Fix only 1 monitor working on DP-MST docking stations (rhbz 1809681)

Fix backtraces on various buggy BIOS-es (rhbz 1564895, 1808874)
Add /etc/modprobe.d/floppy-blacklist.conf to fix auto-loading of the
  legacy floppy driver (rhbz 1789155)

5 files changed, 1238 insertions, 0 deletions

diff --git a/drm-dp-mst-error-handling-improvements.patch b/drm-dp-mst-error-handling-improvements.patch
new file mode 100644
index 000000000..91e396940
--- /dev/null
+++ b/drm-dp-mst-error-handling-improvements.patch
@@ -0,0 +1,471 @@
+From 52bd42038880354565bd5ca0bcc1d24b15136b0d Mon Sep 17 00:00:00 2001
+From: Benjamin Gaignard <benjamin.gaignard@st.com>
+Date: Wed, 5 Feb 2020 09:48:42 +0100
+Subject: [PATCH 1/3] drm/dp_mst: Fix W=1 warnings
+
+Fix the warnings that show up with W=1.
+They are all about unused but set variables.
+If functions returns are not used anymore make them void.
+
+Signed-off-by: Benjamin Gaignard <benjamin.gaignard@st.com>
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200205084842.5642-1-benjamin.gaignard@st.com
+---
+ drivers/gpu/drm/drm_dp_mst_topology.c | 114 +++++++++++++++-----------
+ 1 file changed, 65 insertions(+), 49 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
+index 415bd0770eab..95e08d908dd2 100644
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -1035,7 +1035,8 @@ static bool drm_dp_sideband_parse_req(struct drm_dp_sideband_msg_rx *raw,
+ 	}
+ }
+ 
+-static int build_dpcd_write(struct drm_dp_sideband_msg_tx *msg, u8 port_num, u32 offset, u8 num_bytes, u8 *bytes)
++static void build_dpcd_write(struct drm_dp_sideband_msg_tx *msg,
++			     u8 port_num, u32 offset, u8 num_bytes, u8 *bytes)
+ {
+ 	struct drm_dp_sideband_msg_req_body req;
+ 
+@@ -1045,17 +1046,14 @@ static int build_dpcd_write(struct drm_dp_sideband_msg_tx *msg, u8 port_num, u32
+ 	req.u.dpcd_write.num_bytes = num_bytes;
+ 	req.u.dpcd_write.bytes = bytes;
+ 	drm_dp_encode_sideband_req(&req, msg);
+-
+-	return 0;
+ }
+ 
+-static int build_link_address(struct drm_dp_sideband_msg_tx *msg)
++static void build_link_address(struct drm_dp_sideband_msg_tx *msg)
+ {
+ 	struct drm_dp_sideband_msg_req_body req;
+ 
+ 	req.req_type = DP_LINK_ADDRESS;
+ 	drm_dp_encode_sideband_req(&req, msg);
+-	return 0;
+ }
+ 
+ static int build_clear_payload_id_table(struct drm_dp_sideband_msg_tx *msg)
+@@ -1067,7 +1065,8 @@ static int build_clear_payload_id_table(struct drm_dp_sideband_msg_tx *msg)
+ 	return 0;
+ }
+ 
+-static int build_enum_path_resources(struct drm_dp_sideband_msg_tx *msg, int port_num)
++static int build_enum_path_resources(struct drm_dp_sideband_msg_tx *msg,
++				     int port_num)
+ {
+ 	struct drm_dp_sideband_msg_req_body req;
+ 
+@@ -1078,10 +1077,11 @@ static int build_enum_path_resources(struct drm_dp_sideband_msg_tx *msg, int por
+ 	return 0;
+ }
+ 
+-static int build_allocate_payload(struct drm_dp_sideband_msg_tx *msg, int port_num,
+-				  u8 vcpi, uint16_t pbn,
+-				  u8 number_sdp_streams,
+-				  u8 *sdp_stream_sink)
++static void build_allocate_payload(struct drm_dp_sideband_msg_tx *msg,
++				   int port_num,
++				   u8 vcpi, uint16_t pbn,
++				   u8 number_sdp_streams,
++				   u8 *sdp_stream_sink)
+ {
+ 	struct drm_dp_sideband_msg_req_body req;
+ 	memset(&req, 0, sizeof(req));
+@@ -1094,11 +1094,10 @@ static int build_allocate_payload(struct drm_dp_sideband_msg_tx *msg, int port_n
+ 		   number_sdp_streams);
+ 	drm_dp_encode_sideband_req(&req, msg);
+ 	msg->path_msg = true;
+-	return 0;
+ }
+ 
+-static int build_power_updown_phy(struct drm_dp_sideband_msg_tx *msg,
+-				  int port_num, bool power_up)
++static void build_power_updown_phy(struct drm_dp_sideband_msg_tx *msg,
++				   int port_num, bool power_up)
+ {
+ 	struct drm_dp_sideband_msg_req_body req;
+ 
+@@ -1110,7 +1109,6 @@ static int build_power_updown_phy(struct drm_dp_sideband_msg_tx *msg,
+ 	req.u.port_num.port_number = port_num;
+ 	drm_dp_encode_sideband_req(&req, msg);
+ 	msg->path_msg = true;
+-	return 0;
+ }
+ 
+ static int drm_dp_mst_assign_payload_id(struct drm_dp_mst_topology_mgr *mgr,
+@@ -2073,29 +2071,24 @@ ssize_t drm_dp_mst_dpcd_write(struct drm_dp_aux *aux,
+ 				      offset, size, buffer);
+ }
+ 
+-static void drm_dp_check_mstb_guid(struct drm_dp_mst_branch *mstb, u8 *guid)
++static int drm_dp_check_mstb_guid(struct drm_dp_mst_branch *mstb, u8 *guid)
+ {
+-	int ret;
++	int ret = 0;
+ 
+ 	memcpy(mstb->guid, guid, 16);
+ 
+ 	if (!drm_dp_validate_guid(mstb->mgr, mstb->guid)) {
+ 		if (mstb->port_parent) {
+-			ret = drm_dp_send_dpcd_write(
+-					mstb->mgr,
+-					mstb->port_parent,
+-					DP_GUID,
+-					16,
+-					mstb->guid);
++			ret = drm_dp_send_dpcd_write(mstb->mgr,
++						     mstb->port_parent,
++						     DP_GUID, 16, mstb->guid);
+ 		} else {
+-
+-			ret = drm_dp_dpcd_write(
+-					mstb->mgr->aux,
+-					DP_GUID,
+-					mstb->guid,
+-					16);
++			ret = drm_dp_dpcd_write(mstb->mgr->aux,
++						DP_GUID, mstb->guid, 16);
+ 		}
+ 	}
++
++	return ret;
+ }
+ 
+ static void build_mst_prop_path(const struct drm_dp_mst_branch *mstb,
