drivers/char/tpm/tpm_vtpm_proxy.c

   1 /*
   2  * Copyright (C) 2015, 2016 IBM Corporation
   3  * Copyright (C) 2016 Intel Corporation
   4  *
   5  * Author: Stefan Berger <stefanb@us.ibm.com>
   6  *
   7  * Maintained by: <tpmdd-devel@lists.sourceforge.net>
   8  *
   9  * Device driver for vTPM (vTPM proxy driver)
  10  *
  11  * This program is free software; you can redistribute it and/or
  12  * modify it under the terms of the GNU General Public License as
  13  * published by the Free Software Foundation, version 2 of the
  14  * License.
  15  *
  16  */
  17
  18 #include <linux/types.h>
  19 #include <linux/spinlock.h>
  20 #include <linux/uaccess.h>
  21 #include <linux/wait.h>
  22 #include <linux/miscdevice.h>
  23 #include <linux/vtpm_proxy.h>
  24 #include <linux/file.h>
  25 #include <linux/anon_inodes.h>
  26 #include <linux/poll.h>
  27 #include <linux/compat.h>
  28
  29 #include "tpm.h"
  30
  31 #define VTPM_PROXY_REQ_COMPLETE_FLAG  BIT(0)
  32
  33 struct proxy_dev {
  34         struct tpm_chip *chip;
  35
  36         u32 flags;                   /* public API flags */
  37
  38         wait_queue_head_t wq;
  39
  40         struct mutex buf_lock;       /* protect buffer and flags */
  41
  42         long state;                  /* internal state */
  43 #define STATE_OPENED_FLAG        BIT(0)
  44 #define STATE_WAIT_RESPONSE_FLAG BIT(1)  /* waiting for emulator response */
  45 #define STATE_REGISTERED_FLAG    BIT(2)
  46
  47         size_t req_len;              /* length of queued TPM request */
  48         size_t resp_len;             /* length of queued TPM response */
  49         u8 buffer[TPM_BUFSIZE];      /* request/response buffer */
  50
  51         struct work_struct work;     /* task that retrieves TPM timeouts */
  52 };
  53
  54 /* all supported flags */
  55 #define VTPM_PROXY_FLAGS_ALL  (VTPM_PROXY_FLAG_TPM2)
  56
  57 static struct workqueue_struct *workqueue;
  58
  59 static void vtpm_proxy_delete_device(struct proxy_dev *proxy_dev);
  60
  61 /*
  62  * Functions related to 'server side'
  63  */
  64
  65 /**
  66  * vtpm_proxy_fops_read - Read TPM commands on 'server side'
  67  *
  68  * @filp: file pointer
  69  * @buf: read buffer
  70  * @count: number of bytes to read
  71  * @off: offset
  72  *
  73  * Return:
  74  *      Number of bytes read or negative error code
  75  */
  76 static ssize_t vtpm_proxy_fops_read(struct file *filp, char __user *buf,
  77                                     size_t count, loff_t *off)
  78 {
  79         struct proxy_dev *proxy_dev = filp->private_data;
  80         size_t len;
  81         int sig, rc;
  82
  83         sig = wait_event_interruptible(proxy_dev->wq,
  84                 proxy_dev->req_len != 0 ||
  85                 !(proxy_dev->state & STATE_OPENED_FLAG));
  86         if (sig)
  87                 return -EINTR;
  88
  89         mutex_lock(&proxy_dev->buf_lock);
  90
  91         if (!(proxy_dev->state & STATE_OPENED_FLAG)) {
  92                 mutex_unlock(&proxy_dev->buf_lock);
  93                 return -EPIPE;
  94         }
  95
  96         len = proxy_dev->req_len;
  97
  98         if (count < len) {
  99                 mutex_unlock(&proxy_dev->buf_lock);
 100                 pr_debug("Invalid size in recv: count=%zd, req_len=%zd\n",
 101                          count, len);
 102                 return -EIO;
 103         }
 104
 105         rc = copy_to_user(buf, proxy_dev->buffer, len);
 106         memset(proxy_dev->buffer, 0, len);
 107         proxy_dev->req_len = 0;
 108
 109         if (!rc)
