1 /*- 2 * Copyright (c) 2018 Stormshield. 3 * Copyright (c) 2018 Semihalf. 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 16 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED 17 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 18 * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, 19 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 20 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 21 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 23 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 24 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 25 * POSSIBILITY OF SUCH DAMAGE. 26 */ 27 28 #include <sys/cdefs.h> 29 #include <sys/param.h> 30 31 #include <machine/atomic.h> 32 33 #include "tpm20.h" 34 #include "tpm_if.h" 35 36 /* 37 * TIS register space as defined in 38 * TCG_PC_Client_Platform_TPM_Profile_PTP_2.0_r1.03_v22 39 */ 40 #define TPM_ACCESS 0x0 41 #define TPM_INT_ENABLE 0x8 42 #define TPM_INT_VECTOR 0xc 43 #define TPM_INT_STS 0x10 44 #define TPM_INTF_CAPS 0x14 45 #define TPM_STS 0x18 46 #define TPM_DATA_FIFO 0x24 47 #define TPM_INTF_ID 0x30 48 #define TPM_XDATA_FIFO 0x80 49 #define TPM_DID_VID 0xF00 50 #define TPM_RID 0xF04 51 52 #define TPM_ACCESS_LOC_REQ BIT(1) 53 #define TPM_ACCESS_LOC_Seize BIT(3) 54 #define TPM_ACCESS_LOC_ACTIVE BIT(5) 55 #define TPM_ACCESS_LOC_RELINQUISH BIT(5) 56 #define TPM_ACCESS_VALID BIT(7) 57 58 #define TPM_INT_ENABLE_GLOBAL_ENABLE BIT(31) 59 #define TPM_INT_ENABLE_CMD_RDY BIT(7) 60 #define TPM_INT_ENABLE_LOC_CHANGE BIT(2) 61 #define TPM_INT_ENABLE_STS_VALID BIT(1) 62 #define TPM_INT_ENABLE_DATA_AVAIL BIT(0) 63 64 #define TPM_INT_STS_CMD_RDY BIT(7) 65 #define TPM_INT_STS_LOC_CHANGE BIT(2) 66 #define TPM_INT_STS_VALID BIT(1) 67 #define TPM_INT_STS_DATA_AVAIL BIT(0) 68 69 #define TPM_INTF_CAPS_VERSION 0x70000000 70 #define TPM_INTF_CAPS_TPM20 0x30000000 71 72 #define TPM_STS_VALID BIT(7) 73 #define TPM_STS_CMD_RDY BIT(6) 74 #define TPM_STS_CMD_START BIT(5) 75 #define TPM_STS_DATA_AVAIL BIT(4) 76 #define TPM_STS_DATA_EXPECTED BIT(3) 77 #define TPM_STS_BURST_MASK 0xFFFF00 78 #define TPM_STS_BURST_OFFSET 0x8 79 80 static int tpmtis_transmit(device_t dev, struct tpm_priv *priv, size_t length); 81 82 static int tpmtis_detach(device_t dev); 83 84 static void tpmtis_intr_handler(void *arg); 85 86 static bool tpmtis_program_intr(struct tpm_sc *sc, bool enable); 87 static void tpmtis_setup_intr(struct tpm_sc *sc); 88 static int tpmtis_resume(device_t dev); 89 90 static bool tpmtis_read_bytes(struct tpm_sc *sc, size_t count, uint8_t *buf); 91 static bool tpmtis_write_bytes(struct tpm_sc *sc, size_t count, uint8_t *buf); 92 static bool tpmtis_request_locality(struct tpm_sc *sc, int locality); 93 static void tpmtis_relinquish_locality(struct tpm_sc *sc); 94 static bool tpmtis_go_ready(struct tpm_sc *sc); 95 96 static bool tpm_wait_for_reg(struct tpm_sc *sc, bus_size_t off, 97 uint32_t mask, uint32_t val, int32_t timeout, int intr_type, 98 bool reg32); 99 100 static uint16_t tpmtis_wait_for_burst(struct tpm_sc *sc); 101 102 int 103 tpmtis_attach(device_t dev) 104 { 105 struct tpm_sc *sc; 106 rman_res_t irq; 107 void *intr_cookie; 108 bool configured; 