1 /*
2  * Copyright (C) 2015, 2016 IBM Corporation
3  * Copyright (C) 2016 Intel Corporation
4  *
5  * Author: Stefan Berger <stefanb@us.ibm.com>
6  *
7  * Maintained by: <tpmdd-devel@lists.sourceforge.net>
8  *
9  * Device driver for vTPM (vTPM proxy driver)
10  *
11  * This program is free software; you can redistribute it and/or
12  * modify it under the terms of the GNU General Public License as
13  * published by the Free Software Foundation, version 2 of the
14  * License.
15  *
16  */
17 
18 #include <linux/types.h>
19 #include <linux/spinlock.h>
20 #include <linux/uaccess.h>
21 #include <linux/wait.h>
22 #include <linux/miscdevice.h>
23 #include <linux/vtpm_proxy.h>
24 #include <linux/file.h>
25 #include <linux/anon_inodes.h>
26 #include <linux/poll.h>
27 #include <linux/compat.h>
28 
29 #include "tpm.h"
30 
31 #define VTPM_PROXY_REQ_COMPLETE_FLAG  BIT(0)
32 
33 struct proxy_dev {
34 	struct tpm_chip *chip;
35 
36 	u32 flags;                   /* public API flags */
37 
38 	wait_queue_head_t wq;
39 
40 	struct mutex buf_lock;       /* protect buffer and flags */
41 
42 	long state;                  /* internal state */
43 #define STATE_OPENED_FLAG        BIT(0)
44 #define STATE_WAIT_RESPONSE_FLAG BIT(1)  /* waiting for emulator response */
45 #define STATE_REGISTERED_FLAG	 BIT(2)
46 
47 	size_t req_len;              /* length of queued TPM request */
48 	size_t resp_len;             /* length of queued TPM response */
49 	u8 buffer[TPM_BUFSIZE];      /* request/response buffer */
50 
51 	struct work_struct work;     /* task that retrieves TPM timeouts */
52 };
53 
54 /* all supported flags */
55 #define VTPM_PROXY_FLAGS_ALL  (VTPM_PROXY_FLAG_TPM2)
56 
57 static struct workqueue_struct *workqueue;
58 
59 static void vtpm_proxy_delete_device(struct proxy_dev *proxy_dev);
60 
61 /*
62  * Functions related to 'server side'
63  */
64 
65 /**
66  * vtpm_proxy_fops_read - Read TPM commands on 'server side'
67  *
68  * @filp: file pointer
69  * @buf: read buffer
70  * @count: number of bytes to read
71  * @off: offset
72  *
73  * Return:
74  *	Number of bytes read or negative error code
75  */
76 static ssize_t vtpm_proxy_fops_read(struct file *filp, char __user *buf,
77 				    size_t count, loff_t *off)
78 {
79 	struct proxy_dev *proxy_dev = filp->private_data;
80 	size_t len;
81 	int sig, rc;
82 
83 	sig = wait_event_interruptible(proxy_dev->wq,
84 		proxy_dev->req_len != 0 ||
85 		!(proxy_dev->state & STATE_OPENED_FLAG));
86 	if (sig)
87 		return -EINTR;
88 
89 	mutex_lock(&proxy_dev->buf_lock);
90 
91 	if (!(proxy_dev->state & STATE_OPENED_FLAG)) {
92 		mutex_unlock(&proxy_dev->buf_lock);
93 		return -EPIPE;
94 	}
95 
96 	len = proxy_dev->req_len;
97 
98 	if (count < len) {
99 		mutex_unlock(&proxy_dev->buf_lock);
100 		pr_debug("Invalid size in recv: count=%zd, req_len=%zd\n",
101 			 count, len);
102 		return -EIO;
103 	}
104 
105 	rc = copy_to_user(buf, proxy_dev->buffer, len);
106 	memset(proxy_dev->buffer, 0, len);
107 	proxy_dev->req_len = 0;
108 
109 	if (!rc)
