1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * Copyright (C) 2004 IBM Corporation
4  * Authors:
5  * Leendert van Doorn <leendert@watson.ibm.com>
6  * Dave Safford <safford@watson.ibm.com>
7  * Reiner Sailer <sailer@watson.ibm.com>
8  * Kylene Hall <kjhall@us.ibm.com>
9  *
10  * Copyright (C) 2013 Obsidian Research Corp
11  * Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
12  *
13  * Device file system interface to the TPM
14  */
15 #include <linux/poll.h>
16 #include <linux/slab.h>
17 #include <linux/uaccess.h>
18 #include <linux/workqueue.h>
19 #include "tpm.h"
20 #include "tpm-dev.h"
21 
22 static struct workqueue_struct *tpm_dev_wq;
23 
24 static ssize_t tpm_dev_transmit(struct tpm_chip *chip, struct tpm_space *space,
25 				u8 *buf, size_t bufsiz)
26 {
27 	struct tpm_header *header = (void *)buf;
28 	ssize_t ret, len;
29 
30 	ret = tpm2_prepare_space(chip, space, buf, bufsiz);
31 	/* If the command is not implemented by the TPM, synthesize a
32 	 * response with a TPM2_RC_COMMAND_CODE return for user-space.
33 	 */
34 	if (ret == -EOPNOTSUPP) {
35 		header->length = cpu_to_be32(sizeof(*header));
36 		header->tag = cpu_to_be16(TPM2_ST_NO_SESSIONS);
37 		header->return_code = cpu_to_be32(TPM2_RC_COMMAND_CODE |
38 						  TSS2_RESMGR_TPM_RC_LAYER);
39 		ret = sizeof(*header);
40 	}
41 	if (ret)
42 		goto out_rc;
43 
44 	len = tpm_transmit(chip, buf, bufsiz);
45 	if (len < 0)
46 		ret = len;
47 
48 	if (!ret)
49 		ret = tpm2_commit_space(chip, space, buf, &len);
50 	else
51 		tpm2_flush_space(chip);
52 
53 out_rc:
54 	return ret ? ret : len;
55 }
56 
57 static void tpm_dev_async_work(struct work_struct *work)
58 {
59 	struct file_priv *priv =
60 			container_of(work, struct file_priv, async_work);
61 	ssize_t ret;
62 
63 	mutex_lock(&priv->buffer_mutex);
64 	priv->command_enqueued = false;
65 	ret = tpm_try_get_ops(priv->chip);
66 	if (ret) {
67 		priv->response_length = ret;
68 		goto out;
69 	}
70 
71 	ret = tpm_dev_transmit(priv->chip, priv->space, priv->data_buffer,
72 			       sizeof(priv->data_buffer));
73 	tpm_put_ops(priv->chip);
74 
75 	/*
76 	 * If ret is > 0 then tpm_dev_transmit returned the size of the
77 	 * response. If ret is < 0 then tpm_dev_transmit failed and
78 	 * returned an error code.
79 	 */
80 	if (ret != 0) {
81 		priv->response_length = ret;
82 		mod_timer(&priv->user_read_timer, jiffies + (120 * HZ));
83 	}
84 out:
85 	mutex_unlock(&priv->buffer_mutex);
86 	wake_up_interruptible(&priv->async_wait);
87 }
88 
89 static void user_reader_timeout(struct timer_list *t)
90 {
91 	struct file_priv *priv = from_timer(priv, t, user_read_timer);
92 
93 	pr_warn("TPM user space timeout is deprecated (pid=%d)\n",
94 		task_tgid_nr(current));
95 
96 	schedule_work(&priv->timeout_work);
97 }
98 
99 static void tpm_timeout_work(struct work_struct *work)
100 {
101 	struct file_priv *priv = container_of(work, struct file_priv,
102 					      timeout_work);
103 
104 	mutex_lock(&priv->buffer_mutex);
105 	priv->response_read = true;
106 	priv->response_length = 0;
107 	memset(priv->data_buffer, 0, sizeof(priv->data_buffer));
108 	mutex_unlock(&priv->buffer_mutex);
109 	wake_up_interruptible(&priv->async_wait);
110 }
111 
112 void tpm_common_open(struct file *file, struct tpm_chip *chip,
113 		     struct file_priv *priv, struct tpm_space *space)
114 {
115 	priv->chip = chip;
116 	priv->space = space;
117 	priv->response_read = true;
118 
119 	mutex_init(&priv->buffer_mutex);
120 	timer_setup(&priv->user_read_timer, user_reader_timeout, 0);
121 	INIT_WORK(&priv->timeout_work, tpm_timeout_work);
122 	INIT_WORK(&priv->async_work, tpm_dev_async_work);
123 	init_waitqueue_head(&priv->async_wait);
124 	file->private_data = priv;
125 }
126 
127 ssize_t tpm_common_read(struct file *file, char __user *buf,
128 			size_t size, loff_t *off)
129 {
130 	struct file_priv *priv = file->private_data;
131 	ssize_t ret_size = 0;
132 	int rc;
133 
134 	mutex_lock(&priv->buffer_mutex);
135 
136 	if (priv->response_length) {
137 		priv->response_read = true;
138 
139 		ret_size = min_t(ssize_t, size, priv->response_length);
140 		if (ret_size <= 0) {
141 			priv->response_length = 0;
142 			goto out;
143 		}
144 
145 		rc = copy_to_user(buf, priv->data_buffer + *off, ret_size);
146 		if (rc) {
147 			memset(priv->data_buffer, 0, TPM_BUFSIZE);
148 			priv->response_length = 0;
149 			ret_size = -EFAULT;
150 		} else {
151 			memset(priv->data_buffer + *off, 0, ret_size);
152 			priv->response_length -= ret_size;
153 			*off += ret_size;
154 		}
155 	}
156 
157 out:
158 	if (!priv->response_length) {
159 		*off = 0;
160 		del_timer_sync(&priv->user_read_timer);
161 		flush_work(&priv->timeout_work);
162 	}
163 	mutex_unlock(&priv->buffer_mutex);
164 	return ret_size;
165 }
166 
167 ssize_t tpm_common_write(struct file *file, const char __user *buf,
168 			 size_t size, loff_t *off)
169 {
170 	struct file_priv *priv = file->private_data;
171 	int ret = 0;
172 
173 	if (size > TPM_BUFSIZE)
174 		return -E2BIG;
175 
176 	mutex_lock(&priv->buffer_mutex);
177 
178 	/* Cannot perform a write until the read has cleared either via
179 	 * tpm_read or a user_read_timer timeout. This also prevents split
180 	 * buffered writes from blocking here.
