tpm_crb: fix mapping of the buffers

[cascardo/linux.git] / drivers / char / tpm / tpm_crb.c

diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c
index a12b319..5afe684 100644 (file)
--- a/drivers/char/tpm/tpm_crb.c
+++ b/drivers/char/tpm/tpm_crb.c
@@ -77,7 +77,6 @@ enum crb_flags {
 
 struct crb_priv {
        unsigned int flags;
-       struct resource res;
        void __iomem *iobase;
        struct crb_control_area __iomem *cca;
        u8 __iomem *cmd;
@@ -224,19 +223,19 @@ static int crb_init(struct acpi_device *device, struct crb_priv *priv)
 
 static int crb_check_resource(struct acpi_resource *ares, void *data)
 {
-       struct crb_priv *priv = data;
+       struct resource *io_res = data;
        struct resource res;
 
        if (acpi_dev_resource_memory(ares, &res)) {
-               priv->res = res;
-               priv->res.name = NULL;
+               *io_res = res;
+               io_res->name = NULL;
        }
 
        return 1;
 }
 
 static void __iomem *crb_map_res(struct device *dev, struct crb_priv *priv,
-                                u64 start, u32 size)
+                                struct resource *io_res, u64 start, u32 size)
 {
        struct resource new_res = {
                .start  = start,
@@ -248,51 +247,72 @@ static void __iomem *crb_map_res(struct device *dev, struct crb_priv *priv,
        if (start != new_res.start)
                return ERR_PTR(-EINVAL);
 
-       if (!resource_contains(&priv->res, &new_res))
+       if (!resource_contains(io_res, &new_res))
                return devm_ioremap_resource(dev, &new_res);
 
-       return priv->iobase + (new_res.start - priv->res.start);
+       return priv->iobase + (new_res.start - io_res->start);
 }
 
 static int crb_map_io(struct acpi_device *device, struct crb_priv *priv,
                      struct acpi_table_tpm2 *buf)
 {
        struct list_head resources;
+       struct resource io_res;
        struct device *dev = &device->dev;
-       u64 pa;
+       u64 cmd_pa;
+       u32 cmd_size;
+       u64 rsp_pa;
+       u32 rsp_size;
        int ret;
 
        INIT_LIST_HEAD(&resources);
        ret = acpi_dev_get_resources(device, &resources, crb_check_resource,
-                                    priv);
+                                    &io_res);
        if (ret < 0)
                return ret;
        acpi_dev_free_resource_list(&resources);
 
-       if (resource_type(&priv->res) != IORESOURCE_MEM) {
+       if (resource_type(&io_res) != IORESOURCE_MEM) {
                dev_err(dev,
                        FW_BUG "TPM2 ACPI table does not define a memory resource\n");
                return -EINVAL;
        }
 
-       priv->iobase = devm_ioremap_resource(dev, &priv->res);
+       priv->iobase = devm_ioremap_resource(dev, &io_res);
        if (IS_ERR(priv->iobase))
                return PTR_ERR(priv->iobase);
 
-       priv->cca = crb_map_res(dev, priv, buf->control_address, 0x1000);
+       priv->cca = crb_map_res(dev, priv, &io_res, buf->control_address,
+                               sizeof(struct crb_control_area));
        if (IS_ERR(priv->cca))
                return PTR_ERR(priv->cca);
 
-       pa = ((u64) ioread32(&priv->cca->cmd_pa_high) << 32) |
-             (u64) ioread32(&priv->cca->cmd_pa_low);
-       priv->cmd = crb_map_res(dev, priv, pa, ioread32(&priv->cca->cmd_size));
+       cmd_pa = ((u64) ioread32(&priv->cca->cmd_pa_high) << 32) |
+                 (u64) ioread32(&priv->cca->cmd_pa_low);
+       cmd_size = ioread32(&priv->cca->cmd_size);
+       priv->cmd = crb_map_res(dev, priv, &io_res, cmd_pa, cmd_size);
        if (IS_ERR(priv->cmd))
                return PTR_ERR(priv->cmd);
 
-       memcpy_fromio(&pa, &priv->cca->rsp_pa, 8);
-       pa = le64_to_cpu(pa);
-       priv->rsp = crb_map_res(dev, priv, pa, ioread32(&priv->cca->rsp_size));
-       return PTR_ERR_OR_ZERO(priv->rsp);
+       memcpy_fromio(&rsp_pa, &priv->cca->rsp_pa, 8);
+       rsp_pa = le64_to_cpu(rsp_pa);
+       rsp_size = ioread32(&priv->cca->rsp_size);
+
+       if (cmd_pa != rsp_pa) {
+               priv->rsp = crb_map_res(dev, priv, &io_res, rsp_pa, rsp_size);
+               return PTR_ERR_OR_ZERO(priv->rsp);
+       }
+
+       /* According to the PTP specification, overlapping command and response
+        * buffer sizes must be identical.
+        */
+       if (cmd_size != rsp_size) {
+               dev_err(dev, FW_BUG "overlapping command and response buffer sizes are not identical");
+               return -EINVAL;
+       }
+
+       priv->rsp = priv->cmd;
+       return 0;
 }
 
 static int crb_acpi_add(struct acpi_device *device)
@@ -344,9 +364,6 @@ static int crb_acpi_remove(struct acpi_device *device)
        struct device *dev = &device->dev;
        struct tpm_chip *chip = dev_get_drvdata(dev);
 
-       if (chip->flags & TPM_CHIP_FLAG_TPM2)
-               tpm2_shutdown(chip, TPM2_SU_CLEAR);
-
        tpm_chip_unregister(chip);
 
        return 0;