I recently found that not all BIOS manufacturers are using the specified
generic PNP id in their TPM ACPI table entry.  I have added the vendor
specific IDs that I know about and added a module parameter that a user can
specify another HID to the probe list if their device isn't being found by the
default list.
Signed-off-by: NKylene Hall <kjhall@us.ibm.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

This patch adds a boolean module parameter that allows the user to turn
interrupt support on and off.  The default behavior is to attempt to use
interrupts.
Signed-off-by: NKylene Hall <kjhall@us.ibm.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Fixes minor spacing issues.
Signed-off-by: NKylene Hall <kjhall@us.ibm.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Use __devexit_p() for the exit/remove function to protect against
discarding it.

WARNING: drivers/char/tpm/tpm_infineon.o - Section mismatch: reference to .exit.text:tpm_inf_pnp_remove from .data between 'tpm_inf_pnp' (at offset 0x20) and 'tpm_inf'
Signed-off-by: NRandy Dunlap <rdunlap@xenotime.net>
Cc: Kylene Jo Hall <kjhall@us.ibm.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

The acpi table which contains the BIOS log events was updated for 1.2.
There are now client and server modes as defined in the specifications with
slightly different formats.  Additionally, the start field was even too
small for the 1.1 version but had been working anyway.  This patch updates
the code to deal with any of the three types of headers probperly (1.1, 1.2
client and 1.2 server).
Signed-off-by: NKylie Hall <kjhall@us.ibm.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

The memory start and length values obtained from the ACPI entry need to be
checked and filled in with the default values from the specification if
they don't exist.  This patch fills in the default values and uses them
appropriately.
Signed-off-by: NKylie Hall <kjhall@us.ibm.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Apply the latest changes in the TPM interface to the Infineon TPM-driver.
Signed-off-by: NMarcel Selhorst <selhorst@crypto.rub.de>
Acked-by: NKylie Hall <kjhall@us.ibm.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Use set_bit() and clear_bit() for dev_mask manipulation.
Signed-off-by: NKylie Hall <kjhall@us.ibm.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

The timeout and duration values used in the tpm driver are not exposed to
userspace.  This patch converts the storage units to jiffies with
msecs_to_jiffies.  They were always being used in jiffies so this
simplifies things removing the need for calculation all over the place.
The change necessitated a type change in the tpm_chip struct to hold
jiffies.
Signed-off-by: NKylie Hall <kjhall@us.ibm.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

The driver for the next generation of TPM chips version 1.2 including support
for interrupts.  The Trusted Computing Group has written the TPM Interface
Specification (TIS) which defines a common interface for all manufacturer's
1.2 TPM's thus the name tpm_tis.
Signed-off-by: NLeendert van Doorn <leendert@watson.ibm.com>
Signed-off-by: NKylene Hall <kjhall@us.ibm.com>
Cc: Greg KH <greg@kroah.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Many of the sysfs files were calling the TPM_GetCapability command with array.
 Since for 1.2 more sysfs files of this type are coming I am generalizing the
array so there can be one array and the unique parts can be filled in just
before the command is called.

This updated version of the patch breaks the multi-value sysfs file into
separate files pointed out by Greg.  It also addresses the code redundancy and
ugliness in the tpm_show_* functions pointed out on another patch by Dave
Hansen.
Signed-off-by: NKylene Hall <kjhall@us.ibm.com>
Cc: Greg KH <greg@kroah.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

With the TPM 1.2 Specification, each command is classified as short, medium or
long and the chip tells you the maximum amount of time for a response to each
class of command.  This patch provides and array of the classifications and a
function to determine how long the response should be waited for.  Also, it
uses that information in the command processing to determine how long to poll
for.  The function is exported so the 1.2 driver can use the functionality to
determine how long to wait for a DataAvailable interrupt if interrupts are
being used.
Signed-off-by: NKylene Hall <kjhall@us.ibm.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Changes in the 1.2 TPM Specification make it necessary to update some fields
of the chip structure in the initialization function after it is registered
with tpm.c thus tpm_register_hardware was modified to return a pointer to the
structure.  This patch makes that change and the associated changes in
tpm_atmel and tpm_nsc.  The changes to tpm_infineon will be coming in a patch
from Marcel Selhorst.
Signed-off-by: NKylene Hall <kjhall@us.ibm.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

