--- /dev/null
+From eb82594b75b0cf54c667189e061934b7c49b5d42 Mon Sep 17 00:00:00 2001
+From: David Henningsson <david.henningsson@canonical.com>
+Date: Fri, 29 Nov 2013 15:10:20 +0800
+Subject: ALSA: hda - Add mono speaker quirk for Dell Inspiron 5439
+
+From: David Henningsson <david.henningsson@canonical.com>
+
+commit eb82594b75b0cf54c667189e061934b7c49b5d42 upstream.
+
+This machine also has mono output if run through DAC node 0x03.
+
+BugLink: https://bugs.launchpad.net/bugs/1256212
+Tested-by: David Chen <david.chen@canonical.com>
+Signed-off-by: David Henningsson <david.henningsson@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -4007,6 +4007,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1028, 0x0613, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x0614, "Dell Inspiron 3135", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x0616, "Dell Vostro 5470", ALC290_FIXUP_MONO_SPEAKERS),
++ SND_PCI_QUIRK(0x1028, 0x0638, "Dell Inspiron 5439", ALC290_FIXUP_MONO_SPEAKERS),
+ SND_PCI_QUIRK(0x1028, 0x15cc, "Dell X5 Precision", ALC269_FIXUP_DELL2_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x15cd, "Dell X5 Precision", ALC269_FIXUP_DELL2_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),
--- /dev/null
+From e7ca237bfcf6a288702cb95e94ab94f642ccad88 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 2 Dec 2013 15:27:19 +0100
+Subject: ALSA: hda - Another fixup for ASUS laptop with ALC660 codec
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit e7ca237bfcf6a288702cb95e94ab94f642ccad88 upstream.
+
+ASUS Z35HL laptop also needs the very same fix as the previous one
+that was applied to ASUS W7J.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=66231
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -4331,6 +4331,7 @@ static const struct hda_fixup alc861_fix
+
+ static const struct snd_pci_quirk alc861_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1043, 0x1253, "ASUS W7J", ALC660_FIXUP_ASUS_W7J),
++ SND_PCI_QUIRK(0x1043, 0x1263, "ASUS Z35HL", ALC660_FIXUP_ASUS_W7J),
+ SND_PCI_QUIRK(0x1043, 0x1393, "ASUS A6Rp", ALC861_FIXUP_ASUS_A6RP),
+ SND_PCI_QUIRK_VENDOR(0x1043, "ASUS laptop", ALC861_FIXUP_AMP_VREF_0F),
+ SND_PCI_QUIRK(0x1462, 0x7254, "HP DX2200", ALC861_FIXUP_NO_JACK_DETECT),
--- /dev/null
+From 1cd9b2f78bf29d5282e02b32f9b3ecebc5842a7c Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 2 Dec 2013 13:19:45 +0100
+Subject: ALSA: hda - Fix bad EAPD setup for HP machines with AD1984A
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 1cd9b2f78bf29d5282e02b32f9b3ecebc5842a7c upstream.
+
+It seems that EAPD on NID 0x16 is the only control over all outputs on
+HP machines with AD1984A while turning EAPD on NID 0x12 breaks the
+output. Thus we need to avoid fiddling EAPD on NID. As a quick
+workaround, just set own_eapd_ctrl flag for the wrong EAPD, then
+implement finer EAPD controls.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=66321
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_analog.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_analog.c
++++ b/sound/pci/hda/patch_analog.c
+@@ -964,6 +964,7 @@ static void ad1884_fixup_hp_eapd(struct
+ switch (action) {
+ case HDA_FIXUP_ACT_PRE_PROBE:
+ spec->gen.vmaster_mute.hook = ad1884_vmaster_hp_gpio_hook;
++ spec->gen.own_eapd_ctl = 1;
+ snd_hda_sequence_write_cache(codec, gpio_init_verbs);
+ break;
+ case HDA_FIXUP_ACT_PROBE:
--- /dev/null
+From d59915d0655c5864b514f21daaeac98c047875dc Mon Sep 17 00:00:00 2001
+From: David Henningsson <david.henningsson@canonical.com>
+Date: Mon, 2 Dec 2013 18:06:20 +0800
+Subject: ALSA: hda - Fix headset mic input after muted internal mic (Dell/Realtek)
+
+From: David Henningsson <david.henningsson@canonical.com>
+
+commit d59915d0655c5864b514f21daaeac98c047875dc upstream.