109 int result; 110 int poll = 0; 111 112 sc = device_get_softc(dev); 113 sc->dev = dev; 114 sc->intr_type = -1; 115 sc->intr_generation = 0; 116 sc->interrupts = false; 117 sc->intr_cookie = NULL; 118 sc->irq_res = NULL; 119 120 sx_init(&sc->dev_lock, "TPM driver lock"); 121 mtx_init(&sc->intr_lock, "TPM interrupt lock", NULL, MTX_DEF); 122 cv_init(&sc->intr_cv, "tpmtis_intr"); 123 124 /* 125 * Firmware may have left interrupt delivery enabled. Quiesce the TPM 126 * before installing a handler or starting the entropy harvester, even 127 * when we will use polling or cannot use the advertised IRQ. 128 */ 129 sx_xlock(&sc->dev_lock); 130 configured = tpmtis_program_intr(sc, false); 131 sx_xunlock(&sc->dev_lock); 132 if (!configured) { 133 device_printf(dev, "failed to quiesce TPM interrupts\n"); 134 tpmtis_detach(dev); 135 return (ENXIO); 136 } 137 138 resource_int_value("tpm", device_get_unit(dev), "use_polling", &poll); 139 if (poll != 0) { 140 device_printf(dev, 141 "Using poll method to get TPM operation status\n"); 142 goto skip_irq; 143 } 144 145 sc->irq_rid = 0; 146 sc->irq_res = bus_alloc_resource_any(dev, SYS_RES_IRQ, &sc->irq_rid, 147 RF_ACTIVE | RF_SHAREABLE); 148 if (sc->irq_res == NULL) 149 goto skip_irq; 150 151 /* 152 * This driver uses the resource IRQ directly as the LPC SIRQ selector. 153 * Parent IRQ numbers need not map directly to SIRQ channels. Preserve 154 * the existing 1..15 limit and use polling for other routes without 155 * installing a handler. 156 */ 157 irq = bus_get_resource_start(dev, SYS_RES_IRQ, sc->irq_rid); 158 if (irq == 0 || irq > 0xf) { 159 device_printf(dev, "cannot use IRQ %ju; using polling\n", 160 (uintmax_t)irq); 161 goto release_irq; 162 } 163 164 /* Failed setup may leave a stale cookie after removing its handler. */ 165 intr_cookie = NULL; 166 result = bus_setup_intr(dev, sc->irq_res, INTR_TYPE_MISC | INTR_MPSAFE, 167 NULL, tpmtis_intr_handler, sc, &intr_cookie); 168 if (result == 0) { 169 sc->intr_cookie = intr_cookie; 170 goto skip_irq; 171 } 172 release_irq: 173 if (bus_release_resource(dev, SYS_RES_IRQ, sc->irq_rid, 174 sc->irq_res) == 0) 175 sc->irq_res = NULL; 176 skip_irq: 177 result = tpm20_init(sc); 178 if (result != 0) { 179 tpmtis_detach(dev); 180 return (result); 181 } 182 if (sc->intr_cookie != NULL) 183 tpmtis_setup_intr(sc); 184 185 return (0); 186 } 187 188 static int 189 tpmtis_detach(device_t dev) 190 { 191 struct tpm_sc *sc; 192 193 sc = device_get_softc(dev); 194 /* 195 * Stop new commands before quiescing hardware with the lock still live. 196 */ 197 atomic_store_bool(&sc->dying, true); 198 sx_xlock(&sc->dev_lock); 199 mtx_lock(&sc->intr_lock); 200 sc->interrupts = false; 201 sc->intr_type = -1; 202 mtx_unlock(&sc->intr_lock); 203 if (!tpmtis_program_intr(sc, false)) 204 device_printf(dev, 205 "failed to quiesce TPM interrupts during detach\n"); 206 sx_xunlock(&sc->dev_lock); 207 tpm20_release(sc); 208 209 if (sc->intr_cookie != NULL) 210 bus_teardown_intr(dev, sc->irq_res, sc->intr_cookie); 211 cv_destroy(&sc->intr_cv); 212 mtx_destroy(&sc->intr_lock); 213 214 if (sc->irq_res != NULL) 215 bus_release_resource(dev, SYS_RES_IRQ, 216 sc->irq_rid, sc->irq_res); 217 218 if (sc->mem_res != NULL) 219 bus_release_resource(dev, SYS_RES_MEMORY, 220 sc->mem_rid, sc->mem_res); 221 222 return (0); 223 } 224 225 /* 226 * Test if the advertisted interrupt actually works. 