 110                 proxy_dev->state |= STATE_WAIT_RESPONSE_FLAG;
 111
 112         mutex_unlock(&proxy_dev->buf_lock);
 113
 114         if (rc)
 115                 return -EFAULT;
 116
 117         return len;
 118 }
 119
 120 /**
 121  * vtpm_proxy_fops_write - Write TPM responses on 'server side'
 122  *
 123  * @filp: file pointer
 124  * @buf: write buffer
 125  * @count: number of bytes to write
 126  * @off: offset
 127  *
 128  * Return:
 129  *      Number of bytes read or negative error value
 130  */
 131 static ssize_t vtpm_proxy_fops_write(struct file *filp, const char __user *buf,
 132                                      size_t count, loff_t *off)
 133 {
 134         struct proxy_dev *proxy_dev = filp->private_data;
 135
 136         mutex_lock(&proxy_dev->buf_lock);
 137
 138         if (!(proxy_dev->state & STATE_OPENED_FLAG)) {
 139                 mutex_unlock(&proxy_dev->buf_lock);
 140                 return -EPIPE;
 141         }
 142
 143         if (count > sizeof(proxy_dev->buffer) ||
 144             !(proxy_dev->state & STATE_WAIT_RESPONSE_FLAG)) {
 145                 mutex_unlock(&proxy_dev->buf_lock);
 146                 return -EIO;
 147         }
 148
 149         proxy_dev->state &= ~STATE_WAIT_RESPONSE_FLAG;
 150
 151         proxy_dev->req_len = 0;
 152
 153         if (copy_from_user(proxy_dev->buffer, buf, count)) {
 154                 mutex_unlock(&proxy_dev->buf_lock);
 155                 return -EFAULT;
 156         }
 157
 158         proxy_dev->resp_len = count;
 159
 160         mutex_unlock(&proxy_dev->buf_lock);
 161
 162         wake_up_interruptible(&proxy_dev->wq);
 163
 164         return count;
 165 }
 166
 167 /*
 168  * vtpm_proxy_fops_poll - Poll status on 'server side'
 169  *
 170  * @filp: file pointer
 171  * @wait: poll table
 172  *
 173  * Return: Poll flags
 174  */
 175 static unsigned int vtpm_proxy_fops_poll(struct file *filp, poll_table *wait)
 176 {
 177         struct proxy_dev *proxy_dev = filp->private_data;
 178         unsigned ret;
 179
 180         poll_wait(filp, &proxy_dev->wq, wait);
 181
 182         ret = POLLOUT;
 183
 184         mutex_lock(&proxy_dev->buf_lock);
 185
 186         if (proxy_dev->req_len)
 187                 ret |= POLLIN | POLLRDNORM;
 188
 189         if (!(proxy_dev->state & STATE_OPENED_FLAG))
 190                 ret |= POLLHUP;
 191
 192         mutex_unlock(&proxy_dev->buf_lock);
 193
 194         return ret;
 195 }
 196
 197 /*
 198  * vtpm_proxy_fops_open - Open vTPM device on 'server side'
 199  *
 200  * @filp: file pointer
 201  *
 202  * Called when setting up the anonymous file descriptor
 203  */
 204 static void vtpm_proxy_fops_open(struct file *filp)
 205 {
 206         struct proxy_dev *proxy_dev = filp->private_data;
 207
 208         proxy_dev->state |= STATE_OPENED_FLAG;
 209 }
 210
 211 /**
 212  * vtpm_proxy_fops_undo_open - counter-part to vtpm_fops_open
 213  *       Call to undo vtpm_proxy_fops_open
 214  *
 215  *@proxy_dev: tpm proxy device
 216  */
 217 static void vtpm_proxy_fops_undo_open(struct proxy_dev *proxy_dev)
 218 {
 219         mutex_lock(&proxy_dev->buf_lock);
 220
 221         proxy_dev->state &= ~STATE_OPENED_FLAG;
 222
 223         mutex_unlock(&proxy_dev->buf_lock);
 224
 225         /* no more TPM responses -- wake up anyone waiting for them */
 226         wake_up_interruptible(&proxy_dev->wq);
 227 }
 228
 229 /*
 230  * vtpm_proxy_fops_release - Close 'server side'
 231  *
 232  * @inode: inode
 233  * @filp: file pointer
 234  * Return:
 235  *      Always returns 0.