+
+By trial and error, I found this patch could work around an issue
+where the headset mic would stop working if you switch between the
+internal mic and the headset mic, and the internal mic was muted.
+
+It still takes a second or two before the headset mic actually starts
+working, but still better than nothing.
+
+Information update from Kailang:
+ The verb was ADC digital mute(bit 6 default 1).
+ Switch internal mic and headset mic will run alc_headset_mode_default.
+ The coef index 0x11 will set to 0x0041.
+ Because headset mode was fixed type. It doesn't need to run
+ alc_determine_headset_type.
+ So, the value still keep 0x0041. ADC was muted.
+
+BugLink: https://bugs.launchpad.net/bugs/1256840
+Signed-off-by: David Henningsson <david.henningsson@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -3231,6 +3231,7 @@ static void alc_headset_mode_ctia(struct
+ alc_write_coef_idx(codec, 0x18, 0x7388);
+ break;
+ case 0x10ec0668:
++ alc_write_coef_idx(codec, 0x11, 0x0001);
+ alc_write_coef_idx(codec, 0x15, 0x0d60);
+ alc_write_coef_idx(codec, 0xc3, 0x0000);
+ break;
+@@ -3253,6 +3254,7 @@ static void alc_headset_mode_omtp(struct
+ alc_write_coef_idx(codec, 0x18, 0x7388);
+ break;
+ case 0x10ec0668:
++ alc_write_coef_idx(codec, 0x11, 0x0001);
+ alc_write_coef_idx(codec, 0x15, 0x0d50);
+ alc_write_coef_idx(codec, 0xc3, 0x0000);
+ break;
--- /dev/null
+From 6ddf0fd1c462a418a3cbb8b0653820dc48ffbd98 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 29 Nov 2013 12:47:34 +0100
+Subject: ALSA: hda - Fix silent output on ASUS W7J laptop
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 6ddf0fd1c462a418a3cbb8b0653820dc48ffbd98 upstream.
+
+The recent kernels got regressions on ASUS W7J with ALC660 codec where
+no sound comes out. After a long debugging session, we found out that
+setting the pin control on the unused NID 0x10 is mandatory for the
+outputs. And, it was found out that another magic of NID 0x0f that is
+required for other ASUS laptops isn't needed on this machine.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=66081
+Reported-and-tested-by: Andrey Lipaev <lipaev@mail.ru>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -4266,6 +4266,7 @@ enum {
+ ALC861_FIXUP_AMP_VREF_0F,
+ ALC861_FIXUP_NO_JACK_DETECT,
+ ALC861_FIXUP_ASUS_A6RP,
++ ALC660_FIXUP_ASUS_W7J,
+ };
+
+ /* On some laptops, VREF of pin 0x0f is abused for controlling the main amp */
+@@ -4315,10 +4316,21 @@ static const struct hda_fixup alc861_fix
+ .v.func = alc861_fixup_asus_amp_vref_0f,
+ .chained = true,
+ .chain_id = ALC861_FIXUP_NO_JACK_DETECT,
++ },
++ [ALC660_FIXUP_ASUS_W7J] = {
++ .type = HDA_FIXUP_VERBS,
++ .v.verbs = (const struct hda_verb[]) {
++ /* ASUS W7J needs a magic pin setup on unused NID 0x10
++ * for enabling outputs
++ */
++ {0x10, AC_VERB_SET_PIN_WIDGET_CONTROL, 0x24},
++ { }
++ },
+ }
+ };
+
+ static const struct snd_pci_quirk alc861_fixup_tbl[] = {
++ SND_PCI_QUIRK(0x1043, 0x1253, "ASUS W7J", ALC660_FIXUP_ASUS_W7J),
+ SND_PCI_QUIRK(0x1043, 0x1393, "ASUS A6Rp", ALC861_FIXUP_ASUS_A6RP),
+ SND_PCI_QUIRK_VENDOR(0x1043, "ASUS laptop", ALC861_FIXUP_AMP_VREF_0F),
+ SND_PCI_QUIRK(0x1462, 0x7254, "HP DX2200", ALC861_FIXUP_NO_JACK_DETECT),
--- /dev/null
+From 0756f09c4946fe2d9ce2ebcb6f2e3c58830d22a3 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 4 Dec 2013 13:59:45 +0100
+Subject: ALSA: hda - Fix silent output on MacBook Air 2,1
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 0756f09c4946fe2d9ce2ebcb6f2e3c58830d22a3 upstream.
