diff -druNp --no-dereference linux-libre-5.6-gnu/drivers/ata/ahci.c linux-libre-5.6.3-gnu/drivers/ata/ahci.c
--- linux-libre-5.6-gnu/drivers/ata/ahci.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/drivers/ata/ahci.c	2020-04-08 03:11:10.000000000 -0400
@@ -401,6 +401,7 @@ static const struct pci_device_id ahci_p
 	{ PCI_VDEVICE(INTEL, 0xa252), board_ahci }, /* Lewisburg RAID*/
 	{ PCI_VDEVICE(INTEL, 0xa256), board_ahci }, /* Lewisburg RAID*/
 	{ PCI_VDEVICE(INTEL, 0xa356), board_ahci }, /* Cannon Lake PCH-H RAID */
+	{ PCI_VDEVICE(INTEL, 0x06d7), board_ahci }, /* Comet Lake-H RAID */
 	{ PCI_VDEVICE(INTEL, 0x0f22), board_ahci_mobile }, /* Bay Trail AHCI */
 	{ PCI_VDEVICE(INTEL, 0x0f23), board_ahci_mobile }, /* Bay Trail AHCI */
 	{ PCI_VDEVICE(INTEL, 0x22a3), board_ahci_mobile }, /* Cherry Tr. AHCI */
diff -druNp --no-dereference linux-libre-5.6-gnu/drivers/extcon/extcon-axp288.c linux-libre-5.6.3-gnu/drivers/extcon/extcon-axp288.c
--- linux-libre-5.6-gnu/drivers/extcon/extcon-axp288.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/drivers/extcon/extcon-axp288.c	2020-04-08 03:11:10.000000000 -0400
@@ -443,9 +443,40 @@ static int axp288_extcon_probe(struct pl
 	/* Start charger cable type detection */
 	axp288_extcon_enable(info);
 
+	device_init_wakeup(dev, true);
+	platform_set_drvdata(pdev, info);
+
+	return 0;
+}
+
+static int __maybe_unused axp288_extcon_suspend(struct device *dev)
+{
+	struct axp288_extcon_info *info = dev_get_drvdata(dev);
+
+	if (device_may_wakeup(dev))
+		enable_irq_wake(info->irq[VBUS_RISING_IRQ]);
+
+	return 0;
+}
+
+static int __maybe_unused axp288_extcon_resume(struct device *dev)
+{
+	struct axp288_extcon_info *info = dev_get_drvdata(dev);
+
+	/*
+	 * Wakeup when a charger is connected to do charger-type
+	 * connection and generate an extcon event which makes the
+	 * axp288 charger driver set the input current limit.
+	 */
+	if (device_may_wakeup(dev))
+		disable_irq_wake(info->irq[VBUS_RISING_IRQ]);
+
 	return 0;
 }
 
+static SIMPLE_DEV_PM_OPS(axp288_extcon_pm_ops, axp288_extcon_suspend,
+			 axp288_extcon_resume);
+
 static const struct platform_device_id axp288_extcon_table[] = {
 	{ .name = "axp288_extcon" },
 	{},
@@ -457,6 +488,7 @@ static struct platform_driver axp288_ext
 	.id_table = axp288_extcon_table,
 	.driver = {
 		.name = "axp288_extcon",
+		.pm = &axp288_extcon_pm_ops,
 	},
 };
 
diff -druNp --no-dereference linux-libre-5.6-gnu/drivers/gpu/drm/bridge/analogix/analogix-anx6345.c linux-libre-5.6.3-gnu/drivers/gpu/drm/bridge/analogix/analogix-anx6345.c
--- linux-libre-5.6-gnu/drivers/gpu/drm/bridge/analogix/analogix-anx6345.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/drivers/gpu/drm/bridge/analogix/analogix-anx6345.c	2020-04-08 03:11:10.000000000 -0400
@@ -711,14 +711,14 @@ static int anx6345_i2c_probe(struct i2c_
 		DRM_DEBUG("No panel found\n");
 
 	/* 1.2V digital core power regulator  */
-	anx6345->dvdd12 = devm_regulator_get(dev, "dvdd12-supply");
+	anx6345->dvdd12 = devm_regulator_get(dev, "dvdd12");
 	if (IS_ERR(anx6345->dvdd12)) {
 		DRM_ERROR("dvdd12-supply not found\n");
 		return PTR_ERR(anx6345->dvdd12);
 	}
 
 	/* 2.5V digital core power regulator  */
-	anx6345->dvdd25 = devm_regulator_get(dev, "dvdd25-supply");
+	anx6345->dvdd25 = devm_regulator_get(dev, "dvdd25");
 	if (IS_ERR(anx6345->dvdd25)) {
 		DRM_ERROR("dvdd25-supply not found\n");
 		return PTR_ERR(anx6345->dvdd25);
diff -druNp --no-dereference linux-libre-5.6-gnu/drivers/gpu/drm/i915/display/intel_display.c linux-libre-5.6.3-gnu/drivers/gpu/drm/i915/display/intel_display.c
--- linux-libre-5.6-gnu/drivers/gpu/drm/i915/display/intel_display.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/drivers/gpu/drm/i915/display/intel_display.c	2020-04-08 03:11:10.000000000 -0400
@@ -14582,8 +14582,8 @@ static int intel_atomic_check(struct drm
 	/* Catch I915_MODE_FLAG_INHERITED */
 	for_each_oldnew_intel_crtc_in_state(state, crtc, old_crtc_state,
 					    new_crtc_state, i) {
-		if (new_crtc_state->hw.mode.private_flags !=
-		    old_crtc_state->hw.mode.private_flags)
+		if (new_crtc_state->uapi.mode.private_flags !=
+		    old_crtc_state->uapi.mode.private_flags)
 			new_crtc_state->uapi.mode_changed = true;
 	}
 
diff -druNp --no-dereference linux-libre-5.6-gnu/drivers/md/dm.c linux-libre-5.6.3-gnu/drivers/md/dm.c
--- linux-libre-5.6-gnu/drivers/md/dm.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/drivers/md/dm.c	2020-04-08 03:11:10.000000000 -0400
@@ -1739,8 +1739,9 @@ static blk_qc_t dm_process_bio(struct ma
 	 * won't be imposed.
 	 */
 	if (current->bio_list) {
-		blk_queue_split(md->queue, &bio);
-		if (!is_abnormal_io(bio))
+		if (is_abnormal_io(bio))
+			blk_queue_split(md->queue, &bio);
+		else
 			dm_queue_split(md, ti, &bio);
 	}
 
diff -druNp --no-dereference linux-libre-5.6-gnu/drivers/media/usb/b2c2/flexcop-usb.c linux-libre-5.6.3-gnu/drivers/media/usb/b2c2/flexcop-usb.c
--- linux-libre-5.6-gnu/drivers/media/usb/b2c2/flexcop-usb.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/drivers/media/usb/b2c2/flexcop-usb.c	2020-04-08 03:11:10.000000000 -0400
@@ -511,6 +511,9 @@ static int flexcop_usb_init(struct flexc
 		return ret;
 	}
 
+	if (fc_usb->uintf->cur_altsetting->desc.bNumEndpoints < 1)
+		return -ENODEV;
+
 	switch (fc_usb->udev->speed) {
 	case USB_SPEED_LOW:
 		err("cannot handle USB speed because it is too slow.");
@@ -544,9 +547,6 @@ static int flexcop_usb_probe(struct usb_
 	struct flexcop_device *fc = NULL;
 	int ret;
 
-	if (intf->cur_altsetting->desc.bNumEndpoints < 1)
-		return -ENODEV;
-
 	if ((fc = flexcop_device_kmalloc(sizeof(struct flexcop_usb))) == NULL) {
 		err("out of memory\n");
 		return -ENOMEM;
diff -druNp --no-dereference linux-libre-5.6-gnu/drivers/media/usb/dvb-usb/dib0700_core.c linux-libre-5.6.3-gnu/drivers/media/usb/dvb-usb/dib0700_core.c
--- linux-libre-5.6-gnu/drivers/media/usb/dvb-usb/dib0700_core.c	2020-03-29 20:42:33.000000000 -0400
+++ linux-libre-5.6.3-gnu/drivers/media/usb/dvb-usb/dib0700_core.c	2020-04-08 04:31:16.000000000 -0400
@@ -818,7 +818,7 @@ int dib0700_rc_setup(struct dvb_usb_devi
 
 	/* Starting in firmware 1.20, the RC info is provided on a bulk pipe */
 
-	if (intf->altsetting[0].desc.bNumEndpoints < rc_ep + 1)
+	if (intf->cur_altsetting->desc.bNumEndpoints < rc_ep + 1)
 		return -ENODEV;
 
 	purb = usb_alloc_urb(0, GFP_KERNEL);
@@ -838,7 +838,7 @@ int dib0700_rc_setup(struct dvb_usb_devi
 	 * Some devices like the Hauppauge NovaTD model 52009 use an interrupt
 	 * endpoint, while others use a bulk one.
 	 */
-	e = &intf->altsetting[0].endpoint[rc_ep].desc;
+	e = &intf->cur_altsetting->endpoint[rc_ep].desc;
 	if (usb_endpoint_dir_in(e)) {
 		if (usb_endpoint_xfer_bulk(e)) {
 			pipe = usb_rcvbulkpipe(d->udev, rc_ep);
diff -druNp --no-dereference linux-libre-5.6-gnu/drivers/media/usb/gspca/ov519.c linux-libre-5.6.3-gnu/drivers/media/usb/gspca/ov519.c
--- linux-libre-5.6-gnu/drivers/media/usb/gspca/ov519.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/drivers/media/usb/gspca/ov519.c	2020-04-08 03:11:10.000000000 -0400
@@ -3477,6 +3477,11 @@ static void ov511_mode_init_regs(struct
 		return;
 	}
 
+	if (alt->desc.bNumEndpoints < 1) {
+		sd->gspca_dev.usb_err = -ENODEV;
+		return;
+	}
+
 	packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize);
 	reg_w(sd, R51x_FIFO_PSIZE, packet_size >> 5);
 
@@ -3603,6 +3608,11 @@ static void ov518_mode_init_regs(struct
 		return;
 	}
 
+	if (alt->desc.bNumEndpoints < 1) {
+		sd->gspca_dev.usb_err = -ENODEV;
+		return;
+	}
+
 	packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize);
 	ov518_reg_w32(sd, R51x_FIFO_PSIZE, packet_size & ~7, 2);
 
diff -druNp --no-dereference linux-libre-5.6-gnu/drivers/media/usb/gspca/stv06xx/stv06xx.c linux-libre-5.6.3-gnu/drivers/media/usb/gspca/stv06xx/stv06xx.c
--- linux-libre-5.6-gnu/drivers/media/usb/gspca/stv06xx/stv06xx.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/drivers/media/usb/gspca/stv06xx/stv06xx.c	2020-04-08 03:11:10.000000000 -0400
@@ -282,6 +282,9 @@ static int stv06xx_start(struct gspca_de
 		return -EIO;
 	}
 
+	if (alt->desc.bNumEndpoints < 1)
+		return -ENODEV;
+
 	packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize);
 	err = stv06xx_write_bridge(sd, STV_ISO_SIZE_L, packet_size);
 	if (err < 0)
@@ -306,11 +309,21 @@ out:
 
 static int stv06xx_isoc_init(struct gspca_dev *gspca_dev)
 {
+	struct usb_interface_cache *intfc;
 	struct usb_host_interface *alt;
 	struct sd *sd = (struct sd *) gspca_dev;
 
+	intfc = gspca_dev->dev->actconfig->intf_cache[0];
+
+	if (intfc->num_altsetting < 2)
+		return -ENODEV;
+
+	alt = &intfc->altsetting[1];
+
+	if (alt->desc.bNumEndpoints < 1)
+		return -ENODEV;
+
 	/* Start isoc bandwidth "negotiation" at max isoc bandwidth */
-	alt = &gspca_dev->dev->actconfig->intf_cache[0]->altsetting[1];
 	alt->endpoint[0].desc.wMaxPacketSize =
 		cpu_to_le16(sd->sensor->max_packet_size[gspca_dev->curr_mode]);
 
@@ -323,6 +336,10 @@ static int stv06xx_isoc_nego(struct gspc
 	struct usb_host_interface *alt;
 	struct sd *sd = (struct sd *) gspca_dev;
 
