xref: /freebsd/sys/dev/tpm/tpm.c (revision fcb560670601b2a4d87bb31d7531c8dcc37ee71b)
1 /*
2  * Copyright (c) 2008, 2009 Michael Shalayeff
3  * Copyright (c) 2009, 2010 Hans-Joerg Hoexer
4  * All rights reserved.
5  *
6  * Permission to use, copy, modify, and distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF MIND, USE, DATA OR PROFITS, WHETHER IN
15  * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
16  * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18 
19 /* #define	TPM_DEBUG */
20 
21 #include <sys/cdefs.h>
22 __FBSDID("$FreeBSD$");
23 
24 #include <sys/param.h>
25 #include <sys/systm.h>
26 #include <sys/kernel.h>
27 #include <sys/malloc.h>
28 #include <sys/proc.h>
29 
30 #ifdef __FreeBSD__
31 #include <sys/module.h>
32 #include <sys/conf.h>
33 #include <sys/uio.h>
34 #include <sys/bus.h>
35 
36 #include <machine/bus.h>
37 #include <sys/rman.h>
38 #include <machine/resource.h>
39 
40 #include <machine/md_var.h>
41 
42 #include <isa/isareg.h>
43 #include <isa/isavar.h>
44 #else
45 #include <sys/device.h>
46 
47 #include <machine/cpu.h>
48 #include <machine/bus.h>
49 #include <machine/intr.h>
50 #include <machine/conf.h>
51 
52 #include <dev/isa/isareg.h>
53 #include <dev/isa/isavar.h>
54 #endif
55 #include <dev/tpm/tpmvar.h>
56 
57 #ifndef __FreeBSD__
58 /* XXX horrible hack for tcsd (-lpthread) workaround on OpenBSD */
59 #undef PCATCH
60 #define PCATCH	0
61 #endif
62 
63 #define	TPM_BUFSIZ	1024
64 
65 #define TPM_HDRSIZE	10
66 
67 #define TPM_PARAM_SIZE	0x0001
68 
69 #ifdef __FreeBSD__
70 #define IRQUNK	-1
71 #endif
72 
73 #define	TPM_ACCESS			0x0000	/* acess register */
74 #define	TPM_ACCESS_ESTABLISHMENT	0x01	/* establishment */
75 #define	TPM_ACCESS_REQUEST_USE		0x02	/* request using locality */
76 #define	TPM_ACCESS_REQUEST_PENDING	0x04	/* pending request */
77 #define	TPM_ACCESS_SEIZE		0x08	/* request locality seize */
78 #define	TPM_ACCESS_SEIZED		0x10	/* locality has been seized */
79 #define	TPM_ACCESS_ACTIVE_LOCALITY	0x20	/* locality is active */
80 #define	TPM_ACCESS_VALID		0x80	/* bits are valid */
81 #define	TPM_ACCESS_BITS	\
82     "\020\01EST\02REQ\03PEND\04SEIZE\05SEIZED\06ACT\010VALID"
83 
84 #define	TPM_INTERRUPT_ENABLE	0x0008
85 #define	TPM_GLOBAL_INT_ENABLE	0x80000000	/* enable ints */
86 #define	TPM_CMD_READY_INT	0x00000080	/* cmd ready enable */
87 #define	TPM_INT_EDGE_FALLING	0x00000018
88 #define	TPM_INT_EDGE_RISING	0x00000010
89 #define	TPM_INT_LEVEL_LOW	0x00000008
90 #define	TPM_INT_LEVEL_HIGH	0x00000000
91 #define	TPM_LOCALITY_CHANGE_INT	0x00000004	/* locality change enable */
92 #define	TPM_STS_VALID_INT	0x00000002	/* int on TPM_STS_VALID is set */
93 #define	TPM_DATA_AVAIL_INT	0x00000001	/* int on TPM_STS_DATA_AVAIL is set */
94 #define	TPM_INTERRUPT_ENABLE_BITS \
95     "\020\040ENA\010RDY\03LOCH\02STSV\01DRDY"
96 
97 #define	TPM_INT_VECTOR		0x000c	/* 8 bit reg for 4 bit irq vector */
98 #define	TPM_INT_STATUS		0x0010	/* bits are & 0x87 from TPM_INTERRUPT_ENABLE */
99 
100 #define	TPM_INTF_CAPABILITIES		0x0014	/* capability register */
101 #define	TPM_INTF_BURST_COUNT_STATIC	0x0100	/* TPM_STS_BMASK static */
102 #define	TPM_INTF_CMD_READY_INT		0x0080	/* int on ready supported */
103 #define	TPM_INTF_INT_EDGE_FALLING	0x0040	/* falling edge ints supported */
104 #define	TPM_INTF_INT_EDGE_RISING	0x0020	/* rising edge ints supported */
105 #define	TPM_INTF_INT_LEVEL_LOW		0x0010	/* level-low ints supported */
106 #define	TPM_INTF_INT_LEVEL_HIGH		0x0008	/* level-high ints supported */
107 #define	TPM_INTF_LOCALITY_CHANGE_INT	0x0004	/* locality-change int (mb 1) */
108 #define	TPM_INTF_STS_VALID_INT		0x0002	/* TPM_STS_VALID int supported */
109 #define	TPM_INTF_DATA_AVAIL_INT		0x0001	/* TPM_STS_DATA_AVAIL int supported (mb 1) */
110 #define	TPM_CAPSREQ \
111   (TPM_INTF_DATA_AVAIL_INT|TPM_INTF_LOCALITY_CHANGE_INT|TPM_INTF_INT_LEVEL_LOW)
112 #define	TPM_CAPBITS \
113   "\020\01IDRDY\02ISTSV\03ILOCH\04IHIGH\05ILOW\06IEDGE\07IFALL\010IRDY\011BCST"
114 
115 #define	TPM_STS			0x0018		/* status register */
116 #define TPM_STS_MASK		0x000000ff	/* status bits */
117 #define	TPM_STS_BMASK		0x00ffff00	/* ro io burst size */
118 #define	TPM_STS_VALID		0x00000080	/* ro other bits are valid */
119 #define	TPM_STS_CMD_READY	0x00000040	/* rw chip/signal ready */
120 #define	TPM_STS_GO		0x00000020	/* wo start the command */
121 #define	TPM_STS_DATA_AVAIL	0x00000010	/* ro data available */
122 #define	TPM_STS_DATA_EXPECT	0x00000008	/* ro more data to be written */
123 #define	TPM_STS_RESP_RETRY	0x00000002	/* wo resend the response */
124 #define	TPM_STS_BITS	"\020\010VALID\07RDY\06GO\05DRDY\04EXPECT\02RETRY"
125 
126 #define	TPM_DATA	0x0024
127 #define	TPM_ID		0x0f00
128 #define	TPM_REV		0x0f04
129 #define	TPM_SIZE	0x5000		/* five pages of the above */
130 
131 #define	TPM_ACCESS_TMO	2000		/* 2sec */
132 #define	TPM_READY_TMO	2000		/* 2sec */
133 #define	TPM_READ_TMO	120000		/* 2 minutes */
134 #define TPM_BURST_TMO	2000		/* 2sec */
135 
136 #define	TPM_LEGACY_BUSY	0x01
137 #define	TPM_LEGACY_ABRT	0x01
138 #define	TPM_LEGACY_DA	0x02
139 #define	TPM_LEGACY_RE	0x04
140 #define	TPM_LEGACY_LAST	0x04
141 #define	TPM_LEGACY_BITS	"\020\01BUSY\2DA\3RE\4LAST"
142 #define	TPM_LEGACY_TMO		(2*60)	/* sec */
143 #define	TPM_LEGACY_SLEEP	5	/* ticks */
144 #define	TPM_LEGACY_DELAY	100
145 
146 /* Set when enabling legacy interface in host bridge. */
147 int tpm_enabled;
148 
149 
150 #ifdef __FreeBSD__
