xref: /freebsd/sys/dev/tpm/tpm.c (revision 63f537551380d2dab29fa402ad1269feae17e594)
1 /*
2  * Copyright (c) 2008, 2009 Michael Shalayeff
3  * Copyright (c) 2009, 2010 Hans-Joerg Hoexer
4  * All rights reserved.
5  *
6  * Permission to use, copy, modify, and distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF MIND, USE, DATA OR PROFITS, WHETHER IN
15  * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
16  * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18 
19 /* #define	TPM_DEBUG */
20 
21 #include <sys/cdefs.h>
22 #include <sys/param.h>
23 #include <sys/systm.h>
24 #include <sys/kernel.h>
25 #include <sys/malloc.h>
26 #include <sys/proc.h>
27 
28 #include <sys/module.h>
29 #include <sys/conf.h>
30 #include <sys/uio.h>
31 #include <sys/bus.h>
32 
33 #include <machine/bus.h>
34 #include <sys/rman.h>
35 #include <machine/resource.h>
36 
37 #include <machine/md_var.h>
38 
39 #include <isa/isareg.h>
40 #include <isa/isavar.h>
41 #include <dev/tpm/tpmvar.h>
42 
43 
44 #define	TPM_BUFSIZ	1024
45 
46 #define TPM_HDRSIZE	10
47 
48 #define TPM_PARAM_SIZE	0x0001
49 
50 #define IRQUNK	-1
51 
52 #define	TPM_ACCESS			0x0000	/* access register */
53 #define	TPM_ACCESS_ESTABLISHMENT	0x01	/* establishment */
54 #define	TPM_ACCESS_REQUEST_USE		0x02	/* request using locality */
55 #define	TPM_ACCESS_REQUEST_PENDING	0x04	/* pending request */
56 #define	TPM_ACCESS_SEIZE		0x08	/* request locality seize */
57 #define	TPM_ACCESS_SEIZED		0x10	/* locality has been seized */
58 #define	TPM_ACCESS_ACTIVE_LOCALITY	0x20	/* locality is active */
59 #define	TPM_ACCESS_VALID		0x80	/* bits are valid */
60 #define	TPM_ACCESS_BITS	\
61     "\020\01EST\02REQ\03PEND\04SEIZE\05SEIZED\06ACT\010VALID"
62 
63 #define	TPM_INTERRUPT_ENABLE	0x0008
64 #define	TPM_GLOBAL_INT_ENABLE	0x80000000	/* enable ints */
65 #define	TPM_CMD_READY_INT	0x00000080	/* cmd ready enable */
66 #define	TPM_INT_EDGE_FALLING	0x00000018
67 #define	TPM_INT_EDGE_RISING	0x00000010
68 #define	TPM_INT_LEVEL_LOW	0x00000008
69 #define	TPM_INT_LEVEL_HIGH	0x00000000
70 #define	TPM_LOCALITY_CHANGE_INT	0x00000004	/* locality change enable */
71 #define	TPM_STS_VALID_INT	0x00000002	/* int on TPM_STS_VALID is set */
72 #define	TPM_DATA_AVAIL_INT	0x00000001	/* int on TPM_STS_DATA_AVAIL is set */
73 #define	TPM_INTERRUPT_ENABLE_BITS \
74     "\020\040ENA\010RDY\03LOCH\02STSV\01DRDY"
75 
76 #define	TPM_INT_VECTOR		0x000c	/* 8 bit reg for 4 bit irq vector */
77 #define	TPM_INT_STATUS		0x0010	/* bits are & 0x87 from TPM_INTERRUPT_ENABLE */
78 
79 #define	TPM_INTF_CAPABILITIES		0x0014	/* capability register */
80 #define	TPM_INTF_BURST_COUNT_STATIC	0x0100	/* TPM_STS_BMASK static */
81 #define	TPM_INTF_CMD_READY_INT		0x0080	/* int on ready supported */
82 #define	TPM_INTF_INT_EDGE_FALLING	0x0040	/* falling edge ints supported */
83 #define	TPM_INTF_INT_EDGE_RISING	0x0020	/* rising edge ints supported */
84 #define	TPM_INTF_INT_LEVEL_LOW		0x0010	/* level-low ints supported */
85 #define	TPM_INTF_INT_LEVEL_HIGH		0x0008	/* level-high ints supported */
86 #define	TPM_INTF_LOCALITY_CHANGE_INT	0x0004	/* locality-change int (mb 1) */
87 #define	TPM_INTF_STS_VALID_INT		0x0002	/* TPM_STS_VALID int supported */
88 #define	TPM_INTF_DATA_AVAIL_INT		0x0001	/* TPM_STS_DATA_AVAIL int supported (mb 1) */
89 #define	TPM_CAPSREQ \
90   (TPM_INTF_DATA_AVAIL_INT|TPM_INTF_LOCALITY_CHANGE_INT|TPM_INTF_INT_LEVEL_LOW)
91 #define	TPM_CAPBITS \
92   "\020\01IDRDY\02ISTSV\03ILOCH\04IHIGH\05ILOW\06IEDGE\07IFALL\010IRDY\011BCST"
93 
94 #define	TPM_STS			0x0018		/* status register */
95 #define TPM_STS_MASK		0x000000ff	/* status bits */
96 #define	TPM_STS_BMASK		0x00ffff00	/* ro io burst size */
97 #define	TPM_STS_VALID		0x00000080	/* ro other bits are valid */
98 #define	TPM_STS_CMD_READY	0x00000040	/* rw chip/signal ready */
99 #define	TPM_STS_GO		0x00000020	/* wo start the command */
100 #define	TPM_STS_DATA_AVAIL	0x00000010	/* ro data available */
101 #define	TPM_STS_DATA_EXPECT	0x00000008	/* ro more data to be written */
102 #define	TPM_STS_RESP_RETRY	0x00000002	/* wo resend the response */
103 #define	TPM_STS_BITS	"\020\010VALID\07RDY\06GO\05DRDY\04EXPECT\02RETRY"
104 
105 #define	TPM_DATA	0x0024
106 #define	TPM_ID		0x0f00
107 #define	TPM_REV		0x0f04
108 #define	TPM_SIZE	0x5000		/* five pages of the above */
109 
110 #define	TPM_ACCESS_TMO	2000		/* 2sec */
111 #define	TPM_READY_TMO	2000		/* 2sec */
112 #define	TPM_READ_TMO	120000		/* 2 minutes */
113 #define TPM_BURST_TMO	2000		/* 2sec */
114 
115 #define	TPM_LEGACY_BUSY	0x01
116 #define	TPM_LEGACY_ABRT	0x01
117 #define	TPM_LEGACY_DA	0x02
118 #define	TPM_LEGACY_RE	0x04
119 #define	TPM_LEGACY_LAST	0x04
120 #define	TPM_LEGACY_BITS	"\020\01BUSY\2DA\3RE\4LAST"
121 #define	TPM_LEGACY_TMO		(2*60)	/* sec */
122 #define	TPM_LEGACY_SLEEP	5	/* ticks */
123 #define	TPM_LEGACY_DELAY	100
124 
125 /* Set when enabling legacy interface in host bridge. */
126 int tpm_enabled;
