1/*
2 * Copyright (c) 2008, 2009 Michael Shalayeff
3 * Copyright (c) 2009, 2010 Hans-Joerg Hoexer
4 * All rights reserved.
5 *
6 * Permission to use, copy, modify, and distribute this software for any
7 * purpose with or without fee is hereby granted, provided that the above
8 * copyright notice and this permission notice appear in all copies.
9 *
10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14 * WHATSOEVER RESULTING FROM LOSS OF MIND, USE, DATA OR PROFITS, WHETHER IN
15 * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
16 * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17 */
18
19/* #define	TPM_DEBUG */
20
21#include <sys/cdefs.h>
22__FBSDID("$FreeBSD$");
23
24#include <sys/param.h>
25#include <sys/systm.h>
26#include <sys/kernel.h>
27#include <sys/malloc.h>
28#include <sys/proc.h>
29
30#ifdef __FreeBSD__
31#include <sys/module.h>
32#include <sys/conf.h>
33#include <sys/uio.h>
34#include <sys/bus.h>
35
36#include <machine/bus.h>
37#include <sys/rman.h>
38#include <machine/resource.h>
39
40#include <machine/md_var.h>
41
42#include <isa/isareg.h>
43#include <isa/isavar.h>
44#else
45#include <sys/device.h>
46
47#include <machine/cpu.h>
48#include <machine/bus.h>
49#include <machine/intr.h>
50#include <machine/conf.h>
51
52#include <dev/isa/isareg.h>
53#include <dev/isa/isavar.h>
54#endif
55#include <dev/tpm/tpmvar.h>
56
57#ifndef __FreeBSD__
58/* XXX horrible hack for tcsd (-lpthread) workaround on OpenBSD */
59#undef PCATCH
60#define PCATCH	0
61#endif
62
63#define	TPM_BUFSIZ	1024
64
65#define TPM_HDRSIZE	10
66
67#define TPM_PARAM_SIZE	0x0001
68
69#ifdef __FreeBSD__
70#define IRQUNK	-1
71#endif
72
73#define	TPM_ACCESS			0x0000	/* access register */
74#define	TPM_ACCESS_ESTABLISHMENT	0x01	/* establishment */
75#define	TPM_ACCESS_REQUEST_USE		0x02	/* request using locality */
76#define	TPM_ACCESS_REQUEST_PENDING	0x04	/* pending request */
77#define	TPM_ACCESS_SEIZE		0x08	/* request locality seize */
78#define	TPM_ACCESS_SEIZED		0x10	/* locality has been seized */
79#define	TPM_ACCESS_ACTIVE_LOCALITY	0x20	/* locality is active */
80#define	TPM_ACCESS_VALID		0x80	/* bits are valid */
81#define	TPM_ACCESS_BITS	\
82    "\020\01EST\02REQ\03PEND\04SEIZE\05SEIZED\06ACT\010VALID"
83
84#define	TPM_INTERRUPT_ENABLE	0x0008
85#define	TPM_GLOBAL_INT_ENABLE	0x80000000	/* enable ints */
86#define	TPM_CMD_READY_INT	0x00000080	/* cmd ready enable */
87#define	TPM_INT_EDGE_FALLING	0x00000018
88#define	TPM_INT_EDGE_RISING	0x00000010
89#define	TPM_INT_LEVEL_LOW	0x00000008
90#define	TPM_INT_LEVEL_HIGH	0x00000000
91#define	TPM_LOCALITY_CHANGE_INT	0x00000004	/* locality change enable */
92#define	TPM_STS_VALID_INT	0x00000002	/* int on TPM_STS_VALID is set */
93#define	TPM_DATA_AVAIL_INT	0x00000001	/* int on TPM_STS_DATA_AVAIL is set */
94#define	TPM_INTERRUPT_ENABLE_BITS \
95    "\020\040ENA\010RDY\03LOCH\02STSV\01DRDY"
96
97#define	TPM_INT_VECTOR		0x000c	/* 8 bit reg for 4 bit irq vector */
98#define	TPM_INT_STATUS		0x0010	/* bits are & 0x87 from TPM_INTERRUPT_ENABLE */
99
100#define	TPM_INTF_CAPABILITIES		0x0014	/* capability register */
101#define	TPM_INTF_BURST_COUNT_STATIC	0x0100	/* TPM_STS_BMASK static */
102#define	TPM_INTF_CMD_READY_INT		0x0080	/* int on ready supported */
103#define	TPM_INTF_INT_EDGE_FALLING	0x0040	/* falling edge ints supported */
104#define	TPM_INTF_INT_EDGE_RISING	0x0020	/* rising edge ints supported */
105#define	TPM_INTF_INT_LEVEL_LOW		0x0010	/* level-low ints supported */
106#define	TPM_INTF_INT_LEVEL_HIGH		0x0008	/* level-high ints supported */
107#define	TPM_INTF_LOCALITY_CHANGE_INT	0x0004	/* locality-change int (mb 1) */
108#define	TPM_INTF_STS_VALID_INT		0x0002	/* TPM_STS_VALID int supported */
109#define	TPM_INTF_DATA_AVAIL_INT		0x0001	/* TPM_STS_DATA_AVAIL int supported (mb 1) */
110#define	TPM_CAPSREQ \
111  (TPM_INTF_DATA_AVAIL_INT|TPM_INTF_LOCALITY_CHANGE_INT|TPM_INTF_INT_LEVEL_LOW)
112#define	TPM_CAPBITS \
113  "\020\01IDRDY\02ISTSV\03ILOCH\04IHIGH\05ILOW\06IEDGE\07IFALL\010IRDY\011BCST"
114
115#define	TPM_STS			0x0018		/* status register */
116#define TPM_STS_MASK		0x000000ff	/* status bits */
117#define	TPM_STS_BMASK		0x00ffff00	/* ro io burst size */
118#define	TPM_STS_VALID		0x00000080	/* ro other bits are valid */
119#define	TPM_STS_CMD_READY	0x00000040	/* rw chip/signal ready */
120#define	TPM_STS_GO		0x00000020	/* wo start the command */
121#define	TPM_STS_DATA_AVAIL	0x00000010	/* ro data available */
122#define	TPM_STS_DATA_EXPECT	0x00000008	/* ro more data to be written */
123#define	TPM_STS_RESP_RETRY	0x00000002	/* wo resend the response */
124#define	TPM_STS_BITS	"\020\010VALID\07RDY\06GO\05DRDY\04EXPECT\02RETRY"
125
126#define	TPM_DATA	0x0024
127#define	TPM_ID		0x0f00
128#define	TPM_REV		0x0f04
129#define	TPM_SIZE	0x5000		/* five pages of the above */
130
131#define	TPM_ACCESS_TMO	2000		/* 2sec */
132#define	TPM_READY_TMO	2000		/* 2sec */
133#define	TPM_READ_TMO	120000		/* 2 minutes */
134#define TPM_BURST_TMO	2000		/* 2sec */
135
136#define	TPM_LEGACY_BUSY	0x01
137#define	TPM_LEGACY_ABRT	0x01
138#define	TPM_LEGACY_DA	0x02
139#define	TPM_LEGACY_RE	0x04
140#define	TPM_LEGACY_LAST	0x04
141#define	TPM_LEGACY_BITS	"\020\01BUSY\2DA\3RE\4LAST"
142#define	TPM_LEGACY_TMO		(2*60)	/* sec */
143#define	TPM_LEGACY_SLEEP	5	/* ticks */
144#define	TPM_LEGACY_DELAY	100
145