+@@ -2641,7 +2634,8 @@ static bool drm_dp_validate_guid(struct drm_dp_mst_topology_mgr *mgr,
+ 	return false;
+ }
+ 
+-static int build_dpcd_read(struct drm_dp_sideband_msg_tx *msg, u8 port_num, u32 offset, u8 num_bytes)
++static void build_dpcd_read(struct drm_dp_sideband_msg_tx *msg,
++			    u8 port_num, u32 offset, u8 num_bytes)
+ {
+ 	struct drm_dp_sideband_msg_req_body req;
+ 
+@@ -2650,8 +2644,6 @@ static int build_dpcd_read(struct drm_dp_sideband_msg_tx *msg, u8 port_num, u32
+ 	req.u.dpcd_read.dpcd_address = offset;
+ 	req.u.dpcd_read.num_bytes = num_bytes;
+ 	drm_dp_encode_sideband_req(&req, msg);
+-
+-	return 0;
+ }
+ 
+ static int drm_dp_send_sideband_msg(struct drm_dp_mst_topology_mgr *mgr,
+@@ -2877,7 +2869,7 @@ static int drm_dp_send_link_address(struct drm_dp_mst_topology_mgr *mgr,
+ 	struct drm_dp_sideband_msg_tx *txmsg;
+ 	struct drm_dp_link_address_ack_reply *reply;
+ 	struct drm_dp_mst_port *port, *tmp;
+-	int i, len, ret, port_mask = 0;
++	int i, ret, port_mask = 0;
+ 	bool changed = false;
+ 
+ 	txmsg = kzalloc(sizeof(*txmsg), GFP_KERNEL);
+@@ -2885,7 +2877,7 @@ static int drm_dp_send_link_address(struct drm_dp_mst_topology_mgr *mgr,
+ 		return -ENOMEM;
+ 
+ 	txmsg->dst = mstb;
+-	len = build_link_address(txmsg);
++	build_link_address(txmsg);
+ 
+ 	mstb->link_address_sent = true;
+ 	drm_dp_queue_down_tx(mgr, txmsg);
+@@ -2906,7 +2898,9 @@ static int drm_dp_send_link_address(struct drm_dp_mst_topology_mgr *mgr,
+ 	DRM_DEBUG_KMS("link address reply: %d\n", reply->nports);
+ 	drm_dp_dump_link_address(reply);
+ 
+-	drm_dp_check_mstb_guid(mstb, reply->guid);
++	ret = drm_dp_check_mstb_guid(mstb, reply->guid);
++	if (ret)
++		goto out;
+ 
+ 	for (i = 0; i < reply->nports; i++) {
+ 		port_mask |= BIT(reply->ports[i].port_number);
+@@ -2947,14 +2941,14 @@ void drm_dp_send_clear_payload_id_table(struct drm_dp_mst_topology_mgr *mgr,
+ 					struct drm_dp_mst_branch *mstb)
+ {
+ 	struct drm_dp_sideband_msg_tx *txmsg;
+-	int len, ret;
++	int ret;
+ 
+ 	txmsg = kzalloc(sizeof(*txmsg), GFP_KERNEL);
+ 	if (!txmsg)
+ 		return;
+ 
+ 	txmsg->dst = mstb;
+-	len = build_clear_payload_id_table(txmsg);
++	build_clear_payload_id_table(txmsg);
+ 
+ 	drm_dp_queue_down_tx(mgr, txmsg);
+ 
+@@ -2972,7 +2966,6 @@ drm_dp_send_enum_path_resources(struct drm_dp_mst_topology_mgr *mgr,
+ {
+ 	struct drm_dp_enum_path_resources_ack_reply *path_res;
+ 	struct drm_dp_sideband_msg_tx *txmsg;
+-	int len;
+ 	int ret;
+ 
+ 	txmsg = kzalloc(sizeof(*txmsg), GFP_KERNEL);
+@@ -2980,7 +2973,7 @@ drm_dp_send_enum_path_resources(struct drm_dp_mst_topology_mgr *mgr,
+ 		return -ENOMEM;
+ 
+ 	txmsg->dst = mstb;
+-	len = build_enum_path_resources(txmsg, port->port_num);
++	build_enum_path_resources(txmsg, port->port_num);
+ 
+ 	drm_dp_queue_down_tx(mgr, txmsg);
+ 
+@@ -3073,7 +3066,7 @@ static int drm_dp_payload_send_msg(struct drm_dp_mst_topology_mgr *mgr,
+ {
+ 	struct drm_dp_sideband_msg_tx *txmsg;
+ 	struct drm_dp_mst_branch *mstb;
+-	int len, ret, port_num;
++	int ret, port_num;
+ 	u8 sinks[DRM_DP_MAX_SDP_STREAMS];
+ 	int i;
+ 
+@@ -3098,9 +3091,9 @@ static int drm_dp_payload_send_msg(struct drm_dp_mst_topology_mgr *mgr,
+ 		sinks[i] = i;
+ 
+ 	txmsg->dst = mstb;
+-	len = build_allocate_payload(txmsg, port_num,
+-				     id,
+-				     pbn, port->num_sdp_streams, sinks);
++	build_allocate_payload(txmsg, port_num,
++			       id,
++			       pbn, port->num_sdp_streams, sinks);
+ 
+ 	drm_dp_queue_down_tx(mgr, txmsg);
+ 
+@@ -3129,7 +3122,7 @@ int drm_dp_send_power_updown_phy(struct drm_dp_mst_topology_mgr *mgr,
+ 				 struct drm_dp_mst_port *port, bool power_up)
+ {
+ 	struct drm_dp_sideband_msg_tx *txmsg;
+-	int len, ret;
++	int ret;
+ 
+ 	port = drm_dp_mst_topology_get_port_validated(mgr, port);
+ 	if (!port)
+@@ -3142,7 +3135,7 @@ int drm_dp_send_power_updown_phy(struct drm_dp_mst_topology_mgr *mgr,
+ 	}
+ 
+ 	txmsg->dst = port->parent;
+-	len = build_power_updown_phy(txmsg, port->port_num, power_up);
++	build_power_updown_phy(txmsg, port->port_num, power_up);
+ 	drm_dp_queue_down_tx(mgr, txmsg);
+ 
+ 	ret = drm_dp_mst_wait_tx_reply(port->parent, txmsg);
+@@ -3364,7 +3357,6 @@ static int drm_dp_send_dpcd_read(struct drm_dp_mst_topology_mgr *mgr,
+ 				 struct drm_dp_mst_port *port,
+ 				 int offset, int size, u8 *bytes)
+ {
+-	int len;
+ 	int ret = 0;
+ 	struct drm_dp_sideband_msg_tx *txmsg;
+ 	struct drm_dp_mst_branch *mstb;
+@@ -3379,7 +3371,7 @@ static int drm_dp_send_dpcd_read(struct drm_dp_mst_topology_mgr *mgr,
+ 		goto fail_put;
+ 	}
+ 
+-	len = build_dpcd_read(txmsg, port->port_num, offset, size);
++	build_dpcd_read(txmsg, port->port_num, offset, size);
+ 	txmsg->dst = port->parent;
+ 
+ 	drm_dp_queue_down_tx(mgr, txmsg);
+@@ -3417,7 +3409,6 @@ static int drm_dp_send_dpcd_write(struct drm_dp_mst_topology_mgr *mgr,
+ 				  struct drm_dp_mst_port *port,
+ 				  int offset, int size, u8 *bytes)
+ {
+-	int len;
+ 	int ret;
+ 	struct drm_dp_sideband_msg_tx *txmsg;
+ 	struct drm_dp_mst_branch *mstb;
