drivers/char/tpm/tpm-dev-common.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * Copyright (C) 2004 IBM Corporation
   4  * Authors:
   5  * Leendert van Doorn <[email protected]>
   6  * Dave Safford <[email protected]>
   7  * Reiner Sailer <[email protected]>
   8  * Kylene Hall <[email protected]>
   9  *
  10  * Copyright (C) 2013 Obsidian Research Corp
  11  * Jason Gunthorpe <[email protected]>
  12  *
  13  * Device file system interface to the TPM
  14  */
  15 #include <linux/poll.h>
  16 #include <linux/slab.h>
  17 #include <linux/uaccess.h>
  18 #include <linux/workqueue.h>
  19 #include "tpm.h"
  20 #include "tpm-dev.h"
  21
  22 static struct workqueue_struct *tpm_dev_wq;
  23
  24 static ssize_t tpm_dev_transmit(struct tpm_chip *chip, struct tpm_space *space,
  25                                 u8 *buf, size_t bufsiz)
  26 {
  27         struct tpm_header *header = (void *)buf;
  28         ssize_t ret, len;
  29
  30         if (chip->flags & TPM_CHIP_FLAG_TPM2)
  31                 tpm2_end_auth_session(chip);
  32
  33         ret = tpm2_prepare_space(chip, space, buf, bufsiz);
  34         /* If the command is not implemented by the TPM, synthesize a
  35          * response with a TPM2_RC_COMMAND_CODE return for user-space.
  36          */
  37         if (ret == -EOPNOTSUPP) {
  38                 header->length = cpu_to_be32(sizeof(*header));
  39                 header->tag = cpu_to_be16(TPM2_ST_NO_SESSIONS);
  40                 header->return_code = cpu_to_be32(TPM2_RC_COMMAND_CODE |
  41                                                   TSS2_RESMGR_TPM_RC_LAYER);
  42                 ret = sizeof(*header);
  43         }
  44         if (ret)
  45                 goto out_rc;
  46
  47         len = tpm_transmit(chip, buf, bufsiz);
  48         if (len < 0)
  49                 ret = len;
  50
  51         if (!ret)
  52                 ret = tpm2_commit_space(chip, space, buf, &len);
  53         else
  54                 tpm2_flush_space(chip);
  55
  56 out_rc:
  57         return ret ? ret : len;
  58 }
  59
  60 static void tpm_dev_async_work(struct work_struct *work)
  61 {
  62         struct file_priv *priv =
  63                         container_of(work, struct file_priv, async_work);
  64         ssize_t ret;
  65
  66         mutex_lock(&priv->buffer_mutex);
  67         priv->command_enqueued = false;
  68         ret = tpm_try_get_ops(priv->chip);
  69         if (ret) {
  70                 priv->response_length = ret;
  71                 goto out;
  72         }
  73
  74         ret = tpm_dev_transmit(priv->chip, priv->space, priv->data_buffer,
  75                                sizeof(priv->data_buffer));
  76         tpm_put_ops(priv->chip);
  77
  78         /*
  79          * If ret is > 0 then tpm_dev_transmit returned the size of the
  80          * response. If ret is < 0 then tpm_dev_transmit failed and
  81          * returned an error code.
  82          */
  83         if (ret != 0) {
  84                 priv->response_length = ret;
  85                 mod_timer(&priv->user_read_timer, jiffies + (120 * HZ));
  86         }
  87 out:
  88         mutex_unlock(&priv->buffer_mutex);
  89         wake_up_interruptible(&priv->async_wait);
  90 }
  91
  92 static void user_reader_timeout(struct timer_list *t)
  93 {
  94         struct file_priv *priv = from_timer(priv, t, user_read_timer);
  95
  96         pr_warn("TPM user space timeout is deprecated (pid=%d)\n",
  97                 task_tgid_nr(current));
  98
  99         schedule_work(&priv->timeout_work);
 100 }
 101
 102 static void tpm_timeout_work(struct work_struct *work)
 103 {
 104         struct file_priv *priv = container_of(work, struct file_priv,
 105                                               timeout_work);
 106
 107         mutex_lock(&priv->buffer_mutex);
 108         priv->response_read = true;
 109         priv->response_length = 0;
 110         memset(priv->data_buffer, 0, sizeof(priv->data_buffer));
 111         mutex_unlock(&priv->buffer_mutex);
 112         wake_up_interruptible(&priv->async_wait);
 113 }
 114
 115 void tpm_common_open(struct file *file, struct tpm_chip *chip,
 116                      struct file_priv *priv, struct tpm_space *space)
 117 {
 118         priv->chip = chip;
 119         priv->space = space;
 120         priv->response_read = true;
 121
 122         mutex_init(&priv->buffer_mutex);
 123         timer_setup(&priv->user_read_timer, user_reader_timeout, 0);
 124         INIT_WORK(&priv->timeout_work, tpm_timeout_work);
 125         INIT_WORK(&priv->async_work, tpm_dev_async_work);
 126         init_waitqueue_head(&priv->async_wait);
 127         file->private_data = priv;
 128 }
 129
 130 ssize_t tpm_common_read(struct file *file, char __user *buf,
 131                         size_t size, loff_t *off)
 132 {
 133         struct file_priv *priv = file->private_data;
 134         ssize_t ret_size = 0;
 135         int rc;
 136
 137         mutex_lock(&priv->buffer_mutex);
 138
 139         if (priv->response_length) {
 140                 priv->response_read = true;
 141
 142                 ret_size = min_t(ssize_t, size, priv->response_length);
