The SigmaDSP firmware loader currently does not perform enough boundary size
checks when processing the firmware. As a result it is possible that a
malformed firmware can cause an out of bounds memory access.

This patch adds checks which ensure that both the action header and the payload
are completely inside the firmware data boundaries before processing them.
Signed-off-by: NLars-Peter Clausen <lars@metafoo.de>
Acked-by: NMike Frysinger <vapier@gentoo.org>
Signed-off-by: NMark Brown <broonie@opensource.wolfsonmicro.com>
Cc: stable@kernel.org

This file really needs the full module.h header file present, but
was just getting it implicitly before.  Fix it up in advance so we
avoid build failures once the cleanup commit is present.
Signed-off-by: NPaul Gortmaker <paul.gortmaker@windriver.com>

PCI Express devices will return "XPRS" host bus type during BIOS EDD
call.  "XPRS" should be treated just like "PCI" so that the proper
pci_dev symlink will be created.  Scripts such as fcoe_edd.sh will
then work correctly.
Signed-off-by: NMichael Chan <mchan@broadcom.com>
Reviewed-by: NMatt Domsch <Matt_Domsch@dell.com>
Signed-off-by: NYi Zou <yi.zou@intel.com>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

Currently pstore write interface employs record id as return
value, but it is not enough because it can't tell caller if
the write operation is successful. Pass the record id back via
an argument pointer and return zero for success, non-zero for
failure.
Signed-off-by: NChen Gong <gong.chen@linux.intel.com>
Signed-off-by: NTony Luck <tony.luck@intel.com>

pstore was using mutex locking to protect read/write access to the
backend plug-ins.  This causes problems when pstore is executed in
an NMI context through panic() -> kmsg_dump().

This patch changes the mutex to a spin_lock_irqsave then also checks to
see if we are in an NMI context.  If we are in an NMI and can't get the
lock, just print a message stating that and blow by the locking.

All this is probably a hack around the bigger locking problem but it
solves my current situation of trying to sleep in an NMI context.

Tested by loading the lkdtm module and executing a HARDLOCKUP which
will cause the machine to panic inside the nmi handler.
Signed-off-by: NDon Zickus <dzickus@redhat.com>
Acked-by: NMatthew Garrett <mjg@redhat.com>
Signed-off-by: NTony Luck <tony.luck@intel.com>

Modify function parameter type to match expected type.  Fixes a
build warning:

drivers/firmware/google/gsmi.c:473: warning: initialization from incompatible pointer type
Signed-off-by: NRandy Dunlap <rdunlap@xenotime.net>
Cc: Mike Waychison <mikew@google.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

drivers/firmware/efivars.c:161: warning: ‘utf16_strlen’ defined but not used
utf16_strlen() is only used inside CONFIG_PSTORE - make this "static inline"
to shut the compiler up [thanks to hpa for the suggestion].

drivers/firmware/efivars.c:602: warning: initialization from incompatible pointer type
Between v1 and v2 of this patch series we decided to make the "part" number
unsigned - but missed fixing the stub version of efi_pstore_write()
Acked-by: NMatthew Garrett <mjg@redhat.com>
Acked-by: NMike Waychison <mikew@google.com>
Signed-off-by: NTony Luck <tony.luck@intel.com>

Fix module tainting message:

  sigma: module license 'unspecified' taints kernel.
Signed-off-by: NRandy Dunlap <rdunlap@xenotime.net>
Acked-by: NMike Frysinger <vapier@gentoo.org>
Cc: <stable@kernel.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Consolidate the attributes listed for pstore operations in one place,
PSTORE_EFI_ATTRIBUTES.
Signed-off-by: NMike Waychison <mikew@google.com>
Signed-off-by: NTony Luck <tony.luck@intel.com>

Instead of open-coding the string operations for comparing the prefix of
the variable names, use the provided utf16_* string functions.

This patch also changes the calls to efi.set_variable to
efivars->ops->set_variable so that the right function gets called in the
case of gsmi (which doesn't have a valid efi structure).

As well, make sure that we only consider variables with the right vendor
string.
Signed-off-by: NMike Waychison <mikew@google.com>
Signed-off-by: NTony Luck <tony.luck@intel.com>

Introduce utf16_strncmp which is used in the next patch.  Semantics
should be the same as the strncmp C function.
Signed-off-by: NMike Waychison <mikew@google.com>
Signed-off-by: NTony Luck <tony.luck@intel.com>

Fix the string functions in the efivars driver to be called utf16_*
instead of utf8_* as the encoding is utf16, not utf8.

