Loading...
1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * Copyright (C) 2015, 2016 IBM Corporation
4 * Copyright (C) 2016 Intel Corporation
5 *
6 * Author: Stefan Berger <stefanb@us.ibm.com>
7 *
8 * Maintained by: <tpmdd-devel@lists.sourceforge.net>
9 *
10 * Device driver for vTPM (vTPM proxy driver)
11 */
12
13#include <linux/types.h>
14#include <linux/spinlock.h>
15#include <linux/uaccess.h>
16#include <linux/wait.h>
17#include <linux/miscdevice.h>
18#include <linux/vtpm_proxy.h>
19#include <linux/file.h>
20#include <linux/anon_inodes.h>
21#include <linux/poll.h>
22#include <linux/compat.h>
23
24#include "tpm.h"
25
26#define VTPM_PROXY_REQ_COMPLETE_FLAG BIT(0)
27
28struct proxy_dev {
29 struct tpm_chip *chip;
30
31 u32 flags; /* public API flags */
32
33 wait_queue_head_t wq;
34
35 struct mutex buf_lock; /* protect buffer and flags */
36
37 long state; /* internal state */
38#define STATE_OPENED_FLAG BIT(0)
39#define STATE_WAIT_RESPONSE_FLAG BIT(1) /* waiting for emulator response */
40#define STATE_REGISTERED_FLAG BIT(2)
41#define STATE_DRIVER_COMMAND BIT(3) /* sending a driver specific command */
42
43 size_t req_len; /* length of queued TPM request */
44 size_t resp_len; /* length of queued TPM response */
45 u8 buffer[TPM_BUFSIZE]; /* request/response buffer */
46
47 struct work_struct work; /* task that retrieves TPM timeouts */
48};
49
50/* all supported flags */
51#define VTPM_PROXY_FLAGS_ALL (VTPM_PROXY_FLAG_TPM2)
52
53static struct workqueue_struct *workqueue;
54
55static void vtpm_proxy_delete_device(struct proxy_dev *proxy_dev);
56
57/*
58 * Functions related to 'server side'
59 */
60
61/**
62 * vtpm_proxy_fops_read - Read TPM commands on 'server side'
63 *
64 * @filp: file pointer
65 * @buf: read buffer
66 * @count: number of bytes to read
67 * @off: offset
68 *
69 * Return:
70 * Number of bytes read or negative error code
71 */
72static ssize_t vtpm_proxy_fops_read(struct file *filp, char __user *buf,
73 size_t count, loff_t *off)
74{
75 struct proxy_dev *proxy_dev = filp->private_data;
76 size_t len;
77 int sig, rc;
78
79 sig = wait_event_interruptible(proxy_dev->wq,
80 proxy_dev->req_len != 0 ||
81 !(proxy_dev->state & STATE_OPENED_FLAG));
82 if (sig)
83 return -EINTR;
84
85 mutex_lock(&proxy_dev->buf_lock);
86
87 if (!(proxy_dev->state & STATE_OPENED_FLAG)) {
88 mutex_unlock(&proxy_dev->buf_lock);
89 return -EPIPE;
90 }
91
92 len = proxy_dev->req_len;
93
94 if (count < len || len > sizeof(proxy_dev->buffer)) {
95 mutex_unlock(&proxy_dev->buf_lock);
96 pr_debug("Invalid size in recv: count=%zd, req_len=%zd\n",
97 count, len);
98 return -EIO;
99 }
100
101 rc = copy_to_user(buf, proxy_dev->buffer, len);
102 memset(proxy_dev->buffer, 0, len);
103 proxy_dev->req_len = 0;
104
105 if (!rc)
106 proxy_dev->state |= STATE_WAIT_RESPONSE_FLAG;
107
108 mutex_unlock(&proxy_dev->buf_lock);
109
110 if (rc)
111 return -EFAULT;
112
113 return len;
114}
115
116/**
117 * vtpm_proxy_fops_write - Write TPM responses on 'server side'
118 *
119 * @filp: file pointer
120 * @buf: write buffer
121 * @count: number of bytes to write
122 * @off: offset
123 *
124 * Return:
125 * Number of bytes read or negative error value
126 */
127static ssize_t vtpm_proxy_fops_write(struct file *filp, const char __user *buf,
128 size_t count, loff_t *off)
129{
130 struct proxy_dev *proxy_dev = filp->private_data;
131
132 mutex_lock(&proxy_dev->buf_lock);
133
134 if (!(proxy_dev->state & STATE_OPENED_FLAG)) {
135 mutex_unlock(&proxy_dev->buf_lock);
136 return -EPIPE;
137 }
138
139 if (count > sizeof(proxy_dev->buffer) ||
140 !(proxy_dev->state & STATE_WAIT_RESPONSE_FLAG)) {
141 mutex_unlock(&proxy_dev->buf_lock);
142 return -EIO;
143 }
144
145 proxy_dev->state &= ~STATE_WAIT_RESPONSE_FLAG;
146
147 proxy_dev->req_len = 0;
148
149 if (copy_from_user(proxy_dev->buffer, buf, count)) {
150 mutex_unlock(&proxy_dev->buf_lock);
151 return -EFAULT;
152 }
153
154 proxy_dev->resp_len = count;
155
156 mutex_unlock(&proxy_dev->buf_lock);
157
158 wake_up_interruptible(&proxy_dev->wq);
159
160 return count;
161}
162
163/*
164 * vtpm_proxy_fops_poll - Poll status on 'server side'
165 *
166 * @filp: file pointer
167 * @wait: poll table
168 *
169 * Return: Poll flags
170 */
171static __poll_t vtpm_proxy_fops_poll(struct file *filp, poll_table *wait)
172{
173 struct proxy_dev *proxy_dev = filp->private_data;
174 __poll_t ret;
175
176 poll_wait(filp, &proxy_dev->wq, wait);
177
178 ret = EPOLLOUT;
179
180 mutex_lock(&proxy_dev->buf_lock);
181
182 if (proxy_dev->req_len)
183 ret |= EPOLLIN | EPOLLRDNORM;
184
185 if (!(proxy_dev->state & STATE_OPENED_FLAG))
186 ret |= EPOLLHUP;
187
188 mutex_unlock(&proxy_dev->buf_lock);
189
190 return ret;
191}
192
193/*
194 * vtpm_proxy_fops_open - Open vTPM device on 'server side'
195 *
196 * @filp: file pointer
197 *
198 * Called when setting up the anonymous file descriptor
199 */
200static void vtpm_proxy_fops_open(struct file *filp)
201{
202 struct proxy_dev *proxy_dev = filp->private_data;
203
204 proxy_dev->state |= STATE_OPENED_FLAG;
205}
206
207/**
208 * vtpm_proxy_fops_undo_open - counter-part to vtpm_fops_open
209 * Call to undo vtpm_proxy_fops_open
210 *
211 *@proxy_dev: tpm proxy device
212 */
213static void vtpm_proxy_fops_undo_open(struct proxy_dev *proxy_dev)
214{
215 mutex_lock(&proxy_dev->buf_lock);
216
217 proxy_dev->state &= ~STATE_OPENED_FLAG;
218
219 mutex_unlock(&proxy_dev->buf_lock);
220
221 /* no more TPM responses -- wake up anyone waiting for them */
222 wake_up_interruptible(&proxy_dev->wq);
223}
224
225/*
226 * vtpm_proxy_fops_release - Close 'server side'
227 *
228 * @inode: inode
229 * @filp: file pointer
230 * Return:
231 * Always returns 0.
