tpm_tis: fix potential buffer overruns caused by bit glitches on the bus
[pandora-kernel.git] / drivers / char / tpm / tpm_tis.c
1 /*
2  * Copyright (C) 2005, 2006 IBM Corporation
3  *
4  * Authors:
5  * Leendert van Doorn <leendert@watson.ibm.com>
6  * Kylene Hall <kjhall@us.ibm.com>
7  *
8  * Maintained by: <tpmdd-devel@lists.sourceforge.net>
9  *
10  * Device driver for TCG/TCPA TPM (trusted platform module).
11  * Specifications at www.trustedcomputinggroup.org
12  *
13  * This device driver implements the TPM interface as defined in
14  * the TCG TPM Interface Spec version 1.2, revision 1.0.
15  *
16  * This program is free software; you can redistribute it and/or
17  * modify it under the terms of the GNU General Public License as
18  * published by the Free Software Foundation, version 2 of the
19  * License.
20  */
21 #include <linux/init.h>
22 #include <linux/module.h>
23 #include <linux/moduleparam.h>
24 #include <linux/pnp.h>
25 #include <linux/slab.h>
26 #include <linux/interrupt.h>
27 #include <linux/wait.h>
28 #include <linux/acpi.h>
29 #include <linux/freezer.h>
30 #include "tpm.h"
31
32 #define TPM_HEADER_SIZE 10
33
34 enum tis_access {
35         TPM_ACCESS_VALID = 0x80,
36         TPM_ACCESS_ACTIVE_LOCALITY = 0x20,
37         TPM_ACCESS_REQUEST_PENDING = 0x04,
38         TPM_ACCESS_REQUEST_USE = 0x02,
39 };
40
41 enum tis_status {
42         TPM_STS_VALID = 0x80,
43         TPM_STS_COMMAND_READY = 0x40,
44         TPM_STS_GO = 0x20,
45         TPM_STS_DATA_AVAIL = 0x10,
46         TPM_STS_DATA_EXPECT = 0x08,
47 };
48
49 enum tis_int_flags {
50         TPM_GLOBAL_INT_ENABLE = 0x80000000,
51         TPM_INTF_BURST_COUNT_STATIC = 0x100,
52         TPM_INTF_CMD_READY_INT = 0x080,
53         TPM_INTF_INT_EDGE_FALLING = 0x040,
54         TPM_INTF_INT_EDGE_RISING = 0x020,
55         TPM_INTF_INT_LEVEL_LOW = 0x010,
56         TPM_INTF_INT_LEVEL_HIGH = 0x008,
57         TPM_INTF_LOCALITY_CHANGE_INT = 0x004,
58         TPM_INTF_STS_VALID_INT = 0x002,
59         TPM_INTF_DATA_AVAIL_INT = 0x001,
60 };
61
62 enum tis_defaults {
63         TIS_MEM_BASE = 0xFED40000,
64         TIS_MEM_LEN = 0x5000,
65         TIS_SHORT_TIMEOUT = 750,        /* ms */
66         TIS_LONG_TIMEOUT = 2000,        /* 2 sec */
67 };
68
69 #define TPM_ACCESS(l)                   (0x0000 | ((l) << 12))
70 #define TPM_INT_ENABLE(l)               (0x0008 | ((l) << 12))
71 #define TPM_INT_VECTOR(l)               (0x000C | ((l) << 12))
72 #define TPM_INT_STATUS(l)               (0x0010 | ((l) << 12))
73 #define TPM_INTF_CAPS(l)                (0x0014 | ((l) << 12))
74 #define TPM_STS(l)                      (0x0018 | ((l) << 12))
75 #define TPM_DATA_FIFO(l)                (0x0024 | ((l) << 12))
76
77 #define TPM_DID_VID(l)                  (0x0F00 | ((l) << 12))
78 #define TPM_RID(l)                      (0x0F04 | ((l) << 12))
79
80 static LIST_HEAD(tis_chips);
81 static DEFINE_SPINLOCK(tis_lock);
82
83 #if defined(CONFIG_PNP) && defined(CONFIG_ACPI)
84 static int is_itpm(struct pnp_dev *dev)
85 {
86         struct acpi_device *acpi = pnp_acpi_device(dev);
87         struct acpi_hardware_id *id;
88
89         list_for_each_entry(id, &acpi->pnp.ids, list) {
90                 if (!strcmp("INTC0102", id->id))
91                         return 1;
92         }
93
94         return 0;
95 }
96 #else
97 static inline int is_itpm(struct pnp_dev *dev)
98 {
99         return 0;
100 }
101 #endif
102
103 static int check_locality(struct tpm_chip *chip, int l)
104 {
105         if ((ioread8(chip->vendor.iobase + TPM_ACCESS(l)) &
106              (TPM_ACCESS_ACTIVE_LOCALITY | TPM_ACCESS_VALID)) ==
107             (TPM_ACCESS_ACTIVE_LOCALITY | TPM_ACCESS_VALID))
108                 return chip->vendor.locality = l;
109
110         return -1;
111 }
112
113 static void release_locality(struct tpm_chip *chip, int l, int force)
114 {
115         if (force || (ioread8(chip->vendor.iobase + TPM_ACCESS(l)) &
116                       (TPM_ACCESS_REQUEST_PENDING | TPM_ACCESS_VALID)) ==
117             (TPM_ACCESS_REQUEST_PENDING | TPM_ACCESS_VALID))
118                 iowrite8(TPM_ACCESS_ACTIVE_LOCALITY,
119                          chip->vendor.iobase + TPM_ACCESS(l));
120 }
121
122 static int request_locality(struct tpm_chip *chip, int l)
123 {
124         unsigned long stop, timeout;
125         long rc;
126
127         if (check_locality(chip, l) >= 0)
128                 return l;
129