127 
128 #define	TPMSOFTC(dev) \
129 	((struct tpm_softc *)dev->si_drv1)
130 
131 d_open_t	tpmopen;
132 d_close_t	tpmclose;
133 d_read_t	tpmread;
134 d_write_t	tpmwrite;
135 d_ioctl_t	tpmioctl;
136 
137 static struct cdevsw tpm_cdevsw = {
138 	.d_version =	D_VERSION,
139 	.d_flags =	D_NEEDGIANT,
140 	.d_open =	tpmopen,
141 	.d_close =	tpmclose,
142 	.d_read =	tpmread,
143 	.d_write =	tpmwrite,
144 	.d_ioctl =	tpmioctl,
145 	.d_name =	"tpm",
146 };
147 
148 const struct {
149 	u_int32_t devid;
150 	char name[32];
151 	int flags;
152 #define TPM_DEV_NOINTS	0x0001
153 } tpm_devs[] = {
154 	{ 0x000615d1, "IFX SLD 9630 TT 1.1", 0 },
155 	{ 0x000b15d1, "IFX SLB 9635 TT 1.2", 0 },
156 	{ 0x100214e4, "Broadcom BCM0102", TPM_DEV_NOINTS },
157 	{ 0x00fe1050, "WEC WPCT200", 0 },
158 	{ 0x687119fa, "SNS SSX35", 0 },
159 	{ 0x2e4d5453, "STM ST19WP18", 0 },
160 	{ 0x32021114, "ATML 97SC3203", TPM_DEV_NOINTS },
161 	{ 0x10408086, "INTEL INTC0102", 0 },
162 	{ 0, "", TPM_DEV_NOINTS },
163 };
164 
165 int tpm_tis12_irqinit(struct tpm_softc *, int, int);
166 int tpm_tis12_init(struct tpm_softc *, int, const char *);
167 int tpm_tis12_start(struct tpm_softc *, int);
168 int tpm_tis12_read(struct tpm_softc *, void *, int, size_t *, int);
169 int tpm_tis12_write(struct tpm_softc *, void *, int);
170 int tpm_tis12_end(struct tpm_softc *, int, int);
171 
172 void tpm_intr(void *);
173 
174 int tpm_waitfor_poll(struct tpm_softc *, u_int8_t, int, void *);
175 int tpm_waitfor_int(struct tpm_softc *, u_int8_t, int, void *, int);
176 int tpm_waitfor(struct tpm_softc *, u_int8_t, int, void *);
177 int tpm_request_locality(struct tpm_softc *, int);
178 int tpm_getburst(struct tpm_softc *);
179 u_int8_t tpm_status(struct tpm_softc *);
180 int tpm_tmotohz(int);
181 
182 int tpm_legacy_probe(bus_space_tag_t, bus_addr_t);
183 int tpm_legacy_init(struct tpm_softc *, int, const char *);
184 int tpm_legacy_start(struct tpm_softc *, int);
185 int tpm_legacy_read(struct tpm_softc *, void *, int, size_t *, int);
186 int tpm_legacy_write(struct tpm_softc *, void *, int);
187 int tpm_legacy_end(struct tpm_softc *, int, int);
188 
189 
190 /*
191  * FreeBSD specific code for probing and attaching TPM to device tree.
192  */
193 #if 0
194 static void
195 tpm_identify(driver_t *driver, device_t parent)
196 {
197 	BUS_ADD_CHILD(parent, ISA_ORDER_SPECULATIVE, "tpm", 0);
198 }
199 #endif
200 
201 int
202 tpm_attach(device_t dev)
203 {
204 	struct tpm_softc *sc = device_get_softc(dev);
205 	int irq;
206 
207 	sc->mem_rid = 0;
208 	sc->mem_res = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &sc->mem_rid,
209 	    RF_ACTIVE);
210 	if (sc->mem_res == NULL)
211 		return ENXIO;
212 
213 	sc->sc_bt = rman_get_bustag(sc->mem_res);
214 	sc->sc_bh = rman_get_bushandle(sc->mem_res);
215 
216 	sc->irq_rid = 0;
217 	sc->irq_res = bus_alloc_resource_any(dev, SYS_RES_IRQ, &sc->irq_rid,
218 	    RF_ACTIVE | RF_SHAREABLE);
219 	if (sc->irq_res != NULL)
220 		irq = rman_get_start(sc->irq_res);
221 	else
222 		irq = IRQUNK;
223 
224 	/* In case PnP probe this may contain some initialization. */
225 	tpm_tis12_probe(sc->sc_bt, sc->sc_bh);
226 
227 	if (tpm_legacy_probe(sc->sc_bt, sc->sc_bh)) {
228 		sc->sc_init = tpm_legacy_init;
229 		sc->sc_start = tpm_legacy_start;
230 		sc->sc_read = tpm_legacy_read;
231 		sc->sc_write = tpm_legacy_write;
232 		sc->sc_end = tpm_legacy_end;
233 	} else {
234 		sc->sc_init = tpm_tis12_init;
235 		sc->sc_start = tpm_tis12_start;
236 		sc->sc_read = tpm_tis12_read;
237 		sc->sc_write = tpm_tis12_write;
238 		sc->sc_end = tpm_tis12_end;
239 	}
240 
241 	printf("%s", device_get_name(dev));
242 	if ((sc->sc_init)(sc, irq, "tpm")) {
243 		tpm_detach(dev);
244 		return ENXIO;
245 	}
246 
247 	if (sc->sc_init == tpm_tis12_init && sc->irq_res != NULL &&
248 	    bus_setup_intr(dev, sc->irq_res, INTR_TYPE_TTY, NULL,
249 	    tpm_intr, sc, &sc->intr_cookie) != 0) {
250 		tpm_detach(dev);
251 		printf(": cannot establish interrupt\n");
252 		return 1;
253 	}
254 
255 	sc->sc_cdev = make_dev(&tpm_cdevsw, device_get_unit(dev),
256 			    UID_ROOT, GID_WHEEL, 0600, "tpm");
257 	sc->sc_cdev->si_drv1 = sc;
258 
259 	return 0;
260 }
261 
262 int
263 tpm_detach(device_t dev)
264 {
265 	struct tpm_softc * sc = device_get_softc(dev);
266 
267 	if(sc->intr_cookie){
268 		bus_teardown_intr(dev, sc->irq_res, sc->intr_cookie);
269 	}
270 
271 	if(sc->mem_res){
272 		bus_release_resource(dev, SYS_RES_MEMORY,
273 				     sc->mem_rid, sc->mem_res);
274 	}
275 
276 	if(sc->irq_res){
277 		bus_release_resource(dev, SYS_RES_IRQ,
278 				     sc->irq_rid, sc->irq_res);
279 	}
280 	if(sc->sc_cdev){
281 		destroy_dev(sc->sc_cdev);
282 	}
283 
284 	return 0;
285 }
286 
287 
288 /* Probe TPM using TIS 1.2 interface. */
289 int
290 tpm_tis12_probe(bus_space_tag_t bt, bus_space_handle_t bh)
291 {
292 	u_int32_t r;
293 	u_int8_t save, reg;
294 
