
-	saved_len = buf->len;
-	buf->len = priv_len;
-	maj_stat = gss_unwrap(ctx, 0, buf);
+	maj_stat = gss_unwrap(ctx, 0, priv_len, buf);
 	pad = priv_len - buf->len;
-	buf->len = saved_len;
 	buf->len -= pad;
 	/* The upper layers assume the buffer is aligned on 4-byte boundaries.
 	 * In the krb5p case, at least, the data ends up offset, so we need to
diff -druNp --no-dereference linux-libre-5.6.13-gnu/net/sunrpc/clnt.c linux-libre-5.6.14-gnu/net/sunrpc/clnt.c
--- linux-libre-5.6.13-gnu/net/sunrpc/clnt.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/net/sunrpc/clnt.c	2020-05-20 02:22:38.000000000 -0400
@@ -2416,6 +2416,11 @@ rpc_check_timeout(struct rpc_task *task)
 {
 	struct rpc_clnt	*clnt = task->tk_client;
 
+	if (RPC_SIGNALLED(task)) {
+		rpc_call_rpcerror(task, -ERESTARTSYS);
+		return;
+	}
+
 	if (xprt_adjust_timeout(task->tk_rqstp) == 0)
 		return;
 
diff -druNp --no-dereference linux-libre-5.6.13-gnu/net/sunrpc/xdr.c linux-libre-5.6.14-gnu/net/sunrpc/xdr.c
--- linux-libre-5.6.13-gnu/net/sunrpc/xdr.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/net/sunrpc/xdr.c	2020-05-20 02:22:38.000000000 -0400
@@ -1150,6 +1150,47 @@ xdr_buf_subsegment(struct xdr_buf *buf,
 }
 EXPORT_SYMBOL_GPL(xdr_buf_subsegment);
 
+/**
+ * xdr_buf_trim - lop at most "len" bytes off the end of "buf"
+ * @buf: buf to be trimmed
+ * @len: number of bytes to reduce "buf" by
+ *
+ * Trim an xdr_buf by the given number of bytes by fixing up the lengths. Note
+ * that it's possible that we'll trim less than that amount if the xdr_buf is
+ * too small, or if (for instance) it's all in the head and the parser has
+ * already read too far into it.
+ */
+void xdr_buf_trim(struct xdr_buf *buf, unsigned int len)
+{
+	size_t cur;
+	unsigned int trim = len;
+
+	if (buf->tail[0].iov_len) {
+		cur = min_t(size_t, buf->tail[0].iov_len, trim);
+		buf->tail[0].iov_len -= cur;
+		trim -= cur;
+		if (!trim)
+			goto fix_len;
+	}
+
+	if (buf->page_len) {
+		cur = min_t(unsigned int, buf->page_len, trim);
+		buf->page_len -= cur;
+		trim -= cur;
+		if (!trim)
+			goto fix_len;
+	}
+
+	if (buf->head[0].iov_len) {
+		cur = min_t(size_t, buf->head[0].iov_len, trim);
+		buf->head[0].iov_len -= cur;
+		trim -= cur;
+	}
+fix_len:
+	buf->len -= (len - trim);
+}
+EXPORT_SYMBOL_GPL(xdr_buf_trim);
+
 static void __read_bytes_from_xdr_buf(struct xdr_buf *subbuf, void *obj, unsigned int len)
 {
 	unsigned int this_len;
diff -druNp --no-dereference linux-libre-5.6.13-gnu/net/sunrpc/xprtrdma/backchannel.c linux-libre-5.6.14-gnu/net/sunrpc/xprtrdma/backchannel.c
--- linux-libre-5.6.13-gnu/net/sunrpc/xprtrdma/backchannel.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/net/sunrpc/xprtrdma/backchannel.c	2020-05-20 02:22:38.000000000 -0400
@@ -115,7 +115,7 @@ int xprt_rdma_bc_send_reply(struct rpc_r
 	if (rc < 0)
 		goto failed_marshal;
 
-	if (rpcrdma_ep_post(&r_xprt->rx_ia, &r_xprt->rx_ep, req))
+	if (rpcrdma_post_sends(r_xprt, req))
 		goto drop_connection;
 	return 0;
 
diff -druNp --no-dereference linux-libre-5.6.13-gnu/net/sunrpc/xprtrdma/frwr_ops.c linux-libre-5.6.14-gnu/net/sunrpc/xprtrdma/frwr_ops.c
--- linux-libre-5.6.13-gnu/net/sunrpc/xprtrdma/frwr_ops.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/net/sunrpc/xprtrdma/frwr_ops.c	2020-05-20 02:22:38.000000000 -0400
@@ -372,18 +372,22 @@ static void frwr_wc_fastreg(struct ib_cq
 }
 
 /**
- * frwr_send - post Send WR containing the RPC Call message
- * @ia: interface adapter
- * @req: Prepared RPC Call
+ * frwr_send - post Send WRs containing the RPC Call message
+ * @r_xprt: controlling transport instance
+ * @req: prepared RPC Call
  *
  * For FRWR, chain any FastReg WRs to the Send WR. Only a
  * single ib_post_send call is needed to register memory
  * and then post the Send WR.
  *
- * Returns the result of ib_post_send.
+ * Returns the return code from ib_post_send.
+ *
+ * Caller must hold the transport send lock to ensure that the
+ * pointers to the transport's rdma_cm_id and QP are stable.
  */
-int frwr_send(struct rpcrdma_ia *ia, struct rpcrdma_req *req)
+int frwr_send(struct rpcrdma_xprt *r_xprt, struct rpcrdma_req *req)
 {
+	struct rpcrdma_ia *ia = &r_xprt->rx_ia;
 	struct ib_send_wr *post_wr;
 	struct rpcrdma_mr *mr;
 
diff -druNp --no-dereference linux-libre-5.6.13-gnu/net/sunrpc/xprtrdma/transport.c linux-libre-5.6.14-gnu/net/sunrpc/xprtrdma/transport.c
--- linux-libre-5.6.13-gnu/net/sunrpc/xprtrdma/transport.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/net/sunrpc/xprtrdma/transport.c	2020-05-20 02:22:38.000000000 -0400
@@ -694,7 +694,7 @@ xprt_rdma_send_request(struct rpc_rqst *
 		goto drop_connection;
 	rqst->rq_xtime = ktime_get();
 
