1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (C) 2015, 2016 IBM Corporation 4 * Copyright (C) 2016 Intel Corporation 5 * 6 * Author: Stefan Berger <stefanb@us.ibm.com> 7 * 8 * Maintained by: <tpmdd-devel@lists.sourceforge.net> 9 * 10 * Device driver for vTPM (vTPM proxy driver) 11 */ 12 13 #include <linux/types.h> 14 #include <linux/spinlock.h> 15 #include <linux/uaccess.h> 16 #include <linux/wait.h> 17 #include <linux/miscdevice.h> 18 #include <linux/vtpm_proxy.h> 19 #include <linux/file.h> 20 #include <linux/anon_inodes.h> 21 #include <linux/poll.h> 22 #include <linux/compat.h> 23 24 #include "tpm.h" 25 26 #define VTPM_PROXY_REQ_COMPLETE_FLAG BIT(0) 27 28 struct proxy_dev { 29 struct tpm_chip *chip; 30 31 u32 flags; /* public API flags */ 32 33 wait_queue_head_t wq; 34 35 struct mutex buf_lock; /* protect buffer and flags */ 36 37 long state; /* internal state */ 38 #define STATE_OPENED_FLAG BIT(0) 39 #define STATE_WAIT_RESPONSE_FLAG BIT(1) /* waiting for emulator response */ 40 #define STATE_REGISTERED_FLAG BIT(2) 41 #define STATE_DRIVER_COMMAND BIT(3) /* sending a driver specific command */ 42 43 size_t req_len; /* length of queued TPM request */ 44 size_t resp_len; /* length of queued TPM response */ 45 u8 buffer[TPM_BUFSIZE]; /* request/response buffer */ 46 47 struct work_struct work; /* task that retrieves TPM timeouts */ 48 }; 49 50 /* all supported flags */ 51 #define VTPM_PROXY_FLAGS_ALL (VTPM_PROXY_FLAG_TPM2) 52 53 static struct workqueue_struct *workqueue; 54 55 static void vtpm_proxy_delete_device(struct proxy_dev *proxy_dev); 56 57 /* 58 * Functions related to 'server side' 59 */ 60 61 /** 62 * vtpm_proxy_fops_read - Read TPM commands on 'server side' 63 * 64 * @filp: file pointer 65 * @buf: read buffer 66 * @count: number of bytes to read 67 * @off: offset 68 * 69 * Return: 70 * Number of bytes read or negative error code 71 */ 72 static ssize_t vtpm_proxy_fops_read(struct file *filp, char __user *buf, 73 size_t count, loff_t *off) 74 { 75 struct proxy_dev *proxy_dev = filp->private_data; 76 size_t len; 77 int sig, rc; 78 79 sig = wait_event_interruptible(proxy_dev->wq, 80 proxy_dev->req_len != 0 || 81 !(proxy_dev->state & STATE_OPENED_FLAG)); 82 if (sig) 83 return -EINTR; 84 85 mutex_lock(&proxy_dev->buf_lock); 86 87 if (!(proxy_dev->state & STATE_OPENED_FLAG)) { 88 mutex_unlock(&proxy_dev->buf_lock); 89 return -EPIPE; 90 } 91 92 len = proxy_dev->req_len; 93 94 if (count < len || len > sizeof(proxy_dev->buffer)) { 95 mutex_unlock(&proxy_dev->buf_lock); 96 pr_debug("Invalid size in recv: count=%zd, req_len=%zd\n", 97 count, len); 98 return -EIO; 99 } 100 101 rc = copy_to_user(buf, proxy_dev->buffer, len); 102 memset(proxy_dev->buffer, 0, len); 103 proxy_dev->req_len = 0; 104 105 if (!rc) 106 proxy_dev->state |= STATE_WAIT_RESPONSE_FLAG; 107 108 mutex_unlock(&proxy_dev->buf_lock); 109 110 if (rc) 111 return -EFAULT; 112 113 return len; 114 } 115 116 /** 117 * vtpm_proxy_fops_write - Write TPM responses on 'server side' 118 * 119 * @filp: file pointer 120 * @buf: write buffer 121 * @count: number of bytes to write 122 * @off: offset 123 * 124 * Return: 125 * Number of bytes read or negative error value 126 */ 127 static ssize_t vtpm_proxy_fops_write(struct file *filp, const char __user *buf, 128 size_t count, loff_t *off) 129 { 130 struct proxy_dev *proxy_dev = filp->private_data; 131 132 mutex_lock(&proxy_dev->buf_lock); 133 134 if (!