130         iowrite8(TPM_ACCESS_REQUEST_USE,
131                  chip->vendor.iobase + TPM_ACCESS(l));
132
133         stop = jiffies + chip->vendor.timeout_a;
134
135         if (chip->vendor.irq) {
136 again:
137                 timeout = stop - jiffies;
138                 if ((long)timeout <= 0)
139                         return -1;
140                 rc = wait_event_interruptible_timeout(chip->vendor.int_queue,
141                                                       (check_locality
142                                                        (chip, l) >= 0),
143                                                       timeout);
144                 if (rc > 0)
145                         return l;
146                 if (rc == -ERESTARTSYS && freezing(current)) {
147                         clear_thread_flag(TIF_SIGPENDING);
148                         goto again;
149                 }
150         } else {
151                 /* wait for burstcount */
152                 do {
153                         if (check_locality(chip, l) >= 0)
154                                 return l;
155                         msleep(TPM_TIMEOUT);
156                 }
157                 while (time_before(jiffies, stop));
158         }
159         return -1;
160 }
161
162 static u8 tpm_tis_status(struct tpm_chip *chip)
163 {
164         return ioread8(chip->vendor.iobase +
165                        TPM_STS(chip->vendor.locality));
166 }
167
168 static void tpm_tis_ready(struct tpm_chip *chip)
169 {
170         /* this causes the current command to be aborted */
171         iowrite8(TPM_STS_COMMAND_READY,
172                  chip->vendor.iobase + TPM_STS(chip->vendor.locality));
173 }
174
175 static int get_burstcount(struct tpm_chip *chip)
176 {
177         unsigned long stop;
178         int burstcnt;
179         u32 value;
180
181         /* wait for burstcount */
182         /* which timeout value, spec has 2 answers (c & d) */
183         stop = jiffies + chip->vendor.timeout_d;
184         do {
185                 value = ioread32(chip->vendor.iobase +
186                                  TPM_STS(chip->vendor.locality));
187                 burstcnt = (value >> 8) & 0xFFFF;
188                 if (burstcnt)
189                         return burstcnt;
190                 msleep(TPM_TIMEOUT);
191         } while (time_before(jiffies, stop));
192         return -EBUSY;
193 }
194
195 static int wait_for_stat(struct tpm_chip *chip, u8 mask, unsigned long timeout,
196                          wait_queue_head_t *queue)
197 {
198         unsigned long stop;
199         long rc;
200         u8 status;
201
202         /* check current status */
203         status = tpm_tis_status(chip);
204         if ((status & mask) == mask)
205                 return 0;
206
207         stop = jiffies + timeout;
208
209         if (chip->vendor.irq) {
210 again:
211                 timeout = stop - jiffies;
212                 if ((long)timeout <= 0)
213                         return -ETIME;
214                 rc = wait_event_interruptible_timeout(*queue,
215                                                       ((tpm_tis_status
216                                                         (chip) & mask) ==
217                                                        mask), timeout);
218                 if (rc > 0)
219                         return 0;
220                 if (rc == -ERESTARTSYS && freezing(current)) {
221                         clear_thread_flag(TIF_SIGPENDING);
222                         goto again;
223                 }
224         } else {
225                 do {
226                         msleep(TPM_TIMEOUT);
227                         status = tpm_tis_status(chip);
228                         if ((status & mask) == mask)
229                                 return 0;
230                 } while (time_before(jiffies, stop));
231         }
232         return -ETIME;
233 }
234
235 static int recv_data(struct tpm_chip *chip, u8 *buf, size_t count)
236 {
237         int size = 0, burstcnt;
238         while (size < count &&
239                wait_for_stat(chip,
240                              TPM_STS_DATA_AVAIL | TPM_STS_VALID,
241                              chip->vendor.timeout_c,
242                              &chip->vendor.read_queue)
243                == 0) {
244                 burstcnt = get_burstcount(chip);
245                 for (; burstcnt > 0 && size < count; burstcnt--)