151 #define	TPMSOFTC(dev) \
152 	((struct tpm_softc *)dev->si_drv1)
153 
154 d_open_t	tpmopen;
155 d_close_t	tpmclose;
156 d_read_t	tpmread;
157 d_write_t	tpmwrite;
158 d_ioctl_t	tpmioctl;
159 
160 static struct cdevsw tpm_cdevsw = {
161 	.d_version =	D_VERSION,
162 	.d_flags =	D_NEEDGIANT,
163 	.d_open =	tpmopen,
164 	.d_close =	tpmclose,
165 	.d_read =	tpmread,
166 	.d_write =	tpmwrite,
167 	.d_ioctl =	tpmioctl,
168 	.d_name =	"tpm",
169 };
170 #else
171 #define	TPMSOFTC(dev) \
172     (struct tpm_softc *)device_lookup(&tpm_cd, minor(dev))
173 
174 struct cfdriver tpm_cd = {
175 	NULL, "tpm", DV_DULL
176 };
177 
178 int	tpm_match(struct device *, void *, void *);
179 void	tpm_attach(struct device *, struct device *, void *);
180 
181 struct cfattach tpm_ca = {
182 	sizeof(struct tpm_softc), tpm_match, tpm_attach
183 };
184 #endif
185 
186 const struct {
187 	u_int32_t devid;
188 	char name[32];
189 	int flags;
190 #define TPM_DEV_NOINTS	0x0001
191 } tpm_devs[] = {
192 	{ 0x000615d1, "IFX SLD 9630 TT 1.1", 0 },
193 	{ 0x000b15d1, "IFX SLB 9635 TT 1.2", 0 },
194 	{ 0x100214e4, "Broadcom BCM0102", TPM_DEV_NOINTS },
195 	{ 0x00fe1050, "WEC WPCT200", 0 },
196 	{ 0x687119fa, "SNS SSX35", 0 },
197 	{ 0x2e4d5453, "STM ST19WP18", 0 },
198 	{ 0x32021114, "ATML 97SC3203", TPM_DEV_NOINTS },
199 	{ 0x10408086, "INTEL INTC0102", 0 },
200 	{ 0, "", TPM_DEV_NOINTS },
201 };
202 
203 int tpm_tis12_irqinit(struct tpm_softc *, int, int);
204 int tpm_tis12_init(struct tpm_softc *, int, const char *);
205 int tpm_tis12_start(struct tpm_softc *, int);
206 int tpm_tis12_read(struct tpm_softc *, void *, int, size_t *, int);
207 int tpm_tis12_write(struct tpm_softc *, void *, int);
208 int tpm_tis12_end(struct tpm_softc *, int, int);
209 
210 #ifdef __FreeBSD__
211 void tpm_intr(void *);
212 #else
213 int tpm_intr(void *);
214 void tpm_powerhook(int, void *);
215 int tpm_suspend(struct tpm_softc *, int);
216 int tpm_resume(struct tpm_softc *, int);
217 #endif
218 
219 int tpm_waitfor_poll(struct tpm_softc *, u_int8_t, int, void *);
220 int tpm_waitfor_int(struct tpm_softc *, u_int8_t, int, void *, int);
221 int tpm_waitfor(struct tpm_softc *, u_int8_t, int, void *);
222 int tpm_request_locality(struct tpm_softc *, int);
223 int tpm_getburst(struct tpm_softc *);
224 u_int8_t tpm_status(struct tpm_softc *);
225 int tpm_tmotohz(int);
226 
227 int tpm_legacy_probe(bus_space_tag_t, bus_addr_t);
228 int tpm_legacy_init(struct tpm_softc *, int, const char *);
229 int tpm_legacy_start(struct tpm_softc *, int);
230 int tpm_legacy_read(struct tpm_softc *, void *, int, size_t *, int);
231 int tpm_legacy_write(struct tpm_softc *, void *, int);
232 int tpm_legacy_end(struct tpm_softc *, int, int);
233 
234 #ifdef __FreeBSD__
235 
236 /*
237  * FreeBSD specific code for probing and attaching TPM to device tree.
238  */
239 #if 0
240 static void
241 tpm_identify(driver_t *driver, device_t parent)
242 {
243 	BUS_ADD_CHILD(parent, ISA_ORDER_SPECULATIVE, "tpm", 0);
244 }
245 #endif
246 
247 
248 int
249 tpm_attach(device_t dev)
250 {
251 	struct tpm_softc *sc = device_get_softc(dev);
252 	int irq;
253 
254 	sc->mem_rid = 0;
255 	sc->mem_res = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &sc->mem_rid,
256 	    RF_ACTIVE);
257 	if (sc->mem_res == NULL)
258 		return ENXIO;
259 
260 	sc->sc_bt = rman_get_bustag(sc->mem_res);
261 	sc->sc_bh = rman_get_bushandle(sc->mem_res);
262 
263 	sc->irq_rid = 0;
264 	sc->irq_res = bus_alloc_resource_any(dev, SYS_RES_IRQ, &sc->irq_rid,
265 	    RF_ACTIVE | RF_SHAREABLE);
266 	if (sc->irq_res != NULL)
267 		irq = rman_get_start(sc->irq_res);
268 	else
269 		irq = IRQUNK;
270 
271 	/* In case PnP probe this may contain some initialization. */
272 	tpm_tis12_probe(sc->sc_bt, sc->sc_bh);
273 
274 	if (tpm_legacy_probe(sc->sc_bt, sc->sc_bh)) {
275 		sc->sc_init = tpm_legacy_init;
276 		sc->sc_start = tpm_legacy_start;
277 		sc->sc_read = tpm_legacy_read;
278 		sc->sc_write = tpm_legacy_write;
279 		sc->sc_end = tpm_legacy_end;
280 	} else {
281 		sc->sc_init = tpm_tis12_init;
282 		sc->sc_start = tpm_tis12_start;
283 		sc->sc_read = tpm_tis12_read;
284 		sc->sc_write = tpm_tis12_write;
285 		sc->sc_end = tpm_tis12_end;
286 	}
287 
288 	printf("%s", device_get_name(dev));
289 	if ((sc->sc_init)(sc, irq, "tpm")) {
290 		tpm_detach(dev);
291 		return ENXIO;
292 	}
293 
294 	if (sc->sc_init == tpm_tis12_init && sc->irq_res != NULL &&
295 	    bus_setup_intr(dev, sc->irq_res, INTR_TYPE_TTY, NULL,
296 	    tpm_intr, sc, &sc->intr_cookie) != 0) {
297 		tpm_detach(dev);
298 		printf(": cannot establish interrupt\n");
299 		return 1;
300 	}
301 
302 	sc->sc_cdev = make_dev(&tpm_cdevsw, device_get_unit(dev),
303 			    UID_ROOT, GID_WHEEL, 0600, "tpm");
304 	sc->sc_cdev->si_drv1 = sc;
305 
306 	return 0;
307 }
308 
309 int
310 tpm_detach(device_t dev)
311 {
312 	struct tpm_softc * sc = device_get_softc(dev);
313 
314 	if(sc->intr_cookie){
315 		bus_teardown_intr(dev, sc->irq_res, sc->intr_cookie);
316 	}
317 
318 	if(sc->mem_res){
319 		bus_release_resource(dev, SYS_RES_MEMORY,
320 				     sc->mem_rid, sc->mem_res);
321 	}
322 
323 	if(sc->irq_res){
324 		bus_release_resource(dev, SYS_RES_IRQ,
325 				     sc->irq_rid, sc->irq_res);
326 	}
327 	if(sc->sc_cdev){
328 		destroy_dev(sc->sc_cdev);
329 	}
330 
331 	return 0;
332 }
333 
334 
335 #else
336 /*
337  * OpenBSD specific code for probing and attaching TPM to device tree.