+@@ -3432,7 +3423,7 @@ static int drm_dp_send_dpcd_write(struct drm_dp_mst_topology_mgr *mgr,
+ 		goto fail_put;
+ 	}
+ 
+-	len = build_dpcd_write(txmsg, port->port_num, offset, size, bytes);
++	build_dpcd_write(txmsg, port->port_num, offset, size, bytes);
+ 	txmsg->dst = mstb;
+ 
+ 	drm_dp_queue_down_tx(mgr, txmsg);
+@@ -3682,7 +3673,12 @@ int drm_dp_mst_topology_mgr_resume(struct drm_dp_mst_topology_mgr *mgr,
+ 		DRM_DEBUG_KMS("dpcd read failed - undocked during suspend?\n");
+ 		goto out_fail;
+ 	}
+-	drm_dp_check_mstb_guid(mgr->mst_primary, guid);
++
++	ret = drm_dp_check_mstb_guid(mgr->mst_primary, guid);
++	if (ret) {
++		DRM_DEBUG_KMS("check mstb failed - undocked during suspend?\n");
++		goto out_fail;
++	}
+ 
+ 	/*
+ 	 * For the final step of resuming the topology, we need to bring the
+@@ -4625,15 +4621,34 @@ void drm_dp_mst_dump_topology(struct seq_file *m,
+ 		int ret;
+ 
+ 		ret = drm_dp_dpcd_read(mgr->aux, DP_DPCD_REV, buf, DP_RECEIVER_CAP_SIZE);
++		if (ret) {
++			seq_printf(m, "dpcd read failed\n");
++			goto out;
++		}
+ 		seq_printf(m, "dpcd: %*ph\n", DP_RECEIVER_CAP_SIZE, buf);
++
+ 		ret = drm_dp_dpcd_read(mgr->aux, DP_FAUX_CAP, buf, 2);
++		if (ret) {
++			seq_printf(m, "faux/mst read failed\n");
++			goto out;
++		}
+ 		seq_printf(m, "faux/mst: %*ph\n", 2, buf);
++
+ 		ret = drm_dp_dpcd_read(mgr->aux, DP_MSTM_CTRL, buf, 1);
++		if (ret) {
++			seq_printf(m, "mst ctrl read failed\n");
++			goto out;
++		}
+ 		seq_printf(m, "mst ctrl: %*ph\n", 1, buf);
+ 
+ 		/* dump the standard OUI branch header */
+ 		ret = drm_dp_dpcd_read(mgr->aux, DP_BRANCH_OUI, buf, DP_BRANCH_OUI_HEADER_SIZE);
++		if (ret) {
++			seq_printf(m, "branch oui read failed\n");
++			goto out;
++		}
+ 		seq_printf(m, "branch oui: %*phN devid: ", 3, buf);
++
+ 		for (i = 0x3; i < 0x8 && buf[i]; i++)
+ 			seq_printf(m, "%c", buf[i]);
+ 		seq_printf(m, " revision: hw: %x.%x sw: %x.%x\n",
+@@ -4642,6 +4657,7 @@ void drm_dp_mst_dump_topology(struct seq_file *m,
+ 			seq_printf(m, "payload table: %*ph\n", DP_PAYLOAD_TABLE_SIZE, buf);
+ 	}
+ 
++out:
+ 	mutex_unlock(&mgr->lock);
+ 
+ }
+-- 
+2.25.1
+
+From 9004e704af8486da3dcbde0fb35a2a309152a5c3 Mon Sep 17 00:00:00 2001
+From: Lyude Paul <lyude@redhat.com>
+Date: Fri, 6 Mar 2020 18:49:21 -0500
+Subject: [PATCH 2/3] drm/dp_mst: Make drm_dp_mst_dpcd_write() consistent with
+ drm_dp_dpcd_write()
+
+Noticed this while having some problems with hubs sometimes not being
+detected on the first plug. Every single dpcd read or write function
+returns the number of bytes transferred on success or a negative error
+code, except apparently for drm_dp_mst_dpcd_write() - which returns 0 on
+success.
+
+There's not really any good reason for this difference that I can tell,
+and having the two functions give differing behavior means that
+drm_dp_dpcd_write() will end up returning 0 on success for MST devices,
+but the number of bytes transferred for everything else.
+
+So, fix that and update the kernel doc.
+
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Fixes: 2f221a5efed4 ("drm/dp_mst: Add MST support to DP DPCD R/W functions")
+Cc: Hans de Goede <hdegoede@redhat.com>
+Cc: Mikita Lipski <mikita.lipski@amd.com>
+Cc: Sean Paul <sean@poorly.run>
+---
+ drivers/gpu/drm/drm_dp_mst_topology.c | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
+index 95e08d908dd2..2dc1c0ba456b 100644
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -2059,7 +2059,7 @@ ssize_t drm_dp_mst_dpcd_read(struct drm_dp_aux *aux,
+  * sideband messaging as drm_dp_dpcd_write() does for local
+  * devices via actual AUX CH.
+  *
+- * Return: 0 on success, negative error code on failure.
++ * Return: number of bytes written on success, negative error code on failure.
+  */
+ ssize_t drm_dp_mst_dpcd_write(struct drm_dp_aux *aux,
+ 			      unsigned int offset, void *buffer, size_t size)
+@@ -3429,12 +3429,9 @@ static int drm_dp_send_dpcd_write(struct drm_dp_mst_topology_mgr *mgr,
+ 	drm_dp_queue_down_tx(mgr, txmsg);
+ 
+ 	ret = drm_dp_mst_wait_tx_reply(mstb, txmsg);
+-	if (ret > 0) {
+-		if (txmsg->reply.reply_type == DP_SIDEBAND_REPLY_NAK)
+-			ret = -EIO;
+-		else
+-			ret = 0;
+-	}
++	if (ret > 0 && txmsg->reply.reply_type == DP_SIDEBAND_REPLY_NAK)
++		ret = -EIO;
++
+ 	kfree(txmsg);
+ fail_put:
+ 	drm_dp_mst_topology_put_mstb(mstb);
+-- 
+2.25.1
+
+From ff18e1a7ef709cdd3dcbf7b4ae2b37e1c6695289 Mon Sep 17 00:00:00 2001
+From: Lyude Paul <lyude@redhat.com>
+Date: Fri, 6 Mar 2020 18:49:22 -0500
+Subject: [PATCH 3/3] drm/dp_mst: Fix drm_dp_check_mstb_guid() return code
+
+We actually expect this to return a 0 on success, or negative error code
+on failure. In order to do that, we check whether or not we managed to
+write the whole GUID and then return 0 if so, otherwise return a
+negative error code. Also, let's add an error message here so it's a
+little more obvious when this fails in the middle of a link address
+probe.
+
+This should fix issues with certain MST hubs seemingly stopping for no
+reason in the middle of the link address probe process.