+
+MacBook Air 2,1 has a fairly different pin assignment from its brother
+MBA 1,1, and yet another quirks are needed for pin 0x18 and 0x19,
+similarly like what iMac 9,1 requires, in order to make the sound
+working on it.
+
+Reported-and-tested-by: Bruno Prémont <bonbons@linux-vserver.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 39 +++++++++++++++++++++++++++++++--------
+ 1 file changed, 31 insertions(+), 8 deletions(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -1769,6 +1769,7 @@ enum {
+ ALC889_FIXUP_DAC_ROUTE,
+ ALC889_FIXUP_MBP_VREF,
+ ALC889_FIXUP_IMAC91_VREF,
++ ALC889_FIXUP_MBA21_VREF,
+ ALC882_FIXUP_INV_DMIC,
+ ALC882_FIXUP_NO_PRIMARY_HP,
+ ALC887_FIXUP_ASUS_BASS,
+@@ -1872,17 +1873,13 @@ static void alc889_fixup_mbp_vref(struct
+ }
+ }
+
+-/* Set VREF on speaker pins on imac91 */
+-static void alc889_fixup_imac91_vref(struct hda_codec *codec,
+- const struct hda_fixup *fix, int action)
++static void alc889_fixup_mac_pins(struct hda_codec *codec,
++ const hda_nid_t *nids, int num_nids)
+ {
+ struct alc_spec *spec = codec->spec;
+- static hda_nid_t nids[2] = { 0x18, 0x1a };
+ int i;
+
+- if (action != HDA_FIXUP_ACT_INIT)
+- return;
+- for (i = 0; i < ARRAY_SIZE(nids); i++) {
++ for (i = 0; i < num_nids; i++) {
+ unsigned int val;
+ val = snd_hda_codec_get_pin_target(codec, nids[i]);
+ val |= AC_PINCTL_VREF_50;
+@@ -1891,6 +1888,26 @@ static void alc889_fixup_imac91_vref(str
+ spec->gen.keep_vref_in_automute = 1;
+ }
+
++/* Set VREF on speaker pins on imac91 */
++static void alc889_fixup_imac91_vref(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ static hda_nid_t nids[2] = { 0x18, 0x1a };
++
++ if (action == HDA_FIXUP_ACT_INIT)
++ alc889_fixup_mac_pins(codec, nids, ARRAY_SIZE(nids));
++}
++
++/* Set VREF on speaker pins on mba21 */
++static void alc889_fixup_mba21_vref(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ static hda_nid_t nids[2] = { 0x18, 0x19 };
++
++ if (action == HDA_FIXUP_ACT_INIT)
++ alc889_fixup_mac_pins(codec, nids, ARRAY_SIZE(nids));
++}
++
+ /* Don't take HP output as primary
+ * Strangely, the speaker output doesn't work on Vaio Z and some Vaio
+ * all-in-one desktop PCs (for example VGC-LN51JGB) through DAC 0x05
+@@ -2087,6 +2104,12 @@ static const struct hda_fixup alc882_fix
+ .chained = true,
+ .chain_id = ALC882_FIXUP_GPIO1,
+ },
++ [ALC889_FIXUP_MBA21_VREF] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc889_fixup_mba21_vref,
++ .chained = true,
++ .chain_id = ALC889_FIXUP_MBP_VREF,
++ },
+ [ALC882_FIXUP_INV_DMIC] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc_fixup_inv_dmic_0x12,
+@@ -2151,7 +2174,7 @@ static const struct snd_pci_quirk alc882
+ SND_PCI_QUIRK(0x106b, 0x3000, "iMac", ALC889_FIXUP_MBP_VREF),
+ SND_PCI_QUIRK(0x106b, 0x3200, "iMac 7,1 Aluminum", ALC882_FIXUP_EAPD),
+ SND_PCI_QUIRK(0x106b, 0x3400, "MacBookAir 1,1", ALC889_FIXUP_MBP_VREF),
+- SND_PCI_QUIRK(0x106b, 0x3500, "MacBookAir 2,1", ALC889_FIXUP_MBP_VREF),
++ SND_PCI_QUIRK(0x106b, 0x3500, "MacBookAir 2,1", ALC889_FIXUP_MBA21_VREF),
+ SND_PCI_QUIRK(0x106b, 0x3600, "Macbook 3,1", ALC889_FIXUP_MBP_VREF),
+ SND_PCI_QUIRK(0x106b, 0x3800, "MacbookPro 4,1", ALC889_FIXUP_MBP_VREF),
+ SND_PCI_QUIRK(0x106b, 0x3e00, "iMac 24 Aluminum", ALC885_FIXUP_MACPRO_GPIO),
--- /dev/null
+From b3bd4fc3822a6b5883eaa556822487d87752d443 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 2 Dec 2013 15:04:03 +0100
+Subject: ALSA: hda - Use always amps for auto-mute on AD1986A codec
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit b3bd4fc3822a6b5883eaa556822487d87752d443 upstream.