295 	r = bus_space_read_4(bt, bh, TPM_INTF_CAPABILITIES);
296 	if (r == 0xffffffff)
297 		return 0;
298 
299 #ifdef TPM_DEBUG
300 	printf("tpm: caps=%b\n", r, TPM_CAPBITS);
301 #endif
302 	if ((r & TPM_CAPSREQ) != TPM_CAPSREQ ||
303 	    !(r & (TPM_INTF_INT_EDGE_RISING | TPM_INTF_INT_LEVEL_LOW))) {
304 #ifdef TPM_DEBUG
305 		printf("tpm: caps too low (caps=%b)\n", r, TPM_CAPBITS);
306 #endif
307 		return 0;
308 	}
309 
310 	save = bus_space_read_1(bt, bh, TPM_ACCESS);
311 	bus_space_write_1(bt, bh, TPM_ACCESS, TPM_ACCESS_REQUEST_USE);
312 	reg = bus_space_read_1(bt, bh, TPM_ACCESS);
313 	if ((reg & TPM_ACCESS_VALID) && (reg & TPM_ACCESS_ACTIVE_LOCALITY) &&
314 	    bus_space_read_4(bt, bh, TPM_ID) != 0xffffffff)
315 		return 1;
316 
317 	bus_space_write_1(bt, bh, TPM_ACCESS, save);
318 	return 0;
319 }
320 
321 /*
322  * Setup interrupt vector if one is provided and interrupts are know to
323  * work on that particular chip.
324  */
325 int
326 tpm_tis12_irqinit(struct tpm_softc *sc, int irq, int idx)
327 {
328 	u_int32_t r;
329 
330 	if ((irq == IRQUNK) || (tpm_devs[idx].flags & TPM_DEV_NOINTS)) {
331 		sc->sc_vector = IRQUNK;
332 		return 0;
333 	}
334 
335 	/* Ack and disable all interrupts. */
336 	bus_space_write_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE,
337 	    bus_space_read_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE) &
338 	    ~TPM_GLOBAL_INT_ENABLE);
339 	bus_space_write_4(sc->sc_bt, sc->sc_bh, TPM_INT_STATUS,
340 	    bus_space_read_4(sc->sc_bt, sc->sc_bh, TPM_INT_STATUS));
341 
342 	/* Program interrupt vector. */
343 	bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_INT_VECTOR, irq);
344 	sc->sc_vector = irq;
345 
346 	/* Program interrupt type. */
347 	if (sc->sc_capabilities & TPM_INTF_INT_EDGE_RISING)
348 		r = TPM_INT_EDGE_RISING;
349 	else if (sc->sc_capabilities & TPM_INTF_INT_LEVEL_HIGH)
350 		r = TPM_INT_LEVEL_HIGH;
351 	else
352 		r = TPM_INT_LEVEL_LOW;
353 	bus_space_write_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE, r);
354 
355 	return 0;
356 }
357 
358 /* Setup TPM using TIS 1.2 interface. */
359 int
360 tpm_tis12_init(struct tpm_softc *sc, int irq, const char *name)
361 {
362 	u_int32_t r;
363 	int i;
364 
365 	r = bus_space_read_4(sc->sc_bt, sc->sc_bh, TPM_INTF_CAPABILITIES);
366 #ifdef TPM_DEBUG
367 	printf(" caps=%b ", r, TPM_CAPBITS);
368 #endif
369 	if ((r & TPM_CAPSREQ) != TPM_CAPSREQ ||
370 	    !(r & (TPM_INTF_INT_EDGE_RISING | TPM_INTF_INT_LEVEL_LOW))) {
371 		printf(": capabilities too low (caps=%b)\n", r, TPM_CAPBITS);
372 		return 1;
373 	}
374 	sc->sc_capabilities = r;
375 
376 	sc->sc_devid = bus_space_read_4(sc->sc_bt, sc->sc_bh, TPM_ID);
377 	sc->sc_rev = bus_space_read_1(sc->sc_bt, sc->sc_bh, TPM_REV);
378 
379 	for (i = 0; tpm_devs[i].devid; i++)
380 		if (tpm_devs[i].devid == sc->sc_devid)
381 			break;
382 
383 	if (tpm_devs[i].devid)
384 		printf(": %s rev 0x%x\n", tpm_devs[i].name, sc->sc_rev);
385 	else
386 		printf(": device 0x%08x rev 0x%x\n", sc->sc_devid, sc->sc_rev);
387 
388 	if (tpm_tis12_irqinit(sc, irq, i))
389 		return 1;
390 
391 	if (tpm_request_locality(sc, 0))
392 		return 1;
393 
394 	/* Abort whatever it thought it was doing. */
395 	bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_STS, TPM_STS_CMD_READY);
396 
397 	return 0;
398 }
399 
400 int
401 tpm_request_locality(struct tpm_softc *sc, int l)
402 {
403 	u_int32_t r;
404 	int to, rv;
405 
406 	if (l != 0)
407 		return EINVAL;
408 
409 	if ((bus_space_read_1(sc->sc_bt, sc->sc_bh, TPM_ACCESS) &
410 	    (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY)) ==
411 	    (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY))
412 		return 0;
413 
414 	bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_ACCESS,
415 	    TPM_ACCESS_REQUEST_USE);
416 
417 	to = tpm_tmotohz(TPM_ACCESS_TMO);
418 
419 	while ((r = bus_space_read_1(sc->sc_bt, sc->sc_bh, TPM_ACCESS) &
420 	    (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY)) !=
421 	    (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY) && to--) {
422 		rv = tsleep(sc->sc_init, PRIBIO | PCATCH, "tpm_locality", 1);
423 		if (rv &&  rv != EWOULDBLOCK) {
424 #ifdef TPM_DEBUG
425 			printf("tpm_request_locality: interrupted %d\n", rv);
426 #endif
427 			return rv;
428 		}
429 	}
430 
431 	if ((r & (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY)) !=
432 	    (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY)) {
433 #ifdef TPM_DEBUG
434 		printf("tpm_request_locality: access %b\n", r, TPM_ACCESS_BITS);
435 #endif
436 		return EBUSY;
437 	}
438 
439 	return 0;
440 }
441 
442 int
443 tpm_getburst(struct tpm_softc *sc)
444 {
445 	int burst, to, rv;
446 
447 	to = tpm_tmotohz(TPM_BURST_TMO);
448 
449 	burst = 0;
450 	while (burst == 0 && to--) {
451 		/*
452 		 * Burst count has to be read from bits 8 to 23 without
453 		 * touching any other bits, eg. the actual status bits 0
454 		 * to 7.