338  */
339 int
340 tpm_match(struct device *parent, void *match, void *aux)
341 {
342 	struct isa_attach_args *ia = aux;
343 	struct cfdata *cf = match;
344 	bus_space_tag_t bt = ia->ia_memt;
345 	bus_space_handle_t bh;
346 	int rv;
347 
348 	/* There can be only one. */
349 	if (cf->cf_unit)
350 		return 0;
351 
352 	if (tpm_legacy_probe(ia->ia_iot, ia->ia_iobase)) {
353 		ia->ia_iosize = 2;
354 		return 1;
355 	}
356 
357 	if (ia->ia_maddr == -1)
358 		return 0;
359 
360 	if (bus_space_map(bt, ia->ia_maddr, TPM_SIZE, 0, &bh))
361 		return 0;
362 
363 	if ((rv = tpm_tis12_probe(bt, bh))) {
364 		ia->ia_iosize = 0;
365 		ia->ia_msize = TPM_SIZE;
366 	}
367 
368 	bus_space_unmap(bt, bh, TPM_SIZE);
369 	return rv;
370 }
371 
372 void
373 tpm_attach(struct device *parent, struct device *self, void *aux)
374 {
375 	struct tpm_softc *sc = (struct tpm_softc *)self;
376 	struct isa_attach_args *ia = aux;
377 	bus_addr_t iobase;
378 	bus_size_t size;
379 	int rv;
380 
381 	if (tpm_legacy_probe(ia->ia_iot, ia->ia_iobase)) {
382 		sc->sc_bt = ia->ia_iot;
383 		iobase = ia->ia_iobase;
384 		size = ia->ia_iosize;
385 		sc->sc_batm = ia->ia_iot;
386 		sc->sc_init = tpm_legacy_init;
387 		sc->sc_start = tpm_legacy_start;
388 		sc->sc_read = tpm_legacy_read;
389 		sc->sc_write = tpm_legacy_write;
390 		sc->sc_end = tpm_legacy_end;
391 	} else {
392 		sc->sc_bt = ia->ia_memt;
393 		iobase = ia->ia_maddr;
394 		size = TPM_SIZE;
395 		sc->sc_init = tpm_tis12_init;
396 		sc->sc_start = tpm_tis12_start;
397 		sc->sc_read = tpm_tis12_read;
398 		sc->sc_write = tpm_tis12_write;
399 		sc->sc_end = tpm_tis12_end;
400 	}
401 
402 	if (bus_space_map(sc->sc_bt, iobase, size, 0, &sc->sc_bh)) {
403 		printf(": cannot map registers\n");
404 		return;
405 	}
406 
407 	if ((rv = (sc->sc_init)(sc, ia->ia_irq, sc->sc_dev.dv_xname))) {
408 		bus_space_unmap(sc->sc_bt, sc->sc_bh, size);
409 		return;
410 	}
411 
412 	/*
413 	 * Only setup interrupt handler when we have a vector and the
414 	 * chip is TIS 1.2 compliant.
415 	 */
416 	if (sc->sc_init == tpm_tis12_init && ia->ia_irq != IRQUNK &&
417 	    (sc->sc_ih = isa_intr_establish(ia->ia_ic, ia->ia_irq, IST_EDGE,
418 	    IPL_TTY, tpm_intr, sc, sc->sc_dev.dv_xname)) == NULL) {
419 		bus_space_unmap(sc->sc_bt, sc->sc_bh, TPM_SIZE);
420 		printf("%s: cannot establish interrupt\n",
421 		    sc->sc_dev.dv_xname);
422 		return;
423 	}
424 
425 #ifdef __FreeBSD__
426 	sc->sc_suspend = 0;
427 #else
428 	sc->sc_suspend = PWR_RESUME;
429 	sc->sc_powerhook = powerhook_establish(tpm_powerhook, sc);
430 #endif
431 }
432 #endif
433 
434 /* Probe TPM using TIS 1.2 interface. */
435 int
436 tpm_tis12_probe(bus_space_tag_t bt, bus_space_handle_t bh)
437 {
438 	u_int32_t r;
439 	u_int8_t save, reg;
440 
441 	r = bus_space_read_4(bt, bh, TPM_INTF_CAPABILITIES);
442 	if (r == 0xffffffff)
443 		return 0;
444 
445 #ifdef TPM_DEBUG
446 	printf("tpm: caps=%b\n", r, TPM_CAPBITS);
447 #endif
448 	if ((r & TPM_CAPSREQ) != TPM_CAPSREQ ||
449 	    !(r & (TPM_INTF_INT_EDGE_RISING | TPM_INTF_INT_LEVEL_LOW))) {
450 #ifdef TPM_DEBUG
451 		printf("tpm: caps too low (caps=%b)\n", r, TPM_CAPBITS);
452 #endif
453 		return 0;
454 	}
455 
456 	save = bus_space_read_1(bt, bh, TPM_ACCESS);
457 	bus_space_write_1(bt, bh, TPM_ACCESS, TPM_ACCESS_REQUEST_USE);
458 	reg = bus_space_read_1(bt, bh, TPM_ACCESS);
459 	if ((reg & TPM_ACCESS_VALID) && (reg & TPM_ACCESS_ACTIVE_LOCALITY) &&
460 	    bus_space_read_4(bt, bh, TPM_ID) != 0xffffffff)
461 		return 1;
462 
463 	bus_space_write_1(bt, bh, TPM_ACCESS, save);
464 	return 0;
465 }
466 
467 /*
468  * Setup interrupt vector if one is provided and interrupts are know to
469  * work on that particular chip.