246                         buf[size++] = ioread8(chip->vendor.iobase +
247                                               TPM_DATA_FIFO(chip->vendor.
248                                                             locality));
249         }
250         return size;
251 }
252
253 static int tpm_tis_recv(struct tpm_chip *chip, u8 *buf, size_t count)
254 {
255         int size = 0;
256         int status;
257         u32 expected;
258
259         if (count < TPM_HEADER_SIZE) {
260                 size = -EIO;
261                 goto out;
262         }
263
264         /* read first 10 bytes, including tag, paramsize, and result */
265         if ((size =
266              recv_data(chip, buf, TPM_HEADER_SIZE)) < TPM_HEADER_SIZE) {
267                 dev_err(chip->dev, "Unable to read header\n");
268                 goto out;
269         }
270
271         expected = be32_to_cpu(*(__be32 *) (buf + 2));
272         if (expected > count || expected < TPM_HEADER_SIZE) {
273                 size = -EIO;
274                 goto out;
275         }
276
277         if ((size +=
278              recv_data(chip, &buf[TPM_HEADER_SIZE],
279                        expected - TPM_HEADER_SIZE)) < expected) {
280                 dev_err(chip->dev, "Unable to read remainder of result\n");
281                 size = -ETIME;
282                 goto out;
283         }
284
285         wait_for_stat(chip, TPM_STS_VALID, chip->vendor.timeout_c,
286                       &chip->vendor.int_queue);
287         status = tpm_tis_status(chip);
288         if (status & TPM_STS_DATA_AVAIL) {      /* retry? */
289                 dev_err(chip->dev, "Error left over data\n");
290                 size = -EIO;
291                 goto out;
292         }
293
294 out:
295         tpm_tis_ready(chip);
296         release_locality(chip, chip->vendor.locality, 0);
297         return size;
298 }
299
300 static int itpm;
301 module_param(itpm, bool, 0444);
302 MODULE_PARM_DESC(itpm, "Force iTPM workarounds (found on some Lenovo laptops)");
303
304 /*
305  * If interrupts are used (signaled by an irq set in the vendor structure)
306  * tpm.c can skip polling for the data to be available as the interrupt is
307  * waited for here
308  */
309 static int tpm_tis_send_data(struct tpm_chip *chip, u8 *buf, size_t len)
310 {
311         int rc, status, burstcnt;
312         size_t count = 0;
313
314         if (request_locality(chip, 0) < 0)
315                 return -EBUSY;
316
317         status = tpm_tis_status(chip);
318         if ((status & TPM_STS_COMMAND_READY) == 0) {
319                 tpm_tis_ready(chip);
320                 if (wait_for_stat
321                     (chip, TPM_STS_COMMAND_READY, chip->vendor.timeout_b,
322                      &chip->vendor.int_queue) < 0) {
323                         rc = -ETIME;
324                         goto out_err;
325                 }
326         }
327
328         while (count < len - 1) {
329                 burstcnt = get_burstcount(chip);
330                 for (; burstcnt > 0 && count < len - 1; burstcnt--) {
331                         iowrite8(buf[count], chip->vendor.iobase +
332                                  TPM_DATA_FIFO(chip->vendor.locality));
333                         count++;
334                 }
335
336                 wait_for_stat(chip, TPM_STS_VALID, chip->vendor.timeout_c,
337                               &chip->vendor.int_queue);
338                 status = tpm_tis_status(chip);
339                 if (!itpm && (status & TPM_STS_DATA_EXPECT) == 0) {
340                         rc = -EIO;
341                         goto out_err;
342                 }
343         }
344
345         /* write last byte */
346         iowrite8(buf[count],
347                  chip->vendor.iobase + TPM_DATA_FIFO(chip->vendor.locality));
348         wait_for_stat(chip, TPM_STS_VALID, chip->vendor.timeout_c,
349                       &chip->vendor.int_queue);
350         status = tpm_tis_status(chip);
351         if ((status & TPM_STS_DATA_EXPECT) != 0) {
352                 rc = -EIO;
353                 goto out_err;
354         }
355
356         return 0;
357
358 out_err:
359         tpm_tis_ready(chip);
360         release_locality(chip, chip->vendor.locality, 0);
361         return rc;
362 }
363
364 /*
365  * If interrupts are used (signaled by an irq set in the vendor structure)
366  * tpm.c can skip polling for the data to be available as the interrupt is