110 		proxy_dev->state |= STATE_WAIT_RESPONSE_FLAG;
111 
112 	mutex_unlock(&proxy_dev->buf_lock);
113 
114 	if (rc)
115 		return -EFAULT;
116 
117 	return len;
118 }
119 
120 /**
121  * vtpm_proxy_fops_write - Write TPM responses on 'server side'
122  *
123  * @filp: file pointer
124  * @buf: write buffer
125  * @count: number of bytes to write
126  * @off: offset
127  *
128  * Return:
129  *	Number of bytes read or negative error value
130  */
131 static ssize_t vtpm_proxy_fops_write(struct file *filp, const char __user *buf,
132 				     size_t count, loff_t *off)
133 {
134 	struct proxy_dev *proxy_dev = filp->private_data;
135 
136 	mutex_lock(&proxy_dev->buf_lock);
137 
138 	if (!(proxy_dev->state & STATE_OPENED_FLAG)) {
139 		mutex_unlock(&proxy_dev->buf_lock);
140 		return -EPIPE;
141 	}
142 
143 	if (count > sizeof(proxy_dev->buffer) ||
144 	    !(proxy_dev->state & STATE_WAIT_RESPONSE_FLAG)) {
145 		mutex_unlock(&proxy_dev->buf_lock);
146 		return -EIO;
147 	}
148 
149 	proxy_dev->state &= ~STATE_WAIT_RESPONSE_FLAG;
150 
151 	proxy_dev->req_len = 0;
152 
153 	if (copy_from_user(proxy_dev->buffer, buf, count)) {
154 		mutex_unlock(&proxy_dev->buf_lock);
155 		return -EFAULT;
156 	}
157 
158 	proxy_dev->resp_len = count;
159 
160 	mutex_unlock(&proxy_dev->buf_lock);
161 
162 	wake_up_interruptible(&proxy_dev->wq);
163 
164 	return count;
165 }
166 
167 /*
168  * vtpm_proxy_fops_poll - Poll status on 'server side'
169  *
170  * @filp: file pointer
171  * @wait: poll table
172  *
173  * Return: Poll flags
174  */
175 static unsigned int vtpm_proxy_fops_poll(struct file *filp, poll_table *wait)
176 {
177 	struct proxy_dev *proxy_dev = filp->private_data;
178 	unsigned ret;
179 
180 	poll_wait(filp, &proxy_dev->wq, wait);
181 
182 	ret = POLLOUT;
183 
184 	mutex_lock(&proxy_dev->buf_lock);
185 
186 	if (proxy_dev->req_len)
187 		ret |= POLLIN | POLLRDNORM;
188 
189 	if (!(proxy_dev->state & STATE_OPENED_FLAG))
190 		ret |= POLLHUP;
191 
192 	mutex_unlock(&proxy_dev->buf_lock);
193 
194 	return ret;
195 }
196 
197 /*
198  * vtpm_proxy_fops_open - Open vTPM device on 'server side'
199  *
200  * @filp: file pointer
201  *
202  * Called when setting up the anonymous file descriptor
203  */
204 static void vtpm_proxy_fops_open(struct file *filp)
205 {
206 	struct proxy_dev *proxy_dev = filp->private_data;
207 
208 	proxy_dev->state |= STATE_OPENED_FLAG;
209 }
210 
211 /**
212  * vtpm_proxy_fops_undo_open - counter-part to vtpm_fops_open
213  *       Call to undo vtpm_proxy_fops_open
214  *
215  *@proxy_dev: tpm proxy device
216  */
217 static void vtpm_proxy_fops_undo_open(struct proxy_dev *proxy_dev)
218 {
219 	mutex_lock(&proxy_dev->buf_lock);
220 
221 	proxy_dev->state &= ~STATE_OPENED_FLAG;
222 
223 	mutex_unlock(&proxy_dev->buf_lock);
224 
225 	/* no more TPM responses -- wake up anyone waiting for them */
226 	wake_up_interruptible(&proxy_dev->wq);
227 }
228 
229 /*
230  * vtpm_proxy_fops_release - Close 'server side'
231  *
232  * @inode: inode
233  * @filp: file pointer
234  * Return:
235  *      Always returns 0.