227 * This sends a simple command. (GetRandom) 228 * Interrupts are then enabled in the handler. 229 */ 230 static void 231 tpmtis_test_intr(struct tpm_sc *sc) 232 { 233 struct tpm_priv *priv; 234 uint8_t cmd[] = { 235 0x80, 0x01, /* TPM_ST_NO_SESSIONS tag*/ 236 0x00, 0x00, 0x00, 0x0c, /* cmd length */ 237 0x00, 0x00, 0x01, 0x7b, /* cmd TPM_CC_GetRandom */ 238 0x00, 0x01 /* number of bytes requested */ 239 }; 240 241 sx_xlock(&sc->dev_lock); 242 priv = sc->internal_priv; 243 memcpy(priv->buf, cmd, sizeof(cmd)); 244 tpmtis_transmit(sc->dev, priv, sizeof(cmd)); 245 sx_xunlock(&sc->dev_lock); 246 } 247 248 static bool 249 tpmtis_program_intr(struct tpm_sc *sc, bool enable) 250 { 251 rman_res_t irq; 252 uint32_t reg; 253 254 sx_assert(&sc->dev_lock, SA_XLOCKED); 255 256 if (!tpmtis_request_locality(sc, 0)) { 257 /* Interrupt enable can be read without owning locality. */ 258 return (!enable && (TPM_READ_4(sc->dev, TPM_INT_ENABLE) & 259 TPM_INT_ENABLE_GLOBAL_ENABLE) == 0); 260 } 261 262 /* Disable delivery before acknowledging or reconfiguring interrupts. */ 263 reg = TPM_READ_4(sc->dev, TPM_INT_ENABLE); 264 reg &= ~TPM_INT_ENABLE_GLOBAL_ENABLE; 265 TPM_WRITE_4(sc->dev, TPM_INT_ENABLE, reg); 266 TPM_WRITE_BARRIER(sc->dev, TPM_INT_ENABLE, 4); 267 if ((TPM_READ_4(sc->dev, TPM_INT_ENABLE) & 268 TPM_INT_ENABLE_GLOBAL_ENABLE) != 0) { 269 tpmtis_relinquish_locality(sc); 270 return (false); 271 } 272 273 /* Clear all pending interrupts. */ 274 reg = TPM_READ_4(sc->dev, TPM_INT_STS); 275 TPM_WRITE_4(sc->dev, TPM_INT_STS, reg); 276 277 if (enable) { 278 KASSERT(sc->intr_cookie != NULL, 279 ("TPM interrupts enabled without a handler")); 280 irq = bus_get_resource_start(sc->dev, SYS_RES_IRQ, 281 sc->irq_rid); 282 if (irq == 0 || irq > 0xf) { 283 tpmtis_relinquish_locality(sc); 284 return (false); 285 } 286 TPM_WRITE_1(sc->dev, TPM_INT_VECTOR, (uint8_t)irq); 287 288 if (sc->intr_mask == 0) { 289 reg = TPM_READ_4(sc->dev, TPM_INT_ENABLE); 290 reg |= TPM_INT_ENABLE_DATA_AVAIL | 291 TPM_INT_ENABLE_LOC_CHANGE | 292 TPM_INT_ENABLE_CMD_RDY | 293 TPM_INT_ENABLE_STS_VALID; 294 reg &= ~TPM_INT_ENABLE_GLOBAL_ENABLE; 295 sc->intr_mask = reg; 296 } 297 TPM_WRITE_4(sc->dev, TPM_INT_ENABLE, 298 sc->intr_mask | TPM_INT_ENABLE_GLOBAL_ENABLE); 299 } 300 301 tpmtis_relinquish_locality(sc); 302 return (true); 303 } 304 305 static void 306 tpmtis_setup_intr(struct tpm_sc *sc) 307 { 308 bool configured, enable; 309 310 enable = sc->intr_cookie != NULL; 311 sx_xlock(&sc->dev_lock); 312 mtx_lock(&sc->intr_lock); 313 sc->interrupts = false; 314 sc->intr_type = -1; 315 mtx_unlock(&sc->intr_lock); 316 configured = tpmtis_program_intr(sc, enable); 317 sx_xunlock(&sc->dev_lock); 318 if (!configured || !enable) 319 return; 320 tpmtis_test_intr(sc); 321 } 322 323 static int 324 tpmtis_resume(device_t dev) 325 { 326 struct tpm_sc *sc; 327 bool restore_intr; 328 329 sc = device_get_softc(dev); 330 sx_xlock(&sc->dev_lock); 331 mtx_lock(&sc->intr_lock); 332 restore_intr = sc->interrupts; 333 334 /* 335 * Interrupt routing and enable state may be lost across suspend. Keep 336 * the transport in polling mode until a restored interrupt is actually 337 * observed by the handler. 