367  * waited for here
368  */
369 static int tpm_tis_send(struct tpm_chip *chip, u8 *buf, size_t len)
370 {
371         int rc;
372         u32 ordinal;
373
374         rc = tpm_tis_send_data(chip, buf, len);
375         if (rc < 0)
376                 return rc;
377
378         /* go and do it */
379         iowrite8(TPM_STS_GO,
380                  chip->vendor.iobase + TPM_STS(chip->vendor.locality));
381
382         if (chip->vendor.irq) {
383                 ordinal = be32_to_cpu(*((__be32 *) (buf + 6)));
384                 if (wait_for_stat
385                     (chip, TPM_STS_DATA_AVAIL | TPM_STS_VALID,
386                      tpm_calc_ordinal_duration(chip, ordinal),
387                      &chip->vendor.read_queue) < 0) {
388                         rc = -ETIME;
389                         goto out_err;
390                 }
391         }
392         return len;
393 out_err:
394         tpm_tis_ready(chip);
395         release_locality(chip, chip->vendor.locality, 0);
396         return rc;
397 }
398
399 struct tis_vendor_timeout_override {
400         u32 did_vid;
401         unsigned long timeout_us[4];
402 };
403
404 static const struct tis_vendor_timeout_override vendor_timeout_overrides[] = {
405         /* Atmel 3204 */
406         { 0x32041114, { (TIS_SHORT_TIMEOUT*1000), (TIS_LONG_TIMEOUT*1000),
407                         (TIS_SHORT_TIMEOUT*1000), (TIS_SHORT_TIMEOUT*1000) } },
408 };
409
410 static bool tpm_tis_update_timeouts(struct tpm_chip *chip,
411                                     unsigned long *timeout_cap)
412 {
413         int i;
414         u32 did_vid;
415
416         did_vid = ioread32(chip->vendor.iobase + TPM_DID_VID(0));
417
418         for (i = 0; i != ARRAY_SIZE(vendor_timeout_overrides); i++) {
419                 if (vendor_timeout_overrides[i].did_vid != did_vid)
420                         continue;
421                 memcpy(timeout_cap, vendor_timeout_overrides[i].timeout_us,
422                        sizeof(vendor_timeout_overrides[i].timeout_us));
423                 return true;
424         }
425
426         return false;
427 }
428
429 /*
430  * Early probing for iTPM with STS_DATA_EXPECT flaw.
431  * Try sending command without itpm flag set and if that
432  * fails, repeat with itpm flag set.
433  */
434 static int probe_itpm(struct tpm_chip *chip)
435 {
436         int rc = 0;
437         u8 cmd_getticks[] = {
438                 0x00, 0xc1, 0x00, 0x00, 0x00, 0x0a,
439                 0x00, 0x00, 0x00, 0xf1
440         };
441         size_t len = sizeof(cmd_getticks);
442         int rem_itpm = itpm;
443
444         itpm = 0;
445
446         rc = tpm_tis_send_data(chip, cmd_getticks, len);
447         if (rc == 0)
448                 goto out;
449
450         tpm_tis_ready(chip);
451         release_locality(chip, chip->vendor.locality, 0);
452
453         itpm = 1;
454
455         rc = tpm_tis_send_data(chip, cmd_getticks, len);
456         if (rc == 0) {
457                 dev_info(chip->dev, "Detected an iTPM.\n");
458                 rc = 1;
459         } else
460                 rc = -EFAULT;
461
462 out:
463         itpm = rem_itpm;
464         tpm_tis_ready(chip);
465         /* some TPMs need a break here otherwise they will not work
466          * correctly on the immediately subsequent command */
467         msleep(chip->vendor.timeout_b);
468         release_locality(chip, chip->vendor.locality, 0);
469
470         return rc;
471 }
472
473 static const struct file_operations tis_ops = {
474         .owner = THIS_MODULE,
475         .llseek = no_llseek,
476         .open = tpm_open,
477         .read = tpm_read,
478         .write = tpm_write,
479         .release = tpm_release,
480 };
481
482 static DEVICE_ATTR(pubek, S_IRUGO, tpm_show_pubek, NULL);
483 static DEVICE_ATTR(pcrs, S_IRUGO, tpm_show_pcrs, NULL);
484 static DEVICE_ATTR(enabled, S_IRUGO, tpm_show_enabled, NULL);
485 static DEVICE_ATTR(active, S_IRUGO, tpm_show_active, NULL);
486 static DEVICE_ATTR(owned, S_IRUGO, tpm_show_owned, NULL);
487 static DEVICE_ATTR(temp_deactivated, S_IRUGO, tpm_show_temp_deactivated,
488                    NULL);
489 static DEVICE_ATTR(caps, S_IRUGO, tpm_show_caps_1_2, NULL);
490 static DEVICE_ATTR(cancel, S_IWUSR | S_IWGRP, NULL, tpm_store_cancel);
491 static DEVICE_ATTR(durations, S_IRUGO, tpm_show_durations, NULL);
492 static DEVICE_ATTR(timeouts, S_IRUGO, tpm_show_timeouts, NULL);