As well, rename utf16_strlen to utf16_strnlen as it takes a maxlength
argument and the name should be consistent with the standard C function
names.  utf16_strlen is still provided for convenience in a subsequent
patch.
Signed-off-by: NMike Waychison <mikew@google.com>
Signed-off-by: NTony Luck <tony.luck@intel.com>

EFI provides an area of nonvolatile storage managed by the firmware. We
can use this as a pstore backend to maintain copies of oopses, aiding
diagnosis.
Signed-off-by: NMatthew Garrett <mjg@redhat.com>
Signed-off-by: NTony Luck <tony.luck@intel.com>

This patch removes sysfs entries in gsmi_exit() and gsmi_init() error path.

Also move the driver successfully loaded message to the end of gsmi_init()
and return proper error if register_efivars() fails.
Signed-off-by: NAxel Lin <axel.lin@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

be2iscsi passes the boot functions its phba object which is
allocated in the shost, but iscsi_ibft passes in a object
allocated for each item to display. The problem is that
iscsi_boot_sysfs was managing the lifetime of the object
passed in and doing a kfree on release. This causes a double
free for be2iscsi which frees the shost in its pci_remove.

This patch fixes the problem by adding a release callback
which the drivers can call kfree or a put() type of function
(needed for be2iscsi which will do a get/put on the shost).
Signed-off-by: NMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: NJames Bottomley <JBottomley@Parallels.com>

int i is only needed if CONFIG_ACPI is set
so move it within a new ifdef so kernels without ACPI
don't allocate space for nothing. Fixes warning too.
Signed-off-by: NConnor Hansen <cmdkhh@gmail.com>
Signed-off-by: NPeter Jones <pjones@redhat.com>
[v2: Fixed warning when CONFIG_ACPI was defined]
Signed-off-by: NKonrad Rzeszutek Wilk <konrad@kernel.org>

Is it meaningful/useful to enable EFI_VARS but not EFI?
That's what GOOGLE_SMI does.  Make it enable EFI also.

Fixes this kconfig dependency warning:

warning: (GOOGLE_SMI) selects EFI_VARS which has unmet direct dependencies (EFI)
Signed-off-by: NRandy Dunlap <randy.dunlap@oracle.com>
Acked-by: NMike Waychison <mikew@google.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

- kenrel -> kernel
- whetehr -> whether
- ttt -> tt
- sss -> ss
Signed-off-by: NJustin P. Mattock <justinmattock@gmail.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

efivars_exit() should check for efi_enabled and not undo
allocations when efi is not enabled.  Otherwise there is an Oops
during module unload:

calling  efivars_init+0x0/0x1000 [efivars] @ 2810
EFI Variables Facility v0.08 2004-May-17
initcall efivars_init+0x0/0x1000 [efivars] returned 0 after 5120 usecs
Oops: 0000 [#1] SMP DEBUG_PAGEALLOC
last sysfs file: /sys/module/firmware_class/initstate
CPU 1
Modules linked in: efivars(-) af_packet tun nfsd lockd nfs_acl auth_rpcgss sunrpc ipt_REJECT nf_conntrack_ipv4 nf_defrag_ipv4 iptable_filter ip_tables ip6t_REJECT xt_tcpudp nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables x_tables ipv6 cpufreq_ondemand acpi_cpufreq freq_table mperf binfmt_misc dm_mirror dm_region_hash dm_log dm_multipath scsi_dh dm_mod snd_hda_codec_analog snd_hda_intel snd_hda_codec snd_hwdep mousedev snd_seq joydev snd_seq_device mac_hid evdev snd_pcm usbkbd usbmouse usbhid snd_timer hid tg3 snd sr_mod pcspkr rtc_cmos soundcore cdrom iTCO_wdt processor sg dcdbas i2c_i801 rtc_core iTCO_vendor_support intel_agp snd_page_alloc thermal_sys rtc_lib intel_gtt 8250_pnp button hwmon unix ide_pci_generic ide_core ata_generic pata_acpi ata_piix sd_mod crc_t10dif ext3 jbd mbcache uhci_hcd ohci_hcd ssb mmc_core pcmcia pcmcia_core firmware_class ehci_hcd usbcore [last unloaded: dell_rbu]