(proxy_dev->state & STATE_OPENED_FLAG)) { 135 mutex_unlock(&proxy_dev->buf_lock); 136 return -EPIPE; 137 } 138 139 if (count > sizeof(proxy_dev->buffer) || 140 !(proxy_dev->state & STATE_WAIT_RESPONSE_FLAG)) { 141 mutex_unlock(&proxy_dev->buf_lock); 142 return -EIO; 143 } 144 145 proxy_dev->state &= ~STATE_WAIT_RESPONSE_FLAG; 146 147 proxy_dev->req_len = 0; 148 149 if (copy_from_user(proxy_dev->buffer, buf, count)) { 150 mutex_unlock(&proxy_dev->buf_lock); 151 return -EFAULT; 152 } 153 154 proxy_dev->resp_len = count; 155 156 mutex_unlock(&proxy_dev->buf_lock); 157 158 wake_up_interruptible(&proxy_dev->wq); 159 160 return count; 161 } 162 163 /* 164 * vtpm_proxy_fops_poll - Poll status on 'server side' 165 * 166 * @filp: file pointer 167 * @wait: poll table 168 * 169 * Return: Poll flags 170 */ 171 static __poll_t vtpm_proxy_fops_poll(struct file *filp, poll_table *wait) 172 { 173 struct proxy_dev *proxy_dev = filp->private_data; 174 __poll_t ret; 175 176 poll_wait(filp, &proxy_dev->wq, wait); 177 178 ret = EPOLLOUT; 179 180 mutex_lock(&proxy_dev->buf_lock); 181 182 if (proxy_dev->req_len) 183 ret |= EPOLLIN | EPOLLRDNORM; 184 185 if (!(proxy_dev->state & STATE_OPENED_FLAG)) 186 ret |= EPOLLHUP; 187 188 mutex_unlock(&proxy_dev->buf_lock); 189 190 return ret; 191 } 192 193 /* 194 * vtpm_proxy_fops_open - Open vTPM device on 'server side' 195 * 196 * @filp: file pointer 197 * 198 * Called when setting up the anonymous file descriptor 199 */ 200 static void vtpm_proxy_fops_open(struct file *filp) 201 { 202 struct proxy_dev *proxy_dev = filp->private_data; 203 204 proxy_dev->state |= STATE_OPENED_FLAG; 205 } 206 207 /** 208 * vtpm_proxy_fops_undo_open - counter-part to vtpm_fops_open 209 * Call to undo vtpm_proxy_fops_open 210 * 211 *@proxy_dev: tpm proxy device 212 */ 213 static void vtpm_proxy_fops_undo_open(struct proxy_dev *proxy_dev) 214 { 215 mutex_lock(&proxy_dev->buf_lock); 216 217 proxy_dev->state &= ~STATE_OPENED_FLAG; 218 219 mutex_unlock(&proxy_dev->buf_lock); 220 221 /* no more TPM responses -- wake up anyone waiting for them */ 222 wake_up_interruptible(&proxy_dev->wq); 223 } 224 225 /* 226 * vtpm_proxy_fops_release - Close 'server side' 227 * 228 * @inode: inode 229 * @filp: file pointer 230 * Return: 231 * Always returns 0. 232 */ 233 static int vtpm_proxy_fops_release(struct inode *inode, struct file *filp) 234 { 235 struct proxy_dev *proxy_dev = filp->private_data; 236 237 filp->private_data = NULL; 238 239 vtpm_proxy_delete_device(proxy_dev); 240 241 return 0; 242 } 243 244 static const struct file_operations vtpm_proxy_fops = { 245 .owner = THIS_MODULE, 246 .read = vtpm_proxy_fops_read, 247 .write = vtpm_proxy_fops_write, 248 .poll = vtpm_proxy_fops_poll, 249 .release = vtpm_proxy_fops_release, 250 }; 251 252 /* 253 * Functions invoked by the core TPM driver to send TPM commands to 254 * 'server side' and receive responses from there. 