xref: /netbsd-src/sys/dev/ic/tpm.c (revision 627f7eb200a4419d89b531d55fccd2ee3ffdcde0)
1 /*	$NetBSD: tpm.c,v 1.19 2021/01/04 18:26:59 riastradh Exp $	*/
2 
3 /*
4  * Copyright (c) 2019 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * This code is derived from software contributed to The NetBSD Foundation
8  * by Maxime Villard.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
21  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
22  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
23  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
24  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
27  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29  * POSSIBILITY OF SUCH DAMAGE.
30  */
31 
32 /*
33  * Copyright (c) 2008, 2009 Michael Shalayeff
34  * Copyright (c) 2009, 2010 Hans-Joerg Hoexer
35  * All rights reserved.
36  *
37  * Permission to use, copy, modify, and distribute this software for any
38  * purpose with or without fee is hereby granted, provided that the above
39  * copyright notice and this permission notice appear in all copies.
40  *
41  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
42  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
43  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
44  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
45  * WHATSOEVER RESULTING FROM LOSS OF MIND, USE, DATA OR PROFITS, WHETHER IN
46  * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
47  * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
48  */
49 
50 #include <sys/cdefs.h>
51 __KERNEL_RCSID(0, "$NetBSD: tpm.c,v 1.19 2021/01/04 18:26:59 riastradh Exp $");
52 
53 #include <sys/param.h>
54 #include <sys/types.h>
55 
56 #include <sys/atomic.h>
57 #include <sys/bus.h>
58 #include <sys/conf.h>
59 #include <sys/device.h>
60 #include <sys/kernel.h>
61 #include <sys/malloc.h>
62 #include <sys/pmf.h>
63 #include <sys/proc.h>
64 #include <sys/systm.h>
65 #include <sys/workqueue.h>
66 
67 #include <dev/ic/tpmreg.h>
68 #include <dev/ic/tpmvar.h>
69 
70 #include "ioconf.h"
71 
72 CTASSERT(sizeof(struct tpm_header) == 10);
73 
74 #define TPM_BUFSIZ	1024
75 
76 #define TPM_PARAM_SIZE	0x0001	/* that's a flag */
77 
78 /* Timeouts. */
79 #define TPM_ACCESS_TMO	2000	/* 2sec */
80 #define TPM_READY_TMO	2000	/* 2sec */
81 #define TPM_READ_TMO	2000	/* 2sec */
82 #define TPM_BURST_TMO	2000	/* 2sec */
83 
84 #define TPM_CAPS_REQUIRED \
85 	(TPM_INTF_DATA_AVAIL_INT|TPM_INTF_LOCALITY_CHANGE_INT| \
86 	 TPM_INTF_INT_LEVEL_LOW)
87 
88 static inline int
89 tpm_tmotohz(int tmo)
90 {
91 	struct timeval tv;
92 
93 	tv.tv_sec = tmo / 1000;
94 	tv.tv_usec = 1000 * (tmo % 1000);
95 
96 	return tvtohz(&tv);
97 }
98 
99 static int
100 tpm_getburst(struct tpm_softc *sc)
101 {
102 	int burst, to, rv;
103 
104 	to = tpm_tmotohz(TPM_BURST_TMO);
105 
106 	while (to--) {
107 		/*
108 		 * Burst count is in bits 23:8, so read the two higher bytes.
