--- /dev/null
+From d22a16cc92e04d053fd807ef3587e4f135e4206f Mon Sep 17 00:00:00 2001
+From: Frieder Schrempf <frieder.schrempf@kontron.de>
+Date: Thu, 28 May 2020 14:43:43 +0000
+Subject: ARM: dts: imx6ul-kontron: Change WDOG_ANY signal from push-pull to open-drain
+
+From: Frieder Schrempf <frieder.schrempf@kontron.de>
+
+commit d22a16cc92e04d053fd807ef3587e4f135e4206f upstream.
+
+The WDOG_ANY signal is connected to the RESET_IN signal of the SoM
+and baseboard. It is currently configured as push-pull, which means
+that if some external device like a programmer wants to assert the
+RESET_IN signal by pulling it to ground, it drives against the high
+level WDOG_ANY output of the SoC.
+
+To fix this we set the WDOG_ANY signal to open-drain configuration.
+That way we make sure that the RESET_IN can be asserted by the
+watchdog as well as by external devices.
+
+Fixes: 1ea4b76cdfde ("ARM: dts: imx6ul-kontron-n6310: Add Kontron i.MX6UL N6310 SoM and boards")
+Cc: stable@vger.kernel.org
+Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/imx6ul-kontron-n6x1x-som-common.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/imx6ul-kontron-n6x1x-som-common.dtsi
++++ b/arch/arm/boot/dts/imx6ul-kontron-n6x1x-som-common.dtsi
+@@ -116,7 +116,7 @@
+
+ pinctrl_wdog: wdoggrp {
+ fsl,pins = <
+- MX6UL_PAD_GPIO1_IO09__WDOG1_WDOG_ANY 0x30b0
++ MX6UL_PAD_GPIO1_IO09__WDOG1_WDOG_ANY 0x18b0
+ >;
+ };
+ };
--- /dev/null
+From 04a2c05179b732a4c097f0a9c701ef4c9a37e1e3 Mon Sep 17 00:00:00 2001
+From: Frieder Schrempf <frieder.schrempf@kontron.de>
+Date: Thu, 28 May 2020 14:43:42 +0000
+Subject: ARM: dts: imx6ul-kontron: Move watchdog from Kontron i.MX6UL/ULL board to SoM
+
+From: Frieder Schrempf <frieder.schrempf@kontron.de>
+
+commit 04a2c05179b732a4c097f0a9c701ef4c9a37e1e3 upstream.
+
+The watchdog's WDOG_ANY signal is used to trigger a POR of the SoC,
+if a soft reset is issued. As the SoM hardware connects the WDOG_ANY
+and the POR signals, the watchdog node itself and the pin
+configuration should be part of the common SoM devicetree.
+Let's move it from the baseboard's devicetree to its proper place.
+
+Fixes: 1ea4b76cdfde ("ARM: dts: imx6ul-kontron-n6310: Add Kontron i.MX6UL N6310 SoM and boards")
+Cc: stable@vger.kernel.org
+Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/imx6ul-kontron-n6x1x-s.dtsi | 13 -------------
+ arch/arm/boot/dts/imx6ul-kontron-n6x1x-som-common.dtsi | 13 +++++++++++++
+ 2 files changed, 13 insertions(+), 13 deletions(-)
+
+--- a/arch/arm/boot/dts/imx6ul-kontron-n6x1x-s.dtsi
++++ b/arch/arm/boot/dts/imx6ul-kontron-n6x1x-s.dtsi
+@@ -232,13 +232,6 @@
+ status = "okay";
+ };
+
+-&wdog1 {
+- pinctrl-names = "default";
+- pinctrl-0 = <&pinctrl_wdog>;
+- fsl,ext-reset-output;
+- status = "okay";
+-};
+-
+ &iomuxc {
+ pinctrl-0 = <&pinctrl_reset_out &pinctrl_gpio>;
+
+@@ -409,10 +402,4 @@
+ MX6UL_PAD_NAND_DATA03__USDHC2_DATA3 0x170f9
+ >;
+ };
+-
+- pinctrl_wdog: wdoggrp {
+- fsl,pins = <
+- MX6UL_PAD_GPIO1_IO09__WDOG1_WDOG_ANY 0x30b0
+- >;
+- };
+ };
+--- a/arch/arm/boot/dts/imx6ul-kontron-n6x1x-som-common.dtsi
++++ b/arch/arm/boot/dts/imx6ul-kontron-n6x1x-som-common.dtsi
+@@ -57,6 +57,13 @@
+ status = "okay";
+ };
+
++&wdog1 {
++ pinctrl-names = "default";
++ pinctrl-0 = <&pinctrl_wdog>;
++ fsl,ext-reset-output;
++ status = "okay";
++};
++
+ &iomuxc {
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_reset_out>;
+@@ -106,4 +113,10 @@
+ MX6UL_PAD_SNVS_TAMPER9__GPIO5_IO09 0x1b0b0
+ >;
+ };
++
++ pinctrl_wdog: wdoggrp {
++ fsl,pins = <
++ MX6UL_PAD_GPIO1_IO09__WDOG1_WDOG_ANY 0x30b0
++ >;
++ };
+ };
--- /dev/null
+From d35bd764e6899a7bea71958f08d16cea5bfa1919 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Fri, 19 Jun 2020 11:51:34 -0400
+Subject: dm writecache: add cond_resched to loop in persistent_memory_claim()
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit d35bd764e6899a7bea71958f08d16cea5bfa1919 upstream.
+
+Add cond_resched() to a loop that fills in the mapper memory area
+because the loop can be executed many times.
+
+Fixes: 48debafe4f2fe ("dm: add writecache target")
+Cc: stable@vger.kernel.org
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-writecache.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/md/dm-writecache.c
++++ b/drivers/md/dm-writecache.c
+@@ -286,6 +286,8 @@ static int persistent_memory_claim(struc
+ while (daa-- && i < p) {
+ pages[i++] = pfn_t_to_page(pfn);
+ pfn.val++;
++ if (!(i & 15))
++ cond_resched();
+ }
+ } while (i < p);
+ wc->memory_map = vmap(pages, p, VM_MAP, PAGE_KERNEL);
--- /dev/null
+From 39495b12ef1cf602e6abd350dce2ef4199906531 Mon Sep 17 00:00:00 2001
+From: Huaisheng Ye <yehs1@lenovo.com>
+Date: Fri, 12 Jun 2020 23:59:11 +0800
+Subject: dm writecache: correct uncommitted_block when discarding uncommitted entry
+
+From: Huaisheng Ye <yehs1@lenovo.com>
+
+commit 39495b12ef1cf602e6abd350dce2ef4199906531 upstream.
+
+When uncommitted entry has been discarded, correct wc->uncommitted_block
+for getting the exact number.
+
+Fixes: 48debafe4f2fe ("dm: add writecache target")
+Cc: stable@vger.kernel.org
+Signed-off-by: Huaisheng Ye <yehs1@lenovo.com>
+Acked-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-writecache.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/md/dm-writecache.c
++++ b/drivers/md/dm-writecache.c
+@@ -857,6 +857,8 @@ static void writecache_discard(struct dm
+ writecache_wait_for_ios(wc, WRITE);
+ discarded_something = true;
+ }
++ if (!writecache_entry_is_committed(wc, e))
++ wc->uncommitted_blocks--;
+ writecache_free_entry(wc, e);
+ }
+
--- /dev/null
+From 5ae9c378c3d88b40af72f8e8f961808e29f3e70b Mon Sep 17 00:00:00 2001
+From: Stylon Wang <stylon.wang@amd.com>
+Date: Mon, 1 Jun 2020 16:12:09 +0800
+Subject: drm/amd/display: Enable output_bpc property on all outputs
+
+From: Stylon Wang <stylon.wang@amd.com>
+
+commit 5ae9c378c3d88b40af72f8e8f961808e29f3e70b upstream.