+
+Fixes: cb897542c6d2 ("drm/dp_mst: Fix W=1 warnings")
+Cc: Benjamin Gaignard <benjamin.gaignard@st.com>
+Cc: Sean Paul <sean@poorly.run>
+Cc: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+---
+ drivers/gpu/drm/drm_dp_mst_topology.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
+index 2dc1c0ba456b..d0e5993b0622 100644
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -2088,7 +2088,10 @@ static int drm_dp_check_mstb_guid(struct drm_dp_mst_branch *mstb, u8 *guid)
+ 		}
+ 	}
+ 
+-	return ret;
++	if (ret < 16 && ret > 0)
++		return -EPROTO;
++
++	return ret == 16 ? 0 : ret;
+ }
+ 
+ static void build_mst_prop_path(const struct drm_dp_mst_branch *mstb,
+@@ -2899,8 +2902,14 @@ static int drm_dp_send_link_address(struct drm_dp_mst_topology_mgr *mgr,
+ 	drm_dp_dump_link_address(reply);
+ 
+ 	ret = drm_dp_check_mstb_guid(mstb, reply->guid);
+-	if (ret)
++	if (ret) {
++		char buf[64];
++
++		drm_dp_mst_rad_to_str(mstb->rad, mstb->lct, buf, sizeof(buf));
++		DRM_ERROR("GUID check on %s failed: %d\n",
++			  buf, ret);
+ 		goto out;
++	}
+ 
+ 	for (i = 0; i < reply->nports; i++) {
+ 		port_mask |= BIT(reply->ports[i].port_number);
+-- 
+2.25.1
+
diff --git a/drm-dp-mst-fixes.patch b/drm-dp-mst-fixes.patch
new file mode 100644
index 000000000..d1e61f17d
--- /dev/null
+++ b/drm-dp-mst-fixes.patch
@@ -0,0 +1,578 @@
+From 5118c9aeafecbfa5c2a49d757c882c6033828e7e Mon Sep 17 00:00:00 2001
+From: Lyude Paul <lyude@redhat.com>
+Date: Fri, 6 Mar 2020 18:46:19 -0500
+Subject: [PATCH 1/4] drm/dp_mst: Rename drm_dp_mst_is_dp_mst_end_device() to
+ be less redundant
+
+It's already prefixed by dp_mst, so we don't really need to repeat
+ourselves here. One of the changes I should have picked up originally
+when reviewing MST DSC support.
+
+There should be no functional changes here
+
+Cc: Mikita Lipski <mikita.lipski@amd.com>
+Cc: Sean Paul <seanpaul@google.com>
+Cc: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+---
+ drivers/gpu/drm/drm_dp_mst_topology.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
+index cce0b1bba591..9188c53f5c96 100644
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -1935,7 +1935,7 @@ static u8 drm_dp_calculate_rad(struct drm_dp_mst_port *port,
+ 	return parent_lct + 1;
+ }
+ 
+-static bool drm_dp_mst_is_dp_mst_end_device(u8 pdt, bool mcs)
++static bool drm_dp_mst_is_end_device(u8 pdt, bool mcs)
+ {
+ 	switch (pdt) {
+ 	case DP_PEER_DEVICE_DP_LEGACY_CONV:
+@@ -1965,13 +1965,13 @@ drm_dp_port_set_pdt(struct drm_dp_mst_port *port, u8 new_pdt,
+ 
+ 	/* Teardown the old pdt, if there is one */
+ 	if (port->pdt != DP_PEER_DEVICE_NONE) {
+-		if (drm_dp_mst_is_dp_mst_end_device(port->pdt, port->mcs)) {
++		if (drm_dp_mst_is_end_device(port->pdt, port->mcs)) {
+ 			/*
+ 			 * If the new PDT would also have an i2c bus,
+ 			 * don't bother with reregistering it
+ 			 */
+ 			if (new_pdt != DP_PEER_DEVICE_NONE &&
+-			    drm_dp_mst_is_dp_mst_end_device(new_pdt, new_mcs)) {
++			    drm_dp_mst_is_end_device(new_pdt, new_mcs)) {
+ 				port->pdt = new_pdt;
+ 				port->mcs = new_mcs;
+ 				return 0;
+@@ -1991,7 +1991,7 @@ drm_dp_port_set_pdt(struct drm_dp_mst_port *port, u8 new_pdt,
+ 	port->mcs = new_mcs;
+ 
+ 	if (port->pdt != DP_PEER_DEVICE_NONE) {
+-		if (drm_dp_mst_is_dp_mst_end_device(port->pdt, port->mcs)) {
++		if (drm_dp_mst_is_end_device(port->pdt, port->mcs)) {
+ 			/* add i2c over sideband */
+ 			ret = drm_dp_mst_register_i2c_bus(&port->aux);
+ 		} else {
+@@ -2172,7 +2172,7 @@ drm_dp_mst_port_add_connector(struct drm_dp_mst_branch *mstb,
+ 	}
+ 
+ 	if (port->pdt != DP_PEER_DEVICE_NONE &&
+-	    drm_dp_mst_is_dp_mst_end_device(port->pdt, port->mcs)) {
++	    drm_dp_mst_is_end_device(port->pdt, port->mcs)) {
+ 		port->cached_edid = drm_get_edid(port->connector,
+ 						 &port->aux.ddc);
+ 		drm_connector_set_tile_property(port->connector);
+-- 
+2.25.1
+
+From 270862e1b736dc0e7c56a48fbb61b5ec76236982 Mon Sep 17 00:00:00 2001
+From: Lyude Paul <lyude@redhat.com>
+Date: Fri, 6 Mar 2020 18:46:20 -0500
+Subject: [PATCH 2/4] drm/dp_mst: Use full_pbn instead of available_pbn for
+ bandwidth checks
+
+DisplayPort specifications are fun. For a while, it's been really
+unclear to us what available_pbn actually does. There's a somewhat vague
+explanation in the DisplayPort spec (starting from 1.2) that partially
+explains it:
+
+  The minimum payload bandwidth number supported by the path. Each node
+  updates this number with its available payload bandwidth number if its
+  payload bandwidth number is less than that in the Message Transaction
+  reply.
+
+So, it sounds like available_pbn represents the smallest link rate in
+use between the source and the branch device. Cool, so full_pbn is just
+the highest possible PBN that the branch device supports right?
+
+Well, we assumed that for quite a while until Sean Paul noticed that on
+some MST hubs, available_pbn will actually get set to 0 whenever there's
+any active payloads on the respective branch device. This caused quite a
+bit of confusion since clearing the payload ID table would end up fixing
+the available_pbn value.
+
+So, we just went with that until commit cd82d82cbc04 ("drm/dp_mst: Add
+branch bandwidth validation to MST atomic check") started breaking
+people's setups due to us getting erroneous available_pbn values. So, we
+did some more digging and got confused until we finally looked at the
+definition for full_pbn:
+
+  The bandwidth of the link at the trained link rate and lane count
+  between the DP Source device and the DP Sink device with no time slots
+  allocated to VC Payloads, represented as a Payload Bandwidth Number. As
+  with the Available_Payload_Bandwidth_Number, this number is determined
+  by the link with the lowest lane count and link rate.
+
+That's what we get for not reading specs closely enough, hehe. So, since
+full_pbn is definitely what we want for doing bandwidth restriction
+checks - let's start using that instead and ignore available_pbn
+entirely.
