--- /dev/null
+From 165d42c012be69900f0e2f8545626cb9e7d4a832 Mon Sep 17 00:00:00 2001
+From: Nishka Dasgupta <nishkadg.linux@gmail.com>
+Date: Sat, 6 Jul 2019 19:00:21 +0530
+Subject: drm/mediatek: mtk_drm_drv.c: Add of_node_put() before goto
+
+From: Nishka Dasgupta <nishkadg.linux@gmail.com>
+
+commit 165d42c012be69900f0e2f8545626cb9e7d4a832 upstream.
+
+Each iteration of for_each_child_of_node puts the previous
+node, but in the case of a goto from the middle of the loop, there is
+no put, thus causing a memory leak. Hence add an of_node_put before the
+goto in two places.
+Issue found with Coccinelle.
+
+Fixes: 119f5173628a (drm/mediatek: Add DRM Driver for Mediatek SoC MT8173)
+
+Signed-off-by: Nishka Dasgupta <nishkadg.linux@gmail.com>
+Signed-off-by: CK Hu <ck.hu@mediatek.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/mediatek/mtk_drm_drv.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
++++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+@@ -567,12 +567,15 @@ static int mtk_drm_probe(struct platform
+ comp = devm_kzalloc(dev, sizeof(*comp), GFP_KERNEL);
+ if (!comp) {
+ ret = -ENOMEM;
++ of_node_put(node);
+ goto err_node;
+ }
+
+ ret = mtk_ddp_comp_init(dev, node, comp, comp_id, NULL);
+- if (ret)
++ if (ret) {
++ of_node_put(node);
+ goto err_node;
++ }
+
+ private->ddp_comp[comp_id] = comp;
+ }
--- /dev/null
+From dae1ccee012ea7514af8e4a88429844157aca7dc Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Mon, 24 Jun 2019 17:40:14 +0200
+Subject: drm: panel-orientation-quirks: Add extra quirk table entry for GPD MicroPC
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit dae1ccee012ea7514af8e4a88429844157aca7dc upstream.
+
+Newer GPD MicroPC BIOS versions have proper DMI strings, add an extra quirk
+table entry for these new strings. This is good news, as this means that we
+no longer have to update the BIOS dates list with every BIOS update.
+
+Fixes: 652b8b086538("drm: panel-orientation-quirks: Add quirk for GPD MicroPC")
+Acked-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190624154014.8557-2-hdegoede@redhat.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_panel_orientation_quirks.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c
++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+@@ -90,6 +90,12 @@ static const struct drm_dmi_panel_orient
+ .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP,
+ };
+
++static const struct drm_dmi_panel_orientation_data lcd720x1280_rightside_up = {
++ .width = 720,
++ .height = 1280,
++ .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP,
++};
++
+ static const struct drm_dmi_panel_orientation_data lcd800x1280_rightside_up = {
+ .width = 800,
+ .height = 1280,
+@@ -123,6 +129,12 @@ static const struct dmi_system_id orient
+ DMI_EXACT_MATCH(DMI_BOARD_NAME, "Default string"),
+ },
+ .driver_data = (void *)&gpd_micropc,
++ }, { /* GPD MicroPC (later BIOS versions with proper DMI strings) */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "GPD"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "MicroPC"),
++ },
++ .driver_data = (void *)&lcd720x1280_rightside_up,
+ }, { /*
+ * GPD Pocket, note that the the DMI data is less generic then
+ * it seems, devices with a board-vendor of "AMI Corporation"
--- /dev/null
+From c6013bf50e2a2a94ab3d012e191096432aa50c6f Mon Sep 17 00:00:00 2001
+From: Olivier Moysan <olivier.moysan@st.com>
+Date: Wed, 19 Jun 2019 15:03:48 +0200
+Subject: iio: adc: stm32-dfsdm: fix data type
+
+From: Olivier Moysan <olivier.moysan@st.com>
+
+commit c6013bf50e2a2a94ab3d012e191096432aa50c6f upstream.
+
+Fix the data type as DFSDM raw output is complements 2,
+24bits left aligned in a 32-bit register.
+This change does not affect AUDIO path
+- Set data as signed for IIO (as for AUDIO)
+- Set 8 bit right shift for IIO.
+The 8 LSBs bits of data contains channel info and are masked.
