From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mga02.intel.com ([134.134.136.20]:55106 "EHLO mga02.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753888AbcHSMCg (ORCPT ); Fri, 19 Aug 2016 08:02:36 -0400 Date: Fri, 19 Aug 2016 14:58:36 +0300 From: Jarkko Sakkinen To: gregkh@linuxfoundation.org Cc: jgunthorpe@obsidianresearch.com, stable@vger.kernel.org Subject: Re: FAILED: patch "[PATCH] tpm_crb: fix mapping of the buffers" failed to apply to 4.7-stable tree Message-ID: <20160819115836.GA23267@intel.com> References: <147151721415950@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <147151721415950@kroah.com> Sender: stable-owner@vger.kernel.org List-ID: I will backport this as not having it is breaking tpm_crb on some platfoms. /Jarkko On Thu, Aug 18, 2016 at 12:46:54PM +0200, gregkh@linuxfoundation.org wrote: > > The patch below does not apply to the 4.7-stable tree. > If someone wants it applied there, or to any other stable or longterm > tree, then please email the backport, including the original git commit > id to . > > thanks, > > greg k-h > > ------------------ original commit in Linus's tree ------------------ > > From 422eac3f7deae34dbaffd08e03e27f37a5394a56 Mon Sep 17 00:00:00 2001 > From: Jarkko Sakkinen > Date: Tue, 19 Apr 2016 12:54:18 +0300 > Subject: [PATCH] tpm_crb: fix mapping of the buffers > > On my Lenovo x250 the following situation occurs: > > [18697.813871] tpm_crb MSFT0101:00: can't request region for resource > [mem 0xacdff080-0xacdfffff] > > The mapping of the control area overlaps the mapping of the command > buffer. The control area is mapped over page, which is not right. It > should mapped over sizeof(struct crb_control_area). > > Fixing this issue unmasks another issue. Command and response buffers > can overlap and they do interleave on this machine. According to the PTP > specification the overlapping means that they are mapped to the same > buffer. > > The commit has been also on a Haswell NUC where things worked before > applying this fix so that the both code paths for response buffer > initialization are tested. > > Cc: stable@vger.kernel.org > Fixes: 1bd047be37d9 ("tpm_crb: Use devm_ioremap_resource") > Signed-off-by: Jarkko Sakkinen > Reviewed-by: Jason Gunthorpe > > diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c > index 733cd0e20598..5afe6840030e 100644 > --- a/drivers/char/tpm/tpm_crb.c > +++ b/drivers/char/tpm/tpm_crb.c > @@ -259,7 +259,10 @@ static int crb_map_io(struct acpi_device *device, struct crb_priv *priv, > struct list_head resources; > struct resource io_res; > struct device *dev = &device->dev; > - u64 pa; > + u64 cmd_pa; > + u32 cmd_size; > + u64 rsp_pa; > + u32 rsp_size; > int ret; > > INIT_LIST_HEAD(&resources); > @@ -280,22 +283,36 @@ static int crb_map_io(struct acpi_device *device, struct crb_priv *priv, > return PTR_ERR(priv->iobase); > > priv->cca = crb_map_res(dev, priv, &io_res, buf->control_address, > - 0x1000); > + sizeof(struct crb_control_area)); > if (IS_ERR(priv->cca)) > return PTR_ERR(priv->cca); > > - pa = ((u64) ioread32(&priv->cca->cmd_pa_high) << 32) | > - (u64) ioread32(&priv->cca->cmd_pa_low); > - priv->cmd = crb_map_res(dev, priv, &io_res, pa, > - ioread32(&priv->cca->cmd_size)); > + cmd_pa = ((u64) ioread32(&priv->cca->cmd_pa_high) << 32) | > + (u64) ioread32(&priv->cca->cmd_pa_low); > + cmd_size = ioread32(&priv->cca->cmd_size); > + priv->cmd = crb_map_res(dev, priv, &io_res, cmd_pa, cmd_size); > if (IS_ERR(priv->cmd)) > return PTR_ERR(priv->cmd); > > - memcpy_fromio(&pa, &priv->cca->rsp_pa, 8); > - pa = le64_to_cpu(pa); > - priv->rsp = crb_map_res(dev, priv, &io_res, pa, > - ioread32(&priv->cca->rsp_size)); > - return PTR_ERR_OR_ZERO(priv->rsp); > + memcpy_fromio(&rsp_pa, &priv->cca->rsp_pa, 8); > + rsp_pa = le64_to_cpu(rsp_pa); > + rsp_size = ioread32(&priv->cca->rsp_size); > + > + if (cmd_pa != rsp_pa) { > + priv->rsp = crb_map_res(dev, priv, &io_res, rsp_pa, rsp_size); > + return PTR_ERR_OR_ZERO(priv->rsp); > + } > + > + /* According to the PTP specification, overlapping command and response > + * buffer sizes must be identical. > + */ > + if (cmd_size != rsp_size) { > + dev_err(dev, FW_BUG "overlapping command and response buffer sizes are not identical"); > + return -EINVAL; > + } > + > + priv->rsp = priv->cmd; > + return 0; > } > > static int crb_acpi_add(struct acpi_device *device) >