109 		 */
110 		burst = bus_space_read_1(sc->sc_bt, sc->sc_bh, TPM_STS + 1);
111 		burst |= bus_space_read_1(sc->sc_bt, sc->sc_bh, TPM_STS + 2)
112 		    << 8;
113 
114 		if (burst)
115 			return burst;
116 
117 		rv = tsleep(sc, PCATCH, "tpm_getburst", 1);
118 		if (rv && rv != EWOULDBLOCK) {
119 			return 0;
120 		}
121 	}
122 
123 	return 0;
124 }
125 
126 static inline uint8_t
127 tpm_status(struct tpm_softc *sc)
128 {
129 	return bus_space_read_1(sc->sc_bt, sc->sc_bh, TPM_STS) &
130 	    TPM_STS_STATUS_BITS;
131 }
132 
133 /* -------------------------------------------------------------------------- */
134 
135 static bool
136 tpm12_suspend(struct tpm_softc *sc)
137 {
138 	static const uint8_t command[10] = {
139 		0x00, 0xC1,		/* TPM_TAG_RQU_COMMAND */
140 		0x00, 0x00, 0x00, 10,	/* Length in bytes */
141 		0x00, 0x00, 0x00, 0x98	/* TPM_ORD_SaveState */
142 	};
143 	struct tpm_header response;
144 
145 	if ((*sc->sc_intf->write)(sc, &command, sizeof(command)) != 0)
146 		return false;
147 	if ((*sc->sc_intf->read)(sc, &response, sizeof(response), NULL, 0) != 0)
148 		return false;
149 	if (TPM_BE32(response.code) != 0)
150 		return false;
151 
152 	return true;
153 }
154 
155 static bool
156 tpm20_suspend(struct tpm_softc *sc)
157 {
158 	static const uint8_t command[12] = {
159 		0x80, 0x01,		/* TPM_ST_NO_SESSIONS */
160 		0x00, 0x00, 0x00, 12,	/* Length in bytes */
161 		0x00, 0x00, 0x01, 0x45,	/* TPM_CC_Shutdown */
162 		0x00, 0x01		/* TPM_SU_STATE */
163 	};
164 	struct tpm_header response;
165 
166 	if ((*sc->sc_intf->write)(sc, &command, sizeof(command)) != 0)
167 		return false;
168 	if ((*sc->sc_intf->read)(sc, &response, sizeof(response), NULL, 0) != 0)
169 		return false;
170 	if (TPM_BE32(response.code) != 0)
171 		return false;
172 
173 	return true;
174 }
175 
176 bool
177 tpm_suspend(device_t dev, const pmf_qual_t *qual)
178 {
179 	struct tpm_softc *sc = device_private(dev);
180 
181 	switch (sc->sc_ver) {
182 	case TPM_1_2:
183 		return tpm12_suspend(sc);
184 	case TPM_2_0:
185 		return tpm20_suspend(sc);
186 	default:
187 		panic("%s: impossible", __func__);
188 	}
189 }
190 
191 bool
192 tpm_resume(device_t dev, const pmf_qual_t *qual)
193 {
194 	/*
195 	 * Don't do anything, the BIOS is supposed to restore the previously
196 	 * saved state.
197 	 */
198 	return true;
199 }
200 
201 /* -------------------------------------------------------------------------- */
202 
203 static int
204 tpm_poll(struct tpm_softc *sc, uint8_t mask, int to, wchan_t chan)
205 {
206 	int rv;
207 
208 	while (((sc->sc_status = tpm_status(sc)) & mask) != mask && to--) {
209 		rv = tsleep(chan, PCATCH, "tpm_poll", 1);
210 		if (rv && rv != EWOULDBLOCK) {
211 			return rv;
212 		}
213 	}
214 
215 	return 0;
216 }
217 
218 static int
219 tpm_waitfor(struct tpm_softc *sc, uint8_t bits, int tmo, wchan_t chan)
220 {
221 	int retry, to, rv;
222 	uint8_t todo;
223 
224 	to = tpm_tmotohz(tmo);
225 	retry = 3;
226 
227 restart:
228 	todo = bits;
229 
230 	/*
231 	 * TPM_STS_VALID has priority over the others.
232 	 */
233 	if (todo & TPM_STS_VALID) {
234 		if ((rv = tpm_poll(sc, TPM_STS_VALID, to+1, chan)) != 0)
235 			return rv;
236 		todo &= ~TPM_STS_VALID;
237 	}
238 
239 	if ((rv = tpm_poll(sc, todo, to, chan)) != 0)
240 		return rv;
241 
242 	if ((todo & sc->sc_status) != todo) {
243 		if ((retry-- > 0) && (bits & TPM_STS_VALID)) {
244 			bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_STS,
245 			    TPM_STS_RESP_RETRY);
246 			goto restart;
247 		}
248 		return EIO;
249 	}
250 
251 	return 0;
252 }
253 
254 /* -------------------------------------------------------------------------- */
255 
256 /*
257  * TPM using the TIS 1.2 interface.