-	if (rpcrdma_ep_post(&r_xprt->rx_ia, &r_xprt->rx_ep, req))
+	if (rpcrdma_post_sends(r_xprt, req))
 		goto drop_connection;
 
 	rqst->rq_xmit_bytes_sent += rqst->rq_snd_buf.len;
diff -druNp --no-dereference linux-libre-5.6.13-gnu/net/sunrpc/xprtrdma/verbs.c linux-libre-5.6.14-gnu/net/sunrpc/xprtrdma/verbs.c
--- linux-libre-5.6.13-gnu/net/sunrpc/xprtrdma/verbs.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/net/sunrpc/xprtrdma/verbs.c	2020-05-20 02:22:38.000000000 -0400
@@ -1502,20 +1502,17 @@ static void rpcrdma_regbuf_free(struct r
 }
 
 /**
- * rpcrdma_ep_post - Post WRs to a transport's Send Queue
- * @ia: transport's device information
- * @ep: transport's RDMA endpoint information
+ * rpcrdma_post_sends - Post WRs to a transport's Send Queue
+ * @r_xprt: controlling transport instance
  * @req: rpcrdma_req containing the Send WR to post
  *
  * Returns 0 if the post was successful, otherwise -ENOTCONN
  * is returned.
  */
-int
-rpcrdma_ep_post(struct rpcrdma_ia *ia,
-		struct rpcrdma_ep *ep,
-		struct rpcrdma_req *req)
+int rpcrdma_post_sends(struct rpcrdma_xprt *r_xprt, struct rpcrdma_req *req)
 {
 	struct ib_send_wr *send_wr = &req->rl_wr;
+	struct rpcrdma_ep *ep = &r_xprt->rx_ep;
 	int rc;
 
 	if (!ep->rep_send_count || kref_read(&req->rl_kref) > 1) {
@@ -1526,8 +1523,8 @@ rpcrdma_ep_post(struct rpcrdma_ia *ia,
 		--ep->rep_send_count;
 	}
 
-	rc = frwr_send(ia, req);
-	trace_xprtrdma_post_send(req, rc);
+	trace_xprtrdma_post_send(req);
+	rc = frwr_send(r_xprt, req);
 	if (rc)
 		return -ENOTCONN;
 	return 0;
diff -druNp --no-dereference linux-libre-5.6.13-gnu/net/sunrpc/xprtrdma/xprt_rdma.h linux-libre-5.6.14-gnu/net/sunrpc/xprtrdma/xprt_rdma.h
--- linux-libre-5.6.13-gnu/net/sunrpc/xprtrdma/xprt_rdma.h	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/net/sunrpc/xprtrdma/xprt_rdma.h	2020-05-20 02:22:38.000000000 -0400
@@ -469,8 +469,7 @@ void rpcrdma_ep_destroy(struct rpcrdma_x
 int rpcrdma_ep_connect(struct rpcrdma_ep *, struct rpcrdma_ia *);
 void rpcrdma_ep_disconnect(struct rpcrdma_ep *, struct rpcrdma_ia *);
 
-int rpcrdma_ep_post(struct rpcrdma_ia *, struct rpcrdma_ep *,
-				struct rpcrdma_req *);
+int rpcrdma_post_sends(struct rpcrdma_xprt *r_xprt, struct rpcrdma_req *req);
 void rpcrdma_post_recvs(struct rpcrdma_xprt *r_xprt, bool temp);
 
 /*
@@ -544,7 +543,7 @@ struct rpcrdma_mr_seg *frwr_map(struct r
 				struct rpcrdma_mr_seg *seg,
 				int nsegs, bool writing, __be32 xid,
 				struct rpcrdma_mr *mr);
-int frwr_send(struct rpcrdma_ia *ia, struct rpcrdma_req *req);
+int frwr_send(struct rpcrdma_xprt *r_xprt, struct rpcrdma_req *req);
 void frwr_reminv(struct rpcrdma_rep *rep, struct list_head *mrs);
 void frwr_unmap_sync(struct rpcrdma_xprt *r_xprt, struct rpcrdma_req *req);
 void frwr_unmap_async(struct rpcrdma_xprt *r_xprt, struct rpcrdma_req *req);
diff -druNp --no-dereference linux-libre-5.6.13-gnu/scripts/kallsyms.c linux-libre-5.6.14-gnu/scripts/kallsyms.c
--- linux-libre-5.6.13-gnu/scripts/kallsyms.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/scripts/kallsyms.c	2020-05-20 02:22:38.000000000 -0400
@@ -34,7 +34,7 @@ struct sym_entry {
 	unsigned int len;
 	unsigned int start_pos;
 	unsigned int percpu_absolute;
-	unsigned char sym[0];
+	unsigned char sym[];
 };
 
 struct addr_range {
diff -druNp --no-dereference linux-libre-5.6.13-gnu/sound/core/rawmidi.c linux-libre-5.6.14-gnu/sound/core/rawmidi.c
--- linux-libre-5.6.13-gnu/sound/core/rawmidi.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/sound/core/rawmidi.c	2020-05-20 02:22:38.000000000 -0400
@@ -120,6 +120,17 @@ static void snd_rawmidi_input_event_work
 		runtime->event(runtime->substream);
 }
 