146/* Set when enabling legacy interface in host bridge. */
147int tpm_enabled;
148
149
150#ifdef __FreeBSD__
151#define	TPMSOFTC(dev) \
152	((struct tpm_softc *)dev->si_drv1)
153
154d_open_t	tpmopen;
155d_close_t	tpmclose;
156d_read_t	tpmread;
157d_write_t	tpmwrite;
158d_ioctl_t	tpmioctl;
159
160static struct cdevsw tpm_cdevsw = {
161	.d_version =	D_VERSION,
162	.d_flags =	D_NEEDGIANT,
163	.d_open =	tpmopen,
164	.d_close =	tpmclose,
165	.d_read =	tpmread,
166	.d_write =	tpmwrite,
167	.d_ioctl =	tpmioctl,
168	.d_name =	"tpm",
169};
170#else
171#define	TPMSOFTC(dev) \
172    (struct tpm_softc *)device_lookup(&tpm_cd, minor(dev))
173
174struct cfdriver tpm_cd = {
175	NULL, "tpm", DV_DULL
176};
177
178int	tpm_match(device_t , void *, void *);
179void	tpm_attach(device_t , device_t , void *);
180
181struct cfattach tpm_ca = {
182	sizeof(struct tpm_softc), tpm_match, tpm_attach
183};
184#endif
185
186const struct {
187	u_int32_t devid;
188	char name[32];
189	int flags;
190#define TPM_DEV_NOINTS	0x0001
191} tpm_devs[] = {
192	{ 0x000615d1, "IFX SLD 9630 TT 1.1", 0 },
193	{ 0x000b15d1, "IFX SLB 9635 TT 1.2", 0 },
194	{ 0x100214e4, "Broadcom BCM0102", TPM_DEV_NOINTS },
195	{ 0x00fe1050, "WEC WPCT200", 0 },
196	{ 0x687119fa, "SNS SSX35", 0 },
197	{ 0x2e4d5453, "STM ST19WP18", 0 },
198	{ 0x32021114, "ATML 97SC3203", TPM_DEV_NOINTS },
199	{ 0x10408086, "INTEL INTC0102", 0 },
200	{ 0, "", TPM_DEV_NOINTS },
201};
202
203int tpm_tis12_irqinit(struct tpm_softc *, int, int);
204int tpm_tis12_init(struct tpm_softc *, int, const char *);
205int tpm_tis12_start(struct tpm_softc *, int);
206int tpm_tis12_read(struct tpm_softc *, void *, int, size_t *, int);
207int tpm_tis12_write(struct tpm_softc *, void *, int);
208int tpm_tis12_end(struct tpm_softc *, int, int);
209
210#ifdef __FreeBSD__
211void tpm_intr(void *);
212#else
213int tpm_intr(void *);
214void tpm_powerhook(int, void *);
215int tpm_suspend(struct tpm_softc *, int);
216int tpm_resume(struct tpm_softc *, int);
217#endif
218
219int tpm_waitfor_poll(struct tpm_softc *, u_int8_t, int, void *);
220int tpm_waitfor_int(struct tpm_softc *, u_int8_t, int, void *, int);
221int tpm_waitfor(struct tpm_softc *, u_int8_t, int, void *);
222int tpm_request_locality(struct tpm_softc *, int);
223int tpm_getburst(struct tpm_softc *);
224u_int8_t tpm_status(struct tpm_softc *);
225int tpm_tmotohz(int);
226
227int tpm_legacy_probe(bus_space_tag_t, bus_addr_t);
228int tpm_legacy_init(struct tpm_softc *, int, const char *);
229int tpm_legacy_start(struct tpm_softc *, int);
230int tpm_legacy_read(struct tpm_softc *, void *, int, size_t *, int);
231int tpm_legacy_write(struct tpm_softc *, void *, int);
232int tpm_legacy_end(struct tpm_softc *, int, int);
233
234#ifdef __FreeBSD__
235
236/*
237 * FreeBSD specific code for probing and attaching TPM to device tree.
238 */
239#if 0
240static void
241tpm_identify(driver_t *driver, device_t parent)
242{
243	BUS_ADD_CHILD(parent, ISA_ORDER_SPECULATIVE, "tpm", 0);
244}
245#endif
246
247
248int
249tpm_attach(device_t dev)
250{
251	struct tpm_softc *sc = device_get_softc(dev);
252	int irq;
253
254	sc->mem_rid = 0;
255	sc->mem_res = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &sc->mem_rid,
256	    RF_ACTIVE);
257	if (sc->mem_res == NULL)
258		return ENXIO;
259
260	sc->sc_bt = rman_get_bustag(sc->mem_res);
261	sc->sc_bh = rman_get_bushandle(sc->mem_res);
262
263	sc->irq_rid = 0;
264	sc->irq_res = bus_alloc_resource_any(dev, SYS_RES_IRQ, &sc->irq_rid,
265	    RF_ACTIVE | RF_SHAREABLE);
266	if (sc->irq_res != NULL)
267		irq = rman_get_start(sc->irq_res);
268	else
269		irq = IRQUNK;
270
271	/* In case PnP probe this may contain some initialization. */
272	tpm_tis12_probe(sc->sc_bt, sc->sc_bh);
273
274	if (tpm_legacy_probe(sc->sc_bt, sc->sc_bh)) {
275		sc->sc_init = tpm_legacy_init;
276		sc->sc_start = tpm_legacy_start;
277		sc->sc_read = tpm_legacy_read;
278		sc->sc_write = tpm_legacy_write;
279		sc->sc_end = tpm_legacy_end;
280	} else {
281		sc->sc_init = tpm_tis12_init;
282		sc->sc_start = tpm_tis12_start;
283		sc->sc_read = tpm_tis12_read;
284		sc->sc_write = tpm_tis12_write;
285		sc->sc_end = tpm_tis12_end;
286	}
287
288	printf("%s", device_get_name(dev));
289	if ((sc->sc_init)(sc, irq, "tpm")) {
290		tpm_detach(dev);
291		return ENXIO;
292	}
293
294	if (sc->sc_init == tpm_tis12_init && sc->irq_res != NULL &&
295	    bus_setup_intr(dev, sc->irq_res, INTR_TYPE_TTY, NULL,
296	    tpm_intr, sc, &sc->intr_cookie) != 0) {
297		tpm_detach(dev);
298		printf(": cannot establish interrupt\n");
299		return 1;
300	}
301
302	sc->sc_cdev = make_dev(&tpm_cdevsw, device_get_unit(dev),
303			    UID_ROOT, GID_WHEEL, 0600, "tpm");
304	sc->sc_cdev->si_drv1 = sc;
305
306	return 0;
307}
308
309int
310tpm_detach(device_t dev)
311{
312	struct tpm_softc * sc = device_get_softc(dev);
313
314	if(sc->intr_cookie){
315		bus_teardown_intr(dev, sc->irq_res, sc->intr_cookie);
316	}
317
318	if(sc->mem_res){
319		bus_release_resource(dev, SYS_RES_MEMORY,
320				     sc->mem_rid, sc->mem_res);
321	}
322
323	if(sc->irq_res){
324		bus_release_resource(dev, SYS_RES_IRQ,
325				     sc->irq_rid, sc->irq_res);
326	}
327	if(sc->sc_cdev){
328		destroy_dev(sc->sc_cdev);
329	}
330
331	return 0;
332}
333
334
335#else
336/*
337 * OpenBSD specific code for probing and attaching TPM to device tree.