455 		 */
456 		burst = bus_space_read_1(sc->sc_bt, sc->sc_bh, TPM_STS + 1);
457 		burst |= bus_space_read_1(sc->sc_bt, sc->sc_bh, TPM_STS + 2)
458 		    << 8;
459 #ifdef TPM_DEBUG
460 		printf("tpm_getburst: read %d\n", burst);
461 #endif
462 		if (burst)
463 			return burst;
464 
465 		rv = tsleep(sc, PRIBIO | PCATCH, "tpm_getburst", 1);
466 		if (rv && rv != EWOULDBLOCK) {
467 			return 0;
468 		}
469 	}
470 
471 	return 0;
472 }
473 
474 u_int8_t
475 tpm_status(struct tpm_softc *sc)
476 {
477 	u_int8_t status;
478 
479 	status = bus_space_read_1(sc->sc_bt, sc->sc_bh, TPM_STS) &
480 	    TPM_STS_MASK;
481 
482 	return status;
483 }
484 
485 int
486 tpm_tmotohz(int tmo)
487 {
488 	struct timeval tv;
489 
490 	tv.tv_sec = tmo / 1000;
491 	tv.tv_usec = 1000 * (tmo % 1000);
492 
493 	return tvtohz(&tv);
494 }
495 
496 /* Save TPM state on suspend. */
497 int
498 tpm_suspend(device_t dev)
499 {
500 	struct tpm_softc *sc = device_get_softc(dev);
501 	int why = 1;
502 	u_int8_t command[] = {
503 	    0, 193,		/* TPM_TAG_RQU_COMMAND */
504 	    0, 0, 0, 10,	/* Length in bytes */
505 	    0, 0, 0, 156	/* TPM_ORD_SaveStates */
506 	};
507 
508 	/*
509 	 * Power down:  We have to issue the SaveStates command.
510 	 */
511 	sc->sc_write(sc, &command, sizeof(command));
512 	sc->sc_read(sc, &command, sizeof(command), NULL, TPM_HDRSIZE);
513 #ifdef TPM_DEBUG
514 	printf("tpm_suspend: power down: %d -> %d\n", sc->sc_suspend, why);
515 #endif
516 	sc->sc_suspend = why;
517 
518 	return 0;
519 }
520 
521 /*
522  * Handle resume event.  Actually nothing to do as the BIOS is supposed
523  * to restore the previously saved state.
524  */
525 int
526 tpm_resume(device_t dev)
527 {
528 	struct tpm_softc *sc = device_get_softc(dev);
529 	int why = 0;
530 #ifdef TPM_DEBUG
531 	printf("tpm_resume: resume: %d -> %d\n", sc->sc_suspend, why);
532 #endif
533 	sc->sc_suspend = why;
534 
535 	return 0;
536 }
537 
538 /* Dispatch suspend and resume events. */
539 
540 /* Wait for given status bits using polling. */
541 int
542 tpm_waitfor_poll(struct tpm_softc *sc, u_int8_t mask, int tmo, void *c)
543 {
544 	int rv;
545 
546 	/*
547 	 * Poll until either the requested condition or a time out is
548 	 * met.
549 	 */
550 	while (((sc->sc_stat = tpm_status(sc)) & mask) != mask && tmo--) {
551 		rv = tsleep(c, PRIBIO | PCATCH, "tpm_poll", 1);
552 		if (rv && rv != EWOULDBLOCK) {
553 #ifdef TPM_DEBUG
554 			printf("tpm_waitfor_poll: interrupted %d\n", rv);
555 #endif
556 			return rv;
557 		}
558 	}
559 
560 	return 0;
561 }
562 
563 /* Wait for given status bits using interrupts. */
564 int
565 tpm_waitfor_int(struct tpm_softc *sc, u_int8_t mask, int tmo, void *c,
566     int inttype)
567 {
568 	int rv, to;
569 
570 	/* Poll and return when condition is already met. */
571 	sc->sc_stat = tpm_status(sc);
572 	if ((sc->sc_stat & mask) == mask)
573 		return 0;
574 
575 	/*
576 	 * Enable interrupt on tpm chip.  Note that interrupts on our
577 	 * level (SPL_TTY) are disabled (see tpm{read,write} et al) and
578 	 * will not be delivered to the cpu until we call tsleep(9) below.
579 	 */
580 	bus_space_write_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE,
581 	    bus_space_read_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE) |
582 	    inttype);
583 	bus_space_write_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE,
584 	    bus_space_read_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE) |
585 	    TPM_GLOBAL_INT_ENABLE);
586 
587 	/*
588 	 * Poll once more to remedy the race between previous polling
589 	 * and enabling interrupts on the tpm chip.
590 	 */
591 	sc->sc_stat = tpm_status(sc);
592 	if ((sc->sc_stat & mask) == mask) {
593 		rv = 0;
594 		goto out;
595 	}
596 
597 	to = tpm_tmotohz(tmo);
598 #ifdef TPM_DEBUG
599 	printf("tpm_waitfor_int: sleeping for %d ticks on %p\n", to, c);
600 #endif
601 	/*
602 	 * tsleep(9) enables interrupts on the cpu and returns after
603 	 * wake up with interrupts disabled again.  Note that interrupts
604 	 * generated by the tpm chip while being at SPL_TTY are not lost
605 	 * but held and delivered as soon as the cpu goes below SPL_TTY.