236  */
237 static int vtpm_proxy_fops_release(struct inode *inode, struct file *filp)
238 {
239 	struct proxy_dev *proxy_dev = filp->private_data;
240 
241 	filp->private_data = NULL;
242 
243 	vtpm_proxy_delete_device(proxy_dev);
244 
245 	return 0;
246 }
247 
248 static const struct file_operations vtpm_proxy_fops = {
249 	.owner = THIS_MODULE,
250 	.llseek = no_llseek,
251 	.read = vtpm_proxy_fops_read,
252 	.write = vtpm_proxy_fops_write,
253 	.poll = vtpm_proxy_fops_poll,
254 	.release = vtpm_proxy_fops_release,
255 };
256 
257 /*
258  * Functions invoked by the core TPM driver to send TPM commands to
259  * 'server side' and receive responses from there.
260  */
261 
262 /*
263  * Called when core TPM driver reads TPM responses from 'server side'
264  *
265  * @chip: tpm chip to use
266  * @buf: receive buffer
267  * @count: bytes to read
268  * Return:
269  *      Number of TPM response bytes read, negative error value otherwise
270  */
271 static int vtpm_proxy_tpm_op_recv(struct tpm_chip *chip, u8 *buf, size_t count)
272 {
273 	struct proxy_dev *proxy_dev = dev_get_drvdata(&chip->dev);
274 	size_t len;
275 
276 	/* process gone ? */
277 	mutex_lock(&proxy_dev->buf_lock);
278 
279 	if (!(proxy_dev->state & STATE_OPENED_FLAG)) {
280 		mutex_unlock(&proxy_dev->buf_lock);
281 		return -EPIPE;
282 	}
283 
284 	len = proxy_dev->resp_len;
285 	if (count < len) {
286 		dev_err(&chip->dev,
287 			"Invalid size in recv: count=%zd, resp_len=%zd\n",
288 			count, len);
289 		len = -EIO;
290 		goto out;
291 	}
292 
293 	memcpy(buf, proxy_dev->buffer, len);
294 	proxy_dev->resp_len = 0;
295 
296 out:
297 	mutex_unlock(&proxy_dev->buf_lock);
298 
299 	return len;
300 }
301 
302 /*
303  * Called when core TPM driver forwards TPM requests to 'server side'.
304  *
305  * @chip: tpm chip to use
306  * @buf: send buffer
307  * @count: bytes to send
308  *
309  * Return:
310  *      0 in case of success, negative error value otherwise.
311  */
312 static int vtpm_proxy_tpm_op_send(struct tpm_chip *chip, u8 *buf, size_t count)
313 {
314 	struct proxy_dev *proxy_dev = dev_get_drvdata(&chip->dev);
315 	int rc = 0;
316 
317 	if (count > sizeof(proxy_dev->buffer)) {
318 		dev_err(&chip->dev,
319 			"Invalid size in send: count=%zd, buffer size=%zd\n",
320 			count, sizeof(proxy_dev->buffer));
321 		return -EIO;
322 	}
323 
324 	mutex_lock(&proxy_dev->buf_lock);
325 
326 	if (!(proxy_dev->state & STATE_OPENED_FLAG)) {
327 		mutex_unlock(&proxy_dev->buf_lock);
328 		return -EPIPE;
329 	}
330 
331 	proxy_dev->resp_len = 0;
332 
333 	proxy_dev->req_len = count;
334 	memcpy(proxy_dev->buffer, buf, count);
335 
336 	proxy_dev->state &= ~STATE_WAIT_RESPONSE_FLAG;
337 
338 	mutex_unlock(&proxy_dev->buf_lock);
339 
340 	wake_up_interruptible(&proxy_dev->wq);
341 
342 	return rc;
343 }
344 
345 static void vtpm_proxy_tpm_op_cancel(struct tpm_chip *chip)
346 {
347 	/* not supported */
348 }
349 
350 static u8 vtpm_proxy_tpm_op_status(struct tpm_chip *chip)
351 {