255 */ 256 257 /* 258 * Called when core TPM driver reads TPM responses from 'server side' 259 * 260 * @chip: tpm chip to use 261 * @buf: receive buffer 262 * @count: bytes to read 263 * Return: 264 * Number of TPM response bytes read, negative error value otherwise 265 */ 266 static int vtpm_proxy_tpm_op_recv(struct tpm_chip *chip, u8 *buf, size_t count) 267 { 268 struct proxy_dev *proxy_dev = dev_get_drvdata(&chip->dev); 269 size_t len; 270 271 /* process gone ? */ 272 mutex_lock(&proxy_dev->buf_lock); 273 274 if (!(proxy_dev->state & STATE_OPENED_FLAG)) { 275 mutex_unlock(&proxy_dev->buf_lock); 276 return -EPIPE; 277 } 278 279 len = proxy_dev->resp_len; 280 if (count < len) { 281 dev_err(&chip->dev, 282 "Invalid size in recv: count=%zd, resp_len=%zd\n", 283 count, len); 284 len = -EIO; 285 goto out; 286 } 287 288 memcpy(buf, proxy_dev->buffer, len); 289 proxy_dev->resp_len = 0; 290 291 out: 292 mutex_unlock(&proxy_dev->buf_lock); 293 294 return len; 295 } 296 297 static int vtpm_proxy_is_driver_command(struct tpm_chip *chip, 298 u8 *buf, size_t count) 299 { 300 struct tpm_header *hdr = (struct tpm_header *)buf; 301 302 if (count < sizeof(struct tpm_header)) 303 return 0; 304 305 if (chip->flags & TPM_CHIP_FLAG_TPM2) { 306 switch (be32_to_cpu(hdr->ordinal)) { 307 case TPM2_CC_SET_LOCALITY: 308 return 1; 309 } 310 } else { 311 switch (be32_to_cpu(hdr->ordinal)) { 312 case TPM_ORD_SET_LOCALITY: 313 return 1; 314 } 315 } 316 return 0; 317 } 318 319 /* 320 * Called when core TPM driver forwards TPM requests to 'server side'. 321 * 322 * @chip: tpm chip to use 323 * @buf: send buffer 324 * @bufsiz: size of the buffer 325 * @count: bytes to send 326 * 327 * Return: 328 * 0 in case of success, negative error value otherwise. 329 */ 330 static int vtpm_proxy_tpm_op_send(struct tpm_chip *chip, u8 *buf, size_t bufsiz, 331 size_t count) 332 { 333 struct proxy_dev *proxy_dev = dev_get_drvdata(&chip->dev); 334 335 if (count > sizeof(proxy_dev->buffer)) { 336 dev_err(&chip->dev, 337 "Invalid size in send: count=%zd, buffer size=%zd\n", 338 count, sizeof(proxy_dev->buffer)); 339 return -EIO; 340 } 341 342 if (!(proxy_dev->state & STATE_DRIVER_COMMAND) && 343 vtpm_proxy_is_driver_command(chip, buf, count)) 344 return -EFAULT; 345 346 mutex_lock(&proxy_dev->buf_lock); 347 348 if (!(proxy_dev->state & STATE_OPENED_FLAG)) { 349 mutex_unlock(&proxy_dev->buf_lock); 350 return -EPIPE; 351 } 352 353 proxy_dev->resp_len = 0; 354 355 proxy_dev->req_len = count; 356 memcpy(proxy_dev->buffer, buf, count); 357 358 proxy_dev->state &= ~STATE_WAIT_RESPONSE_FLAG; 359 360 mutex_unlock(&proxy_dev->buf_lock); 361 362 wake_up_interruptible(&proxy_dev->wq); 363 364 return 0; 365 } 366 367 static void vtpm_proxy_tpm_op_cancel(struct tpm_chip *chip) 368 { 369 /* not supported */ 370 } 371 372 static u8 vtpm_proxy_tpm_op_status(struct tpm_chip *chip) 373 { 374 struct proxy_dev *proxy_dev = dev_get_drvdata(&chip->dev); 375 376 if (proxy_dev->resp_len) 377 return VTPM_PROXY_REQ_COMPLETE_FLAG; 378 379 return 0; 380 } 381 382 static bool vtpm_proxy_tpm_req_canceled(struct tpm_chip *chip, u8 status) 383 { 384 struct proxy_dev *proxy_dev = dev_get_drvdata(&chip->dev); 385 bool ret; 386 387 mutex_lock(&proxy_dev->buf_lock); 388 389 ret = !