232 */
233static int vtpm_proxy_fops_release(struct inode *inode, struct file *filp)
234{
235 struct proxy_dev *proxy_dev = filp->private_data;
236
237 filp->private_data = NULL;
238
239 vtpm_proxy_delete_device(proxy_dev);
240
241 return 0;
242}
243
244static const struct file_operations vtpm_proxy_fops = {
245 .owner = THIS_MODULE,
246 .llseek = no_llseek,
247 .read = vtpm_proxy_fops_read,
248 .write = vtpm_proxy_fops_write,
249 .poll = vtpm_proxy_fops_poll,
250 .release = vtpm_proxy_fops_release,
251};
252
253/*
254 * Functions invoked by the core TPM driver to send TPM commands to
255 * 'server side' and receive responses from there.
256 */
257
258/*
259 * Called when core TPM driver reads TPM responses from 'server side'
260 *
261 * @chip: tpm chip to use
262 * @buf: receive buffer
263 * @count: bytes to read
264 * Return:
265 * Number of TPM response bytes read, negative error value otherwise
266 */
267static int vtpm_proxy_tpm_op_recv(struct tpm_chip *chip, u8 *buf, size_t count)
268{
269 struct proxy_dev *proxy_dev = dev_get_drvdata(&chip->dev);
270 size_t len;
271
272 /* process gone ? */
273 mutex_lock(&proxy_dev->buf_lock);
274
275 if (!(proxy_dev->state & STATE_OPENED_FLAG)) {
276 mutex_unlock(&proxy_dev->buf_lock);
277 return -EPIPE;
278 }
279
280 len = proxy_dev->resp_len;
281 if (count < len) {
282 dev_err(&chip->dev,
283 "Invalid size in recv: count=%zd, resp_len=%zd\n",
284 count, len);
285 len = -EIO;
286 goto out;
287 }
288
289 memcpy(buf, proxy_dev->buffer, len);
290 proxy_dev->resp_len = 0;
291
292out:
293 mutex_unlock(&proxy_dev->buf_lock);
294
295 return len;
296}
297
298static int vtpm_proxy_is_driver_command(struct tpm_chip *chip,
299 u8 *buf, size_t count)
300{
301 struct tpm_header *hdr = (struct tpm_header *)buf;
302
303 if (count < sizeof(struct tpm_header))
304 return 0;
305
306 if (chip->flags & TPM_CHIP_FLAG_TPM2) {
307 switch (be32_to_cpu(hdr->ordinal)) {
308 case TPM2_CC_SET_LOCALITY:
309 return 1;
310 }
311 } else {
312 switch (be32_to_cpu(hdr->ordinal)) {
313 case TPM_ORD_SET_LOCALITY:
314 return 1;
315 }
316 }
317 return 0;
318}
319
320/*
321 * Called when core TPM driver forwards TPM requests to 'server side'.
322 *
323 * @chip: tpm chip to use
324 * @buf: send buffer
325 * @count: bytes to send
326 *
327 * Return:
328 * 0 in case of success, negative error value otherwise.