 143                 if (ret_size <= 0) {
 144                         priv->response_length = 0;
 145                         goto out;
 146                 }
 147
 148                 rc = copy_to_user(buf, priv->data_buffer + *off, ret_size);
 149                 if (rc) {
 150                         memset(priv->data_buffer, 0, TPM_BUFSIZE);
 151                         priv->response_length = 0;
 152                         ret_size = -EFAULT;
 153                 } else {
 154                         memset(priv->data_buffer + *off, 0, ret_size);
 155                         priv->response_length -= ret_size;
 156                         *off += ret_size;
 157                 }
 158         }
 159
 160 out:
 161         if (!priv->response_length) {
 162                 *off = 0;
 163                 del_timer_sync(&priv->user_read_timer);
 164                 flush_work(&priv->timeout_work);
 165         }
 166         mutex_unlock(&priv->buffer_mutex);
 167         return ret_size;
 168 }
 169
 170 ssize_t tpm_common_write(struct file *file, const char __user *buf,
 171                          size_t size, loff_t *off)
 172 {
 173         struct file_priv *priv = file->private_data;
 174         int ret = 0;
 175
 176         if (size > TPM_BUFSIZE)
 177                 return -E2BIG;
 178
 179         mutex_lock(&priv->buffer_mutex);
 180
 181         /* Cannot perform a write until the read has cleared either via
 182          * tpm_read or a user_read_timer timeout. This also prevents split
 183          * buffered writes from blocking here.
 184          */
 185         if ((!priv->response_read && priv->response_length) ||
 186             priv->command_enqueued) {
 187                 ret = -EBUSY;
 188                 goto out;
 189         }
 190
 191         if (copy_from_user(priv->data_buffer, buf, size)) {
 192                 ret = -EFAULT;
 193                 goto out;
 194         }
 195
 196         if (size < 6 ||
 197             size < be32_to_cpu(*((__be32 *)(priv->data_buffer + 2)))) {
 198                 ret = -EINVAL;
 199                 goto out;
 200         }
 201
 202         priv->response_length = 0;
 203         priv->response_read = false;
 204         *off = 0;
 205
 206         /*
 207          * If in nonblocking mode schedule an async job to send
 208          * the command return the size.
 209          * In case of error the err code will be returned in
 210          * the subsequent read call.
 211          */
 212         if (file->f_flags & O_NONBLOCK) {
 213                 priv->command_enqueued = true;
 214                 queue_work(tpm_dev_wq, &priv->async_work);
 215                 mutex_unlock(&priv->buffer_mutex);
 216                 return size;
 217         }
 218
 219         /* atomic tpm command send and result receive. We only hold the ops
 220          * lock during this period so that the tpm can be unregistered even if
 221          * the char dev is held open.
 222          */
 223         if (tpm_try_get_ops(priv->chip)) {
 224                 ret = -EPIPE;
 225                 goto out;
 226         }
 227
 228         ret = tpm_dev_transmit(priv->chip, priv->space, priv->data_buffer,
 229                                sizeof(priv->data_buffer));
 230         tpm_put_ops(priv->chip);
 231
 232         if (ret > 0) {
 233                 priv->response_length = ret;
 234                 mod_timer(&priv->user_read_timer, jiffies + (120 * HZ));
 235                 ret = size;
 236         }
 237 out:
 238         mutex_unlock(&priv->buffer_mutex);
 239         return ret;
 240 }
 241
 242 __poll_t tpm_common_poll(struct file *file, poll_table *wait)
 243 {
 244         struct file_priv *priv = file->private_data;
 245         __poll_t mask = 0;
 246
 247         poll_wait(file, &priv->async_wait, wait);
 248         mutex_lock(&priv->buffer_mutex);
 249
 250         /*
 251          * The response_length indicates if there is still response
 252          * (or part of it) to be consumed. Partial reads decrease it
 253          * by the number of bytes read, and write resets it the zero.
 254          */
 255         if (priv->response_length)
 256                 mask = EPOLLIN | EPOLLRDNORM;
 257         else
 258                 mask = EPOLLOUT | EPOLLWRNORM;
 259
 260         mutex_unlock(&priv->buffer_mutex);
 261         return mask;
 262 }
 263
 264 /*
 265  * Called on file close
 266  */
 267 void tpm_common_release(struct file *file, struct file_priv *priv)
 268 {
 269         flush_work(&priv->async_work);
 270         del_timer_sync(&priv->user_read_timer);
 271         flush_work(&priv->timeout_work);
 272         file->private_data = NULL;
 273         priv->response_length = 0;
 274 }
 275
 276 int __init tpm_dev_common_init(void)
 277 {
 278         tpm_dev_wq = alloc_workqueue("tpm_dev_wq", WQ_MEM_RECLAIM, 0);
 279
 280         return !tpm_dev_wq ? -ENOMEM : 0;
 281 }
 282
 283 void __exit tpm_dev_common_exit(void)
 284 {
 285         if (tpm_dev_wq) {
 286                 destroy_workqueue(tpm_dev_wq);
 287                 tpm_dev_wq = NULL;
 288         }
 289 }