--- /dev/null
+From e520d0b6be950ce3738cf4b9bd3b392be818f1dc Mon Sep 17 00:00:00 2001
+From: "Gustavo A. R. Silva" <gustavoars@kernel.org>
+Date: Mon, 31 Jul 2023 21:15:48 -0600
+Subject: cpufreq: brcmstb-avs-cpufreq: Fix -Warray-bounds bug
+
+From: Gustavo A. R. Silva <gustavoars@kernel.org>
+
+commit e520d0b6be950ce3738cf4b9bd3b392be818f1dc upstream.
+
+Allocate extra space for terminating element at:
+
+drivers/cpufreq/brcmstb-avs-cpufreq.c:
+449 table[i].frequency = CPUFREQ_TABLE_END;
+
+and add code comment to make this clear.
+
+This fixes the following -Warray-bounds warning seen after building
+ARM with multi_v7_defconfig (GCC 13):
+In function 'brcm_avs_get_freq_table',
+ inlined from 'brcm_avs_cpufreq_init' at drivers/cpufreq/brcmstb-avs-cpufreq.c:623:15:
+drivers/cpufreq/brcmstb-avs-cpufreq.c:449:28: warning: array subscript 5 is outside array bounds of 'void[60]' [-Warray-bounds=]
+ 449 | table[i].frequency = CPUFREQ_TABLE_END;
+In file included from include/linux/node.h:18,
+ from include/linux/cpu.h:17,
+ from include/linux/cpufreq.h:12,
+ from drivers/cpufreq/brcmstb-avs-cpufreq.c:44:
+In function 'devm_kmalloc_array',
+ inlined from 'devm_kcalloc' at include/linux/device.h:328:9,
+ inlined from 'brcm_avs_get_freq_table' at drivers/cpufreq/brcmstb-avs-cpufreq.c:437:10,
+ inlined from 'brcm_avs_cpufreq_init' at drivers/cpufreq/brcmstb-avs-cpufreq.c:623:15:
+include/linux/device.h:323:16: note: at offset 60 into object of size 60 allocated by 'devm_kmalloc'
+ 323 | return devm_kmalloc(dev, bytes, flags);
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+This helps with the ongoing efforts to tighten the FORTIFY_SOURCE
+routines on memcpy() and help us make progress towards globally
+enabling -Warray-bounds.
+
+Link: https://github.com/KSPP/linux/issues/324
+Fixes: de322e085995 ("cpufreq: brcmstb-avs-cpufreq: AVS CPUfreq driver for Broadcom STB SoCs")
+Cc: stable@vger.kernel.org
+Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
+Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/cpufreq/brcmstb-avs-cpufreq.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/cpufreq/brcmstb-avs-cpufreq.c
++++ b/drivers/cpufreq/brcmstb-avs-cpufreq.c
+@@ -434,7 +434,11 @@ brcm_avs_get_freq_table(struct device *d
+ if (ret)
+ return ERR_PTR(ret);
+
+- table = devm_kcalloc(dev, AVS_PSTATE_MAX + 1, sizeof(*table),
++ /*
++ * We allocate space for the 5 different P-STATES AVS,
++ * plus extra space for a terminating element.
++ */
++ table = devm_kcalloc(dev, AVS_PSTATE_MAX + 1 + 1, sizeof(*table),
+ GFP_KERNEL);
+ if (!table)
+ return ERR_PTR(-ENOMEM);
--- /dev/null
+From d9c83f71eeceed2cb54bb78be84f2d4055fd9a1f Mon Sep 17 00:00:00 2001
+From: Thomas Bourgoin <thomas.bourgoin@foss.st.com>
+Date: Thu, 13 Jul 2023 17:15:15 +0200
+Subject: crypto: stm32 - fix loop iterating through scatterlist for DMA
+
+From: Thomas Bourgoin <thomas.bourgoin@foss.st.com>
+
+commit d9c83f71eeceed2cb54bb78be84f2d4055fd9a1f upstream.
+
+We were reading the length of the scatterlist sg after copying value of
+tsg inside.
+So we are using the size of the previous scatterlist and for the first
+one we are using an unitialised value.
+Fix this by copying tsg in sg[0] before reading the size.
+
+Fixes : 8a1012d3f2ab ("crypto: stm32 - Support for STM32 HASH module")
+Cc: stable@vger.kernel.org
+Signed-off-by: Thomas Bourgoin <thomas.bourgoin@foss.st.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/stm32/stm32-hash.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/crypto/stm32/stm32-hash.c
++++ b/drivers/crypto/stm32/stm32-hash.c
+@@ -627,9 +627,9 @@ static int stm32_hash_dma_send(struct st
+ }
+
+ for_each_sg(rctx->sg, tsg, rctx->nents, i) {
++ sg[0] = *tsg;
+ len = sg->length;
+
+- sg[0] = *tsg;
+ if (sg_is_last(sg)) {
+ if (hdev->dma_mode == 1) {
+ len = (ALIGN(sg->length, 16) - 16);
--- /dev/null
+From a4adfbc2544933ac12e7fbd50708290265546dbc Mon Sep 17 00:00:00 2001
+From: Thomas Bourgoin <thomas.bourgoin@foss.st.com>
+Date: Thu, 13 Jul 2023 17:15:17 +0200
+Subject: crypto: stm32 - fix MDMAT condition
+
+From: Thomas Bourgoin <thomas.bourgoin@foss.st.com>
+
+commit a4adfbc2544933ac12e7fbd50708290265546dbc upstream.
