1// SPDX-License-Identifier: GPL-2.0-only
  2/*
  3 * Copyright (C) 2004 IBM Corporation
  4 * Authors:
  5 * Leendert van Doorn <leendert@watson.ibm.com>
  6 * Dave Safford <safford@watson.ibm.com>
  7 * Reiner Sailer <sailer@watson.ibm.com>
  8 * Kylene Hall <kjhall@us.ibm.com>
  9 *
 10 * Copyright (C) 2013 Obsidian Research Corp
 11 * Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
 12 *
 13 * Device file system interface to the TPM
 14 */
 15#include <linux/poll.h>
 16#include <linux/slab.h>
 17#include <linux/uaccess.h>
 18#include <linux/workqueue.h>
 19#include "tpm.h"
 20#include "tpm-dev.h"
 21
 22static struct workqueue_struct *tpm_dev_wq;
 23
 24static ssize_t tpm_dev_transmit(struct tpm_chip *chip, struct tpm_space *space,
 25				u8 *buf, size_t bufsiz)
 26{
 27	struct tpm_header *header = (void *)buf;
 28	ssize_t ret, len;
 29
 30	ret = tpm2_prepare_space(chip, space, buf, bufsiz);
 31	/* If the command is not implemented by the TPM, synthesize a
 32	 * response with a TPM2_RC_COMMAND_CODE return for user-space.
 33	 */
 34	if (ret == -EOPNOTSUPP) {
 35		header->length = cpu_to_be32(sizeof(*header));
 36		header->tag = cpu_to_be16(TPM2_ST_NO_SESSIONS);
 37		header->return_code = cpu_to_be32(TPM2_RC_COMMAND_CODE |
 38						  TSS2_RESMGR_TPM_RC_LAYER);
 39		ret = sizeof(*header);
 40	}
 41	if (ret)
 42		goto out_rc;
 43
 44	len = tpm_transmit(chip, buf, bufsiz);
 45	if (len < 0)
 46		ret = len;
 47
 48	if (!ret)
 49		ret = tpm2_commit_space(chip, space, buf, &len);
 50
 51out_rc:
 52	return ret ? ret : len;
 53}
 54
 55static void tpm_dev_async_work(struct work_struct *work)
 56{
 57	struct file_priv *priv =
 58			container_of(work, struct file_priv, async_work);
 59	ssize_t ret;
 60
 61	mutex_lock(&priv->buffer_mutex);
 62	priv->command_enqueued = false;
 63	ret = tpm_try_get_ops(priv->chip);
 64	if (ret) {
 65		priv->response_length = ret;
 66		goto out;
 67	}
 68
 69	ret = tpm_dev_transmit(priv->chip, priv->space, priv->data_buffer,
 70			       sizeof(priv->data_buffer));
 71	tpm_put_ops(priv->chip);
 72	if (ret > 0) {
 73		priv->response_length = ret;
 74		mod_timer(&priv->user_read_timer, jiffies + (120 * HZ));
 75	}
 76out:
 77	mutex_unlock(&priv->buffer_mutex);
 78	wake_up_interruptible(&priv->async_wait);
 79}
 80
 81static void user_reader_timeout(struct timer_list *t)
 82{
 83	struct file_priv *priv = from_timer(priv, t, user_read_timer);
 84
 85	pr_warn("TPM user space timeout is deprecated (pid=%d)\n",
 86		task_tgid_nr(current));
 87
 88	schedule_work(&priv->timeout_work);
 89}
 90
 91static void tpm_timeout_work(struct work_struct *work)
 92{
 93	struct file_priv *priv = container_of(work, struct file_priv,
 94					      timeout_work);
 95
 96	mutex_lock(&priv->buffer_mutex);
 97	priv->response_read = true;
 98	priv->response_length = 0;
 99	memset(priv->data_buffer, 0, sizeof(priv->data_buffer));
100	mutex_unlock(&priv->buffer_mutex);
101	wake_up_interruptible(&priv->async_wait);
102}
103
104void tpm_common_open(struct file *file, struct tpm_chip *chip,
105		     struct file_priv *priv, struct tpm_space *space)
106{
107	priv->chip = chip;
108	priv->space = space;
109	priv->response_read = true;
110
111	mutex_init(&priv->buffer_mutex);
112	timer_setup(&priv->user_read_timer, user_reader_timeout, 0);
113	INIT_WORK(&priv->timeout_work, tpm_timeout_work);
114	INIT_WORK(&priv->async_work, tpm_dev_async_work);
115	init_waitqueue_head(&priv->async_wait);
116	file->private_data = priv;
117}
118
119ssize_t tpm_common_read(struct file *file, char __user *buf,
120			size_t size, loff_t *off)
121{
122	struct file_priv *priv = file->private_data;
123	ssize_t ret_size = 0;
124	int rc;
125
126	mutex_lock(&priv->buffer_mutex);
127
128	if (priv->response_length) {
129		priv->response_read = true;
130
131		ret_size = min_t(ssize_t, size, priv->response_length);