+
+Signed-off-by: Olivier Moysan <olivier.moysan@st.com>
+Fixes: e2e6771c6462 ("IIO: ADC: add STM32 DFSDM sigma delta ADC support")
+Acked-by: Fabrice Gasnier <fabrice.gasnier@st.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/adc/stm32-dfsdm-adc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/iio/adc/stm32-dfsdm-adc.c
++++ b/drivers/iio/adc/stm32-dfsdm-adc.c
+@@ -1365,11 +1365,11 @@ static int stm32_dfsdm_adc_chan_init_one
+ BIT(IIO_CHAN_INFO_SAMP_FREQ);
+
+ if (adc->dev_data->type == DFSDM_AUDIO) {
+- ch->scan_type.sign = 's';
+ ch->ext_info = dfsdm_adc_audio_ext_info;
+ } else {
+- ch->scan_type.sign = 'u';
++ ch->scan_type.shift = 8;
+ }
++ ch->scan_type.sign = 's';
+ ch->scan_type.realbits = 24;
+ ch->scan_type.storagebits = 32;
+
--- /dev/null
+From 12c8398d8012ead3d3d68422067ab2f9a66ae76a Mon Sep 17 00:00:00 2001
+From: Olivier Moysan <olivier.moysan@st.com>
+Date: Wed, 19 Jun 2019 15:03:47 +0200
+Subject: iio: adc: stm32-dfsdm: fix output resolution
+
+From: Olivier Moysan <olivier.moysan@st.com>
+
+commit 12c8398d8012ead3d3d68422067ab2f9a66ae76a upstream.
+
+In buffered mode, output samples are shifted left
+unconditionally. This works for filter order 3,
+but this shift is not adapted for other filter orders.
+Compute required shift, left or right, and shift
+output data accordingly.
+Add also saturation management to avoid wrap-around
+when maximum positive sample is reached.
+
+Signed-off-by: Olivier Moysan <olivier.moysan@st.com>
+Fixes: eca949800d2d ("IIO: ADC: add stm32 DFSDM support for PDM microphone")
+Acked-by: Fabrice Gasnier <fabrice.gasnier@st.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/adc/stm32-dfsdm-adc.c | 158 +++++++++++++++++++++++++++++---------
+ drivers/iio/adc/stm32-dfsdm.h | 24 ++++-
+ 2 files changed, 142 insertions(+), 40 deletions(-)
+
+--- a/drivers/iio/adc/stm32-dfsdm-adc.c
++++ b/drivers/iio/adc/stm32-dfsdm-adc.c
+@@ -39,9 +39,16 @@
+ #define DFSDM_MAX_INT_OVERSAMPLING 256
+ #define DFSDM_MAX_FL_OVERSAMPLING 1024
+
+-/* Max sample resolutions */
+-#define DFSDM_MAX_RES BIT(31)
+-#define DFSDM_DATA_RES BIT(23)
++/* Limit filter output resolution to 31 bits. (i.e. sample range is +/-2^30) */
++#define DFSDM_DATA_MAX BIT(30)
++/*
++ * Data are output as two's complement data in a 24 bit field.
++ * Data from filters are in the range +/-2^(n-1)
++ * 2^(n-1) maximum positive value cannot be coded in 2's complement n bits
++ * An extra bit is required to avoid wrap-around of the binary code for 2^(n-1)
++ * So, the resolution of samples from filter is actually limited to 23 bits
++ */
++#define DFSDM_DATA_RES 24
+
+ /* Filter configuration */
+ #define DFSDM_CR1_CFG_MASK (DFSDM_CR1_RCH_MASK | DFSDM_CR1_RCONT_MASK | \
+@@ -181,14 +188,15 @@ static int stm32_dfsdm_get_jextsel(struc
+ return -EINVAL;
+ }
+
+-static int stm32_dfsdm_set_osrs(struct stm32_dfsdm_filter *fl,
+- unsigned int fast, unsigned int oversamp)
++static int stm32_dfsdm_compute_osrs(struct stm32_dfsdm_filter *fl,
++ unsigned int fast, unsigned int oversamp)
+ {
+ unsigned int i, d, fosr, iosr;
+- u64 res;
+- s64 delta;
++ u64 res, max;
++ int bits, shift;
+ unsigned int m = 1; /* multiplication factor */
+ unsigned int p = fl->ford; /* filter order (ford) */
++ struct stm32_dfsdm_filter_osr *flo = &fl->flo;
+
+ pr_debug("%s: Requested oversampling: %d\n", __func__, oversamp);
+ /*
+@@ -207,11 +215,9 @@ static int stm32_dfsdm_set_osrs(struct s
+
+ /*
+ * Look for filter and integrator oversampling ratios which allows
+- * to reach 24 bits data output resolution.
+- * Leave as soon as if exact resolution if reached.
+- * Otherwise the higher resolution below 32 bits is kept.
++ * to maximize data output resolution.
