drivers/char/tpm/tpm-dev-common.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * Copyright (C) 2004 IBM Corporation
   4  * Authors:
   5  * Leendert van Doorn <leendert@watson.ibm.com>
   6  * Dave Safford <safford@watson.ibm.com>
   7  * Reiner Sailer <sailer@watson.ibm.com>
   8  * Kylene Hall <kjhall@us.ibm.com>
   9  *
  10  * Copyright (C) 2013 Obsidian Research Corp
  11  * Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
  12  *
  13  * Device file system interface to the TPM
  14  */
  15 #include <linux/poll.h>
  16 #include <linux/slab.h>
  17 #include <linux/uaccess.h>
  18 #include <linux/workqueue.h>
  19 #include "tpm.h"
  20 #include "tpm-dev.h"
  21
  22 static struct workqueue_struct *tpm_dev_wq;
  23
  24 static ssize_t tpm_dev_transmit(struct tpm_chip *chip, struct tpm_space *space,
  25                                 u8 *buf, size_t bufsiz)
  26 {
  27         struct tpm_header *header = (void *)buf;
  28         ssize_t ret, len;
  29
  30         ret = tpm2_prepare_space(chip, space, buf, bufsiz);
  31         /* If the command is not implemented by the TPM, synthesize a
  32          * response with a TPM2_RC_COMMAND_CODE return for user-space.
  33          */
  34         if (ret == -EOPNOTSUPP) {
  35                 header->length = cpu_to_be32(sizeof(*header));
  36                 header->tag = cpu_to_be16(TPM2_ST_NO_SESSIONS);
  37                 header->return_code = cpu_to_be32(TPM2_RC_COMMAND_CODE |
  38                                                   TSS2_RESMGR_TPM_RC_LAYER);
  39                 ret = sizeof(*header);
  40         }
  41         if (ret)
  42                 goto out_rc;
  43
  44         len = tpm_transmit(chip, buf, bufsiz);
  45         if (len < 0)
  46                 ret = len;
  47
  48         if (!ret)
  49                 ret = tpm2_commit_space(chip, space, buf, &len);
  50
  51 out_rc:
  52         return ret ? ret : len;
  53 }
  54
  55 static void tpm_dev_async_work(struct work_struct *work)
  56 {
  57         struct file_priv *priv =
  58                         container_of(work, struct file_priv, async_work);
  59         ssize_t ret;
  60
  61         mutex_lock(&priv->buffer_mutex);
  62         priv->command_enqueued = false;
  63         ret = tpm_try_get_ops(priv->chip);
  64         if (ret) {
  65                 priv->response_length = ret;
  66                 goto out;
  67         }
  68
  69         ret = tpm_dev_transmit(priv->chip, priv->space, priv->data_buffer,
  70                                sizeof(priv->data_buffer));
  71         tpm_put_ops(priv->chip);
  72         if (ret > 0) {
  73                 priv->response_length = ret;
  74                 mod_timer(&priv->user_read_timer, jiffies + (120 * HZ));
  75         }
  76 out:
  77         mutex_unlock(&priv->buffer_mutex);
  78         wake_up_interruptible(&priv->async_wait);
  79 }
  80
  81 static void user_reader_timeout(struct timer_list *t)
  82 {
  83         struct file_priv *priv = from_timer(priv, t, user_read_timer);
  84
  85         pr_warn("TPM user space timeout is deprecated (pid=%d)\n",
  86                 task_tgid_nr(current));
  87
  88         schedule_work(&priv->timeout_work);
  89 }
  90
  91 static void tpm_timeout_work(struct work_struct *work)
  92 {
  93         struct file_priv *priv = container_of(work, struct file_priv,
  94                                               timeout_work);
  95
  96         mutex_lock(&priv->buffer_mutex);
  97         priv->response_read = true;
  98         priv->response_length = 0;
  99         memset(priv->data_buffer, 0, sizeof(priv->data_buffer));
 100         mutex_unlock(&priv->buffer_mutex);
 101         wake_up_interruptible(&priv->async_wait);
 102 }
 103
 104 void tpm_common_open(struct file *file, struct tpm_chip *chip,
 105                      struct file_priv *priv, struct tpm_space *space)
 106 {
 107         priv->chip = chip;
 108         priv->space = space;
 109         priv->response_read = true;
 110
 111         mutex_init(&priv->buffer_mutex);
 112         timer_setup(&priv->user_read_timer, user_reader_timeout, 0);
 113         INIT_WORK(&priv->timeout_work, tpm_timeout_work);
 114         INIT_WORK(&priv->async_work, tpm_dev_async_work);
 115         init_waitqueue_head(&priv->async_wait);
 116         file->private_data = priv;
 117 }
 118
 119 ssize_t tpm_common_read(struct file *file, char __user *buf,
 120                         size_t size, loff_t *off)
 121 {
 122         struct file_priv *priv = file->private_data;
 123         ssize_t ret_size = 0;
 124         int rc;
 125
 126         mutex_lock(&priv->buffer_mutex);
 127
 128         if (priv->response_length) {
 129                 priv->response_read = true;
 130
 131                 ret_size = min_t(ssize_t, size, priv->response_length);
 132                 if (ret_size <= 0) {
 133                         priv->response_length = 0;
 134                         goto out;
 135                 }
 136
 137                 rc = copy_to_user(buf, priv->data_buffer + *off, ret_size);
 138                 if (rc) {
 139                         memset(priv->data_buffer, 0, TPM_BUFSIZE);
 140                         priv->response_length = 0;
 141                         ret_size = -EFAULT;
 142                 } else {
 143                         memset(priv->data_buffer + *off, 0, ret_size);
 144                         priv->response_length -= ret_size;
 145                         *off += ret_size;
 146                 }
 147         }
 148
 149 out:
 150         if (!priv->response_length) {
 151                 *off = 0;
 152                 del_singleshot_timer_sync(&priv->user_read_timer);
 153                 flush_work(&priv->timeout_work);
 154         }
 155         mutex_unlock(&priv->buffer_mutex);
 156         return ret_size;
 157 }
 158
 159 ssize_t tpm_common_write(struct file *file, const char __user *buf,
 160                          size_t size, loff_t *off)
 161 {
 162         struct file_priv *priv = file->private_data;
 163         int ret = 0;
 164
 165         if (size > TPM_BUFSIZE)
 166                 return -E2BIG;
 167
 168         mutex_lock(&priv->buffer_mutex);
 169
 170         /* Cannot perform a write until the read has cleared either via
 171          * tpm_read or a user_read_timer timeout. This also prevents split
 172          * buffered writes from blocking here.