338 */
339int
340tpm_match(device_t parent, void *match, void *aux)
341{
342	struct isa_attach_args *ia = aux;
343	struct cfdata *cf = match;
344	bus_space_tag_t bt = ia->ia_memt;
345	bus_space_handle_t bh;
346	int rv;
347
348	/* There can be only one. */
349	if (cf->cf_unit)
350		return 0;
351
352	if (tpm_legacy_probe(ia->ia_iot, ia->ia_iobase)) {
353		ia->ia_iosize = 2;
354		return 1;
355	}
356
357	if (ia->ia_maddr == -1)
358		return 0;
359
360	if (bus_space_map(bt, ia->ia_maddr, TPM_SIZE, 0, &bh))
361		return 0;
362
363	if ((rv = tpm_tis12_probe(bt, bh))) {
364		ia->ia_iosize = 0;
365		ia->ia_msize = TPM_SIZE;
366	}
367
368	bus_space_unmap(bt, bh, TPM_SIZE);
369	return rv;
370}
371
372void
373tpm_attach(device_t parent, device_t self, void *aux)
374{
375	struct tpm_softc *sc = (struct tpm_softc *)self;
376	struct isa_attach_args *ia = aux;
377	bus_addr_t iobase;
378	bus_size_t size;
379	int rv;
380
381	if (tpm_legacy_probe(ia->ia_iot, ia->ia_iobase)) {
382		sc->sc_bt = ia->ia_iot;
383		iobase = ia->ia_iobase;
384		size = ia->ia_iosize;
385		sc->sc_batm = ia->ia_iot;
386		sc->sc_init = tpm_legacy_init;
387		sc->sc_start = tpm_legacy_start;
388		sc->sc_read = tpm_legacy_read;
389		sc->sc_write = tpm_legacy_write;
390		sc->sc_end = tpm_legacy_end;
391	} else {
392		sc->sc_bt = ia->ia_memt;
393		iobase = ia->ia_maddr;
394		size = TPM_SIZE;
395		sc->sc_init = tpm_tis12_init;
396		sc->sc_start = tpm_tis12_start;
397		sc->sc_read = tpm_tis12_read;
398		sc->sc_write = tpm_tis12_write;
399		sc->sc_end = tpm_tis12_end;
400	}
401
402	if (bus_space_map(sc->sc_bt, iobase, size, 0, &sc->sc_bh)) {
403		printf(": cannot map registers\n");
404		return;
405	}
406
407	if ((rv = (sc->sc_init)(sc, ia->ia_irq, sc->sc_dev.dv_xname))) {
408		bus_space_unmap(sc->sc_bt, sc->sc_bh, size);
409		return;
410	}
411
412	/*
413	 * Only setup interrupt handler when we have a vector and the
414	 * chip is TIS 1.2 compliant.
415	 */
416	if (sc->sc_init == tpm_tis12_init && ia->ia_irq != IRQUNK &&
417	    (sc->sc_ih = isa_intr_establish(ia->ia_ic, ia->ia_irq, IST_EDGE,
418	    IPL_TTY, tpm_intr, sc, sc->sc_dev.dv_xname)) == NULL) {
419		bus_space_unmap(sc->sc_bt, sc->sc_bh, TPM_SIZE);
420		printf("%s: cannot establish interrupt\n",
421		    sc->sc_dev.dv_xname);
422		return;
423	}
424
425	sc->sc_suspend = PWR_RESUME;
426	sc->sc_powerhook = powerhook_establish(tpm_powerhook, sc);
427}
428#endif
429
430/* Probe TPM using TIS 1.2 interface. */
431int
432tpm_tis12_probe(bus_space_tag_t bt, bus_space_handle_t bh)
433{
434	u_int32_t r;
435	u_int8_t save, reg;
436
437	r = bus_space_read_4(bt, bh, TPM_INTF_CAPABILITIES);
438	if (r == 0xffffffff)
439		return 0;
440
441#ifdef TPM_DEBUG
442	printf("tpm: caps=%b\n", r, TPM_CAPBITS);
443#endif
444	if ((r & TPM_CAPSREQ) != TPM_CAPSREQ ||
445	    !(r & (TPM_INTF_INT_EDGE_RISING | TPM_INTF_INT_LEVEL_LOW))) {
446#ifdef TPM_DEBUG
447		printf("tpm: caps too low (caps=%b)\n", r, TPM_CAPBITS);
448#endif
449		return 0;
450	}
451
452	save = bus_space_read_1(bt, bh, TPM_ACCESS);
453	bus_space_write_1(bt, bh, TPM_ACCESS, TPM_ACCESS_REQUEST_USE);
454	reg = bus_space_read_1(bt, bh, TPM_ACCESS);
455	if ((reg & TPM_ACCESS_VALID) && (reg & TPM_ACCESS_ACTIVE_LOCALITY) &&
456	    bus_space_read_4(bt, bh, TPM_ID) != 0xffffffff)
457		return 1;
458
459	bus_space_write_1(bt, bh, TPM_ACCESS, save);
460	return 0;
461}
462
463/*
464 * Setup interrupt vector if one is provided and interrupts are know to
465 * work on that particular chip.