+/* buffer refcount management: call with runtime->lock held */
+static inline void snd_rawmidi_buffer_ref(struct snd_rawmidi_runtime *runtime)
+{
+	runtime->buffer_ref++;
+}
+
+static inline void snd_rawmidi_buffer_unref(struct snd_rawmidi_runtime *runtime)
+{
+	runtime->buffer_ref--;
+}
+
 static int snd_rawmidi_runtime_create(struct snd_rawmidi_substream *substream)
 {
 	struct snd_rawmidi_runtime *runtime;
@@ -669,6 +680,11 @@ static int resize_runtime_buffer(struct
 		if (!newbuf)
 			return -ENOMEM;
 		spin_lock_irq(&runtime->lock);
+		if (runtime->buffer_ref) {
+			spin_unlock_irq(&runtime->lock);
+			kvfree(newbuf);
+			return -EBUSY;
+		}
 		oldbuf = runtime->buffer;
 		runtime->buffer = newbuf;
 		runtime->buffer_size = params->buffer_size;
@@ -1019,8 +1035,10 @@ static long snd_rawmidi_kernel_read1(str
 	long result = 0, count1;
 	struct snd_rawmidi_runtime *runtime = substream->runtime;
 	unsigned long appl_ptr;
+	int err = 0;
 
 	spin_lock_irqsave(&runtime->lock, flags);
+	snd_rawmidi_buffer_ref(runtime);
 	while (count > 0 && runtime->avail) {
 		count1 = runtime->buffer_size - runtime->appl_ptr;
 		if (count1 > count)
@@ -1039,16 +1057,19 @@ static long snd_rawmidi_kernel_read1(str
 		if (userbuf) {
 			spin_unlock_irqrestore(&runtime->lock, flags);
 			if (copy_to_user(userbuf + result,
-					 runtime->buffer + appl_ptr, count1)) {
-				return result > 0 ? result : -EFAULT;
-			}
+					 runtime->buffer + appl_ptr, count1))
+				err = -EFAULT;
 			spin_lock_irqsave(&runtime->lock, flags);
+			if (err)
+				goto out;
 		}
 		result += count1;
 		count -= count1;
 	}
+ out:
+	snd_rawmidi_buffer_unref(runtime);
 	spin_unlock_irqrestore(&runtime->lock, flags);
-	return result;
+	return result > 0 ? result : err;
 }
 
 long snd_rawmidi_kernel_read(struct snd_rawmidi_substream *substream,
@@ -1342,6 +1363,7 @@ static long snd_rawmidi_kernel_write1(st
 			return -EAGAIN;
 		}
 	}
+	snd_rawmidi_buffer_ref(runtime);
 	while (count > 0 && runtime->avail > 0) {
 		count1 = runtime->buffer_size - runtime->appl_ptr;
 		if (count1 > count)
@@ -1373,6 +1395,7 @@ static long snd_rawmidi_kernel_write1(st
 	}
       __end:
 	count1 = runtime->avail < runtime->buffer_size;
+	snd_rawmidi_buffer_unref(runtime);
 	spin_unlock_irqrestore(&runtime->lock, flags);
 	if (count1)
 		snd_rawmidi_output_trigger(substream, 1);
diff -druNp --no-dereference linux-libre-5.6.13-gnu/sound/firewire/amdtp-stream-trace.h linux-libre-5.6.14-gnu/sound/firewire/amdtp-stream-trace.h
--- linux-libre-5.6.13-gnu/sound/firewire/amdtp-stream-trace.h	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/sound/firewire/amdtp-stream-trace.h	2020-05-20 02:22:38.000000000 -0400
@@ -66,8 +66,7 @@ TRACE_EVENT(amdtp_packet,
 		__entry->irq,
 		__entry->index,
 		__print_array(__get_dynamic_array(cip_header),
-			      __get_dynamic_array_len(cip_header),
-			      sizeof(u8)))
+			      __get_dynamic_array_len(cip_header), 1))
 );
 
 #endif
diff -druNp --no-dereference linux-libre-5.6.13-gnu/sound/pci/hda/patch_hdmi.c linux-libre-5.6.14-gnu/sound/pci/hda/patch_hdmi.c
--- linux-libre-5.6.13-gnu/sound/pci/hda/patch_hdmi.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/sound/pci/hda/patch_hdmi.c	2020-05-20 02:22:38.000000000 -0400
@@ -2320,7 +2320,9 @@ static int generic_hdmi_build_controls(s
 
 	for (pin_idx = 0; pin_idx < spec->num_pins; pin_idx++) {
 		struct hdmi_spec_per_pin *per_pin = get_pin(spec, pin_idx);
+		struct hdmi_eld *pin_eld = &per_pin->sink_eld;
 
+		pin_eld->eld_valid = false;
 		hdmi_present_sense(per_pin, 0);
 	}
 
diff -druNp --no-dereference linux-libre-5.6.13-gnu/sound/pci/hda/patch_realtek.c linux-libre-5.6.14-gnu/sound/pci/hda/patch_realtek.c
--- linux-libre-5.6.13-gnu/sound/pci/hda/patch_realtek.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/sound/pci/hda/patch_realtek.c	2020-05-20 02:22:38.000000000 -0400
@@ -5743,6 +5743,15 @@ static void alc233_alc662_fixup_lenovo_d
 	}
 }
 
+static void alc225_fixup_s3_pop_noise(struct hda_codec *codec,
+				      const struct hda_fixup *fix, int action)
+{
+	if (action != HDA_FIXUP_ACT_PRE_PROBE)
+		return;
+
+	codec->power_save_node = 1;
+}
+
 /* Forcibly assign NID 0x03 to HP/LO while NID 0x02 to SPK for EQ */
 static void alc274_fixup_bind_dacs(struct hda_codec *codec,
 				    const struct hda_fixup *fix, int action)
@@ -5847,6 +5856,7 @@ enum {
 	ALC269_FIXUP_HP_LINE1_MIC1_LED,
 	ALC269_FIXUP_INV_DMIC,
 	ALC269_FIXUP_LENOVO_DOCK,
+	ALC269_FIXUP_LENOVO_DOCK_LIMIT_BOOST,
 	ALC269_FIXUP_NO_SHUTUP,
 	ALC286_FIXUP_SONY_MIC_NO_PRESENCE,
 	ALC269_FIXUP_PINCFG_NO_HP_TO_LINEOUT,
@@ -5932,6 +5942,7 @@ enum {
 	ALC233_FIXUP_ACER_HEADSET_MIC,
 	ALC294_FIXUP_LENOVO_MIC_LOCATION,
 	ALC225_FIXUP_DELL_WYSE_MIC_NO_PRESENCE,
+	ALC225_FIXUP_S3_POP_NOISE,
 	ALC700_FIXUP_INTEL_REFERENCE,
 	ALC274_FIXUP_DELL_BIND_DACS,
 	ALC274_FIXUP_DELL_AIO_LINEOUT_VERB,
@@ -5967,6 +5978,7 @@ enum {
 	ALC294_FIXUP_ASUS_DUAL_SPK,
 	ALC285_FIXUP_THINKPAD_HEADSET_JACK,
 	ALC294_FIXUP_ASUS_HPE,
+	ALC294_FIXUP_ASUS_COEF_1B,
 	ALC285_FIXUP_HP_GPIO_LED,
 };
 