 236  */
 237 static int vtpm_proxy_fops_release(struct inode *inode, struct file *filp)
 238 {
 239         struct proxy_dev *proxy_dev = filp->private_data;
 240
 241         filp->private_data = NULL;
 242
 243         vtpm_proxy_delete_device(proxy_dev);
 244
 245         return 0;
 246 }
 247
 248 static const struct file_operations vtpm_proxy_fops = {
 249         .owner = THIS_MODULE,
 250         .llseek = no_llseek,
 251         .read = vtpm_proxy_fops_read,
 252         .write = vtpm_proxy_fops_write,
 253         .poll = vtpm_proxy_fops_poll,
 254         .release = vtpm_proxy_fops_release,
 255 };
 256
 257 /*
 258  * Functions invoked by the core TPM driver to send TPM commands to
 259  * 'server side' and receive responses from there.
 260  */
 261
 262 /*
 263  * Called when core TPM driver reads TPM responses from 'server side'
 264  *
 265  * @chip: tpm chip to use
 266  * @buf: receive buffer
 267  * @count: bytes to read
 268  * Return:
 269  *      Number of TPM response bytes read, negative error value otherwise
 270  */
 271 static int vtpm_proxy_tpm_op_recv(struct tpm_chip *chip, u8 *buf, size_t count)
 272 {
 273         struct proxy_dev *proxy_dev = dev_get_drvdata(&chip->dev);
 274         size_t len;
 275
 276         /* process gone ? */
 277         mutex_lock(&proxy_dev->buf_lock);
 278
 279         if (!(proxy_dev->state & STATE_OPENED_FLAG)) {
 280                 mutex_unlock(&proxy_dev->buf_lock);
 281                 return -EPIPE;
 282         }
 283
 284         len = proxy_dev->resp_len;
 285         if (count < len) {
 286                 dev_err(&chip->dev,
 287                         "Invalid size in recv: count=%zd, resp_len=%zd\n",
 288                         count, len);
 289                 len = -EIO;
 290                 goto out;
 291         }
 292
 293         memcpy(buf, proxy_dev->buffer, len);
 294         proxy_dev->resp_len = 0;
 295
 296 out:
 297         mutex_unlock(&proxy_dev->buf_lock);
 298
 299         return len;
 300 }
 301
 302 /*
 303  * Called when core TPM driver forwards TPM requests to 'server side'.
 304  *
 305  * @chip: tpm chip to use
 306  * @buf: send buffer
 307  * @count: bytes to send
 308  *
 309  * Return:
 310  *      0 in case of success, negative error value otherwise.
 311  */
 312 static int vtpm_proxy_tpm_op_send(struct tpm_chip *chip, u8 *buf, size_t count)
 313 {
 314         struct proxy_dev *proxy_dev = dev_get_drvdata(&chip->dev);
 315         int rc = 0;
 316
 317         if (count > sizeof(proxy_dev->buffer)) {
 318                 dev_err(&chip->dev,
 319                         "Invalid size in send: count=%zd, buffer size=%zd\n",
 320                         count, sizeof(proxy_dev->buffer));
 321                 return -EIO;
 322         }
 323
 324         mutex_lock(&proxy_dev->buf_lock);
 325
 326         if (!(proxy_dev->state & STATE_OPENED_FLAG)) {
 327                 mutex_unlock(&proxy_dev->buf_lock);
 328                 return -EPIPE;
 329         }
 330
 331         proxy_dev->resp_len = 0;
 332
 333         proxy_dev->req_len = count;
 334         memcpy(proxy_dev->buffer, buf, count);
 335
 336         proxy_dev->state &= ~STATE_WAIT_RESPONSE_FLAG;
 337
 338         mutex_unlock(&proxy_dev->buf_lock);
 339
 340         wake_up_interruptible(&proxy_dev->wq);
 341
 342         return rc;
 343 }
 344
 345 static void vtpm_proxy_tpm_op_cancel(struct tpm_chip *chip)
 346 {
 347         /* not supported */
 348 }
 349
 350 static u8 vtpm_proxy_tpm_op_status(struct tpm_chip *chip)