338 */ 339 sc->interrupts = false; 340 sc->intr_type = -1; 341 mtx_unlock(&sc->intr_lock); 342 if (!tpmtis_program_intr(sc, restore_intr)) 343 device_printf(dev, 344 "failed to %s interrupts; using polling\n", 345 restore_intr ? "restore" : "disable"); 346 sx_xunlock(&sc->dev_lock); 347 348 return (tpm20_resume(dev)); 349 } 350 351 static void 352 tpmtis_intr_handler(void *arg) 353 { 354 struct tpm_sc *sc; 355 uint32_t status; 356 357 sc = (struct tpm_sc *)arg; 358 status = TPM_READ_4(sc->dev, TPM_INT_STS); 359 360 TPM_WRITE_4(sc->dev, TPM_INT_STS, status); 361 362 mtx_lock(&sc->intr_lock); 363 /* Check for stray interrupts. */ 364 if (sc->intr_type != -1 && (sc->intr_type & status) != 0) { 365 sc->interrupts = true; 366 sc->intr_generation++; 367 cv_broadcast(&sc->intr_cv); 368 } 369 mtx_unlock(&sc->intr_lock); 370 } 371 372 static uint32_t 373 tpmtis_read_wait_reg(struct tpm_sc *sc, bus_size_t off, bool reg32) 374 { 375 376 if (reg32) 377 return (TPM_READ_4(sc->dev, off)); 378 return (TPM_READ_1(sc->dev, off)); 379 } 380 381 static bool 382 tpm_wait_for_reg(struct tpm_sc *sc, bus_size_t off, uint32_t mask, 383 uint32_t val, int32_t timeout, int intr_type, bool reg32) 384 { 385 sbintime_t deadline; 386 uint32_t generation; 387 bool interrupts, result; 388 389 sx_assert(&sc->dev_lock, SA_XLOCKED); 390 deadline = sbinuptime() + ustosbt(timeout); 391 mtx_lock(&sc->intr_lock); 392 sc->intr_type = intr_type; 393 generation = sc->intr_generation; 394 interrupts = sc->interrupts; 395 mtx_unlock(&sc->intr_lock); 396 397 for (;;) { 398 result = (tpmtis_read_wait_reg(sc, off, reg32) & mask) == val; 399 if (result) 400 break; 401 if (sbinuptime() >= deadline) 402 break; 403 if (!interrupts) { 404 pause("TPM POLLING", 1); 405 mtx_lock(&sc->intr_lock); 406 generation = sc->intr_generation; 407 interrupts = sc->interrupts; 408 mtx_unlock(&sc->intr_lock); 409 continue; 410 } 411 412 /* 413 * Register access may sleep for a SPI TPM, so evaluate the 414 * predicate without intr_lock. The generation check closes the 415 * resulting window before cv_timedwait_sbt() atomically sleeps. 416 */ 417 mtx_lock(&sc->intr_lock); 418 if (generation == sc->intr_generation) 419 (void)cv_timedwait_sbt(&sc->intr_cv, &sc->intr_lock, 420 deadline, 0, C_ABSOLUTE | C_HARDCLOCK); 421 generation = sc->intr_generation; 422 interrupts = sc->interrupts; 423 mtx_unlock(&sc->intr_lock); 424 } 425 426 mtx_lock(&sc->intr_lock); 427 sc->intr_type = -1; 428 mtx_unlock(&sc->intr_lock); 429 return (result); 430 } 431 432 static uint16_t 433 tpmtis_wait_for_burst(struct tpm_sc *sc) 434 { 435 int timeout; 436 uint16_t burst_count; 437 438 timeout = TPM_TIMEOUT_A; 439 440 while (timeout-- > 0) { 441 burst_count = (TPM_READ_4(sc->dev, TPM_STS) & TPM_STS_BURST_MASK) >> 442 TPM_STS_BURST_OFFSET; 443 if (burst_count > 0) 444 break; 445 446 DELAY(1); 447 } 448 return (burst_count); 449 } 450 451 static bool 452 tpmtis_read_bytes(struct