+
+It seems that AD1986A cannot manage the dynamic pin on/off for
+auto-muting, but rather gets confused. Since each output has own amp,
+let's use it instead.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=64971
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_analog.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/sound/pci/hda/patch_analog.c
++++ b/sound/pci/hda/patch_analog.c
+@@ -345,6 +345,9 @@ static int patch_ad1986a(struct hda_code
+ */
+ spec->gen.multiout.no_share_stream = 1;
+
++ /* AD1986A can't manage the dynamic pin on/off smoothly */
++ spec->gen.auto_mute_via_amp = 1;
++
+ snd_hda_pick_fixup(codec, ad1986a_fixup_models, ad1986a_fixup_tbl,
+ ad1986a_fixups);
+ snd_hda_apply_fixup(codec, HDA_FIXUP_ACT_PRE_PROBE);
--- /dev/null
+From d8aa712c30148ba26fd89a5dc14de95d4c375184 Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+Date: Thu, 28 Nov 2013 21:43:40 +0000
+Subject: ARM: fix booting low-vectors machines
+
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+
+commit d8aa712c30148ba26fd89a5dc14de95d4c375184 upstream.
+
+Commit f6f91b0d9fd9 (ARM: allow kuser helpers to be removed from the
+vector page) required two pages for the vectors code. Although the
+code setting up the initial page tables was updated, the code which
+allocates page tables for new processes wasn't, neither was the code
+which tears down the mappings. Fix this.
+
+Fixes: f6f91b0d9fd9 ("ARM: allow kuser helpers to be removed from the vector page")
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/include/asm/pgtable.h | 2 +-
+ arch/arm/mm/mmap.c | 2 +-
+ arch/arm/mm/pgd.c | 3 ++-
+ 3 files changed, 4 insertions(+), 3 deletions(-)
+
+--- a/arch/arm/include/asm/pgtable.h
++++ b/arch/arm/include/asm/pgtable.h
+@@ -61,7 +61,7 @@ extern void __pgd_error(const char *file
+ * mapping to be mapped at. This is particularly important for
+ * non-high vector CPUs.
+ */
+-#define FIRST_USER_ADDRESS PAGE_SIZE
++#define FIRST_USER_ADDRESS (PAGE_SIZE * 2)
+
+ /*
+ * Use TASK_SIZE as the ceiling argument for free_pgtables() and
+--- a/arch/arm/mm/mmap.c
++++ b/arch/arm/mm/mmap.c
+@@ -146,7 +146,7 @@ arch_get_unmapped_area_topdown(struct fi
+
+ info.flags = VM_UNMAPPED_AREA_TOPDOWN;
+ info.length = len;
+- info.low_limit = PAGE_SIZE;
++ info.low_limit = FIRST_USER_ADDRESS;
+ info.high_limit = mm->mmap_base;
+ info.align_mask = do_align ? (PAGE_MASK & (SHMLBA - 1)) : 0;
+ info.align_offset = pgoff << PAGE_SHIFT;
+--- a/arch/arm/mm/pgd.c
++++ b/arch/arm/mm/pgd.c
+@@ -87,7 +87,8 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
+ init_pud = pud_offset(init_pgd, 0);
+ init_pmd = pmd_offset(init_pud, 0);
+ init_pte = pte_offset_map(init_pmd, 0);
+- set_pte_ext(new_pte, *init_pte, 0);
++ set_pte_ext(new_pte + 0, init_pte[0], 0);
++ set_pte_ext(new_pte + 1, init_pte[1], 0);
+ pte_unmap(init_pte);
+ pte_unmap(new_pte);
+ }
--- /dev/null
+From fc019c7122dfcd69c50142b57a735539aec5da95 Mon Sep 17 00:00:00 2001
+From: Tom Lendacky <thomas.lendacky@amd.com>
+Date: Tue, 12 Nov 2013 11:46:04 -0600
+Subject: crypto: authenc - Find proper IV address in ablkcipher callback
+
+From: Tom Lendacky <thomas.lendacky@amd.com>
+
+commit fc019c7122dfcd69c50142b57a735539aec5da95 upstream.