493
494 static struct attribute *tis_attrs[] = {
495         &dev_attr_pubek.attr,
496         &dev_attr_pcrs.attr,
497         &dev_attr_enabled.attr,
498         &dev_attr_active.attr,
499         &dev_attr_owned.attr,
500         &dev_attr_temp_deactivated.attr,
501         &dev_attr_caps.attr,
502         &dev_attr_cancel.attr,
503         &dev_attr_durations.attr,
504         &dev_attr_timeouts.attr, NULL,
505 };
506
507 static struct attribute_group tis_attr_grp = {
508         .attrs = tis_attrs
509 };
510
511 static struct tpm_vendor_specific tpm_tis = {
512         .status = tpm_tis_status,
513         .recv = tpm_tis_recv,
514         .send = tpm_tis_send,
515         .cancel = tpm_tis_ready,
516         .update_timeouts = tpm_tis_update_timeouts,
517         .req_complete_mask = TPM_STS_DATA_AVAIL | TPM_STS_VALID,
518         .req_complete_val = TPM_STS_DATA_AVAIL | TPM_STS_VALID,
519         .req_canceled = TPM_STS_COMMAND_READY,
520         .attr_group = &tis_attr_grp,
521         .miscdev = {
522                     .fops = &tis_ops,},
523 };
524
525 static irqreturn_t tis_int_probe(int irq, void *dev_id)
526 {
527         struct tpm_chip *chip = dev_id;
528         u32 interrupt;
529
530         interrupt = ioread32(chip->vendor.iobase +
531                              TPM_INT_STATUS(chip->vendor.locality));
532
533         if (interrupt == 0)
534                 return IRQ_NONE;
535
536         chip->vendor.probed_irq = irq;
537
538         /* Clear interrupts handled with TPM_EOI */
539         iowrite32(interrupt,
540                   chip->vendor.iobase +
541                   TPM_INT_STATUS(chip->vendor.locality));
542         return IRQ_HANDLED;
543 }
544
545 static irqreturn_t tis_int_handler(int dummy, void *dev_id)
546 {
547         struct tpm_chip *chip = dev_id;
548         u32 interrupt;
549         int i;
550
551         interrupt = ioread32(chip->vendor.iobase +
552                              TPM_INT_STATUS(chip->vendor.locality));
553
554         if (interrupt == 0)
555                 return IRQ_NONE;
556
557         if (interrupt & TPM_INTF_DATA_AVAIL_INT)
558                 wake_up_interruptible(&chip->vendor.read_queue);
559         if (interrupt & TPM_INTF_LOCALITY_CHANGE_INT)
560                 for (i = 0; i < 5; i++)
561                         if (check_locality(chip, i) >= 0)
562                                 break;
563         if (interrupt &
564             (TPM_INTF_LOCALITY_CHANGE_INT | TPM_INTF_STS_VALID_INT |
565              TPM_INTF_CMD_READY_INT))
566                 wake_up_interruptible(&chip->vendor.int_queue);
567
568         /* Clear interrupts handled with TPM_EOI */
569         iowrite32(interrupt,
570                   chip->vendor.iobase +
571                   TPM_INT_STATUS(chip->vendor.locality));
572         ioread32(chip->vendor.iobase + TPM_INT_STATUS(chip->vendor.locality));
573         return IRQ_HANDLED;
574 }
575
576 static int interrupts = 1;
577 module_param(interrupts, bool, 0444);
578 MODULE_PARM_DESC(interrupts, "Enable interrupts");
579
580 static int tpm_tis_init(struct device *dev, resource_size_t start,
581                         resource_size_t len, unsigned int irq)
582 {
583         u32 vendor, intfcaps, intmask;
584         int rc, i, irq_s, irq_e;
585         struct tpm_chip *chip;
586
587         if (!(chip = tpm_register_hardware(dev, &tpm_tis)))
588                 return -ENODEV;
589
590         chip->vendor.iobase = ioremap(start, len);
591         if (!chip->vendor.iobase) {
592                 rc = -EIO;
593                 goto out_err;
594         }
595
596         /* Default timeouts */
597         chip->vendor.timeout_a = msecs_to_jiffies(TIS_SHORT_TIMEOUT);
598         chip->vendor.timeout_b = msecs_to_jiffies(TIS_LONG_TIMEOUT);
599         chip->vendor.timeout_c = msecs_to_jiffies(TIS_SHORT_TIMEOUT);
600         chip->vendor.timeout_d = msecs_to_jiffies(TIS_SHORT_TIMEOUT);
601
602         if (request_locality(chip, 0) != 0) {
603                 rc = -ENODEV;
604                 goto out_err;
605         }
606
607         vendor = ioread32(chip->vendor.iobase + TPM_DID_VID(0));
608
609         dev_info(dev,
610                  "1.2 TPM (device-id 0x%X, rev-id %d)\n",
611                  vendor >> 16, ioread8(chip->vendor.iobase + TPM_RID(0)));
612
613         if (!itpm) {
614                 itpm = probe_itpm(chip);