+
+If IP has MDMAT support, set or reset the bit MDMAT in Control Register.
+
+Fixes: b56403a25af7 ("crypto: stm32/hash - Support Ux500 hash")
+Cc: stable@vger.kernel.org
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Thomas Bourgoin <thomas.bourgoin@foss.st.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/stm32/stm32-hash.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/crypto/stm32/stm32-hash.c
++++ b/drivers/crypto/stm32/stm32-hash.c
+@@ -492,7 +492,7 @@ static int stm32_hash_xmit_dma(struct st
+
+ reg = stm32_hash_read(hdev, HASH_CR);
+
+- if (!hdev->pdata->has_mdmat) {
++ if (hdev->pdata->has_mdmat) {
+ if (mdma)
+ reg |= HASH_CR_MDMAT;
+ else
--- /dev/null
+From 60165ab774cb0c509680a73cf826d0e158454653 Mon Sep 17 00:00:00 2001
+From: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Date: Wed, 12 Jul 2023 17:02:34 +0200
+Subject: HID: logitech-hidpp: rework one more time the retries attempts
+
+From: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+
+commit 60165ab774cb0c509680a73cf826d0e158454653 upstream.
+
+Extract the internal code inside a helper function, fix the
+initialization of the parameters used in the helper function
+(`hidpp->answer_available` was not reset and `*response` wasn't either),
+and use a `do {...} while();` loop.
+
+Fixes: 586e8fede795 ("HID: logitech-hidpp: Retry commands when device is busy")
+Cc: stable@vger.kernel.org
+Reviewed-by: Bastien Nocera <hadess@hadess.net>
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Link: https://lore.kernel.org/r/20230621-logitech-fixes-v2-1-3635f7f9c8af@kernel.org
+Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/hid-logitech-hidpp.c | 115 +++++++++++++++++++++++++--------------
+ 1 file changed, 75 insertions(+), 40 deletions(-)
+
+--- a/drivers/hid/hid-logitech-hidpp.c
++++ b/drivers/hid/hid-logitech-hidpp.c
+@@ -275,21 +275,22 @@ static int __hidpp_send_report(struct hi
+ }
+
+ /*
+- * hidpp_send_message_sync() returns 0 in case of success, and something else
+- * in case of a failure.
+- * - If ' something else' is positive, that means that an error has been raised
+- * by the protocol itself.
+- * - If ' something else' is negative, that means that we had a classic error
+- * (-ENOMEM, -EPIPE, etc...)
++ * Effectively send the message to the device, waiting for its answer.
++ *
++ * Must be called with hidpp->send_mutex locked
++ *
++ * Same return protocol than hidpp_send_message_sync():
++ * - success on 0
++ * - negative error means transport error
++ * - positive value means protocol error
+ */
+-static int hidpp_send_message_sync(struct hidpp_device *hidpp,
++static int __do_hidpp_send_message_sync(struct hidpp_device *hidpp,
+ struct hidpp_report *message,
+ struct hidpp_report *response)
+ {
+- int ret = -1;
+- int max_retries = 3;
++ int ret;
+
+- mutex_lock(&hidpp->send_mutex);
++ __must_hold(&hidpp->send_mutex);
+
+ hidpp->send_receive_buf = response;
+ hidpp->answer_available = false;
+@@ -300,47 +301,74 @@ static int hidpp_send_message_sync(struc
+ */
+ *response = *message;
+
+- for (; max_retries != 0 && ret; max_retries--) {
+- ret = __hidpp_send_report(hidpp->hid_dev, message);
++ ret = __hidpp_send_report(hidpp->hid_dev, message);
++ if (ret) {
++ dbg_hid("__hidpp_send_report returned err: %d\n", ret);
++ memset(response, 0, sizeof(struct hidpp_report));
++ return ret;
++ }
+
+- if (ret) {
+- dbg_hid("__hidpp_send_report returned err: %d\n", ret);
+- memset(response, 0, sizeof(struct hidpp_report));
+- break;
+- }
++ if (!wait_event_timeout(hidpp->wait, hidpp->answer_available,
++ 5*HZ)) {
++ dbg_hid("%s:timeout waiting for response\n", __func__);
++ memset(response, 0, sizeof(struct hidpp_report));
++ return -ETIMEDOUT;
++ }
+
+- if (!wait_event_timeout(hidpp->wait, hidpp->answer_available,
+- 5*HZ)) {
+- dbg_hid("%s:timeout waiting for response\n", __func__);
+- memset(response, 0, sizeof(struct hidpp_report));
+- ret = -ETIMEDOUT;
+- break;
+- }
++ if (response->report_id == REPORT_ID_HIDPP_SHORT &&
++ response->rap.sub_id == HIDPP_ERROR) {
++ ret = response->rap.params[1];
++ dbg_hid("%s:got hidpp error %02X\n", __func__, ret);
++ return ret;
++ }
+
+- if (response->report_id == REPORT_ID_HIDPP_SHORT &&
+- response->rap.sub_id == HIDPP_ERROR) {
+- ret = response->rap.params[1];
+- dbg_hid("%s:got hidpp error %02X\n", __func__, ret);
++ if ((response->report_id == REPORT_ID_HIDPP_LONG ||
++ response->report_id == REPORT_ID_HIDPP_VERY_LONG) &&
++ response->fap.feature_index == HIDPP20_ERROR) {
++ ret = response->fap.params[1];
++ dbg_hid("%s:got hidpp 2.0 error %02X\n", __func__, ret);
++ return ret;
++ }
++
++ return 0;
++}
++
++/*
++ * hidpp_send_message_sync() returns 0 in case of success, and something else
++ * in case of a failure.