+
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Fixes: cd82d82cbc04 ("drm/dp_mst: Add branch bandwidth validation to MST atomic check")
+Cc: Mikita Lipski <mikita.lipski@amd.com>
+Cc: Hans de Goede <hdegoede@redhat.com>
+Cc: Sean Paul <sean@poorly.run>
+---
+ drivers/gpu/drm/drm_dp_mst_topology.c | 15 +++++++--------
+ include/drm/drm_dp_mst_helper.h       |  4 ++--
+ 2 files changed, 9 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
+index 9188c53f5c96..7df7676b45c4 100644
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -2309,7 +2309,7 @@ drm_dp_mst_handle_link_address_port(struct drm_dp_mst_branch *mstb,
+ 								port);
+ 			}
+ 		} else {
+-			port->available_pbn = 0;
++			port->full_pbn = 0;
+ 		}
+ 	}
+ 
+@@ -2404,7 +2404,7 @@ drm_dp_mst_handle_conn_stat(struct drm_dp_mst_branch *mstb,
+ 		if (port->ddps) {
+ 			dowork = true;
+ 		} else {
+-			port->available_pbn = 0;
++			port->full_pbn = 0;
+ 		}
+ 	}
+ 
+@@ -2556,7 +2556,7 @@ static int drm_dp_check_and_send_link_address(struct drm_dp_mst_topology_mgr *mg
+ 		if (port->input || !port->ddps)
+ 			continue;
+ 
+-		if (!port->available_pbn) {
++		if (!port->full_pbn) {
+ 			drm_modeset_lock(&mgr->base.lock, NULL);
+ 			drm_dp_send_enum_path_resources(mgr, mstb, port);
+ 			drm_modeset_unlock(&mgr->base.lock);
+@@ -3002,8 +3002,7 @@ drm_dp_send_enum_path_resources(struct drm_dp_mst_topology_mgr *mgr,
+ 				      path_res->port_number,
+ 				      path_res->full_payload_bw_number,
+ 				      path_res->avail_payload_bw_number);
+-			port->available_pbn =
+-				path_res->avail_payload_bw_number;
++			port->full_pbn = path_res->full_payload_bw_number;
+ 			port->fec_capable = path_res->fec_capable;
+ 		}
+ 	}
+@@ -3598,7 +3597,7 @@ drm_dp_mst_topology_mgr_invalidate_mstb(struct drm_dp_mst_branch *mstb)
+ 
+ 	list_for_each_entry(port, &mstb->ports, next) {
+ 		/* The PBN for each port will also need to be re-probed */
+-		port->available_pbn = 0;
++		port->full_pbn = 0;
+ 
+ 		if (port->mstb)
+ 			drm_dp_mst_topology_mgr_invalidate_mstb(port->mstb);
+@@ -4842,8 +4841,8 @@ int drm_dp_mst_atomic_check_bw_limit(struct drm_dp_mst_branch *branch,
+ 			if (drm_dp_mst_atomic_check_bw_limit(port->mstb, mst_state))
+ 				return -ENOSPC;
+ 
+-		if (port->available_pbn > 0)
+-			pbn_limit = port->available_pbn;
++		if (port->full_pbn > 0)
++			pbn_limit = port->full_pbn;
+ 	}
+ 	DRM_DEBUG_ATOMIC("[MST BRANCH:%p] branch has %d PBN available\n",
+ 			 branch, pbn_limit);
+diff --git a/include/drm/drm_dp_mst_helper.h b/include/drm/drm_dp_mst_helper.h
+index bcb39da9adb4..41725d88d27e 100644
+--- a/include/drm/drm_dp_mst_helper.h
++++ b/include/drm/drm_dp_mst_helper.h
+@@ -81,7 +81,7 @@ struct drm_dp_vcpi {
+  * &drm_dp_mst_topology_mgr.base.lock.
+  * @num_sdp_stream_sinks: Number of stream sinks. Protected by
+  * &drm_dp_mst_topology_mgr.base.lock.
+- * @available_pbn: Available bandwidth for this port. Protected by
++ * @full_pbn: Max possible bandwidth for this port. Protected by
+  * &drm_dp_mst_topology_mgr.base.lock.
+  * @next: link to next port on this branch device
+  * @aux: i2c aux transport to talk to device connected to this port, protected
+@@ -126,7 +126,7 @@ struct drm_dp_mst_port {
+ 	u8 dpcd_rev;
+ 	u8 num_sdp_streams;
+ 	u8 num_sdp_stream_sinks;
+-	uint16_t available_pbn;
++	uint16_t full_pbn;
+ 	struct list_head next;
+ 	/**
+ 	 * @mstb: the branch device connected to this port, if there is one.
+-- 
+2.25.1
+
+From 6fceb6d9d9cdef2e26558f6b75700cc0f07a812c Mon Sep 17 00:00:00 2001
+From: Lyude Paul <lyude@redhat.com>
+Date: Fri, 6 Mar 2020 18:46:21 -0500
+Subject: [PATCH 3/4] drm/dp_mst: Reprobe path resources in CSN handler
+
+We used to punt off reprobing path resources to the link address probe
+work, but now that we handle CSNs asynchronously from the driver's HPD
+handling we can do whatever the heck we want from the CSN!
+
+So, reprobe the path resources from drm_dp_mst_handle_conn_stat(). Also,
+get rid of the path resource reprobing code in
+drm_dp_check_and_send_link_address() since it's needlessly complicated
+when we already reprobe path resources from
+drm_dp_handle_link_address_port(). And finally, teach
+drm_dp_send_enum_path_resources() to return 1 on PBN changes so we know
+if we need to send another hotplug or not.
+
+This fixes issues where we've indicated to userspace that a port has
+just been connected, before we actually probed it's available PBN -
+something that results in unexpected atomic check failures.
+
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Fixes: cd82d82cbc04 ("drm/dp_mst: Add branch bandwidth validation to MST atomic check")
+Cc: Mikita Lipski <mikita.lipski@amd.com>
+Cc: Hans de Goede <hdegoede@redhat.com>
+Cc: Sean Paul <sean@poorly.run>
+---
+ drivers/gpu/drm/drm_dp_mst_topology.c | 48 ++++++++++++++-------------
+ 1 file changed, 25 insertions(+), 23 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
+index 7df7676b45c4..112972031a84 100644
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -2302,12 +2302,16 @@ drm_dp_mst_handle_link_address_port(struct drm_dp_mst_branch *mstb,
+ 		mutex_unlock(&mgr->lock);
+ 	}
+ 
+-	if (old_ddps != port->ddps) {
+-		if (port->ddps) {
+-			if (!port->input) {
+-				drm_dp_send_enum_path_resources(mgr, mstb,
+-								port);
+-			}
++	/*
++	 * Reprobe PBN caps on both hotplug, and when re-probing the link
++	 * for our parent mstb
++	 */
++	if (old_ddps != port->ddps || !created) {
++		if (port->ddps && !port->input) {
++			ret = drm_dp_send_enum_path_resources(mgr, mstb,
++							      port);
++			if (ret == 1)
++				changed = true;
+ 		} else {
+ 			port->full_pbn = 0;
+ 		}
+@@ -2401,11 +2405,10 @@ drm_dp_mst_handle_conn_stat(struct drm_dp_mst_branch *mstb,
+ 	port->ddps = conn_stat->displayport_device_plug_status;
+ 