+	/*
+	 * Existence of altsetting and endpoint was verified in
+	 * stv06xx_isoc_init()
+	 */
 	alt = &gspca_dev->dev->actconfig->intf_cache[0]->altsetting[1];
 	packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize);
 	min_packet_size = sd->sensor->min_packet_size[gspca_dev->curr_mode];
diff -druNp --no-dereference linux-libre-5.6-gnu/drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c linux-libre-5.6.3-gnu/drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c
--- linux-libre-5.6-gnu/drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c	2020-04-08 03:11:10.000000000 -0400
@@ -185,6 +185,10 @@ static int pb0100_start(struct sd *sd)
 	alt = usb_altnum_to_altsetting(intf, sd->gspca_dev.alt);
 	if (!alt)
 		return -ENODEV;
+
+	if (alt->desc.bNumEndpoints < 1)
+		return -ENODEV;
+
 	packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize);
 
 	/* If we don't have enough bandwidth use a lower framerate */
diff -druNp --no-dereference linux-libre-5.6-gnu/drivers/media/usb/gspca/xirlink_cit.c linux-libre-5.6.3-gnu/drivers/media/usb/gspca/xirlink_cit.c
--- linux-libre-5.6-gnu/drivers/media/usb/gspca/xirlink_cit.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/drivers/media/usb/gspca/xirlink_cit.c	2020-04-08 03:11:10.000000000 -0400
@@ -1442,6 +1442,9 @@ static int cit_get_packet_size(struct gs
 		return -EIO;
 	}
 
+	if (alt->desc.bNumEndpoints < 1)
+		return -ENODEV;
+
 	return le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize);
 }
 
@@ -2626,6 +2629,7 @@ static int sd_start(struct gspca_dev *gs
 
 static int sd_isoc_init(struct gspca_dev *gspca_dev)
 {
+	struct usb_interface_cache *intfc;
 	struct usb_host_interface *alt;
 	int max_packet_size;
 
@@ -2641,8 +2645,17 @@ static int sd_isoc_init(struct gspca_dev
 		break;
 	}
 
+	intfc = gspca_dev->dev->actconfig->intf_cache[0];
+
+	if (intfc->num_altsetting < 2)
+		return -ENODEV;
+
+	alt = &intfc->altsetting[1];
+
+	if (alt->desc.bNumEndpoints < 1)
+		return -ENODEV;
+
 	/* Start isoc bandwidth "negotiation" at max isoc bandwidth */
-	alt = &gspca_dev->dev->actconfig->intf_cache[0]->altsetting[1];
 	alt->endpoint[0].desc.wMaxPacketSize = cpu_to_le16(max_packet_size);
 
 	return 0;
@@ -2665,6 +2678,9 @@ static int sd_isoc_nego(struct gspca_dev
 		break;
 	}
 
+	/*
+	 * Existence of altsetting and endpoint was verified in sd_isoc_init()
+	 */
 	alt = &gspca_dev->dev->actconfig->intf_cache[0]->altsetting[1];
 	packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize);
 	if (packet_size <= min_packet_size)
diff -druNp --no-dereference linux-libre-5.6-gnu/drivers/media/usb/usbtv/usbtv-core.c linux-libre-5.6.3-gnu/drivers/media/usb/usbtv/usbtv-core.c
--- linux-libre-5.6-gnu/drivers/media/usb/usbtv/usbtv-core.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/drivers/media/usb/usbtv/usbtv-core.c	2020-04-08 03:11:10.000000000 -0400
@@ -56,7 +56,7 @@ int usbtv_set_regs(struct usbtv *usbtv,
 
 		ret = usb_control_msg(usbtv->udev, pipe, USBTV_REQUEST_REG,
 			USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
-			value, index, NULL, 0, 0);
+			value, index, NULL, 0, USB_CTRL_GET_TIMEOUT);
 		if (ret < 0)
 			return ret;
 	}
diff -druNp --no-dereference linux-libre-5.6-gnu/drivers/media/usb/usbtv/usbtv-video.c linux-libre-5.6.3-gnu/drivers/media/usb/usbtv/usbtv-video.c
--- linux-libre-5.6-gnu/drivers/media/usb/usbtv/usbtv-video.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/drivers/media/usb/usbtv/usbtv-video.c	2020-04-08 03:11:10.000000000 -0400
@@ -800,7 +800,8 @@ static int usbtv_s_ctrl(struct v4l2_ctrl
 		ret = usb_control_msg(usbtv->udev,
 			usb_rcvctrlpipe(usbtv->udev, 0), USBTV_CONTROL_REG,
 			USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
-			0, USBTV_BASE + 0x0244, (void *)data, 3, 0);
+			0, USBTV_BASE + 0x0244, (void *)data, 3,
+			USB_CTRL_GET_TIMEOUT);
 		if (ret < 0)
 			goto error;
 	}
@@ -851,7 +852,7 @@ static int usbtv_s_ctrl(struct v4l2_ctrl
 	ret = usb_control_msg(usbtv->udev, usb_sndctrlpipe(usbtv->udev, 0),
 			USBTV_CONTROL_REG,
 			USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
-			0, index, (void *)data, size, 0);
+			0, index, (void *)data, size, USB_CTRL_SET_TIMEOUT);
 
 error:
 	if (ret < 0)
diff -druNp --no-dereference linux-libre-5.6-gnu/drivers/media/v4l2-core/v4l2-device.c linux-libre-5.6.3-gnu/drivers/media/v4l2-core/v4l2-device.c
--- linux-libre-5.6-gnu/drivers/media/v4l2-core/v4l2-device.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/drivers/media/v4l2-core/v4l2-device.c	2020-04-08 03:11:10.000000000 -0400
@@ -179,6 +179,7 @@ static void v4l2_subdev_release(struct v
 
 	if (sd->internal_ops && sd->internal_ops->release)
 		sd->internal_ops->release(sd);
+	sd->devnode = NULL;
 	module_put(owner);
 }
 
diff -druNp --no-dereference linux-libre-5.6-gnu/drivers/misc/cardreader/rts5227.c linux-libre-5.6.3-gnu/drivers/misc/cardreader/rts5227.c
--- linux-libre-5.6-gnu/drivers/misc/cardreader/rts5227.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/drivers/misc/cardreader/rts5227.c	2020-04-08 03:11:10.000000000 -0400
@@ -394,6 +394,7 @@ static const struct pcr_ops rts522a_pcr_
 void rts522a_init_params(struct rtsx_pcr *pcr)
 {
 	rts5227_init_params(pcr);
+	pcr->ops = &rts522a_pcr_ops;
 	pcr->tx_initial_phase = SET_CLOCK_PHASE(20, 20, 11);
 	pcr->reg_pm_ctrl3 = RTS522A_PM_CTRL3;
 
diff -druNp --no-dereference linux-libre-5.6-gnu/drivers/misc/mei/hw-me-regs.h linux-libre-5.6.3-gnu/drivers/misc/mei/hw-me-regs.h
--- linux-libre-5.6-gnu/drivers/misc/mei/hw-me-regs.h	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/drivers/misc/mei/hw-me-regs.h	2020-04-08 03:11:10.000000000 -0400
@@ -87,6 +87,8 @@
 #define MEI_DEV_ID_CMP_H      0x06e0  /* Comet Lake H */
 #define MEI_DEV_ID_CMP_H_3    0x06e4  /* Comet Lake H 3 (iTouch) */
 
+#define MEI_DEV_ID_CDF        0x18D3  /* Cedar Fork */
+
 #define MEI_DEV_ID_ICP_LP     0x34E0  /* Ice Lake Point LP */
 
 #define MEI_DEV_ID_JSP_N      0x4DE0  /* Jasper Lake Point N */
diff -druNp --no-dereference linux-libre-5.6-gnu/drivers/misc/mei/pci-me.c linux-libre-5.6.3-gnu/drivers/misc/mei/pci-me.c
--- linux-libre-5.6-gnu/drivers/misc/mei/pci-me.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/drivers/misc/mei/pci-me.c	2020-04-08 03:11:10.000000000 -0400
@@ -111,6 +111,8 @@ static const struct pci_device_id mei_me
 	{MEI_PCI_DEVICE(MEI_DEV_ID_MCC, MEI_ME_PCH15_CFG)},
 	{MEI_PCI_DEVICE(MEI_DEV_ID_MCC_4, MEI_ME_PCH8_CFG)},
 
+	{MEI_PCI_DEVICE(MEI_DEV_ID_CDF, MEI_ME_PCH8_CFG)},
+
 	/* required last entry */
 	{0, }
 };
diff -druNp --no-dereference linux-libre-5.6-gnu/drivers/misc/pci_endpoint_test.c linux-libre-5.6.3-gnu/drivers/misc/pci_endpoint_test.c
--- linux-libre-5.6-gnu/drivers/misc/pci_endpoint_test.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/drivers/misc/pci_endpoint_test.c	2020-04-08 03:11:10.000000000 -0400
@@ -98,6 +98,7 @@ struct pci_endpoint_test {
 	struct completion irq_raised;
 	int		last_irq;
 	int		num_irqs;
+	int		irq_type;
 	/* mutex to protect the ioctls */
 	struct mutex	mutex;
 	struct miscdevice miscdev;
@@ -157,6 +158,7 @@ static void pci_endpoint_test_free_irq_v
 	struct pci_dev *pdev = test->pdev;
 
 	pci_free_irq_vectors(pdev);
+	test->irq_type = IRQ_TYPE_UNDEFINED;
 }
 
 static bool pci_endpoint_test_alloc_irq_vectors(struct pci_endpoint_test *test,
@@ -191,6 +193,8 @@ static bool pci_endpoint_test_alloc_irq_
 		irq = 0;
 		res = false;
 	}
+
+	test->irq_type = type;
 	test->num_irqs = irq;
 
 	return res;
@@ -330,6 +334,7 @@ static bool pci_endpoint_test_copy(struc
 	dma_addr_t orig_dst_phys_addr;
 	size_t offset;
 	size_t alignment = test->alignment;
+	int irq_type = test->irq_type;
 	u32 src_crc32;
 	u32 dst_crc32;
 
@@ -426,6 +431,7 @@ static bool pci_endpoint_test_write(stru
 	dma_addr_t orig_phys_addr;
 	size_t offset;
 	size_t alignment = test->alignment;
+	int irq_type = test->irq_type;
 	u32 crc32;
 
 	if (size > SIZE_MAX - alignment)
@@ -494,6 +500,7 @@ static bool pci_endpoint_test_read(struc
 	dma_addr_t orig_phys_addr;
 	size_t offset;
 	size_t alignment = test->alignment;
+	int irq_type = test->irq_type;
 	u32 crc32;
 
 	if (size > SIZE_MAX - alignment)
@@ -555,7 +562,7 @@ static bool pci_endpoint_test_set_irq(st
 		return false;
 	}
 
-	if (irq_type == req_irq_type)
+	if (test->irq_type == req_irq_type)
 		return true;
 
 	pci_endpoint_test_release_irq(test);
@@ -567,12 +574,10 @@ static bool pci_endpoint_test_set_irq(st
 	if (!pci_endpoint_test_request_irq(test))
 		goto err;
 
-	irq_type = req_irq_type;
 	return true;
 
 err:
 	pci_endpoint_test_free_irq_vectors(test);
-	irq_type = IRQ_TYPE_UNDEFINED;
 	return false;
 }
 
@@ -633,7 +638,7 @@ static int pci_endpoint_test_probe(struc
 {
 	int err;
 	int id;
-	char name[20];
+	char name[24];
 	enum pci_barno bar;
 	void __iomem *base;
 	struct device *dev = &pdev->dev;
@@ -652,6 +657,7 @@ static int pci_endpoint_test_probe(struc
 	test->test_reg_bar = 0;
 	test->alignment = 0;
 	test->pdev = pdev;
+	test->irq_type = IRQ_TYPE_UNDEFINED;
 
 	if (no_msi)
 		irq_type = IRQ_TYPE_LEGACY;
diff -druNp --no-dereference linux-libre-5.6-gnu/drivers/net/dsa/microchip/Kconfig linux-libre-5.6.3-gnu/drivers/net/dsa/microchip/Kconfig
--- linux-libre-5.6-gnu/drivers/net/dsa/microchip/Kconfig	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/drivers/net/dsa/microchip/Kconfig	2020-04-08 03:11:10.000000000 -0400
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0-only
 config NET_DSA_MICROCHIP_KSZ_COMMON
+	select NET_DSA_TAG_KSZ
 	tristate
 
 menuconfig NET_DSA_MICROCHIP_KSZ9477
diff -druNp --no-dereference linux-libre-5.6-gnu/drivers/net/ethernet/cadence/macb_main.c linux-libre-5.6.3-gnu/drivers/net/ethernet/cadence/macb_main.c
--- linux-libre-5.6-gnu/drivers/net/ethernet/cadence/macb_main.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/drivers/net/ethernet/cadence/macb_main.c	2020-04-08 03:11:10.000000000 -0400
@@ -724,6 +724,9 @@ static int macb_mdiobus_register(struct
 {
 	struct device_node *child, *np = bp->pdev->dev.of_node;
 