258  */
259 
260 static int
261 tpm12_request_locality(struct tpm_softc *sc, int l)
262 {
263 	uint32_t r;
264 	int to, rv;
265 
266 	if (l != 0)
267 		return EINVAL;
268 
269 	if ((bus_space_read_1(sc->sc_bt, sc->sc_bh, TPM_ACCESS) &
270 	    (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY)) ==
271 	    (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY))
272 		return 0;
273 
274 	bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_ACCESS,
275 	    TPM_ACCESS_REQUEST_USE);
276 
277 	to = tpm_tmotohz(TPM_ACCESS_TMO);
278 
279 	while ((r = bus_space_read_1(sc->sc_bt, sc->sc_bh, TPM_ACCESS) &
280 	    (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY)) !=
281 	    (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY) && to--) {
282 		rv = tsleep(sc->sc_intf->init, PCATCH, "tpm_locality", 1);
283 		if (rv && rv != EWOULDBLOCK) {
284 			return rv;
285 		}
286 	}
287 
288 	if ((r & (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY)) !=
289 	    (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY)) {
290 		return EBUSY;
291 	}
292 
293 	return 0;
294 }
295 
296 static int
297 tpm_tis12_probe(bus_space_tag_t bt, bus_space_handle_t bh)
298 {
299 	uint32_t cap;
300 	uint8_t reg;
301 	int tmo;
302 
303 	cap = bus_space_read_4(bt, bh, TPM_INTF_CAPABILITY);
304 	if (cap == 0xffffffff)
305 		return EINVAL;
306 	if ((cap & TPM_CAPS_REQUIRED) != TPM_CAPS_REQUIRED)
307 		return ENOTSUP;
308 
309 	/* Request locality 0. */
310 	bus_space_write_1(bt, bh, TPM_ACCESS, TPM_ACCESS_REQUEST_USE);
311 
312 	/* Wait for it to become active. */
313 	tmo = TPM_ACCESS_TMO; /* Milliseconds. */
314 	while ((reg = bus_space_read_1(bt, bh, TPM_ACCESS) &
315 	    (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY)) !=
316 	    (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY) && tmo--) {
317 		DELAY(1000); /* 1 millisecond. */
318 	}
319 	if ((reg & (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY)) !=
320 	    (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY)) {
321 		return ETIMEDOUT;
322 	}
323 
324 	if (bus_space_read_4(bt, bh, TPM_ID) == 0xffffffff)
325 		return EINVAL;
326 
327 	return 0;
328 }
329 
330 static void
331 tpm_tis12_rng_work(struct work *wk, void *cookie)
332 {
333 	struct tpm_softc *sc = cookie;
334 	/*
335 	 * TPM Specification Version 1.2, Main Part 3: Commands,
336 	 * Sec. 13.6 TPM_GetRandom
337 	 */
338 	struct {
339 		struct tpm_header hdr;
340 		uint32_t bytesRequested;
341 	} __packed command;
342 	struct response {
343 		struct tpm_header hdr;
344 		uint32_t randomBytesSize;
345 		uint8_t	bytes[64];
346 	} __packed response;
347 	bool busy, endwrite = false, endread = false;
348 	size_t nread;
349 	uint16_t tag;
350 	uint32_t pktlen, code, nbytes;
351 	int rv;
352 
353 	/* Acknowledge the request.  */
354 	sc->sc_rndpending = 0;
355 
356 	/* Lock userland out of the tpm, or fail if it's already open.  */
357 	mutex_enter(&sc->sc_lock);
358 	busy = sc->sc_busy;
359 	sc->sc_busy = true;
360 	mutex_exit(&sc->sc_lock);
361 	if (busy) {		/* tough */
362 		aprint_debug_dev(sc->sc_dev, "%s: device in use\n", __func__);
363 		return;
364 	}
365 
366 	/* Encode the command.  */
367 	memset(&command, 0, sizeof(command));
368 	command.hdr.tag = htobe16(TPM_TAG_RQU_COMMAND);
369 	command.hdr.length = htobe32(sizeof(command));
370 	command.hdr.code = htobe32(TPM_ORD_GetRandom);
371 	command.bytesRequested = htobe32(sizeof(response.bytes));
372 
373 	/* Write the command.   */