tpm_sc *sc, size_t count, uint8_t *buf) 453 { 454 uint16_t burst_count; 455 456 while (count > 0) { 457 burst_count = tpmtis_wait_for_burst(sc); 458 if (burst_count == 0) 459 return (false); 460 461 burst_count = MIN(burst_count, count); 462 count -= burst_count; 463 464 while (burst_count-- > 0) 465 *buf++ = TPM_READ_1(sc->dev, TPM_DATA_FIFO); 466 } 467 468 return (true); 469 } 470 471 static bool 472 tpmtis_write_bytes(struct tpm_sc *sc, size_t count, uint8_t *buf) 473 { 474 uint16_t burst_count; 475 476 while (count > 0) { 477 burst_count = tpmtis_wait_for_burst(sc); 478 if (burst_count == 0) 479 return (false); 480 481 burst_count = MIN(burst_count, count); 482 count -= burst_count; 483 484 while (burst_count-- > 0) 485 TPM_WRITE_1(sc->dev, TPM_DATA_FIFO, *buf++); 486 } 487 488 return (true); 489 } 490 491 static bool 492 tpmtis_request_locality(struct tpm_sc *sc, int locality) 493 { 494 uint8_t mask; 495 496 sx_assert(&sc->dev_lock, SA_XLOCKED); 497 /* Currently we only support Locality 0 */ 498 if (locality != 0) 499 return (false); 500 501 mask = TPM_ACCESS_LOC_ACTIVE | TPM_ACCESS_VALID; 502 503 TPM_WRITE_1(sc->dev, TPM_ACCESS, TPM_ACCESS_LOC_REQ); 504 TPM_WRITE_BARRIER(sc->dev, TPM_ACCESS, 1); 505 if (tpm_wait_for_reg(sc, TPM_ACCESS, mask, mask, TPM_TIMEOUT_A, 506 TPM_INT_STS_LOC_CHANGE, false)) 507 return (true); 508 509 /* Cancel the request so a later grant cannot leave locality owned. */ 510 TPM_WRITE_1(sc->dev, TPM_ACCESS, TPM_ACCESS_LOC_RELINQUISH); 511 TPM_WRITE_BARRIER(sc->dev, TPM_ACCESS, 1); 512 return (false); 513 } 514 515 static void 516 tpmtis_relinquish_locality(struct tpm_sc *sc) 517 { 518 bool interrupts; 519 520 sx_assert(&sc->dev_lock, SA_XLOCKED); 521 /* 522 * Interrupts can only be cleared when a locality is active. 523 * Clear them now in case interrupt handler didn't make it in time. 524 */ 525 mtx_lock(&sc->intr_lock); 526 interrupts = sc->interrupts; 527 mtx_unlock(&sc->intr_lock); 528 if (interrupts) 529 TPM_WRITE_4(sc->dev, TPM_INT_STS, 530 TPM_READ_4(sc->dev, TPM_INT_STS)); 531 532 OR1(sc, TPM_ACCESS, TPM_ACCESS_LOC_RELINQUISH); 533 } 534 535 static bool 536 tpmtis_go_ready(struct tpm_sc *sc) 537 { 538 uint32_t mask; 539 540 mask = TPM_STS_CMD_RDY; 541 542 TPM_WRITE_4(sc->dev, TPM_STS, TPM_STS_CMD_RDY); 543 TPM_WRITE_BARRIER(sc->dev, TPM_STS, 4); 544 if (!tpm_wait_for_reg(sc, TPM_STS, mask, mask, TPM_TIMEOUT_B, 545 TPM_INT_STS_CMD_RDY, true)) 546 return (false); 547 548 return (true); 549 } 550 551 static int 552 tpmtis_transmit(device_t dev, struct tpm_priv *priv, size_t length) 553 { 554 struct tpm_sc *sc; 555 size_t bytes_available; 556 uint32_t mask, curr_cmd; 557 int error, timeout; 558 bool locality; 559 560 sc = device_get_softc(dev); 561 sx_assert(&sc->dev_lock, SA_XLOCKED); 562 locality = false; 563 564 if (!tpmtis_request_locality(sc, 0)) { 565 device_printf(dev, 566 "Failed to obtain locality\n"); 567 return (EIO); 568 } 569 locality = true; 570 if (!tpmtis_go_ready(sc)) { 571 device_printf(dev, 572 "Failed to switch to ready state\n"); 573 error = EIO; 574 goto out; 575 } 576 if (!tpmtis_write_bytes(sc, length, priv->buf)) { 577 device_printf(dev, 578 "Failed to