606 	 */
607 	rv = tsleep(c, PRIBIO | PCATCH, "tpm_intr", to);
608 
609 	sc->sc_stat = tpm_status(sc);
610 #ifdef TPM_DEBUG
611 	printf("tpm_waitfor_int: woke up with rv %d stat %b\n", rv,
612 	    sc->sc_stat, TPM_STS_BITS);
613 #endif
614 	if ((sc->sc_stat & mask) == mask)
615 		rv = 0;
616 
617 	/* Disable interrupts on tpm chip again. */
618 out:	bus_space_write_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE,
619 	    bus_space_read_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE) &
620 	    ~TPM_GLOBAL_INT_ENABLE);
621 	bus_space_write_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE,
622 	    bus_space_read_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE) &
623 	    ~inttype);
624 
625 	return rv;
626 }
627 
628 /*
629  * Wait on given status bits, uses interrupts where possible, otherwise polls.
630  */
631 int
632 tpm_waitfor(struct tpm_softc *sc, u_int8_t b0, int tmo, void *c)
633 {
634 	u_int8_t b;
635 	int re, to, rv;
636 
637 #ifdef TPM_DEBUG
638 	printf("tpm_waitfor: b0 %b\n", b0, TPM_STS_BITS);
639 #endif
640 
641 	/*
642 	 * If possible, use interrupts, otherwise poll.
643 	 *
644 	 * We use interrupts for TPM_STS_VALID and TPM_STS_DATA_AVAIL (if
645 	 * the tpm chips supports them) as waiting for those can take
646 	 * really long.  The other TPM_STS* are not needed very often
647 	 * so we do not support them.
648 	 */
649 	if (sc->sc_vector != IRQUNK) {
650 		b = b0;
651 
652 		/*
653 		 * Wait for data ready.  This interrupt only occurs
654 		 * when both TPM_STS_VALID and TPM_STS_DATA_AVAIL are asserted.
655 		 * Thus we don't have to bother with TPM_STS_VALID
656 		 * separately and can just return.
657 		 *
658 		 * This only holds for interrupts!  When using polling
659 		 * both flags have to be waited for, see below.
660 		 */
661 		if ((b & TPM_STS_DATA_AVAIL) && (sc->sc_capabilities &
662 		    TPM_INTF_DATA_AVAIL_INT))
663 			return tpm_waitfor_int(sc, b, tmo, c,
664 			    TPM_DATA_AVAIL_INT);
665 
666 		/* Wait for status valid bit. */
667 		if ((b & TPM_STS_VALID) && (sc->sc_capabilities &
668 		    TPM_INTF_STS_VALID_INT)) {
669 			rv = tpm_waitfor_int(sc, b, tmo, c, TPM_STS_VALID_INT);
670 			if (rv != 0)
671 				return rv;
672 			else
673 				b = b0 & ~TPM_STS_VALID;
674 		}
675 
676 		/*
677 		 * When all flags are taken care of, return.  Otherwise
678 		 * use polling for eg. TPM_STS_CMD_READY.
679 		 */
680 		if (b == 0)
681 			return 0;
682 	}
683 
684 	re = 3;
685 restart:
686 	/*
687 	 * If requested wait for TPM_STS_VALID before dealing with
688 	 * any other flag.  Eg. when both TPM_STS_DATA_AVAIL and TPM_STS_VALID
689 	 * are requested, wait for the latter first.
690 	 */
691 	b = b0;
692 	if (b0 & TPM_STS_VALID)
693 		b = TPM_STS_VALID;
694 
695 	to = tpm_tmotohz(tmo);
696 again:
697 	if ((rv = tpm_waitfor_poll(sc, b, to, c)) != 0)
698 		return rv;
699 
700 	if ((b & sc->sc_stat) == TPM_STS_VALID) {
701 		/* Now wait for other flags. */
702 		b = b0 & ~TPM_STS_VALID;
703 		to++;
704 		goto again;
705 	}
706 
707 	if ((sc->sc_stat & b) != b) {
708 #ifdef TPM_DEBUG
709 		printf("tpm_waitfor: timeout: stat=%b b=%b\n",
710 		    sc->sc_stat, TPM_STS_BITS, b, TPM_STS_BITS);
711 #endif
712 		if (re-- && (b0 & TPM_STS_VALID)) {
713 			bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_STS,
714 			    TPM_STS_RESP_RETRY);
715 			goto restart;
716 		}
717 		return EIO;
718 	}
719 
720 	return 0;
721 }
722 
723 /* Start transaction. */
724 int
725 tpm_tis12_start(struct tpm_softc *sc, int flag)
726 {
727 	int rv;
728 
729 	if (flag == UIO_READ) {
730 		rv = tpm_waitfor(sc, TPM_STS_DATA_AVAIL | TPM_STS_VALID,
731 		    TPM_READ_TMO, sc->sc_read);
732 		return rv;
733 	}
734 
735 	/* Own our (0th) locality. */
736 	if ((rv = tpm_request_locality(sc, 0)) != 0)
737 		return rv;
738 
739 	sc->sc_stat = tpm_status(sc);
740 	if (sc->sc_stat & TPM_STS_CMD_READY) {
741 #ifdef TPM_DEBUG
742 		printf("tpm_tis12_start: UIO_WRITE status %b\n", sc->sc_stat,
743 		   TPM_STS_BITS);
744 #endif
745 		return 0;
746 	}
747 
748 #ifdef TPM_DEBUG
749 	printf("tpm_tis12_start: UIO_WRITE readying chip\n");
750 #endif
751 
752 	/* Abort previous and restart. */
753 	bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_STS, TPM_STS_CMD_READY);
754 	if ((rv = tpm_waitfor(sc, TPM_STS_CMD_READY, TPM_READY_TMO,
755 	    sc->sc_write))) {