@@ -6165,6 +6177,12 @@ static const struct hda_fixup alc269_fix
 		.chained = true,
 		.chain_id = ALC269_FIXUP_PINCFG_NO_HP_TO_LINEOUT
 	},
+	[ALC269_FIXUP_LENOVO_DOCK_LIMIT_BOOST] = {
+		.type = HDA_FIXUP_FUNC,
+		.v.func = alc269_fixup_limit_int_mic_boost,
+		.chained = true,
+		.chain_id = ALC269_FIXUP_LENOVO_DOCK,
+	},
 	[ALC269_FIXUP_PINCFG_NO_HP_TO_LINEOUT] = {
 		.type = HDA_FIXUP_FUNC,
 		.v.func = alc269_fixup_pincfg_no_hp_to_lineout,
@@ -6817,6 +6835,12 @@ static const struct hda_fixup alc269_fix
 			{ }
 		},
 		.chained = true,
+		.chain_id = ALC225_FIXUP_S3_POP_NOISE
+	},
+	[ALC225_FIXUP_S3_POP_NOISE] = {
+		.type = HDA_FIXUP_FUNC,
+		.v.func = alc225_fixup_s3_pop_noise,
+		.chained = true,
 		.chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC
 	},
 	[ALC700_FIXUP_INTEL_REFERENCE] = {
@@ -7089,6 +7113,17 @@ static const struct hda_fixup alc269_fix
 		.chained = true,
 		.chain_id = ALC294_FIXUP_ASUS_HEADSET_MIC
 	},
+	[ALC294_FIXUP_ASUS_COEF_1B] = {
+		.type = HDA_FIXUP_VERBS,
+		.v.verbs = (const struct hda_verb[]) {
+			/* Set bit 10 to correct noisy output after reboot from
+			 * Windows 10 (due to pop noise reduction?)
+			 */
+			{ 0x20, AC_VERB_SET_COEF_INDEX, 0x1b },
+			{ 0x20, AC_VERB_SET_PROC_COEF, 0x4e4b },
+			{ }
+		},
+	},
 	[ALC285_FIXUP_HP_GPIO_LED] = {
 		.type = HDA_FIXUP_FUNC,
 		.v.func = alc285_fixup_hp_gpio_led,
@@ -7260,6 +7295,7 @@ static const struct snd_pci_quirk alc269
 	SND_PCI_QUIRK(0x1043, 0x19ce, "ASUS B9450FA", ALC294_FIXUP_ASUS_HPE),
 	SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW),
 	SND_PCI_QUIRK(0x1043, 0x1a30, "ASUS X705UD", ALC256_FIXUP_ASUS_MIC),
+	SND_PCI_QUIRK(0x1043, 0x1b11, "ASUS UX431DA", ALC294_FIXUP_ASUS_COEF_1B),
 	SND_PCI_QUIRK(0x1043, 0x1b13, "Asus U41SV", ALC269_FIXUP_INV_DMIC),
 	SND_PCI_QUIRK(0x1043, 0x1bbd, "ASUS Z550MA", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1043, 0x1c23, "Asus X55U", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
@@ -7301,7 +7337,7 @@ static const struct snd_pci_quirk alc269
 	SND_PCI_QUIRK(0x17aa, 0x21b8, "Thinkpad Edge 14", ALC269_FIXUP_SKU_IGNORE),
 	SND_PCI_QUIRK(0x17aa, 0x21ca, "Thinkpad L412", ALC269_FIXUP_SKU_IGNORE),
 	SND_PCI_QUIRK(0x17aa, 0x21e9, "Thinkpad Edge 15", ALC269_FIXUP_SKU_IGNORE),
-	SND_PCI_QUIRK(0x17aa, 0x21f6, "Thinkpad T530", ALC269_FIXUP_LENOVO_DOCK),
+	SND_PCI_QUIRK(0x17aa, 0x21f6, "Thinkpad T530", ALC269_FIXUP_LENOVO_DOCK_LIMIT_BOOST),
 	SND_PCI_QUIRK(0x17aa, 0x21fa, "Thinkpad X230", ALC269_FIXUP_LENOVO_DOCK),
 	SND_PCI_QUIRK(0x17aa, 0x21f3, "Thinkpad T430", ALC269_FIXUP_LENOVO_DOCK),
 	SND_PCI_QUIRK(0x17aa, 0x21fb, "Thinkpad T430s", ALC269_FIXUP_LENOVO_DOCK),
@@ -7440,6 +7476,7 @@ static const struct hda_model_fixup alc2
 	{.id = ALC269_FIXUP_HEADSET_MODE, .name = "headset-mode"},
 	{.id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC, .name = "headset-mode-no-hp-mic"},
 	{.id = ALC269_FIXUP_LENOVO_DOCK, .name = "lenovo-dock"},
+	{.id = ALC269_FIXUP_LENOVO_DOCK_LIMIT_BOOST, .name = "lenovo-dock-limit-boost"},
 	{.id = ALC269_FIXUP_HP_GPIO_LED, .name = "hp-gpio-led"},
 	{.id = ALC269_FIXUP_HP_DOCK_GPIO_MIC1_LED, .name = "hp-dock-gpio-mic1-led"},
 	{.id = ALC269_FIXUP_DELL1_MIC_NO_PRESENCE, .name = "dell-headset-multi"},
@@ -8084,8 +8121,6 @@ static int patch_alc269(struct hda_codec
 		spec->gen.mixer_nid = 0;
 		break;
 	case 0x10ec0225:
-		codec->power_save_node = 1;
-		/* fall through */
 	case 0x10ec0295:
 	case 0x10ec0299:
 		spec->codec_variant = ALC269_TYPE_ALC225;
diff -druNp --no-dereference linux-libre-5.6.13-gnu/sound/usb/quirks.c linux-libre-5.6.14-gnu/sound/usb/quirks.c
--- linux-libre-5.6.13-gnu/sound/usb/quirks.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/sound/usb/quirks.c	2020-05-20 02:22:38.000000000 -0400
@@ -1592,13 +1592,14 @@ void snd_usb_ctl_msg_quirk(struct usb_de
 	    && (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS)
 		msleep(20);
 