466 */
467int
468tpm_tis12_irqinit(struct tpm_softc *sc, int irq, int idx)
469{
470	u_int32_t r;
471
472	if ((irq == IRQUNK) || (tpm_devs[idx].flags & TPM_DEV_NOINTS)) {
473		sc->sc_vector = IRQUNK;
474		return 0;
475	}
476
477	/* Ack and disable all interrupts. */
478	bus_space_write_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE,
479	    bus_space_read_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE) &
480	    ~TPM_GLOBAL_INT_ENABLE);
481	bus_space_write_4(sc->sc_bt, sc->sc_bh, TPM_INT_STATUS,
482	    bus_space_read_4(sc->sc_bt, sc->sc_bh, TPM_INT_STATUS));
483
484	/* Program interrupt vector. */
485	bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_INT_VECTOR, irq);
486	sc->sc_vector = irq;
487
488	/* Program interrupt type. */
489	if (sc->sc_capabilities & TPM_INTF_INT_EDGE_RISING)
490		r = TPM_INT_EDGE_RISING;
491	else if (sc->sc_capabilities & TPM_INTF_INT_LEVEL_HIGH)
492		r = TPM_INT_LEVEL_HIGH;
493	else
494		r = TPM_INT_LEVEL_LOW;
495	bus_space_write_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE, r);
496
497	return 0;
498}
499
500/* Setup TPM using TIS 1.2 interface. */
501int
502tpm_tis12_init(struct tpm_softc *sc, int irq, const char *name)
503{
504	u_int32_t r;
505	int i;
506
507	r = bus_space_read_4(sc->sc_bt, sc->sc_bh, TPM_INTF_CAPABILITIES);
508#ifdef TPM_DEBUG
509	printf(" caps=%b ", r, TPM_CAPBITS);
510#endif
511	if ((r & TPM_CAPSREQ) != TPM_CAPSREQ ||
512	    !(r & (TPM_INTF_INT_EDGE_RISING | TPM_INTF_INT_LEVEL_LOW))) {
513		printf(": capabilities too low (caps=%b)\n", r, TPM_CAPBITS);
514		return 1;
515	}
516	sc->sc_capabilities = r;
517
518	sc->sc_devid = bus_space_read_4(sc->sc_bt, sc->sc_bh, TPM_ID);
519	sc->sc_rev = bus_space_read_1(sc->sc_bt, sc->sc_bh, TPM_REV);
520
521	for (i = 0; tpm_devs[i].devid; i++)
522		if (tpm_devs[i].devid == sc->sc_devid)
523			break;
524
525	if (tpm_devs[i].devid)
526		printf(": %s rev 0x%x\n", tpm_devs[i].name, sc->sc_rev);
527	else
528		printf(": device 0x%08x rev 0x%x\n", sc->sc_devid, sc->sc_rev);
529
530	if (tpm_tis12_irqinit(sc, irq, i))
531		return 1;
532
533	if (tpm_request_locality(sc, 0))
534		return 1;
535
536	/* Abort whatever it thought it was doing. */
537	bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_STS, TPM_STS_CMD_READY);
538
539	return 0;
540}
541
542int
543tpm_request_locality(struct tpm_softc *sc, int l)
544{
545	u_int32_t r;
546	int to, rv;
547
548	if (l != 0)
549		return EINVAL;
550
551	if ((bus_space_read_1(sc->sc_bt, sc->sc_bh, TPM_ACCESS) &
552	    (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY)) ==
553	    (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY))
554		return 0;
555
556	bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_ACCESS,
557	    TPM_ACCESS_REQUEST_USE);
558
559	to = tpm_tmotohz(TPM_ACCESS_TMO);
560
561	while ((r = bus_space_read_1(sc->sc_bt, sc->sc_bh, TPM_ACCESS) &
562	    (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY)) !=
563	    (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY) && to--) {
564		rv = tsleep(sc->sc_init, PRIBIO | PCATCH, "tpm_locality", 1);
565		if (rv &&  rv != EWOULDBLOCK) {
566#ifdef TPM_DEBUG
567			printf("tpm_request_locality: interrupted %d\n", rv);
568#endif
569			return rv;
570		}
571	}
572
573	if ((r & (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY)) !=
574	    (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY)) {
575#ifdef TPM_DEBUG
576		printf("tpm_request_locality: access %b\n", r, TPM_ACCESS_BITS);
577#endif
578		return EBUSY;
579	}
580
581	return 0;
582}
583
584int
585tpm_getburst(struct tpm_softc *sc)
586{
587	int burst, to, rv;
588
589	to = tpm_tmotohz(TPM_BURST_TMO);
590
591	burst = 0;
592	while (burst == 0 && to--) {
593		/*
594		 * Burst count has to be read from bits 8 to 23 without
595		 * touching any other bits, eg. the actual status bits 0
596		 * to 7.
597		 */
598		burst = bus_space_read_1(sc->sc_bt, sc->sc_bh, TPM_STS + 1);
599		burst |= bus_space_read_1(sc->sc_bt, sc->sc_bh, TPM_STS + 2)
600		    << 8;
601#ifdef TPM_DEBUG
602		printf("tpm_getburst: read %d\n", burst);
603#endif
604		if (burst)
605			return burst;
606
607		rv = tsleep(sc, PRIBIO | PCATCH, "tpm_getburst", 1);
608		if (rv && rv != EWOULDBLOCK) {
609			return 0;
610		}
611	}
612
613	return 0;
614}
615
616u_int8_t
617tpm_status(struct tpm_softc *sc)
618{
619	u_int8_t status;
620
621	status = bus_space_read_1(sc->sc_bt, sc->sc_bh, TPM_STS) &
622	    TPM_STS_MASK;
623
624	return status;
625}
626
627int
628tpm_tmotohz(int tmo)
629{
630	struct timeval tv;
631
632	tv.tv_sec = tmo / 1000;
633	tv.tv_usec = 1000 * (tmo % 1000);
634
635	return tvtohz(&tv);
636}
637
638/* Save TPM state on suspend. */
639int
640#ifdef __FreeBSD__
641tpm_suspend(device_t dev)
642#else
643tpm_suspend(struct tpm_softc *sc, int why)
644#endif
645{
646#ifdef __FreeBSD__
647	struct tpm_softc *sc = device_get_softc(dev);
648	int why = 1;
649#endif
650	u_int8_t command[] = {
651	    0, 193,		/* TPM_TAG_RQU_COMMAND */
652	    0, 0, 0, 10,	/* Length in bytes */
653	    0, 0, 0, 156	/* TPM_ORD_SaveStates */
654	};
655
656	/*
657	 * Power down:  We have to issue the SaveStates command.
658	 */
659	sc->sc_write(sc, &command, sizeof(command));
660	sc->sc_read(sc, &command, sizeof(command), NULL, TPM_HDRSIZE);
661#ifdef TPM_DEBUG
662	printf("tpm_suspend: power down: %d -> %d\n", sc->sc_suspend, why);
663#endif
664	sc->sc_suspend = why;
665
666	return 0;
667}
668
669/*
670 * Handle resume event.  Actually nothing to do as the BIOS is supposed
671 * to restore the previously saved state.
672 */
673int
674#ifdef __FreeBSD__
675tpm_resume(device_t dev)
676#else
677tpm_resume(struct tpm_softc *sc, int why)
678#endif
679{
680#ifdef __FreeBSD__
681	struct tpm_softc *sc = device_get_softc(dev);
682	int why = 0;
683#endif
684#ifdef TPM_DEBUG
685	printf("tpm_resume: resume: %d -> %d\n", sc->sc_suspend, why);
686#endif
687	sc->sc_suspend = why;
688
689	return 0;
690}
691
692/* Dispatch suspend and resume events. */
693#ifndef __FreeBSD__
694void
695tpm_powerhook(int why, void *self)
696{
697	struct tpm_softc *sc = (struct tpm_softc *)self;
698
699	if (why != PWR_RESUME)
700		tpm_suspend(sc, why);
701	else
702		tpm_resume(sc, why);
703}
704#endif	/* !__FreeBSD__ */
705
706/* Wait for given status bits using polling. */
707int
708tpm_waitfor_poll(struct tpm_softc *sc, u_int8_t mask, int tmo, void *c)
709{
710	int rv;
711
712	/*
713	 * Poll until either the requested condition or a time out is
714	 * met.