374 	if ((rv = (*sc->sc_intf->start)(sc, UIO_WRITE)) != 0) {
375 		device_printf(sc->sc_dev, "start write failed, error=%d\n",
376 		    rv);
377 		goto out;
378 	}
379 	endwrite = true;
380 	if ((rv = (*sc->sc_intf->write)(sc, &command, sizeof(command))) != 0) {
381 		device_printf(sc->sc_dev, "write failed, error=%d\n", rv);
382 		goto out;
383 	}
384 	rv = (*sc->sc_intf->end)(sc, UIO_WRITE, 0);
385 	endwrite = false;
386 	if (rv) {
387 		device_printf(sc->sc_dev, "end write failed, error=%d\n", rv);
388 		goto out;
389 	}
390 
391 	/* Read the response header.  */
392 	if ((rv = (*sc->sc_intf->start)(sc, UIO_READ)) != 0) {
393 		device_printf(sc->sc_dev, "start write failed, error=%d\n",
394 		    rv);
395 		goto out;
396 	}
397 	endread = true;
398 	if ((rv = (*sc->sc_intf->read)(sc, &response.hdr, sizeof(response.hdr),
399 		    &nread, 0)) != 0) {
400 		device_printf(sc->sc_dev, "read failed, error=%d\n", rv);
401 		goto out;
402 	}
403 
404 	/* Verify the response header looks sensible.  */
405 	if (nread != sizeof(response.hdr)) {
406 		device_printf(sc->sc_dev, "read %zu bytes, expected %zu",
407 		    nread, sizeof(response.hdr));
408 		goto out;
409 	}
410 	tag = be16toh(response.hdr.tag);
411 	pktlen = be32toh(response.hdr.length);
412 	code = be32toh(response.hdr.code);
413 	if (tag != TPM_TAG_RSP_COMMAND ||
414 	    pktlen < offsetof(struct response, bytes) ||
415 	    pktlen > sizeof(response) ||
416 	    code != 0) {
417 		/*
418 		 * If the tpm itself is busy (e.g., it has yet to run a
419 		 * self-test, or it's in a timeout period to defend
420 		 * against brute force attacks), then we can try again
421 		 * later.  Otherwise, give up.
422 		 */
423 		if (code & TPM_NON_FATAL) {
424 			aprint_debug_dev(sc->sc_dev, "%s: tpm busy, code=%u\n",
425 			    __func__, code & ~TPM_NON_FATAL);
426 			rv = 0;
427 		} else if (code == TPM_DEACTIVATED) {
428 			device_printf(sc->sc_dev, "tpm is deactivated\n");
429 			rv = ENXIO;
430 		} else {
431 			device_printf(sc->sc_dev, "bad tpm response:"
432 			    " tag=%u len=%u code=%u\n", tag, pktlen, code);
433 			hexdump(aprint_debug, "tpm response header",
434 			    (const void *)&response.hdr,
435 			    sizeof(response.hdr));
436 			rv = EIO;
437 		}
438 		goto out;
439 	}
440 
441 	/* Read the response payload.  */
442 	if ((rv = (*sc->sc_intf->read)(sc,
443 		    (char *)&response + nread, pktlen - nread,
444 		    NULL, TPM_PARAM_SIZE)) != 0) {
445 		device_printf(sc->sc_dev, "read failed, error=%d\n", rv);
446 		goto out;
447 	}
448 	endread = false;
449 	if ((rv = (*sc->sc_intf->end)(sc, UIO_READ, 0)) != 0) {
450 		device_printf(sc->sc_dev, "end read failed, error=%d\n", rv);
451 		goto out;
452 	}
453 
454 	/* Verify the number of bytes read looks sensible.  */
455 	nbytes = be32toh(response.randomBytesSize);
456 	if (nbytes > pktlen - offsetof(struct response, bytes)) {
457 		device_printf(sc->sc_dev, "overlong GetRandom length:"
458 		    " %u, max %zu\n",
459 		    nbytes, pktlen - offsetof(struct response, bytes));
460 		nbytes = pktlen - offsetof(struct response, bytes);
461 	}
462 
463 	/*
464 	 * Enter the data into the entropy pool.  Conservatively (or,
465 	 * perhaps, cargocultily) estimate half a bit of entropy per
466 	 * bit of data.
467 	 */
468 	rnd_add_data(&sc->sc_rnd, response.bytes, nbytes, (NBBY/2)*nbytes);
469 
470 out:	/*
471 	 * If the tpm is busted, no sense in trying again -- most
472 	 * likely, it is deactivated, and by the spec it cannot be
473 	 * reactivated until after a reboot.