329 */
330static int vtpm_proxy_tpm_op_send(struct tpm_chip *chip, u8 *buf, size_t count)
331{
332 struct proxy_dev *proxy_dev = dev_get_drvdata(&chip->dev);
333
334 if (count > sizeof(proxy_dev->buffer)) {
335 dev_err(&chip->dev,
336 "Invalid size in send: count=%zd, buffer size=%zd\n",
337 count, sizeof(proxy_dev->buffer));
338 return -EIO;
339 }
340
341 if (!(proxy_dev->state & STATE_DRIVER_COMMAND) &&
342 vtpm_proxy_is_driver_command(chip, buf, count))
343 return -EFAULT;
344
345 mutex_lock(&proxy_dev->buf_lock);
346
347 if (!(proxy_dev->state & STATE_OPENED_FLAG)) {
348 mutex_unlock(&proxy_dev->buf_lock);
349 return -EPIPE;
350 }
351
352 proxy_dev->resp_len = 0;
353
354 proxy_dev->req_len = count;
355 memcpy(proxy_dev->buffer, buf, count);
356
357 proxy_dev->state &= ~STATE_WAIT_RESPONSE_FLAG;
358
359 mutex_unlock(&proxy_dev->buf_lock);
360
361 wake_up_interruptible(&proxy_dev->wq);
362
363 return 0;
364}
365
366static void vtpm_proxy_tpm_op_cancel(struct tpm_chip *chip)
367{
368 /* not supported */
369}
370
371static u8 vtpm_proxy_tpm_op_status(struct tpm_chip *chip)
372{
373 struct proxy_dev *proxy_dev = dev_get_drvdata(&chip->dev);
374
375 if (proxy_dev->resp_len)
376 return VTPM_PROXY_REQ_COMPLETE_FLAG;
377
378 return 0;
379}
380
381static bool vtpm_proxy_tpm_req_canceled(struct tpm_chip *chip, u8 status)
382{
383 struct proxy_dev *proxy_dev = dev_get_drvdata(&chip->dev);
384 bool ret;
385
386 mutex_lock(&proxy_dev->buf_lock);
387
388 ret = !(proxy_dev->state & STATE_OPENED_FLAG);
389
390 mutex_unlock(&proxy_dev->buf_lock);
391
392 return ret;
393}
394
395static int vtpm_proxy_request_locality(struct tpm_chip *chip, int locality)
396{
397 struct tpm_buf buf;
398 int rc;
399 const struct tpm_header *header;
400 struct proxy_dev *proxy_dev = dev_get_drvdata(&chip->dev);
401
402 if (chip->flags & TPM_CHIP_FLAG_TPM2)
403 rc = tpm_buf_init(&buf, TPM2_ST_SESSIONS,
404 TPM2_CC_SET_LOCALITY);
405 else
406 rc = tpm_buf_init(&buf, TPM_TAG_RQU_COMMAND,
407 TPM_ORD_SET_LOCALITY);
408 if (rc)
409 return rc;
410 tpm_buf_append_u8(&buf, locality);
411
412 proxy_dev->state |= STATE_DRIVER_COMMAND;
413
414 rc = tpm_transmit_cmd(chip, &buf, 0, "attempting to set locality");
415
416 proxy_dev->state &= ~STATE_DRIVER_COMMAND;
417
418 if (rc < 0) {
419 locality = rc;
420 goto out;
421 }
422
423 header = (const struct tpm_header *)buf.data;
424 rc = be32_to_cpu(header->return_code);
425 if (rc)
426 locality = -1;
427
428out:
429 tpm_buf_destroy(&buf);
430
431 return locality;
432}
433
434static const struct tpm_class_ops vtpm_proxy_tpm_ops = {
435 .flags = TPM_OPS_AUTO_STARTUP,
436 .recv = vtpm_proxy_tpm_op_recv,
437 .send = vtpm_proxy_tpm_op_send,
438 .cancel = vtpm_proxy_tpm_op_cancel,
439 .status = vtpm_proxy_tpm_op_status,
440 .req_complete_mask = VTPM_PROXY_REQ_COMPLETE_FLAG,
441 .req_complete_val = VTPM_PROXY_REQ_COMPLETE_FLAG,
442 .req_canceled = vtpm_proxy_tpm_req_canceled,
443 .request_locality = vtpm_proxy_request_locality,
444};
445
446/*
447 * Code related to the startup of the TPM 2 and startup of TPM 1.2 +
448 * retrieval of timeouts and durations.
449 */
450
451static void vtpm_proxy_work(struct work_struct *work)
452{
453 struct proxy_dev *proxy_dev = container_of(work, struct proxy_dev,
454 work);
455 int rc;
456
457 rc = tpm_chip_register(proxy_dev->chip);
458 if (rc)
459 vtpm_proxy_fops_undo_open(proxy_dev);
460 else
461 proxy_dev->state |= STATE_REGISTERED_FLAG;
462}
463
464/*
465 * vtpm_proxy_work_stop: make sure the work has finished
466 *
467 * This function is useful when user space closed the fd
468 * while the driver still determines timeouts.
469 */
470static void vtpm_proxy_work_stop(struct proxy_dev *proxy_dev)
471{
472 vtpm_proxy_fops_undo_open(proxy_dev);
473 flush_work(&proxy_dev->work);
474}
475
476/*
477 * vtpm_proxy_work_start: Schedule the work for TPM 1.2 & 2 initialization
478 */
479static inline void vtpm_proxy_work_start(struct proxy_dev *proxy_dev)
480{
481 queue_work(workqueue, &proxy_dev->work);
482}
483
484/*
485 * Code related to creation and deletion of device pairs
486 */
487static struct proxy_dev *vtpm_proxy_create_proxy_dev(void)
488{
489 struct proxy_dev *proxy_dev;
490 struct tpm_chip *chip;
491 int err;
492
493 proxy_dev = kzalloc(sizeof(*proxy_dev), GFP_KERNEL);
494 if (proxy_dev == NULL)
495 return ERR_PTR(-ENOMEM);
496
497 init_waitqueue_head(&proxy_dev->wq);
