Loading...
1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * Copyright (C) 2004 IBM Corporation
4 * Authors:
5 * Leendert van Doorn <leendert@watson.ibm.com>
6 * Dave Safford <safford@watson.ibm.com>
7 * Reiner Sailer <sailer@watson.ibm.com>
8 * Kylene Hall <kjhall@us.ibm.com>
9 *
10 * Copyright (C) 2013 Obsidian Research Corp
11 * Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
12 *
13 * Device file system interface to the TPM
14 */
15#include <linux/poll.h>
16#include <linux/slab.h>
17#include <linux/uaccess.h>
18#include <linux/workqueue.h>
19#include "tpm.h"
20#include "tpm-dev.h"
21
22static struct workqueue_struct *tpm_dev_wq;
23
24static ssize_t tpm_dev_transmit(struct tpm_chip *chip, struct tpm_space *space,
25 u8 *buf, size_t bufsiz)
26{
27 struct tpm_header *header = (void *)buf;
28 ssize_t ret, len;
29
30 ret = tpm2_prepare_space(chip, space, buf, bufsiz);
31 /* If the command is not implemented by the TPM, synthesize a
32 * response with a TPM2_RC_COMMAND_CODE return for user-space.
33 */
34 if (ret == -EOPNOTSUPP) {
35 header->length = cpu_to_be32(sizeof(*header));
36 header->tag = cpu_to_be16(TPM2_ST_NO_SESSIONS);
37 header->return_code = cpu_to_be32(TPM2_RC_COMMAND_CODE |
38 TSS2_RESMGR_TPM_RC_LAYER);
39 ret = sizeof(*header);
40 }
41 if (ret)
42 goto out_rc;
43
44 len = tpm_transmit(chip, buf, bufsiz);
45 if (len < 0)
46 ret = len;
47
48 if (!ret)
49 ret = tpm2_commit_space(chip, space, buf, &len);
50
51out_rc:
52 return ret ? ret : len;
53}
54
55static void tpm_dev_async_work(struct work_struct *work)
56{
57 struct file_priv *priv =
58 container_of(work, struct file_priv, async_work);
59 ssize_t ret;
60
61 mutex_lock(&priv->buffer_mutex);
62 priv->command_enqueued = false;
63 ret = tpm_try_get_ops(priv->chip);
64 if (ret) {
65 priv->response_length = ret;
66 goto out;
67 }
68
69 ret = tpm_dev_transmit(priv->chip, priv->space, priv->data_buffer,
70 sizeof(priv->data_buffer));
71 tpm_put_ops(priv->chip);
72
73 /*
74 * If ret is > 0 then tpm_dev_transmit returned the size of the
75 * response. If ret is < 0 then tpm_dev_transmit failed and
76 * returned an error code.
77 */
78 if (ret != 0) {
79 priv->response_length = ret;
80 mod_timer(&priv->user_read_timer, jiffies + (120 * HZ));
81 }
82out:
83 mutex_unlock(&priv->buffer_mutex);
84 wake_up_interruptible(&priv->async_wait);
85}
86
87static void user_reader_timeout(struct timer_list *t)
88{
89 struct file_priv *priv = from_timer(priv, t, user_read_timer);
90
91 pr_warn("TPM user space timeout is deprecated (pid=%d)\n",
92 task_tgid_nr(current));
93
94 schedule_work(&priv->timeout_work);
95}
96
97static void tpm_timeout_work(struct work_struct *work)
98{
99 struct file_priv *priv = container_of(work, struct file_priv,
100 timeout_work);
101
102 mutex_lock(&priv->buffer_mutex);
103 priv->response_read = true;
104 priv->response_length = 0;
105 memset(priv->data_buffer, 0, sizeof(priv->data_buffer));
106 mutex_unlock(&priv->buffer_mutex);
107 wake_up_interruptible(&priv->async_wait);
108}
109
110void tpm_common_open(struct file *file, struct tpm_chip *chip,
111 struct file_priv *priv, struct tpm_space *space)
112{
113 priv->chip = chip;
114 priv->space = space;
115 priv->response_read = true;
116
117 mutex_init(&priv->buffer_mutex);
118 timer_setup(&priv->user_read_timer, user_reader_timeout, 0);
119 INIT_WORK(&priv->timeout_work, tpm_timeout_work);
120 INIT_WORK(&priv->async_work, tpm_dev_async_work);
121 init_waitqueue_head(&priv->async_wait);
122 file->private_data = priv;
123}
124
125ssize_t tpm_common_read(struct file *file, char __user *buf,
126 size_t size, loff_t *off)
127{
128 struct file_priv *priv = file->private_data;
129 ssize_t ret_size = 0;
130 int rc;
131
132 mutex_lock(&priv->buffer_mutex);
133
134 if (priv->response_length) {
135 priv->response_read = true;
136
137 ret_size = min_t(ssize_t, size, priv->response_length);
138 if (ret_size <= 0) {
139 priv->response_length = 0;
140 goto out;
141 }
142
143 rc = copy_to_user(buf, priv->data_buffer + *off, ret_size);
144 if (rc) {
145 memset(priv->data_buffer, 0, TPM_BUFSIZE);
146 priv->response_length = 0;
147 ret_size = -EFAULT;
148 } else {
149 memset(priv->data_buffer + *off, 0, ret_size);
150 priv->response_length -= ret_size;
151 *off += ret_size;
152 }
153 }
154
155out:
156 if (!priv->response_length) {
157 *off = 0;
158 del_timer_sync(&priv->user_read_timer);
159 flush_work(&priv->timeout_work);
160 }
161 mutex_unlock(&priv->buffer_mutex);
162 return ret_size;
163}
164
165ssize_t tpm_common_write(struct file *file, const char __user *buf,
166 size_t size, loff_t *off)
167{
168 struct file_priv *priv = file->private_data;
169 int ret = 0;
170
171 if (size > TPM_BUFSIZE)
172 return -E2BIG;
173
174 mutex_lock(&priv->buffer_mutex);
175
176 /* Cannot perform a write until the read has cleared either via
177 * tpm_read or a user_read_timer timeout. This also prevents split
178 * buffered writes from blocking here.