474 	 */
475 	if (rv) {
476 		device_printf(sc->sc_dev, "deactivating entropy source\n");
477 		rnd_detach_source(&sc->sc_rnd);
478 		/* XXX worker thread can't workqueue_destroy its own queue */
479 	}
480 
481 	/* End the read or write if still ongoing.  */
482 	if (endread)
483 		rv = (*sc->sc_intf->end)(sc, UIO_READ, rv);
484 	if (endwrite)
485 		rv = (*sc->sc_intf->end)(sc, UIO_WRITE, rv);
486 
487 	/* Relinquish the tpm back to userland.  */
488 	mutex_enter(&sc->sc_lock);
489 	KASSERT(sc->sc_busy);
490 	sc->sc_busy = false;
491 	mutex_exit(&sc->sc_lock);
492 }
493 
494 static void
495 tpm_tis12_rng_get(size_t nbytes, void *cookie)
496 {
497 	struct tpm_softc *sc = cookie;
498 
499 	if (atomic_swap_uint(&sc->sc_rndpending, 1) == 0)
500 		workqueue_enqueue(sc->sc_rndwq, &sc->sc_rndwk, NULL);
501 }
502 
503 static int
504 tpm_tis12_init(struct tpm_softc *sc)
505 {
506 	int rv;
507 
508 	aprint_naive("\n");
509 	aprint_normal("\n");
510 
511 	sc->sc_caps = bus_space_read_4(sc->sc_bt, sc->sc_bh,
512 	    TPM_INTF_CAPABILITY);
513 	sc->sc_devid = bus_space_read_4(sc->sc_bt, sc->sc_bh, TPM_ID);
514 	sc->sc_rev = bus_space_read_1(sc->sc_bt, sc->sc_bh, TPM_REV);
515 
516 	aprint_normal_dev(sc->sc_dev, "device 0x%08x rev 0x%x\n",
517 	    sc->sc_devid, sc->sc_rev);
518 
519 	if ((rv = tpm12_request_locality(sc, 0)) != 0)
520 		return rv;
521 
522 	/* Abort whatever it thought it was doing. */
523 	bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_STS, TPM_STS_CMD_READY);
524 
525 	/* XXX Run this at higher priority?  */
526 	if ((rv = workqueue_create(&sc->sc_rndwq, device_xname(sc->sc_dev),
527 		    tpm_tis12_rng_work, sc, PRI_NONE, IPL_VM, WQ_MPSAFE)) != 0)
528 		return rv;
529 	rndsource_setcb(&sc->sc_rnd, tpm_tis12_rng_get, sc);
530 	rnd_attach_source(&sc->sc_rnd, device_xname(sc->sc_dev),
531 	    RND_TYPE_RNG,
532 	    RND_FLAG_COLLECT_VALUE|RND_FLAG_ESTIMATE_VALUE|RND_FLAG_HASCB);
533 
534 	return 0;
535 }
536 
537 static int
538 tpm_tis12_start(struct tpm_softc *sc, int rw)
539 {
540 	int rv;
541 
542 	if (rw == UIO_READ) {
543 		rv = tpm_waitfor(sc, TPM_STS_DATA_AVAIL | TPM_STS_VALID,
544 		    TPM_READ_TMO, sc->sc_intf->read);
545 		return rv;
546 	}
547 
548 	/* Request the 0th locality. */
549 	if ((rv = tpm12_request_locality(sc, 0)) != 0)
550 		return rv;
551 
552 	sc->sc_status = tpm_status(sc);
553 	if (sc->sc_status & TPM_STS_CMD_READY)
554 		return 0;
555 
556 	/* Abort previous and restart. */
557 	bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_STS, TPM_STS_CMD_READY);
558 	rv = tpm_waitfor(sc, TPM_STS_CMD_READY, TPM_READY_TMO, sc->sc_intf->write);
559 	if (rv)
560 		return rv;
561 
562 	return 0;
563 }
564 
565 static int
566 tpm_tis12_read(struct tpm_softc *sc, void *buf, size_t len, size_t *count,
567     int flags)
568 {
569 	uint8_t *p = buf;
570 	size_t cnt;
571 	int rv, n;
572 
573 	cnt = 0;
574 	while (len > 0) {
575 		rv = tpm_waitfor(sc, TPM_STS_DATA_AVAIL | TPM_STS_VALID,
576 		    TPM_READ_TMO, sc->sc_intf->read);
577 		if (rv)
578 			return rv;
579 
580 		n = MIN(len, tpm_getburst(sc));
581 		while (n > 0) {