+ */
+- fl->res = 0;
++ flo->res = 0;
+ for (fosr = 1; fosr <= DFSDM_MAX_FL_OVERSAMPLING; fosr++) {
+ for (iosr = 1; iosr <= DFSDM_MAX_INT_OVERSAMPLING; iosr++) {
+ if (fast)
+@@ -236,32 +242,68 @@ static int stm32_dfsdm_set_osrs(struct s
+ res = fosr;
+ for (i = p - 1; i > 0; i--) {
+ res = res * (u64)fosr;
+- if (res > DFSDM_MAX_RES)
++ if (res > DFSDM_DATA_MAX)
+ break;
+ }
+- if (res > DFSDM_MAX_RES)
++ if (res > DFSDM_DATA_MAX)
+ continue;
++
+ res = res * (u64)m * (u64)iosr;
+- if (res > DFSDM_MAX_RES)
++ if (res > DFSDM_DATA_MAX)
+ continue;
+
+- delta = res - DFSDM_DATA_RES;
+-
+- if (res >= fl->res) {
+- fl->res = res;
+- fl->fosr = fosr;
+- fl->iosr = iosr;
+- fl->fast = fast;
+- pr_debug("%s: fosr = %d, iosr = %d\n",
+- __func__, fl->fosr, fl->iosr);
++ if (res >= flo->res) {
++ flo->res = res;
++ flo->fosr = fosr;
++ flo->iosr = iosr;
++
++ bits = fls(flo->res);
++ /* 8 LBSs in data register contain chan info */
++ max = flo->res << 8;
++
++ /* if resolution is not a power of two */
++ if (flo->res > BIT(bits - 1))
++ bits++;
++ else
++ max--;
++
++ shift = DFSDM_DATA_RES - bits;
++ /*
++ * Compute right/left shift
++ * Right shift is performed by hardware
++ * when transferring samples to data register.
++ * Left shift is done by software on buffer
++ */
++ if (shift > 0) {
++ /* Resolution is lower than 24 bits */
++ flo->rshift = 0;
++ flo->lshift = shift;
++ } else {
++ /*
++ * If resolution is 24 bits or more,
++ * max positive value may be ambiguous
++ * (equal to max negative value as sign
++ * bit is dropped).
++ * Reduce resolution to 23 bits (rshift)
++ * to keep the sign on bit 23 and treat
++ * saturation before rescaling on 24
++ * bits (lshift).
++ */
++ flo->rshift = 1 - shift;
++ flo->lshift = 1;
++ max >>= flo->rshift;
++ }
++ flo->max = (s32)max;
++
++ pr_debug("%s: fast %d, fosr %d, iosr %d, res 0x%llx/%d bits, rshift %d, lshift %d\n",
++ __func__, fast, flo->fosr, flo->iosr,
++ flo->res, bits, flo->rshift,
++ flo->lshift);
+ }
+-
+- if (!delta)
+- return 0;
+ }
+ }
+
+- if (!fl->res)
++ if (!flo->res)
+ return -EINVAL;
+
+ return 0;
+@@ -384,6 +426,36 @@ static int stm32_dfsdm_filter_set_trig(s
+ return 0;
+ }
+
++static int stm32_dfsdm_channels_configure(struct stm32_dfsdm_adc *adc,
++ unsigned int fl_id,
++ struct iio_trigger *trig)
++{
++ struct iio_dev *indio_dev = iio_priv_to_dev(adc);
++ struct regmap *regmap = adc->dfsdm->regmap;
++ struct stm32_dfsdm_filter *fl = &adc->dfsdm->fl_list[fl_id];
++ struct stm32_dfsdm_filter_osr *flo = &fl->flo;
++ const struct iio_chan_spec *chan;
++ unsigned int bit;
++ int ret;
++
++ if (!flo->res)
++ return -EINVAL;
++
++ for_each_set_bit(bit, &adc->smask,
++ sizeof(adc->smask) * BITS_PER_BYTE) {
++ chan = indio_dev->channels + bit;
++
++ ret = regmap_update_bits(regmap,
++ DFSDM_CHCFGR2(chan->channel),
++ DFSDM_CHCFGR2_DTRBS_MASK,
++ DFSDM_CHCFGR2_DTRBS(flo->rshift));
++ if (ret)
++ return ret;
++ }
++
++ return 0;
++}
++
+ static int stm32_dfsdm_filter_configure(struct stm32_dfsdm_adc *adc,
+ unsigned int fl_id,
+ struct iio_trigger *trig)
+@@ -391,6 +463,7 @@ static int stm32_dfsdm_filter_configure(
+ struct iio_dev *indio_dev = iio_priv_to_dev(adc);
+ struct regmap *regmap = adc->dfsdm->regmap;
+ struct stm32_dfsdm_filter *fl = &adc->dfsdm->fl_list[fl_id];
++ struct stm32_dfsdm_filter_osr *flo = &fl->flo;
+ u32 cr1;
+ const struct iio_chan_spec *chan;
+ unsigned int bit, jchg = 0;
+@@ -398,13 +471,13 @@ static int stm32_dfsdm_filter_configure(
+
+ /* Average integrator oversampling */
+ ret = regmap_update_bits(regmap, DFSDM_FCR(fl_id), DFSDM_FCR_IOSR_MASK,