+ 	if (old_ddps != port->ddps) {
+-		if (port->ddps) {
+-			dowork = true;
+-		} else {
++		if (port->ddps && !port->input)
++			drm_dp_send_enum_path_resources(mgr, mstb, port);
++		else
+ 			port->full_pbn = 0;
+-		}
+ 	}
+ 
+ 	new_pdt = port->input ? DP_PEER_DEVICE_NONE : conn_stat->peer_device_type;
+@@ -2556,13 +2559,6 @@ static int drm_dp_check_and_send_link_address(struct drm_dp_mst_topology_mgr *mg
+ 		if (port->input || !port->ddps)
+ 			continue;
+ 
+-		if (!port->full_pbn) {
+-			drm_modeset_lock(&mgr->base.lock, NULL);
+-			drm_dp_send_enum_path_resources(mgr, mstb, port);
+-			drm_modeset_unlock(&mgr->base.lock);
+-			changed = true;
+-		}
+-
+ 		if (port->mstb)
+ 			mstb_child = drm_dp_mst_topology_get_mstb_validated(
+ 			    mgr, port->mstb);
+@@ -2990,6 +2986,7 @@ drm_dp_send_enum_path_resources(struct drm_dp_mst_topology_mgr *mgr,
+ 
+ 	ret = drm_dp_mst_wait_tx_reply(mstb, txmsg);
+ 	if (ret > 0) {
++		ret = 0;
+ 		path_res = &txmsg->reply.u.path_resources;
+ 
+ 		if (txmsg->reply.reply_type == DP_SIDEBAND_REPLY_NAK) {
+@@ -3002,13 +2999,22 @@ drm_dp_send_enum_path_resources(struct drm_dp_mst_topology_mgr *mgr,
+ 				      path_res->port_number,
+ 				      path_res->full_payload_bw_number,
+ 				      path_res->avail_payload_bw_number);
++
++			/*
++			 * If something changed, make sure we send a
++			 * hotplug
++			 */
++			if (port->full_pbn != path_res->full_payload_bw_number ||
++			    port->fec_capable != path_res->fec_capable)
++				ret = 1;
++
+ 			port->full_pbn = path_res->full_payload_bw_number;
+ 			port->fec_capable = path_res->fec_capable;
+ 		}
+ 	}
+ 
+ 	kfree(txmsg);
+-	return 0;
++	return ret;
+ }
+ 
+ static struct drm_dp_mst_port *drm_dp_get_last_connected_port_to_mstb(struct drm_dp_mst_branch *mstb)
+@@ -3595,13 +3601,9 @@ drm_dp_mst_topology_mgr_invalidate_mstb(struct drm_dp_mst_branch *mstb)
+ 	/* The link address will need to be re-sent on resume */
+ 	mstb->link_address_sent = false;
+ 
+-	list_for_each_entry(port, &mstb->ports, next) {
+-		/* The PBN for each port will also need to be re-probed */
+-		port->full_pbn = 0;
+-
++	list_for_each_entry(port, &mstb->ports, next)
+ 		if (port->mstb)
+ 			drm_dp_mst_topology_mgr_invalidate_mstb(port->mstb);
+-	}
+ }
+ 
+ /**
+-- 
+2.25.1
+
+From 20c8afc6f3f18187517411323a125dfff3c014e7 Mon Sep 17 00:00:00 2001
+From: Lyude Paul <lyude@redhat.com>
+Date: Fri, 6 Mar 2020 18:46:22 -0500
+Subject: [PATCH 4/4] drm/dp_mst: Rewrite and fix bandwidth limit checks
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Sigh, this is mostly my fault for not giving commit cd82d82cbc04
+("drm/dp_mst: Add branch bandwidth validation to MST atomic check")
+enough scrutiny during review. The way we're checking bandwidth
+limitations here is mostly wrong:
+
+For starters, drm_dp_mst_atomic_check_bw_limit() determines the
+pbn_limit of a branch by simply scanning each port on the current branch
+device, then uses the last non-zero full_pbn value that it finds. It
+then counts the sum of the PBN used on each branch device for that
+level, and compares against the full_pbn value it found before.
+
+This is wrong because ports can and will have different PBN limitations
+on many hubs, especially since a number of DisplayPort hubs out there
+will be clever and only use the smallest link rate required for each
+downstream sink - potentially giving every port a different full_pbn
+value depending on what link rate it's trained at. This means with our
+current code, which max PBN value we end up with is not well defined.
+
+Additionally, we also need to remember when checking bandwidth
+limitations that the top-most device in any MST topology is a branch
+device, not a port. This means that the first level of a topology
+doesn't technically have a full_pbn value that needs to be checked.
+Instead, we should assume that so long as our VCPI allocations fit we're
+within the bandwidth limitations of the primary MSTB.
+
+We do however, want to check full_pbn on every port including those of
+the primary MSTB. However, it's important to keep in mind that this
+value represents the minimum link rate /between a port's sink or mstb,
+and the mstb itself/. A quick diagram to explain:
+
+                                MSTB #1
+                               /       \
+                              /         \
+                           Port #1    Port #2
+       full_pbn for Port #1 → |          | ← full_pbn for Port #2
+                           Sink #1    MSTB #2
+                                         |
+                                       etc...
+
+Note that in the above diagram, the combined PBN from all VCPI
+allocations on said hub should not exceed the full_pbn value of port #2,
+and the display configuration on sink #1 should not exceed the full_pbn
+value of port #1. However, port #1 and port #2 can otherwise consume as
+much bandwidth as they want so long as their VCPI allocations still fit.
+
+And finally - our current bandwidth checking code also makes the mistake
+of not checking whether something is an end device or not before trying
+to traverse down it.
+
+So, let's fix it by rewriting our bandwidth checking helpers. We split
+the function into one part for handling branches which simply adds up
+the total PBN on each branch and returns it, and one for checking each
+port to ensure we're not going over its PBN limit. Phew.
+
+This should fix regressions seen, where we erroneously reject display
+configurations due to thinking they're going over our bandwidth limits
+when they're not.
+
+Changes since v1:
+* Took an even closer look at how PBN limitations are supposed to be
+  handled, and did some experimenting with Sean Paul. Ended up rewriting
+  these helpers again, but this time they should actually be correct!