++ *
++ * See __do_hidpp_send_message_sync() for a detailed explanation of the returned
++ * value.
++ */
++static int hidpp_send_message_sync(struct hidpp_device *hidpp,
++ struct hidpp_report *message,
++ struct hidpp_report *response)
++{
++ int ret;
++ int max_retries = 3;
++
++ mutex_lock(&hidpp->send_mutex);
++
++ do {
++ ret = __do_hidpp_send_message_sync(hidpp, message, response);
++ if (ret != HIDPP20_ERROR_BUSY)
+ break;
+- }
+
+- if ((response->report_id == REPORT_ID_HIDPP_LONG ||
+- response->report_id == REPORT_ID_HIDPP_VERY_LONG) &&
+- response->fap.feature_index == HIDPP20_ERROR) {
+- ret = response->fap.params[1];
+- if (ret != HIDPP20_ERROR_BUSY) {
+- dbg_hid("%s:got hidpp 2.0 error %02X\n", __func__, ret);
+- break;
+- }
+- dbg_hid("%s:got busy hidpp 2.0 error %02X, retrying\n", __func__, ret);
+- }
+- }
++ dbg_hid("%s:got busy hidpp 2.0 error %02X, retrying\n", __func__, ret);
++ } while (--max_retries);
+
+ mutex_unlock(&hidpp->send_mutex);
+ return ret;
+
+ }
+
++/*
++ * hidpp_send_fap_command_sync() returns 0 in case of success, and something else
++ * in case of a failure.
++ *
++ * See __do_hidpp_send_message_sync() for a detailed explanation of the returned
++ * value.
++ */
+ static int hidpp_send_fap_command_sync(struct hidpp_device *hidpp,
+ u8 feat_index, u8 funcindex_clientid, u8 *params, int param_count,
+ struct hidpp_report *response)
+@@ -373,6 +401,13 @@ static int hidpp_send_fap_command_sync(s
+ return ret;
+ }
+
++/*
++ * hidpp_send_rap_command_sync() returns 0 in case of success, and something else
++ * in case of a failure.
++ *
++ * See __do_hidpp_send_message_sync() for a detailed explanation of the returned
++ * value.
++ */
+ static int hidpp_send_rap_command_sync(struct hidpp_device *hidpp_dev,
+ u8 report_id, u8 sub_id, u8 reg_address, u8 *params, int param_count,
+ struct hidpp_report *response)
--- /dev/null
+From f741bd7178c95abd7aeac5a9d933ee542f9a5509 Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Fri, 8 Sep 2023 17:03:20 +0100
+Subject: iov_iter: Fix iov_iter_extract_pages() with zero-sized entries
+
+From: David Howells <dhowells@redhat.com>
+
+commit f741bd7178c95abd7aeac5a9d933ee542f9a5509 upstream.
+
+iov_iter_extract_pages() doesn't correctly handle skipping over initial
+zero-length entries in ITER_KVEC and ITER_BVEC-type iterators.
+
+The problem is that it accidentally reduces maxsize to 0 when it
+skipping and thus runs to the end of the array and returns 0.
+
+Fix this by sticking the calculated size-to-copy in a new variable
+rather than back in maxsize.
