xref: /openbmc/linux/drivers/char/tpm/tpm_crb.c (revision b830f94f)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * Copyright (C) 2014 Intel Corporation
4  *
5  * Authors:
6  * Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
7  *
8  * Maintained by: <tpmdd-devel@lists.sourceforge.net>
9  *
10  * This device driver implements the TPM interface as defined in
11  * the TCG CRB 2.0 TPM specification.
12  */
13 
14 #include <linux/acpi.h>
15 #include <linux/highmem.h>
16 #include <linux/rculist.h>
17 #include <linux/module.h>
18 #include <linux/pm_runtime.h>
19 #ifdef CONFIG_ARM64
20 #include <linux/arm-smccc.h>
21 #endif
22 #include "tpm.h"
23 
24 #define ACPI_SIG_TPM2 "TPM2"
25 
26 static const guid_t crb_acpi_start_guid =
27 	GUID_INIT(0x6BBF6CAB, 0x5463, 0x4714,
28 		  0xB7, 0xCD, 0xF0, 0x20, 0x3C, 0x03, 0x68, 0xD4);
29 
30 enum crb_defaults {
31 	CRB_ACPI_START_REVISION_ID = 1,
32 	CRB_ACPI_START_INDEX = 1,
33 };
34 
35 enum crb_loc_ctrl {
36 	CRB_LOC_CTRL_REQUEST_ACCESS	= BIT(0),
37 	CRB_LOC_CTRL_RELINQUISH		= BIT(1),
38 };
39 
40 enum crb_loc_state {
41 	CRB_LOC_STATE_LOC_ASSIGNED	= BIT(1),
42 	CRB_LOC_STATE_TPM_REG_VALID_STS	= BIT(7),
43 };
44 
45 enum crb_ctrl_req {
46 	CRB_CTRL_REQ_CMD_READY	= BIT(0),
47 	CRB_CTRL_REQ_GO_IDLE	= BIT(1),
48 };
49 
50 enum crb_ctrl_sts {
51 	CRB_CTRL_STS_ERROR	= BIT(0),
52 	CRB_CTRL_STS_TPM_IDLE	= BIT(1),
53 };
54 
55 enum crb_start {
56 	CRB_START_INVOKE	= BIT(0),
57 };
58 
59 enum crb_cancel {
60 	CRB_CANCEL_INVOKE	= BIT(0),
61 };
62 
63 struct crb_regs_head {
64 	u32 loc_state;
65 	u32 reserved1;
66 	u32 loc_ctrl;
67 	u32 loc_sts;
68 	u8 reserved2[32];
69 	u64 intf_id;
70 	u64 ctrl_ext;
71 } __packed;
72 
73 struct crb_regs_tail {
74 	u32 ctrl_req;
75 	u32 ctrl_sts;
76 	u32 ctrl_cancel;
77 	u32 ctrl_start;
78 	u32 ctrl_int_enable;
79 	u32 ctrl_int_sts;
80 	u32 ctrl_cmd_size;
81 	u32 ctrl_cmd_pa_low;
82 	u32 ctrl_cmd_pa_high;
83 	u32 ctrl_rsp_size;
84 	u64 ctrl_rsp_pa;
85 } __packed;
86 
87 enum crb_status {
88 	CRB_DRV_STS_COMPLETE	= BIT(0),
89 };
90 
91 struct crb_priv {
92 	u32 sm;
93 	const char *hid;
94 	void __iomem *iobase;
95 	struct crb_regs_head __iomem *regs_h;
96 	struct crb_regs_tail __iomem *regs_t;
97 	u8 __iomem *cmd;
98 	u8 __iomem *rsp;
99 	u32 cmd_size;
100 	u32 smc_func_id;
101 };
102 
103 struct tpm2_crb_smc {
104 	u32 interrupt;
105 	u8 interrupt_flags;
106 	u8 op_flags;
107 	u16 reserved2;
108 	u32 smc_func_id;
109 };
110 
111 static bool crb_wait_for_reg_32(u32 __iomem *reg, u32 mask, u32 value,
112 				unsigned long timeout)
113 {
114 	ktime_t start;
115 	ktime_t stop;
116 
117 	start = ktime_get();
118 	stop = ktime_add(start, ms_to_ktime(timeout));
119 
120 	do {
121 		if ((ioread32(reg) & mask) == value)
122 			return true;
123 
124 		usleep_range(50, 100);
125 	} while (ktime_before(ktime_get(), stop));
126 
127 	return ((ioread32(reg) & mask) == value);
128 }
129 
130 /**
131  * __crb_go_idle - request tpm crb device to go the idle state
132  *
133  * @dev:  crb device
134  * @priv: crb private data
135  *
136  * Write CRB_CTRL_REQ_GO_IDLE to TPM_CRB_CTRL_REQ
137  * The device should respond within TIMEOUT_C by clearing the bit.