498 mutex_init(&proxy_dev->buf_lock);
499 INIT_WORK(&proxy_dev->work, vtpm_proxy_work);
500
501 chip = tpm_chip_alloc(NULL, &vtpm_proxy_tpm_ops);
502 if (IS_ERR(chip)) {
503 err = PTR_ERR(chip);
504 goto err_proxy_dev_free;
505 }
506 dev_set_drvdata(&chip->dev, proxy_dev);
507
508 proxy_dev->chip = chip;
509
510 return proxy_dev;
511
512err_proxy_dev_free:
513 kfree(proxy_dev);
514
515 return ERR_PTR(err);
516}
517
518/*
519 * Undo what has been done in vtpm_create_proxy_dev
520 */
521static inline void vtpm_proxy_delete_proxy_dev(struct proxy_dev *proxy_dev)
522{
523 put_device(&proxy_dev->chip->dev); /* frees chip */
524 kfree(proxy_dev);
525}
526
527/*
528 * Create a /dev/tpm%d and 'server side' file descriptor pair
529 *
530 * Return:
531 * Returns file pointer on success, an error value otherwise
532 */
533static struct file *vtpm_proxy_create_device(
534 struct vtpm_proxy_new_dev *vtpm_new_dev)
535{
536 struct proxy_dev *proxy_dev;
537 int rc, fd;
538 struct file *file;
539
540 if (vtpm_new_dev->flags & ~VTPM_PROXY_FLAGS_ALL)
541 return ERR_PTR(-EOPNOTSUPP);
542
543 proxy_dev = vtpm_proxy_create_proxy_dev();
544 if (IS_ERR(proxy_dev))
545 return ERR_CAST(proxy_dev);
546
547 proxy_dev->flags = vtpm_new_dev->flags;
548
549 /* setup an anonymous file for the server-side */
550 fd = get_unused_fd_flags(O_RDWR);
551 if (fd < 0) {
552 rc = fd;
553 goto err_delete_proxy_dev;
554 }
555
556 file = anon_inode_getfile("[vtpms]", &vtpm_proxy_fops, proxy_dev,
557 O_RDWR);
558 if (IS_ERR(file)) {
559 rc = PTR_ERR(file);
560 goto err_put_unused_fd;
561 }
562
563 /* from now on we can unwind with put_unused_fd() + fput() */
564 /* simulate an open() on the server side */
565 vtpm_proxy_fops_open(file);
566
567 if (proxy_dev->flags & VTPM_PROXY_FLAG_TPM2)
568 proxy_dev->chip->flags |= TPM_CHIP_FLAG_TPM2;
569
570 vtpm_proxy_work_start(proxy_dev);
571
572 vtpm_new_dev->fd = fd;
573 vtpm_new_dev->major = MAJOR(proxy_dev->chip->dev.devt);
574 vtpm_new_dev->minor = MINOR(proxy_dev->chip->dev.devt);
575 vtpm_new_dev->tpm_num = proxy_dev->chip->dev_num;
576
577 return file;
578
579err_put_unused_fd:
580 put_unused_fd(fd);
581
582err_delete_proxy_dev:
583 vtpm_proxy_delete_proxy_dev(proxy_dev);
584
585 return ERR_PTR(rc);
586}
587
588/*
589 * Counter part to vtpm_create_device.
590 */
591static void vtpm_proxy_delete_device(struct proxy_dev *proxy_dev)
592{
593 vtpm_proxy_work_stop(proxy_dev);
594
595 /*
596 * A client may hold the 'ops' lock, so let it know that the server
597 * side shuts down before we try to grab the 'ops' lock when
598 * unregistering the chip.
599 */
600 vtpm_proxy_fops_undo_open(proxy_dev);
601
602 if (proxy_dev->state & STATE_REGISTERED_FLAG)
603 tpm_chip_unregister(proxy_dev->chip);
604
605 vtpm_proxy_delete_proxy_dev(proxy_dev);
606}
607
608/*
609 * Code related to the control device /dev/vtpmx
610 */
611
612/**
613 * vtpmx_ioc_new_dev - handler for the %VTPM_PROXY_IOC_NEW_DEV ioctl
614 * @file: /dev/vtpmx
615 * @ioctl: the ioctl number
616 * @arg: pointer to the struct vtpmx_proxy_new_dev
617 *
618 * Creates an anonymous file that is used by the process acting as a TPM to
619 * communicate with the client processes. The function will also add a new TPM
620 * device through which data is proxied to this TPM acting process. The caller
621 * will be provided with a file descriptor to communicate with the clients and
622 * major and minor numbers for the TPM device.
623 */
624static long vtpmx_ioc_new_dev(struct file *file, unsigned int ioctl,
625 unsigned long arg)
626{
627 void __user *argp = (void __user *)arg;
628 struct vtpm_proxy_new_dev __user *vtpm_new_dev_p;
629 struct vtpm_proxy_new_dev vtpm_new_dev;
630 struct file *vtpm_file;
631
632 if (!capable(CAP_SYS_ADMIN))
633 return -EPERM;
634
635 vtpm_new_dev_p = argp;
636
637 if (copy_from_user(&vtpm_new_dev, vtpm_new_dev_p,
638 sizeof(vtpm_new_dev)))
639 return -EFAULT;
640
641 vtpm_file = vtpm_proxy_create_device(&vtpm_new_dev);
642 if (IS_ERR(vtpm_file))
643 return PTR_ERR(vtpm_file);
644
645 if (copy_to_user(vtpm_new_dev_p, &vtpm_new_dev,
646 sizeof(vtpm_new_dev))) {
647 put_unused_fd(vtpm_new_dev.fd);
648 fput(vtpm_file);
649 return -EFAULT;
650 }
651
652 fd_install(vtpm_new_dev.fd, vtpm_file);
653 return 0;
654}
655
656/*
657 * vtpmx_fops_ioctl: ioctl on /dev/vtpmx
658 *
659 * Return:
660 * Returns 0 on success, a negative error code otherwise.