+
+Fixes: 7d58fe731028 ("iov_iter: Add a function to extract a page list from an iterator")
+Signed-off-by: David Howells <dhowells@redhat.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Cc: Christian Brauner <brauner@kernel.org>
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Cc: David Hildenbrand <david@redhat.com>
+Cc: John Hubbard <jhubbard@nvidia.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ lib/iov_iter.c | 30 +++++++++++++++---------------
+ 1 file changed, 15 insertions(+), 15 deletions(-)
+
+--- a/lib/iov_iter.c
++++ b/lib/iov_iter.c
+@@ -1640,14 +1640,14 @@ static ssize_t iov_iter_extract_bvec_pag
+ size_t *offset0)
+ {
+ struct page **p, *page;
+- size_t skip = i->iov_offset, offset;
++ size_t skip = i->iov_offset, offset, size;
+ int k;
+
+ for (;;) {
+ if (i->nr_segs == 0)
+ return 0;
+- maxsize = min(maxsize, i->bvec->bv_len - skip);
+- if (maxsize)
++ size = min(maxsize, i->bvec->bv_len - skip);
++ if (size)
+ break;
+ i->iov_offset = 0;
+ i->nr_segs--;
+@@ -1660,16 +1660,16 @@ static ssize_t iov_iter_extract_bvec_pag
+ offset = skip % PAGE_SIZE;
+ *offset0 = offset;
+
+- maxpages = want_pages_array(pages, maxsize, offset, maxpages);
++ maxpages = want_pages_array(pages, size, offset, maxpages);
+ if (!maxpages)
+ return -ENOMEM;
+ p = *pages;
+ for (k = 0; k < maxpages; k++)
+ p[k] = page + k;
+
+- maxsize = min_t(size_t, maxsize, maxpages * PAGE_SIZE - offset);
+- iov_iter_advance(i, maxsize);
+- return maxsize;
++ size = min_t(size_t, size, maxpages * PAGE_SIZE - offset);
++ iov_iter_advance(i, size);
++ return size;
+ }
+
+ /*
+@@ -1684,14 +1684,14 @@ static ssize_t iov_iter_extract_kvec_pag
+ {
+ struct page **p, *page;
+ const void *kaddr;
+- size_t skip = i->iov_offset, offset, len;
++ size_t skip = i->iov_offset, offset, len, size;
+ int k;
+
+ for (;;) {
+ if (i->nr_segs == 0)
+ return 0;
+- maxsize = min(maxsize, i->kvec->iov_len - skip);
+- if (maxsize)
++ size = min(maxsize, i->kvec->iov_len - skip);
++ if (size)
+ break;
+ i->iov_offset = 0;
+ i->nr_segs--;
+@@ -1703,13 +1703,13 @@ static ssize_t iov_iter_extract_kvec_pag
+ offset = (unsigned long)kaddr & ~PAGE_MASK;
+ *offset0 = offset;
+
+- maxpages = want_pages_array(pages, maxsize, offset, maxpages);
++ maxpages = want_pages_array(pages, size, offset, maxpages);
+ if (!maxpages)
+ return -ENOMEM;
+ p = *pages;
+
+ kaddr -= offset;
+- len = offset + maxsize;
++ len = offset + size;
+ for (k = 0; k < maxpages; k++) {
+ size_t seg = min_t(size_t, len, PAGE_SIZE);
+
+@@ -1723,9 +1723,9 @@ static ssize_t iov_iter_extract_kvec_pag
+ kaddr += PAGE_SIZE;
+ }
+
+- maxsize = min_t(size_t, maxsize, maxpages * PAGE_SIZE - offset);
+- iov_iter_advance(i, maxsize);
+- return maxsize;
++ size = min_t(size_t, size, maxpages * PAGE_SIZE - offset);
++ iov_iter_advance(i, size);
++ return size;
+ }
+
+ /*
--- /dev/null
+From fbf0ea2da3c7cd0b33ed7ae53a67ab1c24838cba Mon Sep 17 00:00:00 2001
+From: Douglas Anderson <dianders@chromium.org>
+Date: Thu, 27 Jul 2023 10:16:31 -0700
+Subject: of: property: fw_devlink: Add a devlink for panel followers
+
+From: Douglas Anderson <dianders@chromium.org>
+
+commit fbf0ea2da3c7cd0b33ed7ae53a67ab1c24838cba upstream.
+
+Inform fw_devlink of the fact that a panel follower (like a
+touchscreen) is effectively a consumer of the panel from the purposes
+of fw_devlink.
+
+NOTE: this patch isn't required for correctness but instead optimizes
+probe order / helps avoid deferrals.