470  */
471 int
472 tpm_tis12_irqinit(struct tpm_softc *sc, int irq, int idx)
473 {
474 	u_int32_t r;
475 
476 	if ((irq == IRQUNK) || (tpm_devs[idx].flags & TPM_DEV_NOINTS)) {
477 		sc->sc_vector = IRQUNK;
478 		return 0;
479 	}
480 
481 	/* Ack and disable all interrupts. */
482 	bus_space_write_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE,
483 	    bus_space_read_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE) &
484 	    ~TPM_GLOBAL_INT_ENABLE);
485 	bus_space_write_4(sc->sc_bt, sc->sc_bh, TPM_INT_STATUS,
486 	    bus_space_read_4(sc->sc_bt, sc->sc_bh, TPM_INT_STATUS));
487 
488 	/* Program interrupt vector. */
489 	bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_INT_VECTOR, irq);
490 	sc->sc_vector = irq;
491 
492 	/* Program interrupt type. */
493 	if (sc->sc_capabilities & TPM_INTF_INT_EDGE_RISING)
494 		r = TPM_INT_EDGE_RISING;
495 	else if (sc->sc_capabilities & TPM_INTF_INT_LEVEL_HIGH)
496 		r = TPM_INT_LEVEL_HIGH;
497 	else
498 		r = TPM_INT_LEVEL_LOW;
499 	bus_space_write_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE, r);
500 
501 	return 0;
502 }
503 
504 /* Setup TPM using TIS 1.2 interface. */
505 int
506 tpm_tis12_init(struct tpm_softc *sc, int irq, const char *name)
507 {
508 	u_int32_t r;
509 	int i;
510 
511 	r = bus_space_read_4(sc->sc_bt, sc->sc_bh, TPM_INTF_CAPABILITIES);
512 #ifdef TPM_DEBUG
513 	printf(" caps=%b ", r, TPM_CAPBITS);
514 #endif
515 	if ((r & TPM_CAPSREQ) != TPM_CAPSREQ ||
516 	    !(r & (TPM_INTF_INT_EDGE_RISING | TPM_INTF_INT_LEVEL_LOW))) {
517 		printf(": capabilities too low (caps=%b)\n", r, TPM_CAPBITS);
518 		return 1;
519 	}
520 	sc->sc_capabilities = r;
521 
522 	sc->sc_devid = bus_space_read_4(sc->sc_bt, sc->sc_bh, TPM_ID);
523 	sc->sc_rev = bus_space_read_1(sc->sc_bt, sc->sc_bh, TPM_REV);
524 
525 	for (i = 0; tpm_devs[i].devid; i++)
526 		if (tpm_devs[i].devid == sc->sc_devid)
527 			break;
528 
529 	if (tpm_devs[i].devid)
530 		printf(": %s rev 0x%x\n", tpm_devs[i].name, sc->sc_rev);
531 	else
532 		printf(": device 0x%08x rev 0x%x\n", sc->sc_devid, sc->sc_rev);
533 
534 	if (tpm_tis12_irqinit(sc, irq, i))
535 		return 1;
536 
537 	if (tpm_request_locality(sc, 0))
538 		return 1;
539 
540 	/* Abort whatever it thought it was doing. */
541 	bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_STS, TPM_STS_CMD_READY);
542 
543 	return 0;
544 }
545 
546 int
547 tpm_request_locality(struct tpm_softc *sc, int l)
548 {
549 	u_int32_t r;
550 	int to, rv;
551 
552 	if (l != 0)
553 		return EINVAL;
554 
555 	if ((bus_space_read_1(sc->sc_bt, sc->sc_bh, TPM_ACCESS) &
556 	    (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY)) ==
557 	    (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY))
558 		return 0;
559 
560 	bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_ACCESS,
561 	    TPM_ACCESS_REQUEST_USE);
562 
563 	to = tpm_tmotohz(TPM_ACCESS_TMO);
564 
565 	while ((r = bus_space_read_1(sc->sc_bt, sc->sc_bh, TPM_ACCESS) &
566 	    (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY)) !=
567 	    (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY) && to--) {
568 		rv = tsleep(sc->sc_init, PRIBIO | PCATCH, "tpm_locality", 1);
569 		if (rv &&  rv != EWOULDBLOCK) {
570 #ifdef TPM_DEBUG
571 			printf("tpm_request_locality: interrupted %d\n", rv);
572 #endif
573 			return rv;
574 		}
575 	}
576 
577 	if ((r & (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY)) !=
578 	    (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY)) {
579 #ifdef TPM_DEBUG
580 		printf("tpm_request_locality: access %b\n", r, TPM_ACCESS_BITS);
581 #endif
582 		return EBUSY;
583 	}
584 
585 	return 0;
586 }
587 
588 int
589 tpm_getburst(struct tpm_softc *sc)
590 {
591 	int burst, to, rv;
592 
593 	to = tpm_tmotohz(TPM_BURST_TMO);
594 
595 	burst = 0;
596 	while (burst == 0 && to--) {
597 		/*
598 		 * Burst count has to be read from bits 8 to 23 without
599 		 * touching any other bits, eg. the actual status bits 0
600 		 * to 7.
601 		 */
602 		burst = bus_space_read_1(sc->sc_bt, sc->sc_bh, TPM_STS + 1);
603 		burst |= bus_space_read_1(sc->sc_bt, sc->sc_bh, TPM_STS + 2)
604 		    << 8;
605 #ifdef TPM_DEBUG
606 		printf("tpm_getburst: read %d\n", burst);
607 #endif
608 		if (burst)
609 			return burst;
610 
611 		rv = tsleep(sc, PRIBIO | PCATCH, "tpm_getburst", 1);
612 		if (rv && rv != EWOULDBLOCK) {
613 			return 0;
614 		}
615 	}
616 
617 	return 0;
618 }
619 
620 u_int8_t
621 tpm_status(struct tpm_softc *sc)
622 {
623 	u_int8_t status;
624 
625 	status = bus_space_read_1(sc->sc_bt, sc->sc_bh, TPM_STS) &
626 	    TPM_STS_MASK;
627 
628 	return status;
629 }
630 
631 int
632 tpm_tmotohz(int tmo)
633 {
634 	struct timeval tv;
635 
636 	tv.tv_sec = tmo / 1000;
637 	tv.tv_usec = 1000 * (tmo % 1000);
638 
639 	return tvtohz(&tv);
640 }
641 
642 /* Save TPM state on suspend. */
643 int
644 #ifdef __FreeBSD__
645 tpm_suspend(device_t dev)
646 #else
647 tpm_suspend(struct tpm_softc *sc, int why)
648 #endif
649 {
650 #ifdef __FreeBSD__
651 	struct tpm_softc *sc = device_get_softc(dev);
652 	int why = 1;
653 #endif
654 	u_int8_t command[] = {
655 	    0, 193,		/* TPM_TAG_RQU_COMMAND */
656 	    0, 0, 0, 10,	/* Length in bytes */
657 	    0, 0, 0, 156	/* TPM_ORD_SaveStates */
658 	};
659 
660 	/*
661 	 * Power down:  We have to issue the SaveStates command.
662 	 */
663 	sc->sc_write(sc, &command, sizeof(command));
664 	sc->sc_read(sc, &command, sizeof(command), NULL, TPM_HDRSIZE);
665 #ifdef TPM_DEBUG
666 	printf("tpm_suspend: power down: %d -> %d\n", sc->sc_suspend, why);
667 #endif
668 	sc->sc_suspend = why;
669 
670 	return 0;
671 }
672 
673 /*
674  * Handle resume event.  Actually nothing to do as the BIOS is supposed
675  * to restore the previously saved state.
676  */
677 int
678 #ifdef __FreeBSD__
679 tpm_resume(device_t dev)
680 #else
681 tpm_resume(struct tpm_softc *sc, int why)
682 #endif
683 {
684 #ifdef __FreeBSD__
685 	struct tpm_softc *sc = device_get_softc(dev);
686 	int why = 0;
687 #endif
688 #ifdef TPM_DEBUG
689 	printf("tpm_resume: resume: %d -> %d\n", sc->sc_suspend, why);
690 #endif
691 	sc->sc_suspend = why;
692 
693 	return 0;
694 }
695 
696 /* Dispatch suspend and resume events. */
697 #ifndef __FreeBSD__
698 void
699 tpm_powerhook(int why, void *self)
700 {
701 	struct tpm_softc *sc = (struct tpm_softc *)self;
702 
703 	if (why != PWR_RESUME)
704 		tpm_suspend(sc, why);
705 	else
706 		tpm_resume(sc, why);
707 }
708 #endif	/* !__FreeBSD__ */
709 
710 /* Wait for given status bits using polling. */
711 int
712 tpm_waitfor_poll(struct tpm_softc *sc, u_int8_t mask, int tmo, void *c)
713 {
714 	int rv;
715 
716 	/*
717 	 * Poll until either the requested condition or a time out is
718 	 * met.
