linux-stable.git/drivers/char, branch linux-4.8.y

tpm xen: Remove bogus tpm_chip_unregister

2017-01-06T10:16:24+00:00

commit 1f0f30e404b3d8f4597a2d9b77fba55452f8fd0e upstream.

tpm_chip_unregister can only be called after tpm_chip_register.
devm manages the allocation so no unwind is needed here.

Fixes: afb5abc262e96 ("tpm: two-phase chip management functions")
Reviewed-by: Jarkko Sakkinen 
Signed-off-by: Jarkko Sakkinen 
Signed-off-by: Greg Kroah-Hartman

hwrng: core - Don't use a stack buffer in add_early_randomness()

2016-11-18T09:51:51+00:00

commit 6d4952d9d9d4dc2bb9c0255d95a09405a1e958f7 upstream.

hw_random carefully avoids using a stack buffer except in
add_early_randomness().  This causes a crash in virtio_rng if
CONFIG_VMAP_STACK=y.

Reported-by: Matt Mullins 
Tested-by: Matt Mullins 
Fixes: d3cc7996473a ("hwrng: fetch randomness only after device init")
Signed-off-by: Andy Lutomirski 
Signed-off-by: Herbert Xu 
Signed-off-by: Greg Kroah-Hartman

agp/intel: Flush chipset writes after updating a single PTE

2016-11-18T09:51:50+00:00

commit 3497971a71d8b15a41b7bf2bf66ebf5909b2bd3f upstream.

After we update one PTE for a page, the caller expects to be able to
immediately use that through a GGTT read/write. To comply with the
callers expectations we therefore need to flush the chipset buffers
before returning.

Reported-by: Matti Hämäläinen 
Fixes: d6473f566417 ("drm/i915: Add support for mapping an object page...")
Signed-off-by: Chris Wilson 
Cc: Ankitprasad Sharma 
Cc: Tvrtko Ursulin 
Tested-by: Matti Hämäläinen 
Cc: drm-intel-fixes@lists.freedesktop.org
Reviewed-by: Mika Kuoppala 
Link: http://patchwork.freedesktop.org/patch/msgid/20160818161718.27187-2-chris@chris-wilson.co.uk
Signed-off-by: Greg Kroah-Hartman

virtio: console: Unlock vqs while freeing buffers

2016-11-10T15:38:52+00:00

commit 34563769e438d2881f62cf4d9badc4e589ac0ec0 upstream.

Commit c6017e793b93 ("virtio: console: add locks around buffer removal
in port unplug path") added locking around the freeing of buffers in the
vq. However, when free_buf() is called with can_sleep = true and rproc
is enabled, it calls dma_free_coherent() directly, requiring interrupts
to be enabled. Currently a WARNING is triggered due to the spin locking
around free_buf, with a call stack like this:

WARNING: CPU: 3 PID: 121 at ./include/linux/dma-mapping.h:433
free_buf+0x1a8/0x288
Call Trace:
[<8040c538>] show_stack+0x74/0xc0
[<80757240>] dump_stack+0xd0/0x110
[<80430d98>] __warn+0xfc/0x130
[<80430ee0>] warn_slowpath_null+0x2c/0x3c
[<807e7c6c>] free_buf+0x1a8/0x288
[<807ea590>] remove_port_data+0x50/0xac
[<807ea6a0>] unplug_port+0xb4/0x1bc
[<807ea858>] virtcons_remove+0xb0/0xfc
[<807b6734>] virtio_dev_remove+0x58/0xc0
[<807f918c>] __device_release_driver+0xac/0x134
[<807f924c>] device_release_driver+0x38/0x50
[<807f7edc>] bus_remove_device+0xfc/0x130
[<807f4b74>] device_del+0x17c/0x21c
[<807f4c38>] device_unregister+0x24/0x38
[<807b6b50>] unregister_virtio_device+0x28/0x44

Fix this by restructuring the loops to allow the locks to only be taken
where it is necessary to protect the vqs, and release it while the
buffer is being freed.