+
+[Why]
+Connector property output_bpc is available on DP/eDP only. New IGT tests
+would benifit if this property works on HDMI.
+
+[How]
+Enable this read-only property on all types of connectors.
+
+Signed-off-by: Stylon Wang <stylon.wang@amd.com>
+Reviewed-by: Nicholas Kazlauskas <Nicholas.Kazlauskas@amd.com>
+Acked-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
+@@ -1017,7 +1017,6 @@ static const struct {
+ {"link_settings", &dp_link_settings_debugfs_fops},
+ {"phy_settings", &dp_phy_settings_debugfs_fop},
+ {"test_pattern", &dp_phy_test_pattern_fops},
+- {"output_bpc", &output_bpc_fops},
+ {"vrr_range", &vrr_range_fops},
+ {"sdp_message", &sdp_message_fops},
+ {"aux_dpcd_address", &dp_dpcd_address_debugfs_fops},
+@@ -1090,6 +1089,9 @@ void connector_debugfs_init(struct amdgp
+ debugfs_create_file_unsafe("force_yuv420_output", 0644, dir, connector,
+ &force_yuv420_output_fops);
+
++ debugfs_create_file("output_bpc", 0644, dir, connector,
++ &output_bpc_fops);
++
+ connector->debugfs_dpcd_address = 0;
+ connector->debugfs_dpcd_size = 0;
+
--- /dev/null
+From b5b78a6c8d8cb9c307bc6b16a754603424459d6e Mon Sep 17 00:00:00 2001
+From: Bernard Zhao <bernard@vivo.com>
+Date: Sat, 20 Jun 2020 17:11:52 +0800
+Subject: drm/amd: fix potential memleak in err branch
+
+From: Bernard Zhao <bernard@vivo.com>
+
+commit b5b78a6c8d8cb9c307bc6b16a754603424459d6e upstream.
+
+The function kobject_init_and_add alloc memory like:
+kobject_init_and_add->kobject_add_varg->kobject_set_name_vargs
+->kvasprintf_const->kstrdup_const->kstrdup->kmalloc_track_caller
+->kmalloc_slab, in err branch this memory not free. If use
+kmemleak, this path maybe catched.
+These changes are to add kobject_put in kobject_init_and_add
+failed branch, fix potential memleak.
+
+Signed-off-by: Bernard Zhao <bernard@vivo.com>
+Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_process.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_process.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_process.c
+@@ -396,6 +396,7 @@ struct kfd_process *kfd_create_process(s
+ (int)process->lead_thread->pid);
+ if (ret) {
+ pr_warn("Creating procfs pid directory failed");
++ kobject_put(process->kobj);
+ goto out;
+ }
+
--- /dev/null
+From edfaf6fa73f15568d4337f208b2333f647c35810 Mon Sep 17 00:00:00 2001
+From: Wenhui Sheng <Wenhui.Sheng@amd.com>
+Date: Thu, 18 Jun 2020 15:37:04 +0800
+Subject: drm/amdgpu: add fw release for sdma v5_0
+
+From: Wenhui Sheng <Wenhui.Sheng@amd.com>
+
+commit edfaf6fa73f15568d4337f208b2333f647c35810 upstream.
+
+sdma fw isn't released when module exit
+
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Signed-off-by: Wenhui Sheng <Wenhui.Sheng@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c
+@@ -1261,8 +1261,12 @@ static int sdma_v5_0_sw_fini(void *handl
+ struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+ int i;
+
+- for (i = 0; i < adev->sdma.num_instances; i++)
++ for (i = 0; i < adev->sdma.num_instances; i++) {
++ if (adev->sdma.instance[i].fw != NULL)
++ release_firmware(adev->sdma.instance[i].fw);
++
+ amdgpu_ring_fini(&adev->sdma.instance[i].ring);
++ }
+
+ return 0;
+ }
--- /dev/null
+From ee434a4f9f5ea15b0f84bddd8c012838cf9472c5 Mon Sep 17 00:00:00 2001
+From: John van der Kamp <sjonny@suffe.me.uk>
+Date: Tue, 23 Jun 2020 23:30:54 +0200
+Subject: drm/amdgpu/display: Unlock mutex on error
+
+From: John van der Kamp <sjonny@suffe.me.uk>
+
+commit ee434a4f9f5ea15b0f84bddd8c012838cf9472c5 upstream.
+
+Make sure we pass through ret label to unlock the mutex.
+
+Signed-off-by: John van der Kamp <sjonny@suffe.me.uk>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c
+@@ -510,8 +510,10 @@ static ssize_t srm_data_read(struct file
+
+ srm = psp_get_srm(work->hdcp.config.psp.handle, &srm_version, &srm_size);
+
+- if (!srm)
+- return -EINVAL;
++ if (!srm) {
++ ret = -EINVAL;
++ goto ret;
++ }
+
+ if (pos >= srm_size)
+ ret = 0;
--- /dev/null
+From dc5bdb68b5b369d5bc7d1de96fa64cc1737a6320 Mon Sep 17 00:00:00 2001
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date: Wed, 24 Jun 2020 11:29:10 +0200
+Subject: drm/fb-helper: Fix vt restore
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+
+commit dc5bdb68b5b369d5bc7d1de96fa64cc1737a6320 upstream.
+
+In the past we had a pile of hacks to orchestrate access between fbdev
+emulation and native kms clients. We've tried to streamline this, by
+always preferring the kms side above fbdev calls when a drm master
+exists, because drm master controls access to the display resources.
+
+Unfortunately this breaks existing userspace, specifically Xorg. When
+exiting Xorg first restores the console to text mode using the KDSET
+ioctl on the vt. This does nothing, because a drm master is still
+around. Then it drops the drm master status, which again does nothing,
+because logind is keeping additional drm fd open to be able to
+orchestrate vt switches. In the past this is the point where fbdev was
+restored, as part of the ->lastclose hook on the drm side.
+
+Now to fix this regression we don't want to go back to letting fbdev
+restore things whenever it feels like, or to the pile of hacks we've
+had before. Instead try and go with a minimal exception to make the
+KDSET case work again, and nothing else.
+
+This means that if userspace does a KDSET call when switching between
+graphical compositors, there will be some flickering with fbcon
+showing up for a bit. But a) that's not a regression and b) userspace
+can fix it by improving the vt switching dance - logind should have
+all the information it needs.
+
+While pondering all this I'm also wondering wheter we should have a
+SWITCH_MASTER ioctl to allow race-free master status handover. But
+that's for another day.
+
+v2: Somehow forgot to cc all the fbdev people.
+
+v3: Fix typo Alex spotted.