756 #ifdef TPM_DEBUG
757 		printf("tpm_tis12_start: UIO_WRITE readying failed %d\n", rv);
758 #endif
759 		return rv;
760 	}
761 
762 #ifdef TPM_DEBUG
763 	printf("tpm_tis12_start: UIO_WRITE readying done\n");
764 #endif
765 
766 	return 0;
767 }
768 
769 int
770 tpm_tis12_read(struct tpm_softc *sc, void *buf, int len, size_t *count,
771     int flags)
772 {
773 	u_int8_t *p = buf;
774 	size_t cnt;
775 	int rv, n, bcnt;
776 
777 #ifdef TPM_DEBUG
778 	printf("tpm_tis12_read: len %d\n", len);
779 #endif
780 	cnt = 0;
781 	while (len > 0) {
782 		if ((rv = tpm_waitfor(sc, TPM_STS_DATA_AVAIL | TPM_STS_VALID,
783 		    TPM_READ_TMO, sc->sc_read)))
784 			return rv;
785 
786 		bcnt = tpm_getburst(sc);
787 		n = MIN(len, bcnt);
788 #ifdef TPM_DEBUG
789 		printf("tpm_tis12_read: fetching %d, burst is %d\n", n, bcnt);
790 #endif
791 		for (; n--; len--) {
792 			*p++ = bus_space_read_1(sc->sc_bt, sc->sc_bh, TPM_DATA);
793 			cnt++;
794 		}
795 
796 		if ((flags & TPM_PARAM_SIZE) == 0 && cnt >= 6)
797 			break;
798 	}
799 #ifdef TPM_DEBUG
800 	printf("tpm_tis12_read: read %zd bytes, len %d\n", cnt, len);
801 #endif
802 
803 	if (count)
804 		*count = cnt;
805 
806 	return 0;
807 }
808 
809 int
810 tpm_tis12_write(struct tpm_softc *sc, void *buf, int len)
811 {
812 	u_int8_t *p = buf;
813 	size_t cnt;
814 	int rv, r;
815 
816 #ifdef TPM_DEBUG
817 	printf("tpm_tis12_write: sc %p buf %p len %d\n", sc, buf, len);
818 #endif
819 
820 	if ((rv = tpm_request_locality(sc, 0)) != 0)
821 		return rv;
822 
823 	cnt = 0;
824 	while (cnt < len - 1) {
825 		for (r = tpm_getburst(sc); r > 0 && cnt < len - 1; r--) {
826 			bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_DATA, *p++);
827 			cnt++;
828 		}
829 		if ((rv = tpm_waitfor(sc, TPM_STS_VALID, TPM_READ_TMO, sc))) {
830 #ifdef TPM_DEBUG
831 			printf("tpm_tis12_write: failed burst rv %d\n", rv);
832 #endif
833 			return rv;
834 		}
835 		sc->sc_stat = tpm_status(sc);
836 		if (!(sc->sc_stat & TPM_STS_DATA_EXPECT)) {
837 #ifdef TPM_DEBUG
838 			printf("tpm_tis12_write: failed rv %d stat=%b\n", rv,
839 			    sc->sc_stat, TPM_STS_BITS);
840 #endif
841 			return EIO;
842 		}
843 	}
844 
845 	bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_DATA, *p++);
846 	cnt++;
847 
848 	if ((rv = tpm_waitfor(sc, TPM_STS_VALID, TPM_READ_TMO, sc))) {
849 #ifdef TPM_DEBUG
850 		printf("tpm_tis12_write: failed last byte rv %d\n", rv);
851 #endif
852 		return rv;
853 	}
854 	if ((sc->sc_stat & TPM_STS_DATA_EXPECT) != 0) {
855 #ifdef TPM_DEBUG
856 		printf("tpm_tis12_write: failed rv %d stat=%b\n", rv,
857 		    sc->sc_stat, TPM_STS_BITS);
858 #endif
859 		return EIO;
860 	}
861 
862 #ifdef TPM_DEBUG
863 	printf("tpm_tis12_write: wrote %d byte\n", cnt);
864 #endif
865 
866 	return 0;
867 }
868 
869 /* Finish transaction. */
870 int
871 tpm_tis12_end(struct tpm_softc *sc, int flag, int err)
872 {
873 	int rv = 0;
874 
875 	if (flag == UIO_READ) {
876 		if ((rv = tpm_waitfor(sc, TPM_STS_VALID, TPM_READ_TMO,
877 		    sc->sc_read)))
878 			return rv;
879 
880 		/* Still more data? */
881 		sc->sc_stat = tpm_status(sc);
882 		if (!err && ((sc->sc_stat & TPM_STS_DATA_AVAIL) == TPM_STS_DATA_AVAIL)) {
883 #ifdef TPM_DEBUG
884 			printf("tpm_tis12_end: read failed stat=%b\n",
885 			    sc->sc_stat, TPM_STS_BITS);
886 #endif
887 			rv = EIO;
888 		}
889 
890 		bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_STS,
891 		    TPM_STS_CMD_READY);
892 
893 		/* Release our (0th) locality. */
894 		bus_space_write_1(sc->sc_bt, sc->sc_bh,TPM_ACCESS,
895 		    TPM_ACCESS_ACTIVE_LOCALITY);
896 	} else {
897 		/* Hungry for more? */
898 		sc->sc_stat = tpm_status(sc);
899 		if (!err && (sc->sc_stat & TPM_STS_DATA_EXPECT)) {
900 #ifdef TPM_DEBUG
901 			printf("tpm_tis12_end: write failed stat=%b\n",
902 			    sc->sc_stat, TPM_STS_BITS);
903 #endif
904 			rv = EIO;
905 		}
906 
907 		bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_STS,
908 		    err ? TPM_STS_CMD_READY : TPM_STS_GO);
909 	}
910 
911 	return rv;
912 }
913 
914 void
915 tpm_intr(void *v)
916 {
917 	struct tpm_softc *sc = v;
918 	u_int32_t r;
919 #ifdef TPM_DEBUG
920 	static int cnt = 0;
921 #endif
922 
923 	r = bus_space_read_4(sc->sc_bt, sc->sc_bh, TPM_INT_STATUS);
924 #ifdef TPM_DEBUG
925 	if (r != 0)
926 		printf("tpm_intr: int=%b (%d)\n", r, TPM_INTERRUPT_ENABLE_BITS,
927 		    cnt);
928 	else