+	if (of_phy_is_fixed_link(np))
+		return mdiobus_register(bp->mii_bus);
+
 	/* Only create the PHY from the device tree if at least one PHY is
 	 * described. Otherwise scan the entire MDIO bus. We do this to support
 	 * old device tree that did not follow the best practices and did not
diff -druNp --no-dereference linux-libre-5.6-gnu/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c linux-libre-5.6.3-gnu/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
--- linux-libre-5.6-gnu/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c	2020-03-29 20:52:30.000000000 -0400
+++ linux-libre-5.6.3-gnu/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c	2020-04-08 04:41:25.000000000 -0400
@@ -1938,6 +1938,8 @@ static uint brcmf_sdio_readframes(struct
 			if (brcmf_sdio_hdparse(bus, bus->rxhdr, &rd_new,
 					       BRCMF_SDIO_FT_NORMAL)) {
 				rd->len = 0;
+				brcmf_sdio_rxfail(bus, true, true);
+				sdio_release_host(bus->sdiodev->func1);
 				brcmu_pkt_buf_free_skb(pkt);
 				continue;
 			}
diff -druNp --no-dereference linux-libre-5.6-gnu/drivers/nvmem/core.c linux-libre-5.6.3-gnu/drivers/nvmem/core.c
--- linux-libre-5.6-gnu/drivers/nvmem/core.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/drivers/nvmem/core.c	2020-04-08 03:11:10.000000000 -0400
@@ -72,6 +72,7 @@ static void nvmem_release(struct device
 	struct nvmem_device *nvmem = to_nvmem_device(dev);
 
 	ida_simple_remove(&nvmem_ida, nvmem->id);
+	gpiod_put(nvmem->wp_gpio);
 	kfree(nvmem);
 }
 
diff -druNp --no-dereference linux-libre-5.6-gnu/drivers/nvmem/nvmem-sysfs.c linux-libre-5.6.3-gnu/drivers/nvmem/nvmem-sysfs.c
--- linux-libre-5.6-gnu/drivers/nvmem/nvmem-sysfs.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/drivers/nvmem/nvmem-sysfs.c	2020-04-08 03:11:10.000000000 -0400
@@ -56,6 +56,9 @@ static ssize_t bin_attr_nvmem_read(struc
 
 	count = round_down(count, nvmem->word_size);
 
+	if (!nvmem->reg_read)
+		return -EPERM;
+
 	rc = nvmem->reg_read(nvmem->priv, pos, buf, count);
 
 	if (rc)
@@ -90,6 +93,9 @@ static ssize_t bin_attr_nvmem_write(stru
 
 	count = round_down(count, nvmem->word_size);
 
+	if (!nvmem->reg_write)
+		return -EPERM;
+
 	rc = nvmem->reg_write(nvmem->priv, pos, buf, count);
 
 	if (rc)
diff -druNp --no-dereference linux-libre-5.6-gnu/drivers/nvmem/sprd-efuse.c linux-libre-5.6.3-gnu/drivers/nvmem/sprd-efuse.c
--- linux-libre-5.6-gnu/drivers/nvmem/sprd-efuse.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/drivers/nvmem/sprd-efuse.c	2020-04-08 03:11:10.000000000 -0400
@@ -239,7 +239,7 @@ static int sprd_efuse_raw_prog(struct sp
 		ret = -EBUSY;
 	} else {
 		sprd_efuse_set_prog_lock(efuse, lock);
-		writel(*data, efuse->base + SPRD_EFUSE_MEM(blk));
+		writel(0, efuse->base + SPRD_EFUSE_MEM(blk));
 		sprd_efuse_set_prog_lock(efuse, false);
 	}
 
diff -druNp --no-dereference linux-libre-5.6-gnu/drivers/pci/pci-sysfs.c linux-libre-5.6.3-gnu/drivers/pci/pci-sysfs.c
--- linux-libre-5.6-gnu/drivers/pci/pci-sysfs.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/drivers/pci/pci-sysfs.c	2020-04-08 03:11:10.000000000 -0400
@@ -464,7 +464,8 @@ static ssize_t dev_rescan_store(struct d
 	}
 	return count;
 }
-static DEVICE_ATTR_WO(dev_rescan);
+static struct device_attribute dev_attr_dev_rescan = __ATTR(rescan, 0200, NULL,
+							    dev_rescan_store);
 
 static ssize_t remove_store(struct device *dev, struct device_attribute *attr,
 			    const char *buf, size_t count)
@@ -501,7 +502,8 @@ static ssize_t bus_rescan_store(struct d
 	}
 	return count;
 }
-static DEVICE_ATTR_WO(bus_rescan);
+static struct device_attribute dev_attr_bus_rescan = __ATTR(rescan, 0200, NULL,
+							    bus_rescan_store);
 
 #if defined(CONFIG_PM) && defined(CONFIG_ACPI)
 static ssize_t d3cold_allowed_store(struct device *dev,
diff -druNp --no-dereference linux-libre-5.6-gnu/drivers/platform/x86/pmc_atom.c linux-libre-5.6.3-gnu/drivers/platform/x86/pmc_atom.c
--- linux-libre-5.6-gnu/drivers/platform/x86/pmc_atom.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/drivers/platform/x86/pmc_atom.c	2020-04-08 03:11:10.000000000 -0400
@@ -385,6 +385,14 @@ static const struct dmi_system_id critcl
 	},
 	{
 		/* pmc_plt_clk* - are used for ethernet controllers */
+		.ident = "Lex 2I385SW",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Lex BayTrail"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "2I385SW"),
+		},
+	},
+	{
+		/* pmc_plt_clk* - are used for ethernet controllers */
 		.ident = "Beckhoff CB3163",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Beckhoff Automation"),
diff -druNp --no-dereference linux-libre-5.6-gnu/drivers/power/supply/axp288_charger.c linux-libre-5.6.3-gnu/drivers/power/supply/axp288_charger.c
--- linux-libre-5.6-gnu/drivers/power/supply/axp288_charger.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/drivers/power/supply/axp288_charger.c	2020-04-08 03:11:10.000000000 -0400
@@ -21,6 +21,7 @@
 #include <linux/property.h>
 #include <linux/mfd/axp20x.h>
 #include <linux/extcon.h>
+#include <linux/dmi.h>
 
 #define PS_STAT_VBUS_TRIGGER		BIT(0)
 #define PS_STAT_BAT_CHRG_DIR		BIT(2)
@@ -545,6 +546,49 @@ out:
 	return IRQ_HANDLED;
 }
 
+/*
+ * The HP Pavilion x2 10 series comes in a number of variants:
+ * Bay Trail SoC    + AXP288 PMIC, DMI_BOARD_NAME: "815D"
+ * Cherry Trail SoC + AXP288 PMIC, DMI_BOARD_NAME: "813E"
+ * Cherry Trail SoC + TI PMIC,     DMI_BOARD_NAME: "827C" or "82F4"
+ *
+ * The variants with the AXP288 PMIC are all kinds of special:
+ *
+ * 1. All variants use a Type-C connector which the AXP288 does not support, so
+ * when using a Type-C charger it is not recognized. Unlike most AXP288 devices,
+ * this model actually has mostly working ACPI AC / Battery code, the ACPI code
+ * "solves" this by simply setting the input_current_limit to 3A.
+ * There are still some issues with the ACPI code, so we use this native driver,
+ * and to solve the charging not working (500mA is not enough) issue we hardcode
+ * the 3A input_current_limit like the ACPI code does.
+ *
+ * 2. If no charger is connected the machine boots with the vbus-path disabled.
+ * Normally this is done when a 5V boost converter is active to avoid the PMIC
+ * trying to charge from the 5V boost converter's output. This is done when
+ * an OTG host cable is inserted and the ID pin on the micro-B receptacle is
+ * pulled low and the ID pin has an ACPI event handler associated with it
+ * which re-enables the vbus-path when the ID pin is pulled high when the
+ * OTG host cable is removed. The Type-C connector has no ID pin, there is
+ * no ID pin handler and there appears to be no 5V boost converter, so we
+ * end up not charging because the vbus-path is disabled, until we unplug
+ * the charger which automatically clears the vbus-path disable bit and then
+ * on the second plug-in of the adapter we start charging. To solve the not
+ * charging on first charger plugin we unconditionally enable the vbus-path at
+ * probe on this model, which is safe since there is no 5V boost converter.
+ */
+static const struct dmi_system_id axp288_hp_x2_dmi_ids[] = {
+	{
+		/*
+		 * Bay Trail model has "Hewlett-Packard" as sys_vendor, Cherry
+		 * Trail model has "HP", so we only match on product_name.
+		 */
+		.matches = {
+			DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion x2 Detachable"),
+		},
+	},
+	{} /* Terminating entry */
+};
+
 static void axp288_charger_extcon_evt_worker(struct work_struct *work)
 {
 	struct axp288_chrg_info *info =
@@ -568,7 +612,11 @@ static void axp288_charger_extcon_evt_wo
 	}
 
 	/* Determine cable/charger type */
-	if (extcon_get_state(edev, EXTCON_CHG_USB_SDP) > 0) {
+	if (dmi_check_system(axp288_hp_x2_dmi_ids)) {
+		/* See comment above axp288_hp_x2_dmi_ids declaration */
+		dev_dbg(&info->pdev->dev, "HP X2 with Type-C, setting inlmt to 3A\n");
+		current_limit = 3000000;
+	} else if (extcon_get_state(edev, EXTCON_CHG_USB_SDP) > 0) {
 		dev_dbg(&info->pdev->dev, "USB SDP charger is connected\n");
 		current_limit = 500000;
 	} else if (extcon_get_state(edev, EXTCON_CHG_USB_CDP) > 0) {
@@ -685,6 +733,13 @@ static int charger_init_hw_regs(struct a
 		return ret;
 	}
 
+	if (dmi_check_system(axp288_hp_x2_dmi_ids)) {
+		/* See comment above axp288_hp_x2_dmi_ids declaration */
+		ret = axp288_charger_vbus_path_select(info, true);
+		if (ret < 0)
+			return ret;
+	}
+
 	/* Read current charge voltage and current limit */
 	ret = regmap_read(info->regmap, AXP20X_CHRG_CTRL1, &val);
 	if (ret < 0) {
diff -druNp --no-dereference linux-libre-5.6-gnu/drivers/soc/mediatek/mtk-cmdq-helper.c linux-libre-5.6.3-gnu/drivers/soc/mediatek/mtk-cmdq-helper.c
--- linux-libre-5.6-gnu/drivers/soc/mediatek/mtk-cmdq-helper.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/drivers/soc/mediatek/mtk-cmdq-helper.c	2020-04-08 03:11:10.000000000 -0400
@@ -78,6 +78,7 @@ struct cmdq_client *cmdq_mbox_create(str
 	client->pkt_cnt = 0;
 	client->client.dev = dev;
 	client->client.tx_block = false;
+	client->client.knows_txdone = true;
 	client->chan = mbox_request_channel(&client->client, index);
 
 	if (IS_ERR(client->chan)) {
diff -druNp --no-dereference linux-libre-5.6-gnu/drivers/staging/kpc2000/kpc2000/core.c linux-libre-5.6.3-gnu/drivers/staging/kpc2000/kpc2000/core.c
--- linux-libre-5.6-gnu/drivers/staging/kpc2000/kpc2000/core.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/drivers/staging/kpc2000/kpc2000/core.c	2020-04-08 03:11:10.000000000 -0400
@@ -110,10 +110,10 @@ static ssize_t cpld_reconfigure(struct d
 				const char *buf, size_t count)
 {
 	struct kp2000_device *pcard = dev_get_drvdata(dev);
-	long wr_val;
+	unsigned long wr_val;
 	int rv;
 