+
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=208179
+Cc: shlomo@fastmail.com
+Reported-and-Tested-by: shlomo@fastmail.com
+Cc: Michel Dänzer <michel@daenzer.net>
+Fixes: 64914da24ea9 ("drm/fbdev-helper: don't force restores")
+Cc: Noralf Trønnes <noralf@tronnes.org>
+Cc: Thomas Zimmermann <tzimmermann@suse.de>
+Cc: Daniel Vetter <daniel.vetter@intel.com>
+Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Cc: Maxime Ripard <mripard@kernel.org>
+Cc: David Airlie <airlied@linux.ie>
+Cc: Daniel Vetter <daniel@ffwll.ch>
+Cc: dri-devel@lists.freedesktop.org
+Cc: <stable@vger.kernel.org> # v5.7+
+Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Cc: Geert Uytterhoeven <geert@linux-m68k.org>
+Cc: Nathan Chancellor <natechancellor@gmail.com>
+Cc: Qiujun Huang <hqjagain@gmail.com>
+Cc: Peter Rosin <peda@axentia.se>
+Cc: linux-fbdev@vger.kernel.org
+Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200624092910.3280448-1-daniel.vetter@ffwll.ch
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_fb_helper.c | 63 ++++++++++++++++++++++++++++++---------
+ drivers/video/fbdev/core/fbcon.c | 3 +
+ include/uapi/linux/fb.h | 1
+ 3 files changed, 52 insertions(+), 15 deletions(-)
+
+--- a/drivers/gpu/drm/drm_fb_helper.c
++++ b/drivers/gpu/drm/drm_fb_helper.c
+@@ -227,18 +227,9 @@ int drm_fb_helper_debug_leave(struct fb_
+ }
+ EXPORT_SYMBOL(drm_fb_helper_debug_leave);
+
+-/**
+- * drm_fb_helper_restore_fbdev_mode_unlocked - restore fbdev configuration
+- * @fb_helper: driver-allocated fbdev helper, can be NULL
+- *
+- * This should be called from driver's drm &drm_driver.lastclose callback
+- * when implementing an fbcon on top of kms using this helper. This ensures that
+- * the user isn't greeted with a black screen when e.g. X dies.
+- *
+- * RETURNS:
+- * Zero if everything went ok, negative error code otherwise.
+- */
+-int drm_fb_helper_restore_fbdev_mode_unlocked(struct drm_fb_helper *fb_helper)
++static int
++__drm_fb_helper_restore_fbdev_mode_unlocked(struct drm_fb_helper *fb_helper,
++ bool force)
+ {
+ bool do_delayed;
+ int ret;
+@@ -250,7 +241,16 @@ int drm_fb_helper_restore_fbdev_mode_unl
+ return 0;
+
+ mutex_lock(&fb_helper->lock);
+- ret = drm_client_modeset_commit(&fb_helper->client);
++ if (force) {
++ /*
++ * Yes this is the _locked version which expects the master lock
++ * to be held. But for forced restores we're intentionally
++ * racing here, see drm_fb_helper_set_par().
++ */
++ ret = drm_client_modeset_commit_locked(&fb_helper->client);
++ } else {
++ ret = drm_client_modeset_commit(&fb_helper->client);
++ }
+
+ do_delayed = fb_helper->delayed_hotplug;
+ if (do_delayed)
+@@ -262,6 +262,22 @@ int drm_fb_helper_restore_fbdev_mode_unl
+
+ return ret;
+ }
++
++/**
++ * drm_fb_helper_restore_fbdev_mode_unlocked - restore fbdev configuration
++ * @fb_helper: driver-allocated fbdev helper, can be NULL
++ *
++ * This should be called from driver's drm &drm_driver.lastclose callback
++ * when implementing an fbcon on top of kms using this helper. This ensures that
++ * the user isn't greeted with a black screen when e.g. X dies.
++ *
++ * RETURNS:
++ * Zero if everything went ok, negative error code otherwise.
++ */
++int drm_fb_helper_restore_fbdev_mode_unlocked(struct drm_fb_helper *fb_helper)
++{
++ return __drm_fb_helper_restore_fbdev_mode_unlocked(fb_helper, false);
++}
+ EXPORT_SYMBOL(drm_fb_helper_restore_fbdev_mode_unlocked);
+
+ #ifdef CONFIG_MAGIC_SYSRQ
+@@ -1310,6 +1326,7 @@ int drm_fb_helper_set_par(struct fb_info
+ {
+ struct drm_fb_helper *fb_helper = info->par;
+ struct fb_var_screeninfo *var = &info->var;
++ bool force;
+
+ if (oops_in_progress)
+ return -EBUSY;
+@@ -1319,7 +1336,25 @@ int drm_fb_helper_set_par(struct fb_info
+ return -EINVAL;
+ }
+
+- drm_fb_helper_restore_fbdev_mode_unlocked(fb_helper);
++ /*
++ * Normally we want to make sure that a kms master takes precedence over
++ * fbdev, to avoid fbdev flickering and occasionally stealing the
++ * display status. But Xorg first sets the vt back to text mode using
++ * the KDSET IOCTL with KD_TEXT, and only after that drops the master
++ * status when exiting.
++ *
++ * In the past this was caught by drm_fb_helper_lastclose(), but on
++ * modern systems where logind always keeps a drm fd open to orchestrate
++ * the vt switching, this doesn't work.
++ *
++ * To not break the userspace ABI we have this special case here, which
++ * is only used for the above case. Everything else uses the normal
++ * commit function, which ensures that we never steal the display from
++ * an active drm master.
++ */
++ force = var->activate & FB_ACTIVATE_KD_TEXT;
++
++ __drm_fb_helper_restore_fbdev_mode_unlocked(fb_helper, force);
+
+ return 0;
+ }
+--- a/drivers/video/fbdev/core/fbcon.c
++++ b/drivers/video/fbdev/core/fbcon.c
+@@ -2402,7 +2402,8 @@ static int fbcon_blank(struct vc_data *v
+ ops->graphics = 1;
+
+ if (!blank) {
+- var.activate = FB_ACTIVATE_NOW | FB_ACTIVATE_FORCE;
++ var.activate = FB_ACTIVATE_NOW | FB_ACTIVATE_FORCE |
++ FB_ACTIVATE_KD_TEXT;
+ fb_set_var(info, &var);
+ ops->graphics = 0;
+ ops->var = info->var;
+--- a/include/uapi/linux/fb.h
++++ b/include/uapi/linux/fb.h
+@@ -205,6 +205,7 @@ struct fb_bitfield {
+ #define FB_ACTIVATE_ALL 64 /* change all VCs on this fb */
+ #define FB_ACTIVATE_FORCE 128 /* force apply even when no change*/
+ #define FB_ACTIVATE_INV_MODE 256 /* invalidate videomode */
++#define FB_ACTIVATE_KD_TEXT 512 /* for KDSET vt ioctl */
+
+ #define FB_ACCELF_TEXT 1 /* (OBSOLETE) see fb_info.flags and vc_mode */
+
--- /dev/null
+From efb94790852ae673b18efde1b171d284689ff333 Mon Sep 17 00:00:00 2001
+From: Adam Ford <aford173@gmail.com>
+Date: Mon, 15 Jun 2020 08:19:34 -0500
+Subject: drm/panel-simple: fix connector type for LogicPD Type28 Display
+
+From: Adam Ford <aford173@gmail.com>
+
+commit efb94790852ae673b18efde1b171d284689ff333 upstream.
+
+The LogicPD Type28 display used by several Logic PD products has not
+worked since v5.6.