352 	struct proxy_dev *proxy_dev = dev_get_drvdata(&chip->dev);
353 
354 	if (proxy_dev->resp_len)
355 		return VTPM_PROXY_REQ_COMPLETE_FLAG;
356 
357 	return 0;
358 }
359 
360 static bool vtpm_proxy_tpm_req_canceled(struct tpm_chip  *chip, u8 status)
361 {
362 	struct proxy_dev *proxy_dev = dev_get_drvdata(&chip->dev);
363 	bool ret;
364 
365 	mutex_lock(&proxy_dev->buf_lock);
366 
367 	ret = !(proxy_dev->state & STATE_OPENED_FLAG);
368 
369 	mutex_unlock(&proxy_dev->buf_lock);
370 
371 	return ret;
372 }
373 
374 static const struct tpm_class_ops vtpm_proxy_tpm_ops = {
375 	.flags = TPM_OPS_AUTO_STARTUP,
376 	.recv = vtpm_proxy_tpm_op_recv,
377 	.send = vtpm_proxy_tpm_op_send,
378 	.cancel = vtpm_proxy_tpm_op_cancel,
379 	.status = vtpm_proxy_tpm_op_status,
380 	.req_complete_mask = VTPM_PROXY_REQ_COMPLETE_FLAG,
381 	.req_complete_val = VTPM_PROXY_REQ_COMPLETE_FLAG,
382 	.req_canceled = vtpm_proxy_tpm_req_canceled,
383 };
384 
385 /*
386  * Code related to the startup of the TPM 2 and startup of TPM 1.2 +
387  * retrieval of timeouts and durations.
388  */
389 
390 static void vtpm_proxy_work(struct work_struct *work)
391 {
392 	struct proxy_dev *proxy_dev = container_of(work, struct proxy_dev,
393 						   work);
394 	int rc;
395 
396 	rc = tpm_chip_register(proxy_dev->chip);
397 	if (rc)
398 		vtpm_proxy_fops_undo_open(proxy_dev);
399 	else
400 		proxy_dev->state |= STATE_REGISTERED_FLAG;
401 }
402 
403 /*
404  * vtpm_proxy_work_stop: make sure the work has finished
405  *
406  * This function is useful when user space closed the fd
407  * while the driver still determines timeouts.
408  */
409 static void vtpm_proxy_work_stop(struct proxy_dev *proxy_dev)
410 {
411 	vtpm_proxy_fops_undo_open(proxy_dev);
412 	flush_work(&proxy_dev->work);
413 }
414 
415 /*
416  * vtpm_proxy_work_start: Schedule the work for TPM 1.2 & 2 initialization
417  */
418 static inline void vtpm_proxy_work_start(struct proxy_dev *proxy_dev)
419 {
420 	queue_work(workqueue, &proxy_dev->work);
421 }
422 
423 /*
424  * Code related to creation and deletion of device pairs
425  */
426 static struct proxy_dev *vtpm_proxy_create_proxy_dev(void)
427 {
428 	struct proxy_dev *proxy_dev;
429 	struct tpm_chip *chip;
430 	int err;
431 
432 	proxy_dev = kzalloc(sizeof(*proxy_dev), GFP_KERNEL);
433 	if (proxy_dev == NULL)
434 		return ERR_PTR(-ENOMEM);
435 
436 	init_waitqueue_head(&proxy_dev->wq);
437 	mutex_init(&proxy_dev->buf_lock);
438 	INIT_WORK(&proxy_dev->work, vtpm_proxy_work);
439 
440 	chip = tpm_chip_alloc(NULL, &vtpm_proxy_tpm_ops);
441 	if (IS_ERR(chip)) {
442 		err = PTR_ERR(chip);
443 		goto err_proxy_dev_free;
444 	}
445 	dev_set_drvdata(&chip->dev, proxy_dev);
446 
447 	proxy_dev->chip = chip;
448 
449 	return proxy_dev;
450 
451 err_proxy_dev_free:
452 	kfree(proxy_dev);
453 
454 	return ERR_PTR(err);
455 }
456 
457 /*
458  * Undo what has been done in vtpm_create_proxy_dev
459  */
460 static inline void vtpm_proxy_delete_proxy_dev(struct proxy_dev *proxy_dev)