-	rv = kstrtol(buf, 0, &wr_val);
+	rv = kstrtoul(buf, 0, &wr_val);
 	if (rv < 0)
 		return rv;
 	if (wr_val > 7)
diff -druNp --no-dereference linux-libre-5.6-gnu/drivers/staging/rtl8188eu/os_dep/usb_intf.c linux-libre-5.6.3-gnu/drivers/staging/rtl8188eu/os_dep/usb_intf.c
--- linux-libre-5.6-gnu/drivers/staging/rtl8188eu/os_dep/usb_intf.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/drivers/staging/rtl8188eu/os_dep/usb_intf.c	2020-04-08 03:11:10.000000000 -0400
@@ -32,6 +32,7 @@ static const struct usb_device_id rtw_us
 	/****** 8188EUS ********/
 	{USB_DEVICE(0x056e, 0x4008)}, /* Elecom WDC-150SU2M */
 	{USB_DEVICE(0x07b8, 0x8179)}, /* Abocom - Abocom */
+	{USB_DEVICE(0x0B05, 0x18F0)}, /* ASUS USB-N10 Nano B1 */
 	{USB_DEVICE(0x2001, 0x330F)}, /* DLink DWA-125 REV D1 */
 	{USB_DEVICE(0x2001, 0x3310)}, /* Dlink DWA-123 REV D1 */
 	{USB_DEVICE(0x2001, 0x3311)}, /* DLink GO-USB-N150 REV B1 */
diff -druNp --no-dereference linux-libre-5.6-gnu/drivers/staging/wfx/bus_sdio.c linux-libre-5.6.3-gnu/drivers/staging/wfx/bus_sdio.c
--- linux-libre-5.6-gnu/drivers/staging/wfx/bus_sdio.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/drivers/staging/wfx/bus_sdio.c	2020-04-08 03:11:10.000000000 -0400
@@ -200,25 +200,23 @@ static int wfx_sdio_probe(struct sdio_fu
 	if (ret)
 		goto err0;
 
-	ret = wfx_sdio_irq_subscribe(bus);
-	if (ret)
-		goto err1;
-
 	bus->core = wfx_init_common(&func->dev, &wfx_sdio_pdata,
 				    &wfx_sdio_hwbus_ops, bus);
 	if (!bus->core) {
 		ret = -EIO;
-		goto err2;
+		goto err1;
 	}
 
+	ret = wfx_sdio_irq_subscribe(bus);
+	if (ret)
+		goto err1;
+
 	ret = wfx_probe(bus->core);
 	if (ret)
-		goto err3;
+		goto err2;
 
 	return 0;
 
-err3:
-	wfx_free_common(bus->core);
 err2:
 	wfx_sdio_irq_unsubscribe(bus);
 err1:
@@ -234,7 +232,6 @@ static void wfx_sdio_remove(struct sdio_
 	struct wfx_sdio_priv *bus = sdio_get_drvdata(func);
 
 	wfx_release(bus->core);
-	wfx_free_common(bus->core);
 	wfx_sdio_irq_unsubscribe(bus);
 	sdio_claim_host(func);
 	sdio_disable_func(func);
diff -druNp --no-dereference linux-libre-5.6-gnu/drivers/staging/wfx/bus_spi.c linux-libre-5.6.3-gnu/drivers/staging/wfx/bus_spi.c
--- linux-libre-5.6-gnu/drivers/staging/wfx/bus_spi.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/drivers/staging/wfx/bus_spi.c	2020-04-08 03:11:10.000000000 -0400
@@ -27,6 +27,8 @@ MODULE_PARM_DESC(gpio_reset, "gpio numbe
 #define SET_WRITE 0x7FFF        /* usage: and operation */
 #define SET_READ 0x8000         /* usage: or operation */
 
+#define WFX_RESET_INVERTED 1
+
 static const struct wfx_platform_data wfx_spi_pdata = {
 	.file_fw = "wfm_wf200",
 	.file_pds = "wf200.pds",
@@ -154,6 +156,11 @@ static void wfx_spi_request_rx(struct wo
 	wfx_bh_request_rx(bus->core);
 }
 
+static void wfx_flush_irq_work(void *w)
+{
+	flush_work(w);
+}
+
 static size_t wfx_spi_align_size(void *priv, size_t size)
 {
 	// Most of SPI controllers avoid DMA if buffer size is not 32bit aligned
@@ -201,28 +208,31 @@ static int wfx_spi_probe(struct spi_devi
 	if (!bus->gpio_reset) {
 		dev_warn(&func->dev, "try to load firmware anyway\n");
 	} else {
-		gpiod_set_value(bus->gpio_reset, 0);
-		udelay(100);
+		if (spi_get_device_id(func)->driver_data & WFX_RESET_INVERTED)
+			gpiod_toggle_active_low(bus->gpio_reset);
 		gpiod_set_value(bus->gpio_reset, 1);
+		udelay(100);
+		gpiod_set_value(bus->gpio_reset, 0);
 		udelay(2000);
 	}
 
-	ret = devm_request_irq(&func->dev, func->irq, wfx_spi_irq_handler,
-			       IRQF_TRIGGER_RISING, "wfx", bus);
-	if (ret)
-		return ret;
-
 	INIT_WORK(&bus->request_rx, wfx_spi_request_rx);
 	bus->core = wfx_init_common(&func->dev, &wfx_spi_pdata,
 				    &wfx_spi_hwbus_ops, bus);
 	if (!bus->core)
 		return -EIO;
 
-	ret = wfx_probe(bus->core);
+	ret = devm_add_action_or_reset(&func->dev, wfx_flush_irq_work,
+				       &bus->request_rx);
 	if (ret)
-		wfx_free_common(bus->core);
+		return ret;
 
-	return ret;
+	ret = devm_request_irq(&func->dev, func->irq, wfx_spi_irq_handler,
+			       IRQF_TRIGGER_RISING, "wfx", bus);
+	if (ret)
+		return ret;
+
+	return wfx_probe(bus->core);
 }
 
 static int wfx_spi_remove(struct spi_device *func)
@@ -230,11 +240,6 @@ static int wfx_spi_remove(struct spi_dev
 	struct wfx_spi_priv *bus = spi_get_drvdata(func);
 
 	wfx_release(bus->core);
-	wfx_free_common(bus->core);
-	// A few IRQ will be sent during device release. Hopefully, no IRQ
-	// should happen after wdev/wvif are released.
-	devm_free_irq(&func->dev, func->irq, bus);
-	flush_work(&bus->request_rx);
 	return 0;
 }
 
@@ -244,14 +249,16 @@ static int wfx_spi_remove(struct spi_dev
  * stripped.
  */
 static const struct spi_device_id wfx_spi_id[] = {
-	{ "wfx-spi", 0 },
+	{ "wfx-spi", WFX_RESET_INVERTED },
+	{ "wf200", 0 },
 	{ },
 };
 MODULE_DEVICE_TABLE(spi, wfx_spi_id);
 
 #ifdef CONFIG_OF
 static const struct of_device_id wfx_spi_of_match[] = {
-	{ .compatible = "silabs,wfx-spi" },
+	{ .compatible = "silabs,wfx-spi", .data = (void *)WFX_RESET_INVERTED },
+	{ .compatible = "silabs,wf200" },
 	{ },
 };
 MODULE_DEVICE_TABLE(of, wfx_spi_of_match);
diff -druNp --no-dereference linux-libre-5.6-gnu/drivers/staging/wfx/Documentation/devicetree/bindings/net/wireless/siliabs,wfx.txt linux-libre-5.6.3-gnu/drivers/staging/wfx/Documentation/devicetree/bindings/net/wireless/siliabs,wfx.txt
--- linux-libre-5.6-gnu/drivers/staging/wfx/Documentation/devicetree/bindings/net/wireless/siliabs,wfx.txt	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/drivers/staging/wfx/Documentation/devicetree/bindings/net/wireless/siliabs,wfx.txt	2020-04-08 03:11:10.000000000 -0400
@@ -6,7 +6,7 @@ SPI
 You have to declare the WFxxx chip in your device tree.
 
 Required properties:
- - compatible: Should be "silabs,wfx-spi"
+ - compatible: Should be "silabs,wf200"
  - reg: Chip select address of device
  - spi-max-frequency: Maximum SPI clocking speed of device in Hz
  - interrupts-extended: Should contain interrupt line (interrupt-parent +
@@ -15,6 +15,7 @@ Required properties:
 Optional properties:
  - reset-gpios: phandle of gpio that will be used to reset chip during probe.
    Without this property, you may encounter issues with warm boot.
+   (Legacy: when compatible == "silabs,wfx-spi", the gpio is inverted.)
 
 Please consult Documentation/devicetree/bindings/spi/spi-bus.txt for optional
 SPI connection related properties,
@@ -23,12 +24,12 @@ Example:
 
 &spi1 {
 	wfx {
-		compatible = "silabs,wfx-spi";
+		compatible = "silabs,wf200";
 		pinctrl-names = "default";
 		pinctrl-0 = <&wfx_irq &wfx_gpios>;
 		interrupts-extended = <&gpio 16 IRQ_TYPE_EDGE_RISING>;
 		wakeup-gpios = <&gpio 12 GPIO_ACTIVE_HIGH>;
-		reset-gpios = <&gpio 13 GPIO_ACTIVE_HIGH>;
+		reset-gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
 		reg = <0>;
 		spi-max-frequency = <42000000>;
 	};
diff -druNp --no-dereference linux-libre-5.6-gnu/drivers/staging/wfx/main.c linux-libre-5.6.3-gnu/drivers/staging/wfx/main.c
--- linux-libre-5.6-gnu/drivers/staging/wfx/main.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/drivers/staging/wfx/main.c	2020-04-08 03:11:10.000000000 -0400
@@ -262,6 +262,16 @@ static int wfx_send_pdata_pds(struct wfx
 	return ret;
 }
 
+static void wfx_free_common(void *data)
+{
+	struct wfx_dev *wdev = data;
+
+	mutex_destroy(&wdev->rx_stats_lock);
+	mutex_destroy(&wdev->conf_mutex);
+	wfx_tx_queues_deinit(wdev);
+	ieee80211_free_hw(wdev->hw);
+}
+
 struct wfx_dev *wfx_init_common(struct device *dev,
 				const struct wfx_platform_data *pdata,
 				const struct hwbus_ops *hwbus_ops,
@@ -332,15 +342,10 @@ struct wfx_dev *wfx_init_common(struct d
 	wfx_init_hif_cmd(&wdev->hif_cmd);
 	wfx_tx_queues_init(wdev);
 
-	return wdev;
-}
+	if (devm_add_action_or_reset(dev, wfx_free_common, wdev))
+		return NULL;
 
-void wfx_free_common(struct wfx_dev *wdev)
-{
-	mutex_destroy(&wdev->rx_stats_lock);
-	mutex_destroy(&wdev->conf_mutex);
-	wfx_tx_queues_deinit(wdev);
-	ieee80211_free_hw(wdev->hw);
+	return wdev;
 }
 
 int wfx_probe(struct wfx_dev *wdev)
diff -druNp --no-dereference linux-libre-5.6-gnu/drivers/staging/wfx/main.h linux-libre-5.6.3-gnu/drivers/staging/wfx/main.h
--- linux-libre-5.6-gnu/drivers/staging/wfx/main.h	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/drivers/staging/wfx/main.h	2020-04-08 03:11:10.000000000 -0400
@@ -34,7 +34,6 @@ struct wfx_dev *wfx_init_common(struct d
 				const struct wfx_platform_data *pdata,
 				const struct hwbus_ops *hwbus_ops,
 				void *hwbus_priv);
-void wfx_free_common(struct wfx_dev *wdev);
 
 int wfx_probe(struct wfx_dev *wdev);
 void wfx_release(struct wfx_dev *wdev);
diff -druNp --no-dereference linux-libre-5.6-gnu/drivers/staging/wfx/queue.c linux-libre-5.6.3-gnu/drivers/staging/wfx/queue.c
--- linux-libre-5.6-gnu/drivers/staging/wfx/queue.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/drivers/staging/wfx/queue.c	2020-04-08 03:11:10.000000000 -0400
@@ -130,12 +130,12 @@ static void wfx_tx_queue_clear(struct wf
 	spin_lock_bh(&queue->queue.lock);
 	while ((item = __skb_dequeue(&queue->queue)) != NULL)
 		skb_queue_head(gc_list, item);
-	spin_lock_bh(&stats->pending.lock);
+	spin_lock_nested(&stats->pending.lock, 1);
 	for (i = 0; i < ARRAY_SIZE(stats->link_map_cache); ++i) {
 		stats->link_map_cache[i] -= queue->link_map_cache[i];
 		queue->link_map_cache[i] = 0;
 	}
-	spin_unlock_bh(&stats->pending.lock);
+	spin_unlock(&stats->pending.lock);
 	spin_unlock_bh(&queue->queue.lock);
 }
 