179 */
180 if ((!priv->response_read && priv->response_length) ||
181 priv->command_enqueued) {
182 ret = -EBUSY;
183 goto out;
184 }
185
186 if (copy_from_user(priv->data_buffer, buf, size)) {
187 ret = -EFAULT;
188 goto out;
189 }
190
191 if (size < 6 ||
192 size < be32_to_cpu(*((__be32 *)(priv->data_buffer + 2)))) {
193 ret = -EINVAL;
194 goto out;
195 }
196
197 priv->response_length = 0;
198 priv->response_read = false;
199 *off = 0;
200
201 /*
202 * If in nonblocking mode schedule an async job to send
203 * the command return the size.
204 * In case of error the err code will be returned in
205 * the subsequent read call.
206 */
207 if (file->f_flags & O_NONBLOCK) {
208 priv->command_enqueued = true;
209 queue_work(tpm_dev_wq, &priv->async_work);
210 mutex_unlock(&priv->buffer_mutex);
211 return size;
212 }
213
214 /* atomic tpm command send and result receive. We only hold the ops
215 * lock during this period so that the tpm can be unregistered even if
216 * the char dev is held open.
217 */
218 if (tpm_try_get_ops(priv->chip)) {
219 ret = -EPIPE;
220 goto out;
221 }
222
223 ret = tpm_dev_transmit(priv->chip, priv->space, priv->data_buffer,
224 sizeof(priv->data_buffer));
225 tpm_put_ops(priv->chip);
226
227 if (ret > 0) {
228 priv->response_length = ret;
229 mod_timer(&priv->user_read_timer, jiffies + (120 * HZ));
230 ret = size;
231 }
232out:
233 mutex_unlock(&priv->buffer_mutex);
234 return ret;
235}
236
237__poll_t tpm_common_poll(struct file *file, poll_table *wait)
238{
239 struct file_priv *priv = file->private_data;
240 __poll_t mask = 0;
241
242 poll_wait(file, &priv->async_wait, wait);
243 mutex_lock(&priv->buffer_mutex);
244
245 /*
246 * The response_length indicates if there is still response
247 * (or part of it) to be consumed. Partial reads decrease it
248 * by the number of bytes read, and write resets it the zero.
249 */
250 if (priv->response_length)
251 mask = EPOLLIN | EPOLLRDNORM;
252 else
253 mask = EPOLLOUT | EPOLLWRNORM;
254
255 mutex_unlock(&priv->buffer_mutex);
256 return mask;
257}
258
259/*
260 * Called on file close
261 */
262void tpm_common_release(struct file *file, struct file_priv *priv)
263{
264 flush_work(&priv->async_work);
265 del_timer_sync(&priv->user_read_timer);
266 flush_work(&priv->timeout_work);
267 file->private_data = NULL;
268 priv->response_length = 0;
269}
270
271int __init tpm_dev_common_init(void)
272{
273 tpm_dev_wq = alloc_workqueue("tpm_dev_wq", WQ_MEM_RECLAIM, 0);
274
275 return !tpm_dev_wq ? -ENOMEM : 0;
276}
277
278void __exit tpm_dev_common_exit(void)
279{
280 if (tpm_dev_wq) {
281 destroy_workqueue(tpm_dev_wq);
282 tpm_dev_wq = NULL;
283 }
284}
1/*
2 * Copyright (C) 2004 IBM Corporation
3 * Authors:
4 * Leendert van Doorn <leendert@watson.ibm.com>
5 * Dave Safford <safford@watson.ibm.com>
6 * Reiner Sailer <sailer@watson.ibm.com>
7 * Kylene Hall <kjhall@us.ibm.com>
8 *
9 * Copyright (C) 2013 Obsidian Research Corp
10 * Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
11 *
12 * Device file system interface to the TPM
13 *
14 * This program is free software; you can redistribute it and/or
15 * modify it under the terms of the GNU General Public License as
16 * published by the Free Software Foundation, version 2 of the
17 * License.