write cmd to device\n"); 579 error = EIO; 580 goto out; 581 } 582 583 mask = TPM_STS_VALID; 584 if (!tpm_wait_for_reg(sc, TPM_STS, mask, mask, TPM_TIMEOUT_C, 585 TPM_INT_STS_VALID, true)) { 586 device_printf(dev, 587 "Timeout while waiting for valid bit\n"); 588 error = EIO; 589 goto out; 590 } 591 if (TPM_READ_4(dev, TPM_STS) & TPM_STS_DATA_EXPECTED) { 592 device_printf(dev, 593 "Device expects more data even though we already" 594 " sent everything we had\n"); 595 error = EIO; 596 goto out; 597 } 598 599 /* 600 * Calculate timeout for current command. 601 * Command code is passed in bytes 6-10. 602 */ 603 curr_cmd = be32toh(*(uint32_t *) (&priv->buf[6])); 604 timeout = tpm20_get_timeout(curr_cmd); 605 606 TPM_WRITE_4(dev, TPM_STS, TPM_STS_CMD_START); 607 TPM_WRITE_BARRIER(dev, TPM_STS, 4); 608 609 mask = TPM_STS_DATA_AVAIL | TPM_STS_VALID; 610 if (!tpm_wait_for_reg(sc, TPM_STS, mask, mask, timeout, 611 TPM_INT_STS_DATA_AVAIL, true)) { 612 device_printf(dev, 613 "Timeout while waiting for device to process cmd\n"); 614 /* 615 * Switching to ready state also cancels processing 616 * current command 617 */ 618 if (!tpmtis_go_ready(sc)) { 619 error = EIO; 620 goto out; 621 } 622 623 /* 624 * After canceling a command we should get a response, 625 * check if there is one. 626 */ 627 if (!tpm_wait_for_reg(sc, TPM_STS, mask, mask, TPM_TIMEOUT_C, 628 TPM_INT_STS_DATA_AVAIL, true)) { 629 error = EIO; 630 goto out; 631 } 632 } 633 /* Read response header. Length is passed in bytes 2 - 6. */ 634 if (!tpmtis_read_bytes(sc, TPM_HEADER_SIZE, priv->buf)) { 635 device_printf(dev, 636 "Failed to read response header\n"); 637 error = EIO; 638 goto out; 639 } 640 bytes_available = be32toh(*(uint32_t *) (&priv->buf[2])); 641 642 if (bytes_available > TPM_BUFSIZE || bytes_available < TPM_HEADER_SIZE) { 643 device_printf(dev, 644 "Incorrect response size: %zu\n", 645 bytes_available); 646 error = EIO; 647 goto out; 648 } 649 if (!tpmtis_read_bytes(sc, bytes_available - TPM_HEADER_SIZE, 650 &priv->buf[TPM_HEADER_SIZE])) { 651 device_printf(dev, 652 "Failed to read response\n"); 653 error = EIO; 654 goto out; 655 } 656 priv->offset = 0; 657 priv->len = bytes_available; 658 error = 0; 659 660 out: 661 /* 662 * Per TIS 1.3 section 5.6.12, write commandReady after every command 663 * attempt so the TPM can discard a partial FIFO transaction and free 664 * its internal resources. The next tpmtis_go_ready() provides the 665 * second write the spec mentions and waits for the state transition. 666 */ 667 if (locality) { 668 TPM_WRITE_4(sc->dev, TPM_STS, TPM_STS_CMD_RDY); 669 TPM_WRITE_BARRIER(sc->dev, TPM_STS, 4); 670 tpmtis_relinquish_locality(sc); 671 } 672 673 return (error); 674 } 675 676 /* ACPI Driver */ 677 static device_method_t tpmtis_methods[] = { 678 DEVMETHOD(device_attach, tpmtis_attach), 679 DEVMETHOD(device_detach, tpmtis_detach), 680 DEVMETHOD(device_shutdown, tpm20_shutdown), 681 DEVMETHOD(device_suspend, tpm20_suspend), 682 DEVMETHOD(device_resume, tpmtis_resume), 683 DEVMETHOD(tpm_transmit, tpmtis_transmit), 684 DEVMETHOD_END 685 }; 686 687 DEFINE_CLASS_0(tpmtis, tpmtis_driver, tpmtis_methods, sizeof(struct tpm_sc)); 688