615                 if (itpm < 0) {
616                         rc = -ENODEV;
617                         goto out_err;
618                 }
619         }
620
621         if (itpm)
622                 dev_info(dev, "Intel iTPM workaround enabled\n");
623
624
625         /* Figure out the capabilities */
626         intfcaps =
627             ioread32(chip->vendor.iobase +
628                      TPM_INTF_CAPS(chip->vendor.locality));
629         dev_dbg(dev, "TPM interface capabilities (0x%x):\n",
630                 intfcaps);
631         if (intfcaps & TPM_INTF_BURST_COUNT_STATIC)
632                 dev_dbg(dev, "\tBurst Count Static\n");
633         if (intfcaps & TPM_INTF_CMD_READY_INT)
634                 dev_dbg(dev, "\tCommand Ready Int Support\n");
635         if (intfcaps & TPM_INTF_INT_EDGE_FALLING)
636                 dev_dbg(dev, "\tInterrupt Edge Falling\n");
637         if (intfcaps & TPM_INTF_INT_EDGE_RISING)
638                 dev_dbg(dev, "\tInterrupt Edge Rising\n");
639         if (intfcaps & TPM_INTF_INT_LEVEL_LOW)
640                 dev_dbg(dev, "\tInterrupt Level Low\n");
641         if (intfcaps & TPM_INTF_INT_LEVEL_HIGH)
642                 dev_dbg(dev, "\tInterrupt Level High\n");
643         if (intfcaps & TPM_INTF_LOCALITY_CHANGE_INT)
644                 dev_dbg(dev, "\tLocality Change Int Support\n");
645         if (intfcaps & TPM_INTF_STS_VALID_INT)
646                 dev_dbg(dev, "\tSts Valid Int Support\n");
647         if (intfcaps & TPM_INTF_DATA_AVAIL_INT)
648                 dev_dbg(dev, "\tData Avail Int Support\n");
649
650         /* get the timeouts before testing for irqs */
651         tpm_get_timeouts(chip);
652
653         /* INTERRUPT Setup */
654         init_waitqueue_head(&chip->vendor.read_queue);
655         init_waitqueue_head(&chip->vendor.int_queue);
656
657         intmask =
658             ioread32(chip->vendor.iobase +
659                      TPM_INT_ENABLE(chip->vendor.locality));
660
661         intmask |= TPM_INTF_CMD_READY_INT
662             | TPM_INTF_LOCALITY_CHANGE_INT | TPM_INTF_DATA_AVAIL_INT
663             | TPM_INTF_STS_VALID_INT;
664
665         iowrite32(intmask,
666                   chip->vendor.iobase +
667                   TPM_INT_ENABLE(chip->vendor.locality));
668         if (interrupts)
669                 chip->vendor.irq = irq;
670         if (interrupts && !chip->vendor.irq) {
671                 irq_s =
672                     ioread8(chip->vendor.iobase +
673                             TPM_INT_VECTOR(chip->vendor.locality));
674                 if (irq_s) {
675                         irq_e = irq_s;
676                 } else {
677                         irq_s = 3;
678                         irq_e = 15;
679                 }
680
681                 for (i = irq_s; i <= irq_e && chip->vendor.irq == 0; i++) {
682                         iowrite8(i, chip->vendor.iobase +
683                                  TPM_INT_VECTOR(chip->vendor.locality));
684                         if (request_irq
685                             (i, tis_int_probe, IRQF_SHARED,
686                              chip->vendor.miscdev.name, chip) != 0) {
687                                 dev_info(chip->dev,
688                                          "Unable to request irq: %d for probe\n",
689                                          i);
690                                 continue;
691                         }
692
693                         /* Clear all existing */
694                         iowrite32(ioread32
695                                   (chip->vendor.iobase +
696                                    TPM_INT_STATUS(chip->vendor.locality)),
697                                   chip->vendor.iobase +
698                                   TPM_INT_STATUS(chip->vendor.locality));
699
700                         /* Turn on */
701                         iowrite32(intmask | TPM_GLOBAL_INT_ENABLE,
702                                   chip->vendor.iobase +
703                                   TPM_INT_ENABLE(chip->vendor.locality));
704
705                         chip->vendor.probed_irq = 0;
706
707                         /* Generate Interrupts */
708                         tpm_gen_interrupt(chip);
709
710                         chip->vendor.irq = chip->vendor.probed_irq;
711
712                         /* free_irq will call into tis_int_probe;
713                            clear all irqs we haven't seen while doing
