On Thu, Jan 31, 2019 at 07:06:03PM +0200, Jarkko Sakkinen wrote:
> Found something that *does* fix the issue. If I replace memcpy_*io()
> calls with regular memcpy(), the driver works and all my tests pass.
OK, so the length of the response is not trashed, but only the error
code. The attached patch fully fixes the issue.
Here's the header again:
struct tpm_output_header {
__be16 tag;
__be32 length;
__be32 return_code;
} __packed;
The first to fields *are* read correctly and the last field get 1's
(thus TPM error -1).
With the attached the patch things work properly, but still
unsatisfactory fix (return to old behavior because it seems to
work).
/Jarkko
>From 8ff7eb66e1dc05daf1319bf8365e5a3434a90061 Mon Sep 17 00:00:00 2001
From: Jarkko Sakkinen <jarkko.sakkinen@xxxxxxxxxxxxxxx>
Date: Thu, 31 Jan 2019 20:16:00 +0200
Subject: [PATCH] tpm/tpm_crb: Revert to memcpy() for copying tail of the
response
Revert the behavior before 170d13ca3a2f.
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@xxxxxxxxxxxxxxx>
---
drivers/char/tpm/tpm_crb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c
index 36952ef98f90..003923ea50d2 100644
--- a/drivers/char/tpm/tpm_crb.c
+++ b/drivers/char/tpm/tpm_crb.c
@@ -299,7 +299,7 @@ static int crb_recv(struct tpm_chip *chip, u8 *buf, size_t count)
if (expected > count || expected < 6)
return -EIO;
- memcpy_fromio(&buf[6], &priv->rsp[6], expected - 6);
+ memcpy(&buf[6], &priv->rsp[6], expected - 6);
return expected;
}
--
2.19.1