@@ -207,9 +207,9 @@ void wfx_tx_queue_put(struct wfx_dev *wd
 
 	++queue->link_map_cache[tx_priv->link_id];
 
-	spin_lock_bh(&stats->pending.lock);
+	spin_lock_nested(&stats->pending.lock, 1);
 	++stats->link_map_cache[tx_priv->link_id];
-	spin_unlock_bh(&stats->pending.lock);
+	spin_unlock(&stats->pending.lock);
 	spin_unlock_bh(&queue->queue.lock);
 }
 
@@ -237,11 +237,11 @@ static struct sk_buff *wfx_tx_queue_get(
 		__skb_unlink(skb, &queue->queue);
 		--queue->link_map_cache[tx_priv->link_id];
 
-		spin_lock_bh(&stats->pending.lock);
+		spin_lock_nested(&stats->pending.lock, 1);
 		__skb_queue_tail(&stats->pending, skb);
 		if (!--stats->link_map_cache[tx_priv->link_id])
 			wakeup_stats = true;
-		spin_unlock_bh(&stats->pending.lock);
+		spin_unlock(&stats->pending.lock);
 	}
 	spin_unlock_bh(&queue->queue.lock);
 	if (wakeup_stats)
@@ -259,10 +259,10 @@ int wfx_pending_requeue(struct wfx_dev *
 	spin_lock_bh(&queue->queue.lock);
 	++queue->link_map_cache[tx_priv->link_id];
 
-	spin_lock_bh(&stats->pending.lock);
+	spin_lock_nested(&stats->pending.lock, 1);
 	++stats->link_map_cache[tx_priv->link_id];
 	__skb_unlink(skb, &stats->pending);
-	spin_unlock_bh(&stats->pending.lock);
+	spin_unlock(&stats->pending.lock);
 	__skb_queue_tail(&queue->queue, skb);
 	spin_unlock_bh(&queue->queue.lock);
 	return 0;
diff -druNp --no-dereference linux-libre-5.6-gnu/drivers/staging/wlan-ng/hfa384x_usb.c linux-libre-5.6.3-gnu/drivers/staging/wlan-ng/hfa384x_usb.c
--- linux-libre-5.6-gnu/drivers/staging/wlan-ng/hfa384x_usb.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/drivers/staging/wlan-ng/hfa384x_usb.c	2020-04-08 03:11:10.000000000 -0400
@@ -3372,6 +3372,8 @@ static void hfa384x_int_rxmonitor(struct
 	     WLAN_HDR_A4_LEN + WLAN_DATA_MAXLEN + WLAN_CRC_LEN)) {
 		pr_debug("overlen frm: len=%zd\n",
 			 skblen - sizeof(struct p80211_caphdr));
+
+		return;
 	}
 
 	skb = dev_alloc_skb(skblen);
diff -druNp --no-dereference linux-libre-5.6-gnu/drivers/staging/wlan-ng/prism2usb.c linux-libre-5.6.3-gnu/drivers/staging/wlan-ng/prism2usb.c
--- linux-libre-5.6-gnu/drivers/staging/wlan-ng/prism2usb.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/drivers/staging/wlan-ng/prism2usb.c	2020-04-08 03:11:10.000000000 -0400
@@ -180,6 +180,7 @@ static void prism2sta_disconnect_usb(str
 
 		cancel_work_sync(&hw->link_bh);
 		cancel_work_sync(&hw->commsqual_bh);
+		cancel_work_sync(&hw->usb_work);
 
 		/* Now we complete any outstanding commands
 		 * and tell everyone who is waiting for their
diff -druNp --no-dereference linux-libre-5.6-gnu/drivers/tty/serial/sprd_serial.c linux-libre-5.6.3-gnu/drivers/tty/serial/sprd_serial.c
--- linux-libre-5.6-gnu/drivers/tty/serial/sprd_serial.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/drivers/tty/serial/sprd_serial.c	2020-04-08 03:11:10.000000000 -0400
@@ -1132,14 +1132,13 @@ static int sprd_remove(struct platform_d
 	if (sup) {
 		uart_remove_one_port(&sprd_uart_driver, &sup->port);
 		sprd_port[sup->port.line] = NULL;
+		sprd_rx_free_buf(sup);
 		sprd_ports_num--;
 	}
 
 	if (!sprd_ports_num)
 		uart_unregister_driver(&sprd_uart_driver);
 
-	sprd_rx_free_buf(sup);
-
 	return 0;
 }
 
diff -druNp --no-dereference linux-libre-5.6-gnu/drivers/tty/vt/selection.c linux-libre-5.6.3-gnu/drivers/tty/vt/selection.c
--- linux-libre-5.6-gnu/drivers/tty/vt/selection.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/drivers/tty/vt/selection.c	2020-04-08 03:11:10.000000000 -0400
@@ -88,6 +88,11 @@ void clear_selection(void)
 }
 EXPORT_SYMBOL_GPL(clear_selection);
 
+bool vc_is_sel(struct vc_data *vc)
+{
+	return vc == sel_cons;
+}
+
 /*
  * User settable table: what characters are to be considered alphabetic?
  * 128 bits. Locked by the console lock.
diff -druNp --no-dereference linux-libre-5.6-gnu/drivers/tty/vt/vt.c linux-libre-5.6.3-gnu/drivers/tty/vt/vt.c
--- linux-libre-5.6-gnu/drivers/tty/vt/vt.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/drivers/tty/vt/vt.c	2020-04-08 03:11:10.000000000 -0400
@@ -890,8 +890,9 @@ static void hide_softcursor(struct vc_da
 
 static void hide_cursor(struct vc_data *vc)
 {
-	if (vc == sel_cons)
+	if (vc_is_sel(vc))
 		clear_selection();
+
 	vc->vc_sw->con_cursor(vc, CM_ERASE);
 	hide_softcursor(vc);
 }
@@ -901,7 +902,7 @@ static void set_cursor(struct vc_data *v
 	if (!con_is_fg(vc) || console_blanked || vc->vc_mode == KD_GRAPHICS)
 		return;
 	if (vc->vc_deccm) {
-		if (vc == sel_cons)
+		if (vc_is_sel(vc))
 			clear_selection();
 		add_softcursor(vc);
 		if ((vc->vc_cursor_type & 0x0f) != 1)
@@ -1074,6 +1075,17 @@ static void visual_deinit(struct vc_data
 	module_put(vc->vc_sw->owner);
 }
 
+static void vc_port_destruct(struct tty_port *port)
+{
+	struct vc_data *vc = container_of(port, struct vc_data, port);
+
+	kfree(vc);
+}
+
+static const struct tty_port_operations vc_port_ops = {
+	.destruct = vc_port_destruct,
+};
+
 int vc_allocate(unsigned int currcons)	/* return 0 on success */
 {
 	struct vt_notifier_param param;
@@ -1099,6 +1111,7 @@ int vc_allocate(unsigned int currcons)	/
 
 	vc_cons[currcons].d = vc;
 	tty_port_init(&vc->port);
+	vc->port.ops = &vc_port_ops;
 	INIT_WORK(&vc_cons[currcons].SAK_work, vc_SAK);
 
 	visual_init(vc, currcons, 1);
@@ -1207,7 +1220,7 @@ static int vc_do_resize(struct tty_struc
 		}
 	}
 
-	if (vc == sel_cons)
+	if (vc_is_sel(vc))
 		clear_selection();
 
 	old_rows = vc->vc_rows;
@@ -3253,6 +3266,7 @@ static int con_install(struct tty_driver
 
 	tty->driver_data = vc;
 	vc->port.tty = tty;
+	tty_port_get(&vc->port);
 
 	if (!tty->winsize.ws_row && !tty->winsize.ws_col) {
 		tty->winsize.ws_row = vc_cons[currcons].d->vc_rows;
@@ -3288,6 +3302,13 @@ static void con_shutdown(struct tty_stru
 	console_unlock();
 }
 
+static void con_cleanup(struct tty_struct *tty)
+{
+	struct vc_data *vc = tty->driver_data;
+
+	tty_port_put(&vc->port);
+}
+
 static int default_color           = 7; /* white */
 static int default_italic_color    = 2; // green (ASCII)
 static int default_underline_color = 3; // cyan (ASCII)
@@ -3413,7 +3434,8 @@ static const struct tty_operations con_o
 	.throttle = con_throttle,
 	.unthrottle = con_unthrottle,
 	.resize = vt_resize,
-	.shutdown = con_shutdown
+	.shutdown = con_shutdown,
+	.cleanup = con_cleanup,
 };
 
 static struct cdev vc0_cdev;
diff -druNp --no-dereference linux-libre-5.6-gnu/drivers/tty/vt/vt_ioctl.c linux-libre-5.6.3-gnu/drivers/tty/vt/vt_ioctl.c
--- linux-libre-5.6-gnu/drivers/tty/vt/vt_ioctl.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/drivers/tty/vt/vt_ioctl.c	2020-04-08 03:11:10.000000000 -0400
@@ -39,11 +39,32 @@
 #include <linux/kbd_diacr.h>
 #include <linux/selection.h>
 
-char vt_dont_switch;
-extern struct tty_driver *console_driver;
+bool vt_dont_switch;
 
-#define VT_IS_IN_USE(i)	(console_driver->ttys[i] && console_driver->ttys[i]->count)
-#define VT_BUSY(i)	(VT_IS_IN_USE(i) || i == fg_console || vc_cons[i].d == sel_cons)
+static inline bool vt_in_use(unsigned int i)
+{
+	const struct vc_data *vc = vc_cons[i].d;
+
+	/*
+	 * console_lock must be held to prevent the vc from being deallocated
+	 * while we're checking whether it's in-use.
+	 */
+	WARN_CONSOLE_UNLOCKED();
+
+	return vc && kref_read(&vc->port.kref) > 1;
+}
+
+static inline bool vt_busy(int i)
+{
+	if (vt_in_use(i))
+		return true;
+	if (i == fg_console)
+		return true;
+	if (vc_is_sel(vc_cons[i].d))
+		return true;
+
+	return false;
+}
 
 /*
  * Console (vt and kd) routines, as defined by USL SVR4 manual, and by
@@ -289,16 +310,14 @@ static int vt_disallocate(unsigned int v
 	int ret = 0;
 
 	console_lock();
-	if (VT_BUSY(vc_num))
+	if (vt_busy(vc_num))
 		ret = -EBUSY;
 	else if (vc_num)
 		vc = vc_deallocate(vc_num);
 	console_unlock();
 
-	if (vc && vc_num >= MIN_NR_CONSOLES) {
-		tty_port_destroy(&vc->port);
-		kfree(vc);
-	}
+	if (vc && vc_num >= MIN_NR_CONSOLES)
+		tty_port_put(&vc->port);
 
 	return ret;
 }
@@ -311,17 +330,15 @@ static void vt_disallocate_all(void)
 
 	console_lock();
 	for (i = 1; i < MAX_NR_CONSOLES; i++)
-		if (!VT_BUSY(i))
+		if (!vt_busy(i))
 			vc[i] = vc_deallocate(i);
 		else
 			vc[i] = NULL;
 	console_unlock();
 
 	for (i = 1; i < MAX_NR_CONSOLES; i++) {
-		if (vc[i] && i >= MIN_NR_CONSOLES) {
-			tty_port_destroy(&vc[i]->port);
-			kfree(vc[i]);
-		}
+		if (vc[i] && i >= MIN_NR_CONSOLES)
+			tty_port_put(&vc[i]->port);
 	}
 }
 
@@ -335,22 +352,13 @@ int vt_ioctl(struct tty_struct *tty,
 {
 	struct vc_data *vc = tty->driver_data;
 	struct console_font_op op;	/* used in multiple places here */
-	unsigned int console;
+	unsigned int console = vc->vc_num;
 	unsigned char ucval;
 	unsigned int uival;
 	void __user *up = (void __user *)arg;
 	int i, perm;
 	int ret = 0;
 
