1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (C) 2004 IBM Corporation 4 * Authors: 5 * Leendert van Doorn <leendert@watson.ibm.com> 6 * Dave Safford <safford@watson.ibm.com> 7 * Reiner Sailer <sailer@watson.ibm.com> 8 * Kylene Hall <kjhall@us.ibm.com> 9 * 10 * Copyright (C) 2013 Obsidian Research Corp 11 * Jason Gunthorpe <jgunthorpe@obsidianresearch.com> 12 * 13 * Device file system interface to the TPM 14 */ 15 #include <linux/poll.h> 16 #include <linux/slab.h> 17 #include <linux/uaccess.h> 18 #include <linux/workqueue.h> 19 #include "tpm.h" 20 #include "tpm-dev.h" 21 22 static struct workqueue_struct *tpm_dev_wq; 23 24 static ssize_t tpm_dev_transmit(struct tpm_chip *chip, struct tpm_space *space, 25 u8 *buf, size_t bufsiz) 26 { 27 struct tpm_header *header = (void *)buf; 28 ssize_t ret, len; 29 30 ret = tpm2_prepare_space(chip, space, buf, bufsiz); 31 /* If the command is not implemented by the TPM, synthesize a 32 * response with a TPM2_RC_COMMAND_CODE return for user-space. 33 */ 34 if (ret == -EOPNOTSUPP) { 35 header->length = cpu_to_be32(sizeof(*header)); 36 header->tag = cpu_to_be16(TPM2_ST_NO_SESSIONS); 37 header->return_code = cpu_to_be32(TPM2_RC_COMMAND_CODE | 38 TSS2_RESMGR_TPM_RC_LAYER); 39 ret = sizeof(*header); 40 } 41 if (ret) 42 goto out_rc; 43 44 len = tpm_transmit(chip, buf, bufsiz); 45 if (len < 0) 46 ret = len; 47 48 if (!ret) 49 ret = tpm2_commit_space(chip, space, buf, &len); 50 else 51 tpm2_flush_space(chip); 52 53 out_rc: 54 return ret ? ret : len; 55 } 56 57 static void tpm_dev_async_work(struct work_struct *work) 58 { 59 struct file_priv *priv = 60 container_of(work, struct file_priv, async_work); 61 ssize_t ret; 62 63 mutex_lock(&priv->buffer_mutex); 64 priv->command_enqueued = false; 65 ret = tpm_try_get_ops(priv->chip); 66 if (ret) { 67 priv->response_length = ret; 68 goto out; 69 } 70 71 ret = tpm_dev_transmit(priv->chip, priv->space, priv->data_buffer, 72 sizeof(priv->data_buffer)); 73 tpm_put_ops(priv->chip); 74 75 /* 76 * If ret is > 0 then tpm_dev_transmit returned the size of the 77 * response. If ret is < 0 then tpm_dev_transmit failed and 78 * returned an error code. 79 */ 80 if (ret != 0) { 81 priv->response_length = ret; 82 mod_timer(&priv->user_read_timer, jiffies + (120 * HZ)); 83 } 84 out: 85 mutex_unlock(&priv->buffer_mutex); 86 wake_up_interruptible(&priv->async_wait); 87 } 88 89 static void user_reader_timeout(struct timer_list *t) 90 { 91 struct file_priv *priv = from_timer(priv, t, user_read_timer); 92 93 pr_warn("TPM user space timeout is deprecated (pid=%d)\n", 94 task_tgid_nr(current)); 95 96 schedule_work(&priv->timeout_work); 97 } 98 99 static void tpm_timeout_work(struct work_struct *work) 100 { 101 struct file_priv *priv = container_of(work, struct file_priv, 102 timeout_work); 103 104 mutex_lock(&priv->buffer_mutex); 105 priv->response_read = true; 106 priv->response_length = 0; 107 memset(priv->data_buffer, 0, sizeof(priv->data_buffer)); 108 mutex_unlock(&priv->buffer_mutex); 109 wake_up_interruptible(&priv->async_wait); 110 } 111 112 void tpm_common_open(struct file *file, struct tpm_chip *chip, 113 struct file_priv *priv, struct tpm_space *space) 114 { 115 priv->chip = chip; 116 priv->space = space; 117 priv->response_read = true; 118 119 mutex_init(&priv->buffer_mutex); 120 timer_setup(&priv->user_read_timer, user_reader_timeout, 0); 121 INIT_WORK(&priv->timeout_work, tpm_timeout_work); 122 INIT_WORK(&priv->async_work, tpm_dev_async_work); 123 init_waitqueue_head(&priv->async_wait); 124 file->private_data = priv; 125 } 126 127 ssize_t tpm_common_read(struct file *file, char __user *buf, 128 size_t size, loff_t *off) 129 { 130 struct file_priv *priv = file->private_data; 131 ssize_t ret_size = 0; 132 int rc; 133 134 mutex_lock(&priv->buffer_mutex); 135 136 if (priv->response_length) { 137 