138  * Anyhow, we do not wait here as a consequent CMD_READY request
139  * will be handled correctly even if idle was not completed.
140  *
141  * The function does nothing for devices with ACPI-start method
142  * or SMC-start method.
143  *
144  * Return: 0 always
145  */
146 static int __crb_go_idle(struct device *dev, struct crb_priv *priv)
147 {
148 	if ((priv->sm == ACPI_TPM2_START_METHOD) ||
149 	    (priv->sm == ACPI_TPM2_COMMAND_BUFFER_WITH_START_METHOD) ||
150 	    (priv->sm == ACPI_TPM2_COMMAND_BUFFER_WITH_ARM_SMC))
151 		return 0;
152 
153 	iowrite32(CRB_CTRL_REQ_GO_IDLE, &priv->regs_t->ctrl_req);
154 
155 	if (!crb_wait_for_reg_32(&priv->regs_t->ctrl_req,
156 				 CRB_CTRL_REQ_GO_IDLE/* mask */,
157 				 0, /* value */
158 				 TPM2_TIMEOUT_C)) {
159 		dev_warn(dev, "goIdle timed out\n");
160 		return -ETIME;
161 	}
162 
163 	return 0;
164 }
165 
166 static int crb_go_idle(struct tpm_chip *chip)
167 {
168 	struct device *dev = &chip->dev;
169 	struct crb_priv *priv = dev_get_drvdata(dev);
170 
171 	return __crb_go_idle(dev, priv);
172 }
173 
174 /**
175  * __crb_cmd_ready - request tpm crb device to enter ready state
176  *
177  * @dev:  crb device
178  * @priv: crb private data
179  *
180  * Write CRB_CTRL_REQ_CMD_READY to TPM_CRB_CTRL_REQ
181  * and poll till the device acknowledge it by clearing the bit.
182  * The device should respond within TIMEOUT_C.
183  *
184  * The function does nothing for devices with ACPI-start method
185  * or SMC-start method.