-	/* Zoom R16/24, Logitech H650e, Jabra 550a needs a tiny delay here,
-	 * otherwise requests like get/set frequency return as failed despite
-	 * actually succeeding.
+	/* Zoom R16/24, Logitech H650e, Jabra 550a, Kingston HyperX needs a tiny
+	 * delay here, otherwise requests like get/set frequency return as
+	 * failed despite actually succeeding.
 	 */
 	if ((chip->usb_id == USB_ID(0x1686, 0x00dd) ||
 	     chip->usb_id == USB_ID(0x046d, 0x0a46) ||
-	     chip->usb_id == USB_ID(0x0b0e, 0x0349)) &&
+	     chip->usb_id == USB_ID(0x0b0e, 0x0349) ||
+	     chip->usb_id == USB_ID(0x0951, 0x16ad)) &&
 	    (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS)
 		usleep_range(1000, 2000);
 }
diff -druNp --no-dereference linux-libre-5.6.13-gnu/tools/testing/selftests/bpf/progs/test_overhead.c linux-libre-5.6.14-gnu/tools/testing/selftests/bpf/progs/test_overhead.c
--- linux-libre-5.6.13-gnu/tools/testing/selftests/bpf/progs/test_overhead.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/tools/testing/selftests/bpf/progs/test_overhead.c	2020-05-20 02:22:38.000000000 -0400
@@ -33,13 +33,13 @@ int prog3(struct bpf_raw_tracepoint_args
 SEC("fentry/__set_task_comm")
 int BPF_PROG(prog4, struct task_struct *tsk, const char *buf, bool exec)
 {
-	return !tsk;
+	return 0;
 }
 
 SEC("fexit/__set_task_comm")
 int BPF_PROG(prog5, struct task_struct *tsk, const char *buf, bool exec)
 {
-	return !tsk;
+	return 0;
 }
 
 char _license[] SEC("license") = "GPL";
diff -druNp --no-dereference linux-libre-5.6.13-gnu/tools/testing/selftests/bpf/prog_tests/mmap.c linux-libre-5.6.14-gnu/tools/testing/selftests/bpf/prog_tests/mmap.c
--- linux-libre-5.6.13-gnu/tools/testing/selftests/bpf/prog_tests/mmap.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/tools/testing/selftests/bpf/prog_tests/mmap.c	2020-05-20 02:22:38.000000000 -0400
@@ -197,6 +197,15 @@ void test_mmap(void)
 	CHECK_FAIL(map_data->val[far] != 3 * 321);
 
 	munmap(tmp2, 4 * page_size);
+
+	/* map all 4 pages, but with pg_off=1 page, should fail */
+	tmp1 = mmap(NULL, 4 * page_size, PROT_READ, MAP_SHARED | MAP_FIXED,
+		    data_map_fd, page_size /* initial page shift */);
+	if (CHECK(tmp1 != MAP_FAILED, "adv_mmap7", "unexpected success")) {
+		munmap(tmp1, 4 * page_size);
+		goto cleanup;
+	}
+
 cleanup:
 	if (bss_mmaped)
 		CHECK_FAIL(munmap(bss_mmaped, bss_sz));
diff -druNp --no-dereference linux-libre-5.6.13-gnu/tools/testing/selftests/ftrace/ftracetest linux-libre-5.6.14-gnu/tools/testing/selftests/ftrace/ftracetest
--- linux-libre-5.6.13-gnu/tools/testing/selftests/ftrace/ftracetest	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/tools/testing/selftests/ftrace/ftracetest	2020-05-20 02:22:38.000000000 -0400
@@ -29,8 +29,25 @@ err_ret=1
 # kselftest skip code is 4
 err_skip=4
 
+# cgroup RT scheduling prevents chrt commands from succeeding, which
+# induces failures in test wakeup tests.  Disable for the duration of
+# the tests.
+
+readonly sched_rt_runtime=/proc/sys/kernel/sched_rt_runtime_us
+
+sched_rt_runtime_orig=$(cat $sched_rt_runtime)
+
+setup() {
+  echo -1 > $sched_rt_runtime
+}
+
+cleanup() {
+  echo $sched_rt_runtime_orig > $sched_rt_runtime
+}
+
 errexit() { # message
   echo "Error: $1" 1>&2
+  cleanup
   exit $err_ret
 }
 
@@ -39,6 +56,8 @@ if [ `id -u` -ne 0 ]; then
   errexit "this must be run by root user"
 fi
 
+setup
+
 # Utilities
 absdir() { # file_path
   (cd `dirname $1`; pwd)
@@ -235,6 +254,7 @@ TOTAL_RESULT=0
 
 INSTANCE=
 CASENO=0
+
 testcase() { # testfile
   CASENO=$((CASENO+1))
   desc=`grep "^#[ \t]*description:" $1 | cut -f2 -d:`
@@ -406,5 +426,7 @@ prlog "# of unsupported: " `echo $UNSUPP
 prlog "# of xfailed: " `echo $XFAILED_CASES | wc -w`
 prlog "# of undefined(test bug): " `echo $UNDEFINED_CASES | wc -w`
 
+cleanup
+
 # if no error, return 0
 exit $TOTAL_RESULT
diff -druNp --no-dereference linux-libre-5.6.13-gnu/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_type.tc linux-libre-5.6.14-gnu/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_type.tc
--- linux-libre-5.6.13-gnu/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_type.tc	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_type.tc	2020-05-20 02:22:38.000000000 -0400
@@ -38,7 +38,7 @@ for width in 64 32 16 8; do
   echo 0 > events/kprobes/testprobe/enable
 
   : "Confirm the arguments is recorded in given types correctly"
-  ARGS=`grep "testprobe" trace | sed -e 's/.* arg1=\(.*\) arg2=\(.*\) arg3=\(.*\) arg4=\(.*\)/\1 \2 \3 \4/'`
+  ARGS=`grep "testprobe" trace | head -n 1 | sed -e 's/.* arg1=\(.*\) arg2=\(.*\) arg3=\(.*\) arg4=\(.*\)/\1 \2 \3 \4/'`
   check_types $ARGS $width
 
