--- /dev/null
+From c927b080c67e3e97193c81fc1d27f4251bf4e036 Mon Sep 17 00:00:00 2001
+From: Kamil Konieczny <k.konieczny@partner.samsung.com>
+Date: Wed, 7 Feb 2018 16:52:09 +0100
+Subject: crypto: s5p-sss - Fix kernel Oops in AES-ECB mode
+
+From: Kamil Konieczny <k.konieczny@partner.samsung.com>
+
+commit c927b080c67e3e97193c81fc1d27f4251bf4e036 upstream.
+
+In AES-ECB mode crypt is done with key only, so any use of IV
+can cause kernel Oops. Use IV only in AES-CBC and AES-CTR.
+
+Signed-off-by: Kamil Konieczny <k.konieczny@partner.samsung.com>
+Reported-by: Anand Moon <linux.amoon@gmail.com>
+Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
+Tested-by: Anand Moon <linux.amoon@gmail.com>
+Cc: stable@vger.kernel.org # can be applied after commit 8f9702aad138
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/crypto/s5p-sss.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+--- a/drivers/crypto/s5p-sss.c
++++ b/drivers/crypto/s5p-sss.c
+@@ -601,15 +601,21 @@ static void s5p_aes_crypt_start(struct s
+ uint32_t aes_control;
+ unsigned long flags;
+ int err;
++ u8 *iv;
+
+ aes_control = SSS_AES_KEY_CHANGE_MODE;
+ if (mode & FLAGS_AES_DECRYPT)
+ aes_control |= SSS_AES_MODE_DECRYPT;
+
+- if ((mode & FLAGS_AES_MODE_MASK) == FLAGS_AES_CBC)
++ if ((mode & FLAGS_AES_MODE_MASK) == FLAGS_AES_CBC) {
+ aes_control |= SSS_AES_CHAIN_MODE_CBC;
+- else if ((mode & FLAGS_AES_MODE_MASK) == FLAGS_AES_CTR)
++ iv = req->info;
++ } else if ((mode & FLAGS_AES_MODE_MASK) == FLAGS_AES_CTR) {
+ aes_control |= SSS_AES_CHAIN_MODE_CTR;
++ iv = req->info;
++ } else {
++ iv = NULL; /* AES_ECB */
++ }
+
+ if (dev->ctx->keylen == AES_KEYSIZE_192)
+ aes_control |= SSS_AES_KEY_SIZE_192;
+@@ -640,7 +646,7 @@ static void s5p_aes_crypt_start(struct s
+ goto outdata_error;
+
+ SSS_AES_WRITE(dev, AES_CONTROL, aes_control);
+- s5p_set_aes(dev, dev->ctx->aes_key, req->info, dev->ctx->keylen);
++ s5p_set_aes(dev, dev->ctx->aes_key, iv, dev->ctx->keylen);
+
+ s5p_set_dma_indata(dev, dev->sg_src);
+ s5p_set_dma_outdata(dev, dev->sg_dst);
--- /dev/null
+From 2a4ac172c2f257d28c47b90c9e381bec31edcc44 Mon Sep 17 00:00:00 2001
+From: Tomas Winkler <tomas.winkler@intel.com>
+Date: Sun, 18 Feb 2018 11:05:16 +0200
+Subject: mei: me: add cannon point device ids for 4th device
+
+From: Tomas Winkler <tomas.winkler@intel.com>
+
+commit 2a4ac172c2f257d28c47b90c9e381bec31edcc44 upstream.
+
+Add cannon point device ids for 4th (itouch) device.
+
+Cc: <stable@vger.kernel.org> 4.14+
+Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/misc/mei/hw-me-regs.h | 2 ++
+ drivers/misc/mei/pci-me.c | 2 ++
+ 2 files changed, 4 insertions(+)
+
+--- a/drivers/misc/mei/hw-me-regs.h
++++ b/drivers/misc/mei/hw-me-regs.h
+@@ -133,7 +133,9 @@
+ #define MEI_DEV_ID_KBP_2 0xA2BB /* Kaby Point 2 */
+
+ #define MEI_DEV_ID_CNP_LP 0x9DE0 /* Cannon Point LP */
++#define MEI_DEV_ID_CNP_LP_4 0x9DE4 /* Cannon Point LP 4 (iTouch) */
+ #define MEI_DEV_ID_CNP_H 0xA360 /* Cannon Point H */
++#define MEI_DEV_ID_CNP_H_4 0xA364 /* Cannon Point H 4 (iTouch) */
+
+ /*
+ * MEI HW Section
+--- a/drivers/misc/mei/pci-me.c
++++ b/drivers/misc/mei/pci-me.c
+@@ -99,7 +99,9 @@ static const struct pci_device_id mei_me
+ {MEI_PCI_DEVICE(MEI_DEV_ID_KBP_2, MEI_ME_PCH8_CFG)},
+
+ {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_LP, MEI_ME_PCH8_CFG)},
++ {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_LP_4, MEI_ME_PCH8_CFG)},
+ {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H, MEI_ME_PCH8_CFG)},
++ {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H_4, MEI_ME_PCH8_CFG)},
+
+ /* required last entry */
+ {0, }
--- /dev/null
+From f8f4aa68a8ae98ed79c8fee3488c38a2f5d2de8c Mon Sep 17 00:00:00 2001
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+Date: Sun, 18 Feb 2018 11:05:15 +0200
+Subject: mei: me: add cannon point device ids
+
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+
+commit f8f4aa68a8ae98ed79c8fee3488c38a2f5d2de8c upstream.
