1 /* 2 * Copyright (C) 2015, 2016 IBM Corporation 3 * Copyright (C) 2016 Intel Corporation 4 * 5 * Author: Stefan Berger <stefanb@us.ibm.com> 6 * 7 * Maintained by: <tpmdd-devel@lists.sourceforge.net> 8 * 9 * Device driver for vTPM (vTPM proxy driver) 10 * 11 * This program is free software; you can redistribute it and/or 12 * modify it under the terms of the GNU General Public License as 13 * published by the Free Software Foundation, version 2 of the 14 * License. 15 * 16 */ 17 18 #include <linux/types.h> 19 #include <linux/spinlock.h> 20 #include <linux/uaccess.h> 21 #include <linux/wait.h> 22 #include <linux/miscdevice.h> 23 #include <linux/vtpm_proxy.h> 24 #include <linux/file.h> 25 #include <linux/anon_inodes.h> 26 #include <linux/poll.h> 27 #include <linux/compat.h> 28 29 #include "tpm.h" 30 31 #define VTPM_PROXY_REQ_COMPLETE_FLAG BIT(0) 32 33 struct proxy_dev { 34 struct tpm_chip *chip; 35 36 u32 flags; /* public API flags */ 37 38 wait_queue_head_t wq; 39 40 struct mutex buf_lock; /* protect buffer and flags */ 41 42 long state; /* internal state */ 43 #define STATE_OPENED_FLAG BIT(0) 44 #define STATE_WAIT_RESPONSE_FLAG BIT(1) /* waiting for emulator response */ 45 #define STATE_REGISTERED_FLAG BIT(2) 46 47 size_t req_len; /* length of queued TPM request */ 48 size_t resp_len; /* length of queued TPM response */ 49 u8 buffer[TPM_BUFSIZE]; /* request/response buffer */ 50 51 struct work_struct work; /* task that retrieves TPM timeouts */ 52 }; 53 54 /* all supported flags */ 55 #define VTPM_PROXY_FLAGS_ALL (VTPM_PROXY_FLAG_TPM2) 56 57 static struct workqueue_struct *workqueue; 58 59 static void vtpm_proxy_delete_device(struct proxy_dev *proxy_dev); 60 61 /* 62 * Functions related to 'server side' 63 */ 64 65 /** 66 * vtpm_proxy_fops_read - Read TPM commands on 'server side' 67 * 68 * @filp: file pointer 69 * @buf: read buffer 70 * @count: number of bytes to read 71 * @off: offset 72 * 73 * Return: 74 * Number of bytes read or negative error code 75 */ 76 static ssize_t vtpm_proxy_fops_read(struct file *filp, char __user *buf, 77 size_t count, loff_t *off) 78 { 79 struct proxy_dev *proxy_dev = filp->private_data; 80 size_t len; 81 int sig, rc; 82 83 sig = wait_event_interruptible(proxy_dev->wq, 84 proxy_dev->req_len != 0 || 85 !(proxy_dev->state & STATE_OPENED_FLAG)); 86 if (sig) 87 return -EINTR; 88 89 mutex_lock(&proxy_dev->buf_lock); 90 91 if (!(proxy_dev->state & STATE_OPENED_FLAG)) { 92 mutex_unlock(&proxy_dev->buf_lock); 93 return -EPIPE; 94 } 95 96 len = proxy_dev->req_len; 97 98 if (count < len) { 99 mutex_unlock(&proxy_dev->buf_lock); 100 pr_debug("Invalid size in recv: count=%zd, req_len=%zd\n", 101 count, len); 102 return -EIO; 103 } 104 105 rc = copy_to_user(buf, proxy_dev->buffer, len); 106 memset(proxy_dev->buffer, 0, len); 107 proxy_dev->req_len = 0; 108 109 if (!rc) 110 proxy_dev->state |= STATE_WAIT_RESPONSE_FLAG; 111 112 mutex_unlock(&proxy_dev->buf_lock); 113 114 if (rc) 115 return -EFAULT; 116 117 return len; 118 } 119 120 /** 121 * vtpm_proxy_fops_write - Write TPM responses on 'server side' 122 * 123 * @filp: file pointer 124 * @buf: write buffer 125 * @count: number of bytes to write 126 * @off: offset 127 * 128 * Return: 129 * Number of bytes read or negative error value 130 */ 131 static ssize_t vtpm_proxy_fops_write(struct file *filp, const char __user *buf, 132 size_t count, loff_t *off) 133 { 134 struct proxy_dev *proxy_dev = filp->private_data; 135 136 mutex_lock(&proxy_dev->buf_lock); 137 138 if (!(proxy_dev->state & STATE_OPENED_FLAG)) { 139 mutex_unlock(&proxy_dev->buf_lock); 140 return -EPIPE; 141 } 142 143 if (count > sizeof(proxy_dev->buffer) || 144 !(proxy_dev->state & STATE_WAIT_RESPONSE_FLAG)) { 145 mutex_unlock(&proxy_dev->buf_lock); 146 return -EIO; 147 } 148 149 proxy_dev->state &= ~STATE_WAIT_RESPONSE_FLAG; 150 151 proxy_dev->req_len = 0; 152 153 if (copy_from_user(proxy_dev->buffer, buf, count)) { 154 mutex_unlock(&proxy_dev->buf_lock); 155 return -EFAULT; 156 } 157 158 proxy_dev->resp_len = count; 159 160 mutex_unlock(&proxy_dev->buf_lock); 161 162 wake_up_interruptible(&proxy_dev->wq); 163 164 return count; 165 } 166 167 /* 168 * vtpm_proxy_fops_poll - Poll status on 'server side' 169 * 170 * @filp: file pointer 171 * @wait: poll table 172 * 173 * Return: Poll flags 174 */ 175 static unsigned int vtpm_proxy_fops_poll(struct file *filp, poll_table *wait) 176 { 177 struct proxy_dev *proxy_dev = filp->private_data; 178 unsigned ret; 179 180 poll_wait(filp, &proxy_dev->wq, wait); 181 182 ret = POLLOUT; 183 184 mutex_lock(&proxy_dev->buf_lock); 185 186 if (proxy_dev->req_len) 187 ret |= POLLIN | POLLRDNORM; 188 189 if (!(proxy_dev->state & STATE_OPENED_FLAG)) 190 ret |= POLLHUP; 191 192 mutex_unlock(&proxy_dev->buf_lock); 193 194 return ret; 195 } 196 197 /* 198 * vtpm_proxy_fops_open - Open vTPM device on 'server side' 199 * 200 * @filp: file pointer 201 * 202 * Called when setting up the anonymous file descriptor 203 */ 204 static void vtpm_proxy_fops_open(struct file *filp) 205 { 206 struct proxy_dev *proxy_dev = filp->private_data; 207 208 proxy_dev->state |= STATE_OPENED_FLAG; 209 } 210 211 /** 212 * vtpm_proxy_fops_undo_open - counter-part to vtpm_fops_open 213 * Call to undo vtpm_proxy_fops_open 214 * 215 *@proxy_dev: tpm proxy device 216 */ 217 static void vtpm_proxy_fops_undo_open(struct proxy_dev *proxy_dev) 218 { 219 mutex_lock(&proxy_dev->buf_lock); 220 221 proxy_dev->state &= ~STATE_OPENED_FLAG; 222 223 mutex_unlock(&proxy_dev->buf_lock); 224 225 /* no more TPM responses -- wake up anyone waiting for them */ 226 wake_up_interruptible(&proxy_dev->wq); 227 } 228 229 /* 230 * vtpm_proxy_fops_release - Close 'server side' 231 * 232 * @inode: inode 233 * @filp: file pointer 234 * Return: 235 * Always returns 0. 