(proxy_dev->state & STATE_OPENED_FLAG); 390 391 mutex_unlock(&proxy_dev->buf_lock); 392 393 return ret; 394 } 395 396 static int vtpm_proxy_request_locality(struct tpm_chip *chip, int locality) 397 { 398 int rc; 399 const struct tpm_header *header; 400 struct proxy_dev *proxy_dev = dev_get_drvdata(&chip->dev); 401 402 struct tpm_buf *buf __free(kfree) = kzalloc(TPM_BUFSIZE, GFP_KERNEL); 403 if (!buf) 404 return -ENOMEM; 405 406 tpm_buf_init(buf, TPM_BUFSIZE); 407 if (chip->flags & TPM_CHIP_FLAG_TPM2) 408 tpm_buf_reset(buf, TPM2_ST_SESSIONS, TPM2_CC_SET_LOCALITY); 409 else 410 tpm_buf_reset(buf, TPM_TAG_RQU_COMMAND, TPM_ORD_SET_LOCALITY); 411 412 tpm_buf_append_u8(buf, locality); 413 414 proxy_dev->state |= STATE_DRIVER_COMMAND; 415 416 rc = tpm_transmit_cmd(chip, buf, 0, "attempting to set locality"); 417 418 proxy_dev->state &= ~STATE_DRIVER_COMMAND; 419 420 if (rc < 0) 421 return rc; 422 423 header = (const struct tpm_header *)buf->data; 424 rc = be32_to_cpu(header->return_code); 425 if (rc) 426 locality = -1; 427 428 return locality; 429 } 430 431 static const struct tpm_class_ops vtpm_proxy_tpm_ops = { 432 .flags = TPM_OPS_AUTO_STARTUP, 433 .recv = vtpm_proxy_tpm_op_recv, 434 .send = vtpm_proxy_tpm_op_send, 435 .cancel = vtpm_proxy_tpm_op_cancel, 436 .status = vtpm_proxy_tpm_op_status, 437 .req_complete_mask = VTPM_PROXY_REQ_COMPLETE_FLAG, 438 .req_complete_val = VTPM_PROXY_REQ_COMPLETE_FLAG, 439 .req_canceled = vtpm_proxy_tpm_req_canceled, 440 .request_locality = vtpm_proxy_request_locality, 441 }; 442 443 /* 444 * Code related to the startup of the TPM 2 and startup of TPM 1.2 + 445 * retrieval of timeouts and durations. 446 */ 447 448 static void vtpm_proxy_work(struct work_struct *work) 449 { 450 struct proxy_dev *proxy_dev = container_of(work, struct proxy_dev, 451 work); 452 int rc; 453 454 rc = tpm_chip_register(proxy_dev->chip); 455 if (rc) 456 vtpm_proxy_fops_undo_open(proxy_dev); 457 else 458 proxy_dev->state |= STATE_REGISTERED_FLAG; 459 } 460 461 /* 462 * vtpm_proxy_work_stop: make sure the work has finished 463 * 464 * This function is useful when user space closed the fd 465 * while the driver still determines timeouts. 