Why can't I write registers on my TPM? (Infineon SLB 9670)

I'm trying to write a driver for the Infineon SLB 9670 TPM to use it on an embedded system (AD Blackfin ADSP-BF607). So far I'm able to read registers but I fail when I try to perform a write operation.

According to the specifications (PC Client Platform section 7.4.6 and PC Client Platform section 9.2.2) the bitstream has to have the following format:

• First bit sent tells the TPM wheather a read (1) or write (0) operation is to be conducted
• Second bit is reserved (0)
• Bits 2-7 indicate the size of the transfer
• The next 4 bytes are 2 bytes of address with offset 0xFED4
• Then x bytes of data is sent or received

Additional Question: The size of the transfer set by bits 2-7 refers to the size of the data being sent and received, right? (Whithout Read/Write bit, address bytes, etc.)

Following this format I am able to conduct read operations. For example I can read the TPM_STS_0 register. A description of the contents of this register can be found in the PC Client Specifications on page 82. Here is a picture of a logic analyzer capture of the successful register read operation

Here is the exact bitsream I'm sending:

uint8_t TxData[] = {
        0b10000011,     // read bit + size of transfer (4 bytes)
        0xFE, 0xD4,     // specified offset
        0x00, 0x18      // memory address for TPM_STS_0 register
};

When I try to write to a register the TPM still interprets the instructions as a read operation eventhough the first bit sent is a "0". I'm trying to set the commandReady bit in the TPM_STS_0 register. According to the specification the data transfered should be most significant bit first and least significant byte first. picture of logic analyzer capture of failed register write operation

Here is the exact bitsream I sent to the TPM for my register write attempt:

uint8_t TxData[] = {
        0b00000011,     // write bit + size of transfer (4 bytes)
        0xFE, 0xD4,     // specified offset
        0x00, 0x18,     // memory address for TPM_STS register (0x0018)
        0x40, 0x00,
        0x00, 0x00
};

As a matter of fact I have found out that as long as the address and the 0xFED4 offset is present I can set all other bits however I like and it has no effect. The TPM always returns the contents of the register.

Main Question: Can someone help me out? What am I doing wrong?

Thanks!

I also have posted to the infineon forum and got an answer there that solved the problem!

The problem was that the offset of 0xFED4 was supposed to be used for communicating with the TPM via MMIO. For direct communication via SPI the offset is just 0xD4. After changing the offset and adding a 0x00 dummy byte before the actual transfer for timing I am now able to conduct write operations!

If anyone is wondering, this is the exact bit stream I'm sending for a successful write operation (to enable all interrupts):

uint8_t TxData[] = {
    0x00, 0b00000011,   // write bit + size of transfer (4 bytes)
    0xD4,           // specified offset
    0x00, 0x08,     // TPM_INT_ENABLE_0 register (locality 0)
    0x0F, 0x00,
    0x00, 0x80
};

Here is the link to the infineon forum thread.