715	 */
716	while (((sc->sc_stat = tpm_status(sc)) & mask) != mask && tmo--) {
717		rv = tsleep(c, PRIBIO | PCATCH, "tpm_poll", 1);
718		if (rv && rv != EWOULDBLOCK) {
719#ifdef TPM_DEBUG
720			printf("tpm_waitfor_poll: interrupted %d\n", rv);
721#endif
722			return rv;
723		}
724	}
725
726	return 0;
727}
728
729/* Wait for given status bits using interrupts. */
730int
731tpm_waitfor_int(struct tpm_softc *sc, u_int8_t mask, int tmo, void *c,
732    int inttype)
733{
734	int rv, to;
735
736	/* Poll and return when condition is already met. */
737	sc->sc_stat = tpm_status(sc);
738	if ((sc->sc_stat & mask) == mask)
739		return 0;
740
741	/*
742	 * Enable interrupt on tpm chip.  Note that interrupts on our
743	 * level (SPL_TTY) are disabled (see tpm{read,write} et al) and
744	 * will not be delivered to the cpu until we call tsleep(9) below.
745	 */
746	bus_space_write_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE,
747	    bus_space_read_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE) |
748	    inttype);
749	bus_space_write_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE,
750	    bus_space_read_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE) |
751	    TPM_GLOBAL_INT_ENABLE);
752
753	/*
754	 * Poll once more to remedy the race between previous polling
755	 * and enabling interrupts on the tpm chip.
756	 */
757	sc->sc_stat = tpm_status(sc);
758	if ((sc->sc_stat & mask) == mask) {
759		rv = 0;
760		goto out;
761	}
762
763	to = tpm_tmotohz(tmo);
764#ifdef TPM_DEBUG
765	printf("tpm_waitfor_int: sleeping for %d ticks on %p\n", to, c);
766#endif
767	/*
768	 * tsleep(9) enables interrupts on the cpu and returns after
769	 * wake up with interrupts disabled again.  Note that interrupts
770	 * generated by the tpm chip while being at SPL_TTY are not lost
771	 * but held and delivered as soon as the cpu goes below SPL_TTY.
772	 */
773	rv = tsleep(c, PRIBIO | PCATCH, "tpm_intr", to);
774
775	sc->sc_stat = tpm_status(sc);
776#ifdef TPM_DEBUG
777	printf("tpm_waitfor_int: woke up with rv %d stat %b\n", rv,
778	    sc->sc_stat, TPM_STS_BITS);
779#endif
780	if ((sc->sc_stat & mask) == mask)
781		rv = 0;
782
783	/* Disable interrupts on tpm chip again. */
784out:	bus_space_write_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE,
785	    bus_space_read_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE) &
786	    ~TPM_GLOBAL_INT_ENABLE);
787	bus_space_write_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE,
788	    bus_space_read_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE) &
789	    ~inttype);
790
791	return rv;
792}
793
794/*
795 * Wait on given status bits, uses interrupts where possible, otherwise polls.
796 */
797int
798tpm_waitfor(struct tpm_softc *sc, u_int8_t b0, int tmo, void *c)
799{
800	u_int8_t b;
801	int re, to, rv;
802
803#ifdef TPM_DEBUG
804	printf("tpm_waitfor: b0 %b\n", b0, TPM_STS_BITS);
805#endif
806
807	/*
808	 * If possible, use interrupts, otherwise poll.
809	 *
810	 * We use interrupts for TPM_STS_VALID and TPM_STS_DATA_AVAIL (if
811	 * the tpm chips supports them) as waiting for those can take
812	 * really long.  The other TPM_STS* are not needed very often
813	 * so we do not support them.
814	 */
815	if (sc->sc_vector != IRQUNK) {
816		b = b0;
817
818		/*
819		 * Wait for data ready.  This interrupt only occurs
820		 * when both TPM_STS_VALID and TPM_STS_DATA_AVAIL are asserted.
821		 * Thus we don't have to bother with TPM_STS_VALID
822		 * separately and can just return.
823		 *
824		 * This only holds for interrupts!  When using polling
825		 * both flags have to be waited for, see below.
826		 */
827		if ((b & TPM_STS_DATA_AVAIL) && (sc->sc_capabilities &
828		    TPM_INTF_DATA_AVAIL_INT))
829			return tpm_waitfor_int(sc, b, tmo, c,
830			    TPM_DATA_AVAIL_INT);
831
832		/* Wait for status valid bit. */
833		if ((b & TPM_STS_VALID) && (sc->sc_capabilities &
834		    TPM_INTF_STS_VALID_INT)) {
835			rv = tpm_waitfor_int(sc, b, tmo, c, TPM_STS_VALID_INT);
836			if (rv != 0)
837				return rv;
838			else
839				b = b0 & ~TPM_STS_VALID;
840		}
841
842		/*
843		 * When all flags are taken care of, return.  Otherwise
844		 * use polling for eg. TPM_STS_CMD_READY.
845		 */
846		if (b == 0)
847			return 0;
848	}
849
850	re = 3;
851restart:
852	/*
853	 * If requested wait for TPM_STS_VALID before dealing with
854	 * any other flag.  Eg. when both TPM_STS_DATA_AVAIL and TPM_STS_VALID
855	 * are requested, wait for the latter first.
