Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security

Pull security subsystem update from James Morris:
 "Just some minor updates across the subsystem"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
  ima: eliminate passing d_name.name to process_measurement()
  TPM: Retry SaveState command in suspend path
  tpm/tpm_i2c_infineon: Add small comment about return value of __i2c_transfer
  tpm/tpm_i2c_infineon.c: Add OF attributes type and name to the of_device_id table entries
  tpm_i2c_stm_st33: Remove duplicate inclusion of header files
  tpm: Add support for new Infineon I2C TPM (SLB 9645 TT 1.2 I2C)
  char/tpm: Convert struct i2c_msg initialization to C99 format
  drivers/char/tpm/tpm_ppi: use strlcpy instead of strncpy
  tpm/tpm_i2c_stm_st33: formatting and white space changes
  Smack: include magic.h in smackfs.c
  selinux: make security_sb_clone_mnt_opts return an error on context mismatch
  seccomp: allow BPF_XOR based ALU instructions.
  Fix NULL pointer dereference in smack_inode_unlink() and smack_inode_rmdir()
  Smack: add support for modification of existing rules
  smack: SMACK_MAGIC to include/uapi/linux/magic.h
  Smack: add missing support for transmute bit in smack_str_from_perm()
  Smack: prevent revoke-subject from failing when unseen label is written to it
  tomoyo: use DEFINE_SRCU() to define tomoyo_ss
  tomoyo: use DEFINE_SRCU() to define tomoyo_ss

20 files changed, 450 insertions, 201 deletions

diff --git a/Documentation/devicetree/bindings/i2c/trivial-devices.txt b/Documentation/devicetree/bindings/i2c/trivial-devices.txt
index 446859fcdca4..ad6a73852f08 100644
--- a/Documentation/devicetree/bindings/i2c/trivial-devices.txt
+++ b/Documentation/devicetree/bindings/i2c/trivial-devices.txt
@@ -35,6 +35,8 @@ fsl,mc13892		MC13892: Power Management Integrated Circuit (PMIC) for i.MX35/51
 fsl,mma8450             MMA8450Q: Xtrinsic Low-power, 3-axis Xtrinsic Accelerometer
 fsl,mpr121              MPR121: Proximity Capacitive Touch Sensor Controller
 fsl,sgtl5000            SGTL5000: Ultra Low-Power Audio Codec
+infineon,slb9635tt      Infineon SLB9635 (Soft-) I2C TPM (old protocol, max 100khz)
+infineon,slb9645tt      Infineon SLB9645 I2C TPM (new protocol, max 400khz)
 maxim,ds1050            5 Bit Programmable, Pulse-Width Modulator
 maxim,max1237           Low-Power, 4-/12-Channel, 2-Wire Serial, 12-Bit ADCs
 maxim,max6625           9-Bit/12-Bit Temperature Sensors with I²C-Compatible Serial Interface
diff --git a/Documentation/security/Smack.txt b/Documentation/security/Smack.txt
index 8a177e4b6e21..7a2d30c132e3 100644
--- a/Documentation/security/Smack.txt
+++ b/Documentation/security/Smack.txt
@@ -117,6 +117,17 @@ access2
 ambient
         This contains the Smack label applied to unlabeled network
         packets.
+change-rule
+        This interface allows modification of existing access control rules.
+        The format accepted on write is:
+                "%s %s %s %s"
+        where the first string is the subject label, the second the
+        object label, the third the access to allow and the fourth the
+        access to deny. The access strings may contain only the characters
+        "rwxat-". If a rule for a given subject and object exists it will be
+        modified by enabling the permissions in the third string and disabling
+        those in the fourth string. If there is no such rule it will be
+        created using the access specified in the third and the fourth strings.
 cipso
         This interface allows a specific CIPSO header to be assigned
         to a Smack label. The format accepted on write is:
diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
index 0d2e82f95577..7c3b3dcbfbc8 100644
--- a/drivers/char/tpm/tpm.c
+++ b/drivers/char/tpm/tpm.c
@@ -1337,7 +1337,7 @@ int tpm_pm_suspend(struct device *dev)
 {
         struct tpm_chip *chip = dev_get_drvdata(dev);
         struct tpm_cmd_t cmd;
-        int rc;
+        int rc, try;
 
         u8 dummy_hash[TPM_DIGEST_SIZE] = { 0 };
 