461 {
462 	put_device(&proxy_dev->chip->dev); /* frees chip */
463 	kfree(proxy_dev);
464 }
465 
466 /*
467  * Create a /dev/tpm%d and 'server side' file descriptor pair
468  *
469  * Return:
470  *      Returns file pointer on success, an error value otherwise
471  */
472 static struct file *vtpm_proxy_create_device(
473 				 struct vtpm_proxy_new_dev *vtpm_new_dev)
474 {
475 	struct proxy_dev *proxy_dev;
476 	int rc, fd;
477 	struct file *file;
478 
479 	if (vtpm_new_dev->flags & ~VTPM_PROXY_FLAGS_ALL)
480 		return ERR_PTR(-EOPNOTSUPP);
481 
482 	proxy_dev = vtpm_proxy_create_proxy_dev();
483 	if (IS_ERR(proxy_dev))
484 		return ERR_CAST(proxy_dev);
485 
486 	proxy_dev->flags = vtpm_new_dev->flags;
487 
488 	/* setup an anonymous file for the server-side */
489 	fd = get_unused_fd_flags(O_RDWR);
490 	if (fd < 0) {
491 		rc = fd;
492 		goto err_delete_proxy_dev;
493 	}
494 
495 	file = anon_inode_getfile("[vtpms]", &vtpm_proxy_fops, proxy_dev,
496 				  O_RDWR);
497 	if (IS_ERR(file)) {
498 		rc = PTR_ERR(file);
499 		goto err_put_unused_fd;
500 	}
501 
502 	/* from now on we can unwind with put_unused_fd() + fput() */
503 	/* simulate an open() on the server side */
504 	vtpm_proxy_fops_open(file);
505 
506 	if (proxy_dev->flags & VTPM_PROXY_FLAG_TPM2)
507 		proxy_dev->chip->flags |= TPM_CHIP_FLAG_TPM2;
508 
509 	vtpm_proxy_work_start(proxy_dev);
510 
511 	vtpm_new_dev->fd = fd;
512 	vtpm_new_dev->major = MAJOR(proxy_dev->chip->dev.devt);
513 	vtpm_new_dev->minor = MINOR(proxy_dev->chip->dev.devt);
514 	vtpm_new_dev->tpm_num = proxy_dev->chip->dev_num;
515 
516 	return file;
517 
518 err_put_unused_fd:
519 	put_unused_fd(fd);
520 
521 err_delete_proxy_dev:
522 	vtpm_proxy_delete_proxy_dev(proxy_dev);
523 
524 	return ERR_PTR(rc);
525 }
526 
527 /*
528  * Counter part to vtpm_create_device.
529  */
530 static void vtpm_proxy_delete_device(struct proxy_dev *proxy_dev)
531 {
532 	vtpm_proxy_work_stop(proxy_dev);
533 
534 	/*
535 	 * A client may hold the 'ops' lock, so let it know that the server
536 	 * side shuts down before we try to grab the 'ops' lock when
537 	 * unregistering the chip.
538 	 */
539 	vtpm_proxy_fops_undo_open(proxy_dev);
540 
541 	if (proxy_dev->state & STATE_REGISTERED_FLAG)
542 		tpm_chip_unregister(proxy_dev->chip);
543 
544 	vtpm_proxy_delete_proxy_dev(proxy_dev);
545 }
546 
547 /*
548  * Code related to the control device /dev/vtpmx
549  */
550 
551 /**
552  * vtpmx_ioc_new_dev - handler for the %VTPM_PROXY_IOC_NEW_DEV ioctl
553  * @file:	/dev/vtpmx
554  * @ioctl:	the ioctl number
555  * @arg:	pointer to the struct vtpmx_proxy_new_dev
556  *
557  * Creates an anonymous file that is used by the process acting as a TPM to
558  * communicate with the client processes. The function will also add a new TPM
559  * device through which data is proxied to this TPM acting process. The caller
560  * will be provided with a file descriptor to communicate with the clients and
561  * major and minor numbers for the TPM device.