+
+The connector type for the LogicPD Type 28 display is missing and
+drm_panel_bridge_add() requires connector type to be set.
+
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Fixes: 0d35408afbeb ("drm/panel: simple: Add Logic PD Type 28 display support")
+Cc: Adam Ford <aford173@gmail.com>
+Cc: Sam Ravnborg <sam@ravnborg.org>
+Cc: Thierry Reding <thierry.reding@gmail.com>
+Cc: dri-devel@lists.freedesktop.org
+Cc: <stable@vger.kernel.org> # v5.6+
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200615131934.12440-1-aford173@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/panel/panel-simple.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/panel/panel-simple.c
++++ b/drivers/gpu/drm/panel/panel-simple.c
+@@ -2297,6 +2297,7 @@ static const struct panel_desc logicpd_t
+ .bus_format = MEDIA_BUS_FMT_RGB888_1X24,
+ .bus_flags = DRM_BUS_FLAG_DE_HIGH | DRM_BUS_FLAG_PIXDATA_DRIVE_POSEDGE |
+ DRM_BUS_FLAG_SYNC_DRIVE_NEGEDGE,
++ .connector_type = DRM_MODE_CONNECTOR_DPI,
+ };
+
+ static const struct panel_desc mitsubishi_aa070mc01 = {
--- /dev/null
+From 8a4f5e1185db61bce6ce3a5dce6381a77bcf94e6 Mon Sep 17 00:00:00 2001
+From: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Date: Tue, 9 Jun 2020 13:28:09 +0300
+Subject: drm/panel-simple: fix connector type for newhaven_nhd_43_480272ef_atxl
+
+From: Tomi Valkeinen <tomi.valkeinen@ti.com>
+
+commit 8a4f5e1185db61bce6ce3a5dce6381a77bcf94e6 upstream.
+
+Add connector type for newhaven_nhd_43_480272ef_atxl, as
+drm_panel_bridge_add() requires connector type to be set.
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Cc: stable@vger.kernel.org # v5.5+
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200609102809.753203-1-tomi.valkeinen@ti.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/panel/panel-simple.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/panel/panel-simple.c
++++ b/drivers/gpu/drm/panel/panel-simple.c
+@@ -2465,6 +2465,7 @@ static const struct panel_desc newhaven_
+ .bus_format = MEDIA_BUS_FMT_RGB888_1X24,
+ .bus_flags = DRM_BUS_FLAG_DE_HIGH | DRM_BUS_FLAG_PIXDATA_DRIVE_POSEDGE |
+ DRM_BUS_FLAG_SYNC_DRIVE_POSEDGE,
++ .connector_type = DRM_MODE_CONNECTOR_DPI,
+ };
+
+ static const struct display_timing nlt_nl192108ac18_02d_timing = {
--- /dev/null
+From 35f760b44b1b9cb16a306bdcc7220fbbf78c4789 Mon Sep 17 00:00:00 2001
+From: Denis Efremov <efremov@linux.com>
+Date: Mon, 22 Jun 2020 23:31:22 +0300
+Subject: drm/radeon: fix fb_div check in ni_init_smc_spll_table()
+
+From: Denis Efremov <efremov@linux.com>
+
+commit 35f760b44b1b9cb16a306bdcc7220fbbf78c4789 upstream.
+
+clk_s is checked twice in a row in ni_init_smc_spll_table().
+fb_div should be checked instead.
+
+Fixes: 69e0b57a91ad ("drm/radeon/kms: add dpm support for cayman (v5)")
+Cc: stable@vger.kernel.org
+Signed-off-by: Denis Efremov <efremov@linux.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/ni_dpm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/ni_dpm.c
++++ b/drivers/gpu/drm/radeon/ni_dpm.c
+@@ -2127,7 +2127,7 @@ static int ni_init_smc_spll_table(struct
+ if (clk_s & ~(SMC_NISLANDS_SPLL_DIV_TABLE_CLKS_MASK >> SMC_NISLANDS_SPLL_DIV_TABLE_CLKS_SHIFT))
+ ret = -EINVAL;
+
+- if (clk_s & ~(SMC_NISLANDS_SPLL_DIV_TABLE_CLKS_MASK >> SMC_NISLANDS_SPLL_DIV_TABLE_CLKS_SHIFT))
++ if (fb_div & ~(SMC_NISLANDS_SPLL_DIV_TABLE_FBDIV_MASK >> SMC_NISLANDS_SPLL_DIV_TABLE_FBDIV_SHIFT))
+ ret = -EINVAL;
+
+ if (clk_v & ~(SMC_NISLANDS_SPLL_DIV_TABLE_CLKV_MASK >> SMC_NISLANDS_SPLL_DIV_TABLE_CLKV_SHIFT))
--- /dev/null
+From 5f9af404eec82981c4345c9943be48422234e7ab Mon Sep 17 00:00:00 2001
+From: Daniel Gomez <dagmcr@gmail.com>
+Date: Mon, 18 May 2020 22:16:46 +0200
+Subject: drm: rcar-du: Fix build error
+
+From: Daniel Gomez <dagmcr@gmail.com>
+
+commit 5f9af404eec82981c4345c9943be48422234e7ab upstream.
+
+Select DRM_KMS_HELPER dependency.
+
+Build error when DRM_KMS_HELPER is not selected:
+
+drivers/gpu/drm/rcar-du/rcar_lvds.o:(.rodata+0xd48): undefined reference to `drm_atomic_helper_bridge_duplicate_state'
+drivers/gpu/drm/rcar-du/rcar_lvds.o:(.rodata+0xd50): undefined reference to `drm_atomic_helper_bridge_destroy_state'
+drivers/gpu/drm/rcar-du/rcar_lvds.o:(.rodata+0xd70): undefined reference to `drm_atomic_helper_bridge_reset'
+drivers/gpu/drm/rcar-du/rcar_lvds.o:(.rodata+0xdc8): undefined reference to `drm_atomic_helper_connector_reset'
+drivers/gpu/drm/rcar-du/rcar_lvds.o:(.rodata+0xde0): undefined reference to `drm_helper_probe_single_connector_modes'
+drivers/gpu/drm/rcar-du/rcar_lvds.o:(.rodata+0xe08): undefined reference to `drm_atomic_helper_connector_duplicate_state'
+drivers/gpu/drm/rcar-du/rcar_lvds.o:(.rodata+0xe10): undefined reference to `drm_atomic_helper_connector_destroy_state'
+
+Fixes: c6a27fa41fab ("drm: rcar-du: Convert LVDS encoder code to bridge driver")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Daniel Gomez <dagmcr@gmail.com>
+Reviewed-by: Emil Velikov <emil.l.velikov@gmail.com>
+Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/rcar-du/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/rcar-du/Kconfig
++++ b/drivers/gpu/drm/rcar-du/Kconfig
+@@ -31,6 +31,7 @@ config DRM_RCAR_DW_HDMI
+ config DRM_RCAR_LVDS
+ tristate "R-Car DU LVDS Encoder Support"
+ depends on DRM && DRM_BRIDGE && OF
++ select DRM_KMS_HELPER
+ select DRM_PANEL
+ select OF_FLATTREE
+ select OF_OVERLAY
--- /dev/null
+From ee470bb25d0dcdf126f586ec0ae6dca66cb340a4 Mon Sep 17 00:00:00 2001
+From: Borislav Petkov <bp@suse.de>
+Date: Thu, 18 Jun 2020 20:25:25 +0200
+Subject: EDAC/amd64: Read back the scrub rate PCI register on F15h
+
+From: Borislav Petkov <bp@suse.de>
+
+commit ee470bb25d0dcdf126f586ec0ae6dca66cb340a4 upstream.