719 	 */
720 	while (((sc->sc_stat = tpm_status(sc)) & mask) != mask && tmo--) {
721 		rv = tsleep(c, PRIBIO | PCATCH, "tpm_poll", 1);
722 		if (rv && rv != EWOULDBLOCK) {
723 #ifdef TPM_DEBUG
724 			printf("tpm_waitfor_poll: interrupted %d\n", rv);
725 #endif
726 			return rv;
727 		}
728 	}
729 
730 	return 0;
731 }
732 
733 /* Wait for given status bits using interrupts. */
734 int
735 tpm_waitfor_int(struct tpm_softc *sc, u_int8_t mask, int tmo, void *c,
736     int inttype)
737 {
738 	int rv, to;
739 
740 	/* Poll and return when condition is already met. */
741 	sc->sc_stat = tpm_status(sc);
742 	if ((sc->sc_stat & mask) == mask)
743 		return 0;
744 
745 	/*
746 	 * Enable interrupt on tpm chip.  Note that interrupts on our
747 	 * level (SPL_TTY) are disabled (see tpm{read,write} et al) and
748 	 * will not be delivered to the cpu until we call tsleep(9) below.
749 	 */
750 	bus_space_write_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE,
751 	    bus_space_read_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE) |
752 	    inttype);
753 	bus_space_write_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE,
754 	    bus_space_read_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE) |
755 	    TPM_GLOBAL_INT_ENABLE);
756 
757 	/*
758 	 * Poll once more to remedy the race between previous polling
759 	 * and enabling interrupts on the tpm chip.
760 	 */
761 	sc->sc_stat = tpm_status(sc);
762 	if ((sc->sc_stat & mask) == mask) {
763 		rv = 0;
764 		goto out;
765 	}
766 
767 	to = tpm_tmotohz(tmo);
768 #ifdef TPM_DEBUG
769 	printf("tpm_waitfor_int: sleeping for %d ticks on %p\n", to, c);
770 #endif
771 	/*
772 	 * tsleep(9) enables interrupts on the cpu and returns after
773 	 * wake up with interrupts disabled again.  Note that interrupts
774 	 * generated by the tpm chip while being at SPL_TTY are not lost
775 	 * but held and delivered as soon as the cpu goes below SPL_TTY.
776 	 */
777 	rv = tsleep(c, PRIBIO | PCATCH, "tpm_intr", to);
778 
779 	sc->sc_stat = tpm_status(sc);
780 #ifdef TPM_DEBUG
781 	printf("tpm_waitfor_int: woke up with rv %d stat %b\n", rv,
782 	    sc->sc_stat, TPM_STS_BITS);
783 #endif
784 	if ((sc->sc_stat & mask) == mask)
785 		rv = 0;
786 
787 	/* Disable interrupts on tpm chip again. */
788 out:	bus_space_write_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE,
789 	    bus_space_read_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE) &
790 	    ~TPM_GLOBAL_INT_ENABLE);
791 	bus_space_write_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE,
792 	    bus_space_read_4(sc->sc_bt, sc->sc_bh, TPM_INTERRUPT_ENABLE) &
793 	    ~inttype);
794 
795 	return rv;
796 }
797 
798 /*
799  * Wait on given status bits, uses interrupts where possible, otherwise polls.
800  */
801 int
802 tpm_waitfor(struct tpm_softc *sc, u_int8_t b0, int tmo, void *c)
803 {
804 	u_int8_t b;
805 	int re, to, rv;
806 
807 #ifdef TPM_DEBUG
808 	printf("tpm_waitfor: b0 %b\n", b0, TPM_STS_BITS);
809 #endif
810 
811 	/*
812 	 * If possible, use interrupts, otherwise poll.
813 	 *
814 	 * We use interrupts for TPM_STS_VALID and TPM_STS_DATA_AVAIL (if
815 	 * the tpm chips supports them) as waiting for those can take
816 	 * really long.  The other TPM_STS* are not needed very often
817 	 * so we do not support them.
818 	 */
819 	if (sc->sc_vector != IRQUNK) {
820 		b = b0;
821 
822 		/*
823 		 * Wait for data ready.  This interrupt only occures
824 		 * when both TPM_STS_VALID and TPM_STS_DATA_AVAIL are asserted.
825 		 * Thus we don't have to bother with TPM_STS_VALID
826 		 * separately and can just return.
827 		 *
828 		 * This only holds for interrupts!  When using polling
829 		 * both flags have to be waited for, see below.
830 		 */
831 		if ((b & TPM_STS_DATA_AVAIL) && (sc->sc_capabilities &
832 		    TPM_INTF_DATA_AVAIL_INT))
833 			return tpm_waitfor_int(sc, b, tmo, c,
834 			    TPM_DATA_AVAIL_INT);
835 
836 		/* Wait for status valid bit. */
837 		if ((b & TPM_STS_VALID) && (sc->sc_capabilities &
838 		    TPM_INTF_STS_VALID_INT)) {
839 			rv = tpm_waitfor_int(sc, b, tmo, c, TPM_STS_VALID_INT);
840 			if (rv != 0)
841 				return rv;
842 			else
843 				b = b0 & ~TPM_STS_VALID;
844 		}
845 
846 		/*
847 		 * When all flags are taken care of, return.  Otherwise
848 		 * use polling for eg. TPM_STS_CMD_READY.
849 		 */
850 		if (b == 0)
851 			return 0;
852 	}
853 
854 	re = 3;
855 restart:
856 	/*
857 	 * If requested wait for TPM_STS_VALID before dealing with
858 	 * any other flag.  Eg. when both TPM_STS_DATA_AVAIL and TPM_STS_VALID
859 	 * are requested, wait for the latter first.