929 		cnt++;
930 #endif
931 	if (!(r & (TPM_CMD_READY_INT | TPM_LOCALITY_CHANGE_INT |
932 	    TPM_STS_VALID_INT | TPM_DATA_AVAIL_INT)))
933 		return;
934 	if (r & TPM_STS_VALID_INT)
935 		wakeup(sc);
936 
937 	if (r & TPM_CMD_READY_INT)
938 		wakeup(sc->sc_write);
939 
940 	if (r & TPM_DATA_AVAIL_INT)
941 		wakeup(sc->sc_read);
942 
943 	if (r & TPM_LOCALITY_CHANGE_INT)
944 		wakeup(sc->sc_init);
945 
946 	bus_space_write_4(sc->sc_bt, sc->sc_bh, TPM_INT_STATUS, r);
947 
948 	return;
949 }
950 
951 /* Read single byte using legacy interface. */
952 static inline u_int8_t
953 tpm_legacy_in(bus_space_tag_t iot, bus_space_handle_t ioh, int reg)
954 {
955 	bus_space_write_1(iot, ioh, 0, reg);
956 	return bus_space_read_1(iot, ioh, 1);
957 }
958 
959 #if 0
960 /* Write single byte using legacy interface. */
961 static inline void
962 tpm_legacy_out(bus_space_tag_t iot, bus_space_handle_t ioh, int reg, u_int8_t v)
963 {
964 	bus_space_write_1(iot, ioh, 0, reg);
965 	bus_space_write_1(iot, ioh, 1, v);
966 }
967 #endif
968 
969 /* Probe for TPM using legacy interface. */
970 int
971 tpm_legacy_probe(bus_space_tag_t iot, bus_addr_t iobase)
972 {
973 	bus_space_handle_t ioh;
974 	u_int8_t r, v;
975 	int i, rv = 0;
976 	char id[8];
977 
978 	if (!tpm_enabled || iobase == -1)
979 		return 0;
980 
981 	if (bus_space_map(iot, iobase, 2, 0, &ioh))
982 		return 0;
983 
984 	v = bus_space_read_1(iot, ioh, 0);
985 	if (v == 0xff) {
986 		bus_space_unmap(iot, ioh, 2);
987 		return 0;
988 	}
989 	r = bus_space_read_1(iot, ioh, 1);
990 
991 	for (i = sizeof(id); i--; )
992 		id[i] = tpm_legacy_in(iot, ioh, TPM_ID + i);
993 
994 #ifdef TPM_DEBUG
995 	printf("tpm_legacy_probe %.4s %d.%d.%d.%d\n",
996 	    &id[4], id[0], id[1], id[2], id[3]);
997 #endif
998 	/*
999 	 * The only chips using the legacy interface we are aware of are
1000 	 * by Atmel.  For other chips more signature would have to be added.
1001 	 */
1002 	if (!bcmp(&id[4], "ATML", 4))
1003 		rv = 1;
1004 
1005 	if (!rv) {
1006 		bus_space_write_1(iot, ioh, r, 1);
1007 		bus_space_write_1(iot, ioh, v, 0);
1008 	}
1009 	bus_space_unmap(iot, ioh, 2);
1010 
1011 	return rv;
1012 }
1013 
1014 /* Setup TPM using legacy interface. */
1015 int
1016 tpm_legacy_init(struct tpm_softc *sc, int irq, const char *name)
1017 {
1018 	char id[8];
1019 	int i;
1020 
1021 	if ((i = bus_space_map(sc->sc_batm, tpm_enabled, 2, 0, &sc->sc_bahm))) {
1022 		printf(": cannot map tpm registers (%d)\n", i);
1023 		tpm_enabled = 0;
1024 		return 1;
1025 	}
1026 
1027 	for (i = sizeof(id); i--; )
1028 		id[i] = tpm_legacy_in(sc->sc_bt, sc->sc_bh, TPM_ID + i);
1029 
1030 	printf(": %.4s %d.%d @0x%x\n", &id[4], id[0], id[1], tpm_enabled);
1031 	tpm_enabled = 0;
1032 
1033 	return 0;
1034 }
1035 
1036 /* Start transaction. */
1037 int
1038 tpm_legacy_start(struct tpm_softc *sc, int flag)
1039 {
1040 	struct timeval tv;
1041 	u_int8_t bits, r;
1042 	int to, rv;
1043 
1044 	bits = flag == UIO_READ ? TPM_LEGACY_DA : 0;
1045 	tv.tv_sec = TPM_LEGACY_TMO;
1046 	tv.tv_usec = 0;
1047 	to = tvtohz(&tv) / TPM_LEGACY_SLEEP;
1048 	while (((r = bus_space_read_1(sc->sc_batm, sc->sc_bahm, 1)) &
1049 	    (TPM_LEGACY_BUSY|bits)) != bits && to--) {
1050 		rv = tsleep(sc, PRIBIO | PCATCH, "legacy_tpm_start",
1051 		    TPM_LEGACY_SLEEP);
1052 		if (rv && rv != EWOULDBLOCK)
1053 			return rv;
1054 	}
1055 
1056 	if ((r & (TPM_LEGACY_BUSY|bits)) != bits)
1057 		return EIO;
1058 
1059 	return 0;
1060 }
1061 
1062 int
1063 tpm_legacy_read(struct tpm_softc *sc, void *buf, int len, size_t *count,
1064     int flags)
1065 {
1066 	u_int8_t *p;
1067 	size_t cnt;
1068 	int to, rv;
1069 
1070 	cnt = rv = 0;
1071 	for (p = buf; !rv && len > 0; len--) {
1072 		for (to = 1000;
1073 		    !(bus_space_read_1(sc->sc_batm, sc->sc_bahm, 1) &
1074 		    TPM_LEGACY_DA); DELAY(1))
1075 			if (!to--)
1076 				return EIO;
1077 
1078 		DELAY(TPM_LEGACY_DELAY);
1079 		*p++ = bus_space_read_1(sc->sc_batm, sc->sc_bahm, 0);
1080 		cnt++;
1081 	}
1082 
1083 	*count = cnt;
1084 	return 0;
1085 }
1086 
1087 int
1088 tpm_legacy_write(struct tpm_softc *sc, void *buf, int len)
1089 {
1090 	u_int8_t *p;
1091 	int n;
1092 
1093 	for (p = buf, n = len; n--; DELAY(TPM_LEGACY_DELAY)) {
1094 		if (!n && len != TPM_BUFSIZ) {
1095 			bus_space_write_1(sc->sc_batm, sc->sc_bahm, 1,
1096 			    TPM_LEGACY_LAST);
1097 			DELAY(TPM_LEGACY_DELAY);