+
+Commit:
+
+ da92110dfdfa ("EDAC, amd64_edac: Extend scrub rate support to F15hM60h")
+
+added support for F15h, model 0x60 CPUs but in doing so, missed to read
+back SCRCTRL PCI config register on F15h CPUs which are *not* model
+0x60. Add that read so that doing
+
+ $ cat /sys/devices/system/edac/mc/mc0/sdram_scrub_rate
+
+can show the previously set DRAM scrub rate.
+
+Fixes: da92110dfdfa ("EDAC, amd64_edac: Extend scrub rate support to F15hM60h")
+Reported-by: Anders Andersson <pipatron@gmail.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Cc: <stable@vger.kernel.org> #v4.4..
+Link: https://lkml.kernel.org/r/CAKkunMbNWppx_i6xSdDHLseA2QQmGJqj_crY=NF-GZML5np4Vw@mail.gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/edac/amd64_edac.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/edac/amd64_edac.c
++++ b/drivers/edac/amd64_edac.c
+@@ -272,6 +272,8 @@ static int get_scrub_rate(struct mem_ctl
+
+ if (pvt->model == 0x60)
+ amd64_read_pci_cfg(pvt->F2, F15H_M60H_SCRCTRL, &scrubval);
++ else
++ amd64_read_pci_cfg(pvt->F3, SCRCTRL, &scrubval);
+ } else {
+ amd64_read_pci_cfg(pvt->F3, SCRCTRL, &scrubval);
+ }
--- /dev/null
+From d03727b248d0dae6199569a8d7b629a681154633 Mon Sep 17 00:00:00 2001
+From: Olga Kornievskaia <olga.kornievskaia@gmail.com>
+Date: Wed, 24 Jun 2020 13:54:08 -0400
+Subject: NFSv4 fix CLOSE not waiting for direct IO compeletion
+
+From: Olga Kornievskaia <olga.kornievskaia@gmail.com>
+
+commit d03727b248d0dae6199569a8d7b629a681154633 upstream.
+
+Figuring out the root case for the REMOVE/CLOSE race and
+suggesting the solution was done by Neil Brown.
+
+Currently what happens is that direct IO calls hold a reference
+on the open context which is decremented as an asynchronous task
+in the nfs_direct_complete(). Before reference is decremented,
+control is returned to the application which is free to close the
+file. When close is being processed, it decrements its reference
+on the open_context but since directIO still holds one, it doesn't
+sent a close on the wire. It returns control to the application
+which is free to do other operations. For instance, it can delete a
+file. Direct IO is finally releasing its reference and triggering
+an asynchronous close. Which races with the REMOVE. On the server,
+REMOVE can be processed before the CLOSE, failing the REMOVE with
+EACCES as the file is still opened.
+
+Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
+Suggested-by: Neil Brown <neilb@suse.com>
+CC: stable@vger.kernel.org
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/direct.c | 13 +++++++++----
+ fs/nfs/file.c | 1 +
+ 2 files changed, 10 insertions(+), 4 deletions(-)
+
+--- a/fs/nfs/direct.c
++++ b/fs/nfs/direct.c
+@@ -267,8 +267,6 @@ static void nfs_direct_complete(struct n
+ {
+ struct inode *inode = dreq->inode;
+
+- inode_dio_end(inode);
+-
+ if (dreq->iocb) {
+ long res = (long) dreq->error;
+ if (dreq->count != 0) {
+@@ -280,7 +278,10 @@ static void nfs_direct_complete(struct n
+
+ complete(&dreq->completion);
+
++ igrab(inode);
+ nfs_direct_req_release(dreq);
++ inode_dio_end(inode);
++ iput(inode);
+ }
+
+ static void nfs_direct_read_completion(struct nfs_pgio_header *hdr)
+@@ -410,8 +411,10 @@ static ssize_t nfs_direct_read_schedule_
+ * generic layer handle the completion.
+ */
+ if (requested_bytes == 0) {
+- inode_dio_end(inode);
++ igrab(inode);
+ nfs_direct_req_release(dreq);
++ inode_dio_end(inode);
++ iput(inode);
+ return result < 0 ? result : -EIO;
+ }
+
+@@ -864,8 +867,10 @@ static ssize_t nfs_direct_write_schedule
+ * generic layer handle the completion.
+ */
+ if (requested_bytes == 0) {
+- inode_dio_end(inode);
++ igrab(inode);
+ nfs_direct_req_release(dreq);
++ inode_dio_end(inode);
++ iput(inode);
+ return result < 0 ? result : -EIO;
+ }
+
+--- a/fs/nfs/file.c
++++ b/fs/nfs/file.c
+@@ -83,6 +83,7 @@ nfs_file_release(struct inode *inode, st
+ dprintk("NFS: release(%pD2)\n", filp);
+
+ nfs_inc_stats(inode, NFSIOS_VFSRELEASE);
++ inode_dio_wait(inode);
+ nfs_file_clear_open_context(filp);
+ return 0;
+ }
--- /dev/null
+From 8b04013737341442ed914b336cde866b902664ae Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+Date: Mon, 22 Jun 2020 15:04:15 -0400
+Subject: pNFS/flexfiles: Fix list corruption if the mirror count changes
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+commit 8b04013737341442ed914b336cde866b902664ae upstream.
+
+If the mirror count changes in the new layout we pick up inside
+ff_layout_pg_init_write(), then we can end up adding the
+request to the wrong mirror and corrupting the mirror->pg_list.
+
+Fixes: d600ad1f2bdb ("NFS41: pop some layoutget errors to application")
+Cc: stable@vger.kernel.org
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/flexfilelayout/flexfilelayout.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/fs/nfs/flexfilelayout/flexfilelayout.c
++++ b/fs/nfs/flexfilelayout/flexfilelayout.c
+@@ -907,9 +907,8 @@ retry:
+ goto out_mds;
+
+ /* Use a direct mapping of ds_idx to pgio mirror_idx */
+- if (WARN_ON_ONCE(pgio->pg_mirror_count !=
+- FF_LAYOUT_MIRROR_COUNT(pgio->pg_lseg)))
+- goto out_mds;
++ if (pgio->pg_mirror_count != FF_LAYOUT_MIRROR_COUNT(pgio->pg_lseg))
++ goto out_eagain;
+
+ for (i = 0; i < pgio->pg_mirror_count; i++) {
+ mirror = FF_LAYOUT_COMP(pgio->pg_lseg, i);
+@@ -931,7 +930,10 @@ retry:
+ (NFS_MOUNT_SOFT|NFS_MOUNT_SOFTERR))
+ pgio->pg_maxretrans = io_maxretrans;
+ return;
+-
++out_eagain:
++ pnfs_generic_pg_cleanup(pgio);
++ pgio->pg_error = -EAGAIN;
++ return;
+ out_mds:
+ trace_pnfs_mds_fallback_pg_init_write(pgio->pg_inode,
+ 0, NFS4_MAX_UINT64, IOMODE_RW,
+@@ -941,6 +943,7 @@ out_mds:
+ pgio->pg_lseg = NULL;
+ pgio->pg_maxretrans = 0;
+ nfs_pageio_reset_write_mds(pgio);
++ pgio->pg_error = -EAGAIN;
+ }
+
+ static unsigned int
--- /dev/null
+From 7e4773f73dcfb92e7e33532162f722ec291e75a4 Mon Sep 17 00:00:00 2001
+From: Arseny Solokha <asolokha@kb.kras.ru>
+Date: Sat, 13 Jun 2020 23:28:01 +0700
+Subject: powerpc/fsl_booke/32: Fix build with CONFIG_RANDOMIZE_BASE
+
+From: Arseny Solokha <asolokha@kb.kras.ru>
+
+commit 7e4773f73dcfb92e7e33532162f722ec291e75a4 upstream.