236 */ 237 static int vtpm_proxy_fops_release(struct inode *inode, struct file *filp) 238 { 239 struct proxy_dev *proxy_dev = filp->private_data; 240 241 filp->private_data = NULL; 242 243 vtpm_proxy_delete_device(proxy_dev); 244 245 return 0; 246 } 247 248 static const struct file_operations vtpm_proxy_fops = { 249 .owner = THIS_MODULE, 250 .llseek = no_llseek, 251 .read = vtpm_proxy_fops_read, 252 .write = vtpm_proxy_fops_write, 253 .poll = vtpm_proxy_fops_poll, 254 .release = vtpm_proxy_fops_release, 255 }; 256 257 /* 258 * Functions invoked by the core TPM driver to send TPM commands to 259 * 'server side' and receive responses from there. 260 */ 261 262 /* 263 * Called when core TPM driver reads TPM responses from 'server side' 264 * 265 * @chip: tpm chip to use 266 * @buf: receive buffer 267 * @count: bytes to read 268 * Return: 269 * Number of TPM response bytes read, negative error value otherwise 270 */ 271 static int vtpm_proxy_tpm_op_recv(struct tpm_chip *chip, u8 *buf, size_t count) 272 { 273 struct proxy_dev *proxy_dev = dev_get_drvdata(&chip->dev); 274 size_t len; 275 276 /* process gone ? */ 277 mutex_lock(&proxy_dev->buf_lock); 278 279 if (!(proxy_dev->state & STATE_OPENED_FLAG)) { 280 mutex_unlock(&proxy_dev->buf_lock); 281 return -EPIPE; 282 } 283 284 len = proxy_dev->resp_len; 285 if (count < len) { 286 dev_err(&chip->dev, 287 "Invalid size in recv: count=%zd, resp_len=%zd\n", 288 count, len); 289 len = -EIO; 290 goto out; 291 } 292 293 memcpy(buf, proxy_dev->buffer, len); 294 proxy_dev->resp_len = 0; 295 296 out: 297 mutex_unlock(&proxy_dev->buf_lock); 298 299 return len; 300 } 301 302 /* 303 * Called when core TPM driver forwards TPM requests to 'server side'. 304 * 305 * @chip: tpm chip to use 306 * @buf: send buffer 307 * @count: bytes to send 308 * 309 * Return: 310 * 0 in case of success, negative error value otherwise. 311 */ 312 static int vtpm_proxy_tpm_op_send(struct tpm_chip *chip, u8 *buf, size_t count) 313 { 314 struct proxy_dev *proxy_dev = dev_get_drvdata(&chip->dev); 315 int rc = 0; 316 317 if (count > sizeof(proxy_dev->buffer)) { 318 dev_err(&chip->dev, 319 "Invalid size in send: count=%zd, buffer size=%zd\n", 320 count, sizeof(proxy_dev->buffer)); 321 return -EIO; 322 } 323 324 mutex_lock(&proxy_dev->buf_lock); 325 326 if (!(proxy_dev->state & STATE_OPENED_FLAG)) { 327 mutex_unlock(&proxy_dev->buf_lock); 328 return -EPIPE; 329 } 330 331 proxy_dev->resp_len = 0; 332 333 proxy_dev->req_len = count; 334 memcpy(proxy_dev->buffer, buf, count); 335 336 proxy_dev->state &= ~STATE_WAIT_RESPONSE_FLAG; 337 338 mutex_unlock(&proxy_dev->buf_lock); 339 340 wake_up_interruptible(&proxy_dev->wq); 341 342 return rc; 343 } 344 345 static void vtpm_proxy_tpm_op_cancel(struct tpm_chip *chip) 346 { 347 /* not supported */ 348 } 349 350 static u8 vtpm_proxy_tpm_op_status(struct tpm_chip *chip) 351 { 352 struct proxy_dev *proxy_dev = dev_get_drvdata(&chip->dev); 353 354 if (proxy_dev->resp_len) 355 return VTPM_PROXY_REQ_COMPLETE_FLAG; 356 357 return 0; 358 } 359 360 static bool vtpm_proxy_tpm_req_canceled(struct tpm_chip *chip, u8 status) 361 { 362 struct proxy_dev *proxy_dev = dev_get_drvdata(&chip->dev); 363 bool ret; 364 365 mutex_lock(&proxy_dev->buf_lock); 366 367 ret = !