+
+Acked-by: Rob Herring <robh@kernel.org>
+Reviewed-by: Maxime Ripard <mripard@kernel.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230727101636.v4.4.Ibf8e1342b5b7906279db2365aca45e6253857bb3@changeid
+Cc: Adam Ford <aford173@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/of/property.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/of/property.c
++++ b/drivers/of/property.c
+@@ -1266,6 +1266,7 @@ DEFINE_SIMPLE_PROP(pwms, "pwms", "#pwm-c
+ DEFINE_SIMPLE_PROP(resets, "resets", "#reset-cells")
+ DEFINE_SIMPLE_PROP(leds, "leds", NULL)
+ DEFINE_SIMPLE_PROP(backlight, "backlight", NULL)
++DEFINE_SIMPLE_PROP(panel, "panel", NULL)
+ DEFINE_SUFFIX_PROP(regulators, "-supply", NULL)
+ DEFINE_SUFFIX_PROP(gpio, "-gpio", "#gpio-cells")
+
+@@ -1354,6 +1355,7 @@ static const struct supplier_bindings of
+ { .parse_prop = parse_resets, },
+ { .parse_prop = parse_leds, },
+ { .parse_prop = parse_backlight, },
++ { .parse_prop = parse_panel, },
+ { .parse_prop = parse_gpio_compat, },
+ { .parse_prop = parse_interrupts, },
+ { .parse_prop = parse_regulators, },
--- /dev/null
+From 9300f00439743c4a34d735e1a27118eb68a1504e Mon Sep 17 00:00:00 2001
+From: Andy Chiu <andy.chiu@sifive.com>
+Date: Fri, 25 Aug 2023 05:02:46 +0000
+Subject: RISC-V: Add ptrace support for vectors
+
+From: Andy Chiu <andy.chiu@sifive.com>
+
+commit 9300f00439743c4a34d735e1a27118eb68a1504e upstream.
+
+This patch add back the ptrace support with the following fix:
+ - Define NT_RISCV_CSR and re-number NT_RISCV_VECTOR to prevent
+ conflicting with gdb's NT_RISCV_CSR.
+ - Use struct __riscv_v_regset_state to handle ptrace requests
+
+Since gdb does not directly include the note description header in
+Linux and has already defined NT_RISCV_CSR as 0x900, we decide to
+sync with gdb and renumber NT_RISCV_VECTOR to solve and prevent future
+conflicts.
+
+Fixes: 0c59922c769a ("riscv: Add ptrace vector support")
+Signed-off-by: Andy Chiu <andy.chiu@sifive.com>
+Link: https://lore.kernel.org/r/20230825050248.32681-1-andy.chiu@sifive.com
+[Palmer: Drop the unused "size" variable in riscv_vr_set().]
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/riscv/include/uapi/asm/ptrace.h | 13 +++--
+ arch/riscv/kernel/ptrace.c | 79 ++++++++++++++++++++++++++++
+ include/uapi/linux/elf.h | 2 +
+ 3 files changed, 90 insertions(+), 4 deletions(-)
+
+diff --git a/arch/riscv/include/uapi/asm/ptrace.h b/arch/riscv/include/uapi/asm/ptrace.h
+index 283800130614..575e95bb1bc3 100644
+--- a/arch/riscv/include/uapi/asm/ptrace.h
++++ b/arch/riscv/include/uapi/asm/ptrace.h
+@@ -103,13 +103,18 @@ struct __riscv_v_ext_state {
+ * In signal handler, datap will be set a correct user stack offset
+ * and vector registers will be copied to the address of datap
+ * pointer.
+- *
+- * In ptrace syscall, datap will be set to zero and the vector
+- * registers will be copied to the address right after this
+- * structure.
+ */
+ };
+
++struct __riscv_v_regset_state {
++ unsigned long vstart;
++ unsigned long vl;
++ unsigned long vtype;
++ unsigned long vcsr;
++ unsigned long vlenb;
++ char vreg[];
++};
++
+ /*
+ * According to spec: The number of bits in a single vector register,
+ * VLEN >= ELEN, which must be a power of 2, and must be no greater than
+diff --git a/arch/riscv/kernel/ptrace.c b/arch/riscv/kernel/ptrace.c
+index 487303e3ef22..2afe460de16a 100644
+--- a/arch/riscv/kernel/ptrace.c
++++ b/arch/riscv/kernel/ptrace.c
+@@ -25,6 +25,9 @@ enum riscv_regset {
+ #ifdef CONFIG_FPU
+ REGSET_F,
+ #endif
++#ifdef CONFIG_RISCV_ISA_V
++ REGSET_V,
++#endif
+ };
+
+ static int riscv_gpr_get(struct task_struct *target,
+@@ -81,6 +84,71 @@ static int riscv_fpr_set(struct task_struct *target,
+ }
+ #endif
+
++#ifdef CONFIG_RISCV_ISA_V
++static int riscv_vr_get(struct task_struct *target,
++ const struct user_regset *regset,
++ struct membuf to)
++{
++ struct __riscv_v_ext_state *vstate = &target->thread.vstate;
++ struct __riscv_v_regset_state ptrace_vstate;
++
++ if (!riscv_v_vstate_query(task_pt_regs(target)))
++ return -EINVAL;
++
++ /*
++ * Ensure the vector registers have been saved to the memory before
++ * copying them to membuf.