-	console = vc->vc_num;
-
-
-	if (!vc_cons_allocated(console)) { 	/* impossible? */
-		ret = -ENOIOCTLCMD;
-		goto out;
-	}
-
-
 	/*
 	 * To have permissions to do most of the vt ioctls, we either have
 	 * to be the owner of the tty, or have CAP_SYS_TTY_CONFIG.
@@ -641,15 +649,16 @@ int vt_ioctl(struct tty_struct *tty,
 		struct vt_stat __user *vtstat = up;
 		unsigned short state, mask;
 
-		/* Review: FIXME: Console lock ? */
 		if (put_user(fg_console + 1, &vtstat->v_active))
 			ret = -EFAULT;
 		else {
 			state = 1;	/* /dev/tty0 is always open */
+			console_lock(); /* required by vt_in_use() */
 			for (i = 0, mask = 2; i < MAX_NR_CONSOLES && mask;
 							++i, mask <<= 1)
-				if (VT_IS_IN_USE(i))
+				if (vt_in_use(i))
 					state |= mask;
+			console_unlock();
 			ret = put_user(state, &vtstat->v_state);
 		}
 		break;
@@ -659,10 +668,11 @@ int vt_ioctl(struct tty_struct *tty,
 	 * Returns the first available (non-opened) console.
 	 */
 	case VT_OPENQRY:
-		/* FIXME: locking ? - but then this is a stupid API */
+		console_lock(); /* required by vt_in_use() */
 		for (i = 0; i < MAX_NR_CONSOLES; ++i)
-			if (! VT_IS_IN_USE(i))
+			if (!vt_in_use(i))
 				break;
+		console_unlock();
 		uival = i < MAX_NR_CONSOLES ? (i+1) : -1;
 		goto setint;		 
 
@@ -1011,12 +1021,12 @@ int vt_ioctl(struct tty_struct *tty,
 	case VT_LOCKSWITCH:
 		if (!capable(CAP_SYS_TTY_CONFIG))
 			return -EPERM;
-		vt_dont_switch = 1;
+		vt_dont_switch = true;
 		break;
 	case VT_UNLOCKSWITCH:
 		if (!capable(CAP_SYS_TTY_CONFIG))
 			return -EPERM;
-		vt_dont_switch = 0;
+		vt_dont_switch = false;
 		break;
 	case VT_GETHIFONTMASK:
 		ret = put_user(vc->vc_hi_font_mask,
@@ -1180,14 +1190,9 @@ long vt_compat_ioctl(struct tty_struct *
 {
 	struct vc_data *vc = tty->driver_data;
 	struct console_font_op op;	/* used in multiple places here */
-	unsigned int console = vc->vc_num;
 	void __user *up = compat_ptr(arg);
 	int perm;
 
-
-	if (!vc_cons_allocated(console)) 	/* impossible? */
-		return -ENOIOCTLCMD;
-
 	/*
 	 * To have permissions to do most of the vt ioctls, we either have
 	 * to be the owner of the tty, or have CAP_SYS_TTY_CONFIG.
diff -druNp --no-dereference linux-libre-5.6-gnu/drivers/usb/class/cdc-acm.c linux-libre-5.6.3-gnu/drivers/usb/class/cdc-acm.c
--- linux-libre-5.6-gnu/drivers/usb/class/cdc-acm.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/drivers/usb/class/cdc-acm.c	2020-04-08 03:11:10.000000000 -0400
@@ -923,16 +923,16 @@ static int set_serial_info(struct tty_st
 
 	mutex_lock(&acm->port.mutex);
 
-	if ((ss->close_delay != old_close_delay) ||
-            (ss->closing_wait != old_closing_wait)) {
-		if (!capable(CAP_SYS_ADMIN))
+	if (!capable(CAP_SYS_ADMIN)) {
+		if ((ss->close_delay != old_close_delay) ||
+		    (ss->closing_wait != old_closing_wait))
 			retval = -EPERM;
-		else {
-			acm->port.close_delay  = close_delay;
-			acm->port.closing_wait = closing_wait;
-		}
-	} else
-		retval = -EOPNOTSUPP;
+		else
+			retval = -EOPNOTSUPP;
+	} else {
+		acm->port.close_delay  = close_delay;
+		acm->port.closing_wait = closing_wait;
+	}
 
 	mutex_unlock(&acm->port.mutex);
 	return retval;
diff -druNp --no-dereference linux-libre-5.6-gnu/drivers/usb/musb/musb_host.c linux-libre-5.6.3-gnu/drivers/usb/musb/musb_host.c
--- linux-libre-5.6-gnu/drivers/usb/musb/musb_host.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/drivers/usb/musb/musb_host.c	2020-04-08 03:11:10.000000000 -0400
@@ -1436,10 +1436,7 @@ done:
 	 * We need to map sg if the transfer_buffer is
 	 * NULL.
 	 */
-	if (!urb->transfer_buffer)
-		qh->use_sg = true;
-
-	if (qh->use_sg) {
+	if (!urb->transfer_buffer) {
 		/* sg_miter_start is already done in musb_ep_program */
 		if (!sg_miter_next(&qh->sg_miter)) {
 			dev_err(musb->controller, "error: sg list empty\n");
@@ -1447,9 +1444,8 @@ done:
 			status = -EINVAL;
 			goto done;
 		}
-		urb->transfer_buffer = qh->sg_miter.addr;
 		length = min_t(u32, length, qh->sg_miter.length);
-		musb_write_fifo(hw_ep, length, urb->transfer_buffer);
+		musb_write_fifo(hw_ep, length, qh->sg_miter.addr);
 		qh->sg_miter.consumed = length;
 		sg_miter_stop(&qh->sg_miter);
 	} else {
@@ -1458,11 +1454,6 @@ done:
 
 	qh->segsize = length;
 
-	if (qh->use_sg) {
-		if (offset + length >= urb->transfer_buffer_length)
-			qh->use_sg = false;
-	}
-
 	musb_ep_select(mbase, epnum);
 	musb_writew(epio, MUSB_TXCSR,
 			MUSB_TXCSR_H_WZC_BITS | MUSB_TXCSR_TXPKTRDY);
@@ -1977,8 +1968,10 @@ finish:
 	urb->actual_length += xfer_len;
 	qh->offset += xfer_len;
 	if (done) {
-		if (qh->use_sg)
+		if (qh->use_sg) {
 			qh->use_sg = false;
+			urb->transfer_buffer = NULL;
+		}
 
 		if (urb->status == -EINPROGRESS)
 			urb->status = status;
diff -druNp --no-dereference linux-libre-5.6-gnu/drivers/usb/serial/io_edgeport.c linux-libre-5.6.3-gnu/drivers/usb/serial/io_edgeport.c
--- linux-libre-5.6-gnu/drivers/usb/serial/io_edgeport.c	2020-03-29 21:05:03.000000000 -0400
+++ linux-libre-5.6.3-gnu/drivers/usb/serial/io_edgeport.c	2020-04-08 04:54:04.000000000 -0400
@@ -710,7 +710,7 @@ static void edge_interrupt_callback(stru
 		/* grab the txcredits for the ports if available */
 		position = 2;
 		portNumber = 0;
-		while ((position < length) &&
+		while ((position < length - 1) &&
 				(portNumber < edge_serial->serial->num_ports)) {
 			txCredits = data[position] | (data[position+1] << 8);
 			if (txCredits) {
diff -druNp --no-dereference linux-libre-5.6-gnu/drivers/usb/serial/option.c linux-libre-5.6.3-gnu/drivers/usb/serial/option.c
--- linux-libre-5.6-gnu/drivers/usb/serial/option.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/drivers/usb/serial/option.c	2020-04-08 03:11:10.000000000 -0400
@@ -1992,8 +1992,14 @@ static const struct usb_device_id option
 	{ USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) },	/* D-Link DWM-152/C1 */
 	{ USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) },	/* D-Link DWM-156/C1 */
 	{ USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) },	/* D-Link DWM-156/A3 */
+	{ USB_DEVICE_INTERFACE_CLASS(0x1435, 0xd191, 0xff),			/* Wistron Neweb D19Q1 */
+	  .driver_info = RSVD(1) | RSVD(4) },
+	{ USB_DEVICE_INTERFACE_CLASS(0x1690, 0x7588, 0xff),			/* ASKEY WWHC050 */
+	  .driver_info = RSVD(1) | RSVD(4) },
 	{ USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2031, 0xff),			/* Olicard 600 */
 	  .driver_info = RSVD(4) },
+	{ USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2033, 0xff),			/* BroadMobi BM806U */
+	  .driver_info = RSVD(4) },
 	{ USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2060, 0xff),			/* BroadMobi BM818 */
 	  .driver_info = RSVD(4) },
 	{ USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) },			/* OLICARD300 - MT6225 */
diff -druNp --no-dereference linux-libre-5.6-gnu/fs/libfs.c linux-libre-5.6.3-gnu/fs/libfs.c
--- linux-libre-5.6-gnu/fs/libfs.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/fs/libfs.c	2020-04-08 03:11:10.000000000 -0400
@@ -891,7 +891,7 @@ int simple_attr_open(struct inode *inode
 {
 	struct simple_attr *attr;
 
-	attr = kmalloc(sizeof(*attr), GFP_KERNEL);
+	attr = kzalloc(sizeof(*attr), GFP_KERNEL);
 	if (!attr)
 		return -ENOMEM;
 
@@ -931,9 +931,11 @@ ssize_t simple_attr_read(struct file *fi
 	if (ret)
 		return ret;
 
-	if (*ppos) {		/* continued read */
+	if (*ppos && attr->get_buf[0]) {
+		/* continued read */
 		size = strlen(attr->get_buf);
-	} else {		/* first read */
+	} else {
+		/* first read */
 		u64 val;
 		ret = attr->get(attr->data, &val);
 		if (ret)
diff -druNp --no-dereference linux-libre-5.6-gnu/include/linux/selection.h linux-libre-5.6.3-gnu/include/linux/selection.h
--- linux-libre-5.6-gnu/include/linux/selection.h	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/include/linux/selection.h	2020-04-08 03:11:10.000000000 -0400
@@ -11,8 +11,8 @@
 #include <linux/tiocl.h>
 #include <linux/vt_buffer.h>
 
-extern struct vc_data *sel_cons;
 struct tty_struct;
+struct vc_data;
 
 extern void clear_selection(void);
 extern int set_selection_user(const struct tiocl_selection __user *sel,
@@ -24,6 +24,8 @@ extern int sel_loadlut(char __user *p);
 extern int mouse_reporting(void);
 extern void mouse_report(struct tty_struct * tty, int butt, int mrx, int mry);
 
+bool vc_is_sel(struct vc_data *vc);
+
 extern int console_blanked;
 
 extern const unsigned char color_table[];
diff -druNp --no-dereference linux-libre-5.6-gnu/include/linux/vt_kern.h linux-libre-5.6.3-gnu/include/linux/vt_kern.h
--- linux-libre-5.6-gnu/include/linux/vt_kern.h	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/include/linux/vt_kern.h	2020-04-08 03:11:10.000000000 -0400
@@ -135,7 +135,7 @@ extern int do_unbind_con_driver(const st
 			     int deflt);
 int vty_init(const struct file_operations *console_fops);
 
-extern char vt_dont_switch;
+extern bool vt_dont_switch;
 extern int default_utf8;
 extern int global_cursor_default;
 
diff -druNp --no-dereference linux-libre-5.6-gnu/include/uapi/linux/coresight-stm.h linux-libre-5.6.3-gnu/include/uapi/linux/coresight-stm.h
--- linux-libre-5.6-gnu/include/uapi/linux/coresight-stm.h	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/include/uapi/linux/coresight-stm.h	2020-04-08 03:11:10.000000000 -0400
@@ -2,8 +2,10 @@
 #ifndef __UAPI_CORESIGHT_STM_H_
 #define __UAPI_CORESIGHT_STM_H_
 
-#define STM_FLAG_TIMESTAMPED   BIT(3)
-#define STM_FLAG_GUARANTEED    BIT(7)
+#include <linux/const.h>
+
+#define STM_FLAG_TIMESTAMPED   _BITUL(3)
+#define STM_FLAG_GUARANTEED    _BITUL(7)
 