+- DFSDM_FCR_IOSR(fl->iosr - 1));
++ DFSDM_FCR_IOSR(flo->iosr - 1));
+ if (ret)
+ return ret;
+
+ /* Filter order and Oversampling */
+ ret = regmap_update_bits(regmap, DFSDM_FCR(fl_id), DFSDM_FCR_FOSR_MASK,
+- DFSDM_FCR_FOSR(fl->fosr - 1));
++ DFSDM_FCR_FOSR(flo->fosr - 1));
+ if (ret)
+ return ret;
+
+@@ -573,7 +646,7 @@ static int dfsdm_adc_set_samp_freq(struc
+ "Rate not accurate. requested (%u), actual (%u)\n",
+ sample_freq, spi_freq / oversamp);
+
+- ret = stm32_dfsdm_set_osrs(fl, 0, oversamp);
++ ret = stm32_dfsdm_compute_osrs(fl, 0, oversamp);
+ if (ret < 0) {
+ dev_err(&indio_dev->dev, "No filter parameters that match!\n");
+ return ret;
+@@ -623,6 +696,10 @@ static int stm32_dfsdm_start_conv(struct
+ struct regmap *regmap = adc->dfsdm->regmap;
+ int ret;
+
++ ret = stm32_dfsdm_channels_configure(adc, adc->fl_id, trig);
++ if (ret < 0)
++ return ret;
++
+ ret = stm32_dfsdm_start_channel(adc);
+ if (ret < 0)
+ return ret;
+@@ -729,6 +806,8 @@ static void stm32_dfsdm_dma_buffer_done(
+ {
+ struct iio_dev *indio_dev = data;
+ struct stm32_dfsdm_adc *adc = iio_priv(indio_dev);
++ struct stm32_dfsdm_filter *fl = &adc->dfsdm->fl_list[adc->fl_id];
++ struct stm32_dfsdm_filter_osr *flo = &fl->flo;
+ int available = stm32_dfsdm_adc_dma_residue(adc);
+ size_t old_pos;
+
+@@ -751,10 +830,19 @@ static void stm32_dfsdm_dma_buffer_done(
+ old_pos = adc->bufi;
+
+ while (available >= indio_dev->scan_bytes) {
+- u32 *buffer = (u32 *)&adc->rx_buf[adc->bufi];
++ s32 *buffer = (s32 *)&adc->rx_buf[adc->bufi];
+
+ /* Mask 8 LSB that contains the channel ID */
+- *buffer = (*buffer & 0xFFFFFF00) << 8;
++ *buffer &= 0xFFFFFF00;
++ /* Convert 2^(n-1) sample to 2^(n-1)-1 to avoid wrap-around */
++ if (*buffer > flo->max)
++ *buffer -= 1;
++ /*
++ * Samples from filter are retrieved with 23 bits resolution
++ * or less. Shift left to align MSB on 24 bits.
++ */
++ *buffer <<= flo->lshift;
++
+ available -= indio_dev->scan_bytes;
+ adc->bufi += indio_dev->scan_bytes;
+ if (adc->bufi >= adc->buf_sz) {
+@@ -1078,7 +1166,7 @@ static int stm32_dfsdm_write_raw(struct
+ ret = iio_device_claim_direct_mode(indio_dev);
+ if (ret)
+ return ret;
+- ret = stm32_dfsdm_set_osrs(fl, 0, val);
++ ret = stm32_dfsdm_compute_osrs(fl, 0, val);
+ if (!ret)
+ adc->oversamp = val;
+ iio_device_release_direct_mode(indio_dev);
+@@ -1327,8 +1415,8 @@ static int stm32_dfsdm_adc_init(struct i
+ int ret, chan_idx;
+
+ adc->oversamp = DFSDM_DEFAULT_OVERSAMPLING;
+- ret = stm32_dfsdm_set_osrs(&adc->dfsdm->fl_list[adc->fl_id], 0,
+- adc->oversamp);
++ ret = stm32_dfsdm_compute_osrs(&adc->dfsdm->fl_list[adc->fl_id], 0,
++ adc->oversamp);
+ if (ret < 0)
+ return ret;
+
+--- a/drivers/iio/adc/stm32-dfsdm.h
++++ b/drivers/iio/adc/stm32-dfsdm.h
+@@ -243,19 +243,33 @@ enum stm32_dfsdm_sinc_order {
+ };
+
+ /**
+- * struct stm32_dfsdm_filter - structure relative to stm32 FDSDM filter
++ * struct stm32_dfsdm_filter_osr - DFSDM filter settings linked to oversampling
+ * @iosr: integrator oversampling
+ * @fosr: filter oversampling
+- * @ford: filter order
++ * @rshift: output sample right shift (hardware shift)
++ * @lshift: output sample left shift (software shift)
+ * @res: output sample resolution
++ * @max: output sample maximum positive value
++ */
++struct stm32_dfsdm_filter_osr {
++ unsigned int iosr;
++ unsigned int fosr;
++ unsigned int rshift;
++ unsigned int lshift;
++ u64 res;
++ s32 max;
++};
++
++/**
++ * struct stm32_dfsdm_filter - structure relative to stm32 FDSDM filter
++ * @ford: filter order
++ * @flo: filter oversampling structure
+ * @sync_mode: filter synchronized with filter 0