+
+Building the current 5.8 kernel for an e500 machine with
+CONFIG_RANDOMIZE_BASE=y and CONFIG_BLOCK=n yields the following
+failure:
+
+ arch/powerpc/mm/nohash/kaslr_booke.c: In function 'kaslr_early_init':
+ arch/powerpc/mm/nohash/kaslr_booke.c:387:2: error: implicit
+ declaration of function 'flush_icache_range'; did you mean 'flush_tlb_range'?
+
+Indeed, including asm/cacheflush.h into kaslr_booke.c fixes the build.
+
+Fixes: 2b0e86cc5de6 ("powerpc/fsl_booke/32: implement KASLR infrastructure")
+Cc: stable@vger.kernel.org # v5.5+
+Signed-off-by: Arseny Solokha <asolokha@kb.kras.ru>
+Reviewed-by: Jason Yan <yanaijie@huawei.com>
+Acked-by: Scott Wood <oss@buserror.net>
+[mpe: Tweak change log to mention CONFIG_BLOCK=n]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20200613162801.1946619-1-asolokha@kb.kras.ru
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/mm/nohash/kaslr_booke.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/powerpc/mm/nohash/kaslr_booke.c
++++ b/arch/powerpc/mm/nohash/kaslr_booke.c
+@@ -14,6 +14,7 @@
+ #include <linux/memblock.h>
+ #include <linux/libfdt.h>
+ #include <linux/crash_core.h>
++#include <asm/cacheflush.h>
+ #include <asm/pgalloc.h>
+ #include <asm/prom.h>
+ #include <asm/kdump.h>
--- /dev/null
+From 097350d1c6e1f5808cae142006f18a0bbc57018d Mon Sep 17 00:00:00 2001
+From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
+Date: Mon, 22 Jun 2020 15:18:15 -0400
+Subject: ring-buffer: Zero out time extend if it is nested and not absolute
+
+From: Steven Rostedt (VMware) <rostedt@goodmis.org>
+
+commit 097350d1c6e1f5808cae142006f18a0bbc57018d upstream.
+
+Currently the ring buffer makes events that happen in interrupts that preempt
+another event have a delta of zero. (Hopefully we can change this soon). But
+this is to deal with the races of updating a global counter with lockless
+and nesting functions updating deltas.
+
+With the addition of absolute time stamps, the time extend didn't follow
+this rule. A time extend can happen if two events happen longer than 2^27
+nanoseconds appart, as the delta time field in each event is only 27 bits.
+If that happens, then a time extend is injected with 2^59 bits of
+nanoseconds to use (18 years). But if the 2^27 nanoseconds happen between
+two events, and as it is writing the event, an interrupt triggers, it will
+see the 2^27 difference as well and inject a time extend of its own. But a
+recent change made the time extend logic not take into account the nesting,
+and this can cause two time extend deltas to happen moving the time stamp
+much further ahead than the current time. This gets all reset when the ring
+buffer moves to the next page, but that can cause time to appear to go
+backwards.
+
+This was observed in a trace-cmd recording, and since the data is saved in a
+file, with trace-cmd report --debug, it was possible to see that this indeed
+did happen!
+
+ bash-52501 110d... 81778.908247: sched_switch: bash:52501 [120] S ==> swapper/110:0 [120] [12770284:0x2e8:64]
+ <idle>-0 110d... 81778.908757: sched_switch: swapper/110:0 [120] R ==> bash:52501 [120] [509947:0x32c:64]
+ TIME EXTEND: delta:306454770 length:0
+ bash-52501 110.... 81779.215212: sched_swap_numa: src_pid=52501 src_tgid=52388 src_ngid=52501 src_cpu=110 src_nid=2 dst_pid=52509 dst_tgid=52388 dst_ngid=52501 dst_cpu=49 dst_nid=1 [0:0x378:48]
+ TIME EXTEND: delta:306458165 length:0
+ bash-52501 110dNh. 81779.521670: sched_wakeup: migration/110:565 [0] success=1 CPU:110 [0:0x3b4:40]
+
+and at the next page, caused the time to go backwards:
+
+ bash-52504 110d... 81779.685411: sched_switch: bash:52504 [120] S ==> swapper/110:0 [120] [8347057:0xfb4:64]
+CPU:110 [SUBBUFFER START] [81779379165886:0x1320000]
+ <idle>-0 110dN.. 81779.379166: sched_wakeup: bash:52504 [120] success=1 CPU:110 [0:0x10:40]
+ <idle>-0 110d... 81779.379167: sched_switch: swapper/110:0 [120] R ==> bash:52504 [120] [1168:0x3c:64]
+
+Link: https://lkml.kernel.org/r/20200622151815.345d1bf5@oasis.local.home
+
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Tom Zanussi <zanussi@kernel.org>
+Cc: stable@vger.kernel.org
+Fixes: dc4e2801d400b ("ring-buffer: Redefine the unimplemented RINGBUF_TYPE_TIME_STAMP")
+Reported-by: Julia Lawall <julia.lawall@inria.fr>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/trace/ring_buffer.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -2427,7 +2427,7 @@ rb_update_event(struct ring_buffer_per_c
+ if (unlikely(info->add_timestamp)) {
+ bool abs = ring_buffer_time_stamp_abs(cpu_buffer->buffer);
+
+- event = rb_add_time_stamp(event, info->delta, abs);
++ event = rb_add_time_stamp(event, abs ? info->delta : delta, abs);
+ length -= RB_LEN_TIME_EXTEND;
+ delta = 0;
+ }
arm64-perf-report-the-pc-value-in-regs_abi_32-mode.patch
arm64-dts-imx8mm-evk-correct-ldo1-ldo2-voltage-range.patch
arm64-dts-imx8mn-ddr4-evk-correct-ldo1-ldo2-voltage-range.patch
+tracing-boottime-fix-kprobe-multiple-events.patch
+tracing-fix-event-trigger-to-accept-redundant-spaces.patch
+ring-buffer-zero-out-time-extend-if-it-is-nested-and-not-absolute.patch
+drm-amd-display-enable-output_bpc-property-on-all-outputs.patch
+drm-amd-fix-potential-memleak-in-err-branch.patch
+drm-rcar-du-fix-build-error.patch
+drm-radeon-fix-fb_div-check-in-ni_init_smc_spll_table.patch
+drm-fb-helper-fix-vt-restore.patch
+drm-amdgpu-add-fw-release-for-sdma-v5_0.patch
+drm-amdgpu-display-unlock-mutex-on-error.patch
+drm-panel-simple-fix-connector-type-for-newhaven_nhd_43_480272ef_atxl.patch
+drm-panel-simple-fix-connector-type-for-logicpd-type28-display.patch
+arm-dts-imx6ul-kontron-move-watchdog-from-kontron-i.mx6ul-ull-board-to-som.patch
+arm-dts-imx6ul-kontron-change-wdog_any-signal-from-push-pull-to-open-drain.patch
+staging-rtl8723bs-prevent-buffer-overflow-in-update_sta_support_rate.patch
+powerpc-fsl_booke-32-fix-build-with-config_randomize_base.patch
+sunrpc-fixed-rollback-in-rpc_gssd_dummy_populate.patch
+sunrpc-properly-set-the-subbuf-parameter-of-xdr_buf_subsegment.patch
+pnfs-flexfiles-fix-list-corruption-if-the-mirror-count-changes.patch
+nfsv4-fix-close-not-waiting-for-direct-io-compeletion.patch
+edac-amd64-read-back-the-scrub-rate-pci-register-on-f15h.patch
+xprtrdma-fix-handling-of-rdma_error-replies.patch
+dm-writecache-correct-uncommitted_block-when-discarding-uncommitted-entry.patch
+dm-writecache-add-cond_resched-to-loop-in-persistent_memory_claim.patch
--- /dev/null
+From b65a2d8c8614386f7e8d38ea150749f8a862f431 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 3 Jun 2020 13:19:58 +0300
+Subject: Staging: rtl8723bs: prevent buffer overflow in update_sta_support_rate()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit b65a2d8c8614386f7e8d38ea150749f8a862f431 upstream.