++ */
++ if (target == current)
++ riscv_v_vstate_save(current, task_pt_regs(current));
++
++ ptrace_vstate.vstart = vstate->vstart;
++ ptrace_vstate.vl = vstate->vl;
++ ptrace_vstate.vtype = vstate->vtype;
++ ptrace_vstate.vcsr = vstate->vcsr;
++ ptrace_vstate.vlenb = vstate->vlenb;
++
++ /* Copy vector header from vstate. */
++ membuf_write(&to, &ptrace_vstate, sizeof(struct __riscv_v_regset_state));
++
++ /* Copy all the vector registers from vstate. */
++ return membuf_write(&to, vstate->datap, riscv_v_vsize);
++}
++
++static int riscv_vr_set(struct task_struct *target,
++ const struct user_regset *regset,
++ unsigned int pos, unsigned int count,
++ const void *kbuf, const void __user *ubuf)
++{
++ int ret;
++ struct __riscv_v_ext_state *vstate = &target->thread.vstate;
++ struct __riscv_v_regset_state ptrace_vstate;
++
++ if (!riscv_v_vstate_query(task_pt_regs(target)))
++ return -EINVAL;
++
++ /* Copy rest of the vstate except datap */
++ ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &ptrace_vstate, 0,
++ sizeof(struct __riscv_v_regset_state));
++ if (unlikely(ret))
++ return ret;
++
++ if (vstate->vlenb != ptrace_vstate.vlenb)
++ return -EINVAL;
++
++ vstate->vstart = ptrace_vstate.vstart;
++ vstate->vl = ptrace_vstate.vl;
++ vstate->vtype = ptrace_vstate.vtype;
++ vstate->vcsr = ptrace_vstate.vcsr;
++
++ /* Copy all the vector registers. */
++ pos = 0;
++ ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, vstate->datap,
++ 0, riscv_v_vsize);
++ return ret;
++}
++#endif
++
+ static const struct user_regset riscv_user_regset[] = {
+ [REGSET_X] = {
+ .core_note_type = NT_PRSTATUS,
+@@ -100,6 +168,17 @@ static const struct user_regset riscv_user_regset[] = {
+ .set = riscv_fpr_set,
+ },
+ #endif
++#ifdef CONFIG_RISCV_ISA_V
++ [REGSET_V] = {
++ .core_note_type = NT_RISCV_VECTOR,
++ .align = 16,
++ .n = ((32 * RISCV_MAX_VLENB) +
++ sizeof(struct __riscv_v_regset_state)) / sizeof(__u32),
++ .size = sizeof(__u32),
++ .regset_get = riscv_vr_get,
++ .set = riscv_vr_set,
++ },
++#endif
+ };
+
+ static const struct user_regset_view riscv_user_native_view = {
+diff --git a/include/uapi/linux/elf.h b/include/uapi/linux/elf.h
+index e0e159138331..20e285fdbc46 100644
+--- a/include/uapi/linux/elf.h
++++ b/include/uapi/linux/elf.h
+@@ -443,6 +443,8 @@ typedef struct elf64_shdr {
+ #define NT_MIPS_DSP 0x800 /* MIPS DSP ASE registers */
+ #define NT_MIPS_FP_MODE 0x801 /* MIPS floating-point mode */
+ #define NT_MIPS_MSA 0x802 /* MIPS SIMD registers */
++#define NT_RISCV_CSR 0x900 /* RISC-V Control and Status Registers */
++#define NT_RISCV_VECTOR 0x901 /* RISC-V vector registers */
+ #define NT_LOONGARCH_CPUCFG 0xa00 /* LoongArch CPU config registers */
+ #define NT_LOONGARCH_CSR 0xa01 /* LoongArch control and status registers */
+ #define NT_LOONGARCH_LSX 0xa02 /* LoongArch Loongson SIMD Extension registers */
+--
+2.42.0
+
--- /dev/null
+From f7cf22424665043787a96a66a048ff6b2cfd473c Mon Sep 17 00:00:00 2001
+From: Heiko Carstens <hca@linux.ibm.com>
+Date: Mon, 28 Aug 2023 17:31:42 +0200
+Subject: s390/dasd: fix string length handling
+
+From: Heiko Carstens <hca@linux.ibm.com>
+
+commit f7cf22424665043787a96a66a048ff6b2cfd473c upstream.
+
+Building dasd_eckd.o with latest clang reveals this bug:
+
+ CC drivers/s390/block/dasd_eckd.o
+ drivers/s390/block/dasd_eckd.c:1082:3: warning: 'snprintf' will always be truncated;
+ specified size is 1, but format string expands to at least 11 [-Wfortify-source]
+ 1082 | snprintf(print_uid, sizeof(*print_uid),
+ | ^
+ drivers/s390/block/dasd_eckd.c:1087:3: warning: 'snprintf' will always be truncated;
+ specified size is 1, but format string expands to at least 10 [-Wfortify-source]
+ 1087 | snprintf(print_uid, sizeof(*print_uid),
+ | ^
+
+Fix this by moving and using the existing UID_STRLEN for the arrays
+that are being written to. Also rename UID_STRLEN to DASD_UID_STRLEN
+to clarify its scope.