+ * @fast: filter fast mode
+ */
+ struct stm32_dfsdm_filter {
+- unsigned int iosr;
+- unsigned int fosr;
+ enum stm32_dfsdm_sinc_order ford;
+- u64 res;
++ struct stm32_dfsdm_filter_osr flo;
+ unsigned int sync_mode;
+ unsigned int fast;
+ };
--- /dev/null
+From 14108b9131a47ff18a3c640f583eb2d625c75c0d Mon Sep 17 00:00:00 2001
+From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
+Date: Fri, 30 Aug 2019 16:04:43 -0700
+Subject: mm/z3fold.c: fix lock/unlock imbalance in z3fold_page_isolate
+
+From: Gustavo A. R. Silva <gustavo@embeddedor.com>
+
+commit 14108b9131a47ff18a3c640f583eb2d625c75c0d upstream.
+
+Fix lock/unlock imbalance by unlocking *zhdr* before return.
+
+Addresses Coverity ID 1452811 ("Missing unlock")
+
+Link: http://lkml.kernel.org/r/20190826030634.GA4379@embeddedor
+Fixes: d776aaa9895e ("mm/z3fold.c: fix race between migration and destruction")
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Henry Burns <henrywolfeburns@gmail.com>
+Cc: Vitaly Wool <vitalywool@gmail.com>
+Cc: Shakeel Butt <shakeelb@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/z3fold.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/mm/z3fold.c
++++ b/mm/z3fold.c
+@@ -1408,6 +1408,7 @@ static bool z3fold_page_isolate(struct p
+ * should freak out.
+ */
+ WARN(1, "Z3fold is experiencing kref problems\n");
++ z3fold_page_unlock(zhdr);
+ return false;
+ }
+ z3fold_page_unlock(zhdr);
--- /dev/null
+From be03074c9af25d06cf8e9ebddfcd284c0bf7f947 Mon Sep 17 00:00:00 2001
+From: Henry Burns <henryburns@google.com>
+Date: Tue, 16 Jul 2019 16:26:18 -0700
+Subject: mm/z3fold.c: remove z3fold_migration trylock
+
+From: Henry Burns <henryburns@google.com>
+
+commit be03074c9af25d06cf8e9ebddfcd284c0bf7f947 upstream.
+
+z3fold_page_migrate() will never succeed because it attempts to acquire
+a lock that has already been taken by migrate.c in __unmap_and_move().
+
+ __unmap_and_move() migrate.c
+ trylock_page(oldpage)
+ move_to_new_page(oldpage_newpage)
+ a_ops->migrate_page(oldpage, newpage)
+ z3fold_page_migrate(oldpage, newpage)
+ trylock_page(oldpage)
+
+Link: http://lkml.kernel.org/r/20190710213238.91835-1-henryburns@google.com
+Fixes: 1f862989b04a ("mm/z3fold.c: support page migration")
+Signed-off-by: Henry Burns <henryburns@google.com>
+Reviewed-by: Shakeel Butt <shakeelb@google.com>
+Cc: Vitaly Wool <vitalywool@gmail.com>
+Cc: Vitaly Vul <vitaly.vul@sony.com>
+Cc: Jonathan Adams <jwadams@google.com>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Snild Dolkow <snild@sony.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/z3fold.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+--- a/mm/z3fold.c
++++ b/mm/z3fold.c
+@@ -1439,16 +1439,11 @@ static int z3fold_page_migrate(struct ad
+ zhdr = page_address(page);
+ pool = zhdr_to_pool(zhdr);
+
+- if (!trylock_page(page))
+- return -EAGAIN;
+-
+ if (!z3fold_page_trylock(zhdr)) {
+- unlock_page(page);
+ return -EAGAIN;
+ }
+ if (zhdr->mapped_count != 0) {
+ z3fold_page_unlock(zhdr);
+- unlock_page(page);
+ return -EBUSY;
+ }
+ if (work_pending(&zhdr->work)) {
+@@ -1494,7 +1489,6 @@ static int z3fold_page_migrate(struct ad
+ spin_unlock(&pool->lock);
+
+ page_mapcount_reset(page);
+- unlock_page(page);
+ put_page(page);
+ return 0;
+ }
--- /dev/null
+From 38f054d549a869f22a02224cd276a27bf14b6171 Mon Sep 17 00:00:00 2001
+From: Jessica Yu <jeyu@kernel.org>
+Date: Tue, 23 Jul 2019 15:26:28 +0200
+Subject: modules: always page-align module section allocations
+
+From: Jessica Yu <jeyu@kernel.org>
+
+commit 38f054d549a869f22a02224cd276a27bf14b6171 upstream.