132		if (ret_size <= 0) {
133			priv->response_length = 0;
134			goto out;
135		}
136
137		rc = copy_to_user(buf, priv->data_buffer + *off, ret_size);
138		if (rc) {
139			memset(priv->data_buffer, 0, TPM_BUFSIZE);
140			priv->response_length = 0;
141			ret_size = -EFAULT;
142		} else {
143			memset(priv->data_buffer + *off, 0, ret_size);
144			priv->response_length -= ret_size;
145			*off += ret_size;
146		}
147	}
148
149out:
150	if (!priv->response_length) {
151		*off = 0;
152		del_singleshot_timer_sync(&priv->user_read_timer);
153		flush_work(&priv->timeout_work);
154	}
155	mutex_unlock(&priv->buffer_mutex);
156	return ret_size;
157}
158
159ssize_t tpm_common_write(struct file *file, const char __user *buf,
160			 size_t size, loff_t *off)
161{
162	struct file_priv *priv = file->private_data;
163	int ret = 0;
164
165	if (size > TPM_BUFSIZE)
166		return -E2BIG;
167
168	mutex_lock(&priv->buffer_mutex);
169
170	/* Cannot perform a write until the read has cleared either via
171	 * tpm_read or a user_read_timer timeout. This also prevents split
172	 * buffered writes from blocking here.
173	 */
174	if ((!priv->response_read && priv->response_length) ||
175	    priv->command_enqueued) {
176		ret = -EBUSY;
177		goto out;
178	}
179
180	if (copy_from_user(priv->data_buffer, buf, size)) {
181		ret = -EFAULT;
182		goto out;
183	}
184
185	if (size < 6 ||
186	    size < be32_to_cpu(*((__be32 *)(priv->data_buffer + 2)))) {
187		ret = -EINVAL;
188		goto out;
189	}
190
191	priv->response_length = 0;
192	priv->response_read = false;
193	*off = 0;
194
195	/*
196	 * If in nonblocking mode schedule an async job to send
197	 * the command return the size.
198	 * In case of error the err code will be returned in
199	 * the subsequent read call.
200	 */
201	if (file->f_flags & O_NONBLOCK) {
202		priv->command_enqueued = true;
203		queue_work(tpm_dev_wq, &priv->async_work);
204		mutex_unlock(&priv->buffer_mutex);
205		return size;
206	}
207
208	/* atomic tpm command send and result receive. We only hold the ops
209	 * lock during this period so that the tpm can be unregistered even if
210	 * the char dev is held open.
211	 */
212	if (tpm_try_get_ops(priv->chip)) {
213		ret = -EPIPE;
214		goto out;
215	}
216
217	ret = tpm_dev_transmit(priv->chip, priv->space, priv->data_buffer,
218			       sizeof(priv->data_buffer));
219	tpm_put_ops(priv->chip);
220
221	if (ret > 0) {
222		priv->response_length = ret;
223		mod_timer(&priv->user_read_timer, jiffies + (120 * HZ));
224		ret = size;
225	}
226out:
227	mutex_unlock(&priv->buffer_mutex);
228	return ret;
229}
230
231__poll_t tpm_common_poll(struct file *file, poll_table *wait)
232{
233	struct file_priv *priv = file->private_data;
234	__poll_t mask = 0;
235
236	poll_wait(file, &priv->async_wait, wait);
237	mutex_lock(&priv->buffer_mutex);
238
239	/*
240	 * The response_length indicates if there is still response
241	 * (or part of it) to be consumed. Partial reads decrease it
242	 * by the number of bytes read, and write resets it the zero.
243	 */
244	if (priv->response_length)
245		mask = EPOLLIN | EPOLLRDNORM;
246	else
247		mask = EPOLLOUT | EPOLLWRNORM;
248
249	mutex_unlock(&priv->buffer_mutex);
250	return mask;
251}
252
253/*
254 * Called on file close
255 */
256void tpm_common_release(struct file *file, struct file_priv *priv)
257{
258	flush_work(&priv->async_work);
259	del_singleshot_timer_sync(&priv->user_read_timer);
260	flush_work(&priv->timeout_work);
261	file->private_data = NULL;
262	priv->response_length = 0;
263}
264
265int __init tpm_dev_common_init(void)
266{
267	tpm_dev_wq = alloc_workqueue("tpm_dev_wq", WQ_MEM_RECLAIM, 0);
268
269	return !tpm_dev_wq ? -ENOMEM : 0;
270}
271
272void __exit tpm_dev_common_exit(void)
273{
274	if (tpm_dev_wq) {
275		destroy_workqueue(tpm_dev_wq);
276		tpm_dev_wq = NULL;
277	}
278}