+
+Fixes: 23596961b437 ("s390/dasd: split up dasd_eckd_read_conf")
+Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Tested-by: Nick Desaulniers <ndesaulniers@google.com> # build
+Reported-by: Nathan Chancellor <nathan@kernel.org>
+Closes: https://github.com/ClangBuiltLinux/linux/issues/1923
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Link: https://lore.kernel.org/r/20230828153142.2843753-2-hca@linux.ibm.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/s390/block/dasd_devmap.c | 6 +-----
+ drivers/s390/block/dasd_eckd.c | 10 +++++-----
+ drivers/s390/block/dasd_int.h | 4 ++++
+ 3 files changed, 10 insertions(+), 10 deletions(-)
+
+--- a/drivers/s390/block/dasd_devmap.c
++++ b/drivers/s390/block/dasd_devmap.c
+@@ -1378,16 +1378,12 @@ static ssize_t dasd_vendor_show(struct d
+
+ static DEVICE_ATTR(vendor, 0444, dasd_vendor_show, NULL);
+
+-#define UID_STRLEN ( /* vendor */ 3 + 1 + /* serial */ 14 + 1 +\
+- /* SSID */ 4 + 1 + /* unit addr */ 2 + 1 +\
+- /* vduit */ 32 + 1)
+-
+ static ssize_t
+ dasd_uid_show(struct device *dev, struct device_attribute *attr, char *buf)
+ {
++ char uid_string[DASD_UID_STRLEN];
+ struct dasd_device *device;
+ struct dasd_uid uid;
+- char uid_string[UID_STRLEN];
+ char ua_string[3];
+
+ device = dasd_device_from_cdev(to_ccwdev(dev));
+--- a/drivers/s390/block/dasd_eckd.c
++++ b/drivers/s390/block/dasd_eckd.c
+@@ -1079,12 +1079,12 @@ static void dasd_eckd_get_uid_string(str
+
+ create_uid(conf, &uid);
+ if (strlen(uid.vduit) > 0)
+- snprintf(print_uid, sizeof(*print_uid),
++ snprintf(print_uid, DASD_UID_STRLEN,
+ "%s.%s.%04x.%02x.%s",
+ uid.vendor, uid.serial, uid.ssid,
+ uid.real_unit_addr, uid.vduit);
+ else
+- snprintf(print_uid, sizeof(*print_uid),
++ snprintf(print_uid, DASD_UID_STRLEN,
+ "%s.%s.%04x.%02x",
+ uid.vendor, uid.serial, uid.ssid,
+ uid.real_unit_addr);
+@@ -1093,8 +1093,8 @@ static void dasd_eckd_get_uid_string(str
+ static int dasd_eckd_check_cabling(struct dasd_device *device,
+ void *conf_data, __u8 lpm)
+ {
++ char print_path_uid[DASD_UID_STRLEN], print_device_uid[DASD_UID_STRLEN];
+ struct dasd_eckd_private *private = device->private;
+- char print_path_uid[60], print_device_uid[60];
+ struct dasd_conf path_conf;
+
+ path_conf.data = conf_data;
+@@ -1293,9 +1293,9 @@ static void dasd_eckd_path_available_act
+ __u8 path_rcd_buf[DASD_ECKD_RCD_DATA_SIZE];
+ __u8 lpm, opm, npm, ppm, epm, hpfpm, cablepm;
+ struct dasd_conf_data *conf_data;
++ char print_uid[DASD_UID_STRLEN];
+ struct dasd_conf path_conf;
+ unsigned long flags;
+- char print_uid[60];
+ int rc, pos;
+
+ opm = 0;
+@@ -5855,8 +5855,8 @@ static void dasd_eckd_dump_sense(struct
+ static int dasd_eckd_reload_device(struct dasd_device *device)
+ {
+ struct dasd_eckd_private *private = device->private;
++ char print_uid[DASD_UID_STRLEN];
+ int rc, old_base;
+- char print_uid[60];
+ struct dasd_uid uid;
+ unsigned long flags;
+
+--- a/drivers/s390/block/dasd_int.h
++++ b/drivers/s390/block/dasd_int.h
+@@ -259,6 +259,10 @@ struct dasd_uid {
+ char vduit[33];
+ };
+
++#define DASD_UID_STRLEN ( /* vendor */ 3 + 1 + /* serial */ 14 + 1 + \
++ /* SSID */ 4 + 1 + /* unit addr */ 2 + 1 + \
++ /* vduit */ 32 + 1)
++
+ /*
+ * PPRC Status data
+ */
--- /dev/null
+From c8f40a0bccefd613748d080147469a4652d6e74c Mon Sep 17 00:00:00 2001
+From: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
+Date: Thu, 10 Aug 2023 10:22:36 +0200
+Subject: s390/dcssblk: fix kernel crash with list_add corruption
+
+From: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
+
+commit c8f40a0bccefd613748d080147469a4652d6e74c upstream.