+
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Fixes: cd82d82cbc04 ("drm/dp_mst: Add branch bandwidth validation to MST atomic check")
+Cc: Mikita Lipski <mikita.lipski@amd.com>
+Cc: Sean Paul <seanpaul@google.com>
+Cc: Hans de Goede <hdegoede@redhat.com>
+---
+ drivers/gpu/drm/drm_dp_mst_topology.c | 120 ++++++++++++++++++++------
+ 1 file changed, 94 insertions(+), 26 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
+index 112972031a84..415bd0770eab 100644
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -4830,41 +4830,103 @@ static bool drm_dp_mst_port_downstream_of_branch(struct drm_dp_mst_port *port,
+ 	return false;
+ }
+ 
+-static inline
+-int drm_dp_mst_atomic_check_bw_limit(struct drm_dp_mst_branch *branch,
+-				     struct drm_dp_mst_topology_state *mst_state)
++static int
++drm_dp_mst_atomic_check_port_bw_limit(struct drm_dp_mst_port *port,
++				      struct drm_dp_mst_topology_state *state);
++
++static int
++drm_dp_mst_atomic_check_mstb_bw_limit(struct drm_dp_mst_branch *mstb,
++				      struct drm_dp_mst_topology_state *state)
+ {
+-	struct drm_dp_mst_port *port;
+ 	struct drm_dp_vcpi_allocation *vcpi;
+-	int pbn_limit = 0, pbn_used = 0;
++	struct drm_dp_mst_port *port;
++	int pbn_used = 0, ret;
++	bool found = false;
+ 
+-	list_for_each_entry(port, &branch->ports, next) {
+-		if (port->mstb)
+-			if (drm_dp_mst_atomic_check_bw_limit(port->mstb, mst_state))
+-				return -ENOSPC;
++	/* Check that we have at least one port in our state that's downstream
++	 * of this branch, otherwise we can skip this branch
++	 */
++	list_for_each_entry(vcpi, &state->vcpis, next) {
++		if (!vcpi->pbn ||
++		    !drm_dp_mst_port_downstream_of_branch(vcpi->port,
++							  mstb))
++			continue;
+ 
+-		if (port->full_pbn > 0)
+-			pbn_limit = port->full_pbn;
++		found = true;
++		break;
+ 	}
+-	DRM_DEBUG_ATOMIC("[MST BRANCH:%p] branch has %d PBN available\n",
+-			 branch, pbn_limit);
++	if (!found)
++		return 0;
+ 
+-	list_for_each_entry(vcpi, &mst_state->vcpis, next) {
+-		if (!vcpi->pbn)
+-			continue;
++	if (mstb->port_parent)
++		DRM_DEBUG_ATOMIC("[MSTB:%p] [MST PORT:%p] Checking bandwidth limits on [MSTB:%p]\n",
++				 mstb->port_parent->parent, mstb->port_parent,
++				 mstb);
++	else
++		DRM_DEBUG_ATOMIC("[MSTB:%p] Checking bandwidth limits\n",
++				 mstb);
++
++	list_for_each_entry(port, &mstb->ports, next) {
++		ret = drm_dp_mst_atomic_check_port_bw_limit(port, state);
++		if (ret < 0)
++			return ret;
+ 
+-		if (drm_dp_mst_port_downstream_of_branch(vcpi->port, branch))
+-			pbn_used += vcpi->pbn;
++		pbn_used += ret;
+ 	}
+-	DRM_DEBUG_ATOMIC("[MST BRANCH:%p] branch used %d PBN\n",
+-			 branch, pbn_used);
+ 
+-	if (pbn_used > pbn_limit) {
+-		DRM_DEBUG_ATOMIC("[MST BRANCH:%p] No available bandwidth\n",
+-				 branch);
++	return pbn_used;
++}
++
++static int
++drm_dp_mst_atomic_check_port_bw_limit(struct drm_dp_mst_port *port,
++				      struct drm_dp_mst_topology_state *state)
++{
++	struct drm_dp_vcpi_allocation *vcpi;
++	int pbn_used = 0;
++
++	if (port->pdt == DP_PEER_DEVICE_NONE)
++		return 0;
++
++	if (drm_dp_mst_is_end_device(port->pdt, port->mcs)) {
++		bool found = false;
++
++		list_for_each_entry(vcpi, &state->vcpis, next) {
++			if (vcpi->port != port)
++				continue;
++			if (!vcpi->pbn)
++				return 0;
++
++			found = true;
++			break;
++		}
++		if (!found)
++			return 0;
++
++		/* This should never happen, as it means we tried to
++		 * set a mode before querying the full_pbn
++		 */
++		if (WARN_ON(!port->full_pbn))
++			return -EINVAL;
++
++		pbn_used = vcpi->pbn;
++	} else {
++		pbn_used = drm_dp_mst_atomic_check_mstb_bw_limit(port->mstb,
++								 state);
++		if (pbn_used <= 0)
++			return 0;
++	}
++
++	if (pbn_used > port->full_pbn) {
++		DRM_DEBUG_ATOMIC("[MSTB:%p] [MST PORT:%p] required PBN of %d exceeds port limit of %d\n",
++				 port->parent, port, pbn_used,
++				 port->full_pbn);
+ 		return -ENOSPC;
+ 	}
+-	return 0;
++
++	DRM_DEBUG_ATOMIC("[MSTB:%p] [MST PORT:%p] uses %d out of %d PBN\n",
++			 port->parent, port, pbn_used, port->full_pbn);
++
++	return pbn_used;
+ }
+ 
+ static inline int
+@@ -5062,9 +5124,15 @@ int drm_dp_mst_atomic_check(struct drm_atomic_state *state)
+ 		ret = drm_dp_mst_atomic_check_vcpi_alloc_limit(mgr, mst_state);
+ 		if (ret)
+ 			break;
+-		ret = drm_dp_mst_atomic_check_bw_limit(mgr->mst_primary, mst_state);
+-		if (ret)
++
++		mutex_lock(&mgr->lock);
++		ret = drm_dp_mst_atomic_check_mstb_bw_limit(mgr->mst_primary,
++							    mst_state);
++		mutex_unlock(&mgr->lock);
++		if (ret < 0)
+ 			break;
++		else
++			ret = 0;
+ 	}
+ 
+ 	return ret;
+-- 
+2.25.1
+
diff --git a/iommu-WARN_TAINT-fixes.patch b/iommu-WARN_TAINT-fixes.patch
new file mode 100644
index 000000000..5cb4aa973
--- /dev/null
+++ b/iommu-WARN_TAINT-fixes.patch
@@ -0,0 +1,164 @@
+From 2f2265a8cbc6b43deb169c525204ea7df02e9363 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Mon, 9 Mar 2020 13:55:02 +0100
+Subject: [PATCH 1/2] iommu/vt-d: dmar: replace WARN_TAINT with pr_warn +
+ add_taint
+
+Quoting from the comment describing the WARN functions in
+include/asm-generic/bug.h:
+
+ * WARN(), WARN_ON(), WARN_ON_ONCE, and so on can be used to report
+ * significant kernel issues that need prompt attention if they should ever
+ * appear at runtime.
+ *
+ * Do not use these macros when checking for invalid external inputs
+
+The (buggy) firmware tables which the dmar code was calling WARN_TAINT
+for really are invalid external inputs. They are not under the kernel's
+control and the issues in them cannot be fixed by a kernel update.
+So logging a backtrace, which invites bug reports to be filed about this,
+is not helpful.
+
+Some distros, e.g. Fedora, have tools watching for the kernel backtraces
+logged by the WARN macros and offer the user an option to file a bug for
+this when these are encountered. The WARN_TAINT in warn_invalid_dmar()
++ another iommu WARN_TAINT, addressed in another patch, have lead to over
+a 100 bugs being filed this way.
+
+This commit replaces the WARN_TAINT("...") calls, with
+pr_warn(FW_BUG "...") + add_taint(TAINT_FIRMWARE_WORKAROUND, ...) calls
+avoiding the backtrace and thus also avoiding bug-reports being filed
+about this against the kernel.