(proxy_dev->state & STATE_OPENED_FLAG); 368 369 mutex_unlock(&proxy_dev->buf_lock); 370 371 return ret; 372 } 373 374 static const struct tpm_class_ops vtpm_proxy_tpm_ops = { 375 .flags = TPM_OPS_AUTO_STARTUP, 376 .recv = vtpm_proxy_tpm_op_recv, 377 .send = vtpm_proxy_tpm_op_send, 378 .cancel = vtpm_proxy_tpm_op_cancel, 379 .status = vtpm_proxy_tpm_op_status, 380 .req_complete_mask = VTPM_PROXY_REQ_COMPLETE_FLAG, 381 .req_complete_val = VTPM_PROXY_REQ_COMPLETE_FLAG, 382 .req_canceled = vtpm_proxy_tpm_req_canceled, 383 }; 384 385 /* 386 * Code related to the startup of the TPM 2 and startup of TPM 1.2 + 387 * retrieval of timeouts and durations. 388 */ 389 390 static void vtpm_proxy_work(struct work_struct *work) 391 { 392 struct proxy_dev *proxy_dev = container_of(work, struct proxy_dev, 393 work); 394 int rc; 395 396 rc = tpm_chip_register(proxy_dev->chip); 397 if (rc) 398 vtpm_proxy_fops_undo_open(proxy_dev); 399 else 400 proxy_dev->state |= STATE_REGISTERED_FLAG; 401 } 402 403 /* 404 * vtpm_proxy_work_stop: make sure the work has finished 405 * 406 * This function is useful when user space closed the fd 407 * while the driver still determines timeouts. 408 */ 409 static void vtpm_proxy_work_stop(struct proxy_dev *proxy_dev) 410 { 411 vtpm_proxy_fops_undo_open(proxy_dev); 412 flush_work(&proxy_dev->work); 413 } 414 415 /* 416 * vtpm_proxy_work_start: Schedule the work for TPM 1.2 & 2 initialization 417 */ 418 static inline void vtpm_proxy_work_start(struct proxy_dev *proxy_dev) 419 { 420 queue_work(workqueue, &proxy_dev->work); 421 } 422 423 /* 424 * Code related to creation and deletion of device pairs 425 */ 426 static struct proxy_dev *vtpm_proxy_create_proxy_dev(void) 427 { 428 struct proxy_dev *proxy_dev; 429 struct tpm_chip *chip; 430 int err; 431 432 proxy_dev = kzalloc(sizeof(*proxy_dev), GFP_KERNEL); 433 if (proxy_dev == NULL) 434 return ERR_PTR(-ENOMEM); 435 436 init_waitqueue_head(&proxy_dev->wq); 437 mutex_init(&proxy_dev->buf_lock); 438 INIT_WORK(&proxy_dev->work, vtpm_proxy_work); 439 440 chip = tpm_chip_alloc(NULL, &vtpm_proxy_tpm_ops); 441 if (IS_ERR(chip)) { 442 err = PTR_ERR(chip); 443 goto err_proxy_dev_free; 444 } 445 dev_set_drvdata(&chip->dev, proxy_dev); 446 447 proxy_dev->chip = chip; 448 449 return proxy_dev; 450 451 err_proxy_dev_free: 452 kfree(proxy_dev); 453 454 return ERR_PTR(err); 455 } 456 457 /* 458 * Undo what has been done in vtpm_create_proxy_dev 459 */ 460 