drivers/char/tpm/tpm-dev-common.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * Copyright (C) 2004 IBM Corporation
   4  * Authors:
   5  * Leendert van Doorn <[email protected]>
   6  * Dave Safford <[email protected]>
   7  * Reiner Sailer <[email protected]>
   8  * Kylene Hall <[email protected]>
   9  *
  10  * Copyright (C) 2013 Obsidian Research Corp
  11  * Jason Gunthorpe <[email protected]>
  12  *
  13  * Device file system interface to the TPM
  14  */
  15 #include <linux/poll.h>
  16 #include <linux/slab.h>
  17 #include <linux/uaccess.h>
  18 #include <linux/workqueue.h>
  19 #include "tpm.h"
  20 #include "tpm-dev.h"
  21
  22 static struct workqueue_struct *tpm_dev_wq;
  23 static DEFINE_MUTEX(tpm_dev_wq_lock);
  24
  25 static ssize_t tpm_dev_transmit(struct tpm_chip *chip, struct tpm_space *space,
  26                                 u8 *buf, size_t bufsiz)
  27 {
  28         struct tpm_header *header = (void *)buf;
  29         ssize_t ret, len;
  30
  31         ret = tpm2_prepare_space(chip, space, buf, bufsiz);
  32         /* If the command is not implemented by the TPM, synthesize a
  33          * response with a TPM2_RC_COMMAND_CODE return for user-space.
  34          */
  35         if (ret == -EOPNOTSUPP) {
  36                 header->length = cpu_to_be32(sizeof(*header));
  37                 header->tag = cpu_to_be16(TPM2_ST_NO_SESSIONS);
  38                 header->return_code = cpu_to_be32(TPM2_RC_COMMAND_CODE |
  39                                                   TSS2_RESMGR_TPM_RC_LAYER);
  40                 ret = sizeof(*header);
  41         }
  42         if (ret)
  43                 goto out_rc;
  44
  45         len = tpm_transmit(chip, buf, bufsiz);
  46         if (len < 0)
  47                 ret = len;
  48
  49         if (!ret)
  50                 ret = tpm2_commit_space(chip, space, buf, &len);
  51
  52 out_rc:
  53         return ret ? ret : len;
  54 }
  55
  56 static void tpm_dev_async_work(struct work_struct *work)
  57 {
  58         struct file_priv *priv =
  59                         container_of(work, struct file_priv, async_work);
  60         ssize_t ret;
  61
  62         mutex_lock(&priv->buffer_mutex);
  63         priv->command_enqueued = false;
  64         ret = tpm_try_get_ops(priv->chip);
  65         if (ret) {
  66                 priv->response_length = ret;
  67                 goto out;
  68         }
  69
  70         ret = tpm_dev_transmit(priv->chip, priv->space, priv->data_buffer,
  71                                sizeof(priv->data_buffer));
  72         tpm_put_ops(priv->chip);
  73         if (ret > 0) {
  74                 priv->response_length = ret;
  75                 mod_timer(&priv->user_read_timer, jiffies + (120 * HZ));
  76         }
  77 out:
  78         mutex_unlock(&priv->buffer_mutex);
  79         wake_up_interruptible(&priv->async_wait);
  80 }
  81
  82 static void user_reader_timeout(struct timer_list *t)
  83 {
  84         struct file_priv *priv = from_timer(priv, t, user_read_timer);
  85
  86         pr_warn("TPM user space timeout is deprecated (pid=%d)\n",
  87                 task_tgid_nr(current));
  88
  89         schedule_work(&priv->timeout_work);
  90 }
  91
  92 static void tpm_timeout_work(struct work_struct *work)
  93 {
  94         struct file_priv *priv = container_of(work, struct file_priv,
  95                                               timeout_work);
  96
  97         mutex_lock(&priv->buffer_mutex);
  98         priv->response_read = true;
  99         priv->response_length = 0;
 100         memset(priv->data_buffer, 0, sizeof(priv->data_buffer));
 101         mutex_unlock(&priv->buffer_mutex);
 102         wake_up_interruptible(&priv->async_wait);
 103 }
 104
 105 void tpm_common_open(struct file *file, struct tpm_chip *chip,
 106                      struct file_priv *priv, struct tpm_space *space)
 107 {
 108         priv->chip = chip;
 109         priv->space = space;
 110         priv->response_read = true;
 111
 112         mutex_init(&priv->buffer_mutex);
 113         timer_setup(&priv->user_read_timer, user_reader_timeout, 0);
 114         INIT_WORK(&priv->timeout_work, tpm_timeout_work);
 115         INIT_WORK(&priv->async_work, tpm_dev_async_work);
 116         init_waitqueue_head(&priv->async_wait);
 117         file->private_data = priv;
 118 }
 119
 120 ssize_t tpm_common_read(struct file *file, char __user *buf,
 121                         size_t size, loff_t *off)
 122 {
 123         struct file_priv *priv = file->private_data;
 124         ssize_t ret_size = 0;
 125         int rc;
 126
 127         mutex_lock(&priv->buffer_mutex);
 128
 129         if (priv->response_length) {
 130                 priv->response_read = true;
 131
 132                 ret_size = min_t(ssize_t, size, priv->response_length);
 133                 if (ret_size <= 0) {
 134                         priv->response_length = 0;
 135                         goto out;
 136                 }
 137
 138                 rc = copy_to_user(buf, priv->data_buffer + *off, ret_size);
 139                 if (rc) {
 140                         memset(priv->data_buffer, 0, TPM_BUFSIZE);
 141                         priv->response_length = 0;
 142                         ret_size = -EFAULT;
 143                 } else {
 144                         memset(priv->data_buffer + *off, 0, ret_size);
 145                         priv->response_length -= ret_size;
 146                         *off += ret_size;
 147                 }
 148         }
 149
 150 out:
 151         if (!priv->response_length) {
 152                 *off = 0;
 153                 del_singleshot_timer_sync(&priv->user_read_timer);
 154                 flush_work(&priv->timeout_work);
 155         }
 156         mutex_unlock(&priv->buffer_mutex);
 157         return ret_size;
 158 }
 159
 160 ssize_t tpm_common_write(struct file *file, const char __user *buf,
 161                          size_t size, loff_t *off)
 162 {
 163         struct file_priv *priv = file->private_data;
 164         int ret = 0;
 165
 166         if (size > TPM_BUFSIZE)
 167                 return -E2BIG;
 168
 169         mutex_lock(&priv->buffer_mutex);
 170
 171         /* Cannot perform a write until the read has cleared either via
 172          * tpm_read or a user_read_timer timeout. This also prevents split
 173          * buffered writes from blocking here.