 173          */
 174         if ((!priv->response_read && priv->response_length) ||
 175             priv->command_enqueued) {
 176                 ret = -EBUSY;
 177                 goto out;
 178         }
 179
 180         if (copy_from_user(priv->data_buffer, buf, size)) {
 181                 ret = -EFAULT;
 182                 goto out;
 183         }
 184
 185         if (size < 6 ||
 186             size < be32_to_cpu(*((__be32 *)(priv->data_buffer + 2)))) {
 187                 ret = -EINVAL;
 188                 goto out;
 189         }
 190
 191         priv->response_length = 0;
 192         priv->response_read = false;
 193         *off = 0;
 194
 195         /*
 196          * If in nonblocking mode schedule an async job to send
 197          * the command return the size.
 198          * In case of error the err code will be returned in
 199          * the subsequent read call.
 200          */
 201         if (file->f_flags & O_NONBLOCK) {
 202                 priv->command_enqueued = true;
 203                 queue_work(tpm_dev_wq, &priv->async_work);
 204                 mutex_unlock(&priv->buffer_mutex);
 205                 return size;
 206         }
 207
 208         /* atomic tpm command send and result receive. We only hold the ops
 209          * lock during this period so that the tpm can be unregistered even if
 210          * the char dev is held open.
 211          */
 212         if (tpm_try_get_ops(priv->chip)) {
 213                 ret = -EPIPE;
 214                 goto out;
 215         }
 216
 217         ret = tpm_dev_transmit(priv->chip, priv->space, priv->data_buffer,
 218                                sizeof(priv->data_buffer));
 219         tpm_put_ops(priv->chip);
 220
 221         if (ret > 0) {
 222                 priv->response_length = ret;
 223                 mod_timer(&priv->user_read_timer, jiffies + (120 * HZ));
 224                 ret = size;
 225         }
 226 out:
 227         mutex_unlock(&priv->buffer_mutex);
 228         return ret;
 229 }
 230
 231 __poll_t tpm_common_poll(struct file *file, poll_table *wait)
 232 {
 233         struct file_priv *priv = file->private_data;
 234         __poll_t mask = 0;
 235
 236         poll_wait(file, &priv->async_wait, wait);
 237         mutex_lock(&priv->buffer_mutex);
 238
 239         /*
 240          * The response_length indicates if there is still response
 241          * (or part of it) to be consumed. Partial reads decrease it
 242          * by the number of bytes read, and write resets it the zero.
 243          */
 244         if (priv->response_length)
 245                 mask = EPOLLIN | EPOLLRDNORM;
 246         else
 247                 mask = EPOLLOUT | EPOLLWRNORM;
 248
 249         mutex_unlock(&priv->buffer_mutex);
 250         return mask;
 251 }
 252
 253 /*
 254  * Called on file close
 255  */
 256 void tpm_common_release(struct file *file, struct file_priv *priv)
 257 {
 258         flush_work(&priv->async_work);
 259         del_singleshot_timer_sync(&priv->user_read_timer);
 260         flush_work(&priv->timeout_work);
 261         file->private_data = NULL;
 262         priv->response_length = 0;
 263 }
 264
 265 int __init tpm_dev_common_init(void)
 266 {
 267         tpm_dev_wq = alloc_workqueue("tpm_dev_wq", WQ_MEM_RECLAIM, 0);
 268
 269         return !tpm_dev_wq ? -ENOMEM : 0;
 270 }
 271
 272 void __exit tpm_dev_common_exit(void)
 273 {
 274         if (tpm_dev_wq) {
 275                 destroy_workqueue(tpm_dev_wq);
 276                 tpm_dev_wq = NULL;
 277         }
 278 }