+
+Add CNP LP and CNP H device ids for cannon lake
+and coffee lake platforms.
+
+Cc: <stable@vger.kernel.org> 4.14+
+Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
+Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/misc/mei/hw-me-regs.h | 3 +++
+ drivers/misc/mei/pci-me.c | 3 +++
+ 2 files changed, 6 insertions(+)
+
+--- a/drivers/misc/mei/hw-me-regs.h
++++ b/drivers/misc/mei/hw-me-regs.h
+@@ -132,6 +132,9 @@
+ #define MEI_DEV_ID_KBP 0xA2BA /* Kaby Point */
+ #define MEI_DEV_ID_KBP_2 0xA2BB /* Kaby Point 2 */
+
++#define MEI_DEV_ID_CNP_LP 0x9DE0 /* Cannon Point LP */
++#define MEI_DEV_ID_CNP_H 0xA360 /* Cannon Point H */
++
+ /*
+ * MEI HW Section
+ */
+--- a/drivers/misc/mei/pci-me.c
++++ b/drivers/misc/mei/pci-me.c
+@@ -98,6 +98,9 @@ static const struct pci_device_id mei_me
+ {MEI_PCI_DEVICE(MEI_DEV_ID_KBP, MEI_ME_PCH8_CFG)},
+ {MEI_PCI_DEVICE(MEI_DEV_ID_KBP_2, MEI_ME_PCH8_CFG)},
+
++ {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_LP, MEI_ME_PCH8_CFG)},
++ {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H, MEI_ME_PCH8_CFG)},
++
+ /* required last entry */
+ {0, }
+ };
hippi-fix-a-fix-a-possible-sleep-in-atomic-bug-in-rr_close.patch
crypto-talitos-fix-kernel-oops-on-hashing-an-empty-file.patch
drm-i915-fix-intel_backlight_device_register-declaration.patch
+crypto-s5p-sss-fix-kernel-oops-in-aes-ecb-mode.patch
+mei-me-add-cannon-point-device-ids.patch
+mei-me-add-cannon-point-device-ids-for-4th-device.patch
+vmalloc-fix-__gfp_highmem-usage-for-vmalloc_32-on-32b-systems.patch
--- /dev/null
+From 698d0831ba87b92ae10b15e8203cfd59f5a59a35 Mon Sep 17 00:00:00 2001
+From: Michal Hocko <mhocko@suse.com>
+Date: Wed, 21 Feb 2018 14:46:01 -0800
+Subject: vmalloc: fix __GFP_HIGHMEM usage for vmalloc_32 on 32b systems
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michal Hocko <mhocko@suse.com>
+
+commit 698d0831ba87b92ae10b15e8203cfd59f5a59a35 upstream.
+
+Kai Heng Feng has noticed that BUG_ON(PageHighMem(pg)) triggers in
+drivers/media/common/saa7146/saa7146_core.c since 19809c2da28a ("mm,
+vmalloc: use __GFP_HIGHMEM implicitly").
+
+saa7146_vmalloc_build_pgtable uses vmalloc_32 and it is reasonable to
+expect that the resulting page is not in highmem. The above commit
+aimed to add __GFP_HIGHMEM only for those requests which do not specify
+any zone modifier gfp flag. vmalloc_32 relies on GFP_VMALLOC32 which
+should do the right thing. Except it has been missed that GFP_VMALLOC32
+is an alias for GFP_KERNEL on 32b architectures. Thanks to Matthew to
+notice this.
+
+Fix the problem by unconditionally setting GFP_DMA32 in GFP_VMALLOC32
+for !64b arches (as a bailout). This should do the right thing and use
+ZONE_NORMAL which should be always below 4G on 32b systems.
+
+Debugged by Matthew Wilcox.
+
+[akpm@linux-foundation.org: coding-style fixes]
+Link: http://lkml.kernel.org/r/20180212095019.GX21609@dhcp22.suse.cz
+Fixes: 19809c2da28a ("mm, vmalloc: use __GFP_HIGHMEM implicitly”)
+Signed-off-by: Michal Hocko <mhocko@suse.com>
+Reported-by: Kai Heng Feng <kai.heng.feng@canonical.com>
+Cc: Matthew Wilcox <willy@infradead.org>
+Cc: Laura Abbott <labbott@redhat.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/vmalloc.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/mm/vmalloc.c
++++ b/mm/vmalloc.c
+@@ -1943,11 +1943,15 @@ void *vmalloc_exec(unsigned long size)
+ }
+
+ #if defined(CONFIG_64BIT) && defined(CONFIG_ZONE_DMA32)
+-#define GFP_VMALLOC32 GFP_DMA32 | GFP_KERNEL
++#define GFP_VMALLOC32 (GFP_DMA32 | GFP_KERNEL)
+ #elif defined(CONFIG_64BIT) && defined(CONFIG_ZONE_DMA)
+-#define GFP_VMALLOC32 GFP_DMA | GFP_KERNEL
++#define GFP_VMALLOC32 (GFP_DMA | GFP_KERNEL)
+ #else
+-#define GFP_VMALLOC32 GFP_KERNEL
++/*
++ * 64b systems should always have either DMA or DMA32 zones. For others
++ * GFP_DMA32 should do the right thing and use the normal zone.
++ */
++#define GFP_VMALLOC32 GFP_DMA32 | GFP_KERNEL
+ #endif
+
+ /**
projects / thirdparty / kernel / stable-queue.git / commitdiff