661 */
662static long vtpmx_fops_ioctl(struct file *f, unsigned int ioctl,
663 unsigned long arg)
664{
665 switch (ioctl) {
666 case VTPM_PROXY_IOC_NEW_DEV:
667 return vtpmx_ioc_new_dev(f, ioctl, arg);
668 default:
669 return -ENOIOCTLCMD;
670 }
671}
672
673static const struct file_operations vtpmx_fops = {
674 .owner = THIS_MODULE,
675 .unlocked_ioctl = vtpmx_fops_ioctl,
676 .compat_ioctl = compat_ptr_ioctl,
677 .llseek = noop_llseek,
678};
679
680static struct miscdevice vtpmx_miscdev = {
681 .minor = MISC_DYNAMIC_MINOR,
682 .name = "vtpmx",
683 .fops = &vtpmx_fops,
684};
685
686static int __init vtpm_module_init(void)
687{
688 int rc;
689
690 workqueue = create_workqueue("tpm-vtpm");
691 if (!workqueue) {
692 pr_err("couldn't create workqueue\n");
693 return -ENOMEM;
694 }
695
696 rc = misc_register(&vtpmx_miscdev);
697 if (rc) {
698 pr_err("couldn't create vtpmx device\n");
699 destroy_workqueue(workqueue);
700 }
701
702 return rc;
703}
704
705static void __exit vtpm_module_exit(void)
706{
707 destroy_workqueue(workqueue);
708 misc_deregister(&vtpmx_miscdev);
709}
710
711module_init(vtpm_module_init);
712module_exit(vtpm_module_exit);
713
714MODULE_AUTHOR("Stefan Berger (stefanb@us.ibm.com)");
715MODULE_DESCRIPTION("vTPM Driver");
716MODULE_VERSION("0.1");
717MODULE_LICENSE("GPL");
1/*
2 * Copyright (C) 2015, 2016 IBM Corporation
3 * Copyright (C) 2016 Intel Corporation
4 *
5 * Author: Stefan Berger <stefanb@us.ibm.com>
6 *
7 * Maintained by: <tpmdd-devel@lists.sourceforge.net>
8 *
9 * Device driver for vTPM (vTPM proxy driver)
10 *
11 * This program is free software; you can redistribute it and/or
12 * modify it under the terms of the GNU General Public License as
13 * published by the Free Software Foundation, version 2 of the
14 * License.
15 *
16 */
17
18#include <linux/types.h>
19#include <linux/spinlock.h>
20#include <linux/uaccess.h>
21#include <linux/wait.h>
22#include <linux/miscdevice.h>
23#include <linux/vtpm_proxy.h>
24#include <linux/file.h>
25#include <linux/anon_inodes.h>
26#include <linux/poll.h>
27#include <linux/compat.h>
28
29#include "tpm.h"
30
31#define VTPM_PROXY_REQ_COMPLETE_FLAG BIT(0)
32
33struct proxy_dev {
34 struct tpm_chip *chip;
35
36 u32 flags; /* public API flags */
37
38 wait_queue_head_t wq;
39
40 struct mutex buf_lock; /* protect buffer and flags */
41
42 long state; /* internal state */
43#define STATE_OPENED_FLAG BIT(0)
44#define STATE_WAIT_RESPONSE_FLAG BIT(1) /* waiting for emulator response */
45#define STATE_REGISTERED_FLAG BIT(2)
46
47 size_t req_len; /* length of queued TPM request */
48 size_t resp_len; /* length of queued TPM response */
49 u8 buffer[TPM_BUFSIZE]; /* request/response buffer */
50
51 struct work_struct work; /* task that retrieves TPM timeouts */
52};
53
54/* all supported flags */
55#define VTPM_PROXY_FLAGS_ALL (VTPM_PROXY_FLAG_TPM2)
56
57static struct workqueue_struct *workqueue;
58
59static void vtpm_proxy_delete_device(struct proxy_dev *proxy_dev);
60
61/*
62 * Functions related to 'server side'
63 */
64
65/**
66 * vtpm_proxy_fops_read - Read TPM commands on 'server side'
67 *
68 * Return value:
69 * Number of bytes read or negative error code
70 */
71static ssize_t vtpm_proxy_fops_read(struct file *filp, char __user *buf,
72 size_t count, loff_t *off)
73{
74 struct proxy_dev *proxy_dev = filp->private_data;
75 size_t len;
76 int sig, rc;
77
78 sig = wait_event_interruptible(proxy_dev->wq,
79 proxy_dev->req_len != 0 ||
80 !(proxy_dev->state & STATE_OPENED_FLAG));
81 if (sig)
82 return -EINTR;
83
84 mutex_lock(&proxy_dev->buf_lock);
85
86 if (!(proxy_dev->state & STATE_OPENED_FLAG)) {
87 mutex_unlock(&proxy_dev->buf_lock);
88 return -EPIPE;
89 }
90
91 len = proxy_dev->req_len;
92
93 if (count < len) {
94 mutex_unlock(&proxy_dev->buf_lock);
95 pr_debug("Invalid size in recv: count=%zd, req_len=%zd\n",
96 count, len);
97 return -EIO;
98 }
99
100 rc = copy_to_user(buf, proxy_dev->buffer, len);
101 memset(proxy_dev->buffer, 0, len);
102 proxy_dev->req_len = 0;
103
104 if (!rc)
105 proxy_dev->state |= STATE_WAIT_RESPONSE_FLAG;
106
107 mutex_unlock(&proxy_dev->buf_lock);
108
109 if (rc)
110 return -EFAULT;
111
112 return len;
113}
114
115/**