181 	 */
182 	if ((!priv->response_read && priv->response_length) ||
183 	    priv->command_enqueued) {
184 		ret = -EBUSY;
185 		goto out;
186 	}
187 
188 	if (copy_from_user(priv->data_buffer, buf, size)) {
189 		ret = -EFAULT;
190 		goto out;
191 	}
192 
193 	if (size < 6 ||
194 	    size < be32_to_cpu(*((__be32 *)(priv->data_buffer + 2)))) {
195 		ret = -EINVAL;
196 		goto out;
197 	}
198 
199 	priv->response_length = 0;
200 	priv->response_read = false;
201 	*off = 0;
202 
203 	/*
204 	 * If in nonblocking mode schedule an async job to send
205 	 * the command return the size.
206 	 * In case of error the err code will be returned in
207 	 * the subsequent read call.
208 	 */
209 	if (file->f_flags & O_NONBLOCK) {
210 		priv->command_enqueued = true;
211 		queue_work(tpm_dev_wq, &priv->async_work);
212 		mutex_unlock(&priv->buffer_mutex);
213 		return size;
214 	}
215 
216 	/* atomic tpm command send and result receive. We only hold the ops
217 	 * lock during this period so that the tpm can be unregistered even if
218 	 * the char dev is held open.
219 	 */
220 	if (tpm_try_get_ops(priv->chip)) {
221 		ret = -EPIPE;
222 		goto out;
223 	}
224 
225 	ret = tpm_dev_transmit(priv->chip, priv->space, priv->data_buffer,
226 			       sizeof(priv->data_buffer));
227 	tpm_put_ops(priv->chip);
228 
229 	if (ret > 0) {
230 		priv->response_length = ret;
231 		mod_timer(&priv->user_read_timer, jiffies + (120 * HZ));
232 		ret = size;
233 	}
234 out:
235 	mutex_unlock(&priv->buffer_mutex);
236 	return ret;
237 }
238 
239 __poll_t tpm_common_poll(struct file *file, poll_table *wait)
240 {
241 	struct file_priv *priv = file->private_data;
242 	__poll_t mask = 0;
243 
244 	poll_wait(file, &priv->async_wait, wait);
245 	mutex_lock(&priv->buffer_mutex);
246 
247 	/*
248 	 * The response_length indicates if there is still response
249 	 * (or part of it) to be consumed. Partial reads decrease it
250 	 * by the number of bytes read, and write resets it the zero.
251 	 */
252 	if (priv->response_length)
253 		mask = EPOLLIN | EPOLLRDNORM;
254 	else
255 		mask = EPOLLOUT | EPOLLWRNORM;
256 
257 	mutex_unlock(&priv->buffer_mutex);
258 	return mask;
259 }
260 
261 /*
262  * Called on file close
263  */
264 void tpm_common_release(struct file *file, struct file_priv *priv)
265 {
266 	flush_work(&priv->async_work);
267 	del_timer_sync(&priv->user_read_timer);
268 	flush_work(&priv->timeout_work);
269 	file->private_data = NULL;
270 	priv->response_length = 0;
271 }
272 
273 int __init tpm_dev_common_init(void)
274 {
275 	tpm_dev_wq = alloc_workqueue("tpm_dev_wq", WQ_MEM_RECLAIM, 0);
276 
277 	return !tpm_dev_wq ? -ENOMEM : 0;
278 }
279 
280 void __exit tpm_dev_common_exit(void)
281 {
282 	if (tpm_dev_wq) {
283 		destroy_workqueue(tpm_dev_wq);
284 		tpm_dev_wq = NULL;
285 	}
286 }
287