Pid: 2812, comm: rmmod Not tainted 2.6.39-rc6 #1 Dell Inc.                 OptiPlex 745                 /0TY565
RIP: 0010:[<ffffffffa06a17f6>]  [<ffffffffa06a17f6>] unregister_efivars+0x28/0x12c [efivars]
RSP: 0018:ffff88005eedde98  EFLAGS: 00010283
RAX: ffffffffa06a23fc RBX: ffffffffa06a44c0 RCX: ffff88007c227a50
RDX: 0000000000000000 RSI: 00000055ac13db78 RDI: ffffffffa06a44c0
RBP: ffff88005eeddec8 R08: 0000000000000000 R09: ffff88005eeddd78
R10: ffffffffa06a4220 R11: ffff88005eeddd78 R12: fffffffffffff7d0
R13: 00007fff5a3aaec0 R14: 0000000000000000 R15: ffffffffa06a4508
FS:  00007fa8dcc4a6f0(0000) GS:ffff88007c200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 0000000000000000 CR3: 000000005d148000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process rmmod (pid: 2812, threadinfo ffff88005eedc000, task ffff88006754b000)
Stack:
 ffff88005eeddec8 ffffffffa06a4220 0000000000000000 00007fff5a3aaec0
 0000000000000000 0000000000000001 ffff88005eedded8 ffffffffa06a2418
 ffff88005eeddf78 ffffffff810d3598 ffffffffa06a4220 0000000000000880
Call Trace:
 [<ffffffffa06a2418>] efivars_exit+0x1c/0xc04 [efivars]
 [<ffffffff810d3598>] sys_delete_module+0x2d6/0x368
 [<ffffffff812d1db9>] ? lockdep_sys_exit_thunk+0x35/0x67
 [<ffffffff810fcba1>] ? audit_syscall_entry+0x172/0x1a5
 [<ffffffff81575082>] system_call_fastpath+0x16/0x1b
Code: 5c c9 c3 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 08 0f 1f 44 00 00 4c 8b 67 48 48 89 fb 4c 8d 7f 48 49 81 ec 30 08 00 00 <4d> 8b ac 24 30 08 00 00 49 81 ed 30 08 00 00 eb 59 48 89 df 48
RIP  [<ffffffffa06a17f6>] unregister_efivars+0x28/0x12c [efivars]
 RSP <ffff88005eedde98>
CR2: 0000000000000000
 ---[ end trace aa99b99090f70baa ]---

Matt apparently removed such a check in 2004 (with no reason given):
 *  17 May 2004 - Matt Domsch <Matt_Domsch@dell.com>
 *   remove check for efi_enabled in exit
but there have been several changes since then.
Signed-off-by: NRandy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: NMike Waychison <mikew@google.com>
Tested-by: NRandy Dunlap <randy.dunlap@oracle.com>
Cc: Matt Domsch <Matt_Domsch@dell.com>
Cc: <matthew.e.tolentino@intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

In order to keep Google's firmware drivers organized amongst themselves,
all Google firmware drivers are gated on CONFIG_GOOGLE_FIRMWARE=y, which
defaults to 'n' in the kernel build.
Signed-off-by: NMike Waychison <mikew@google.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch introduces the 'memconsole' driver.

Our firmware gives us access to an in-memory log of the firmware's
output.   This gives us visibility in a data-center of headless machines
as to what the firmware is doing.

The memory console is found by the driver by finding a header block in
the EBDA.  The buffer is then copied out, and is exported to userland in
the file /sys/firmware/log.
Signed-off-by: NSan Mehat <san@google.com>
Signed-off-by: NMike Waychison <mikew@google.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

The "gsmi" driver bridges userland with firmware specific routines for
accessing hardware.

Currently, this driver only supports NVRAM and eventlog information.
Deprecated functions have been removed from the driver, though their
op-codes are left in place so that they are not re-used.

This driver works by trampolining into the firmware via the smi_command
outlined in the FADT table.  Three protocols are used due to various
limitations over time, but all are included herein.

This driver should only ever load on Google boards, identified by either
a "Google, Inc." board vendor string in DMI, or "GOOGLE" in the OEM
strings of the FADT ACPI table.  This logic happens in
gsmi_system_valid().
Signed-off-by: NDuncan Laurie <dlaurie@google.com>
Signed-off-by: NAaron Durbin <adurbin@google.com>
Signed-off-by: NMike Waychison <mikew@google.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Check for nonzero path in edd_has_edd30() has no sense. First, it looks
at the wrong memory. Device path starts at offset 30 of the info->params
structure which is at offset 8 from the beginning of info structure,
but code looks at info + 4 instead. This was correct when code was
introduced, but around v2.6.4 three more fields were added to edd_info
structure (commit 66b61a5c in history.git). Second, even if it will check
correct memory it will always succeed since at offset 30 (params->key)
there will be non-zero values otherwise previous check would fail.