116 * vtpm_proxy_fops_write - Write TPM responses on 'server side'
117 *
118 * Return value:
119 * Number of bytes read or negative error value
120 */
121static ssize_t vtpm_proxy_fops_write(struct file *filp, const char __user *buf,
122 size_t count, loff_t *off)
123{
124 struct proxy_dev *proxy_dev = filp->private_data;
125
126 mutex_lock(&proxy_dev->buf_lock);
127
128 if (!(proxy_dev->state & STATE_OPENED_FLAG)) {
129 mutex_unlock(&proxy_dev->buf_lock);
130 return -EPIPE;
131 }
132
133 if (count > sizeof(proxy_dev->buffer) ||
134 !(proxy_dev->state & STATE_WAIT_RESPONSE_FLAG)) {
135 mutex_unlock(&proxy_dev->buf_lock);
136 return -EIO;
137 }
138
139 proxy_dev->state &= ~STATE_WAIT_RESPONSE_FLAG;
140
141 proxy_dev->req_len = 0;
142
143 if (copy_from_user(proxy_dev->buffer, buf, count)) {
144 mutex_unlock(&proxy_dev->buf_lock);
145 return -EFAULT;
146 }
147
148 proxy_dev->resp_len = count;
149
150 mutex_unlock(&proxy_dev->buf_lock);
151
152 wake_up_interruptible(&proxy_dev->wq);
153
154 return count;
155}
156
157/*
158 * vtpm_proxy_fops_poll: Poll status on 'server side'
159 *
160 * Return value:
161 * Poll flags
162 */
163static unsigned int vtpm_proxy_fops_poll(struct file *filp, poll_table *wait)
164{
165 struct proxy_dev *proxy_dev = filp->private_data;
166 unsigned ret;
167
168 poll_wait(filp, &proxy_dev->wq, wait);
169
170 ret = POLLOUT;
171
172 mutex_lock(&proxy_dev->buf_lock);
173
174 if (proxy_dev->req_len)
175 ret |= POLLIN | POLLRDNORM;
176
177 if (!(proxy_dev->state & STATE_OPENED_FLAG))
178 ret |= POLLHUP;
179
180 mutex_unlock(&proxy_dev->buf_lock);
181
182 return ret;
183}
184
185/*
186 * vtpm_proxy_fops_open - Open vTPM device on 'server side'
187 *
188 * Called when setting up the anonymous file descriptor
189 */
190static void vtpm_proxy_fops_open(struct file *filp)
191{
192 struct proxy_dev *proxy_dev = filp->private_data;
193
194 proxy_dev->state |= STATE_OPENED_FLAG;
195}
196
197/**
198 * vtpm_proxy_fops_undo_open - counter-part to vtpm_fops_open
199 *
200 * Call to undo vtpm_proxy_fops_open
201 */
202static void vtpm_proxy_fops_undo_open(struct proxy_dev *proxy_dev)
203{
204 mutex_lock(&proxy_dev->buf_lock);
205
206 proxy_dev->state &= ~STATE_OPENED_FLAG;
207
208 mutex_unlock(&proxy_dev->buf_lock);
209
210 /* no more TPM responses -- wake up anyone waiting for them */
211 wake_up_interruptible(&proxy_dev->wq);
212}
213
214/*
215 * vtpm_proxy_fops_release: Close 'server side'
216 *
217 * Return value:
218 * Always returns 0.
219 */
220static int vtpm_proxy_fops_release(struct inode *inode, struct file *filp)
221{
222 struct proxy_dev *proxy_dev = filp->private_data;
223
224 filp->private_data = NULL;
225
226 vtpm_proxy_delete_device(proxy_dev);
227
228 return 0;
229}
230
231static const struct file_operations vtpm_proxy_fops = {
232 .owner = THIS_MODULE,
233 .llseek = no_llseek,
234 .read = vtpm_proxy_fops_read,
235 .write = vtpm_proxy_fops_write,
236 .poll = vtpm_proxy_fops_poll,
237 .release = vtpm_proxy_fops_release,
238};
239
240/*
241 * Functions invoked by the core TPM driver to send TPM commands to
242 * 'server side' and receive responses from there.
243 */
244
245/*
246 * Called when core TPM driver reads TPM responses from 'server side'
247 *
248 * Return value:
249 * Number of TPM response bytes read, negative error value otherwise
250 */
251static int vtpm_proxy_tpm_op_recv(struct tpm_chip *chip, u8 *buf, size_t count)
252{
253 struct proxy_dev *proxy_dev = dev_get_drvdata(&chip->dev);
254 size_t len;
255
256 /* process gone ? */
257 mutex_lock(&proxy_dev->buf_lock);
258
259 if (!(proxy_dev->state & STATE_OPENED_FLAG)) {
260 mutex_unlock(&proxy_dev->buf_lock);
261 return -EPIPE;
262 }
263
264 len = proxy_dev->resp_len;
265 if (count < len) {
266 dev_err(&chip->dev,
267 "Invalid size in recv: count=%zd, resp_len=%zd\n",
268 count, len);
269 len = -EIO;
270 goto out;
271 }
272
273 memcpy(buf, proxy_dev->buffer, len);
274 proxy_dev->resp_len = 0;
275
276out:
277 mutex_unlock(&proxy_dev->buf_lock);
278
279 return len;
280}
281
282/*
283 * Called when core TPM driver forwards TPM requests to 'server side'.
284 *
285 * Return value:
286 * 0 in case of success, negative error value otherwise.