186  *
187  * Return: 0 on success -ETIME on timeout;
188  */
189 static int __crb_cmd_ready(struct device *dev, struct crb_priv *priv)
190 {
191 	if ((priv->sm == ACPI_TPM2_START_METHOD) ||
192 	    (priv->sm == ACPI_TPM2_COMMAND_BUFFER_WITH_START_METHOD) ||
193 	    (priv->sm == ACPI_TPM2_COMMAND_BUFFER_WITH_ARM_SMC))
194 		return 0;
195 
196 	iowrite32(CRB_CTRL_REQ_CMD_READY, &priv->regs_t->ctrl_req);
197 	if (!crb_wait_for_reg_32(&priv->regs_t->ctrl_req,
198 				 CRB_CTRL_REQ_CMD_READY /* mask */,
199 				 0, /* value */
200 				 TPM2_TIMEOUT_C)) {
201 		dev_warn(dev, "cmdReady timed out\n");
202 		return -ETIME;
203 	}
204 
205 	return 0;
206 }
207 
208 static int crb_cmd_ready(struct tpm_chip *chip)
209 {
210 	struct device *dev = &chip->dev;
211 	struct crb_priv *priv = dev_get_drvdata(dev);
212 
213 	return __crb_cmd_ready(dev, priv);
214 }
215 
216 static int __crb_request_locality(struct device *dev,
217 				  struct crb_priv *priv, int loc)
218 {
219 	u32 value = CRB_LOC_STATE_LOC_ASSIGNED |
220 		    CRB_LOC_STATE_TPM_REG_VALID_STS;
221 
222 	if (!priv->regs_h)
223 		return 0;
224 
225 	iowrite32(CRB_LOC_CTRL_REQUEST_ACCESS, &priv->regs_h->loc_ctrl);
226 	if (!crb_wait_for_reg_32(&priv->regs_h->loc_state, value, value,
227 				 TPM2_TIMEOUT_C)) {
228 		dev_warn(dev, "TPM_LOC_STATE_x.requestAccess timed out\n");
229 		return -ETIME;
230 	}
231 
232 	return 0;
233 }
234 
235 static int crb_request_locality(struct tpm_chip *chip, int loc)
236 {
237 	struct crb_priv *priv = dev_get_drvdata(&chip->dev);
238 
239 	return __crb_request_locality(&chip->dev, priv, loc);
240 }
241 
242 static int __crb_relinquish_locality(struct device *dev,
243 				     struct crb_priv *priv, int loc)
244 {
245 	u32 mask = CRB_LOC_STATE_LOC_ASSIGNED |
246 		   CRB_LOC_STATE_TPM_REG_VALID_STS;
247 	u32 value = CRB_LOC_STATE_TPM_REG_VALID_STS;
248 
249 	if (!priv->regs_h)
250 		return 0;
251 
252 	iowrite32(CRB_LOC_CTRL_RELINQUISH, &priv->regs_h->loc_ctrl);
253 	if (!crb_wait_for_reg_32(&priv->regs_h->loc_state, mask, value,
254 				 TPM2_TIMEOUT_C)) {
255 		dev_warn(dev, "TPM_LOC_STATE_x.requestAccess timed out\n");
256 		return -ETIME;
257 	}
258 
259 	return 0;
260 }
261 
262 static int crb_relinquish_locality(struct tpm_chip *chip, int loc)
263 {
264 	struct crb_priv *priv = dev_get_drvdata(&chip->dev);
265 
266 	return __crb_relinquish_locality(&chip->dev, priv, loc);
267 }
268 
269 static u8 crb_status(struct tpm_chip *chip)
270 {
271 	struct crb_priv *priv = dev_get_drvdata(&chip->dev);
272 	u8 sts = 0;
273 
274 	if ((ioread32(&priv->regs_t->ctrl_start) & CRB_START_INVOKE) !=
275 	    CRB_START_INVOKE)
276 		sts |= CRB_DRV_STS_COMPLETE;
277 
278 	return sts;
279 }
280 
281 static int crb_recv(struct tpm_chip *chip, u8 *buf, size_t count)
282 {
283 	struct crb_priv *priv = dev_get_drvdata(&chip->dev);
284 	unsigned int expected;
285 
286 	/* A sanity check that the upper layer wants to get at least the header
287 	 * as that is the minimum size for any TPM response.
288 	 */
289 	if (count < TPM_HEADER_SIZE)
290 		return -EIO;
291 
292 	/* If this bit is set, according to the spec, the TPM is in
293 	 * unrecoverable condition.
294 	 */
295 	if (ioread32(&priv->regs_t->ctrl_sts) & CRB_CTRL_STS_ERROR)
296 		return -EIO;
297 
298 	/* Read the first 8 bytes in order to get the length of the response.
299 	 * We read exactly a quad word in order to make sure that the remaining
300 	 * reads will be aligned.