The patch replaces this bogus check with one that verifies checksum.
Signed-off-by: NGleb Natapov <gleb@redhat.com>
Link: http://lkml.kernel.org/r/20110426082132.GG2265@redhat.comSigned-off-by: NH. Peter Anvin <hpa@linux.intel.com>

Using C line continuation inside format strings is error prone.
Clean up the unintended whitespace introduced by misuse of \.
Neaten correctly used line continations as well for consistency.

drivers/scsi/arcmsr/arcmsr_hba.c has these errors as well,
but arcmsr needs a lot more work and the driver should likely be
moved to staging instead.
Signed-off-by: NJoe Perches <joe@perches.com>
Acked-by: NRandy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

We should unwind and return an error if register_efivars() fails.
Signed-off-by: NDan Carpenter <error27@gmail.com>
Acked-by: NMike Waychison <mikew@google.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This is a cut and paste bug.  We intended to free ->del_var and
->new_var but we only free ->new_var.
Signed-off-by: NDan Carpenter <error27@gmail.com>
Acked-by: NMike Waychison <mikew@google.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Broadcom iscsi offload firmware uses a non standard ibft sign of "BIFT".
When we added support for boot, the anaconda team and I were using
older firmware (I guess 4 years old), so boot does not work on current
cards.

This patch modifies the ibft search code to search for "BIFT" along
with the other possible values.

Broadcom has tested the patch and reported it works with their
firmware. Mike has tested Chelsio and Intel cards.

[v2:
- Add ACPI_SIG_IBFT to ibft_signs
- replace break with goto in find_ibft_in_mem innner loop.]
Signed-off-by: NMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: NPeter Jones <pjones@redhat.com>
Signed-off-by: NKonrad Rzeszutek Wilk <konrad@kernel.org>

Analog Devices' SigmaStudio can produce firmware blobs for devices with
these DSPs embedded (like some audio codecs).  Allow these device drivers
to easily parse and load them.
Signed-off-by: NMike Frysinger <vapier@gentoo.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Signed-off-by: NMike Waychison <mikew@google.com>
Cc: Matt Domsch <Matt_Domsch@dell.com>,
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Instead of letting efivars access struct efi directly when dealing with
variables, use an operations structure.  This allows a later change to
reuse the efivars logic without having to pretend to support everything
in struct efi.
Signed-off-by: NMike Waychison <mikew@google.com>
Cc: Matt Domsch <Matt_Domsch@dell.com>,
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

In anticipation of re-using the variable facilities in efivars from
elsewhere, split out the registration and unregistration of struct
efivars from the rest of the EFI specific sysfs code.
Signed-off-by: NMike Waychison <mikew@google.com>
Cc: Matt Domsch <Matt_Domsch@dell.com>,
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Now that we all global variable state is encapsulated by struct efivars,
parameterize all functions to the efivars local to the control flow rather
than at file scope.  We do this by removing the variable "efivars" at file
scope and move its storage down to the end of the file.

Variables get at efivars by storing the efivars pointer within each
efivar_entry.  The "new_var" and "del_var" binary attribute files get at
the efivars through the private pointer.
Signed-off-by: NMike Waychison <mikew@google.com>
Cc: Matt Domsch <Matt_Domsch@dell.com>,
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

In preparation for encapsulating efivars, we need to have the
bin_attributes be dynamically allocated so that we can use their
->private fields to get back to the struct efivars structure.
Signed-off-by: NMike Waychison <mikew@google.com>
Cc: Matt Domsch <Matt_Domsch@dell.com>,
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

In preparation for abstracting out efivars to be usable by other similar
variable services, move the global lock, list and kset into a structure.
Later patches will change the scope of 'efivars' and have it be passed
by function argument.
Signed-off-by: NMike Waychison <mikew@google.com>
Cc: Matt Domsch <Matt_Domsch@dell.com>,
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

The dcdbas driver can do an I/O write to cause a SMI to occur.  The SMI handler
looks at certain registers and memory locations, so the SMI needs to happen
immediately.  On some systems I/O writes are posted, though, causing the SMI to
happen well after the "outb" occurred, which causes random failures.  Following
the "outb" with an "inb" forces the write to go through even if it is posted.
Signed-off-by: NStuart Hayes <stuart_hayes@yahoo.com>
Acked-by: NDoug Warzecha <douglas_warzecha@dell.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

DMI entries are arranged in memory back to back with no alignment
guarantees. This means that the struct dmi_header passed to callbacks
from dmi_walk() itself isn't byte aligned.  This causes problems on
architectures that expect aligned data, such as IA64.