860 	 */
861 	b = b0;
862 	if (b0 & TPM_STS_VALID)
863 		b = TPM_STS_VALID;
864 
865 	to = tpm_tmotohz(tmo);
866 again:
867 	if ((rv = tpm_waitfor_poll(sc, b, to, c)) != 0)
868 		return rv;
869 
870 	if ((b & sc->sc_stat) == TPM_STS_VALID) {
871 		/* Now wait for other flags. */
872 		b = b0 & ~TPM_STS_VALID;
873 		to++;
874 		goto again;
875 	}
876 
877 	if ((sc->sc_stat & b) != b) {
878 #ifdef TPM_DEBUG
879 		printf("tpm_waitfor: timeout: stat=%b b=%b\n",
880 		    sc->sc_stat, TPM_STS_BITS, b, TPM_STS_BITS);
881 #endif
882 		if (re-- && (b0 & TPM_STS_VALID)) {
883 			bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_STS,
884 			    TPM_STS_RESP_RETRY);
885 			goto restart;
886 		}
887 		return EIO;
888 	}
889 
890 	return 0;
891 }
892 
893 /* Start transaction. */
894 int
895 tpm_tis12_start(struct tpm_softc *sc, int flag)
896 {
897 	int rv;
898 
899 	if (flag == UIO_READ) {
900 		rv = tpm_waitfor(sc, TPM_STS_DATA_AVAIL | TPM_STS_VALID,
901 		    TPM_READ_TMO, sc->sc_read);
902 		return rv;
903 	}
904 
905 	/* Own our (0th) locality. */
906 	if ((rv = tpm_request_locality(sc, 0)) != 0)
907 		return rv;
908 
909 	sc->sc_stat = tpm_status(sc);
910 	if (sc->sc_stat & TPM_STS_CMD_READY) {
911 #ifdef TPM_DEBUG
912 		printf("tpm_tis12_start: UIO_WRITE status %b\n", sc->sc_stat,
913 		   TPM_STS_BITS);
914 #endif
915 		return 0;
916 	}
917 
918 #ifdef TPM_DEBUG
919 	printf("tpm_tis12_start: UIO_WRITE readying chip\n");
920 #endif
921 
922 	/* Abort previous and restart. */
923 	bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_STS, TPM_STS_CMD_READY);
924 	if ((rv = tpm_waitfor(sc, TPM_STS_CMD_READY, TPM_READY_TMO,
925 	    sc->sc_write))) {
926 #ifdef TPM_DEBUG
927 		printf("tpm_tis12_start: UIO_WRITE readying failed %d\n", rv);
928 #endif
929 		return rv;
930 	}
931 
932 #ifdef TPM_DEBUG
933 	printf("tpm_tis12_start: UIO_WRITE readying done\n");
934 #endif
935 
936 	return 0;
937 }
938 
939 int
940 tpm_tis12_read(struct tpm_softc *sc, void *buf, int len, size_t *count,
941     int flags)
942 {
943 	u_int8_t *p = buf;
944 	size_t cnt;
945 	int rv, n, bcnt;
946 
947 #ifdef TPM_DEBUG
948 	printf("tpm_tis12_read: len %d\n", len);
949 #endif
950 	cnt = 0;
951 	while (len > 0) {
952 		if ((rv = tpm_waitfor(sc, TPM_STS_DATA_AVAIL | TPM_STS_VALID,
953 		    TPM_READ_TMO, sc->sc_read)))
954 			return rv;
955 
956 		bcnt = tpm_getburst(sc);
957 		n = MIN(len, bcnt);
958 #ifdef TPM_DEBUG
959 		printf("tpm_tis12_read: fetching %d, burst is %d\n", n, bcnt);
960 #endif
961 		for (; n--; len--) {
962 			*p++ = bus_space_read_1(sc->sc_bt, sc->sc_bh, TPM_DATA);
963 			cnt++;
964 		}
965 
966 		if ((flags & TPM_PARAM_SIZE) == 0 && cnt >= 6)
967 			break;
968 	}
969 #ifdef TPM_DEBUG
970 	printf("tpm_tis12_read: read %zd bytes, len %d\n", cnt, len);
971 #endif
972 
973 	if (count)
974 		*count = cnt;
975 
976 	return 0;
977 }
978 
979 int
980 tpm_tis12_write(struct tpm_softc *sc, void *buf, int len)
981 {
982 	u_int8_t *p = buf;
983 	size_t cnt;
984 	int rv, r;
985 
986 #ifdef TPM_DEBUG
987 	printf("tpm_tis12_write: sc %p buf %p len %d\n", sc, buf, len);
988 #endif
989 
990 	if ((rv = tpm_request_locality(sc, 0)) != 0)
991 		return rv;
992 
993 	cnt = 0;
994 	while (cnt < len - 1) {
995 		for (r = tpm_getburst(sc); r > 0 && cnt < len - 1; r--) {
996 			bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_DATA, *p++);
997 			cnt++;
998 		}
999 		if ((rv = tpm_waitfor(sc, TPM_STS_VALID, TPM_READ_TMO, sc))) {
1000 #ifdef TPM_DEBUG
1001 			printf("tpm_tis12_write: failed burst rv %d\n", rv);
1002 #endif
1003 			return rv;
1004 		}
1005 		sc->sc_stat = tpm_status(sc);
1006 		if (!(sc->sc_stat & TPM_STS_DATA_EXPECT)) {
1007 #ifdef TPM_DEBUG
1008 			printf("tpm_tis12_write: failed rv %d stat=%b\n", rv,
1009 			    sc->sc_stat, TPM_STS_BITS);
1010 #endif
1011 			return EIO;
1012 		}
1013 	}
1014 
1015 	bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_DATA, *p++);
1016 	cnt++;
1017 
1018 	if ((rv = tpm_waitfor(sc, TPM_STS_VALID, TPM_READ_TMO, sc))) {
1019 #ifdef TPM_DEBUG
1020 		printf("tpm_tis12_write: failed last byte rv %d\n", rv);
1021 #endif
1022 		return rv;
1023 	}
1024 	if ((sc->sc_stat & TPM_STS_DATA_EXPECT) != 0) {
1025 #ifdef TPM_DEBUG
1026 		printf("tpm_tis12_write: failed rv %d stat=%b\n", rv,
1027 		    sc->sc_stat, TPM_STS_BITS);
1028 #endif
1029 		return EIO;
1030 	}
1031 
1032 #ifdef TPM_DEBUG
1033 	printf("tpm_tis12_write: wrote %d byte\n", cnt);
1034 #endif
1035 
1036 	return 0;
1037 }
1038 
1039 /* Finish transaction. */
1040 int
1041 tpm_tis12_end(struct tpm_softc *sc, int flag, int err)
1042 {
1043 	int rv = 0;
1044 
1045 	if (flag == UIO_READ) {
1046 		if ((rv = tpm_waitfor(sc, TPM_STS_VALID, TPM_READ_TMO,
1047 		    sc->sc_read)))
1048 			return rv;
1049 
1050 		/* Still more data? */
1051 		sc->sc_stat = tpm_status(sc);
1052 		if (!err && ((sc->sc_stat & TPM_STS_DATA_AVAIL) == TPM_STS_DATA_AVAIL)) {
1053 #ifdef TPM_DEBUG
1054 			printf("tpm_tis12_end: read failed stat=%b\n",
1055 			    sc->sc_stat, TPM_STS_BITS);
1056 #endif
1057 			rv = EIO;
1058 		}
1059 
1060 		bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_STS,
1061 		    TPM_STS_CMD_READY);
1062 
1063 		/* Release our (0th) locality. */
1064 		bus_space_write_1(sc->sc_bt, sc->sc_bh,TPM_ACCESS,
1065 		    TPM_ACCESS_ACTIVE_LOCALITY);
1066 	} else {