856	 */
857	b = b0;
858	if (b0 & TPM_STS_VALID)
859		b = TPM_STS_VALID;
860
861	to = tpm_tmotohz(tmo);
862again:
863	if ((rv = tpm_waitfor_poll(sc, b, to, c)) != 0)
864		return rv;
865
866	if ((b & sc->sc_stat) == TPM_STS_VALID) {
867		/* Now wait for other flags. */
868		b = b0 & ~TPM_STS_VALID;
869		to++;
870		goto again;
871	}
872
873	if ((sc->sc_stat & b) != b) {
874#ifdef TPM_DEBUG
875		printf("tpm_waitfor: timeout: stat=%b b=%b\n",
876		    sc->sc_stat, TPM_STS_BITS, b, TPM_STS_BITS);
877#endif
878		if (re-- && (b0 & TPM_STS_VALID)) {
879			bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_STS,
880			    TPM_STS_RESP_RETRY);
881			goto restart;
882		}
883		return EIO;
884	}
885
886	return 0;
887}
888
889/* Start transaction. */
890int
891tpm_tis12_start(struct tpm_softc *sc, int flag)
892{
893	int rv;
894
895	if (flag == UIO_READ) {
896		rv = tpm_waitfor(sc, TPM_STS_DATA_AVAIL | TPM_STS_VALID,
897		    TPM_READ_TMO, sc->sc_read);
898		return rv;
899	}
900
901	/* Own our (0th) locality. */
902	if ((rv = tpm_request_locality(sc, 0)) != 0)
903		return rv;
904
905	sc->sc_stat = tpm_status(sc);
906	if (sc->sc_stat & TPM_STS_CMD_READY) {
907#ifdef TPM_DEBUG
908		printf("tpm_tis12_start: UIO_WRITE status %b\n", sc->sc_stat,
909		   TPM_STS_BITS);
910#endif
911		return 0;
912	}
913
914#ifdef TPM_DEBUG
915	printf("tpm_tis12_start: UIO_WRITE readying chip\n");
916#endif
917
918	/* Abort previous and restart. */
919	bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_STS, TPM_STS_CMD_READY);
920	if ((rv = tpm_waitfor(sc, TPM_STS_CMD_READY, TPM_READY_TMO,
921	    sc->sc_write))) {
922#ifdef TPM_DEBUG
923		printf("tpm_tis12_start: UIO_WRITE readying failed %d\n", rv);
924#endif
925		return rv;
926	}
927
928#ifdef TPM_DEBUG
929	printf("tpm_tis12_start: UIO_WRITE readying done\n");
930#endif
931
932	return 0;
933}
934
935int
936tpm_tis12_read(struct tpm_softc *sc, void *buf, int len, size_t *count,
937    int flags)
938{
939	u_int8_t *p = buf;
940	size_t cnt;
941	int rv, n, bcnt;
942
943#ifdef TPM_DEBUG
944	printf("tpm_tis12_read: len %d\n", len);
945#endif
946	cnt = 0;
947	while (len > 0) {
948		if ((rv = tpm_waitfor(sc, TPM_STS_DATA_AVAIL | TPM_STS_VALID,
949		    TPM_READ_TMO, sc->sc_read)))
950			return rv;
951
952		bcnt = tpm_getburst(sc);
953		n = MIN(len, bcnt);
954#ifdef TPM_DEBUG
955		printf("tpm_tis12_read: fetching %d, burst is %d\n", n, bcnt);
956#endif
957		for (; n--; len--) {
958			*p++ = bus_space_read_1(sc->sc_bt, sc->sc_bh, TPM_DATA);
959			cnt++;
960		}
961
962		if ((flags & TPM_PARAM_SIZE) == 0 && cnt >= 6)
963			break;
964	}
965#ifdef TPM_DEBUG
966	printf("tpm_tis12_read: read %zd bytes, len %d\n", cnt, len);
967#endif
968
969	if (count)
970		*count = cnt;
971
972	return 0;
973}
974
975int
976tpm_tis12_write(struct tpm_softc *sc, void *buf, int len)
977{
978	u_int8_t *p = buf;
979	size_t cnt;
980	int rv, r;
981
982#ifdef TPM_DEBUG
983	printf("tpm_tis12_write: sc %p buf %p len %d\n", sc, buf, len);
984#endif
985
986	if ((rv = tpm_request_locality(sc, 0)) != 0)
987		return rv;
988
989	cnt = 0;
990	while (cnt < len - 1) {
991		for (r = tpm_getburst(sc); r > 0 && cnt < len - 1; r--) {
992			bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_DATA, *p++);
993			cnt++;
994		}
995		if ((rv = tpm_waitfor(sc, TPM_STS_VALID, TPM_READ_TMO, sc))) {
996#ifdef TPM_DEBUG
997			printf("tpm_tis12_write: failed burst rv %d\n", rv);
998#endif
999			return rv;
1000		}
1001		sc->sc_stat = tpm_status(sc);
1002		if (!(sc->sc_stat & TPM_STS_DATA_EXPECT)) {
1003#ifdef TPM_DEBUG
1004			printf("tpm_tis12_write: failed rv %d stat=%b\n", rv,
1005			    sc->sc_stat, TPM_STS_BITS);
1006#endif
1007			return EIO;
1008		}
1009	}
1010
1011	bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_DATA, *p++);
1012	cnt++;
1013
1014	if ((rv = tpm_waitfor(sc, TPM_STS_VALID, TPM_READ_TMO, sc))) {
1015#ifdef TPM_DEBUG
1016		printf("tpm_tis12_write: failed last byte rv %d\n", rv);
1017#endif
1018		return rv;
1019	}
1020	if ((sc->sc_stat & TPM_STS_DATA_EXPECT) != 0) {
1021#ifdef TPM_DEBUG
1022		printf("tpm_tis12_write: failed rv %d stat=%b\n", rv,
1023		    sc->sc_stat, TPM_STS_BITS);
1024#endif
1025		return EIO;
1026	}
1027
1028#ifdef TPM_DEBUG
1029	printf("tpm_tis12_write: wrote %d byte\n", cnt);
1030#endif
1031
1032	return 0;
1033}
1034
1035/* Finish transaction. */
1036int
1037tpm_tis12_end(struct tpm_softc *sc, int flag, int err)
1038{
1039	int rv = 0;
1040
1041	if (flag == UIO_READ) {
1042		if ((rv = tpm_waitfor(sc, TPM_STS_VALID, TPM_READ_TMO,
1043		    sc->sc_read)))
1044			return rv;
1045
1046		/* Still more data? */
1047		sc->sc_stat = tpm_status(sc);
1048		if (!err && ((sc->sc_stat & TPM_STS_DATA_AVAIL) == TPM_STS_DATA_AVAIL)) {
1049#ifdef TPM_DEBUG
1050			printf("tpm_tis12_end: read failed stat=%b\n",
1051			    sc->sc_stat, TPM_STS_BITS);
1052#endif
1053			rv = EIO;
1054		}
1055
1056		bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_STS,
1057		    TPM_STS_CMD_READY);
1058
1059		/* Release our (0th) locality. */
1060		bus_space_write_1(sc->sc_bt, sc->sc_bh,TPM_ACCESS,
1061		    TPM_ACCESS_ACTIVE_LOCALITY);
1062	} else {