301 	 */
302 	memcpy_fromio(buf, priv->rsp, 8);
303 
304 	expected = be32_to_cpup((__be32 *)&buf[2]);
305 	if (expected > count || expected < TPM_HEADER_SIZE)
306 		return -EIO;
307 
308 	memcpy_fromio(&buf[8], &priv->rsp[8], expected - 8);
309 
310 	return expected;
311 }
312 
313 static int crb_do_acpi_start(struct tpm_chip *chip)
314 {
315 	union acpi_object *obj;
316 	int rc;
317 
318 	obj = acpi_evaluate_dsm(chip->acpi_dev_handle,
319 				&crb_acpi_start_guid,
320 				CRB_ACPI_START_REVISION_ID,
321 				CRB_ACPI_START_INDEX,
322 				NULL);
323 	if (!obj)
324 		return -ENXIO;
325 	rc = obj->integer.value == 0 ? 0 : -ENXIO;
326 	ACPI_FREE(obj);
327 	return rc;
328 }
329 
330 #ifdef CONFIG_ARM64
331 /*
332  * This is a TPM Command Response Buffer start method that invokes a
333  * Secure Monitor Call to requrest the firmware to execute or cancel
334  * a TPM 2.0 command.
335  */
336 static int tpm_crb_smc_start(struct device *dev, unsigned long func_id)
337 {
338 	struct arm_smccc_res res;
339 
340 	arm_smccc_smc(func_id, 0, 0, 0, 0, 0, 0, 0, &res);
341 	if (res.a0 != 0) {
342 		dev_err(dev,
343 			FW_BUG "tpm_crb_smc_start() returns res.a0 = 0x%lx\n",
344 			res.a0);
345 		return -EIO;
346 	}
347 
348 	return 0;
349 }
350 #else
351 static int tpm_crb_smc_start(struct device *dev, unsigned long func_id)
352 {
353 	dev_err(dev, FW_BUG "tpm_crb: incorrect start method\n");
354 	return -EINVAL;
355 }
356 #endif
357 
358 static int crb_send(struct tpm_chip *chip, u8 *buf, size_t len)
359 {
360 	struct crb_priv *priv = dev_get_drvdata(&chip->dev);
361 	int rc = 0;
362 
363 	/* Zero the cancel register so that the next command will not get
364 	 * canceled.
365 	 */
366 	iowrite32(0, &priv->regs_t->ctrl_cancel);
367 
368 	if (len > priv->cmd_size) {
369 		dev_err(&chip->dev, "invalid command count value %zd %d\n",
370 			len, priv->cmd_size);
371 		return -E2BIG;
372 	}
373 
374 	memcpy_toio(priv->cmd, buf, len);
375 
376 	/* Make sure that cmd is populated before issuing start. */
377 	wmb();
378 
379 	/* The reason for the extra quirk is that the PTT in 4th Gen Core CPUs
380 	 * report only ACPI start but in practice seems to require both
381 	 * CRB start, hence invoking CRB start method if hid == MSFT0101.