714                            tpm_gen_interrupt */
715                         iowrite32(ioread32
716                                   (chip->vendor.iobase +
717                                    TPM_INT_STATUS(chip->vendor.locality)),
718                                   chip->vendor.iobase +
719                                   TPM_INT_STATUS(chip->vendor.locality));
720
721                         /* Turn off */
722                         iowrite32(intmask,
723                                   chip->vendor.iobase +
724                                   TPM_INT_ENABLE(chip->vendor.locality));
725                         free_irq(i, chip);
726                 }
727         }
728         if (chip->vendor.irq) {
729                 iowrite8(chip->vendor.irq,
730                          chip->vendor.iobase +
731                          TPM_INT_VECTOR(chip->vendor.locality));
732                 if (request_irq
733                     (chip->vendor.irq, tis_int_handler, IRQF_SHARED,
734                      chip->vendor.miscdev.name, chip) != 0) {
735                         dev_info(chip->dev,
736                                  "Unable to request irq: %d for use\n",
737                                  chip->vendor.irq);
738                         chip->vendor.irq = 0;
739                 } else {
740                         /* Clear all existing */
741                         iowrite32(ioread32
742                                   (chip->vendor.iobase +
743                                    TPM_INT_STATUS(chip->vendor.locality)),
744                                   chip->vendor.iobase +
745                                   TPM_INT_STATUS(chip->vendor.locality));
746
747                         /* Turn on */
748                         iowrite32(intmask | TPM_GLOBAL_INT_ENABLE,
749                                   chip->vendor.iobase +
750                                   TPM_INT_ENABLE(chip->vendor.locality));
751                 }
752         }
753
754         INIT_LIST_HEAD(&chip->vendor.list);
755         spin_lock(&tis_lock);
756         list_add(&chip->vendor.list, &tis_chips);
757         spin_unlock(&tis_lock);
758
759         tpm_continue_selftest(chip);
760
761         return 0;
762 out_err:
763         if (chip->vendor.iobase)
764                 iounmap(chip->vendor.iobase);
765         tpm_remove_hardware(chip->dev);
766         return rc;
767 }
768
769 static void tpm_tis_reenable_interrupts(struct tpm_chip *chip)
770 {
771         u32 intmask;
772
773         /* reenable interrupts that device may have lost or
774            BIOS/firmware may have disabled */
775         iowrite8(chip->vendor.irq, chip->vendor.iobase +
776                  TPM_INT_VECTOR(chip->vendor.locality));
777
778         intmask =
779             ioread32(chip->vendor.iobase +
780                      TPM_INT_ENABLE(chip->vendor.locality));
781
782         intmask |= TPM_INTF_CMD_READY_INT
783             | TPM_INTF_LOCALITY_CHANGE_INT | TPM_INTF_DATA_AVAIL_INT
784             | TPM_INTF_STS_VALID_INT | TPM_GLOBAL_INT_ENABLE;
785
786         iowrite32(intmask,
787                   chip->vendor.iobase + TPM_INT_ENABLE(chip->vendor.locality));
788 }
789
790
791 #ifdef CONFIG_PNP
792 static int __devinit tpm_tis_pnp_init(struct pnp_dev *pnp_dev,
793                                       const struct pnp_device_id *pnp_id)
794 {
795         resource_size_t start, len;
796         unsigned int irq = 0;
797
798         start = pnp_mem_start(pnp_dev, 0);
799         len = pnp_mem_len(pnp_dev, 0);
800
801         if (pnp_irq_valid(pnp_dev, 0))
802                 irq = pnp_irq(pnp_dev, 0);
803         else
804                 interrupts = 0;
805
806         if (is_itpm(pnp_dev))
807                 itpm = 1;
808
809         return tpm_tis_init(&pnp_dev->dev, start, len, irq);
810 }
811
812 static int tpm_tis_pnp_suspend(struct pnp_dev *dev, pm_message_t msg)
813 {
814         return tpm_pm_suspend(&dev->dev, msg);
815 }
816
817 static int tpm_tis_pnp_resume(struct pnp_dev *dev)
818 {
819         struct tpm_chip *chip = pnp_get_drvdata(dev);
820         int ret;
821
822         if (chip->vendor.irq)
823                 tpm_tis_reenable_interrupts(chip);
824
825         ret = tpm_pm_resume(&dev->dev);
826         if (!ret)
827                 tpm_continue_selftest(chip);
828
829         return ret;
830 }
831