 351 {
 352         struct proxy_dev *proxy_dev = dev_get_drvdata(&chip->dev);
 353
 354         if (proxy_dev->resp_len)
 355                 return VTPM_PROXY_REQ_COMPLETE_FLAG;
 356
 357         return 0;
 358 }
 359
 360 static bool vtpm_proxy_tpm_req_canceled(struct tpm_chip  *chip, u8 status)
 361 {
 362         struct proxy_dev *proxy_dev = dev_get_drvdata(&chip->dev);
 363         bool ret;
 364
 365         mutex_lock(&proxy_dev->buf_lock);
 366
 367         ret = !(proxy_dev->state & STATE_OPENED_FLAG);
 368
 369         mutex_unlock(&proxy_dev->buf_lock);
 370
 371         return ret;
 372 }
 373
 374 static const struct tpm_class_ops vtpm_proxy_tpm_ops = {
 375         .flags = TPM_OPS_AUTO_STARTUP,
 376         .recv = vtpm_proxy_tpm_op_recv,
 377         .send = vtpm_proxy_tpm_op_send,
 378         .cancel = vtpm_proxy_tpm_op_cancel,
 379         .status = vtpm_proxy_tpm_op_status,
 380         .req_complete_mask = VTPM_PROXY_REQ_COMPLETE_FLAG,
 381         .req_complete_val = VTPM_PROXY_REQ_COMPLETE_FLAG,
 382         .req_canceled = vtpm_proxy_tpm_req_canceled,
 383 };
 384
 385 /*
 386  * Code related to the startup of the TPM 2 and startup of TPM 1.2 +
 387  * retrieval of timeouts and durations.
 388  */
 389
 390 static void vtpm_proxy_work(struct work_struct *work)
 391 {
 392         struct proxy_dev *proxy_dev = container_of(work, struct proxy_dev,
 393                                                    work);
 394         int rc;
 395
 396         rc = tpm_chip_register(proxy_dev->chip);
 397         if (rc)
 398                 vtpm_proxy_fops_undo_open(proxy_dev);
 399         else
 400                 proxy_dev->state |= STATE_REGISTERED_FLAG;
 401 }
 402
 403 /*
 404  * vtpm_proxy_work_stop: make sure the work has finished
 405  *
 406  * This function is useful when user space closed the fd
 407  * while the driver still determines timeouts.
 408  */
 409 static void vtpm_proxy_work_stop(struct proxy_dev *proxy_dev)
 410 {
 411         vtpm_proxy_fops_undo_open(proxy_dev);
 412         flush_work(&proxy_dev->work);
 413 }
 414
 415 /*
 416  * vtpm_proxy_work_start: Schedule the work for TPM 1.2 & 2 initialization
 417  */
 418 static inline void vtpm_proxy_work_start(struct proxy_dev *proxy_dev)
 419 {
 420         queue_work(workqueue, &proxy_dev->work);
 421 }
 422
 423 /*
 424  * Code related to creation and deletion of device pairs
 425  */
 426 static struct proxy_dev *vtpm_proxy_create_proxy_dev(void)
 427 {
 428         struct proxy_dev *proxy_dev;
 429         struct tpm_chip *chip;
 430         int err;
 431
 432         proxy_dev = kzalloc(sizeof(*proxy_dev), GFP_KERNEL);
 433         if (proxy_dev == NULL)
 434                 return ERR_PTR(-ENOMEM);
 435
 436         init_waitqueue_head(&proxy_dev->wq);
 437         mutex_init(&proxy_dev->buf_lock);
 438         INIT_WORK(&proxy_dev->work, vtpm_proxy_work);
 439
 440         chip = tpm_chip_alloc(NULL, &vtpm_proxy_tpm_ops);
 441         if (IS_ERR(chip)) {
 442                 err = PTR_ERR(chip);
 443                 goto err_proxy_dev_free;
 444         }
 445         dev_set_drvdata(&chip->dev, proxy_dev);
 446
 447         proxy_dev->chip = chip;
 448
 449         return proxy_dev;
 450
 451 err_proxy_dev_free:
 452         kfree(proxy_dev);
 453
 454         return ERR_PTR(err);
 455 }
 456
 457 /*
 458  * Undo what has been done in vtpm_create_proxy_dev
 459  */
 460 static inline void vtpm_proxy_delete_proxy_dev(struct proxy_dev *proxy_dev)