382 	 */
383 	if ((priv->sm == ACPI_TPM2_COMMAND_BUFFER) ||
384 	    (priv->sm == ACPI_TPM2_MEMORY_MAPPED) ||
385 	    (!strcmp(priv->hid, "MSFT0101")))
386 		iowrite32(CRB_START_INVOKE, &priv->regs_t->ctrl_start);
387 
388 	if ((priv->sm == ACPI_TPM2_START_METHOD) ||
389 	    (priv->sm == ACPI_TPM2_COMMAND_BUFFER_WITH_START_METHOD))
390 		rc = crb_do_acpi_start(chip);
391 
392 	if (priv->sm == ACPI_TPM2_COMMAND_BUFFER_WITH_ARM_SMC) {
393 		iowrite32(CRB_START_INVOKE, &priv->regs_t->ctrl_start);
394 		rc = tpm_crb_smc_start(&chip->dev, priv->smc_func_id);
395 	}
396 
397 	return rc;
398 }
399 
400 static void crb_cancel(struct tpm_chip *chip)
401 {
402 	struct crb_priv *priv = dev_get_drvdata(&chip->dev);
403 
404 	iowrite32(CRB_CANCEL_INVOKE, &priv->regs_t->ctrl_cancel);
405 
406 	if (((priv->sm == ACPI_TPM2_START_METHOD) ||
407 	    (priv->sm == ACPI_TPM2_COMMAND_BUFFER_WITH_START_METHOD)) &&
408 	     crb_do_acpi_start(chip))
409 		dev_err(&chip->dev, "ACPI Start failed\n");
410 }
411 
412 static bool crb_req_canceled(struct tpm_chip *chip, u8 status)
413 {
414 	struct crb_priv *priv = dev_get_drvdata(&chip->dev);
415 	u32 cancel = ioread32(&priv->regs_t->ctrl_cancel);
416 
417 	return (cancel & CRB_CANCEL_INVOKE) == CRB_CANCEL_INVOKE;
418 }
419 
420 static const struct tpm_class_ops tpm_crb = {
421 	.flags = TPM_OPS_AUTO_STARTUP,
422 	.status = crb_status,
423 	.recv = crb_recv,
424 	.send = crb_send,
425 	.cancel = crb_cancel,
426 	.req_canceled = crb_req_canceled,
427 	.go_idle  = crb_go_idle,
428 	.cmd_ready = crb_cmd_ready,
429 	.request_locality = crb_request_locality,
430 	.relinquish_locality = crb_relinquish_locality,
431 	.req_complete_mask = CRB_DRV_STS_COMPLETE,
432 	.req_complete_val = CRB_DRV_STS_COMPLETE,
433 };
434 
435 static int crb_check_resource(struct acpi_resource *ares, void *data)
436 {
437 	struct resource *io_res = data;
438 	struct resource_win win;
439 	struct resource *res = &(win.res);
440 
441 	if (acpi_dev_resource_memory(ares, res) ||
442 	    acpi_dev_resource_address_space(ares, &win)) {
443 		*io_res = *res;
444 		io_res->name = NULL;
445 	}
446 
447 	return 1;
448 }
449 
450 static void __iomem *crb_map_res(struct device *dev, struct crb_priv *priv,
451 				 struct resource *io_res, u64 start, u32 size)
452 {
453 	struct resource new_res = {
454 		.start	= start,
455 		.end	= start + size - 1,
456 		.flags	= IORESOURCE_MEM,
457 	};
458 
459 	/* Detect a 64 bit address on a 32 bit system */
460 	if (start != new_res.start)
461 		return (void __iomem *) ERR_PTR(-EINVAL);
462 
463 	if (!resource_contains(io_res, &new_res))
464 		return devm_ioremap_resource(dev, &new_res);
465 
466 	return priv->iobase + (new_res.start - io_res->start);
467 }
468 
469 /*
470  * Work around broken BIOSs that return inconsistent values from the ACPI
471  * region vs the registers. Trust the ACPI region. Such broken systems
472  * probably cannot send large TPM commands since the buffer will be truncated.
473  */
474 static u64 crb_fixup_cmd_size(struct device *dev, struct resource *io_res,
475 			      u64 start, u64 size)
476 {
477 	if (io_res->start > start || io_res->end < start)
478 		return size;
479 
480 	if (start + size - 1 <= io_res->end)
481 		return size;
482 
483 	dev_err(dev,
484 		FW_BUG "ACPI region does not cover the entire command/response buffer. %pr vs %llx %llx\n",
485 		io_res, start, size);
486 
487 	return io_res->end - start + 1;
488 }
489 
490 static int crb_map_io(struct acpi_device *device, struct crb_priv *priv,
491 		      struct acpi_table_tpm2 *buf)
492 {
493 	struct list_head resources;
494 	struct resource io_res;
495 	struct device *dev = &device->dev;
496 	u32 pa_high, pa_low;
497 	u64 cmd_pa;
498 	u32 cmd_size;
499 	__le64 __rsp_pa;
500 	u64 rsp_pa;
501 	u32 rsp_size;
502 	int ret;
503 
504 	INIT_LIST_HEAD(&resources);
505 	ret = acpi_dev_get_resources(device, &resources, crb_check_resource,
506 				     &io_res);
507 	if (ret < 0)
508 		return ret;
509 	acpi_dev_free_resource_list(&resources);
510 
511 	if (resource_type(&io_res) != IORESOURCE_MEM) {
512 		dev_err(dev, FW_BUG "TPM2 ACPI table does not define a memory resource\n");
513 		return -EINVAL;
514 	}
515 
516 	priv->iobase = devm_ioremap_resource(dev, &io_res);
517 	if (IS_ERR(priv->iobase))
518 		return PTR_ERR(priv->iobase);
519 
520 	/* The ACPI IO region starts at the head area and continues to include
521 	 * the control area, as one nice sane region except for some older
522 	 * stuff that puts the control area outside the ACPI IO region.