static inline void vtpm_proxy_delete_proxy_dev(struct proxy_dev *proxy_dev) 461 { 462 put_device(&proxy_dev->chip->dev); /* frees chip */ 463 kfree(proxy_dev); 464 } 465 466 /* 467 * Create a /dev/tpm%d and 'server side' file descriptor pair 468 * 469 * Return: 470 * Returns file pointer on success, an error value otherwise 471 */ 472 static struct file *vtpm_proxy_create_device( 473 struct vtpm_proxy_new_dev *vtpm_new_dev) 474 { 475 struct proxy_dev *proxy_dev; 476 int rc, fd; 477 struct file *file; 478 479 if (vtpm_new_dev->flags & ~VTPM_PROXY_FLAGS_ALL) 480 return ERR_PTR(-EOPNOTSUPP); 481 482 proxy_dev = vtpm_proxy_create_proxy_dev(); 483 if (IS_ERR(proxy_dev)) 484 return ERR_CAST(proxy_dev); 485 486 proxy_dev->flags = vtpm_new_dev->flags; 487 488 /* setup an anonymous file for the server-side */ 489 fd = get_unused_fd_flags(O_RDWR); 490 if (fd < 0) { 491 rc = fd; 492 goto err_delete_proxy_dev; 493 } 494 495 file = anon_inode_getfile("[vtpms]", &vtpm_proxy_fops, proxy_dev, 496 O_RDWR); 497 if (IS_ERR(file)) { 498 rc = PTR_ERR(file); 499 goto err_put_unused_fd; 500 } 501 502 /* from now on we can unwind with put_unused_fd() + fput() */ 503 /* simulate an open() on the server side */ 504 vtpm_proxy_fops_open(file); 505 506 if (proxy_dev->flags & VTPM_PROXY_FLAG_TPM2) 507 proxy_dev->chip->flags |= TPM_CHIP_FLAG_TPM2; 508 509 vtpm_proxy_work_start(proxy_dev); 510 511 vtpm_new_dev->fd = fd; 512 vtpm_new_dev->major = MAJOR(proxy_dev->chip->dev.devt); 513 vtpm_new_dev->minor = MINOR(proxy_dev->chip->dev.devt); 514 vtpm_new_dev->tpm_num = proxy_dev->chip->dev_num; 515 516 return file; 517 518 err_put_unused_fd: 519 put_unused_fd(fd); 520 521 err_delete_proxy_dev: 522 vtpm_proxy_delete_proxy_dev(proxy_dev); 523 524 return ERR_PTR(rc); 525 } 526 527 /* 528 * Counter part to vtpm_create_device. 529 */ 530 static void vtpm_proxy_delete_device(struct proxy_dev *proxy_dev) 531 { 532 vtpm_proxy_work_stop(proxy_dev); 533 534 /* 535 * A client may hold the 'ops' lock, so let it know that the server 536 * side shuts down before we try to grab the 'ops' lock when 537 * unregistering the chip. 538 */ 539 vtpm_proxy_fops_undo_open(proxy_dev); 540 541 if (proxy_dev->state & STATE_REGISTERED_FLAG) 542 tpm_chip_unregister(proxy_dev->chip); 543 544 vtpm_proxy_delete_proxy_dev(proxy_dev); 545 } 546 547 /* 548 * Code related to the control device /dev/vtpmx 549 */ 550 551 /** 552 * vtpmx_ioc_new_dev - handler for the %VTPM_PROXY_IOC_NEW_DEV ioctl 553 * @file: /dev/vtpmx 554 * @ioctl: the ioctl number 555 * @arg: pointer to the struct vtpmx_proxy_new_dev 556 * 557 * Creates an anonymous file that is used by the process acting as a TPM to 558 * communicate with the client processes. The function will also add a new TPM 559 * device through which data is proxied to this TPM acting process. The caller 560 * will be provided with a file descriptor to communicate with the clients and 561 * major and minor numbers for the TPM device. 