 /*
  * The CoreSight STM supports guaranteed and invariant timing
diff -druNp --no-dereference linux-libre-5.6-gnu/include/uapi/sound/asoc.h linux-libre-5.6.3-gnu/include/uapi/sound/asoc.h
--- linux-libre-5.6-gnu/include/uapi/sound/asoc.h	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/include/uapi/sound/asoc.h	2020-04-08 03:11:10.000000000 -0400
@@ -17,6 +17,7 @@
 #define __LINUX_UAPI_SND_ASOC_H
 
 #include <linux/types.h>
+#include <sound/asound.h>
 
 /*
  * Maximum number of channels topology kcontrol can represent.
diff -druNp --no-dereference linux-libre-5.6-gnu/kernel/bpf/verifier.c linux-libre-5.6.3-gnu/kernel/bpf/verifier.c
--- linux-libre-5.6-gnu/kernel/bpf/verifier.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/kernel/bpf/verifier.c	2020-04-08 03:11:10.000000000 -0400
@@ -1034,17 +1034,6 @@ static void __reg_bound_offset(struct bp
 						 reg->umax_value));
 }
 
-static void __reg_bound_offset32(struct bpf_reg_state *reg)
-{
-	u64 mask = 0xffffFFFF;
-	struct tnum range = tnum_range(reg->umin_value & mask,
-				       reg->umax_value & mask);
-	struct tnum lo32 = tnum_cast(reg->var_off, 4);
-	struct tnum hi32 = tnum_lshift(tnum_rshift(reg->var_off, 32), 32);
-
-	reg->var_off = tnum_or(hi32, tnum_intersect(lo32, range));
-}
-
 /* Reset the min/max bounds of a register */
 static void __mark_reg_unbounded(struct bpf_reg_state *reg)
 {
@@ -5717,10 +5706,6 @@ static void reg_set_min_max(struct bpf_r
 	/* We might have learned some bits from the bounds. */
 	__reg_bound_offset(false_reg);
 	__reg_bound_offset(true_reg);
-	if (is_jmp32) {
-		__reg_bound_offset32(false_reg);
-		__reg_bound_offset32(true_reg);
-	}
 	/* Intersecting with the old var_off might have improved our bounds
 	 * slightly.  e.g. if umax was 0x7f...f and var_off was (0; 0xf...fc),
 	 * then new var_off is (0; 0x7f...fc) which improves our umax.
@@ -5830,10 +5815,6 @@ static void reg_set_min_max_inv(struct b
 	/* We might have learned some bits from the bounds. */
 	__reg_bound_offset(false_reg);
 	__reg_bound_offset(true_reg);
-	if (is_jmp32) {
-		__reg_bound_offset32(false_reg);
-		__reg_bound_offset32(true_reg);
-	}
 	/* Intersecting with the old var_off might have improved our bounds
 	 * slightly.  e.g. if umax was 0x7f...f and var_off was (0; 0xf...fc),
 	 * then new var_off is (0; 0x7f...fc) which improves our umax.
diff -druNp --no-dereference linux-libre-5.6-gnu/kernel/padata.c linux-libre-5.6.3-gnu/kernel/padata.c
--- linux-libre-5.6-gnu/kernel/padata.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/kernel/padata.c	2020-04-08 03:11:10.000000000 -0400
@@ -512,7 +512,7 @@ static int padata_replace_one(struct pad
 static int padata_replace(struct padata_instance *pinst)
 {
 	struct padata_shell *ps;
-	int err;
+	int err = 0;
 
 	pinst->flags |= PADATA_RESET;
 
diff -druNp --no-dereference linux-libre-5.6-gnu/lib/test_xarray.c linux-libre-5.6.3-gnu/lib/test_xarray.c
--- linux-libre-5.6-gnu/lib/test_xarray.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/lib/test_xarray.c	2020-04-08 03:11:10.000000000 -0400
@@ -12,6 +12,9 @@
 static unsigned int tests_run;
 static unsigned int tests_passed;
 
+static const unsigned int order_limit =
+		IS_ENABLED(CONFIG_XARRAY_MULTI) ? BITS_PER_LONG : 1;
+
 #ifndef XA_DEBUG
 # ifdef __KERNEL__
 void xa_dump(const struct xarray *xa) { }
@@ -959,6 +962,20 @@ static noinline void check_multi_find_2(
 	}
 }
 
+static noinline void check_multi_find_3(struct xarray *xa)
+{
+	unsigned int order;
+
+	for (order = 5; order < order_limit; order++) {
+		unsigned long index = 1UL << (order - 5);
+
+		XA_BUG_ON(xa, !xa_empty(xa));
+		xa_store_order(xa, 0, order - 4, xa_mk_index(0), GFP_KERNEL);
+		XA_BUG_ON(xa, xa_find_after(xa, &index, ULONG_MAX, XA_PRESENT));
+		xa_erase_index(xa, 0);
+	}
+}
+
 static noinline void check_find_1(struct xarray *xa)
 {
 	unsigned long i, j, k;
@@ -1081,6 +1098,7 @@ static noinline void check_find(struct x
 	for (i = 2; i < 10; i++)
 		check_multi_find_1(xa, i);
 	check_multi_find_2(xa);
+	check_multi_find_3(xa);
 }
 
 /* See find_swap_entry() in mm/shmem.c */
diff -druNp --no-dereference linux-libre-5.6-gnu/lib/xarray.c linux-libre-5.6.3-gnu/lib/xarray.c
--- linux-libre-5.6-gnu/lib/xarray.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/lib/xarray.c	2020-04-08 03:11:10.000000000 -0400
@@ -1839,7 +1839,8 @@ static bool xas_sibling(struct xa_state
 	if (!node)
 		return false;
 	mask = (XA_CHUNK_SIZE << node->shift) - 1;
-	return (xas->xa_index & mask) > (xas->xa_offset << node->shift);
+	return (xas->xa_index & mask) >
+		((unsigned long)xas->xa_offset << node->shift);
 }
 
 /**
diff -druNp --no-dereference linux-libre-5.6-gnu/Makefile linux-libre-5.6.3-gnu/Makefile
--- linux-libre-5.6-gnu/Makefile	2020-03-29 20:30:15.000000000 -0400
+++ linux-libre-5.6.3-gnu/Makefile	2020-04-08 04:20:30.000000000 -0400
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 5
 PATCHLEVEL = 6
-SUBLEVEL = 0
+SUBLEVEL = 3
 EXTRAVERSION = -gnu
 NAME = Kleptomaniac Octopus
 
diff -druNp --no-dereference linux-libre-5.6-gnu/mm/mempolicy.c linux-libre-5.6.3-gnu/mm/mempolicy.c
--- linux-libre-5.6-gnu/mm/mempolicy.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/mm/mempolicy.c	2020-04-08 03:11:10.000000000 -0400
@@ -2841,7 +2841,9 @@ int mpol_parse_str(char *str, struct mem
 	switch (mode) {
 	case MPOL_PREFERRED:
 		/*
-		 * Insist on a nodelist of one node only
+		 * Insist on a nodelist of one node only, although later
+		 * we use first_node(nodes) to grab a single node, so here
+		 * nodelist (or nodes) cannot be empty.
 		 */
 		if (nodelist) {
 			char *rest = nodelist;
@@ -2849,6 +2851,8 @@ int mpol_parse_str(char *str, struct mem
 				rest++;
 			if (*rest)
 				goto out;
+			if (nodes_empty(nodes))
+				goto out;
 		}
 		break;
 	case MPOL_INTERLEAVE:
diff -druNp --no-dereference linux-libre-5.6-gnu/net/core/skbuff.c linux-libre-5.6.3-gnu/net/core/skbuff.c
--- linux-libre-5.6-gnu/net/core/skbuff.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/net/core/skbuff.c	2020-04-08 03:11:10.000000000 -0400
@@ -3668,6 +3668,7 @@ struct sk_buff *skb_segment_list(struct
 
 		skb_push(nskb, -skb_network_offset(nskb) + offset);
 
+		skb_release_head_state(nskb);
 		 __copy_skb_header(nskb, skb);
 
 		skb_headers_offset_update(nskb, skb_headroom(nskb) - skb_headroom(skb));
diff -druNp --no-dereference linux-libre-5.6-gnu/net/ipv4/fib_trie.c linux-libre-5.6.3-gnu/net/ipv4/fib_trie.c
--- linux-libre-5.6-gnu/net/ipv4/fib_trie.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/net/ipv4/fib_trie.c	2020-04-08 03:11:10.000000000 -0400
@@ -2577,6 +2577,7 @@ static int fib_triestat_seq_show(struct
 		   " %zd bytes, size of tnode: %zd bytes.\n",
 		   LEAF_SIZE, TNODE_SIZE(0));
 
+	rcu_read_lock();
 	for (h = 0; h < FIB_TABLE_HASHSZ; h++) {
 		struct hlist_head *head = &net->ipv4.fib_table_hash[h];
 		struct fib_table *tb;
@@ -2596,7 +2597,9 @@ static int fib_triestat_seq_show(struct
 			trie_show_usage(seq, t->stats);
 #endif
 		}
+		cond_resched_rcu();
 	}
+	rcu_read_unlock();
 
 	return 0;
 }
diff -druNp --no-dereference linux-libre-5.6-gnu/net/ipv4/ip_tunnel.c linux-libre-5.6.3-gnu/net/ipv4/ip_tunnel.c
--- linux-libre-5.6-gnu/net/ipv4/ip_tunnel.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/net/ipv4/ip_tunnel.c	2020-04-08 03:11:10.000000000 -0400
@@ -142,11 +142,8 @@ struct ip_tunnel *ip_tunnel_lookup(struc
 			cand = t;
 	}
 
-	if (flags & TUNNEL_NO_KEY)
-		goto skip_key_lookup;
-
 	hlist_for_each_entry_rcu(t, head, hash_node) {
-		if (t->parms.i_key != key ||
+		if ((!(flags & TUNNEL_NO_KEY) && t->parms.i_key != key) ||
 		    t->parms.iph.saddr != 0 ||
 		    t->parms.iph.daddr != 0 ||
 		    !(t->dev->flags & IFF_UP))
@@ -158,7 +155,6 @@ struct ip_tunnel *ip_tunnel_lookup(struc
 			cand = t;
 	}
 
-skip_key_lookup:
 	if (cand)
 		return cand;
 
diff -druNp --no-dereference linux-libre-5.6-gnu/net/ipv4/udp_offload.c linux-libre-5.6.3-gnu/net/ipv4/udp_offload.c
--- linux-libre-5.6-gnu/net/ipv4/udp_offload.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/net/ipv4/udp_offload.c	2020-04-08 03:11:10.000000000 -0400
@@ -453,6 +453,7 @@ struct sk_buff *udp_gro_receive(struct l
 	unsigned int off = skb_gro_offset(skb);
 	int flush = 1;
 
+	NAPI_GRO_CB(skb)->is_flist = 0;
 	if (skb->dev->features & NETIF_F_GRO_FRAGLIST)
 		NAPI_GRO_CB(skb)->is_flist = sk ? !udp_sk(sk)->gro_enabled: 1;
 
diff -druNp --no-dereference linux-libre-5.6-gnu/net/mac80211/tx.c linux-libre-5.6.3-gnu/net/mac80211/tx.c
--- linux-libre-5.6-gnu/net/mac80211/tx.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/net/mac80211/tx.c	2020-04-08 03:11:10.000000000 -0400
@@ -3610,7 +3610,8 @@ begin:
 		 * Drop unicast frames to unauthorised stations unless they are
 		 * EAPOL frames from the local station.
 		 */
-		if (unlikely(!ieee80211_vif_is_mesh(&tx.sdata->vif) &&
+		if (unlikely(ieee80211_is_data(hdr->frame_control) &&
+			     !ieee80211_vif_is_mesh(&tx.sdata->vif) &&
 			     tx.sdata->vif.type != NL80211_IFTYPE_OCB &&
 			     !is_multicast_ether_addr(hdr->addr1) &&
 			     !test_sta_flag(tx.sta, WLAN_STA_AUTHORIZED) &&
diff -druNp --no-dereference linux-libre-5.6-gnu/net/sctp/ipv6.c linux-libre-5.6.3-gnu/net/sctp/ipv6.c
--- linux-libre-5.6-gnu/net/sctp/ipv6.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/net/sctp/ipv6.c	2020-04-08 03:11:10.000000000 -0400
@@ -228,7 +228,8 @@ static void sctp_v6_get_dst(struct sctp_
 {
 	struct sctp_association *asoc = t->asoc;
 	struct dst_entry *dst = NULL;
-	struct flowi6 *fl6 = &fl->u.ip6;
+	struct flowi _fl;
+	struct flowi6 *fl6 = &_fl.u.ip6;
 	struct sctp_bind_addr *bp;
 	struct ipv6_pinfo *np = inet6_sk(sk);
 	struct sctp_sockaddr_entry *laddr;
@@ -238,7 +239,7 @@ static void sctp_v6_get_dst(struct sctp_
 	enum sctp_scope scope;
 	__u8 matchlen = 0;
 
