1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (C) 2021 - Google LLC 4 * Author: David Brazdil <dbrazdil@google.com> 5 * 6 * Driver for Open Profile for DICE. 7 * 8 * This driver takes ownership of a reserved memory region containing data 9 * generated by the Open Profile for DICE measured boot protocol. The memory 10 * contents are not interpreted by the kernel but can be mapped into a userspace 11 * process via a misc device. Userspace can also request a wipe of the memory. 12 * 13 * Userspace can access the data with (w/o error handling): 14 * 15 * fd = open("/dev/open-dice0", O_RDWR); 16 * read(fd, &size, sizeof(unsigned long)); 17 * data = mmap(NULL, size, PROT_READ, MAP_PRIVATE, fd, 0); 18 * write(fd, NULL, 0); // wipe 19 * close(fd); 20 */ 21 22 #include <linux/io.h> 23 #include <linux/miscdevice.h> 24 #include <linux/mm.h> 25 #include <linux/module.h> 26 #include <linux/of_reserved_mem.h> 27 #include <linux/platform_device.h> 28 29 #define DRIVER_NAME "open-dice" 30 31 struct open_dice_drvdata { 32 struct mutex lock; 33 char name[16]; 34 struct reserved_mem *rmem; 35 struct miscdevice misc; 36 }; 37 38 static inline struct open_dice_drvdata *to_open_dice_drvdata(struct file *filp) 39 { 40 return container_of(filp->private_data, struct open_dice_drvdata, misc); 41 } 42 43 static int open_dice_wipe(struct open_dice_drvdata *drvdata) 44 { 45 void *kaddr; 46 47 mutex_lock(&drvdata->lock); 48 kaddr = devm_memremap(drvdata->misc.this_device, drvdata->rmem->base, 49 drvdata->rmem->size, MEMREMAP_WC); 50 if (IS_ERR(kaddr)) { 51 mutex_unlock(&drvdata->lock); 52 return PTR_ERR(kaddr); 53 } 54 55 memset(kaddr, 0, drvdata->rmem->size); 56 devm_memunmap(drvdata->misc.this_device, kaddr); 57 mutex_unlock(&drvdata->lock); 58 return 0; 59 } 60 61 /* 62 * Copies the size of the reserved memory region to the user-provided buffer. 63 */ 64 static ssize_t open_dice_read(struct file *filp, char __user *ptr, size_t len, 65 loff_t *off) 66 { 67 unsigned long val = to_open_dice_drvdata(filp)->rmem->size; 68 69 return simple_read_from_buffer(ptr, len, off, &val, sizeof(val)); 70 } 71 72 /* 73 * Triggers a wipe of the reserved memory region. The user-provided pointer 74 * is never dereferenced. 75 */ 76 static ssize_t open_dice_write(struct file *filp, const char __user *ptr, 77 size_t len, loff_t *off) 78 { 79 if (open_dice_wipe(to_open_dice_drvdata(filp))) 80 return -EIO; 81 82 /* Consume the input buffer. */ 83 return len; 84 } 85 86 /* 87 * Creates a mapping of the reserved memory region in user address space. 88 */ 89 static int open_dice_mmap(struct file *filp, struct vm_area_struct *vma) 90 { 91 struct open_dice_drvdata *drvdata = to_open_dice_drvdata(filp); 92 93 if (vma->vm_flags & VM_MAYSHARE) { 94 /* Do not allow userspace to modify the underlying data. */ 95 if (vma->vm_flags & VM_WRITE) 96 return -EPERM; 97 /* Ensure userspace cannot acquire VM_WRITE later. */ 98 vm_flags_clear(vma, VM_MAYWRITE); 99 } 100 101 /* Create write-combine mapping so all clients observe a wipe. */ 102 vma->vm_page_prot = pgprot_writecombine(vma->vm_page_prot); 103 vm_flags_set(vma, VM_DONTCOPY | VM_DONTDUMP); 104 return vm_iomap_memory(vma, drvdata->rmem->base, drvdata->rmem->size); 105 } 106 107 static const struct file_operations open_dice_fops = { 108 .owner = THIS_MODULE, 109 .read = open_dice_read, 110 .write = open_dice_write, 111 .mmap = open_dice_mmap, 112 }; 113 114 static int __init open_dice_probe(struct platform_device *pdev) 115 { 116 static unsigned int dev_idx; 117 struct device *dev = &pdev->dev; 118 struct reserved_mem *rmem; 119 struct open_dice_drvdata *drvdata; 120 int ret; 121 122 rmem = of_reserved_mem_lookup(dev->of_node); 123 if (!rmem) { 124 dev_err(dev, "failed to lookup reserved memory\n"); 125 return -EINVAL; 126 } 127 128 if (!rmem->size || (rmem->size > ULONG_MAX)) { 129 dev_err(dev, "invalid memory region size\n"); 130 return -EINVAL; 131 } 132 133 if (!PAGE_ALIGNED(rmem->base) || !PAGE_ALIGNED(rmem->size)) { 134 dev_err(dev, "memory region must be page-aligned\n"); 135 return -EINVAL; 136 } 137 138 drvdata = devm_kmalloc(dev, sizeof(*drvdata), GFP_KERNEL); 139 if (!drvdata) 140 return -ENOMEM; 141 142 *drvdata = (struct open_dice_drvdata){ 143 .rmem = rmem, 144 .misc = (struct miscdevice){ 145 .parent = dev, 146 .name = drvdata->name, 147 .minor = MISC_DYNAMIC_MINOR, 148 .fops = &open_dice_fops, 149 .mode = 0600, 150 }, 151 }; 152 mutex_init(&drvdata->lock); 153 154 /* Index overflow check not needed, misc_register() will fail. */ 155 snprintf(drvdata->name, sizeof(drvdata->name), DRIVER_NAME"%u", dev_idx++); 156 157 ret = misc_register(&drvdata->misc); 158 if (ret) { 159 dev_err(dev, "failed to register misc device '%s': %d\n", 160 drvdata->name, ret); 161 return ret; 162 } 163 164 platform_set_drvdata(pdev, drvdata); 165 return 0; 166 } 167 168 static void open_dice_remove(struct platform_device *pdev) 169 { 170 struct open_dice_drvdata *drvdata = platform_get_drvdata(pdev); 171 172 misc_deregister(&drvdata->misc); 173 } 174 175 static const struct of_device_id open_dice_of_match[] = { 176 { .compatible = "google,open-dice" }, 177 {}, 178 }; 179 180 static struct platform_driver open_dice_driver = { 181 .remove_new = open_dice_remove, 182 .driver = { 183 .name = DRIVER_NAME, 184 .of_match_table = open_dice_of_match, 185 }, 186 }; 187 188 static int __init open_dice_init(void) 189 { 190 int ret = platform_driver_probe(&open_dice_driver, open_dice_probe); 191 192 /* DICE regions are optional. Succeed even with zero instances. */ 193 return (ret == -ENODEV) ? 0 : ret; 194 } 195 196 static void __exit open_dice_exit(void) 197 { 198 platform_driver_unregister(&open_dice_driver); 199 } 200 201 module_init(open_dice_init); 202 module_exit(open_dice_exit); 203 204 MODULE_LICENSE("GPL v2"); 205 MODULE_AUTHOR("David Brazdil <dbrazdil@google.com>"); 206