The dmi-sysfs patchset introduced structure member accesses through this
passed in dmi_header.  Fix this by memcpy()ing the structures to
temporary locations on stack when inspecting/copying them.
Signed-off-by: NMike Waychison <mikew@google.com>
Tested-by: NTony Luck <tony.luck@intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

The System Event Log described by DMI entry type 15 may be backed by
either memory or may be indirectly accessed via an IO index/data
register pair.

In order to get read access to this log, expose it in the
"system_event_log" sub-directory of type 15 DMI entries, ie:
/sys/firmware/dmi/entries/15-0/system_event_log/raw_event_log.

This commit handles both IO accessed and memory access system event
logs.  OEM specific access and GPNV support is explicitly not handled
and we error out in the logs when we do not recognize the access method.
Signed-off-by: NMike Waychison <mikew@google.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

The optional type 15 entry of the DMI table describes a non-volatile
storage-backed system event log.

In preparation for the next commit which exposes the raw bits of the
event log to userland, create a new sub-directory within the dmi entry
called "system_event_log" and expose attribute files that describe the
event log itself.

Currently, only a single child object is permitted within a
dmi_sysfs_entry.  We simply point at this child from the dmi_sysfs_entry
if it exists.
Signed-off-by: NMike Waychison <mikew@google.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Introduce a new module "dmi-sysfs" that exports the broken out entries
of the DMI table through sysfs.

Entries are enumerated via dmi_walk() on module load, and are populated
as kobjects rooted at /sys/firmware/dmi/entries.

Entries are named "<type>-<instance>", where:
   <type>	: is the type of the entry, and
   <instance>	: is the ordinal count within the DMI table of that
		  entry type.  This instance is used in lieu the DMI
		  entry's handle as no assurances are made by the kernel
		  that handles are unique.

All entries export the following attributes:
   length	: The length of the formatted portion of the entry
   handle	: The handle given to this entry by the firmware
   raw		: The raw bytes of the entire entry, including the
		  formatted portion, the unformatted (strings) portion,
		  and the two terminating nul characters.
   type		: The DMI entry type
   instance	: The ordinal instance of this entry given its type.
   position	: The position ordinal of the entry within the table in
		  its entirety.

Entries in dmi-sysfs are kobject backed members called "struct
dmi_sysfs_entry" and belong to dmi_kset.  They are threaded through
entry_list (protected by entry_list_lock) so that we can find them at
cleanup time.
Signed-off-by: NMike Waychison <mikew@google.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

The "Type 2" SMBIOS record that contains Board Name is not
strictly required and may be absent in the SMBIOS on some
platforms.

( Please note that Type 2 is not listed in Table 3 in Sec 6.2
  ("Required Structures and Data") of the SMBIOS v2.7
  Specification. )

Use the Manufacturer Name (aka System Vendor) name.
Print Board Name only when it is present.

Before the fix:
  (i) dmesg output: DMI: /ProLiant DL380 G6, BIOS P62 01/29/2011
 (ii) oops output:  Pid: 2170, comm: bash Not tainted 2.6.38-rc4+ #3 /ProLiant DL380 G6

After the fix:
  (i) dmesg output: DMI: HP ProLiant DL380 G6, BIOS P62 01/29/2011
 (ii) oops output:  Pid: 2278, comm: bash Not tainted 2.6.38-rc4+ #4 HP ProLiant DL380 G6
Signed-off-by: NNaga Chumbalkar <nagananda.chumbalkar@hp.com>
Reviewed-by: NBjorn Helgaas <bjorn.helgaas@hp.com>
Cc: <stable@kernel.org> # .3x - good for debugging, please apply as far back as it applies cleanly
LKML-Reference: <20110214224423.2182.13929.sendpatchset@nchumbalkar.americas.hpqcorp.net>
Signed-off-by: NIngo Molnar <mingo@elte.hu>