+
+Commit fb08a1908cb1 ("dax: simplify the dax_device <-> gendisk
+association") introduced new logic for gendisk association, requiring
+drivers to explicitly call dax_add_host() and dax_remove_host().
+
+For dcssblk driver, some dax_remove_host() calls were missing, e.g. in
+device remove path. The commit also broke error handling for out_dax case
+in device add path, resulting in an extra put_device() w/o the previous
+get_device() in that case.
+
+This lead to stale xarray entries after device add / remove cycles. In the
+case when a previously used struct gendisk pointer (xarray index) would be
+used again, because blk_alloc_disk() happened to return such a pointer, the
+xa_insert() in dax_add_host() would fail and go to out_dax, doing the extra
+put_device() in the error path. In combination with an already flawed error
+handling in dcssblk (device_register() cleanup), which needs to be
+addressed in a separate patch, this resulted in a missing device_del() /
+klist_del(), and eventually in the kernel crash with list_add corruption on
+a subsequent device_add() / klist_add().
+
+Fix this by adding the missing dax_remove_host() calls, and also move the
+put_device() in the error path to restore the previous logic.
+
+Fixes: fb08a1908cb1 ("dax: simplify the dax_device <-> gendisk association")
+Cc: <stable@vger.kernel.org> # 5.17+
+Acked-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/s390/block/dcssblk.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/s390/block/dcssblk.c
++++ b/drivers/s390/block/dcssblk.c
+@@ -412,6 +412,7 @@ removeseg:
+ }
+ list_del(&dev_info->lh);
+
++ dax_remove_host(dev_info->gd);
+ kill_dax(dev_info->dax_dev);
+ put_dax(dev_info->dax_dev);
+ del_gendisk(dev_info->gd);
+@@ -707,9 +708,9 @@ dcssblk_add_store(struct device *dev, st
+ goto out;
+
+ out_dax_host:
++ put_device(&dev_info->dev);
+ dax_remove_host(dev_info->gd);
+ out_dax:
+- put_device(&dev_info->dev);
+ kill_dax(dev_info->dax_dev);
+ put_dax(dev_info->dax_dev);
+ put_dev:
+@@ -789,6 +790,7 @@ dcssblk_remove_store(struct device *dev,
+ }
+
+ list_del(&dev_info->lh);
++ dax_remove_host(dev_info->gd);
+ kill_dax(dev_info->dax_dev);
+ put_dax(dev_info->dax_dev);
+ del_gendisk(dev_info->gd);
--- /dev/null
+From ea5717cb13468323a7c3dd394748301802991f39 Mon Sep 17 00:00:00 2001
+From: Sven Schnelle <svens@linux.ibm.com>
+Date: Tue, 15 Aug 2023 09:26:06 +0200
+Subject: s390/ipl: add missing secure/has_secure file to ipl type 'unknown'
+
+From: Sven Schnelle <svens@linux.ibm.com>
+
+commit ea5717cb13468323a7c3dd394748301802991f39 upstream.
+
+OS installers are relying on /sys/firmware/ipl/has_secure to be
+present on machines supporting secure boot. This file is present
+for all IPL types, but not the unknown type, which prevents a secure
+installation when an LPAR is booted in HMC via FTP(s), because
+this is an unknown IPL type in linux. While at it, also add the secure
+file.
+
+Fixes: c9896acc7851 ("s390/ipl: Provide has_secure sysfs attribute")
+Cc: stable@vger.kernel.org
+Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
+Reviewed-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/s390/kernel/ipl.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/s390/kernel/ipl.c
++++ b/arch/s390/kernel/ipl.c
+@@ -640,6 +640,8 @@ static struct attribute_group ipl_ccw_at
+
+ static struct attribute *ipl_unknown_attrs[] = {
+ &sys_ipl_type_attr.attr,
++ &sys_ipl_secure_attr.attr,
++ &sys_ipl_has_secure_attr.attr,
+ NULL,
+ };
+
pstore-ram-check-start-of-empty-przs-during-init.patch
arm64-sdei-abort-running-sdei-handlers-during-crash.patch
regulator-dt-bindings-qcom-rpm-fix-pattern-for-children.patch
+iov_iter-fix-iov_iter_extract_pages-with-zero-sized-entries.patch
+risc-v-add-ptrace-support-for-vectors.patch
+s390-dcssblk-fix-kernel-crash-with-list_add-corruption.patch
+s390-ipl-add-missing-secure-has_secure-file-to-ipl-type-unknown.patch
+s390-dasd-fix-string-length-handling.patch
+hid-logitech-hidpp-rework-one-more-time-the-retries-attempts.patch
+crypto-stm32-fix-loop-iterating-through-scatterlist-for-dma.patch
+crypto-stm32-fix-mdmat-condition.patch
+cpufreq-brcmstb-avs-cpufreq-fix-warray-bounds-bug.patch
+of-property-fw_devlink-add-a-devlink-for-panel-followers.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