1063		/* Hungry for more? */
1064		sc->sc_stat = tpm_status(sc);
1065		if (!err && (sc->sc_stat & TPM_STS_DATA_EXPECT)) {
1066#ifdef TPM_DEBUG
1067			printf("tpm_tis12_end: write failed stat=%b\n",
1068			    sc->sc_stat, TPM_STS_BITS);
1069#endif
1070			rv = EIO;
1071		}
1072
1073		bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_STS,
1074		    err ? TPM_STS_CMD_READY : TPM_STS_GO);
1075	}
1076
1077	return rv;
1078}
1079
1080#ifdef __FreeBSD__
1081void
1082#else
1083int
1084#endif
1085tpm_intr(void *v)
1086{
1087	struct tpm_softc *sc = v;
1088	u_int32_t r;
1089#ifdef TPM_DEBUG
1090	static int cnt = 0;
1091#endif
1092
1093	r = bus_space_read_4(sc->sc_bt, sc->sc_bh, TPM_INT_STATUS);
1094#ifdef TPM_DEBUG
1095	if (r != 0)
1096		printf("tpm_intr: int=%b (%d)\n", r, TPM_INTERRUPT_ENABLE_BITS,
1097		    cnt);
1098	else
1099		cnt++;
1100#endif
1101	if (!(r & (TPM_CMD_READY_INT | TPM_LOCALITY_CHANGE_INT |
1102	    TPM_STS_VALID_INT | TPM_DATA_AVAIL_INT)))
1103#ifdef __FreeBSD__
1104		return;
1105#else
1106		return 0;
1107#endif
1108	if (r & TPM_STS_VALID_INT)
1109		wakeup(sc);
1110
1111	if (r & TPM_CMD_READY_INT)
1112		wakeup(sc->sc_write);
1113
1114	if (r & TPM_DATA_AVAIL_INT)
1115		wakeup(sc->sc_read);
1116
1117	if (r & TPM_LOCALITY_CHANGE_INT)
1118		wakeup(sc->sc_init);
1119
1120	bus_space_write_4(sc->sc_bt, sc->sc_bh, TPM_INT_STATUS, r);
1121
1122#ifdef __FreeBSD__
1123	return;
1124#else
1125	return 1;
1126#endif
1127}
1128
1129/* Read single byte using legacy interface. */
1130static inline u_int8_t
1131tpm_legacy_in(bus_space_tag_t iot, bus_space_handle_t ioh, int reg)
1132{
1133	bus_space_write_1(iot, ioh, 0, reg);
1134	return bus_space_read_1(iot, ioh, 1);
1135}
1136
1137#if 0
1138/* Write single byte using legacy interface. */
1139static inline void
1140tpm_legacy_out(bus_space_tag_t iot, bus_space_handle_t ioh, int reg, u_int8_t v)
1141{
1142	bus_space_write_1(iot, ioh, 0, reg);
1143	bus_space_write_1(iot, ioh, 1, v);
1144}
1145#endif
1146
1147/* Probe for TPM using legacy interface. */
1148int
1149tpm_legacy_probe(bus_space_tag_t iot, bus_addr_t iobase)
1150{
1151	bus_space_handle_t ioh;
1152	u_int8_t r, v;
1153	int i, rv = 0;
1154	char id[8];
1155
1156	if (!tpm_enabled || iobase == -1)
1157		return 0;
1158
1159	if (bus_space_map(iot, iobase, 2, 0, &ioh))
1160		return 0;
1161
1162	v = bus_space_read_1(iot, ioh, 0);
1163	if (v == 0xff) {
1164		bus_space_unmap(iot, ioh, 2);
1165		return 0;
1166	}
1167	r = bus_space_read_1(iot, ioh, 1);
1168
1169	for (i = sizeof(id); i--; )
1170		id[i] = tpm_legacy_in(iot, ioh, TPM_ID + i);
1171
1172#ifdef TPM_DEBUG
1173	printf("tpm_legacy_probe %.4s %d.%d.%d.%d\n",
1174	    &id[4], id[0], id[1], id[2], id[3]);
1175#endif
1176	/*
1177	 * The only chips using the legacy interface we are aware of are
1178	 * by Atmel.  For other chips more signature would have to be added.
1179	 */
1180	if (!bcmp(&id[4], "ATML", 4))
1181		rv = 1;
1182
1183	if (!rv) {
1184		bus_space_write_1(iot, ioh, r, 1);
1185		bus_space_write_1(iot, ioh, v, 0);
1186	}
1187	bus_space_unmap(iot, ioh, 2);
1188
1189	return rv;
1190}
1191
1192/* Setup TPM using legacy interface. */
1193int
1194tpm_legacy_init(struct tpm_softc *sc, int irq, const char *name)
1195{
1196	char id[8];
1197	u_int8_t ioh, iol;
1198	int i;
1199
1200	if ((i = bus_space_map(sc->sc_batm, tpm_enabled, 2, 0, &sc->sc_bahm))) {
1201		printf(": cannot map tpm registers (%d)\n", i);
1202		tpm_enabled = 0;
1203		return 1;
1204	}
1205
1206	for (i = sizeof(id); i--; )
1207		id[i] = tpm_legacy_in(sc->sc_bt, sc->sc_bh, TPM_ID + i);
1208
1209	printf(": %.4s %d.%d @0x%x\n", &id[4], id[0], id[1], tpm_enabled);
1210	iol = tpm_enabled & 0xff;
1211	ioh = tpm_enabled >> 16;
1212	tpm_enabled = 0;
1213
1214	return 0;
1215}
1216
1217/* Start transaction. */
1218int
1219tpm_legacy_start(struct tpm_softc *sc, int flag)
1220{
1221	struct timeval tv;
1222	u_int8_t bits, r;
1223	int to, rv;
1224
1225	bits = flag == UIO_READ ? TPM_LEGACY_DA : 0;
1226	tv.tv_sec = TPM_LEGACY_TMO;
1227	tv.tv_usec = 0;
1228	to = tvtohz(&tv) / TPM_LEGACY_SLEEP;
1229	while (((r = bus_space_read_1(sc->sc_batm, sc->sc_bahm, 1)) &
1230	    (TPM_LEGACY_BUSY|bits)) != bits && to--) {
1231		rv = tsleep(sc, PRIBIO | PCATCH, "legacy_tpm_start",
1232		    TPM_LEGACY_SLEEP);
1233		if (rv && rv != EWOULDBLOCK)
1234			return rv;
1235	}
1236
1237#if defined(TPM_DEBUG) && !defined(__FreeBSD__)
1238	printf("%s: bits %b\n", sc->sc_dev.dv_xname, r, TPM_LEGACY_BITS);
1239#endif
1240	if ((r & (TPM_LEGACY_BUSY|bits)) != bits)
1241		return EIO;
1242
1243	return 0;
1244}
1245
1246int
1247tpm_legacy_read(struct tpm_softc *sc, void *buf, int len, size_t *count,
1248    int flags)
1249{
1250	u_int8_t *p;
1251	size_t cnt;
1252	int to, rv;
1253
1254	cnt = rv = 0;
1255	for (p = buf; !rv && len > 0; len--) {
1256		for (to = 1000;
1257		    !(bus_space_read_1(sc->sc_batm, sc->sc_bahm, 1) &
1258		    TPM_LEGACY_DA); DELAY(1))
1259			if (!to--)
1260				return EIO;
1261
1262		DELAY(TPM_LEGACY_DELAY);
1263		*p++ = bus_space_read_1(sc->sc_batm, sc->sc_bahm, 0);
1264		cnt++;
1265	}
1266
1267	*count = cnt;
1268	return 0;
1269}
1270
1271int