 461 {
 462         put_device(&proxy_dev->chip->dev); /* frees chip */
 463         kfree(proxy_dev);
 464 }
 465
 466 /*
 467  * Create a /dev/tpm%d and 'server side' file descriptor pair
 468  *
 469  * Return:
 470  *      Returns file pointer on success, an error value otherwise
 471  */
 472 static struct file *vtpm_proxy_create_device(
 473                                  struct vtpm_proxy_new_dev *vtpm_new_dev)
 474 {
 475         struct proxy_dev *proxy_dev;
 476         int rc, fd;
 477         struct file *file;
 478
 479         if (vtpm_new_dev->flags & ~VTPM_PROXY_FLAGS_ALL)
 480                 return ERR_PTR(-EOPNOTSUPP);
 481
 482         proxy_dev = vtpm_proxy_create_proxy_dev();
 483         if (IS_ERR(proxy_dev))
 484                 return ERR_CAST(proxy_dev);
 485
 486         proxy_dev->flags = vtpm_new_dev->flags;
 487
 488         /* setup an anonymous file for the server-side */
 489         fd = get_unused_fd_flags(O_RDWR);
 490         if (fd < 0) {
 491                 rc = fd;
 492                 goto err_delete_proxy_dev;
 493         }
 494
 495         file = anon_inode_getfile("[vtpms]", &vtpm_proxy_fops, proxy_dev,
 496                                   O_RDWR);
 497         if (IS_ERR(file)) {
 498                 rc = PTR_ERR(file);
 499                 goto err_put_unused_fd;
 500         }
 501
 502         /* from now on we can unwind with put_unused_fd() + fput() */
 503         /* simulate an open() on the server side */
 504         vtpm_proxy_fops_open(file);
 505
 506         if (proxy_dev->flags & VTPM_PROXY_FLAG_TPM2)
 507                 proxy_dev->chip->flags |= TPM_CHIP_FLAG_TPM2;
 508
 509         vtpm_proxy_work_start(proxy_dev);
 510
 511         vtpm_new_dev->fd = fd;
 512         vtpm_new_dev->major = MAJOR(proxy_dev->chip->dev.devt);
 513         vtpm_new_dev->minor = MINOR(proxy_dev->chip->dev.devt);
 514         vtpm_new_dev->tpm_num = proxy_dev->chip->dev_num;
 515
 516         return file;
 517
 518 err_put_unused_fd:
 519         put_unused_fd(fd);
 520
 521 err_delete_proxy_dev:
 522         vtpm_proxy_delete_proxy_dev(proxy_dev);
 523
 524         return ERR_PTR(rc);
 525 }
 526
 527 /*
 528  * Counter part to vtpm_create_device.
 529  */
 530 static void vtpm_proxy_delete_device(struct proxy_dev *proxy_dev)
 531 {
 532         vtpm_proxy_work_stop(proxy_dev);
 533
 534         /*
 535          * A client may hold the 'ops' lock, so let it know that the server
 536          * side shuts down before we try to grab the 'ops' lock when
 537          * unregistering the chip.
 538          */
 539         vtpm_proxy_fops_undo_open(proxy_dev);
 540
 541         if (proxy_dev->state & STATE_REGISTERED_FLAG)
 542                 tpm_chip_unregister(proxy_dev->chip);
 543
 544         vtpm_proxy_delete_proxy_dev(proxy_dev);
 545 }
 546
 547 /*
 548  * Code related to the control device /dev/vtpmx
 549  */
 550
 551 /**
 552  * vtpmx_ioc_new_dev - handler for the %VTPM_PROXY_IOC_NEW_DEV ioctl
 553  * @file:       /dev/vtpmx
 554  * @ioctl:      the ioctl number
 555  * @arg:        pointer to the struct vtpmx_proxy_new_dev
 556  *
 557  * Creates an anonymous file that is used by the process acting as a TPM to
 558  * communicate with the client processes. The function will also add a new TPM
 559  * device through which data is proxied to this TPM acting process. The caller
 560  * will be provided with a file descriptor to communicate with the clients and
 561  * major and minor numbers for the TPM device.