   : "Clear event for next loop"
diff -druNp --no-dereference linux-libre-5.6.13-gnu/virt/kvm/arm/vgic/vgic-mmio.c linux-libre-5.6.14-gnu/virt/kvm/arm/vgic/vgic-mmio.c
--- linux-libre-5.6.13-gnu/virt/kvm/arm/vgic/vgic-mmio.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/virt/kvm/arm/vgic/vgic-mmio.c	2020-05-20 02:22:38.000000000 -0400
@@ -179,17 +179,6 @@ unsigned long vgic_mmio_read_pending(str
 	return value;
 }
 
-/* Must be called with irq->irq_lock held */
-static void vgic_hw_irq_spending(struct kvm_vcpu *vcpu, struct vgic_irq *irq,
-				 bool is_uaccess)
-{
-	if (is_uaccess)
-		return;
-
-	irq->pending_latch = true;
-	vgic_irq_set_phys_active(irq, true);
-}
-
 static bool is_vgic_v2_sgi(struct kvm_vcpu *vcpu, struct vgic_irq *irq)
 {
 	return (vgic_irq_is_sgi(irq->intid) &&
@@ -200,7 +189,6 @@ void vgic_mmio_write_spending(struct kvm
 			      gpa_t addr, unsigned int len,
 			      unsigned long val)
 {
-	bool is_uaccess = !kvm_get_running_vcpu();
 	u32 intid = VGIC_ADDR_TO_INTID(addr, 1);
 	int i;
 	unsigned long flags;
@@ -215,22 +203,49 @@ void vgic_mmio_write_spending(struct kvm
 		}
 
 		raw_spin_lock_irqsave(&irq->irq_lock, flags);
+
+		irq->pending_latch = true;
 		if (irq->hw)
-			vgic_hw_irq_spending(vcpu, irq, is_uaccess);
-		else
-			irq->pending_latch = true;
+			vgic_irq_set_phys_active(irq, true);
+
 		vgic_queue_irq_unlock(vcpu->kvm, irq, flags);
 		vgic_put_irq(vcpu->kvm, irq);
 	}
 }
 
-/* Must be called with irq->irq_lock held */
-static void vgic_hw_irq_cpending(struct kvm_vcpu *vcpu, struct vgic_irq *irq,
-				 bool is_uaccess)
+int vgic_uaccess_write_spending(struct kvm_vcpu *vcpu,
+				gpa_t addr, unsigned int len,
+				unsigned long val)
 {
-	if (is_uaccess)
-		return;
+	u32 intid = VGIC_ADDR_TO_INTID(addr, 1);
+	int i;
+	unsigned long flags;
+
+	for_each_set_bit(i, &val, len * 8) {
+		struct vgic_irq *irq = vgic_get_irq(vcpu->kvm, vcpu, intid + i);
+
+		raw_spin_lock_irqsave(&irq->irq_lock, flags);
+		irq->pending_latch = true;
+
+		/*
+		 * GICv2 SGIs are terribly broken. We can't restore
+		 * the source of the interrupt, so just pick the vcpu
+		 * itself as the source...
+		 */
+		if (is_vgic_v2_sgi(vcpu, irq))
+			irq->source |= BIT(vcpu->vcpu_id);
+
+		vgic_queue_irq_unlock(vcpu->kvm, irq, flags);
+
+		vgic_put_irq(vcpu->kvm, irq);
+	}
+
+	return 0;
+}
 
+/* Must be called with irq->irq_lock held */
+static void vgic_hw_irq_cpending(struct kvm_vcpu *vcpu, struct vgic_irq *irq)
+{
 	irq->pending_latch = false;
 
 	/*
@@ -253,7 +268,6 @@ void vgic_mmio_write_cpending(struct kvm
 			      gpa_t addr, unsigned int len,
 			      unsigned long val)
 {
-	bool is_uaccess = !kvm_get_running_vcpu();
 	u32 intid = VGIC_ADDR_TO_INTID(addr, 1);
 	int i;
 	unsigned long flags;
@@ -270,7 +284,7 @@ void vgic_mmio_write_cpending(struct kvm
 		raw_spin_lock_irqsave(&irq->irq_lock, flags);
 
 		if (irq->hw)
-			vgic_hw_irq_cpending(vcpu, irq, is_uaccess);
+			vgic_hw_irq_cpending(vcpu, irq);
 		else
 			irq->pending_latch = false;
 
@@ -279,8 +293,68 @@ void vgic_mmio_write_cpending(struct kvm
 	}
 }
 
-unsigned long vgic_mmio_read_active(struct kvm_vcpu *vcpu,
-				    gpa_t addr, unsigned int len)
+int vgic_uaccess_write_cpending(struct kvm_vcpu *vcpu,
+				gpa_t addr, unsigned int len,
+				unsigned long val)
+{
+	u32 intid = VGIC_ADDR_TO_INTID(addr, 1);
+	int i;
+	unsigned long flags;
+
+	for_each_set_bit(i, &val, len * 8) {
+		struct vgic_irq *irq = vgic_get_irq(vcpu->kvm, vcpu, intid + i);
+
+		raw_spin_lock_irqsave(&irq->irq_lock, flags);
+		/*
+		 * More fun with GICv2 SGIs! If we're clearing one of them
+		 * from userspace, which source vcpu to clear? Let's not
+		 * even think of it, and blow the whole set.
+		 */
+		if (is_vgic_v2_sgi(vcpu, irq))
+			irq->source = 0;
+
+		irq->pending_latch = false;
+
+		raw_spin_unlock_irqrestore(&irq->irq_lock, flags);
+
+		vgic_put_irq(vcpu->kvm, irq);
+	}
+
+	return 0;
+}
+
+/*
+ * If we are fiddling with an IRQ's active state, we have to make sure the IRQ
+ * is not queued on some running VCPU's LRs, because then the change to the
+ * active state can be overwritten when the VCPU's state is synced coming back
+ * from the guest.
+ *
+ * For shared interrupts as well as GICv3 private interrupts, we have to
+ * stop all the VCPUs because interrupts can be migrated while we don't hold
+ * the IRQ locks and we don't want to be chasing moving targets.
+ *
+ * For GICv2 private interrupts we don't have to do anything because
+ * userspace accesses to the VGIC state already require all VCPUs to be
+ * stopped, and only the VCPU itself can modify its private interrupts
+ * active state, which guarantees that the VCPU is not running.
+ */
+static void vgic_access_active_prepare(struct kvm_vcpu *vcpu, u32 intid)
+{
+	if (vcpu->kvm->arch.vgic.vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3 ||
+	    intid >= VGIC_NR_PRIVATE_IRQS)
+		kvm_arm_halt_guest(vcpu->kvm);
+}
+
+/* See vgic_access_active_prepare */
+static void vgic_access_active_finish(struct kvm_vcpu *vcpu, u32 intid)
+{
+	if (vcpu->kvm->arch.vgic.vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3 ||
+	    intid >= VGIC_NR_PRIVATE_IRQS)
+		kvm_arm_resume_guest(vcpu->kvm);
+}
+
+static unsigned long __vgic_mmio_read_active(struct kvm_vcpu *vcpu,
+					     gpa_t addr, unsigned int len)
 {
 	u32 intid = VGIC_ADDR_TO_INTID(addr, 1);
 	u32 value = 0;
@@ -290,6 +364,10 @@ unsigned long vgic_mmio_read_active(stru
 	for (i = 0; i < len * 8; i++) {
 		struct vgic_irq *irq = vgic_get_irq(vcpu->kvm, vcpu, intid + i);
 