523 	 */
524 	if ((priv->sm == ACPI_TPM2_COMMAND_BUFFER) ||
525 	    (priv->sm == ACPI_TPM2_MEMORY_MAPPED)) {
526 		if (buf->control_address == io_res.start +
527 		    sizeof(*priv->regs_h))
528 			priv->regs_h = priv->iobase;
529 		else
530 			dev_warn(dev, FW_BUG "Bad ACPI memory layout");
531 	}
532 
533 	ret = __crb_request_locality(dev, priv, 0);
534 	if (ret)
535 		return ret;
536 
537 	priv->regs_t = crb_map_res(dev, priv, &io_res, buf->control_address,
538 				   sizeof(struct crb_regs_tail));
539 	if (IS_ERR(priv->regs_t)) {
540 		ret = PTR_ERR(priv->regs_t);
541 		goto out_relinquish_locality;
542 	}
543 
544 	/*
545 	 * PTT HW bug w/a: wake up the device to access
546 	 * possibly not retained registers.
547 	 */
548 	ret = __crb_cmd_ready(dev, priv);
549 	if (ret)
550 		goto out_relinquish_locality;
551 
552 	pa_high = ioread32(&priv->regs_t->ctrl_cmd_pa_high);
553 	pa_low  = ioread32(&priv->regs_t->ctrl_cmd_pa_low);
554 	cmd_pa = ((u64)pa_high << 32) | pa_low;
555 	cmd_size = crb_fixup_cmd_size(dev, &io_res, cmd_pa,
556 				      ioread32(&priv->regs_t->ctrl_cmd_size));
557 
558 	dev_dbg(dev, "cmd_hi = %X cmd_low = %X cmd_size %X\n",
559 		pa_high, pa_low, cmd_size);
560 
561 	priv->cmd = crb_map_res(dev, priv, &io_res, cmd_pa, cmd_size);
562 	if (IS_ERR(priv->cmd)) {
563 		ret = PTR_ERR(priv->cmd);
564 		goto out;
565 	}
566 
567 	memcpy_fromio(&__rsp_pa, &priv->regs_t->ctrl_rsp_pa, 8);
568 	rsp_pa = le64_to_cpu(__rsp_pa);
569 	rsp_size = crb_fixup_cmd_size(dev, &io_res, rsp_pa,
570 				      ioread32(&priv->regs_t->ctrl_rsp_size));
571 
572 	if (cmd_pa != rsp_pa) {
573 		priv->rsp = crb_map_res(dev, priv, &io_res, rsp_pa, rsp_size);
574 		ret = PTR_ERR_OR_ZERO(priv->rsp);
575 		goto out;
576 	}
577 
578 	/* According to the PTP specification, overlapping command and response
579 	 * buffer sizes must be identical.