466 */ 467 static void vtpm_proxy_work_stop(struct proxy_dev *proxy_dev) 468 { 469 vtpm_proxy_fops_undo_open(proxy_dev); 470 flush_work(&proxy_dev->work); 471 } 472 473 /* 474 * vtpm_proxy_work_start: Schedule the work for TPM 1.2 & 2 initialization 475 */ 476 static inline void vtpm_proxy_work_start(struct proxy_dev *proxy_dev) 477 { 478 queue_work(workqueue, &proxy_dev->work); 479 } 480 481 /* 482 * Code related to creation and deletion of device pairs 483 */ 484 static struct proxy_dev *vtpm_proxy_create_proxy_dev(void) 485 { 486 struct proxy_dev *proxy_dev; 487 struct tpm_chip *chip; 488 int err; 489 490 proxy_dev = kzalloc_obj(*proxy_dev); 491 if (proxy_dev == NULL) 492 return ERR_PTR(-ENOMEM); 493 494 init_waitqueue_head(&proxy_dev->wq); 495 mutex_init(&proxy_dev->buf_lock); 496 INIT_WORK(&proxy_dev->work, vtpm_proxy_work); 497 498 chip = tpm_chip_alloc(NULL, &vtpm_proxy_tpm_ops); 499 if (IS_ERR(chip)) { 500 err = PTR_ERR(chip); 501 goto err_proxy_dev_free; 502 } 503 dev_set_drvdata(&chip->dev, proxy_dev); 504 505 proxy_dev->chip = chip; 506 507 return proxy_dev; 508 509 err_proxy_dev_free: 510 kfree(proxy_dev); 511 512 return ERR_PTR(err); 513 } 514 515 /* 516 * Undo what has been done in vtpm_create_proxy_dev 517 */ 518 static inline void vtpm_proxy_delete_proxy_dev(struct proxy_dev *proxy_dev) 519 { 520 put_device(&proxy_dev->chip->dev); /* frees chip */ 521 kfree(proxy_dev); 522 } 523 524 /* 525 * Create a /dev/tpm%d and 'server side' file descriptor pair 526 * 527 * Return: 528 * Returns file pointer on success, an error value otherwise 529 */ 530 static struct file *vtpm_proxy_create_device( 531 struct vtpm_proxy_new_dev *vtpm_new_dev) 532 { 533 struct proxy_dev *proxy_dev; 534 int rc, fd; 535 struct file *file; 536 537 if (vtpm_new_dev->flags & ~VTPM_PROXY_FLAGS_ALL) 538 return ERR_PTR(-EOPNOTSUPP); 539 540 proxy_dev = vtpm_proxy_create_proxy_dev(); 541 if (IS_ERR(proxy_dev)) 542 return ERR_CAST(proxy_dev); 543 544 proxy_dev->flags = vtpm_new_dev->flags; 545 546 /* setup an anonymous file for the server-side */ 547 fd = get_unused_fd_flags(O_RDWR); 548 if (fd < 0) { 549 rc = fd; 550 goto err_delete_proxy_dev; 551 } 552 553 file = anon_inode_getfile("[vtpms]", &vtpm_proxy_fops, proxy_dev, 554 O_RDWR); 555 if (IS_ERR(file)) { 556 rc = PTR_ERR(file); 557 goto err_put_unused_fd; 558 } 559 560 /* from now on we can unwind with put_unused_fd() + fput() */ 561 /* simulate an open() on the server side */ 562 vtpm_proxy_fops_open(file); 563 564 if (proxy_dev->flags & VTPM_PROXY_FLAG_TPM2) 565 proxy_dev->chip->flags |= TPM_CHIP_FLAG_TPM2; 566 567 vtpm_proxy_work_start(proxy_dev); 568 569 vtpm_new_dev->fd = fd; 570 vtpm_new_dev->major = MAJOR(proxy_dev->chip->dev.devt); 571 vtpm_new_dev->minor = MINOR(proxy_dev->chip->dev.devt); 572 vtpm_new_dev->tpm_num = proxy_dev->chip->dev_num; 573 574 return file; 575 576 err_put_unused_fd: 577 put_unused_fd(fd); 578 579 err_delete_proxy_dev: 580 vtpm_proxy_delete_proxy_dev(proxy_dev); 581 582 return ERR_PTR(rc); 583 } 584 585 /* 586 * Counter part to vtpm_create_device. 