+
+Some arches (e.g., arm64, x86) have moved towards non-executable
+module_alloc() allocations for security hardening reasons. That means
+that the module loader will need to set the text section of a module to
+executable, regardless of whether or not CONFIG_STRICT_MODULE_RWX is set.
+
+When CONFIG_STRICT_MODULE_RWX=y, module section allocations are always
+page-aligned to handle memory rwx permissions. On some arches with
+CONFIG_STRICT_MODULE_RWX=n however, when setting the module text to
+executable, the BUG_ON() in frob_text() gets triggered since module
+section allocations are not page-aligned when CONFIG_STRICT_MODULE_RWX=n.
+Since the set_memory_* API works with pages, and since we need to call
+set_memory_x() regardless of whether CONFIG_STRICT_MODULE_RWX is set, we
+might as well page-align all module section allocations for ease of
+managing rwx permissions of module sections (text, rodata, etc).
+
+Fixes: 2eef1399a866 ("modules: fix BUG when load module with rodata=n")
+Reported-by: Martin Kaiser <lists@kaiser.cx>
+Reported-by: Bartosz Golaszewski <brgl@bgdev.pl>
+Tested-by: David Lechner <david@lechnology.com>
+Tested-by: Martin Kaiser <martin@kaiser.cx>
+Tested-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Jessica Yu <jeyu@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/module.c | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -64,14 +64,9 @@
+
+ /*
+ * Modules' sections will be aligned on page boundaries
+- * to ensure complete separation of code and data, but
+- * only when CONFIG_STRICT_MODULE_RWX=y
++ * to ensure complete separation of code and data
+ */
+-#ifdef CONFIG_STRICT_MODULE_RWX
+ # define debug_align(X) ALIGN(X, PAGE_SIZE)
+-#else
+-# define debug_align(X) (X)
+-#endif
+
+ /* If this is set, the section belongs in the init part of the module */
+ #define INIT_OFFSET_MASK (1UL << (BITS_PER_LONG-1))
--- /dev/null
+From 2eef1399a866c57687962e15142b141a4f8e7862 Mon Sep 17 00:00:00 2001
+From: Yang Yingliang <yangyingliang@huawei.com>
+Date: Thu, 20 Jun 2019 10:18:14 +0800
+Subject: modules: fix BUG when load module with rodata=n
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+commit 2eef1399a866c57687962e15142b141a4f8e7862 upstream.
+
+When loading a module with rodata=n, it causes an executing
+NX-protected page BUG.
+
+[ 32.379191] kernel tried to execute NX-protected page - exploit attempt? (uid: 0)
+[ 32.382917] BUG: unable to handle page fault for address: ffffffffc0005000
+[ 32.385947] #PF: supervisor instruction fetch in kernel mode
+[ 32.387662] #PF: error_code(0x0011) - permissions violation
+[ 32.389352] PGD 240c067 P4D 240c067 PUD 240e067 PMD 421a52067 PTE 8000000421a53063
+[ 32.391396] Oops: 0011 [#1] SMP PTI
+[ 32.392478] CPU: 7 PID: 2697 Comm: insmod Tainted: G O 5.2.0-rc5+ #202
+[ 32.394588] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
+[ 32.398157] RIP: 0010:ko_test_init+0x0/0x1000 [ko_test]
+[ 32.399662] Code: Bad RIP value.