Fixes: c6017e793b93 ("virtio: console: add locks around buffer removal in port unplug path")
Signed-off-by: Matt Redfearn 
Signed-off-by: Michael S. Tsirkin 
Signed-off-by: Greg Kroah-Hartman

hwrng: omap - Only fail if pm_runtime_get_sync returns < 0

2016-10-31T11:02:10+00:00

commit ad8529fde9e3601180a839867a8ab041109aebb5 upstream.

Currently omap-rng checks the return value of pm_runtime_get_sync and
reports failure if anything is returned, however it should be checking
if ret < 0 as pm_runtime_get_sync return 0 on success but also can return
1 if the device was already active which is not a failure case. Only
values < 0 are actual failures.

Fixes: 61dc0a446e5d ("hwrng: omap - Fix assumption that runtime_get_sync will always succeed")
Signed-off-by: Dave Gerlach 
Signed-off-by: Herbert Xu 
Signed-off-by: Greg Kroah-Hartman

tpm_crb: fix crb_req_canceled behavior

2016-10-16T16:03:41+00:00

commit 72fd50e14e46dc0edf360631bdece87c2f066a97 upstream.

The req_canceled() callback is used by tpm_transmit() periodically to
check whether the request has been canceled while it is receiving a
response from the TPM.

The TPM_CRB_CTRL_CANCEL register was cleared already in the crb_cancel
callback, which has two consequences:

* Cancel might not happen.
* req_canceled() always returns zero.

A better place to clear the register is when starting to send a new
command. The behavior of TPM_CRB_CTRL_CANCEL is described in the
section 5.5.3.6 of the PTP specification.

Fixes: 30fc8d138e91 ("tpm: TPM 2.0 CRB Interface")
Signed-off-by: Jarkko Sakkinen 
Signed-off-by: Greg Kroah-Hartman

tpm: fix a race condition in tpm2_unseal_trusted()

2016-10-16T16:03:41+00:00

commit d4816edfe706497a8525480c1685ceb9871bc118 upstream.

Unseal and load operations should be done as an atomic operation. This
commit introduces unlocked tpm_transmit() so that tpm2_unseal_trusted()
can do the locking by itself.

Fixes: 0fe5480303a1 ("keys, trusted: seal/unseal with TPM 2.0 chips")
Signed-off-by: Jarkko Sakkinen 
Reviewed-by: Jason Gunthorpe 
Signed-off-by: Greg Kroah-Hartman

Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost

2016-09-09T21:52:05+00:00

Pull virtio fixes from Michael Tsirkin:
 "This includes a couple of bugfixs for virtio.

  The virtio console patch is actually also in x86/tip targeting 4.9
  because it helps vmap stacks, but it also fixes IOMMU_PLATFORM which
  was added in 4.8, and it seems important not to ship that in a broken
  configuration"

* tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost:
  virtio_console: Stop doing DMA on the stack
  virtio: mark vring_dma_dev() static

virtio_console: Stop doing DMA on the stack

2016-09-09T18:12:45+00:00

virtio_console uses a small DMA buffer for control requests.  Move
that buffer into heap memory.

Doing virtio DMA on the stack is normally okay on non-DMA-API virtio
systems (which is currently most of them), but it breaks completely
if the stack is virtually mapped.

Tested by typing both directions using picocom aimed at /dev/hvc0.

Signed-off-by: Andy Lutomirski 
Signed-off-by: Michael S. Tsirkin 
Reviewed-by: Amit Shah

tpm: invalid self test error message

2016-09-02T22:27:37+00:00

The driver emits invalid self test error message even though the init
succeeds.

Signed-off-by: Jarkko Sakkinen 
Fixes: cae8b441fc20 ("tpm: Factor out common startup code")
Reviewed-by: James Morris 
Signed-off-by: James Morris