1067 		/* Hungry for more? */
1068 		sc->sc_stat = tpm_status(sc);
1069 		if (!err && (sc->sc_stat & TPM_STS_DATA_EXPECT)) {
1070 #ifdef TPM_DEBUG
1071 			printf("tpm_tis12_end: write failed stat=%b\n",
1072 			    sc->sc_stat, TPM_STS_BITS);
1073 #endif
1074 			rv = EIO;
1075 		}
1076 
1077 		bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_STS,
1078 		    err ? TPM_STS_CMD_READY : TPM_STS_GO);
1079 	}
1080 
1081 	return rv;
1082 }
1083 
1084 #ifdef __FreeBSD__
1085 void
1086 #else
1087 int
1088 #endif
1089 tpm_intr(void *v)
1090 {
1091 	struct tpm_softc *sc = v;
1092 	u_int32_t r;
1093 #ifdef TPM_DEBUG
1094 	static int cnt = 0;
1095 #endif
1096 
1097 	r = bus_space_read_4(sc->sc_bt, sc->sc_bh, TPM_INT_STATUS);
1098 #ifdef TPM_DEBUG
1099 	if (r != 0)
1100 		printf("tpm_intr: int=%b (%d)\n", r, TPM_INTERRUPT_ENABLE_BITS,
1101 		    cnt);
1102 	else
1103 		cnt++;
1104 #endif
1105 	if (!(r & (TPM_CMD_READY_INT | TPM_LOCALITY_CHANGE_INT |
1106 	    TPM_STS_VALID_INT | TPM_DATA_AVAIL_INT)))
1107 #ifdef __FreeBSD__
1108 		return;
1109 #else
1110 		return 0;
1111 #endif
1112 	if (r & TPM_STS_VALID_INT)
1113 		wakeup(sc);
1114 
1115 	if (r & TPM_CMD_READY_INT)
1116 		wakeup(sc->sc_write);
1117 
1118 	if (r & TPM_DATA_AVAIL_INT)
1119 		wakeup(sc->sc_read);
1120 
1121 	if (r & TPM_LOCALITY_CHANGE_INT)
1122 		wakeup(sc->sc_init);
1123 
1124 	bus_space_write_4(sc->sc_bt, sc->sc_bh, TPM_INT_STATUS, r);
1125 
1126 #ifdef __FreeBSD__
1127 	return;
1128 #else
1129 	return 1;
1130 #endif
1131 }
1132 
1133 /* Read single byte using legacy interface. */
1134 static inline u_int8_t
1135 tpm_legacy_in(bus_space_tag_t iot, bus_space_handle_t ioh, int reg)
1136 {
1137 	bus_space_write_1(iot, ioh, 0, reg);
1138 	return bus_space_read_1(iot, ioh, 1);
1139 }
1140 
1141 #if 0
1142 /* Write single byte using legacy interface. */
1143 static inline void
1144 tpm_legacy_out(bus_space_tag_t iot, bus_space_handle_t ioh, int reg, u_int8_t v)
1145 {
1146 	bus_space_write_1(iot, ioh, 0, reg);
1147 	bus_space_write_1(iot, ioh, 1, v);
1148 }
1149 #endif
1150 
1151 /* Probe for TPM using legacy interface. */
1152 int
1153 tpm_legacy_probe(bus_space_tag_t iot, bus_addr_t iobase)
1154 {
1155 	bus_space_handle_t ioh;
1156 	u_int8_t r, v;
1157 	int i, rv = 0;
1158 	char id[8];
1159 
1160 	if (!tpm_enabled || iobase == -1)
1161 		return 0;
1162 
1163 	if (bus_space_map(iot, iobase, 2, 0, &ioh))
1164 		return 0;
1165 
1166 	v = bus_space_read_1(iot, ioh, 0);
1167 	if (v == 0xff) {
1168 		bus_space_unmap(iot, ioh, 2);
1169 		return 0;
1170 	}
1171 	r = bus_space_read_1(iot, ioh, 1);
1172 
1173 	for (i = sizeof(id); i--; )
1174 		id[i] = tpm_legacy_in(iot, ioh, TPM_ID + i);
1175 
1176 #ifdef TPM_DEBUG
1177 	printf("tpm_legacy_probe %.4s %d.%d.%d.%d\n",
1178 	    &id[4], id[0], id[1], id[2], id[3]);
1179 #endif
1180 	/*
1181 	 * The only chips using the legacy interface we are aware of are
1182 	 * by Atmel.  For other chips more signature would have to be added.
1183 	 */
1184 	if (!bcmp(&id[4], "ATML", 4))
1185 		rv = 1;
1186 
1187 	if (!rv) {
1188 		bus_space_write_1(iot, ioh, r, 1);
1189 		bus_space_write_1(iot, ioh, v, 0);
1190 	}
1191 	bus_space_unmap(iot, ioh, 2);
1192 
1193 	return rv;
1194 }
1195 
1196 /* Setup TPM using legacy interface. */
1197 int
1198 tpm_legacy_init(struct tpm_softc *sc, int irq, const char *name)
1199 {
1200 	char id[8];
1201 	u_int8_t ioh, iol;
1202 	int i;
1203 
1204 	if ((i = bus_space_map(sc->sc_batm, tpm_enabled, 2, 0, &sc->sc_bahm))) {
1205 		printf(": cannot map tpm registers (%d)\n", i);
1206 		tpm_enabled = 0;
1207 		return 1;
1208 	}
1209 
1210 	for (i = sizeof(id); i--; )
1211 		id[i] = tpm_legacy_in(sc->sc_bt, sc->sc_bh, TPM_ID + i);
1212 
1213 	printf(": %.4s %d.%d @0x%x\n", &id[4], id[0], id[1], tpm_enabled);
1214 	iol = tpm_enabled & 0xff;
1215 	ioh = tpm_enabled >> 16;
1216 	tpm_enabled = 0;
1217 
1218 	return 0;
1219 }
1220 
1221 /* Start transaction. */
1222 int
1223 tpm_legacy_start(struct tpm_softc *sc, int flag)
1224 {
1225 	struct timeval tv;
1226 	u_int8_t bits, r;
1227 	int to, rv;
1228 
1229 	bits = flag == UIO_READ ? TPM_LEGACY_DA : 0;
1230 	tv.tv_sec = TPM_LEGACY_TMO;
1231 	tv.tv_usec = 0;
1232 	to = tvtohz(&tv) / TPM_LEGACY_SLEEP;
1233 	while (((r = bus_space_read_1(sc->sc_batm, sc->sc_bahm, 1)) &
1234 	    (TPM_LEGACY_BUSY|bits)) != bits && to--) {
1235 		rv = tsleep(sc, PRIBIO | PCATCH, "legacy_tpm_start",
1236 		    TPM_LEGACY_SLEEP);
1237 		if (rv && rv != EWOULDBLOCK)
1238 			return rv;
1239 	}
1240 
1241 #if defined(TPM_DEBUG) && !defined(__FreeBSD__)
1242 	printf("%s: bits %b\n", sc->sc_dev.dv_xname, r, TPM_LEGACY_BITS);
1243 #endif
1244 	if ((r & (TPM_LEGACY_BUSY|bits)) != bits)
1245 		return EIO;
1246 
1247 	return 0;
1248 }
1249 
1250 int
1251 tpm_legacy_read(struct tpm_softc *sc, void *buf, int len, size_t *count,
1252     int flags)
1253 {
1254 	u_int8_t *p;
1255 	size_t cnt;
1256 	int to, rv;
1257 
1258 	cnt = rv = 0;
1259 	for (p = buf; !rv && len > 0; len--) {
1260 		for (to = 1000;
1261 		    !(bus_space_read_1(sc->sc_batm, sc->sc_bahm, 1) &
1262 		    TPM_LEGACY_DA); DELAY(1))
1263 			if (!to--)
1264 				return EIO;
1265 
1266 		DELAY(TPM_LEGACY_DELAY);
1267 		*p++ = bus_space_read_1(sc->sc_batm, sc->sc_bahm, 0);
1268 		cnt++;
1269 	}
1270 
1271 	*count = cnt;
1272 	return 0;
1273 }
1274 
1275 int