+		/*
+		 * Even for HW interrupts, don't evaluate the HW state as
+		 * all the guest is interested in is the virtual state.
+		 */
 		if (irq->active)
 			value |= (1U << i);
 
@@ -299,6 +377,29 @@ unsigned long vgic_mmio_read_active(stru
 	return value;
 }
 
+unsigned long vgic_mmio_read_active(struct kvm_vcpu *vcpu,
+				    gpa_t addr, unsigned int len)
+{
+	u32 intid = VGIC_ADDR_TO_INTID(addr, 1);
+	u32 val;
+
+	mutex_lock(&vcpu->kvm->lock);
+	vgic_access_active_prepare(vcpu, intid);
+
+	val = __vgic_mmio_read_active(vcpu, addr, len);
+
+	vgic_access_active_finish(vcpu, intid);
+	mutex_unlock(&vcpu->kvm->lock);
+
+	return val;
+}
+
+unsigned long vgic_uaccess_read_active(struct kvm_vcpu *vcpu,
+				    gpa_t addr, unsigned int len)
+{
+	return __vgic_mmio_read_active(vcpu, addr, len);
+}
+
 /* Must be called with irq->irq_lock held */
 static void vgic_hw_irq_change_active(struct kvm_vcpu *vcpu, struct vgic_irq *irq,
 				      bool active, bool is_uaccess)
@@ -350,36 +451,6 @@ static void vgic_mmio_change_active(stru
 		raw_spin_unlock_irqrestore(&irq->irq_lock, flags);
 }
 
-/*
- * If we are fiddling with an IRQ's active state, we have to make sure the IRQ
- * is not queued on some running VCPU's LRs, because then the change to the
- * active state can be overwritten when the VCPU's state is synced coming back
- * from the guest.
- *
- * For shared interrupts, we have to stop all the VCPUs because interrupts can
- * be migrated while we don't hold the IRQ locks and we don't want to be
- * chasing moving targets.
- *
- * For private interrupts we don't have to do anything because userspace
- * accesses to the VGIC state already require all VCPUs to be stopped, and
- * only the VCPU itself can modify its private interrupts active state, which
- * guarantees that the VCPU is not running.
- */
-static void vgic_change_active_prepare(struct kvm_vcpu *vcpu, u32 intid)
-{
-	if (vcpu->kvm->arch.vgic.vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3 ||
-	    intid >= VGIC_NR_PRIVATE_IRQS)
-		kvm_arm_halt_guest(vcpu->kvm);
-}
-
-/* See vgic_change_active_prepare */
-static void vgic_change_active_finish(struct kvm_vcpu *vcpu, u32 intid)
-{
-	if (vcpu->kvm->arch.vgic.vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3 ||
-	    intid >= VGIC_NR_PRIVATE_IRQS)
-		kvm_arm_resume_guest(vcpu->kvm);
-}
-
 static void __vgic_mmio_write_cactive(struct kvm_vcpu *vcpu,
 				      gpa_t addr, unsigned int len,
 				      unsigned long val)
@@ -401,11 +472,11 @@ void vgic_mmio_write_cactive(struct kvm_
 	u32 intid = VGIC_ADDR_TO_INTID(addr, 1);
 
 	mutex_lock(&vcpu->kvm->lock);
-	vgic_change_active_prepare(vcpu, intid);
+	vgic_access_active_prepare(vcpu, intid);
 
 	__vgic_mmio_write_cactive(vcpu, addr, len, val);
 
-	vgic_change_active_finish(vcpu, intid);
+	vgic_access_active_finish(vcpu, intid);
 	mutex_unlock(&vcpu->kvm->lock);
 }
 
@@ -438,11 +509,11 @@ void vgic_mmio_write_sactive(struct kvm_
 	u32 intid = VGIC_ADDR_TO_INTID(addr, 1);
 
 	mutex_lock(&vcpu->kvm->lock);
-	vgic_change_active_prepare(vcpu, intid);
+	vgic_access_active_prepare(vcpu, intid);
 
 	__vgic_mmio_write_sactive(vcpu, addr, len, val);
 
-	vgic_change_active_finish(vcpu, intid);
+	vgic_access_active_finish(vcpu, intid);
 	mutex_unlock(&vcpu->kvm->lock);
 }
 
diff -druNp --no-dereference linux-libre-5.6.13-gnu/virt/kvm/arm/vgic/vgic-mmio.h linux-libre-5.6.14-gnu/virt/kvm/arm/vgic/vgic-mmio.h
--- linux-libre-5.6.13-gnu/virt/kvm/arm/vgic/vgic-mmio.h	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/virt/kvm/arm/vgic/vgic-mmio.h	2020-05-20 02:22:38.000000000 -0400
@@ -149,9 +149,20 @@ void vgic_mmio_write_cpending(struct kvm
 			      gpa_t addr, unsigned int len,
 			      unsigned long val);
 