1098 		}
1099 		bus_space_write_1(sc->sc_batm, sc->sc_bahm, 0, *p++);
1100 	}
1101 
1102 	return 0;
1103 }
1104 
1105 /* Finish transaction. */
1106 int
1107 tpm_legacy_end(struct tpm_softc *sc, int flag, int rv)
1108 {
1109 	struct timeval tv;
1110 	u_int8_t r;
1111 	int to;
1112 
1113 	if (rv || flag == UIO_READ)
1114 		bus_space_write_1(sc->sc_batm, sc->sc_bahm, 1, TPM_LEGACY_ABRT);
1115 	else {
1116 		tv.tv_sec = TPM_LEGACY_TMO;
1117 		tv.tv_usec = 0;
1118 		to = tvtohz(&tv) / TPM_LEGACY_SLEEP;
1119 		while(((r = bus_space_read_1(sc->sc_batm, sc->sc_bahm, 1)) &
1120 		    TPM_LEGACY_BUSY) && to--) {
1121 			rv = tsleep(sc, PRIBIO | PCATCH, "legacy_tpm_end",
1122 			    TPM_LEGACY_SLEEP);
1123 			if (rv && rv != EWOULDBLOCK)
1124 				return rv;
1125 		}
1126 
1127 		if (r & TPM_LEGACY_BUSY)
1128 			return EIO;
1129 
1130 		if (r & TPM_LEGACY_RE)
1131 			return EIO;	/* XXX Retry the loop? */
1132 	}
1133 
1134 	return rv;
1135 }
1136 
1137 int
1138 tpmopen(struct cdev *dev, int flag, int mode, struct thread *td)
1139 {
1140 	struct tpm_softc *sc = TPMSOFTC(dev);
1141 
1142 	if (!sc)
1143 		return ENXIO;
1144 
1145 	if (sc->sc_flags & TPM_OPEN)
1146 		return EBUSY;
1147 
1148 	sc->sc_flags |= TPM_OPEN;
1149 
1150 	return 0;
1151 }
1152 
1153 int
1154 tpmclose(struct cdev *dev, int flag, int mode, struct thread *td)
1155 {
1156 	struct tpm_softc *sc = TPMSOFTC(dev);
1157 
1158 	if (!sc)
1159 		return ENXIO;
1160 
1161 	if (!(sc->sc_flags & TPM_OPEN))
1162 		return EINVAL;
1163 
1164 	sc->sc_flags &= ~TPM_OPEN;
1165 
1166 	return 0;
1167 }
1168 
1169 int
1170 tpmread(struct cdev *dev, struct uio *uio, int flags)
1171 {
1172 	struct tpm_softc *sc = TPMSOFTC(dev);
1173 	u_int8_t buf[TPM_BUFSIZ], *p;
1174 	size_t cnt;
1175 	int n, len, rv, s;
1176 
1177 	if (!sc)
1178 		return ENXIO;
1179 
1180 	s = spltty();
1181 	if ((rv = (sc->sc_start)(sc, UIO_READ))) {
1182 		splx(s);
1183 		return rv;
1184 	}
1185 
1186 #ifdef TPM_DEBUG
1187 	printf("tpmread: getting header\n");
1188 #endif
1189 	if ((rv = (sc->sc_read)(sc, buf, TPM_HDRSIZE, &cnt, 0))) {
1190 		(sc->sc_end)(sc, UIO_READ, rv);
1191 		splx(s);
1192 		return rv;
1193 	}
1194 
1195 	len = (buf[2] << 24) | (buf[3] << 16) | (buf[4] << 8) | buf[5];
1196 #ifdef TPM_DEBUG
1197 	printf("tpmread: len %d, io count %d\n", len, uio->uio_resid);
1198 #endif
1199 	if (len > uio->uio_resid) {
1200 		rv = EIO;
1201 		(sc->sc_end)(sc, UIO_READ, rv);
1202 #ifdef TPM_DEBUG
1203 		printf("tpmread: bad residual io count 0x%x\n", uio->uio_resid);
1204 #endif
1205 		splx(s);
1206 		return rv;
1207 	}
1208 
1209 	/* Copy out header. */
1210 	if ((rv = uiomove((caddr_t)buf, cnt, uio))) {
1211 		(sc->sc_end)(sc, UIO_READ, rv);
1212 		splx(s);
1213 		return rv;
1214 	}
1215 
1216 	/* Get remaining part of the answer (if anything is left). */
1217 	for (len -= cnt, p = buf, n = sizeof(buf); len > 0; p = buf, len -= n,
1218 	    n = sizeof(buf)) {
1219 		n = MIN(n, len);
1220 #ifdef TPM_DEBUG
1221 		printf("tpmread: n %d len %d\n", n, len);
1222 #endif
1223 		if ((rv = (sc->sc_read)(sc, p, n, NULL, TPM_PARAM_SIZE))) {
1224 			(sc->sc_end)(sc, UIO_READ, rv);
1225 			splx(s);
1226 			return rv;
1227 		}
1228 		p += n;
1229 		if ((rv = uiomove((caddr_t)buf, p - buf, uio))) {
1230 			(sc->sc_end)(sc, UIO_READ, rv);
1231 			splx(s);
1232 			return rv;
1233 		}
1234 	}
1235 
1236 	rv = (sc->sc_end)(sc, UIO_READ, rv);
1237 	splx(s);
1238 	return rv;
1239 }
1240 
1241 int
1242 tpmwrite(struct cdev *dev, struct uio *uio, int flags)
1243 {
1244 	struct tpm_softc *sc = TPMSOFTC(dev);
1245 	u_int8_t buf[TPM_BUFSIZ];
1246 	int n, rv, s;
1247 
1248 	if (!sc)
1249 		return ENXIO;
1250 
1251 	s = spltty();
1252 
1253 #ifdef TPM_DEBUG
1254 	printf("tpmwrite: io count %d\n", uio->uio_resid);
1255 #endif
1256 
1257 	n = MIN(sizeof(buf), uio->uio_resid);
1258 	if ((rv = uiomove((caddr_t)buf, n, uio))) {
1259 		splx(s);
1260 		return rv;
1261 	}
1262 
1263 	if ((rv = (sc->sc_start)(sc, UIO_WRITE))) {
1264 		splx(s);
1265 		return rv;
1266 	}
1267 
1268 	if ((rv = (sc->sc_write(sc, buf, n)))) {
1269 		splx(s);
1270 		return rv;
1271 	}
1272 
1273 	rv = (sc->sc_end)(sc, UIO_WRITE, rv);
1274 	splx(s);
1275 	return rv;
1276 }
1277 
1278 int
1279 tpmioctl(struct cdev *dev, u_long cmd, caddr_t data, int flags,
1280     struct thread *td)
1281 {
1282 	return ENOTTY;
1283 }
1284