+[ 32.400621] RSP: 0018:ffffc900029f3ca8 EFLAGS: 00010246
+[ 32.402171] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
+[ 32.404332] RDX: 00000000000004c7 RSI: 0000000000000cc0 RDI: ffffffffc0005000
+[ 32.406347] RBP: ffffffffc0005000 R08: ffff88842fbebc40 R09: ffffffff810ede4a
+[ 32.408392] R10: ffffea00108e3480 R11: 0000000000000000 R12: ffff88842bee21a0
+[ 32.410472] R13: 0000000000000001 R14: 0000000000000001 R15: ffffc900029f3e78
+[ 32.412609] FS: 00007fb4f0c0a700(0000) GS:ffff88842fbc0000(0000) knlGS:0000000000000000
+[ 32.414722] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 32.416290] CR2: ffffffffc0004fd6 CR3: 0000000421a90004 CR4: 0000000000020ee0
+[ 32.418471] Call Trace:
+[ 32.419136] do_one_initcall+0x41/0x1df
+[ 32.420199] ? _cond_resched+0x10/0x40
+[ 32.421433] ? kmem_cache_alloc_trace+0x36/0x160
+[ 32.422827] do_init_module+0x56/0x1f7
+[ 32.423946] load_module+0x1e67/0x2580
+[ 32.424947] ? __alloc_pages_nodemask+0x150/0x2c0
+[ 32.426413] ? map_vm_area+0x2d/0x40
+[ 32.427530] ? __vmalloc_node_range+0x1ef/0x260
+[ 32.428850] ? __do_sys_init_module+0x135/0x170
+[ 32.430060] ? _cond_resched+0x10/0x40
+[ 32.431249] __do_sys_init_module+0x135/0x170
+[ 32.432547] do_syscall_64+0x43/0x120
+[ 32.433853] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Because if rodata=n, set_memory_x() can't be called, fix this by
+calling set_memory_x in complete_formation();
+
+Fixes: f2c65fb3221a ("x86/modules: Avoid breaking W^X while loading modules")
+Suggested-by: Jian Cheng <cj.chengjian@huawei.com>
+Reviewed-by: Nadav Amit <namit@vmware.com>
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: Jessica Yu <jeyu@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/module.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -1961,13 +1961,9 @@ void module_enable_ro(const struct modul
+ set_vm_flush_reset_perms(mod->core_layout.base);
+ set_vm_flush_reset_perms(mod->init_layout.base);
+ frob_text(&mod->core_layout, set_memory_ro);
+- frob_text(&mod->core_layout, set_memory_x);
+
+ frob_rodata(&mod->core_layout, set_memory_ro);
+-
+ frob_text(&mod->init_layout, set_memory_ro);
+- frob_text(&mod->init_layout, set_memory_x);
+-
+ frob_rodata(&mod->init_layout, set_memory_ro);
+
+ if (after_init)
+@@ -2030,6 +2026,12 @@ void set_all_modules_text_ro(void)
+ static void module_enable_nx(const struct module *mod) { }
+ #endif
+
++static void module_enable_x(const struct module *mod)
++{
++ frob_text(&mod->core_layout, set_memory_x);
++ frob_text(&mod->init_layout, set_memory_x);
++}
++
+ #ifdef CONFIG_LIVEPATCH
+ /*
+ * Persist Elf information about a module. Copy the Elf header,
+@@ -3626,6 +3628,7 @@ static int complete_formation(struct mod
+
+ module_enable_ro(mod, false);
+ module_enable_nx(mod);
++ module_enable_x(mod);
+
+ /* Mark state as coming so strong_try_module_get() ignores us,
+ * but kallsyms etc. can see us. */
--- /dev/null
+From 93651f80dcb616b8c9115cdafc8e57a781af22d0 Mon Sep 17 00:00:00 2001
+From: Yang Yingliang <yangyingliang@huawei.com>
+Date: Tue, 25 Jun 2019 17:40:28 +0800
+Subject: modules: fix compile error if don't have strict module rwx
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+commit 93651f80dcb616b8c9115cdafc8e57a781af22d0 upstream.
+
+If CONFIG_ARCH_HAS_STRICT_MODULE_RWX is not defined,
+we need stub for module_enable_nx() and module_enable_x().
+
+If CONFIG_ARCH_HAS_STRICT_MODULE_RWX is defined, but
+CONFIG_STRICT_MODULE_RWX is disabled, we need stub for
+module_enable_nx.
+
+Move frob_text() outside of the CONFIG_STRICT_MODULE_RWX,
+because it is needed anyway.
+
+Fixes: 2eef1399a866 ("modules: fix BUG when load module with rodata=n")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: Jessica Yu <jeyu@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/module.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -1887,7 +1887,7 @@ static void mod_sysfs_teardown(struct mo
+ mod_sysfs_fini(mod);
+ }
+
+-#ifdef CONFIG_STRICT_MODULE_RWX
++#ifdef CONFIG_ARCH_HAS_STRICT_MODULE_RWX
+ /*
+ * LKM RO/NX protection: protect module's text/ro-data
+ * from modification and any data from execution.