+
+When performing an asynchronous ablkcipher operation the authenc
+completion callback routine is invoked, but it does not locate and use
+the proper IV.
+
+The callback routine, crypto_authenc_encrypt_done, is updated to use
+the same method of calculating the address of the IV as is done in
+crypto_authenc_encrypt function which sets up the callback.
+
+Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ crypto/authenc.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/crypto/authenc.c
++++ b/crypto/authenc.c
+@@ -368,9 +368,10 @@ static void crypto_authenc_encrypt_done(
+ if (!err) {
+ struct crypto_aead *authenc = crypto_aead_reqtfm(areq);
+ struct crypto_authenc_ctx *ctx = crypto_aead_ctx(authenc);
+- struct ablkcipher_request *abreq = aead_request_ctx(areq);
+- u8 *iv = (u8 *)(abreq + 1) +
+- crypto_ablkcipher_reqsize(ctx->enc);
++ struct authenc_request_ctx *areq_ctx = aead_request_ctx(areq);
++ struct ablkcipher_request *abreq = (void *)(areq_ctx->tail
++ + ctx->reqoff);
++ u8 *iv = (u8 *)abreq - crypto_ablkcipher_ivsize(ctx->enc);
+
+ err = crypto_authenc_genicv(areq, iv, 0);
+ }
--- /dev/null
+From 5638cabf3e4883f38dfb246c30980cebf694fbda Mon Sep 17 00:00:00 2001
+From: Horia Geanta <horia.geanta@freescale.com>
+Date: Thu, 28 Nov 2013 15:11:15 +0200
+Subject: crypto: ccm - Fix handling of zero plaintext when computing mac
+
+From: Horia Geanta <horia.geanta@freescale.com>
+
+commit 5638cabf3e4883f38dfb246c30980cebf694fbda upstream.
+
+There are cases when cryptlen can be zero in crypto_ccm_auth():
+-encryptiom: input scatterlist length is zero (no plaintext)
+-decryption: input scatterlist contains only the mac
+plus the condition of having different source and destination buffers
+(or else scatterlist length = max(plaintext_len, ciphertext_len)).
+
+These are not handled correctly, leading to crashes like:
+
+root@p4080ds:~/crypto# insmod tcrypt.ko mode=45
+------------[ cut here ]------------
+kernel BUG at crypto/scatterwalk.c:37!
+Oops: Exception in kernel mode, sig: 5 [#1]
+SMP NR_CPUS=8 P4080 DS
+Modules linked in: tcrypt(+) crc32c xts xcbc vmac pcbc ecb gcm ghash_generic gf128mul ccm ctr seqiv
+CPU: 3 PID: 1082 Comm: cryptomgr_test Not tainted 3.11.0 #14
+task: ee12c5b0 ti: eecd0000 task.ti: eecd0000
+NIP: c0204d98 LR: f9225848 CTR: c0204d80
+REGS: eecd1b70 TRAP: 0700 Not tainted (3.11.0)
+MSR: 00029002 <CE,EE,ME> CR: 22044022 XER: 20000000
+
+GPR00: f9225c94 eecd1c20 ee12c5b0 eecd1c28 ee879400 ee879400 00000000 ee607464
+GPR08: 00000001 00000001 00000000 006b0000 c0204d80 00000000 00000002 c0698e20
+GPR16: ee987000 ee895000 fffffff4 ee879500 00000100 eecd1d58 00000001 00000000
+GPR24: ee879400 00000020 00000000 00000000 ee5b2800 ee607430 00000004 ee607460
+NIP [c0204d98] scatterwalk_start+0x18/0x30
+LR [f9225848] get_data_to_compute+0x28/0x2f0 [ccm]
+Call Trace:
+[eecd1c20] [f9225974] get_data_to_compute+0x154/0x2f0 [ccm] (unreliable)
+[eecd1c70] [f9225c94] crypto_ccm_auth+0x184/0x1d0 [ccm]
+[eecd1cb0] [f9225d40] crypto_ccm_encrypt+0x60/0x2d0 [ccm]
+[eecd1cf0] [c020d77c] __test_aead+0x3ec/0xe20
+[eecd1e20] [c020f35c] test_aead+0x6c/0xe0