1272tpm_legacy_write(struct tpm_softc *sc, void *buf, int len)
1273{
1274	u_int8_t *p;
1275	int n;
1276
1277	for (p = buf, n = len; n--; DELAY(TPM_LEGACY_DELAY)) {
1278		if (!n && len != TPM_BUFSIZ) {
1279			bus_space_write_1(sc->sc_batm, sc->sc_bahm, 1,
1280			    TPM_LEGACY_LAST);
1281			DELAY(TPM_LEGACY_DELAY);
1282		}
1283		bus_space_write_1(sc->sc_batm, sc->sc_bahm, 0, *p++);
1284	}
1285
1286	return 0;
1287}
1288
1289/* Finish transaction. */
1290int
1291tpm_legacy_end(struct tpm_softc *sc, int flag, int rv)
1292{
1293	struct timeval tv;
1294	u_int8_t r;
1295	int to;
1296
1297	if (rv || flag == UIO_READ)
1298		bus_space_write_1(sc->sc_batm, sc->sc_bahm, 1, TPM_LEGACY_ABRT);
1299	else {
1300		tv.tv_sec = TPM_LEGACY_TMO;
1301		tv.tv_usec = 0;
1302		to = tvtohz(&tv) / TPM_LEGACY_SLEEP;
1303		while(((r = bus_space_read_1(sc->sc_batm, sc->sc_bahm, 1)) &
1304		    TPM_LEGACY_BUSY) && to--) {
1305			rv = tsleep(sc, PRIBIO | PCATCH, "legacy_tpm_end",
1306			    TPM_LEGACY_SLEEP);
1307			if (rv && rv != EWOULDBLOCK)
1308				return rv;
1309		}
1310
1311#if defined(TPM_DEBUG) && !defined(__FreeBSD__)
1312		printf("%s: bits %b\n", sc->sc_dev.dv_xname, r, TPM_LEGACY_BITS);
1313#endif
1314		if (r & TPM_LEGACY_BUSY)
1315			return EIO;
1316
1317		if (r & TPM_LEGACY_RE)
1318			return EIO;	/* XXX Retry the loop? */
1319	}
1320
1321	return rv;
1322}
1323
1324int
1325#ifdef __FreeBSD__
1326tpmopen(struct cdev *dev, int flag, int mode, struct thread *td)
1327#else
1328tpmopen(dev_t dev, int flag, int mode, struct proc *p)
1329#endif
1330{
1331	struct tpm_softc *sc = TPMSOFTC(dev);
1332
1333	if (!sc)
1334		return ENXIO;
1335
1336	if (sc->sc_flags & TPM_OPEN)
1337		return EBUSY;
1338
1339	sc->sc_flags |= TPM_OPEN;
1340
1341	return 0;
1342}
1343
1344int
1345#ifdef __FreeBSD__
1346tpmclose(struct cdev *dev, int flag, int mode, struct thread *td)
1347#else
1348tpmclose(dev_t dev, int flag, int mode, struct proc *p)
1349#endif
1350{
1351	struct tpm_softc *sc = TPMSOFTC(dev);
1352
1353	if (!sc)
1354		return ENXIO;
1355
1356	if (!(sc->sc_flags & TPM_OPEN))
1357		return EINVAL;
1358
1359	sc->sc_flags &= ~TPM_OPEN;
1360
1361	return 0;
1362}
1363
1364int
1365#ifdef __FreeBSD__
1366tpmread(struct cdev *dev, struct uio *uio, int flags)
1367#else
1368tpmread(dev_t dev, struct uio *uio, int flags)
1369#endif
1370{
1371	struct tpm_softc *sc = TPMSOFTC(dev);
1372	u_int8_t buf[TPM_BUFSIZ], *p;
1373	size_t cnt;
1374	int n, len, rv, s;
1375
1376	if (!sc)
1377		return ENXIO;
1378
1379	s = spltty();
1380	if ((rv = (sc->sc_start)(sc, UIO_READ))) {
1381		splx(s);
1382		return rv;
1383	}
1384
1385#ifdef TPM_DEBUG
1386	printf("tpmread: getting header\n");
1387#endif
1388	if ((rv = (sc->sc_read)(sc, buf, TPM_HDRSIZE, &cnt, 0))) {
1389		(sc->sc_end)(sc, UIO_READ, rv);
1390		splx(s);
1391		return rv;
1392	}
1393
1394	len = (buf[2] << 24) | (buf[3] << 16) | (buf[4] << 8) | buf[5];
1395#ifdef TPM_DEBUG
1396	printf("tpmread: len %d, io count %d\n", len, uio->uio_resid);
1397#endif
1398	if (len > uio->uio_resid) {
1399		rv = EIO;
1400		(sc->sc_end)(sc, UIO_READ, rv);
1401#ifdef TPM_DEBUG
1402		printf("tpmread: bad residual io count 0x%x\n", uio->uio_resid);
1403#endif
1404		splx(s);
1405		return rv;
1406	}
1407
1408	/* Copy out header. */
1409	if ((rv = uiomove((caddr_t)buf, cnt, uio))) {
1410		(sc->sc_end)(sc, UIO_READ, rv);
1411		splx(s);
1412		return rv;
1413	}
1414
1415	/* Get remaining part of the answer (if anything is left). */
1416	for (len -= cnt, p = buf, n = sizeof(buf); len > 0; p = buf, len -= n,
1417	    n = sizeof(buf)) {
1418		n = MIN(n, len);
1419#ifdef TPM_DEBUG
1420		printf("tpmread: n %d len %d\n", n, len);
1421#endif
1422		if ((rv = (sc->sc_read)(sc, p, n, NULL, TPM_PARAM_SIZE))) {
1423			(sc->sc_end)(sc, UIO_READ, rv);
1424			splx(s);
1425			return rv;
1426		}
1427		p += n;
1428		if ((rv = uiomove((caddr_t)buf, p - buf, uio))) {
1429			(sc->sc_end)(sc, UIO_READ, rv);
1430			splx(s);
1431			return rv;
1432		}
1433	}
1434
1435	rv = (sc->sc_end)(sc, UIO_READ, rv);
1436	splx(s);
1437	return rv;
1438}
1439
1440int
1441#ifdef __FreeBSD__
1442tpmwrite(struct cdev *dev, struct uio *uio, int flags)
1443#else
1444tpmwrite(dev_t dev, struct uio *uio, int flags)
1445#endif
1446{
1447	struct tpm_softc *sc = TPMSOFTC(dev);
1448	u_int8_t buf[TPM_BUFSIZ];
1449	int n, rv, s;
1450
1451	if (!sc)
1452		return ENXIO;
1453
1454	s = spltty();
1455
1456#ifdef TPM_DEBUG
1457	printf("tpmwrite: io count %d\n", uio->uio_resid);
1458#endif
1459
1460	n = MIN(sizeof(buf), uio->uio_resid);
1461	if ((rv = uiomove((caddr_t)buf, n, uio))) {
1462		splx(s);
1463		return rv;
1464	}
1465
1466	if ((rv = (sc->sc_start)(sc, UIO_WRITE))) {
1467		splx(s);
1468		return rv;
1469	}
1470
1471	if ((rv = (sc->sc_write(sc, buf, n)))) {
1472		splx(s);
1473		return rv;
1474	}
1475
1476	rv = (sc->sc_end)(sc, UIO_WRITE, rv);
1477	splx(s);
1478	return rv;
1479}
1480
1481int
1482#ifdef __FreeBSD__
1483tpmioctl(struct cdev *dev, u_long cmd, caddr_t data, int flags,
1484    struct thread *td)
1485#else
1486tpmioctl(dev_t dev, u_long cmd, caddr_t data, int flags, struct proc *p)
1487#endif
1488{
1489	return ENOTTY;
1490}
1491