 174          */
 175         if ((!priv->response_read && priv->response_length) ||
 176             priv->command_enqueued) {
 177                 ret = -EBUSY;
 178                 goto out;
 179         }
 180
 181         if (copy_from_user(priv->data_buffer, buf, size)) {
 182                 ret = -EFAULT;
 183                 goto out;
 184         }
 185
 186         if (size < 6 ||
 187             size < be32_to_cpu(*((__be32 *)(priv->data_buffer + 2)))) {
 188                 ret = -EINVAL;
 189                 goto out;
 190         }
 191
 192         priv->response_length = 0;
 193         priv->response_read = false;
 194         *off = 0;
 195
 196         /*
 197          * If in nonblocking mode schedule an async job to send
 198          * the command return the size.
 199          * In case of error the err code will be returned in
 200          * the subsequent read call.
 201          */
 202         if (file->f_flags & O_NONBLOCK) {
 203                 priv->command_enqueued = true;
 204                 queue_work(tpm_dev_wq, &priv->async_work);
 205                 mutex_unlock(&priv->buffer_mutex);
 206                 return size;
 207         }
 208
 209         /* atomic tpm command send and result receive. We only hold the ops
 210          * lock during this period so that the tpm can be unregistered even if
 211          * the char dev is held open.
 212          */
 213         if (tpm_try_get_ops(priv->chip)) {
 214                 ret = -EPIPE;
 215                 goto out;
 216         }
 217
 218         ret = tpm_dev_transmit(priv->chip, priv->space, priv->data_buffer,
 219                                sizeof(priv->data_buffer));
 220         tpm_put_ops(priv->chip);
 221
 222         if (ret > 0) {
 223                 priv->response_length = ret;
 224                 mod_timer(&priv->user_read_timer, jiffies + (120 * HZ));
 225                 ret = size;
 226         }
 227 out:
 228         mutex_unlock(&priv->buffer_mutex);
 229         return ret;
 230 }
 231
 232 __poll_t tpm_common_poll(struct file *file, poll_table *wait)
 233 {
 234         struct file_priv *priv = file->private_data;
 235         __poll_t mask = 0;
 236
 237         poll_wait(file, &priv->async_wait, wait);
 238         mutex_lock(&priv->buffer_mutex);
 239
 240         /*
 241          * The response_length indicates if there is still response
 242          * (or part of it) to be consumed. Partial reads decrease it
 243          * by the number of bytes read, and write resets it the zero.
 244          */
 245         if (priv->response_length)
 246                 mask = EPOLLIN | EPOLLRDNORM;
 247         else
 248                 mask = EPOLLOUT | EPOLLWRNORM;
 249
 250         mutex_unlock(&priv->buffer_mutex);
 251         return mask;
 252 }
 253
 254 /*
 255  * Called on file close
 256  */
 257 void tpm_common_release(struct file *file, struct file_priv *priv)
 258 {
 259         flush_work(&priv->async_work);
 260         del_singleshot_timer_sync(&priv->user_read_timer);
 261         flush_work(&priv->timeout_work);
 262         file->private_data = NULL;
 263         priv->response_length = 0;
 264 }
 265
 266 int __init tpm_dev_common_init(void)
 267 {
 268         tpm_dev_wq = alloc_workqueue("tpm_dev_wq", WQ_MEM_RECLAIM, 0);
 269
 270         return !tpm_dev_wq ? -ENOMEM : 0;
 271 }
 272
 273 void __exit tpm_dev_common_exit(void)
 274 {
 275         if (tpm_dev_wq) {
 276                 destroy_workqueue(tpm_dev_wq);
 277                 tpm_dev_wq = NULL;
 278         }
 279 }