18 *
19 */
20#include <linux/slab.h>
21#include <linux/uaccess.h>
22#include "tpm.h"
23#include "tpm-dev.h"
24
25static void user_reader_timeout(struct timer_list *t)
26{
27 struct file_priv *priv = from_timer(priv, t, user_read_timer);
28
29 pr_warn("TPM user space timeout is deprecated (pid=%d)\n",
30 task_tgid_nr(current));
31
32 schedule_work(&priv->work);
33}
34
35static void timeout_work(struct work_struct *work)
36{
37 struct file_priv *priv = container_of(work, struct file_priv, work);
38
39 mutex_lock(&priv->buffer_mutex);
40 atomic_set(&priv->data_pending, 0);
41 memset(priv->data_buffer, 0, sizeof(priv->data_buffer));
42 mutex_unlock(&priv->buffer_mutex);
43}
44
45void tpm_common_open(struct file *file, struct tpm_chip *chip,
46 struct file_priv *priv)
47{
48 priv->chip = chip;
49 atomic_set(&priv->data_pending, 0);
50 mutex_init(&priv->buffer_mutex);
51 timer_setup(&priv->user_read_timer, user_reader_timeout, 0);
52 INIT_WORK(&priv->work, timeout_work);
53
54 file->private_data = priv;
55}
56
57ssize_t tpm_common_read(struct file *file, char __user *buf,
58 size_t size, loff_t *off)
59{
60 struct file_priv *priv = file->private_data;
61 ssize_t ret_size;
62 ssize_t orig_ret_size;
63 int rc;
64
65 del_singleshot_timer_sync(&priv->user_read_timer);
66 flush_work(&priv->work);
67 ret_size = atomic_read(&priv->data_pending);
68 if (ret_size > 0) { /* relay data */
69 orig_ret_size = ret_size;
70 if (size < ret_size)
71 ret_size = size;
72
73 mutex_lock(&priv->buffer_mutex);
74 rc = copy_to_user(buf, priv->data_buffer, ret_size);
75 memset(priv->data_buffer, 0, orig_ret_size);
76 if (rc)
77 ret_size = -EFAULT;
78
79 mutex_unlock(&priv->buffer_mutex);
80 }
81
82 atomic_set(&priv->data_pending, 0);
83
84 return ret_size;
85}
86
87ssize_t tpm_common_write(struct file *file, const char __user *buf,
88 size_t size, loff_t *off, struct tpm_space *space)
89{
90 struct file_priv *priv = file->private_data;
91 size_t in_size = size;
92 ssize_t out_size;
93
94 /* Cannot perform a write until the read has cleared either via
95 * tpm_read or a user_read_timer timeout. This also prevents split
96 * buffered writes from blocking here.
97 */
98 if (atomic_read(&priv->data_pending) != 0)
99 return -EBUSY;
100
101 if (in_size > TPM_BUFSIZE)
102 return -E2BIG;
103
104 mutex_lock(&priv->buffer_mutex);
105
106 if (copy_from_user
107 (priv->data_buffer, (void __user *) buf, in_size)) {
108 mutex_unlock(&priv->buffer_mutex);
109 return -EFAULT;
110 }
111
112 if (in_size < 6 ||
113 in_size < be32_to_cpu(*((__be32 *) (priv->data_buffer + 2)))) {
114 mutex_unlock(&priv->buffer_mutex);
115 return -EINVAL;
116 }
117
118 /* atomic tpm command send and result receive. We only hold the ops
119 * lock during this period so that the tpm can be unregistered even if
120 * the char dev is held open.
121 */
122 if (tpm_try_get_ops(priv->chip)) {
123 mutex_unlock(&priv->buffer_mutex);
124 return -EPIPE;
125 }
126 out_size = tpm_transmit(priv->chip, space, priv->data_buffer,
127 sizeof(priv->data_buffer), 0);
128
129 tpm_put_ops(priv->chip);
130 if (out_size < 0) {
131 mutex_unlock(&priv->buffer_mutex);
132 return out_size;
133 }
134
135 atomic_set(&priv->data_pending, out_size);
136 mutex_unlock(&priv->buffer_mutex);
137
138 /* Set a timeout by which the reader must come claim the result */
139 mod_timer(&priv->user_read_timer, jiffies + (120 * HZ));
140
141 return in_size;
142}
143
144/*
145 * Called on file close
146 */
147void tpm_common_release(struct file *file, struct file_priv *priv)
148{
149 del_singleshot_timer_sync(&priv->user_read_timer);
150 flush_work(&priv->work);
151 file->private_data = NULL;
152 atomic_set(&priv->data_pending, 0);
153}