1.1 --- a/linux-2.6-xen-sparse/drivers/xen/tpmback/interface.c	Fri Oct 07 23:21:23 2005 +0100
     1.2 +++ b/linux-2.6-xen-sparse/drivers/xen/tpmback/interface.c	Fri Oct 07 23:22:35 2005 +0100
     1.3 @@ -67,7 +67,7 @@ tpmif_find(domid_t domid, long int insta
     1.4  				tpmif_get(tpmif);
     1.5  				return tpmif;
     1.6  			} else {
     1.7 -				return NULL;
     1.8 +				return ERR_PTR(-EEXIST);
     1.9  			}
    1.10  		}
    1.11  	}

     2.1 --- a/linux-2.6-xen-sparse/drivers/xen/tpmback/tpmback.c	Fri Oct 07 23:21:23 2005 +0100
     2.2 +++ b/linux-2.6-xen-sparse/drivers/xen/tpmback/tpmback.c	Fri Oct 07 23:22:35 2005 +0100
     2.3 @@ -22,6 +22,7 @@
     2.4  #include <asm-xen/xen-public/grant_table.h>
     2.5  
     2.6  
     2.7 +/* local data structures */
     2.8  struct data_exchange {
     2.9  	struct list_head pending_pak;
    2.10  	struct list_head current_pak;
    2.11 @@ -45,7 +46,7 @@ struct packet {
    2.12  
    2.13  enum {
    2.14  	PACKET_FLAG_DISCARD_RESPONSE = 1,
    2.15 -	PACKET_FLAG_SEND_CONTROLMESSAGE = 2,
    2.16 +	PACKET_FLAG_CHECK_RESPONSESTATUS = 2,
    2.17  };
    2.18  
    2.19  static struct data_exchange dataex;
    2.20 @@ -66,9 +67,26 @@ static int  packet_read_shmem(struct pac
    2.21  
    2.22  #define MAX_PENDING_REQS TPMIF_TX_RING_SIZE
    2.23  
    2.24 -static multicall_entry_t tx_mcl[MAX_PENDING_REQS];
    2.25 +#define MIN(x,y)  (x) < (y) ? (x) : (y)
    2.26 +
    2.27  
    2.28 -#define MIN(x,y)  (x) < (y) ? (x) : (y)
    2.29 +/***************************************************************
    2.30 + Buffer copying
    2.31 +***************************************************************/
    2.32 +static inline int
    2.33 +copy_from_buffer(void *to,
    2.34 +                 const void *from,
    2.35 +                 unsigned long size,
    2.36 +                 int userbuffer)
    2.37 +{
    2.38 +	if (userbuffer) {
    2.39 +		if (copy_from_user(to, from, size))
    2.40 +			return -EFAULT;
    2.41 +	} else {
    2.42 +		memcpy(to, from, size);
    2.43 +	}
    2.44 +	return 0;
    2.45 +}
    2.46  
    2.47  /***************************************************************
    2.48   Packet-related functions
    2.49 @@ -188,15 +206,25 @@ packet_write(struct packet *pak,
    2.50  	DPRINTK("Supposed to send %d bytes to front-end!\n",
    2.51  	        size);
    2.52  
    2.53 -	if (0 != (pak->flags & PACKET_FLAG_SEND_CONTROLMESSAGE)) {
    2.54 +	if (0 != (pak->flags & PACKET_FLAG_CHECK_RESPONSESTATUS)) {
    2.55  #ifdef CONFIG_XEN_TPMDEV_CLOSE_IF_VTPM_FAILS
    2.56  		u32 res;
    2.57 -		memcpy(&res, &data[2+4], sizeof(res));
    2.58 +		if (copy_from_buffer(&res,
    2.59 +		                     &data[2+4],
    2.60 +		                     sizeof(res),
    2.61 +		                     userbuffer)) {
    2.62 +			return -EFAULT;
    2.63 +		}
    2.64 +
    2.65  		if (res != 0) {
    2.66  			/*
    2.67 -			 * Will close down this device and have the
    2.68 +			 * Close down this device. Should have the
    2.69  			 * FE notified about closure.