@@ -1355,9 +1355,32 @@ int tpm_pm_suspend(struct device *dev)
         }
 
         /* now do the actual savestate */
-        cmd.header.in = savestate_header;
-        rc = transmit_cmd(chip, &cmd, SAVESTATE_RESULT_SIZE,
-                          "sending savestate before suspend");
+        for (try = 0; try < TPM_RETRY; try++) {
+                cmd.header.in = savestate_header;
+                rc = transmit_cmd(chip, &cmd, SAVESTATE_RESULT_SIZE, NULL);
+
+                /*
+                 * If the TPM indicates that it is too busy to respond to
+                 * this command then retry before giving up.  It can take
+                 * several seconds for this TPM to be ready.
+                 *
+                 * This can happen if the TPM has already been sent the
+                 * SaveState command before the driver has loaded.  TCG 1.2
+                 * specification states that any communication after SaveState
+                 * may cause the TPM to invalidate previously saved state.
+                 */
+                if (rc != TPM_WARN_RETRY)
+                        break;
+                msleep(TPM_TIMEOUT_RETRY);
+        }
+
+        if (rc)
+                dev_err(chip->dev,
+                        "Error (%d) sending savestate before suspend\n", rc);
+        else if (try > 0)
+                dev_warn(chip->dev, "TPM savestate took %dms\n",
+                         try * TPM_TIMEOUT_RETRY);
+
         return rc;
 }
 EXPORT_SYMBOL_GPL(tpm_pm_suspend);
diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
index 81b52015f669..0770d1d79366 100644
--- a/drivers/char/tpm/tpm.h
+++ b/drivers/char/tpm/tpm.h
@@ -32,10 +32,12 @@ enum tpm_const {
         TPM_MINOR = 224,        /* officially assigned */
         TPM_BUFSIZE = 4096,
         TPM_NUM_DEVICES = 256,
+        TPM_RETRY = 50,         /* 5 seconds */
 };
 
 enum tpm_timeout {
         TPM_TIMEOUT = 5,        /* msecs */
+        TPM_TIMEOUT_RETRY = 100 /* msecs */
 };
 
 /* TPM addresses */
@@ -44,6 +46,7 @@ enum tpm_addr {
         TPM_ADDR = 0x4E,
 };
 
+#define TPM_WARN_RETRY          0x800
 #define TPM_WARN_DOING_SELFTEST 0x802
 #define TPM_ERR_DEACTIVATED     0x6
 #define TPM_ERR_DISABLED        0x7
diff --git a/drivers/char/tpm/tpm_i2c_infineon.c b/drivers/char/tpm/tpm_i2c_infineon.c
index 8fe7ac3d095b..37d5dcc10ea7 100644
--- a/drivers/char/tpm/tpm_i2c_infineon.c
+++ b/drivers/char/tpm/tpm_i2c_infineon.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2012 Infineon Technologies
+ * Copyright (C) 2012,2013 Infineon Technologies
  *
  * Authors:
  * Peter Huewe <peter.huewe@infineon.com>
@@ -56,13 +56,21 @@
 #define TPM_TIMEOUT_US_HI  (TPM_TIMEOUT_US_LOW + 2000)
 
 /* expected value for DIDVID register */
-#define TPM_TIS_I2C_DID_VID 0x000b15d1L
+#define TPM_TIS_I2C_DID_VID_9635 0xd1150b00L
+#define TPM_TIS_I2C_DID_VID_9645 0x001a15d1L
+
+enum i2c_chip_type {
+        SLB9635,
+        SLB9645,
+        UNKNOWN,
+};
 
 /* Structure to store I2C TPM specific stuff */
 struct tpm_inf_dev {
         struct i2c_client *client;
         u8 buf[TPM_BUFSIZE + sizeof(u8)]; /* max. buffer size + addr */
         struct tpm_chip *chip;
+        enum i2c_chip_type chip_type;
 };