1// SPDX-License-Identifier: GPL-2.0-only
  2/*
  3 * Copyright (C) 2004 IBM Corporation
  4 * Authors:
  5 * Leendert van Doorn <leendert@watson.ibm.com>
  6 * Dave Safford <safford@watson.ibm.com>
  7 * Reiner Sailer <sailer@watson.ibm.com>
  8 * Kylene Hall <kjhall@us.ibm.com>
  9 *
 10 * Copyright (C) 2013 Obsidian Research Corp
 11 * Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
 12 *
 13 * Device file system interface to the TPM
 14 */
 15#include <linux/poll.h>
 16#include <linux/slab.h>
 17#include <linux/uaccess.h>
 18#include <linux/workqueue.h>
 19#include "tpm.h"
 20#include "tpm-dev.h"
 21
 22static struct workqueue_struct *tpm_dev_wq;
 23static DEFINE_MUTEX(tpm_dev_wq_lock);
 24
 25static ssize_t tpm_dev_transmit(struct tpm_chip *chip, struct tpm_space *space,
 26				u8 *buf, size_t bufsiz)
 27{
 28	struct tpm_header *header = (void *)buf;
 29	ssize_t ret, len;
 30
 31	ret = tpm2_prepare_space(chip, space, buf, bufsiz);
 32	/* If the command is not implemented by the TPM, synthesize a
 33	 * response with a TPM2_RC_COMMAND_CODE return for user-space.
 34	 */
 35	if (ret == -EOPNOTSUPP) {
 36		header->length = cpu_to_be32(sizeof(*header));
 37		header->tag = cpu_to_be16(TPM2_ST_NO_SESSIONS);
 38		header->return_code = cpu_to_be32(TPM2_RC_COMMAND_CODE |
 39						  TSS2_RESMGR_TPM_RC_LAYER);
 40		ret = sizeof(*header);
 41	}
 42	if (ret)
 43		goto out_rc;
 44
 45	len = tpm_transmit(chip, buf, bufsiz);
 46	if (len < 0)
 47		ret = len;
 48
 49	if (!ret)
 50		ret = tpm2_commit_space(chip, space, buf, &len);
 51
 52out_rc:
 53	return ret ? ret : len;
 54}
 55
 56static void tpm_dev_async_work(struct work_struct *work)
 57{
 58	struct file_priv *priv =
 59			container_of(work, struct file_priv, async_work);
 60	ssize_t ret;
 61
 62	mutex_lock(&priv->buffer_mutex);
 63	priv->command_enqueued = false;
 64	ret = tpm_try_get_ops(priv->chip);
 65	if (ret) {
 66		priv->response_length = ret;
 67		goto out;
 68	}
 69
 70	ret = tpm_dev_transmit(priv->chip, priv->space, priv->data_buffer,
 71			       sizeof(priv->data_buffer));
 72	tpm_put_ops(priv->chip);
 73	if (ret > 0) {
 74		priv->response_length = ret;
 75		mod_timer(&priv->user_read_timer, jiffies + (120 * HZ));
 76	}
 77out:
 78	mutex_unlock(&priv->buffer_mutex);
 79	wake_up_interruptible(&priv->async_wait);
 80}
 81
 82static void user_reader_timeout(struct timer_list *t)
 83{
 84	struct file_priv *priv = from_timer(priv, t, user_read_timer);
 85
 86	pr_warn("TPM user space timeout is deprecated (pid=%d)\n",
 87		task_tgid_nr(current));
 88
 89	schedule_work(&priv->timeout_work);
 90}
 91
 92static void tpm_timeout_work(struct work_struct *work)
 93{
 94	struct file_priv *priv = container_of(work, struct file_priv,
 95					      timeout_work);
 96
 97	mutex_lock(&priv->buffer_mutex);
 98	priv->response_read = true;
 99	priv->response_length = 0;
100	memset(priv->data_buffer, 0, sizeof(priv->data_buffer));
101	mutex_unlock(&priv->buffer_mutex);
102	wake_up_interruptible(&priv->async_wait);
103}
104
105void tpm_common_open(struct file *file, struct tpm_chip *chip,
106		     struct file_priv *priv, struct tpm_space *space)
107{
108	priv->chip = chip;
109	priv->space = space;
110	priv->response_read = true;
111
112	mutex_init(&priv->buffer_mutex);
113	timer_setup(&priv->user_read_timer, user_reader_timeout, 0);
114	INIT_WORK(&priv->timeout_work, tpm_timeout_work);
115	INIT_WORK(&priv->async_work, tpm_dev_async_work);
116	init_waitqueue_head(&priv->async_wait);
117	file->private_data = priv;
118}
119
120ssize_t tpm_common_read(struct file *file, char __user *buf,
121			size_t size, loff_t *off)
122{
123	struct file_priv *priv = file->private_data;
124	ssize_t ret_size = 0;
125	int rc;
126
127	mutex_lock(&priv->buffer_mutex);
128
129	if (priv->response_length) {
130		priv->response_read = true;
131