580 	 */
581 	if (cmd_size != rsp_size) {
582 		dev_err(dev, FW_BUG "overlapping command and response buffer sizes are not identical");
583 		ret = -EINVAL;
584 		goto out;
585 	}
586 
587 	priv->rsp = priv->cmd;
588 
589 out:
590 	if (!ret)
591 		priv->cmd_size = cmd_size;
592 
593 	__crb_go_idle(dev, priv);
594 
595 out_relinquish_locality:
596 
597 	__crb_relinquish_locality(dev, priv, 0);
598 
599 	return ret;
600 }
601 
602 static int crb_acpi_add(struct acpi_device *device)
603 {
604 	struct acpi_table_tpm2 *buf;
605 	struct crb_priv *priv;
606 	struct tpm_chip *chip;
607 	struct device *dev = &device->dev;
608 	struct tpm2_crb_smc *crb_smc;
609 	acpi_status status;
610 	u32 sm;
611 	int rc;
612 
613 	status = acpi_get_table(ACPI_SIG_TPM2, 1,
614 				(struct acpi_table_header **) &buf);
615 	if (ACPI_FAILURE(status) || buf->header.length < sizeof(*buf)) {
616 		dev_err(dev, FW_BUG "failed to get TPM2 ACPI table\n");
617 		return -EINVAL;
618 	}
619 
620 	/* Should the FIFO driver handle this? */
621 	sm = buf->start_method;
622 	if (sm == ACPI_TPM2_MEMORY_MAPPED)
623 		return -ENODEV;
624 
625 	priv = devm_kzalloc(dev, sizeof(struct crb_priv), GFP_KERNEL);
626 	if (!priv)
627 		return -ENOMEM;
628 
629 	if (sm == ACPI_TPM2_COMMAND_BUFFER_WITH_ARM_SMC) {
630 		if (buf->header.length < (sizeof(*buf) + sizeof(*crb_smc))) {
631 			dev_err(dev,
632 				FW_BUG "TPM2 ACPI table has wrong size %u for start method type %d\n",
633 				buf->header.length,
634 				ACPI_TPM2_COMMAND_BUFFER_WITH_ARM_SMC);
635 			return -EINVAL;
636 		}
637 		crb_smc = ACPI_ADD_PTR(struct tpm2_crb_smc, buf, sizeof(*buf));
638 		priv->smc_func_id = crb_smc->smc_func_id;
639 	}
640 
641 	priv->sm = sm;
642 	priv->hid = acpi_device_hid(device);
643 
644 	rc = crb_map_io(device, priv, buf);
645 	if (rc)
646 		return rc;
647 
648 	chip = tpmm_chip_alloc(dev, &tpm_crb);
649 	if (IS_ERR(chip))
650 		return PTR_ERR(chip);
651 
652 	dev_set_drvdata(&chip->dev, priv);
653 	chip->acpi_dev_handle = device->handle;
654 	chip->flags = TPM_CHIP_FLAG_TPM2;
655 
656 	return tpm_chip_register(chip);
657 }
658 
659 static int crb_acpi_remove(struct acpi_device *device)
660 {
661 	struct device *dev = &device->dev;
662 	struct tpm_chip *chip = dev_get_drvdata(dev);
663 
664 	tpm_chip_unregister(chip);
665 
666 	return 0;
667 }
668 
669 static const struct dev_pm_ops crb_pm = {
670 	SET_SYSTEM_SLEEP_PM_OPS(tpm_pm_suspend, tpm_pm_resume)
671 };
672 
673 static const struct acpi_device_id crb_device_ids[] = {
674 	{"MSFT0101", 0},
675 	{"", 0},
676 };
677 MODULE_DEVICE_TABLE(acpi, crb_device_ids);
678 
679 static struct acpi_driver crb_acpi_driver = {
680 	.name = "tpm_crb",
681 	.ids = crb_device_ids,
682 	.ops = {
683 		.add = crb_acpi_add,
684 		.remove = crb_acpi_remove,
685 	},
686 	.drv = {
687 		.pm = &crb_pm,
688 	},
689 };
690 
691 module_acpi_driver(crb_acpi_driver);
692 MODULE_AUTHOR("Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>");
693 MODULE_DESCRIPTION("TPM2 Driver");
694 MODULE_VERSION("0.1");
695 MODULE_LICENSE("GPL");
696