832 static struct pnp_device_id tpm_pnp_tbl[] __devinitdata = {
833         {"PNP0C31", 0},         /* TPM */
834         {"ATM1200", 0},         /* Atmel */
835         {"IFX0102", 0},         /* Infineon */
836         {"BCM0101", 0},         /* Broadcom */
837         {"BCM0102", 0},         /* Broadcom */
838         {"NSC1200", 0},         /* National */
839         {"ICO0102", 0},         /* Intel */
840         /* Add new here */
841         {"", 0},                /* User Specified */
842         {"", 0}                 /* Terminator */
843 };
844 MODULE_DEVICE_TABLE(pnp, tpm_pnp_tbl);
845
846 static __devexit void tpm_tis_pnp_remove(struct pnp_dev *dev)
847 {
848         struct tpm_chip *chip = pnp_get_drvdata(dev);
849
850         tpm_dev_vendor_release(chip);
851
852         kfree(chip);
853 }
854
855
856 static struct pnp_driver tis_pnp_driver = {
857         .name = "tpm_tis",
858         .id_table = tpm_pnp_tbl,
859         .probe = tpm_tis_pnp_init,
860         .suspend = tpm_tis_pnp_suspend,
861         .resume = tpm_tis_pnp_resume,
862         .remove = tpm_tis_pnp_remove,
863 };
864
865 #define TIS_HID_USR_IDX sizeof(tpm_pnp_tbl)/sizeof(struct pnp_device_id) -2
866 module_param_string(hid, tpm_pnp_tbl[TIS_HID_USR_IDX].id,
867                     sizeof(tpm_pnp_tbl[TIS_HID_USR_IDX].id), 0444);
868 MODULE_PARM_DESC(hid, "Set additional specific HID for this driver to probe");
869 #endif
870 static int tpm_tis_suspend(struct platform_device *dev, pm_message_t msg)
871 {
872         return tpm_pm_suspend(&dev->dev, msg);
873 }
874
875 static int tpm_tis_resume(struct platform_device *dev)
876 {
877         struct tpm_chip *chip = dev_get_drvdata(&dev->dev);
878
879         if (chip->vendor.irq)
880                 tpm_tis_reenable_interrupts(chip);
881
882         return tpm_pm_resume(&dev->dev);
883 }
884 static struct platform_driver tis_drv = {
885         .driver = {
886                 .name = "tpm_tis",
887                 .owner          = THIS_MODULE,
888         },
889         .suspend = tpm_tis_suspend,
890         .resume = tpm_tis_resume,
891 };
892
893 static struct platform_device *pdev;
894
895 static int force;
896 module_param(force, bool, 0444);
897 MODULE_PARM_DESC(force, "Force device probe rather than using ACPI entry");
898 static int __init init_tis(void)
899 {
900         int rc;
901 #ifdef CONFIG_PNP
902         if (!force)
903                 return pnp_register_driver(&tis_pnp_driver);
904 #endif
905
906         rc = platform_driver_register(&tis_drv);
907         if (rc < 0)
908                 return rc;
909         if (IS_ERR(pdev=platform_device_register_simple("tpm_tis", -1, NULL, 0)))
910                 return PTR_ERR(pdev);
911         if((rc=tpm_tis_init(&pdev->dev, TIS_MEM_BASE, TIS_MEM_LEN, 0)) != 0) {
912                 platform_device_unregister(pdev);
913                 platform_driver_unregister(&tis_drv);
914         }
915         return rc;
916 }
917
918 static void __exit cleanup_tis(void)
919 {
920         struct tpm_vendor_specific *i, *j;
921         struct tpm_chip *chip;
922         spin_lock(&tis_lock);
923         list_for_each_entry_safe(i, j, &tis_chips, list) {
924                 chip = to_tpm_chip(i);
925                 tpm_remove_hardware(chip->dev);
926                 iowrite32(~TPM_GLOBAL_INT_ENABLE &
927                           ioread32(chip->vendor.iobase +
928                                    TPM_INT_ENABLE(chip->vendor.
929                                                   locality)),
930                           chip->vendor.iobase +
931                           TPM_INT_ENABLE(chip->vendor.locality));
932                 release_locality(chip, chip->vendor.locality, 1);
933                 if (chip->vendor.irq)
934                         free_irq(chip->vendor.irq, chip);
935                 iounmap(i->iobase);
936                 list_del(&i->list);
937         }
938         spin_unlock(&tis_lock);
939 #ifdef CONFIG_PNP
940         if (!force) {
941                 pnp_unregister_driver(&tis_pnp_driver);
942                 return;
943         }
944 #endif
945         platform_device_unregister(pdev);
946         platform_driver_unregister(&tis_drv);
947 }
948
949 module_init(init_tis);
950 module_exit(cleanup_tis);
951 MODULE_AUTHOR("Leendert van Doorn (leendert@watson.ibm.com)");
952 MODULE_DESCRIPTION("TPM Driver");
953 MODULE_VERSION("2.0");
954 MODULE_LICENSE("GPL");