    2.70  			 */
    2.71 +			if (!pak->tpmif) {
    2.72 +				return -EFAULT;
    2.73 +			}
    2.74 +			pak->tpmif->status = DISCONNECTING;
    2.75  		}
    2.76  #endif
    2.77  	}
    2.78 @@ -226,16 +254,15 @@ static int
    2.79  	int rc = 0;
    2.80  	unsigned int i = 0;
    2.81  	unsigned int offset = 0;
    2.82 -	multicall_entry_t *mcl;
    2.83  
    2.84 -	if (tpmif == NULL)
    2.85 +	if (tpmif == NULL) {
    2.86  		return -EFAULT;
    2.87 +        }
    2.88  
    2.89 -	if (tpmif->status != CONNECTED) {
    2.90 +	if (tpmif->status == DISCONNECTED) {
    2.91  		return size;
    2.92  	}
    2.93  
    2.94 -	mcl = tx_mcl;
    2.95  	while (offset < size && i < TPMIF_TX_RING_SIZE) {
    2.96  		unsigned int tocopy;
    2.97  		struct gnttab_map_grant_ref map_op;
    2.98 @@ -272,22 +299,15 @@ static int
    2.99  					PAGE_SHIFT] =
   2.100  			FOREIGN_FRAME(map_op.dev_bus_addr >> PAGE_SHIFT);
   2.101  
   2.102 -		tocopy = size - offset;
   2.103 -		if (tocopy > PAGE_SIZE) {
   2.104 -			tocopy = PAGE_SIZE;
   2.105 -		}
   2.106 -		if (userbuffer) {
   2.107 -			if (copy_from_user((void *)(MMAP_VADDR(tpmif,i) |
   2.108 -			                           (tx->addr & ~PAGE_MASK)),
   2.109 -			                   (void __user *)&data[offset],
   2.110 -			                   tocopy)) {
   2.111 -				tpmif_put(tpmif);
   2.112 -				return -EFAULT;
   2.113 -			}
   2.114 -		} else {
   2.115 -			memcpy((void *)(MMAP_VADDR(tpmif,i) |
   2.116 -					(tx->addr & ~PAGE_MASK)),
   2.117 -			       &data[offset], tocopy);
   2.118 +		tocopy = MIN(size - offset, PAGE_SIZE);
   2.119 +
   2.120 +		if (copy_from_buffer((void *)(MMAP_VADDR(tpmif,i)|
   2.121 +		                     (tx->addr & ~PAGE_MASK)),
   2.122 +		                     &data[offset],
   2.123 +		                     tocopy,
   2.124 +		                     userbuffer)) {
   2.125 +			tpmif_put(tpmif);
   2.126 +			return -EFAULT;
   2.127  		}
   2.128  		tx->size = tocopy;
   2.129  
   2.130 @@ -306,8 +326,8 @@ static int
   2.131  	}
   2.132  
   2.133  	rc = offset;
   2.134 -	DPRINTK("Notifying frontend via event channel %d\n",
   2.135 -	        tpmif->evtchn);
   2.136 +	DPRINTK("Notifying frontend via irq %d\n",
   2.137 +	        tpmif->irq);
   2.138  	notify_remote_via_irq(tpmif->irq);
   2.139  
   2.140  	return rc;
   2.141 @@ -705,9 +725,13 @@ static u8 destroy_cmd[] = {
   2.142  int tpmif_vtpm_open(tpmif_t *tpmif, domid_t domid, u32 instance)
   2.143  {
   2.144  	int rc = 0;
   2.145 -	struct packet *pak = packet_alloc(tpmif, sizeof(create_cmd), create_cmd[0],
   2.146 -	    PACKET_FLAG_DISCARD_RESPONSE|
   2.147 -	    PACKET_FLAG_SEND_CONTROLMESSAGE);
   2.148 +	struct packet *pak;
   2.149 +
   2.150 +	pak = packet_alloc(tpmif,
   2.151 +	                   sizeof(create_cmd),
   2.152 +	                   create_cmd[0],
   2.153 +	                   PACKET_FLAG_DISCARD_RESPONSE|
   2.154 +	                   PACKET_FLAG_CHECK_RESPONSESTATUS);
   2.155  	if (pak) {
   2.156  		u8 buf[sizeof(create_cmd)];
   2.157  		u32 domid_no = htonl((u32)domid);
   2.158 @@ -742,8 +766,7 @@ int tpmif_vtpm_close(u32 instid)
   2.159  	pak = packet_alloc(NULL,
   2.160  	                   sizeof(create_cmd),
   2.161  	                   create_cmd[0],
   2.162 -	                   PACKET_FLAG_DISCARD_RESPONSE|
   2.163 -	                   PACKET_FLAG_SEND_CONTROLMESSAGE);
   2.164 +	                   PACKET_FLAG_DISCARD_RESPONSE);
   2.165  	if (pak) {
   2.166  		u8 buf[sizeof(destroy_cmd)];
   2.167  		u32 instid_no = htonl(instid);
   2.168 @@ -896,7 +919,8 @@ static int vtpm_receive(tpmif_t *tpmif, 
   2.169  	 */
   2.170  	if (size < 10 ||
   2.171  	    be32_to_cpu(*native_size) != size ||
   2.172 -	    0 == dataex.has_opener) {
   2.173 +	    0 == dataex.has_opener ||
   2.174 +	    tpmif->status != CONNECTED) {
   2.175  	    	rc = -EINVAL;
   2.176  	    	goto failexit;
   2.177  	} else {

     3.1 --- a/tools/python/xen/xend/server/tpmif.py	Fri Oct 07 23:21:23 2005 +0100
     3.2 +++ b/tools/python/xen/xend/server/tpmif.py	Fri Oct 07 23:22:35 2005 +0100
     3.3 @@ -37,7 +37,7 @@ class TPMifController(DevController):
     3.4  
     3.5      def getDeviceDetails(self, config):
     3.6          """@see DevController.getDeviceDetails"""
     3.7 -        
     3.8 +
     3.9          devid = int(sxp.child_value(config, 'instance', '0'))
    3.10          log.info("The domain has a TPM with instance %d." % devid)
    3.11  
    3.12 @@ -48,9 +48,7 @@ class TPMifController(DevController):
    3.13  
    3.14      def configuration(self, devid):
    3.15  
    3.16 -        log.info("The configuration method is called.")
    3.17 -
    3.18 -        result = DevContoller.configuration(self, devid)
    3.19 +        result = DevController.configuration(self, devid)
    3.20  
    3.21          (instance) = self.readBackend(devif,
    3.22                                        'instance')