+[eecd1e40] [c020f420] alg_test_aead+0x50/0xd0
+[eecd1e60] [c020e5e4] alg_test+0x114/0x2e0
+[eecd1ee0] [c020bd1c] cryptomgr_test+0x4c/0x60
+[eecd1ef0] [c0047058] kthread+0xa8/0xb0
+[eecd1f40] [c000eb0c] ret_from_kernel_thread+0x5c/0x64
+Instruction dump:
+0f080000 81290024 552807fe 0f080000 5529003a 4bffffb4 90830000 39400000
+39000001 8124000c 2f890000 7d28579e <0f090000> 81240008 91230004 4e800020
+---[ end trace 6d652dfcd1be37bd ]---
+
+Cc: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
+Signed-off-by: Horia Geanta <horia.geanta@freescale.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ crypto/ccm.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/crypto/ccm.c
++++ b/crypto/ccm.c
+@@ -271,7 +271,8 @@ static int crypto_ccm_auth(struct aead_r
+ }
+
+ /* compute plaintext into mac */
+- get_data_to_compute(cipher, pctx, plain, cryptlen);
++ if (cryptlen)
++ get_data_to_compute(cipher, pctx, plain, cryptlen);
+
+ out:
+ return err;
--- /dev/null
+From 9dda2769af4f3f3093434648c409bb351120d9e8 Mon Sep 17 00:00:00 2001
+From: Gerald Schaefer <gerald.schaefer@de.ibm.com>
+Date: Tue, 19 Nov 2013 17:12:47 +0100
+Subject: crypto: s390 - Fix aes-xts parameter corruption
+
+From: Gerald Schaefer <gerald.schaefer@de.ibm.com>
+
+commit 9dda2769af4f3f3093434648c409bb351120d9e8 upstream.
+
+Some s390 crypto algorithms incorrectly use the crypto_tfm structure to
+store private data. As the tfm can be shared among multiple threads, this
+can result in data corruption.
+
+This patch fixes aes-xts by moving the xts and pcc parameter blocks from
+the tfm onto the stack (48 + 96 bytes).
+
+Signed-off-by: Gerald Schaefer <gerald.schaefer@de.ibm.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/s390/crypto/aes_s390.c | 31 +++++++++++++++++--------------
+ 1 file changed, 17 insertions(+), 14 deletions(-)
+
+--- a/arch/s390/crypto/aes_s390.c
++++ b/arch/s390/crypto/aes_s390.c
+@@ -55,8 +55,7 @@ struct pcc_param {
+
+ struct s390_xts_ctx {
+ u8 key[32];
+- u8 xts_param[16];
+- struct pcc_param pcc;
++ u8 pcc_key[32];
+ long enc;
+ long dec;
+ int key_len;
+@@ -591,7 +590,7 @@ static int xts_aes_set_key(struct crypto
+ xts_ctx->enc = KM_XTS_128_ENCRYPT;
+ xts_ctx->dec = KM_XTS_128_DECRYPT;
+ memcpy(xts_ctx->key + 16, in_key, 16);
+- memcpy(xts_ctx->pcc.key + 16, in_key + 16, 16);
++ memcpy(xts_ctx->pcc_key + 16, in_key + 16, 16);
+ break;
+ case 48:
+ xts_ctx->enc = 0;
+@@ -602,7 +601,7 @@ static int xts_aes_set_key(struct crypto
+ xts_ctx->enc = KM_XTS_256_ENCRYPT;
+ xts_ctx->dec = KM_XTS_256_DECRYPT;
+ memcpy(xts_ctx->key, in_key, 32);
+- memcpy(xts_ctx->pcc.key, in_key + 32, 32);
++ memcpy(xts_ctx->pcc_key, in_key + 32, 32);
+ break;
+ default:
+ *flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
+@@ -621,29 +620,33 @@ static int xts_aes_crypt(struct blkciphe
+ unsigned int nbytes = walk->nbytes;
+ unsigned int n;
+ u8 *in, *out;
+- void *param;
++ struct pcc_param pcc_param;
++ struct {
++ u8 key[32];
++ u8 init[16];
++ } xts_param;
+
+ if (!nbytes)
+ goto out;
+
+- memset(xts_ctx->pcc.block, 0, sizeof(xts_ctx->pcc.block));
+- memset(xts_ctx->pcc.bit, 0, sizeof(xts_ctx->pcc.bit));