582 			*p++ = bus_space_read_1(sc->sc_bt, sc->sc_bh, TPM_DATA);
583 			cnt++;
584 			len--;
585 			n--;
586 		}
587 
588 		if ((flags & TPM_PARAM_SIZE) == 0 && cnt >= 6)
589 			break;
590 	}
591 
592 	if (count)
593 		*count = cnt;
594 
595 	return 0;
596 }
597 
598 static int
599 tpm_tis12_write(struct tpm_softc *sc, const void *buf, size_t len)
600 {
601 	const uint8_t *p = buf;
602 	size_t cnt;
603 	int rv, r;
604 
605 	if (len == 0)
606 		return 0;
607 	if ((rv = tpm12_request_locality(sc, 0)) != 0)
608 		return rv;
609 
610 	cnt = 0;
611 	while (cnt < len - 1) {
612 		for (r = tpm_getburst(sc); r > 0 && cnt < len - 1; r--) {
613 			bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_DATA, *p++);
614 			cnt++;
615 		}
616 		if ((rv = tpm_waitfor(sc, TPM_STS_VALID, TPM_READ_TMO, sc))) {
617 			return rv;
618 		}
619 		sc->sc_status = tpm_status(sc);
620 		if (!(sc->sc_status & TPM_STS_DATA_EXPECT)) {
621 			return EIO;
622 		}
623 	}
624 
625 	bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_DATA, *p++);
626 	cnt++;
627 
628 	if ((rv = tpm_waitfor(sc, TPM_STS_VALID, TPM_READ_TMO, sc))) {
629 		return rv;
630 	}
631 	if ((sc->sc_status & TPM_STS_DATA_EXPECT) != 0) {
632 		return EIO;
633 	}
634 
635 	return 0;
636 }
637 
638 static int
639 tpm_tis12_end(struct tpm_softc *sc, int rw, int err)
640 {
641 	int rv = 0;
642 
643 	if (rw == UIO_READ) {
644 		rv = tpm_waitfor(sc, TPM_STS_VALID, TPM_READ_TMO, sc->sc_intf->read);
645 		if (rv)
646 			return rv;
647 
648 		/* Still more data? */
649 		sc->sc_status = tpm_status(sc);
650 		if (!err && (sc->sc_status & TPM_STS_DATA_AVAIL)) {
651 			rv = EIO;
652 		}
653 
654 		bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_STS,
655 		    TPM_STS_CMD_READY);
656 
657 		/* Release the 0th locality. */
658 		bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_ACCESS,
659 		    TPM_ACCESS_ACTIVE_LOCALITY);
660 	} else {
661 		/* Hungry for more? */
662 		sc->sc_status = tpm_status(sc);
663 		if (!err && (sc->sc_status & TPM_STS_DATA_EXPECT)) {
664 			rv = EIO;
665 		}
666 
667 		bus_space_write_1(sc->sc_bt, sc->sc_bh, TPM_STS,
668 		    err ? TPM_STS_CMD_READY : TPM_STS_GO);
669 	}
670 
671 	return rv;
672 }
673 
674 const struct tpm_intf tpm_intf_tis12 = {
675 	.version = TIS_1_2,
676 	.probe = tpm_tis12_probe,
677 	.init = tpm_tis12_init,
678 	.start = tpm_tis12_start,
679 	.read = tpm_tis12_read,
680 	.write = tpm_tis12_write,
681 	.end = tpm_tis12_end
682 };
683 
684 /* -------------------------------------------------------------------------- */
685 
686 static dev_type_open(tpmopen);
687 static dev_type_close(tpmclose);
688 static dev_type_read(tpmread);
689 static dev_type_write(tpmwrite);
690 static dev_type_ioctl(tpmioctl);
691 
692 const struct cdevsw tpm_cdevsw = {
693 	.d_open = tpmopen,
694 	.d_close = tpmclose,
695 	.d_read = tpmread,
696 	.d_write = tpmwrite,
697 	.d_ioctl = tpmioctl,
698 	.d_stop = nostop,
699 	.d_tty = notty,
700 	.d_poll = nopoll,
701 	.d_mmap = nommap,
702 	.d_kqfilter = nokqfilter,
703 	.d_discard = nodiscard,
704 	.d_flag = D_OTHER | D_MPSAFE,
705 };
706 
707 static int