+
+The "ie_len" variable is in the 0-255 range and it comes from the
+network. If it's over NDIS_802_11_LENGTH_RATES_EX (16) then that will
+lead to memory corruption.
+
+Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200603101958.GA1845750@mwanda
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
++++ b/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
+@@ -1830,12 +1830,14 @@ int update_sta_support_rate(struct adapt
+ pIE = (struct ndis_80211_var_ie *)rtw_get_ie(pvar_ie, _SUPPORTEDRATES_IE_, &ie_len, var_ie_len);
+ if (!pIE)
+ return _FAIL;
++ if (ie_len > sizeof(pmlmeinfo->FW_sta_info[cam_idx].SupportedRates))
++ return _FAIL;
+
+ memcpy(pmlmeinfo->FW_sta_info[cam_idx].SupportedRates, pIE->data, ie_len);
+ supportRateNum = ie_len;
+
+ pIE = (struct ndis_80211_var_ie *)rtw_get_ie(pvar_ie, _EXT_SUPPORTEDRATES_IE_, &ie_len, var_ie_len);
+- if (pIE)
++ if (pIE && (ie_len <= sizeof(pmlmeinfo->FW_sta_info[cam_idx].SupportedRates) - supportRateNum))
+ memcpy((pmlmeinfo->FW_sta_info[cam_idx].SupportedRates + supportRateNum), pIE->data, ie_len);
+
+ return _SUCCESS;
--- /dev/null
+From b7ade38165ca0001c5a3bd5314a314abbbfbb1b7 Mon Sep 17 00:00:00 2001
+From: Vasily Averin <vvs@virtuozzo.com>
+Date: Mon, 1 Jun 2020 11:54:57 +0300
+Subject: sunrpc: fixed rollback in rpc_gssd_dummy_populate()
+
+From: Vasily Averin <vvs@virtuozzo.com>
+
+commit b7ade38165ca0001c5a3bd5314a314abbbfbb1b7 upstream.
+
+__rpc_depopulate(gssd_dentry) was lost on error path
+
+cc: stable@vger.kernel.org
+Fixes: commit 4b9a445e3eeb ("sunrpc: create a new dummy pipe for gssd to hold open")
+Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
+Reviewed-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/sunrpc/rpc_pipe.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/sunrpc/rpc_pipe.c
++++ b/net/sunrpc/rpc_pipe.c
+@@ -1317,6 +1317,7 @@ rpc_gssd_dummy_populate(struct dentry *r
+ q.len = strlen(gssd_dummy_clnt_dir[0].name);
+ clnt_dentry = d_hash_and_lookup(gssd_dentry, &q);
+ if (!clnt_dentry) {
++ __rpc_depopulate(gssd_dentry, gssd_dummy_clnt_dir, 0, 1);
+ pipe_dentry = ERR_PTR(-ENOENT);
+ goto out;
+ }
--- /dev/null
+From 89a3c9f5b9f0bcaa9aea3e8b2a616fcaea9aad78 Mon Sep 17 00:00:00 2001
+From: Chuck Lever <chuck.lever@oracle.com>
+Date: Thu, 25 Jun 2020 11:32:34 -0400
+Subject: SUNRPC: Properly set the @subbuf parameter of xdr_buf_subsegment()
+
+From: Chuck Lever <chuck.lever@oracle.com>
+
+commit 89a3c9f5b9f0bcaa9aea3e8b2a616fcaea9aad78 upstream.
+
+@subbuf is an output parameter of xdr_buf_subsegment(). A survey of
+call sites shows that @subbuf is always uninitialized before
+xdr_buf_segment() is invoked by callers.
+
+There are some execution paths through xdr_buf_subsegment() that do
+not set all of the fields in @subbuf, leaving some pointer fields
+containing garbage addresses. Subsequent processing of that buffer
+then results in a page fault.
+
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/sunrpc/xdr.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/net/sunrpc/xdr.c
++++ b/net/sunrpc/xdr.c
+@@ -1118,6 +1118,7 @@ xdr_buf_subsegment(struct xdr_buf *buf,
+ base = 0;
+ } else {
+ base -= buf->head[0].iov_len;
++ subbuf->head[0].iov_base = buf->head[0].iov_base;
+ subbuf->head[0].iov_len = 0;
+ }
+
+@@ -1130,6 +1131,8 @@ xdr_buf_subsegment(struct xdr_buf *buf,
+ base = 0;
+ } else {
+ base -= buf->page_len;
++ subbuf->pages = buf->pages;
++ subbuf->page_base = 0;
+ subbuf->page_len = 0;
+ }
+
+@@ -1141,6 +1144,7 @@ xdr_buf_subsegment(struct xdr_buf *buf,
+ base = 0;
+ } else {
+ base -= buf->tail[0].iov_len;
++ subbuf->tail[0].iov_base = buf->tail[0].iov_base;
+ subbuf->tail[0].iov_len = 0;
+ }
+
--- /dev/null
+From 20dc3847cc2fc886ee4eb9112e6e2fad9419b0c7 Mon Sep 17 00:00:00 2001
+From: Sascha Ortmann <sascha.ortmann@stud.uni-hannover.de>
+Date: Thu, 18 Jun 2020 18:33:01 +0200
+Subject: tracing/boottime: Fix kprobe multiple events
+
+From: Sascha Ortmann <sascha.ortmann@stud.uni-hannover.de>
+
+commit 20dc3847cc2fc886ee4eb9112e6e2fad9419b0c7 upstream.
+
+Fix boottime kprobe events to report and abort after each failure when
+adding probes.