-	memset(fl6, 0, sizeof(struct flowi6));
+	memset(&_fl, 0, sizeof(_fl));
 	fl6->daddr = daddr->v6.sin6_addr;
 	fl6->fl6_dport = daddr->v6.sin6_port;
 	fl6->flowi6_proto = IPPROTO_SCTP;
@@ -276,8 +277,11 @@ static void sctp_v6_get_dst(struct sctp_
 	rcu_read_unlock();
 
 	dst = ip6_dst_lookup_flow(sock_net(sk), sk, fl6, final_p);
-	if (!asoc || saddr)
+	if (!asoc || saddr) {
+		t->dst = dst;
+		memcpy(fl, &_fl, sizeof(_fl));
 		goto out;
+	}
 
 	bp = &asoc->base.bind_addr;
 	scope = sctp_scope(daddr);
@@ -300,6 +304,8 @@ static void sctp_v6_get_dst(struct sctp_
 			if ((laddr->a.sa.sa_family == AF_INET6) &&
 			    (sctp_v6_cmp_addr(&dst_saddr, &laddr->a))) {
 				rcu_read_unlock();
+				t->dst = dst;
+				memcpy(fl, &_fl, sizeof(_fl));
 				goto out;
 			}
 		}
@@ -338,6 +344,8 @@ static void sctp_v6_get_dst(struct sctp_
 			if (!IS_ERR_OR_NULL(dst))
 				dst_release(dst);
 			dst = bdst;
+			t->dst = dst;
+			memcpy(fl, &_fl, sizeof(_fl));
 			break;
 		}
 
@@ -351,6 +359,8 @@ static void sctp_v6_get_dst(struct sctp_
 			dst_release(dst);
 		dst = bdst;
 		matchlen = bmatchlen;
+		t->dst = dst;
+		memcpy(fl, &_fl, sizeof(_fl));
 	}
 	rcu_read_unlock();
 
@@ -359,14 +369,12 @@ out:
 		struct rt6_info *rt;
 
 		rt = (struct rt6_info *)dst;
-		t->dst = dst;
 		t->dst_cookie = rt6_get_cookie(rt);
 		pr_debug("rt6_dst:%pI6/%d rt6_src:%pI6\n",
 			 &rt->rt6i_dst.addr, rt->rt6i_dst.plen,
-			 &fl6->saddr);
+			 &fl->u.ip6.saddr);
 	} else {
 		t->dst = NULL;
-
 		pr_debug("no route\n");
 	}
 }
diff -druNp --no-dereference linux-libre-5.6-gnu/net/sctp/protocol.c linux-libre-5.6.3-gnu/net/sctp/protocol.c
--- linux-libre-5.6-gnu/net/sctp/protocol.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/net/sctp/protocol.c	2020-04-08 03:11:10.000000000 -0400
@@ -409,7 +409,8 @@ static void sctp_v4_get_dst(struct sctp_
 {
 	struct sctp_association *asoc = t->asoc;
 	struct rtable *rt;
-	struct flowi4 *fl4 = &fl->u.ip4;
+	struct flowi _fl;
+	struct flowi4 *fl4 = &_fl.u.ip4;
 	struct sctp_bind_addr *bp;
 	struct sctp_sockaddr_entry *laddr;
 	struct dst_entry *dst = NULL;
@@ -419,7 +420,7 @@ static void sctp_v4_get_dst(struct sctp_
 
 	if (t->dscp & SCTP_DSCP_SET_MASK)
 		tos = t->dscp & SCTP_DSCP_VAL_MASK;
-	memset(fl4, 0x0, sizeof(struct flowi4));
+	memset(&_fl, 0x0, sizeof(_fl));
 	fl4->daddr  = daddr->v4.sin_addr.s_addr;
 	fl4->fl4_dport = daddr->v4.sin_port;
 	fl4->flowi4_proto = IPPROTO_SCTP;
@@ -438,8 +439,11 @@ static void sctp_v4_get_dst(struct sctp_
 		 &fl4->saddr);
 
 	rt = ip_route_output_key(sock_net(sk), fl4);
-	if (!IS_ERR(rt))
+	if (!IS_ERR(rt)) {
 		dst = &rt->dst;
+		t->dst = dst;
+		memcpy(fl, &_fl, sizeof(_fl));
+	}
 
 	/* If there is no association or if a source address is passed, no
 	 * more validation is required.
@@ -502,27 +506,33 @@ static void sctp_v4_get_dst(struct sctp_
 		odev = __ip_dev_find(sock_net(sk), laddr->a.v4.sin_addr.s_addr,
 				     false);
 		if (!odev || odev->ifindex != fl4->flowi4_oif) {
-			if (!dst)
+			if (!dst) {
 				dst = &rt->dst;
-			else
+				t->dst = dst;
+				memcpy(fl, &_fl, sizeof(_fl));
+			} else {
 				dst_release(&rt->dst);
+			}
 			continue;
 		}
 
 		dst_release(dst);
 		dst = &rt->dst;
+		t->dst = dst;
+		memcpy(fl, &_fl, sizeof(_fl));
 		break;
 	}
 
 out_unlock:
 	rcu_read_unlock();
 out:
-	t->dst = dst;
-	if (dst)
+	if (dst) {
 		pr_debug("rt_dst:%pI4, rt_src:%pI4\n",
-			 &fl4->daddr, &fl4->saddr);
-	else
+			 &fl->u.ip4.daddr, &fl->u.ip4.saddr);
+	} else {
+		t->dst = NULL;
 		pr_debug("no route\n");
+	}
 }
 
 /* For v4, the source address is cached in the route entry(dst). So no need
diff -druNp --no-dereference linux-libre-5.6-gnu/net/sctp/socket.c linux-libre-5.6.3-gnu/net/sctp/socket.c
--- linux-libre-5.6-gnu/net/sctp/socket.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/net/sctp/socket.c	2020-04-08 03:11:10.000000000 -0400
@@ -147,29 +147,44 @@ static void sctp_clear_owner_w(struct sc
 	skb_orphan(chunk->skb);
 }
 
+#define traverse_and_process()	\
+do {				\
+	msg = chunk->msg;	\
+	if (msg == prev_msg)	\
+		continue;	\
+	list_for_each_entry(c, &msg->chunks, frag_list) {	\
+		if ((clear && asoc->base.sk == c->skb->sk) ||	\
+		    (!clear && asoc->base.sk != c->skb->sk))	\
+			cb(c);	\
+	}			\
+	prev_msg = msg;		\
+} while (0)
+
 static void sctp_for_each_tx_datachunk(struct sctp_association *asoc,
+				       bool clear,
 				       void (*cb)(struct sctp_chunk *))
 
 {
+	struct sctp_datamsg *msg, *prev_msg = NULL;
 	struct sctp_outq *q = &asoc->outqueue;
+	struct sctp_chunk *chunk, *c;
 	struct sctp_transport *t;
-	struct sctp_chunk *chunk;
 
 	list_for_each_entry(t, &asoc->peer.transport_addr_list, transports)
 		list_for_each_entry(chunk, &t->transmitted, transmitted_list)
-			cb(chunk);
+			traverse_and_process();
 
 	list_for_each_entry(chunk, &q->retransmit, transmitted_list)
-		cb(chunk);
+		traverse_and_process();
 
 	list_for_each_entry(chunk, &q->sacked, transmitted_list)
-		cb(chunk);
+		traverse_and_process();
 
 	list_for_each_entry(chunk, &q->abandoned, transmitted_list)
-		cb(chunk);
+		traverse_and_process();
 
 	list_for_each_entry(chunk, &q->out_chunk_list, list)
-		cb(chunk);
+		traverse_and_process();
 }
 
 static void sctp_for_each_rx_skb(struct sctp_association *asoc, struct sock *sk,
@@ -9574,9 +9589,9 @@ static int sctp_sock_migrate(struct sock
 	 * paths won't try to lock it and then oldsk.
 	 */
 	lock_sock_nested(newsk, SINGLE_DEPTH_NESTING);
-	sctp_for_each_tx_datachunk(assoc, sctp_clear_owner_w);
+	sctp_for_each_tx_datachunk(assoc, true, sctp_clear_owner_w);
 	sctp_assoc_migrate(assoc, newsk);
-	sctp_for_each_tx_datachunk(assoc, sctp_set_owner_w);
+	sctp_for_each_tx_datachunk(assoc, false, sctp_set_owner_w);
 
 	/* If the association on the newsk is already closed before accept()
 	 * is called, set RCV_SHUTDOWN flag.
diff -druNp --no-dereference linux-libre-5.6-gnu/sound/pci/hda/patch_ca0132.c linux-libre-5.6.3-gnu/sound/pci/hda/patch_ca0132.c
--- linux-libre-5.6-gnu/sound/pci/hda/patch_ca0132.c	2020-03-29 21:08:02.000000000 -0400
+++ linux-libre-5.6.3-gnu/sound/pci/hda/patch_ca0132.c	2020-04-08 04:57:03.000000000 -0400
@@ -1178,6 +1178,7 @@ static const struct snd_pci_quirk ca0132
 	SND_PCI_QUIRK(0x1458, 0xA016, "Recon3Di", QUIRK_R3DI),
 	SND_PCI_QUIRK(0x1458, 0xA026, "Gigabyte G1.Sniper Z97", QUIRK_R3DI),
 	SND_PCI_QUIRK(0x1458, 0xA036, "Gigabyte GA-Z170X-Gaming 7", QUIRK_R3DI),
+	SND_PCI_QUIRK(0x3842, 0x1038, "EVGA X99 Classified", QUIRK_R3DI),
 	SND_PCI_QUIRK(0x1102, 0x0013, "Recon3D", QUIRK_R3D),
 	SND_PCI_QUIRK(0x1102, 0x0051, "Sound Blaster AE-5", QUIRK_AE5),
 	{}
diff -druNp --no-dereference linux-libre-5.6-gnu/tools/perf/util/setup.py linux-libre-5.6.3-gnu/tools/perf/util/setup.py
--- linux-libre-5.6-gnu/tools/perf/util/setup.py	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/tools/perf/util/setup.py	2020-04-08 03:11:10.000000000 -0400
@@ -3,7 +3,7 @@ from subprocess import Popen, PIPE
 from re import sub
 
 cc = getenv("CC")
-cc_is_clang = b"clang version" in Popen([cc, "-v"], stderr=PIPE).stderr.readline()
+cc_is_clang = b"clang version" in Popen([cc.split()[0], "-v"], stderr=PIPE).stderr.readline()
 
 def clang_has_option(option):
     return [o for o in Popen([cc, option], stderr=PIPE).stderr.readlines() if b"unknown argument" in o] == [ ]
diff -druNp --no-dereference linux-libre-5.6-gnu/tools/testing/selftests/bpf/verifier/jmp32.c linux-libre-5.6.3-gnu/tools/testing/selftests/bpf/verifier/jmp32.c
--- linux-libre-5.6-gnu/tools/testing/selftests/bpf/verifier/jmp32.c	2020-03-29 18:25:41.000000000 -0400
+++ linux-libre-5.6.3-gnu/tools/testing/selftests/bpf/verifier/jmp32.c	2020-04-08 03:11:10.000000000 -0400
@@ -783,7 +783,8 @@
 	},
 	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
 	.fixup_map_hash_48b = { 4 },
-	.result = ACCEPT,
+	.result = REJECT,
+	.errstr = "R8 unbounded memory access",
 	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
 },
 {
@@ -811,7 +812,8 @@
 	},
 	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
 	.fixup_map_hash_48b = { 4 },
-	.result = ACCEPT,
+	.result = REJECT,
+	.errstr = "R8 unbounded memory access",
 	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
 },
 {
@@ -839,6 +841,7 @@
 	},
 	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
 	.fixup_map_hash_48b = { 4 },
-	.result = ACCEPT,
+	.result = REJECT,
+	.errstr = "R8 unbounded memory access",
 	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
 },