To assist with chip management and better support the possibility of having
multiple TPMs in the system of the same kind, the struct tpm_vendor_specific
member of the tpm_chip was changed from a pointer to an instance.  This patch
changes that declaration and fixes up all accesses to the structure member
except in tpm_infineon which is coming in a patch from Marcel Selhorst.
Signed-off-by: NKylene Hall <kjhall@us.ibm.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Many of the sysfs files were calling the TPM_GetCapability command with array.
Since for 1.2 more sysfs files of this type are coming I am generalizing the
array so there can be one array and the unique parts can be filled in just
before the command is called.
Signed-off-by: NKylene Hall <kjhall@us.ibm.com>
Cc: Greg KH <greg@kroah.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

The following patch set contains numerous changes to the base tpm driver
(tpm.c) to support the next generation of TPM chips.  The changes include new
sysfs files because of more relevant data being available, a function to
access the timeout and duration values for the chip, and changes to make use
of those duration values.  Duration in the TPM specification is defined as the
maximum amount of time the chip could take to return the results.  Commands
are in one of three categories short, medium and long.  Also included are
cleanups of how the commands for the sysfs files are composed to reduce a
bunch of redundant arrays.

This patch:

Fix minor spacing issues.
Signed-off-by: NKylene Hall <kjhall@us.ibm.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

A string corresponding to the tcpa_pc_event_id POST_CONTENTS was missing
causing an overflow bug when access was attempted in the get_event_name
function.

This bug was found by Coverity.
Signed-off-by: NKylene Hall <kjhall@us.ibm.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

The eventname was kmalloc'd and not freed in the *_show functions.

This bug was found by Coverity.
Signed-off-by: NKylene Hall <kjhall@us.ibm.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

reiserfs_cache_default_acl() should return whether we successfully found
the acl or not.  We have to return correct value even if reiserfs_get_acl()
returns error code and not just 0.  Otherwise callers such as
reiserfs_mkdir() can unnecessarily lock the xattrs and later functions such
as reiserfs_new_inode() fail to notice that we have already taken the lock
and try to take it again with obvious consequences.
Signed-off-by: NJan Kara <jack@suse.cz>
Cc: <reiserfs-dev@namesys.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

from: Greg Howard <ghoward@sgi.com>

Fix Altix system controller (snsc) device names to include the slot number
of the blade whose associated system controller is the target of the device
interface.  Including the slot number avoids a problem we're currently
having where slots within the same enclosure are attempting to create
multiple kobjects with identical names.
Signed-off-by: NGreg Howard <ghoward@sgi.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

We do this by removing a micro-optimization that tries to avoid grabbing
the iommu_bitmap_lock spinlock and using a bus-locked operation.

This still races with other simultaneous alloc_iommu or free_iommu(size >
1) which both use bus-unlocked operations.

The end result of this race is eventually ending up with an
iommu_gart_bitmap that has bits errornously set all over, making large
contiguous iommu space allocations fail with 'PCI-DMA: Out of IOMMU space'.
Signed-off-by: NMike Waychison <mikew@google.com>
Signed-off-by: NAndi Kleen <ak@suse.de>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

This quietens warnings and actually fixes a bug.  The unwind tables would
come out wrong without -32, causing pthread cancellation during them to
crash in the gcc runtime.

The problem seems to only happen with newer binutils (it doesn't happen
with 2.16.91.0.2 but happens wit 2.16.91.0.5)

Thanks to David Altobelli <david.altobelli@hp.com> and Brian Baker
<Brian.B@hp.com> for test case and initial analysis.
Signed-off-by: NAndi Kleen <ak@suse.de>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Basic problem: pages of a shared memory segment can only be migrated once.

In 2.6.16 through 2.6.17-rc1, shared memory mappings do not have a
migratepage address space op.  Therefore, migrate_pages() falls back to
default processing.  In this path, it will try to pageout() dirty pages.
Once a shared memory page has been migrated it becomes dirty, so
migrate_pages() will try to page it out.  However, because the page count
is 3 [cache + current + pte], pageout() will return PAGE_KEEP because
is_page_cache_freeable() returns false.  This will abort all subsequent
migrations.

