[4.2.y-ckt stable] Patch "tpm, tpm_crb: fix unaligned read of the command buffer address" has been added to staging queue

[Kamal Mostafa]

This is a note to let you know that I have just added a patch titled

    tpm, tpm_crb: fix unaligned read of the command buffer address

to the linux-4.2.y-queue branch of the 4.2.y-ckt extended stable tree 
which can be found at:

    http://kernel.ubuntu.com/git/ubuntu/linux.git/log/?h=linux-4.2.y-queue

This patch is scheduled to be released in version 4.2.8-ckt1.

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 4.2.y-ckt tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Kamal

------

>From 8ea2f56bf2b097c2e3a47df38664b01673d27d7c Mon Sep 17 00:00:00 2001
From: Jarkko Sakkinen <jarkko.sakkinen at linux.intel.com>
Date: Tue, 15 Sep 2015 20:05:40 +0300
Subject: tpm, tpm_crb: fix unaligned read of the command buffer address

commit 149789ce9d472e6b4fd99336e779ab843754a96c upstream.

The command buffer address must be read with exactly two 32-bit reads.
Otherwise, on some HW platforms, it seems that HW will abort the read
operation, which causes CPU to fill the read bytes with 1's. Therefore,
we cannot rely on memcpy_fromio() but must call ioread32() two times
instead.

Also, this matches the PC Client Platform TPM Profile specification,
which defines command buffer address with two 32-bit fields.

Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen at linux.intel.com>
Reviewed-by: Peter Huewe <peterhuewe at gmx.de>
Signed-off-by: Peter Huewe <peterhuewe at gmx.de>
Signed-off-by: Kamal Mostafa <kamal at canonical.com>
---
 drivers/char/tpm/tpm_crb.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c
index 1267322..83068fa 100644
--- a/drivers/char/tpm/tpm_crb.c
+++ b/drivers/char/tpm/tpm_crb.c
@@ -74,7 +74,8 @@ struct crb_control_area {
 	u32 int_enable;
 	u32 int_sts;
 	u32 cmd_size;
-	u64 cmd_pa;
+	u32 cmd_pa_low;
+	u32 cmd_pa_high;
 	u32 rsp_size;
 	u64 rsp_pa;
 } __packed;
@@ -273,8 +274,8 @@ static int crb_acpi_add(struct acpi_device *device)
 		return -ENOMEM;
 	}

-	memcpy_fromio(&pa, &priv->cca->cmd_pa, 8);
-	pa = le64_to_cpu(pa);
+	pa = ((u64) le32_to_cpu(ioread32(&priv->cca->cmd_pa_high)) << 32) |
+		(u64) le32_to_cpu(ioread32(&priv->cca->cmd_pa_low));
 	priv->cmd = devm_ioremap_nocache(dev, pa,
 					 ioread32(&priv->cca->cmd_size));
 	if (!priv->cmd) {
--
1.9.1