+
+BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1564895
+Fixes: e625b4a95d50 ("iommu/vt-d: Parse ANDD records")
+Fixes: fd0c8894893c ("intel-iommu: Set a more specific taint flag for invalid BI
+Cc: stable@vger.kernel.org
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ drivers/iommu/dmar.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
+index 071bb42bbbc5..87194a46cb0b 100644
+--- a/drivers/iommu/dmar.c
++++ b/drivers/iommu/dmar.c
+@@ -440,12 +440,13 @@ static int __init dmar_parse_one_andd(struct acpi_dmar_header *header,
+ 
+ 	/* Check for NUL termination within the designated length */
+ 	if (strnlen(andd->device_name, header->length - 8) == header->length - 8) {
+-		WARN_TAINT(1, TAINT_FIRMWARE_WORKAROUND,
++		pr_warn(FW_BUG
+ 			   "Your BIOS is broken; ANDD object name is not NUL-terminated\n"
+ 			   "BIOS vendor: %s; Ver: %s; Product Version: %s\n",
+ 			   dmi_get_system_info(DMI_BIOS_VENDOR),
+ 			   dmi_get_system_info(DMI_BIOS_VERSION),
+ 			   dmi_get_system_info(DMI_PRODUCT_VERSION));
++		add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_STILL_OK);
+ 		return -EINVAL;
+ 	}
+ 	pr_info("ANDD device: %x name: %s\n", andd->device_number,
+@@ -471,14 +472,14 @@ static int dmar_parse_one_rhsa(struct acpi_dmar_header *header, void *arg)
+ 			return 0;
+ 		}
+ 	}
+-	WARN_TAINT(
+-		1, TAINT_FIRMWARE_WORKAROUND,
++	pr_warn(FW_BUG
+ 		"Your BIOS is broken; RHSA refers to non-existent DMAR unit at %llx\n"
+ 		"BIOS vendor: %s; Ver: %s; Product Version: %s\n",
+ 		drhd->reg_base_addr,
+ 		dmi_get_system_info(DMI_BIOS_VENDOR),
+ 		dmi_get_system_info(DMI_BIOS_VERSION),
+ 		dmi_get_system_info(DMI_PRODUCT_VERSION));
++	add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_STILL_OK);
+ 
+ 	return 0;
+ }
+@@ -827,14 +828,14 @@ int __init dmar_table_init(void)
+ 
+ static void warn_invalid_dmar(u64 addr, const char *message)
+ {
+-	WARN_TAINT_ONCE(
+-		1, TAINT_FIRMWARE_WORKAROUND,
++	pr_warn_once(FW_BUG
+ 		"Your BIOS is broken; DMAR reported at address %llx%s!\n"
+ 		"BIOS vendor: %s; Ver: %s; Product Version: %s\n",
+ 		addr, message,
+ 		dmi_get_system_info(DMI_BIOS_VENDOR),
+ 		dmi_get_system_info(DMI_BIOS_VERSION),
+ 		dmi_get_system_info(DMI_PRODUCT_VERSION));
++	add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_STILL_OK);
+ }
+ 
+ static int __ref
+-- 
+2.25.1
+
+From 038ebd8952c5fb3ba3b5e09b0b55a4e617ae22bf Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Mon, 9 Mar 2020 14:12:37 +0100
+Subject: [PATCH 2/2] iommu/vt-d: dmar_parse_one_rmrr: replace WARN_TAINT with
+ pr_warn + add_taint
+
+Quoting from the comment describing the WARN functions in
+include/asm-generic/bug.h:
+
+ * WARN(), WARN_ON(), WARN_ON_ONCE, and so on can be used to report
+ * significant kernel issues that need prompt attention if they should ever
+ * appear at runtime.
+ *
+ * Do not use these macros when checking for invalid external inputs
+
+The (buggy) firmware tables which the dmar code was calling WARN_TAINT
+for really are invalid external inputs. They are not under the kernel's
+control and the issues in them cannot be fixed by a kernel update.
+So logging a backtrace, which invites bug reports to be filed about this,
+is not helpful.
+
+Some distros, e.g. Fedora, have tools watching for the kernel backtraces
+logged by the WARN macros and offer the user an option to file a bug for
+this when these are encountered. The WARN_TAINT in dmar_parse_one_rmrr
++ another iommu WARN_TAINT, addressed in another patch, have lead to over
+a 100 bugs being filed this way.
+
+This commit replaces the WARN_TAINT("...") call, with a
+pr_warn(FW_BUG "...") + add_taint(TAINT_FIRMWARE_WORKAROUND, ...) call
+avoiding the backtrace and thus also avoiding bug-reports being filed
+about this against the kernel.
+
+BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1808874
+Fixes: f5a68bb0752e ("iommu/vt-d: Mark firmware tainted if RMRR fails sanity check")
+Cc: Barret Rhoden <brho@google.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ drivers/iommu/intel-iommu.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index 6fa6de2b6ad5..3857a5cd1a75 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -4460,14 +4460,16 @@ int __init dmar_parse_one_rmrr(struct acpi_dmar_header *header, void *arg)
+ 	struct dmar_rmrr_unit *rmrru;
+ 
+ 	rmrr = (struct acpi_dmar_reserved_memory *)header;
+-	if (rmrr_sanity_check(rmrr))
+-		WARN_TAINT(1, TAINT_FIRMWARE_WORKAROUND,
++	if (rmrr_sanity_check(rmrr)) {
++		pr_warn(FW_BUG
+ 			   "Your BIOS is broken; bad RMRR [%#018Lx-%#018Lx]\n"
+ 			   "BIOS vendor: %s; Ver: %s; Product Version: %s\n",
+ 			   rmrr->base_address, rmrr->end_address,
+ 			   dmi_get_system_info(DMI_BIOS_VENDOR),
+ 			   dmi_get_system_info(DMI_BIOS_VERSION),
+ 			   dmi_get_system_info(DMI_PRODUCT_VERSION));
++		add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_STILL_OK);
++	}
+ 
+ 	rmrru = kzalloc(sizeof(*rmrru), GFP_KERNEL);
+ 	if (!rmrru)
+-- 
+2.25.1
+
diff --git a/kernel.spec b/kernel.spec
index 4f68ea776..aa807220b 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -879,6 +879,17 @@ Patch504: 0001-mm-kmemleak-skip-late_init-if-not-skip-disable.patch
 # https://lkml.org/lkml/2019/8/29/1772
 Patch505: ARM-fix-__get_user_check-in-case-uaccess_-calls-are-not-inlined.patch
 
+# Fix issues with only 1 monitor working on DP-MST docks (rhbz#1809681)
+# These patches should show up in a future 5.6-rc# release
+Patch506: drm-dp-mst-fixes.patch
+
+# More DP-MST fixes, pending for 5.7
+Patch507: drm-dp-mst-error-handling-improvements.patch
+
+# Fix backtraces triggered by warnings about buggy BIOS (rhbz 1564895, 1808874)
+# Submitted upstream
+Patch508: iommu-WARN_TAINT-fixes.patch
+
 # END OF PATCH DEFINITIONS
 
 %endif
@@ -2952,6 +2963,12 @@ fi
 #
 #
 %changelog
+* Mon Mar 09 2020 Hans de Goede <hdegoede@redhat.com>
+- Fix only 1 monitor working on DP-MST docking stations (rhbz 1809681)
+- Fix backtraces on various buggy BIOS-es (rhbz 1564895, 1808874)
+- Add /etc/modprobe.d/floppy-blacklist.conf to fix auto-loading of the
+  legacy floppy driver (rhbz 1789155)
+
 * Mon Mar 09 2020 Peter Robinson <pbrobinson@gmail.com> - 5.6.0-0.rc5.git0.1
 - Linux v5.6-rc5
 
diff --git a/mod-extra-blacklist.sh b/mod-extra-blacklist.sh
index 9569ef6f2..c4c4f8f6d 100755
--- a/mod-extra-blacklist.sh
+++ b/mod-extra-blacklist.sh
@@ -46,3 +46,11 @@ foreachp()
 [ -d "$buildroot/etc/modprobe.d/" ] || mkdir -p "$buildroot/etc/modprobe.d/"
 find "$buildroot/$kernel_base/extra" -name "*.ko*" | \
 	foreachp check_blacklist
+
+# Many BIOS-es export a PNP-id which causes the floppy driver to autoload
+# even though most modern systems don't have a 3.5" floppy driver anymore
+# this replaces the old die_floppy_die.patch which removed the PNP-id from
+# the module
+if [ -f $buildroot/$kernel_base/extra/drivers/block/floppy.ko* ]; then
+	blacklist "floppy"
+fi