This patch adds a migratepage address space op to shared memory segments to
avoid taking the default path.  We use the "migrate_page()" function
because it knows how to migrate dirty pages.  This allows shared memory
segment pages to migrate, subject to other conditions such as # pte's
referencing the page [page_mapcount(page)], when requested.

I think this is safe.  If we're migrating a shared memory page, then we
found the page via a page table, so it must be in memory.

Can be verified with memtoy and the shmem-mbind-test script, both
available at:  http://free.linux.hp.com/~lts/Tools/Signed-off-by: NLee Schermerhorn <lee.schermerhorn@hp.com>
Acked-by: NChristoph Lameter <clameter@sgi.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Seems we are trying to init the node_mem_map when we don't need to, for
example when SPARSEMEM is enabled.  This causes the error below during
compilation.  Use CONFIG_FLAT_NODE_MEM_MAP to gate allocation and init.

  arch/x86_64/mm/numa.c: In function `setup_node_zones':
  arch/x86_64/mm/numa.c:191: error: structure has no member
                                                  named `node_mem_map'
Signed-off-by: NAndy Whitcroft <apw@shadowen.org>
Acked-by: NAndi Kleen <ak@muc.de>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Fix a possible Oops in the Siemens Gigaset base driver when the device is
unplugged while an ISDN connection is still active, and makes sure that the
isdn4linux link level (LL) is properly informed if a connection is broken
by the USB cable being unplugged.

- Avoid unsafe checks of URB status fields outside the URB completion
  handlers, keep track of in-use URBs myself instead.

- If an isochronous transfer URB completes with status==0, also check the
  status of the frame descriptors.

- Verify length of interrupt messages received from the device.

- Align the length limit on transmitted AT commands with the device
  documentation.

- In case of AT response receive overrun, keep newly arrived instead of old
  unread data.

- Remove redundant check of device ID in the USB probe function.

- Correct and improve some comments and formatting.
Signed-off-by: NTilman Schmidt <tilman@imap.cc>
Acked-by: NHansjoerg Lipp <hjlipp@web.de>
Cc: Karsten Keil <kkeil@suse.de>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/netdev-2.6: (21 commits)
  [PATCH] wext: Fix RtNetlink ENCODE security permissions
  [PATCH] bcm43xx: iw_priv_args names should be <16 characters
  [PATCH] bcm43xx: sysfs code cleanup
  [PATCH] bcm43xx: fix pctl slowclock limit calculation
  [PATCH] bcm43xx: fix dyn tssi2dbm memleak
  [PATCH] bcm43xx: fix config menu alignment
  [PATCH] bcm43xx wireless: fix printk format warnings
  [PATCH] softmac: report when scanning has finished
  [PATCH] softmac: fix event sending
  [PATCH] softmac: handle iw_mode properly
  [PATCH] softmac: dont send out packets while scanning
  [PATCH] softmac: return -EAGAIN from getscan while scanning
  [PATCH] bcm43xx: set trans_start on TX to prevent bogus timeouts
  [PATCH] orinoco: fix truncating commsquality RID with the latest Symbol firmware
  [PATCH] softmac: fix spinlock recursion on reassoc
  [PATCH] Revert NET_RADIO Kconfig title change
  [PATCH] wext: Fix IWENCODEEXT security permissions
  [PATCH] wireless/atmel: send WEXT scan completion events
  [PATCH] wireless/airo: clean up WEXT association and scan events
  [PATCH] softmac uses Wiress Ext.
  ...

* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [EBTABLES]: Clean up vmalloc usage in net/bridge/netfilter/ebtables.c
  [NET]: Add skb->truesize assertion checking.
  [TCP]: Account skb overhead in tcp_fragment
  [SUNGEM]: Marvell PHY suspend.
  [LLC]: Use pskb_trim_rcsum() in llc_fixup_skb().
  [NET]: sockfd_lookup_light() returns random error for -EBADFD

* master.kernel.org:/home/rmk/linux-2.6-arm:
  [ARM] for_each_possible_cpu
  [ARM] add_memory() build fix
  [ARM] 3483/1: ixp23xx: update defconfig to 2.6.17-rc2
  [ARM] 3482/1: ixp2000: update defconfig to 2.6.17-rc2
  [ARM] 3481/1: ep93xx: update defconfig to 2.6.17-rc2
  [ARM] 3480/1: ixp4xx: fix irq2gpio array type

Merge branch 'upstream-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6

Correct the base address of the Realtek RTL8019AS chip on the Toshiba RBTX4938
board -- this should make the driver work at least when CONFIG_PCI is enabled.
Signed-off-by: NYuri Shpilevsky <yshpilevsky@ru.mvista.com>
Signed-off-by: NSergei Shtylyov <sshtylyov@ru.mvista.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

for_each_cpu() actually iterates across all possible CPUs.  We've had mistakes
in the past where people were using for_each_cpu() where they should have been
iterating across only online or present CPUs.  This is inefficient and
possibly buggy.

We're renaming for_each_cpu() to for_each_possible_cpu() to avoid this in the
future.

This patch replaces for_each_cpu with for_each_possible_cpu.
Signed-off-by: NKAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

This is back again.  Offending patch is x86_64-mm-hotadd-reserve.patch

arch/arm/kernel/setup.c:435: error: conflicting types for 'add_memory'
include/linux/memory_hotplug.h:102: error: previous declaration of 'add_memory' was here
arch/arm/kernel/setup.c:435: error: conflicting types for 'add_memory'
include/linux/memory_hotplug.h:102: error: previous declaration of 'add_memory' was here
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

Patch from Lennert Buytenhek
Signed-off-by: NLennert Buytenhek <buytenh@wantstofly.org>
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

Patch from Lennert Buytenhek
Signed-off-by: NLennert Buytenhek <buytenh@wantstofly.org>
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

Patch from Lennert Buytenhek
Signed-off-by: NLennert Buytenhek <buytenh@wantstofly.org>
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

Patch from Lennert Buytenhek

The irq2gpio array was recently converted from an array of ints to an
array of chars (by patch 3368/1.)  However, this array contains elements
that are -1, and on ARM, the char type is unsigned by default, so this
patch broke the GPIO check in ixp4xx_set_irq_type.

Change the 'char' to be a 'signed char' to fix this.
Signed-off-by: NLennert Buytenhek <buytenh@wantstofly.org>
Signed-off-by: NDeepak Saxena <dsaxena@plexity.net>
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

* 'for-linus' of git://brick.kernel.dk/data/git/linux-2.6-block:
  [PATCH] block/elevator.c: remove unused exports
  [PATCH] splice: fix smaller sized splice reads
  [PATCH] Don't inherit ->splice_pipe across forks
  [patch] cleanup: use blk_queue_stopped
  [PATCH] Document online io scheduler switching

* master.kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6:
  [SPARC]: __NR_sys_splice --> __NR_splice

It seems latest kernel has a wrong/missing __read_mostly implementation
for x86_64

__read_mostly macro should be declared outside of #if CONFIG_X86_VSMP block
Signed-off-by: NEric Dumazet <dada1@cosmosbay.com>
Signed-off-by: NAndi Kleen <ak@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

AMD K7/K8 CPUs only save/restore the FOP/FIP/FDP x87 registers in FXSAVE
when an exception is pending.  This means the value leak through
context switches and allow processes to observe some x87 instruction
state of other processes.

This was actually documented by AMD, but nobody recognized it as
being different from Intel before.

The fix first adds an optimization: instead of unconditionally
calling FNCLEX after each FXSAVE test if ES is pending and skip
it when not needed. Then do a x87 load from a kernel variable to
clear FOP/FIP/FDP.

This means other processes always will only see a constant value
defined by the kernel in their FP state.

I took some pain to make sure to chose a variable that's already
in L1 during context switch to make the overhead of this low.

Also alternative() is used to patch away the new code on CPUs
who don't need it.

Patch for both i386/x86-64.

The problem was discovered originally by Jan Beulich. Richard
Brunner provided the basic code for the workarounds, with contribution
from Jan.

This is CVE-2006-1056

Cc: richard.brunner@amd.com
Cc: jbeulich@novell.com
Signed-off-by: NAndi Kleen <ak@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>