+int vgic_uaccess_write_spending(struct kvm_vcpu *vcpu,
+				gpa_t addr, unsigned int len,
+				unsigned long val);
+
+int vgic_uaccess_write_cpending(struct kvm_vcpu *vcpu,
+				gpa_t addr, unsigned int len,
+				unsigned long val);
+
 unsigned long vgic_mmio_read_active(struct kvm_vcpu *vcpu,
 				    gpa_t addr, unsigned int len);
 
+unsigned long vgic_uaccess_read_active(struct kvm_vcpu *vcpu,
+				    gpa_t addr, unsigned int len);
+
 void vgic_mmio_write_cactive(struct kvm_vcpu *vcpu,
 			     gpa_t addr, unsigned int len,
 			     unsigned long val);
diff -druNp --no-dereference linux-libre-5.6.13-gnu/virt/kvm/arm/vgic/vgic-mmio-v2.c linux-libre-5.6.14-gnu/virt/kvm/arm/vgic/vgic-mmio-v2.c
--- linux-libre-5.6.13-gnu/virt/kvm/arm/vgic/vgic-mmio-v2.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/virt/kvm/arm/vgic/vgic-mmio-v2.c	2020-05-20 02:22:38.000000000 -0400
@@ -415,18 +415,20 @@ static const struct vgic_register_region
 		vgic_mmio_read_enable, vgic_mmio_write_cenable, NULL, NULL, 1,
 		VGIC_ACCESS_32bit),
 	REGISTER_DESC_WITH_BITS_PER_IRQ(GIC_DIST_PENDING_SET,
-		vgic_mmio_read_pending, vgic_mmio_write_spending, NULL, NULL, 1,
+		vgic_mmio_read_pending, vgic_mmio_write_spending,
+		NULL, vgic_uaccess_write_spending, 1,
 		VGIC_ACCESS_32bit),
 	REGISTER_DESC_WITH_BITS_PER_IRQ(GIC_DIST_PENDING_CLEAR,
-		vgic_mmio_read_pending, vgic_mmio_write_cpending, NULL, NULL, 1,
+		vgic_mmio_read_pending, vgic_mmio_write_cpending,
+		NULL, vgic_uaccess_write_cpending, 1,
 		VGIC_ACCESS_32bit),
 	REGISTER_DESC_WITH_BITS_PER_IRQ(GIC_DIST_ACTIVE_SET,
 		vgic_mmio_read_active, vgic_mmio_write_sactive,
-		NULL, vgic_mmio_uaccess_write_sactive, 1,
+		vgic_uaccess_read_active, vgic_mmio_uaccess_write_sactive, 1,
 		VGIC_ACCESS_32bit),
 	REGISTER_DESC_WITH_BITS_PER_IRQ(GIC_DIST_ACTIVE_CLEAR,
 		vgic_mmio_read_active, vgic_mmio_write_cactive,
-		NULL, vgic_mmio_uaccess_write_cactive, 1,
+		vgic_uaccess_read_active, vgic_mmio_uaccess_write_cactive, 1,
 		VGIC_ACCESS_32bit),
 	REGISTER_DESC_WITH_BITS_PER_IRQ(GIC_DIST_PRI,
 		vgic_mmio_read_priority, vgic_mmio_write_priority, NULL, NULL,
diff -druNp --no-dereference linux-libre-5.6.13-gnu/virt/kvm/arm/vgic/vgic-mmio-v3.c linux-libre-5.6.14-gnu/virt/kvm/arm/vgic/vgic-mmio-v3.c
--- linux-libre-5.6.13-gnu/virt/kvm/arm/vgic/vgic-mmio-v3.c	2020-05-14 01:59:28.000000000 -0400
+++ linux-libre-5.6.14-gnu/virt/kvm/arm/vgic/vgic-mmio-v3.c	2020-05-20 02:22:38.000000000 -0400
@@ -494,11 +494,11 @@ static const struct vgic_register_region
 		VGIC_ACCESS_32bit),
 	REGISTER_DESC_WITH_BITS_PER_IRQ_SHARED(GICD_ISACTIVER,
 		vgic_mmio_read_active, vgic_mmio_write_sactive,
-		NULL, vgic_mmio_uaccess_write_sactive, 1,
+		vgic_uaccess_read_active, vgic_mmio_uaccess_write_sactive, 1,
 		VGIC_ACCESS_32bit),
 	REGISTER_DESC_WITH_BITS_PER_IRQ_SHARED(GICD_ICACTIVER,
 		vgic_mmio_read_active, vgic_mmio_write_cactive,
-		NULL, vgic_mmio_uaccess_write_cactive,
+		vgic_uaccess_read_active, vgic_mmio_uaccess_write_cactive,
 		1, VGIC_ACCESS_32bit),
 	REGISTER_DESC_WITH_BITS_PER_IRQ_SHARED(GICD_IPRIORITYR,
 		vgic_mmio_read_priority, vgic_mmio_write_priority, NULL, NULL,
@@ -566,12 +566,12 @@ static const struct vgic_register_region
 		VGIC_ACCESS_32bit),
 	REGISTER_DESC_WITH_LENGTH_UACCESS(SZ_64K + GICR_ISACTIVER0,
 		vgic_mmio_read_active, vgic_mmio_write_sactive,
-		NULL, vgic_mmio_uaccess_write_sactive,
-		4, VGIC_ACCESS_32bit),
+		vgic_uaccess_read_active, vgic_mmio_uaccess_write_sactive, 4,
+		VGIC_ACCESS_32bit),
 	REGISTER_DESC_WITH_LENGTH_UACCESS(SZ_64K + GICR_ICACTIVER0,
 		vgic_mmio_read_active, vgic_mmio_write_cactive,
-		NULL, vgic_mmio_uaccess_write_cactive,
-		4, VGIC_ACCESS_32bit),
+		vgic_uaccess_read_active, vgic_mmio_uaccess_write_cactive, 4,
+		VGIC_ACCESS_32bit),
 	REGISTER_DESC_WITH_LENGTH(SZ_64K + GICR_IPRIORITYR0,
 		vgic_mmio_read_priority, vgic_mmio_write_priority, 32,
 		VGIC_ACCESS_32bit | VGIC_ACCESS_8bit),