287 */
288static int vtpm_proxy_tpm_op_send(struct tpm_chip *chip, u8 *buf, size_t count)
289{
290 struct proxy_dev *proxy_dev = dev_get_drvdata(&chip->dev);
291 int rc = 0;
292
293 if (count > sizeof(proxy_dev->buffer)) {
294 dev_err(&chip->dev,
295 "Invalid size in send: count=%zd, buffer size=%zd\n",
296 count, sizeof(proxy_dev->buffer));
297 return -EIO;
298 }
299
300 mutex_lock(&proxy_dev->buf_lock);
301
302 if (!(proxy_dev->state & STATE_OPENED_FLAG)) {
303 mutex_unlock(&proxy_dev->buf_lock);
304 return -EPIPE;
305 }
306
307 proxy_dev->resp_len = 0;
308
309 proxy_dev->req_len = count;
310 memcpy(proxy_dev->buffer, buf, count);
311
312 proxy_dev->state &= ~STATE_WAIT_RESPONSE_FLAG;
313
314 mutex_unlock(&proxy_dev->buf_lock);
315
316 wake_up_interruptible(&proxy_dev->wq);
317
318 return rc;
319}
320
321static void vtpm_proxy_tpm_op_cancel(struct tpm_chip *chip)
322{
323 /* not supported */
324}
325
326static u8 vtpm_proxy_tpm_op_status(struct tpm_chip *chip)
327{
328 struct proxy_dev *proxy_dev = dev_get_drvdata(&chip->dev);
329
330 if (proxy_dev->resp_len)
331 return VTPM_PROXY_REQ_COMPLETE_FLAG;
332
333 return 0;
334}
335
336static bool vtpm_proxy_tpm_req_canceled(struct tpm_chip *chip, u8 status)
337{
338 struct proxy_dev *proxy_dev = dev_get_drvdata(&chip->dev);
339 bool ret;
340
341 mutex_lock(&proxy_dev->buf_lock);
342
343 ret = !(proxy_dev->state & STATE_OPENED_FLAG);
344
345 mutex_unlock(&proxy_dev->buf_lock);
346
347 return ret;
348}
349
350static const struct tpm_class_ops vtpm_proxy_tpm_ops = {
351 .flags = TPM_OPS_AUTO_STARTUP,
352 .recv = vtpm_proxy_tpm_op_recv,
353 .send = vtpm_proxy_tpm_op_send,
354 .cancel = vtpm_proxy_tpm_op_cancel,
355 .status = vtpm_proxy_tpm_op_status,
356 .req_complete_mask = VTPM_PROXY_REQ_COMPLETE_FLAG,
357 .req_complete_val = VTPM_PROXY_REQ_COMPLETE_FLAG,
358 .req_canceled = vtpm_proxy_tpm_req_canceled,
359};
360
361/*
362 * Code related to the startup of the TPM 2 and startup of TPM 1.2 +
363 * retrieval of timeouts and durations.
364 */
365
366static void vtpm_proxy_work(struct work_struct *work)
367{
368 struct proxy_dev *proxy_dev = container_of(work, struct proxy_dev,
369 work);
370 int rc;
371
372 rc = tpm_chip_register(proxy_dev->chip);
373 if (rc)
374 vtpm_proxy_fops_undo_open(proxy_dev);
375 else
376 proxy_dev->state |= STATE_REGISTERED_FLAG;
377}
378
379/*
380 * vtpm_proxy_work_stop: make sure the work has finished
381 *
382 * This function is useful when user space closed the fd
383 * while the driver still determines timeouts.
384 */
385static void vtpm_proxy_work_stop(struct proxy_dev *proxy_dev)
386{
387 vtpm_proxy_fops_undo_open(proxy_dev);
388 flush_work(&proxy_dev->work);
389}
390
391/*
392 * vtpm_proxy_work_start: Schedule the work for TPM 1.2 & 2 initialization
393 */
394static inline void vtpm_proxy_work_start(struct proxy_dev *proxy_dev)
395{
396 queue_work(workqueue, &proxy_dev->work);
397}
398
399/*
400 * Code related to creation and deletion of device pairs
401 */
402static struct proxy_dev *vtpm_proxy_create_proxy_dev(void)
403{
404 struct proxy_dev *proxy_dev;
405 struct tpm_chip *chip;
406 int err;
407
408 proxy_dev = kzalloc(sizeof(*proxy_dev), GFP_KERNEL);
409 if (proxy_dev == NULL)
410 return ERR_PTR(-ENOMEM);
411
412 init_waitqueue_head(&proxy_dev->wq);
413 mutex_init(&proxy_dev->buf_lock);
414 INIT_WORK(&proxy_dev->work, vtpm_proxy_work);
415
416 chip = tpm_chip_alloc(NULL, &vtpm_proxy_tpm_ops);
417 if (IS_ERR(chip)) {
418 err = PTR_ERR(chip);
419 goto err_proxy_dev_free;
420 }
421 dev_set_drvdata(&chip->dev, proxy_dev);
422
423 proxy_dev->chip = chip;
424
425 return proxy_dev;
426
427err_proxy_dev_free:
428 kfree(proxy_dev);
429
430 return ERR_PTR(err);
431}
432
433/*
434 * Undo what has been done in vtpm_create_proxy_dev
435 */
436static inline void vtpm_proxy_delete_proxy_dev(struct proxy_dev *proxy_dev)
437{
438 put_device(&proxy_dev->chip->dev); /* frees chip */
439 kfree(proxy_dev);
440}
441
442/*
443 * Create a /dev/tpm%d and 'server side' file descriptor pair
444 *
445 * Return value:
446 * Returns file pointer on success, an error value otherwise
447 */
448static struct file *vtpm_proxy_create_device(
449 struct vtpm_proxy_new_dev *vtpm_new_dev)
450{
451 struct proxy_dev *proxy_dev;
452 int rc, fd;
453 struct file *file;
454
455 if (vtpm_new_dev->flags & ~VTPM_PROXY_FLAGS_ALL)
456 return ERR_PTR(-EOPNOTSUPP);
457
458 proxy_dev = vtpm_proxy_create_proxy_dev();
459 if (IS_ERR(proxy_dev))
460 return ERR_CAST(proxy_dev);
461
462 proxy_dev->flags = vtpm_new_dev->flags;
463
464 /* setup an anonymous file for the server-side */
465 fd = get_unused_fd_flags(O_RDWR);
466 if (fd < 0) {
467 rc = fd;
468 goto err_delete_proxy_dev;
469 }
470
471 file = anon_inode_getfile("[vtpms]", &vtpm_proxy_fops, proxy_dev,
472 O_RDWR);
473 if (IS_ERR(file)) {
474 rc = PTR_ERR(file);
475 goto err_put_unused_fd;
476 }
477
478 /* from now on we can unwind with put_unused_fd() + fput() */
479 /* simulate an open() on the server side */
480 vtpm_proxy_fops_open(file);
481
482 if (proxy_dev->flags & VTPM_PROXY_FLAG_TPM2)
483 proxy_dev->chip->flags |= TPM_CHIP_FLAG_TPM2;
484
485 vtpm_proxy_work_start(proxy_dev);
486
487 vtpm_new_dev->fd = fd;
488 vtpm_new_dev->major = MAJOR(proxy_dev->chip->dev.devt);
489 vtpm_new_dev->minor = MINOR(proxy_dev->chip->dev.devt);
490 vtpm_new_dev->tpm_num = proxy_dev->chip->dev_num;
491
492 return file;
493
494err_put_unused_fd:
495 put_unused_fd(fd);
496
497err_delete_proxy_dev:
498 vtpm_proxy_delete_proxy_dev(proxy_dev);
499
500 return ERR_PTR(rc);
501}
502
503/*
504 * Counter part to vtpm_create_device.