+- memset(xts_ctx->pcc.xts, 0, sizeof(xts_ctx->pcc.xts));
+- memcpy(xts_ctx->pcc.tweak, walk->iv, sizeof(xts_ctx->pcc.tweak));
+- param = xts_ctx->pcc.key + offset;
+- ret = crypt_s390_pcc(func, param);
++ memset(pcc_param.block, 0, sizeof(pcc_param.block));
++ memset(pcc_param.bit, 0, sizeof(pcc_param.bit));
++ memset(pcc_param.xts, 0, sizeof(pcc_param.xts));
++ memcpy(pcc_param.tweak, walk->iv, sizeof(pcc_param.tweak));
++ memcpy(pcc_param.key, xts_ctx->pcc_key, 32);
++ ret = crypt_s390_pcc(func, &pcc_param.key[offset]);
+ if (ret < 0)
+ return -EIO;
+
+- memcpy(xts_ctx->xts_param, xts_ctx->pcc.xts, 16);
+- param = xts_ctx->key + offset;
++ memcpy(xts_param.key, xts_ctx->key, 32);
++ memcpy(xts_param.init, pcc_param.xts, 16);
+ do {
+ /* only use complete blocks */
+ n = nbytes & ~(AES_BLOCK_SIZE - 1);
+ out = walk->dst.virt.addr;
+ in = walk->src.virt.addr;
+
+- ret = crypt_s390_km(func, param, out, in, n);
++ ret = crypt_s390_km(func, &xts_param.key[offset], out, in, n);
+ if (ret < 0 || ret != n)
+ return -EIO;
+
--- /dev/null
+From 41da8b5adba77e22584f8b45f9641504fa885308 Mon Sep 17 00:00:00 2001
+From: Tom Lendacky <thomas.lendacky@amd.com>
+Date: Tue, 12 Nov 2013 11:46:10 -0600
+Subject: crypto: scatterwalk - Set the chain pointer indication bit
+
+From: Tom Lendacky <thomas.lendacky@amd.com>
+
+commit 41da8b5adba77e22584f8b45f9641504fa885308 upstream.
+
+The scatterwalk_crypto_chain function invokes the scatterwalk_sg_chain
+function to chain two scatterlists, but the chain pointer indication
+bit is not set. When the resulting scatterlist is used, for example,
+by sg_nents to count the number of scatterlist entries, a segfault occurs
+because sg_nents does not follow the chain pointer to the chained scatterlist.
+
+Update scatterwalk_sg_chain to set the chain pointer indication bit as is
+done by the sg_chain function.
+
+Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/crypto/scatterwalk.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/include/crypto/scatterwalk.h
++++ b/include/crypto/scatterwalk.h
+@@ -36,6 +36,7 @@ static inline void scatterwalk_sg_chain(
+ {
+ sg_set_page(&sg1[num - 1], (void *)sg2, 0, 0);
+ sg1[num - 1].page_link &= ~0x02;
++ sg1[num - 1].page_link |= 0x01;
+ }
+
+ static inline struct scatterlist *scatterwalk_sg_next(struct scatterlist *sg)
--- /dev/null
+alsa-hda-fix-silent-output-on-asus-w7j-laptop.patch
+alsa-hda-another-fixup-for-asus-laptop-with-alc660-codec.patch
+alsa-hda-use-always-amps-for-auto-mute-on-ad1986a-codec.patch
+alsa-hda-fix-headset-mic-input-after-muted-internal-mic-dell-realtek.patch
+alsa-hda-fix-bad-eapd-setup-for-hp-machines-with-ad1984a.patch
+alsa-hda-fix-silent-output-on-macbook-air-2-1.patch
+alsa-hda-add-mono-speaker-quirk-for-dell-inspiron-5439.patch
+crypto-s390-fix-aes-xts-parameter-corruption.patch
+crypto-scatterwalk-set-the-chain-pointer-indication-bit.patch
+crypto-ccm-fix-handling-of-zero-plaintext-when-computing-mac.patch
+crypto-authenc-find-proper-iv-address-in-ablkcipher-callback.patch
+arm-fix-booting-low-vectors-machines.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