 562  */
 563 static long vtpmx_ioc_new_dev(struct file *file, unsigned int ioctl,
 564                               unsigned long arg)
 565 {
 566         void __user *argp = (void __user *)arg;
 567         struct vtpm_proxy_new_dev __user *vtpm_new_dev_p;
 568         struct vtpm_proxy_new_dev vtpm_new_dev;
 569         struct file *vtpm_file;
 570
 571         if (!capable(CAP_SYS_ADMIN))
 572                 return -EPERM;
 573
 574         vtpm_new_dev_p = argp;
 575
 576         if (copy_from_user(&vtpm_new_dev, vtpm_new_dev_p,
 577                            sizeof(vtpm_new_dev)))
 578                 return -EFAULT;
 579
 580         vtpm_file = vtpm_proxy_create_device(&vtpm_new_dev);
 581         if (IS_ERR(vtpm_file))
 582                 return PTR_ERR(vtpm_file);
 583
 584         if (copy_to_user(vtpm_new_dev_p, &vtpm_new_dev,
 585                          sizeof(vtpm_new_dev))) {
 586                 put_unused_fd(vtpm_new_dev.fd);
 587                 fput(vtpm_file);
 588                 return -EFAULT;
 589         }
 590
 591         fd_install(vtpm_new_dev.fd, vtpm_file);
 592         return 0;
 593 }
 594
 595 /*
 596  * vtpmx_fops_ioctl: ioctl on /dev/vtpmx
 597  *
 598  * Return:
 599  *      Returns 0 on success, a negative error code otherwise.
 600  */
 601 static long vtpmx_fops_ioctl(struct file *f, unsigned int ioctl,
 602                              unsigned long arg)
 603 {
 604         switch (ioctl) {
 605         case VTPM_PROXY_IOC_NEW_DEV:
 606                 return vtpmx_ioc_new_dev(f, ioctl, arg);
 607         default:
 608                 return -ENOIOCTLCMD;
 609         }
 610 }
 611
 612 #ifdef CONFIG_COMPAT
 613 static long vtpmx_fops_compat_ioctl(struct file *f, unsigned int ioctl,
 614                                           unsigned long arg)
 615 {
 616         return vtpmx_fops_ioctl(f, ioctl, (unsigned long)compat_ptr(arg));
 617 }
 618 #endif
 619
 620 static const struct file_operations vtpmx_fops = {
 621         .owner = THIS_MODULE,
 622         .unlocked_ioctl = vtpmx_fops_ioctl,
 623 #ifdef CONFIG_COMPAT
 624         .compat_ioctl = vtpmx_fops_compat_ioctl,
 625 #endif
 626         .llseek = noop_llseek,
 627 };
 628
 629 static struct miscdevice vtpmx_miscdev = {
 630         .minor = MISC_DYNAMIC_MINOR,
 631         .name = "vtpmx",
 632         .fops = &vtpmx_fops,
 633 };
 634
 635 static int vtpmx_init(void)
 636 {
 637         return misc_register(&vtpmx_miscdev);
 638 }
 639
 640 static void vtpmx_cleanup(void)
 641 {
 642         misc_deregister(&vtpmx_miscdev);
 643 }
 644
 645 static int __init vtpm_module_init(void)
 646 {
 647         int rc;
 648
 649         rc = vtpmx_init();
 650         if (rc) {
 651                 pr_err("couldn't create vtpmx device\n");
 652                 return rc;
 653         }
 654
 655         workqueue = create_workqueue("tpm-vtpm");
 656         if (!workqueue) {
 657                 pr_err("couldn't create workqueue\n");
 658                 rc = -ENOMEM;
 659                 goto err_vtpmx_cleanup;
 660         }
 661
 662         return 0;
 663
 664 err_vtpmx_cleanup:
 665         vtpmx_cleanup();
 666
 667         return rc;
 668 }
 669
 670 static void __exit vtpm_module_exit(void)
 671 {
 672         destroy_workqueue(workqueue);
 673         vtpmx_cleanup();
 674 }
 675
 676 module_init(vtpm_module_init);
 677 module_exit(vtpm_module_exit);
 678
 679 MODULE_AUTHOR("Stefan Berger (stefanb@us.ibm.com)");
 680 MODULE_DESCRIPTION("vTPM Driver");
 681 MODULE_VERSION("0.1");
 682 MODULE_LICENSE("GPL");