562 */ 563 static long vtpmx_ioc_new_dev(struct file *file, unsigned int ioctl, 564 unsigned long arg) 565 { 566 void __user *argp = (void __user *)arg; 567 struct vtpm_proxy_new_dev __user *vtpm_new_dev_p; 568 struct vtpm_proxy_new_dev vtpm_new_dev; 569 struct file *vtpm_file; 570 571 if (!capable(CAP_SYS_ADMIN)) 572 return -EPERM; 573 574 vtpm_new_dev_p = argp; 575 576 if (copy_from_user(&vtpm_new_dev, vtpm_new_dev_p, 577 sizeof(vtpm_new_dev))) 578 return -EFAULT; 579 580 vtpm_file = vtpm_proxy_create_device(&vtpm_new_dev); 581 if (IS_ERR(vtpm_file)) 582 return PTR_ERR(vtpm_file); 583 584 if (copy_to_user(vtpm_new_dev_p, &vtpm_new_dev, 585 sizeof(vtpm_new_dev))) { 586 put_unused_fd(vtpm_new_dev.fd); 587 fput(vtpm_file); 588 return -EFAULT; 589 } 590 591 fd_install(vtpm_new_dev.fd, vtpm_file); 592 return 0; 593 } 594 595 /* 596 * vtpmx_fops_ioctl: ioctl on /dev/vtpmx 597 * 598 * Return: 599 * Returns 0 on success, a negative error code otherwise. 600 */ 601 static long vtpmx_fops_ioctl(struct file *f, unsigned int ioctl, 602 unsigned long arg) 603 { 604 switch (ioctl) { 605 case VTPM_PROXY_IOC_NEW_DEV: 606 return vtpmx_ioc_new_dev(f, ioctl, arg); 607 default: 608 return -ENOIOCTLCMD; 609 } 610 } 611 612 #ifdef CONFIG_COMPAT 613 static long vtpmx_fops_compat_ioctl(struct file *f, unsigned int ioctl, 614 unsigned long arg) 615 { 616 return vtpmx_fops_ioctl(f, ioctl, (unsigned long)compat_ptr(arg)); 617 } 618 #endif 619 620 static const struct file_operations vtpmx_fops = { 621 .owner = THIS_MODULE, 622 .unlocked_ioctl = vtpmx_fops_ioctl, 623 #ifdef CONFIG_COMPAT 624 .compat_ioctl = vtpmx_fops_compat_ioctl, 625 #endif 626 .llseek = noop_llseek, 627 }; 628 629 static struct miscdevice vtpmx_miscdev = { 630 .minor = MISC_DYNAMIC_MINOR, 631 .name = "vtpmx", 632 .fops = &vtpmx_fops, 633 }; 634 635 static int vtpmx_init(void) 636 { 637 return misc_register(&vtpmx_miscdev); 638 } 639 640 static void vtpmx_cleanup(void) 641 { 642 misc_deregister(&vtpmx_miscdev); 643 } 644 645 static int __init vtpm_module_init(void) 646 { 647 int rc; 648 649 rc = vtpmx_init(); 650 if (rc) { 651 pr_err("couldn't create vtpmx device\n"); 652 return rc; 653 } 654 655 workqueue = create_workqueue("tpm-vtpm"); 656 if (!workqueue) { 657 pr_err("couldn't create workqueue\n"); 658 rc = -ENOMEM; 659 goto err_vtpmx_cleanup; 660 } 661 662 return 0; 663 664 err_vtpmx_cleanup: 665 vtpmx_cleanup(); 666 667 return rc; 668 } 669 670 static void __exit vtpm_module_exit(void) 671 { 672 destroy_workqueue(workqueue); 673 vtpmx_cleanup(); 674 } 675 676 module_init(vtpm_module_init); 677 module_exit(vtpm_module_exit); 678 679 MODULE_AUTHOR("Stefan Berger (stefanb@us.ibm.com)"); 680 MODULE_DESCRIPTION("vTPM Driver"); 681 MODULE_VERSION("0.1"); 682 MODULE_LICENSE("GPL"); 683