+@@ -1910,6 +1910,7 @@ static void frob_text(const struct modul
+ layout->text_size >> PAGE_SHIFT);
+ }
+
++#ifdef CONFIG_STRICT_MODULE_RWX
+ static void frob_rodata(const struct module_layout *layout,
+ int (*set_memory)(unsigned long start, int num_pages))
+ {
+@@ -2022,15 +2023,19 @@ void set_all_modules_text_ro(void)
+ }
+ mutex_unlock(&module_mutex);
+ }
+-#else
++#else /* !CONFIG_STRICT_MODULE_RWX */
+ static void module_enable_nx(const struct module *mod) { }
+-#endif
+-
++#endif /* CONFIG_STRICT_MODULE_RWX */
+ static void module_enable_x(const struct module *mod)
+ {
+ frob_text(&mod->core_layout, set_memory_x);
+ frob_text(&mod->init_layout, set_memory_x);
+ }
++#else /* !CONFIG_ARCH_HAS_STRICT_MODULE_RWX */
++static void module_enable_nx(const struct module *mod) { }
++static void module_enable_x(const struct module *mod) { }
++#endif /* CONFIG_ARCH_HAS_STRICT_MODULE_RWX */
++
+
+ #ifdef CONFIG_LIVEPATCH
+ /*
--- /dev/null
+From 1ffdb51f28e8ec6be0a2b812c1765b5cf5c44a8f Mon Sep 17 00:00:00 2001
+From: Mario Limonciello <mario.limonciello@dell.com>
+Date: Mon, 19 Aug 2019 12:04:08 -0500
+Subject: Revert "Bluetooth: btusb: driver to enable the usb-wakeup feature"
+
+From: Mario Limonciello <mario.limonciello@dell.com>
+
+commit 1ffdb51f28e8ec6be0a2b812c1765b5cf5c44a8f upstream.
+
+This reverts commit a0085f2510e8976614ad8f766b209448b385492f.
+
+This commit has caused regressions in notebooks that support suspend
+to idle such as the XPS 9360, XPS 9370 and XPS 9380.
+
+These notebooks will wakeup from suspend to idle from an unsolicited
+advertising packet from an unpaired BLE device.
+
+In a bug report it was sugggested that this is caused by a generic
+lack of LE privacy support. Revert this commit until that behavior
+can be avoided by the kernel.
+
+Fixes: a0085f2510e8 ("Bluetooth: btusb: driver to enable the usb-wakeup feature")
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=200039
+Link: https://marc.info/?l=linux-bluetooth&m=156441081612627&w=2
+Link: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/750073/
+CC: Bastien Nocera <hadess@hadess.net>
+CC: Christian Kellner <ckellner@redhat.com>
+CC: Sukumar Ghorai <sukumar.ghorai@intel.com>
+Signed-off-by: Mario Limonciello <mario.limonciello@dell.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/bluetooth/btusb.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -1162,10 +1162,6 @@ static int btusb_open(struct hci_dev *hd
+ }
+
+ data->intf->needs_remote_wakeup = 1;
+- /* device specific wakeup source enabled and required for USB
+- * remote wakeup while host is suspended
+- */
+- device_wakeup_enable(&data->udev->dev);
+
+ if (test_and_set_bit(BTUSB_INTR_RUNNING, &data->flags))
+ goto done;
+@@ -1229,7 +1225,6 @@ static int btusb_close(struct hci_dev *h
+ goto failed;
+
+ data->intf->needs_remote_wakeup = 0;
+- device_wakeup_disable(&data->udev->dev);
+ usb_autopm_put_interface(data->intf);
+
+ failed:
crypto-talitos-do-not-modify-req-cryptlen-on-decryption.patch
crypto-talitos-hmac-snoop-no-afeu-mode-requires-sw-icv-checking.patch
firmware-ti_sci-always-request-response-from-firmware.patch
+drm-panel-orientation-quirks-add-extra-quirk-table-entry-for-gpd-micropc.patch
+drm-mediatek-mtk_drm_drv.c-add-of_node_put-before-goto.patch
+mm-z3fold.c-remove-z3fold_migration-trylock.patch
+mm-z3fold.c-fix-lock-unlock-imbalance-in-z3fold_page_isolate.patch
+revert-bluetooth-btusb-driver-to-enable-the-usb-wakeup-feature.patch
+iio-adc-stm32-dfsdm-fix-output-resolution.patch
+iio-adc-stm32-dfsdm-fix-data-type.patch
+modules-fix-bug-when-load-module-with-rodata-n.patch
+modules-fix-compile-error-if-don-t-have-strict-module-rwx.patch
+modules-always-page-align-module-section-allocations.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