562  */
563 static long vtpmx_ioc_new_dev(struct file *file, unsigned int ioctl,
564 			      unsigned long arg)
565 {
566 	void __user *argp = (void __user *)arg;
567 	struct vtpm_proxy_new_dev __user *vtpm_new_dev_p;
568 	struct vtpm_proxy_new_dev vtpm_new_dev;
569 	struct file *vtpm_file;
570 
571 	if (!capable(CAP_SYS_ADMIN))
572 		return -EPERM;
573 
574 	vtpm_new_dev_p = argp;
575 
576 	if (copy_from_user(&vtpm_new_dev, vtpm_new_dev_p,
577 			   sizeof(vtpm_new_dev)))
578 		return -EFAULT;
579 
580 	vtpm_file = vtpm_proxy_create_device(&vtpm_new_dev);
581 	if (IS_ERR(vtpm_file))
582 		return PTR_ERR(vtpm_file);
583 
584 	if (copy_to_user(vtpm_new_dev_p, &vtpm_new_dev,
585 			 sizeof(vtpm_new_dev))) {
586 		put_unused_fd(vtpm_new_dev.fd);
587 		fput(vtpm_file);
588 		return -EFAULT;
589 	}
590 
591 	fd_install(vtpm_new_dev.fd, vtpm_file);
592 	return 0;
593 }
594 
595 /*
596  * vtpmx_fops_ioctl: ioctl on /dev/vtpmx
597  *
598  * Return:
599  *      Returns 0 on success, a negative error code otherwise.
600  */
601 static long vtpmx_fops_ioctl(struct file *f, unsigned int ioctl,
602 			     unsigned long arg)
603 {
604 	switch (ioctl) {
605 	case VTPM_PROXY_IOC_NEW_DEV:
606 		return vtpmx_ioc_new_dev(f, ioctl, arg);
607 	default:
608 		return -ENOIOCTLCMD;
609 	}
610 }
611 
612 #ifdef CONFIG_COMPAT
613 static long vtpmx_fops_compat_ioctl(struct file *f, unsigned int ioctl,
614 					  unsigned long arg)
615 {
616 	return vtpmx_fops_ioctl(f, ioctl, (unsigned long)compat_ptr(arg));
617 }
618 #endif
619 
620 static const struct file_operations vtpmx_fops = {
621 	.owner = THIS_MODULE,
622 	.unlocked_ioctl = vtpmx_fops_ioctl,
623 #ifdef CONFIG_COMPAT
624 	.compat_ioctl = vtpmx_fops_compat_ioctl,
625 #endif
626 	.llseek = noop_llseek,
627 };
628 
629 static struct miscdevice vtpmx_miscdev = {
630 	.minor = MISC_DYNAMIC_MINOR,
631 	.name = "vtpmx",
632 	.fops = &vtpmx_fops,
633 };
634 
635 static int vtpmx_init(void)
636 {
637 	return misc_register(&vtpmx_miscdev);
638 }
639 
640 static void vtpmx_cleanup(void)
641 {
642 	misc_deregister(&vtpmx_miscdev);
643 }
644 
645 static int __init vtpm_module_init(void)
646 {
647 	int rc;
648 
649 	rc = vtpmx_init();
650 	if (rc) {
651 		pr_err("couldn't create vtpmx device\n");
652 		return rc;
653 	}
654 
655 	workqueue = create_workqueue("tpm-vtpm");
656 	if (!workqueue) {
657 		pr_err("couldn't create workqueue\n");
658 		rc = -ENOMEM;
659 		goto err_vtpmx_cleanup;
660 	}
661 
662 	return 0;
663 
664 err_vtpmx_cleanup:
665 	vtpmx_cleanup();
666 
667 	return rc;
668 }
669 
670 static void __exit vtpm_module_exit(void)
671 {
672 	destroy_workqueue(workqueue);
673 	vtpmx_cleanup();
674 }
675 
676 module_init(vtpm_module_init);
677 module_exit(vtpm_module_exit);
678 
679 MODULE_AUTHOR("Stefan Berger (stefanb@us.ibm.com)");
680 MODULE_DESCRIPTION("vTPM Driver");
681 MODULE_VERSION("0.1");
682 MODULE_LICENSE("GPL");
683