587 */ 588 static void vtpm_proxy_delete_device(struct proxy_dev *proxy_dev) 589 { 590 vtpm_proxy_work_stop(proxy_dev); 591 592 /* 593 * A client may hold the 'ops' lock, so let it know that the server 594 * side shuts down before we try to grab the 'ops' lock when 595 * unregistering the chip. 596 */ 597 vtpm_proxy_fops_undo_open(proxy_dev); 598 599 if (proxy_dev->state & STATE_REGISTERED_FLAG) 600 tpm_chip_unregister(proxy_dev->chip); 601 602 vtpm_proxy_delete_proxy_dev(proxy_dev); 603 } 604 605 /* 606 * Code related to the control device /dev/vtpmx 607 */ 608 609 /** 610 * vtpmx_ioc_new_dev - handler for the %VTPM_PROXY_IOC_NEW_DEV ioctl 611 * @file: /dev/vtpmx 612 * @ioctl: the ioctl number 613 * @arg: pointer to the struct vtpmx_proxy_new_dev 614 * 615 * Creates an anonymous file that is used by the process acting as a TPM to 616 * communicate with the client processes. The function will also add a new TPM 617 * device through which data is proxied to this TPM acting process. The caller 618 * will be provided with a file descriptor to communicate with the clients and 619 * major and minor numbers for the TPM device. 620 */ 621 static long vtpmx_ioc_new_dev(struct file *file, unsigned int ioctl, 622 unsigned long arg) 623 { 624 void __user *argp = (void __user *)arg; 625 struct vtpm_proxy_new_dev __user *vtpm_new_dev_p; 626 struct vtpm_proxy_new_dev vtpm_new_dev; 627 struct file *vtpm_file; 628 629 if (!capable(CAP_SYS_ADMIN)) 630 return -EPERM; 631 632 vtpm_new_dev_p = argp; 633 634 if (copy_from_user(&vtpm_new_dev, vtpm_new_dev_p, 635 sizeof(vtpm_new_dev))) 636 return -EFAULT; 637 638 vtpm_file = vtpm_proxy_create_device(&vtpm_new_dev); 639 if (IS_ERR(vtpm_file)) 640 return PTR_ERR(vtpm_file); 641 642 if (copy_to_user(vtpm_new_dev_p, &vtpm_new_dev, 643 sizeof(vtpm_new_dev))) { 644 put_unused_fd(vtpm_new_dev.fd); 645 fput(vtpm_file); 646 return -EFAULT; 647 } 648 649 fd_install(vtpm_new_dev.fd, vtpm_file); 650 return 0; 651 } 652 653 /* 654 * vtpmx_fops_ioctl: ioctl on /dev/vtpmx 655 * 656 * Return: 657 * Returns 0 on success, a negative error code otherwise. 658 */ 659 static long vtpmx_fops_ioctl(struct file *f, unsigned int ioctl, 660 unsigned long arg) 661 { 662 switch (ioctl) { 663 case VTPM_PROXY_IOC_NEW_DEV: 664 return vtpmx_ioc_new_dev(f, ioctl, arg); 665 default: 666 return -ENOIOCTLCMD; 667 } 668 } 669 670 static const struct file_operations vtpmx_fops = { 671 .owner = THIS_MODULE, 672 .unlocked_ioctl = vtpmx_fops_ioctl, 673 .compat_ioctl = compat_ptr_ioctl, 674 .llseek = noop_llseek, 675 }; 676 677 static struct miscdevice vtpmx_miscdev = { 678 .minor = MISC_DYNAMIC_MINOR, 679 .name = "vtpmx", 680 .fops = &vtpmx_fops, 681 }; 682 683 static int __init vtpm_module_init(void) 684 { 685 int rc; 686 687 workqueue = create_workqueue("tpm-vtpm"); 688 if (!workqueue) { 689 pr_err("couldn't create workqueue\n"); 690 return -ENOMEM; 691 } 692 693 rc = misc_register(&vtpmx_miscdev); 694 if (rc) { 695 pr_err("couldn't create vtpmx device\n"); 696 destroy_workqueue(workqueue); 697 } 698 699 return rc; 700 } 701 702 static void __exit vtpm_module_exit(void) 703 { 704 destroy_workqueue(workqueue); 705 misc_deregister(&vtpmx_miscdev); 706 } 707 708 module_init(vtpm_module_init); 709 module_exit(vtpm_module_exit); 710 711 MODULE_AUTHOR("Stefan Berger <stefanb@us.ibm.com>"); 712 MODULE_DESCRIPTION("vTPM Driver"); 713 MODULE_VERSION("0.1"); 714 MODULE_LICENSE("GPL"); 715