708 tpmopen(dev_t dev, int flag, int mode, struct lwp *l)
709 {
710 	struct tpm_softc *sc = device_lookup_private(&tpm_cd, minor(dev));
711 	int ret = 0;
712 
713 	if (sc == NULL)
714 		return ENXIO;
715 
716 	mutex_enter(&sc->sc_lock);
717 	if (sc->sc_busy) {
718 		ret = EBUSY;
719 	} else {
720 		sc->sc_busy = true;
721 	}
722 	mutex_exit(&sc->sc_lock);
723 
724 	return ret;
725 }
726 
727 static int
728 tpmclose(dev_t dev, int flag, int mode, struct lwp *l)
729 {
730 	struct tpm_softc *sc = device_lookup_private(&tpm_cd, minor(dev));
731 	int ret = 0;
732 
733 	if (sc == NULL)
734 		return ENXIO;
735 
736 	mutex_enter(&sc->sc_lock);
737 	if (!sc->sc_busy) {
738 		ret = EINVAL;
739 	} else {
740 		sc->sc_busy = false;
741 	}
742 	mutex_exit(&sc->sc_lock);
743 
744 	return ret;
745 }
746 
747 static int
748 tpmread(dev_t dev, struct uio *uio, int flags)
749 {
750 	struct tpm_softc *sc = device_lookup_private(&tpm_cd, minor(dev));
751 	struct tpm_header hdr;
752 	uint8_t buf[TPM_BUFSIZ];
753 	size_t cnt, len, n;
754 	int rv;
755 
756 	if (sc == NULL)
757 		return ENXIO;
758 
759 	if ((rv = (*sc->sc_intf->start)(sc, UIO_READ)))
760 		return rv;
761 
762 	/* Get the header. */
763 	if ((rv = (*sc->sc_intf->read)(sc, &hdr, sizeof(hdr), &cnt, 0))) {
764 		goto out;
765 	}
766 	len = TPM_BE32(hdr.length);
767 	if (len > uio->uio_resid || len < cnt) {
768 		rv = EIO;
769 		goto out;
770 	}
771 
772 	/* Copy out the header. */
773 	if ((rv = uiomove(&hdr, cnt, uio))) {
774 		goto out;
775 	}
776 
777 	/* Process the rest. */
778 	len -= cnt;
779 	while (len > 0) {
780 		n = MIN(sizeof(buf), len);
781 		if ((rv = (*sc->sc_intf->read)(sc, buf, n, NULL, TPM_PARAM_SIZE))) {
782 			goto out;
783 		}
784 		if ((rv = uiomove(buf, n, uio))) {
785 			goto out;
786 		}
787 		len -= n;
788 	}
789 
790 out:
791 	rv = (*sc->sc_intf->end)(sc, UIO_READ, rv);
792 	return rv;
793 }
794 
795 static int
796 tpmwrite(dev_t dev, struct uio *uio, int flags)
797 {
798 	struct tpm_softc *sc = device_lookup_private(&tpm_cd, minor(dev));
799 	uint8_t buf[TPM_BUFSIZ];
800 	int n, rv;
801 
802 	if (sc == NULL)
803 		return ENXIO;
804 
805 	n = MIN(sizeof(buf), uio->uio_resid);
806 	if ((rv = uiomove(buf, n, uio))) {
807 		goto out;
808 	}
809 	if ((rv = (*sc->sc_intf->start)(sc, UIO_WRITE))) {
810 		goto out;
811 	}
812 	if ((rv = (*sc->sc_intf->write)(sc, buf, n))) {
813 		goto out;
814 	}
815 
816 	rv = (*sc->sc_intf->end)(sc, UIO_WRITE, rv);
817 out:
818 	return rv;
819 }
820 
821 static int
822 tpmioctl(dev_t dev, u_long cmd, void *addr, int flag, struct lwp *l)
823 {
824 	struct tpm_softc *sc = device_lookup_private(&tpm_cd, minor(dev));
825 	struct tpm_ioc_getinfo *info;
826 
827 	if (sc == NULL)
828 		return ENXIO;
829 
830 	switch (cmd) {
831 	case TPM_IOC_GETINFO:
832 		info = addr;
833 		info->api_version = TPM_API_VERSION;
834 		info->tpm_version = sc->sc_ver;
835 		info->itf_version = sc->sc_intf->version;
836 		info->device_id = sc->sc_devid;
837 		info->device_rev = sc->sc_rev;
838 		info->device_caps = sc->sc_caps;
839 		return 0;
840 	default:
841 		break;
842 	}
843 
844 	return ENOTTY;
845 }
846