1276 tpm_legacy_write(struct tpm_softc *sc, void *buf, int len)
1277 {
1278 	u_int8_t *p;
1279 	int n;
1280 
1281 	for (p = buf, n = len; n--; DELAY(TPM_LEGACY_DELAY)) {
1282 		if (!n && len != TPM_BUFSIZ) {
1283 			bus_space_write_1(sc->sc_batm, sc->sc_bahm, 1,
1284 			    TPM_LEGACY_LAST);
1285 			DELAY(TPM_LEGACY_DELAY);
1286 		}
1287 		bus_space_write_1(sc->sc_batm, sc->sc_bahm, 0, *p++);
1288 	}
1289 
1290 	return 0;
1291 }
1292 
1293 /* Finish transaction. */
1294 int
1295 tpm_legacy_end(struct tpm_softc *sc, int flag, int rv)
1296 {
1297 	struct timeval tv;
1298 	u_int8_t r;
1299 	int to;
1300 
1301 	if (rv || flag == UIO_READ)
1302 		bus_space_write_1(sc->sc_batm, sc->sc_bahm, 1, TPM_LEGACY_ABRT);
1303 	else {
1304 		tv.tv_sec = TPM_LEGACY_TMO;
1305 		tv.tv_usec = 0;
1306 		to = tvtohz(&tv) / TPM_LEGACY_SLEEP;
1307 		while(((r = bus_space_read_1(sc->sc_batm, sc->sc_bahm, 1)) &
1308 		    TPM_LEGACY_BUSY) && to--) {
1309 			rv = tsleep(sc, PRIBIO | PCATCH, "legacy_tpm_end",
1310 			    TPM_LEGACY_SLEEP);
1311 			if (rv && rv != EWOULDBLOCK)
1312 				return rv;
1313 		}
1314 
1315 #if defined(TPM_DEBUG) && !defined(__FreeBSD__)
1316 		printf("%s: bits %b\n", sc->sc_dev.dv_xname, r, TPM_LEGACY_BITS);
1317 #endif
1318 		if (r & TPM_LEGACY_BUSY)
1319 			return EIO;
1320 
1321 		if (r & TPM_LEGACY_RE)
1322 			return EIO;	/* XXX Retry the loop? */
1323 	}
1324 
1325 	return rv;
1326 }
1327 
1328 int
1329 #ifdef __FreeBSD__
1330 tpmopen(struct cdev *dev, int flag, int mode, struct thread *td)
1331 #else
1332 tpmopen(dev_t dev, int flag, int mode, struct proc *p)
1333 #endif
1334 {
1335 	struct tpm_softc *sc = TPMSOFTC(dev);
1336 
1337 	if (!sc)
1338 		return ENXIO;
1339 
1340 	if (sc->sc_flags & TPM_OPEN)
1341 		return EBUSY;
1342 
1343 	sc->sc_flags |= TPM_OPEN;
1344 
1345 	return 0;
1346 }
1347 
1348 int
1349 #ifdef __FreeBSD__
1350 tpmclose(struct cdev *dev, int flag, int mode, struct thread *td)
1351 #else
1352 tpmclose(dev_t dev, int flag, int mode, struct proc *p)
1353 #endif
1354 {
1355 	struct tpm_softc *sc = TPMSOFTC(dev);
1356 
1357 	if (!sc)
1358 		return ENXIO;
1359 
1360 	if (!(sc->sc_flags & TPM_OPEN))
1361 		return EINVAL;
1362 
1363 	sc->sc_flags &= ~TPM_OPEN;
1364 
1365 	return 0;
1366 }
1367 
1368 int
1369 #ifdef __FreeBSD__
1370 tpmread(struct cdev *dev, struct uio *uio, int flags)
1371 #else
1372 tpmread(dev_t dev, struct uio *uio, int flags)
1373 #endif
1374 {
1375 	struct tpm_softc *sc = TPMSOFTC(dev);
1376 	u_int8_t buf[TPM_BUFSIZ], *p;
1377 	size_t cnt;
1378 	int n, len, rv, s;
1379 
1380 	if (!sc)
1381 		return ENXIO;
1382 
1383 	s = spltty();
1384 	if ((rv = (sc->sc_start)(sc, UIO_READ))) {
1385 		splx(s);
1386 		return rv;
1387 	}
1388 
1389 #ifdef TPM_DEBUG
1390 	printf("tpmread: getting header\n");
1391 #endif
1392 	if ((rv = (sc->sc_read)(sc, buf, TPM_HDRSIZE, &cnt, 0))) {
1393 		(sc->sc_end)(sc, UIO_READ, rv);
1394 		splx(s);
1395 		return rv;
1396 	}
1397 
1398 	len = (buf[2] << 24) | (buf[3] << 16) | (buf[4] << 8) | buf[5];
1399 #ifdef TPM_DEBUG
1400 	printf("tpmread: len %d, io count %d\n", len, uio->uio_resid);
1401 #endif
1402 	if (len > uio->uio_resid) {
1403 		rv = EIO;
1404 		(sc->sc_end)(sc, UIO_READ, rv);
1405 #ifdef TPM_DEBUG
1406 		printf("tpmread: bad residual io count 0x%x\n", uio->uio_resid);
1407 #endif
1408 		splx(s);
1409 		return rv;
1410 	}
1411 
1412 	/* Copy out header. */
1413 	if ((rv = uiomove((caddr_t)buf, cnt, uio))) {
1414 		(sc->sc_end)(sc, UIO_READ, rv);
1415 		splx(s);
1416 		return rv;
1417 	}
1418 
1419 	/* Get remaining part of the answer (if anything is left). */
1420 	for (len -= cnt, p = buf, n = sizeof(buf); len > 0; p = buf, len -= n,
1421 	    n = sizeof(buf)) {
1422 		n = MIN(n, len);
1423 #ifdef TPM_DEBUG
1424 		printf("tpmread: n %d len %d\n", n, len);
1425 #endif
1426 		if ((rv = (sc->sc_read)(sc, p, n, NULL, TPM_PARAM_SIZE))) {
1427 			(sc->sc_end)(sc, UIO_READ, rv);
1428 			splx(s);
1429 			return rv;
1430 		}
1431 		p += n;
1432 		if ((rv = uiomove((caddr_t)buf, p - buf, uio))) {
1433 			(sc->sc_end)(sc, UIO_READ, rv);
1434 			splx(s);
1435 			return rv;
1436 		}
1437 	}
1438 
1439 	rv = (sc->sc_end)(sc, UIO_READ, rv);
1440 	splx(s);
1441 	return rv;
1442 }
1443 
1444 int
1445 #ifdef __FreeBSD__
1446 tpmwrite(struct cdev *dev, struct uio *uio, int flags)
1447 #else
1448 tpmwrite(dev_t dev, struct uio *uio, int flags)
1449 #endif
1450 {
1451 	struct tpm_softc *sc = TPMSOFTC(dev);
1452 	u_int8_t buf[TPM_BUFSIZ];
1453 	int n, rv, s;
1454 
1455 	if (!sc)
1456 		return ENXIO;
1457 
1458 	s = spltty();
1459 
1460 #ifdef TPM_DEBUG
1461 	printf("tpmwrite: io count %d\n", uio->uio_resid);
1462 #endif
1463 
1464 	n = MIN(sizeof(buf), uio->uio_resid);
1465 	if ((rv = uiomove((caddr_t)buf, n, uio))) {
1466 		splx(s);
1467 		return rv;
1468 	}
1469 
1470 	if ((rv = (sc->sc_start)(sc, UIO_WRITE))) {
1471 		splx(s);
1472 		return rv;
1473 	}
1474 
1475 	if ((rv = (sc->sc_write(sc, buf, n)))) {
1476 		splx(s);
1477 		return rv;
1478 	}
1479 
1480 	rv = (sc->sc_end)(sc, UIO_WRITE, rv);
1481 	splx(s);
1482 	return rv;
1483 }
1484 
1485 int
1486 #ifdef __FreeBSD__
1487 tpmioctl(struct cdev *dev, u_long cmd, caddr_t data, int flags,
1488     struct thread *td)
1489 #else
1490 tpmioctl(dev_t dev, u_long cmd, caddr_t data, int flags, struct proc *p)
1491 #endif
1492 {
1493 	return ENOTTY;
1494 }
1495