priv->response_read = true; 138 139 ret_size = min_t(ssize_t, size, priv->response_length); 140 if (ret_size <= 0) { 141 priv->response_length = 0; 142 goto out; 143 } 144 145 rc = copy_to_user(buf, priv->data_buffer + *off, ret_size); 146 if (rc) { 147 memset(priv->data_buffer, 0, TPM_BUFSIZE); 148 priv->response_length = 0; 149 ret_size = -EFAULT; 150 } else { 151 memset(priv->data_buffer + *off, 0, ret_size); 152 priv->response_length -= ret_size; 153 *off += ret_size; 154 } 155 } 156 157 out: 158 if (!priv->response_length) { 159 *off = 0; 160 del_timer_sync(&priv->user_read_timer); 161 flush_work(&priv->timeout_work); 162 } 163 mutex_unlock(&priv->buffer_mutex); 164 return ret_size; 165 } 166 167 ssize_t tpm_common_write(struct file *file, const char __user *buf, 168 size_t size, loff_t *off) 169 { 170 struct file_priv *priv = file->private_data; 171 int ret = 0; 172 173 if (size > TPM_BUFSIZE) 174 return -E2BIG; 175 176 mutex_lock(&priv->buffer_mutex); 177 178 /* Cannot perform a write until the read has cleared either via 179 * tpm_read or a user_read_timer timeout. This also prevents split 180 * buffered writes from blocking here. 181 */ 182 if ((!priv->response_read && priv->response_length) || 183 priv->command_enqueued) { 184 ret = -EBUSY; 185 goto out; 186 } 187 188 if (copy_from_user(priv->data_buffer, buf, size)) { 189 ret = -EFAULT; 190 goto out; 191 } 192 193 if (size < 6 || 194 size < be32_to_cpu(*((__be32 *)(priv->data_buffer + 2)))) { 195 ret = -EINVAL; 196 goto out; 197 } 198 199 priv->response_length = 0; 200 priv->response_read = false; 201 *off = 0; 202 203 /* 204 * If in nonblocking mode schedule an async job to send 205 * the command return the size. 206 * In case of error the err code will be returned in 207 * the subsequent read call. 208 */ 209 if (file->f_flags & O_NONBLOCK) { 210 priv->command_enqueued = true; 211 queue_work(tpm_dev_wq, &priv->async_work); 212 mutex_unlock(&priv->buffer_mutex); 213 return size; 214 } 215 216 /* atomic tpm command send and result receive. We only hold the ops 217 * lock during this period so that the tpm can be unregistered even if 218 * the char dev is held open. 219 */ 220 if (tpm_try_get_ops(priv->chip)) { 221 ret = -EPIPE; 222 goto out; 223 } 224 225 ret = tpm_dev_transmit(priv->chip, priv->space, priv->data_buffer, 226 sizeof(priv->data_buffer)); 227 tpm_put_ops(priv->chip); 228 229 if (ret > 0) { 230 priv->response_length = ret; 231 mod_timer(&priv->user_read_timer, jiffies + (120 * HZ)); 232 ret = size; 233 } 234 out: 235 mutex_unlock(&priv->buffer_mutex); 236 return ret; 237 } 238 239 __poll_t tpm_common_poll(struct file *file, poll_table *wait) 240 { 241 struct file_priv *priv = file->private_data; 242 __poll_t mask = 0; 243 244 poll_wait(file, &priv->async_wait, wait); 245 mutex_lock(&priv->buffer_mutex); 246 247 /* 248 * The response_length indicates if there is still response 249 * (or part of it) to be consumed. Partial reads decrease it 250 * by the number of bytes read, and write resets it the zero. 251 */ 252 if (priv->response_length) 253 mask = EPOLLIN | EPOLLRDNORM; 254 else 255 mask = EPOLLOUT | EPOLLWRNORM; 256 257 mutex_unlock(&priv->buffer_mutex); 258 return mask; 259 } 260 261 /* 262 * Called on file close 263 */ 264 void tpm_common_release(struct file *file, struct file_priv *priv) 265 { 266 flush_work(&priv->async_work); 267 del_timer_sync(&priv->user_read_timer); 268 flush_work(&priv->timeout_work); 269 file->private_data = NULL; 270 priv->response_length = 0; 271 } 272 273 int __init tpm_dev_common_init(void) 274 { 275 tpm_dev_wq = alloc_workqueue("tpm_dev_wq", WQ_MEM_RECLAIM, 0); 276 277 return !tpm_dev_wq ? -ENOMEM : 0; 278 } 279 280 void __exit tpm_dev_common_exit(void) 281 { 282 if (tpm_dev_wq) { 283 destroy_workqueue(tpm_dev_wq); 284 tpm_dev_wq = NULL; 285 } 286 } 287