132		ret_size = min_t(ssize_t, size, priv->response_length);
133		if (ret_size <= 0) {
134			priv->response_length = 0;
135			goto out;
136		}
137
138		rc = copy_to_user(buf, priv->data_buffer + *off, ret_size);
139		if (rc) {
140			memset(priv->data_buffer, 0, TPM_BUFSIZE);
141			priv->response_length = 0;
142			ret_size = -EFAULT;
143		} else {
144			memset(priv->data_buffer + *off, 0, ret_size);
145			priv->response_length -= ret_size;
146			*off += ret_size;
147		}
148	}
149
150out:
151	if (!priv->response_length) {
152		*off = 0;
153		del_singleshot_timer_sync(&priv->user_read_timer);
154		flush_work(&priv->timeout_work);
155	}
156	mutex_unlock(&priv->buffer_mutex);
157	return ret_size;
158}
159
160ssize_t tpm_common_write(struct file *file, const char __user *buf,
161			 size_t size, loff_t *off)
162{
163	struct file_priv *priv = file->private_data;
164	int ret = 0;
165
166	if (size > TPM_BUFSIZE)
167		return -E2BIG;
168
169	mutex_lock(&priv->buffer_mutex);
170
171	/* Cannot perform a write until the read has cleared either via
172	 * tpm_read or a user_read_timer timeout. This also prevents split
173	 * buffered writes from blocking here.
174	 */
175	if ((!priv->response_read && priv->response_length) ||
176	    priv->command_enqueued) {
177		ret = -EBUSY;
178		goto out;
179	}
180
181	if (copy_from_user(priv->data_buffer, buf, size)) {
182		ret = -EFAULT;
183		goto out;
184	}
185
186	if (size < 6 ||
187	    size < be32_to_cpu(*((__be32 *)(priv->data_buffer + 2)))) {
188		ret = -EINVAL;
189		goto out;
190	}
191
192	priv->response_length = 0;
193	priv->response_read = false;
194	*off = 0;
195
196	/*
197	 * If in nonblocking mode schedule an async job to send
198	 * the command return the size.
199	 * In case of error the err code will be returned in
200	 * the subsequent read call.
201	 */
202	if (file->f_flags & O_NONBLOCK) {
203		priv->command_enqueued = true;
204		queue_work(tpm_dev_wq, &priv->async_work);
205		mutex_unlock(&priv->buffer_mutex);
206		return size;
207	}
208
209	/* atomic tpm command send and result receive. We only hold the ops
210	 * lock during this period so that the tpm can be unregistered even if
211	 * the char dev is held open.
212	 */
213	if (tpm_try_get_ops(priv->chip)) {
214		ret = -EPIPE;
215		goto out;
216	}
217
218	ret = tpm_dev_transmit(priv->chip, priv->space, priv->data_buffer,
219			       sizeof(priv->data_buffer));
220	tpm_put_ops(priv->chip);
221
222	if (ret > 0) {
223		priv->response_length = ret;
224		mod_timer(&priv->user_read_timer, jiffies + (120 * HZ));
225		ret = size;
226	}
227out:
228	mutex_unlock(&priv->buffer_mutex);
229	return ret;
230}
231
232__poll_t tpm_common_poll(struct file *file, poll_table *wait)
233{
234	struct file_priv *priv = file->private_data;
235	__poll_t mask = 0;
236
237	poll_wait(file, &priv->async_wait, wait);
238	mutex_lock(&priv->buffer_mutex);
239
240	/*
241	 * The response_length indicates if there is still response
242	 * (or part of it) to be consumed. Partial reads decrease it
243	 * by the number of bytes read, and write resets it the zero.
244	 */
245	if (priv->response_length)
246		mask = EPOLLIN | EPOLLRDNORM;
247	else
248		mask = EPOLLOUT | EPOLLWRNORM;
249
250	mutex_unlock(&priv->buffer_mutex);
251	return mask;
252}
253
254/*
255 * Called on file close
256 */
257void tpm_common_release(struct file *file, struct file_priv *priv)
258{
259	flush_work(&priv->async_work);
260	del_singleshot_timer_sync(&priv->user_read_timer);
261	flush_work(&priv->timeout_work);
262	file->private_data = NULL;
263	priv->response_length = 0;
264}
265
266int __init tpm_dev_common_init(void)
267{
268	tpm_dev_wq = alloc_workqueue("tpm_dev_wq", WQ_MEM_RECLAIM, 0);
269
270	return !tpm_dev_wq ? -ENOMEM : 0;
271}
272
273void __exit tpm_dev_common_exit(void)
274{
275	if (tpm_dev_wq) {
276		destroy_workqueue(tpm_dev_wq);
277		tpm_dev_wq = NULL;
278	}
279}