505 */
506static void vtpm_proxy_delete_device(struct proxy_dev *proxy_dev)
507{
508 vtpm_proxy_work_stop(proxy_dev);
509
510 /*
511 * A client may hold the 'ops' lock, so let it know that the server
512 * side shuts down before we try to grab the 'ops' lock when
513 * unregistering the chip.
514 */
515 vtpm_proxy_fops_undo_open(proxy_dev);
516
517 if (proxy_dev->state & STATE_REGISTERED_FLAG)
518 tpm_chip_unregister(proxy_dev->chip);
519
520 vtpm_proxy_delete_proxy_dev(proxy_dev);
521}
522
523/*
524 * Code related to the control device /dev/vtpmx
525 */
526
527/**
528 * vtpmx_ioc_new_dev - handler for the %VTPM_PROXY_IOC_NEW_DEV ioctl
529 * @file: /dev/vtpmx
530 * @ioctl: the ioctl number
531 * @arg: pointer to the struct vtpmx_proxy_new_dev
532 *
533 * Creates an anonymous file that is used by the process acting as a TPM to
534 * communicate with the client processes. The function will also add a new TPM
535 * device through which data is proxied to this TPM acting process. The caller
536 * will be provided with a file descriptor to communicate with the clients and
537 * major and minor numbers for the TPM device.
538 */
539static long vtpmx_ioc_new_dev(struct file *file, unsigned int ioctl,
540 unsigned long arg)
541{
542 void __user *argp = (void __user *)arg;
543 struct vtpm_proxy_new_dev __user *vtpm_new_dev_p;
544 struct vtpm_proxy_new_dev vtpm_new_dev;
545 struct file *vtpm_file;
546
547 if (!capable(CAP_SYS_ADMIN))
548 return -EPERM;
549
550 vtpm_new_dev_p = argp;
551
552 if (copy_from_user(&vtpm_new_dev, vtpm_new_dev_p,
553 sizeof(vtpm_new_dev)))
554 return -EFAULT;
555
556 vtpm_file = vtpm_proxy_create_device(&vtpm_new_dev);
557 if (IS_ERR(vtpm_file))
558 return PTR_ERR(vtpm_file);
559
560 if (copy_to_user(vtpm_new_dev_p, &vtpm_new_dev,
561 sizeof(vtpm_new_dev))) {
562 put_unused_fd(vtpm_new_dev.fd);
563 fput(vtpm_file);
564 return -EFAULT;
565 }
566
567 fd_install(vtpm_new_dev.fd, vtpm_file);
568 return 0;
569}
570
571/*
572 * vtpmx_fops_ioctl: ioctl on /dev/vtpmx
573 *
574 * Return value:
575 * Returns 0 on success, a negative error code otherwise.
576 */
577static long vtpmx_fops_ioctl(struct file *f, unsigned int ioctl,
578 unsigned long arg)
579{
580 switch (ioctl) {
581 case VTPM_PROXY_IOC_NEW_DEV:
582 return vtpmx_ioc_new_dev(f, ioctl, arg);
583 default:
584 return -ENOIOCTLCMD;
585 }
586}
587
588#ifdef CONFIG_COMPAT
589static long vtpmx_fops_compat_ioctl(struct file *f, unsigned int ioctl,
590 unsigned long arg)
591{
592 return vtpmx_fops_ioctl(f, ioctl, (unsigned long)compat_ptr(arg));
593}
594#endif
595
596static const struct file_operations vtpmx_fops = {
597 .owner = THIS_MODULE,
598 .unlocked_ioctl = vtpmx_fops_ioctl,
599#ifdef CONFIG_COMPAT
600 .compat_ioctl = vtpmx_fops_compat_ioctl,
601#endif
602 .llseek = noop_llseek,
603};
604
605static struct miscdevice vtpmx_miscdev = {
606 .minor = MISC_DYNAMIC_MINOR,
607 .name = "vtpmx",
608 .fops = &vtpmx_fops,
609};
610
611static int vtpmx_init(void)
612{
613 return misc_register(&vtpmx_miscdev);
614}
615
616static void vtpmx_cleanup(void)
617{
618 misc_deregister(&vtpmx_miscdev);
619}
620
621static int __init vtpm_module_init(void)
622{
623 int rc;
624
625 rc = vtpmx_init();
626 if (rc) {
627 pr_err("couldn't create vtpmx device\n");
628 return rc;
629 }
630
631 workqueue = create_workqueue("tpm-vtpm");
632 if (!workqueue) {
633 pr_err("couldn't create workqueue\n");
634 rc = -ENOMEM;
635 goto err_vtpmx_cleanup;
636 }
637
638 return 0;
639
640err_vtpmx_cleanup:
641 vtpmx_cleanup();
642
643 return rc;
644}
645
646static void __exit vtpm_module_exit(void)
647{
648 destroy_workqueue(workqueue);
649 vtpmx_cleanup();
650}
651
652module_init(vtpm_module_init);
653module_exit(vtpm_module_exit);
654
655MODULE_AUTHOR("Stefan Berger (stefanb@us.ibm.com)");
656MODULE_DESCRIPTION("vTPM Driver");
657MODULE_VERSION("0.1");
658MODULE_LICENSE("GPL");