+
+As an example, when we try to set multiprobe kprobe events in
+bootconfig like this:
+
+ftrace.event.kprobes.vfsevents {
+ probes = "vfs_read $arg1 $arg2,,
+ !error! not reported;?", // leads to error
+ "vfs_write $arg1 $arg2"
+}
+
+This will not work as expected. After
+commit da0f1f4167e3af69e ("tracing/boottime: Fix kprobe event API usage"),
+the function trace_boot_add_kprobe_event will not produce any error
+message when adding a probe fails at kprobe_event_gen_cmd_start.
+Furthermore, we continue to add probes when kprobe_event_gen_cmd_end fails
+(and kprobe_event_gen_cmd_start did not fail). In this case the function
+even returns successfully when the last call to kprobe_event_gen_cmd_end
+is successful.
+
+The behaviour of reporting and aborting after failures is not
+consistent.
+
+The function trace_boot_add_kprobe_event now reports each failure and
+stops adding probes immediately.
+
+Link: https://lkml.kernel.org/r/20200618163301.25854-1-sascha.ortmann@stud.uni-hannover.de
+
+Cc: stable@vger.kernel.org
+Cc: linux-kernel@i4.cs.fau.de
+Co-developed-by: Maximilian Werner <maximilian.werner96@gmail.com>
+Fixes: da0f1f4167e3 ("tracing/boottime: Fix kprobe event API usage")
+Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Maximilian Werner <maximilian.werner96@gmail.com>
+Signed-off-by: Sascha Ortmann <sascha.ortmann@stud.uni-hannover.de>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/trace/trace_boot.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/kernel/trace/trace_boot.c
++++ b/kernel/trace/trace_boot.c
+@@ -101,12 +101,16 @@ trace_boot_add_kprobe_event(struct xbc_n
+ kprobe_event_cmd_init(&cmd, buf, MAX_BUF_LEN);
+
+ ret = kprobe_event_gen_cmd_start(&cmd, event, val);
+- if (ret)
++ if (ret) {
++ pr_err("Failed to generate probe: %s\n", buf);
+ break;
++ }
+
+ ret = kprobe_event_gen_cmd_end(&cmd);
+- if (ret)
++ if (ret) {
+ pr_err("Failed to add probe: %s\n", buf);
++ break;
++ }
+ }
+
+ return ret;
--- /dev/null
+From 6784beada631800f2c5afd567e5628c843362cee Mon Sep 17 00:00:00 2001
+From: Masami Hiramatsu <mhiramat@kernel.org>
+Date: Sat, 20 Jun 2020 12:46:03 +0900
+Subject: tracing: Fix event trigger to accept redundant spaces
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+commit 6784beada631800f2c5afd567e5628c843362cee upstream.
+
+Fix the event trigger to accept redundant spaces in
+the trigger input.
+
+For example, these return -EINVAL
+
+echo " traceon" > events/ftrace/print/trigger
+echo "traceon if common_pid == 0" > events/ftrace/print/trigger
+echo "disable_event:kmem:kmalloc " > events/ftrace/print/trigger
+
+But these are hard to find what is wrong.
+
+To fix this issue, use skip_spaces() to remove spaces
+in front of actual tokens, and set NULL if there is no
+token.
+
+Link: http://lkml.kernel.org/r/159262476352.185015.5261566783045364186.stgit@devnote2
+
+Cc: Tom Zanussi <zanussi@kernel.org>
+Cc: stable@vger.kernel.org
+Fixes: 85f2b08268c0 ("tracing: Add basic event trigger framework")
+Reviewed-by: Tom Zanussi <zanussi@kernel.org>
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/trace/trace_events_trigger.c | 21 +++++++++++++++++++--
+ 1 file changed, 19 insertions(+), 2 deletions(-)
+
+--- a/kernel/trace/trace_events_trigger.c
++++ b/kernel/trace/trace_events_trigger.c
+@@ -216,11 +216,17 @@ static int event_trigger_regex_open(stru
+
+ int trigger_process_regex(struct trace_event_file *file, char *buff)
+ {
+- char *command, *next = buff;
++ char *command, *next;
+ struct event_command *p;
+ int ret = -EINVAL;
+
++ next = buff = skip_spaces(buff);
+ command = strsep(&next, ": \t");
++ if (next) {
++ next = skip_spaces(next);
++ if (!*next)
++ next = NULL;
++ }
+ command = (command[0] != '!') ? command : command + 1;
+
+ mutex_lock(&trigger_cmd_mutex);
+@@ -630,8 +636,14 @@ event_trigger_callback(struct event_comm
+ int ret;
+
+ /* separate the trigger from the filter (t:n [if filter]) */
+- if (param && isdigit(param[0]))
++ if (param && isdigit(param[0])) {
+ trigger = strsep(¶m, " \t");
++ if (param) {
++ param = skip_spaces(param);
++ if (!*param)
++ param = NULL;
++ }
++ }
+
+ trigger_ops = cmd_ops->get_trigger_ops(cmd, trigger);
+
+@@ -1368,6 +1380,11 @@ int event_enable_trigger_func(struct eve
+ trigger = strsep(¶m, " \t");
+ if (!trigger)
+ return -EINVAL;
++ if (param) {
++ param = skip_spaces(param);
++ if (!*param)
++ param = NULL;
++ }
+
+ system = strsep(&trigger, ":");
+ if (!trigger)
--- /dev/null
+From 7b2182ec381f8ea15c7eb1266d6b5d7da620ad93 Mon Sep 17 00:00:00 2001
+From: Chuck Lever <chuck.lever@oracle.com>
+Date: Mon, 15 Jun 2020 09:21:13 -0400
+Subject: xprtrdma: Fix handling of RDMA_ERROR replies
+
+From: Chuck Lever <chuck.lever@oracle.com>
+
+commit 7b2182ec381f8ea15c7eb1266d6b5d7da620ad93 upstream.
+
+The RPC client currently doesn't handle ERR_CHUNK replies correctly.
+rpcrdma_complete_rqst() incorrectly passes a negative number to
+xprt_complete_rqst() as the number of bytes copied. Instead, set
+task->tk_status to the error value, and return zero bytes copied.
+
+In these cases, return -EIO rather than -EREMOTEIO. The RPC client's
+finite state machine doesn't know what to do with -EREMOTEIO.
+
+Additional clean ups:
+- Don't double-count RDMA_ERROR replies
+- Remove a stale comment
+
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Cc: <stable@kernel.vger.org>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/sunrpc/xprtrdma/rpc_rdma.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+--- a/net/sunrpc/xprtrdma/rpc_rdma.c
++++ b/net/sunrpc/xprtrdma/rpc_rdma.c
+@@ -1349,8 +1349,7 @@ rpcrdma_decode_error(struct rpcrdma_xprt
+ be32_to_cpup(p), be32_to_cpu(rep->rr_xid));
+ }
+
+- r_xprt->rx_stats.bad_reply_count++;
+- return -EREMOTEIO;
++ return -EIO;
+ }
+
+ /* Perform XID lookup, reconstruction of the RPC reply, and
+@@ -1387,13 +1386,11 @@ out:
+ spin_unlock(&xprt->queue_lock);
+ return;
+
+-/* If the incoming reply terminated a pending RPC, the next
+- * RPC call will post a replacement receive buffer as it is
+- * being marshaled.
+- */
+ out_badheader:
+ trace_xprtrdma_reply_hdr(rep);
+ r_xprt->rx_stats.bad_reply_count++;
++ rqst->rq_task->tk_status = status;
++ status = 0;
+ goto out;
+ }
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
