1 // SPDX-License-Identifier: GPL-2.0-only
3 * Copyright (C) 2015, 2016 IBM Corporation
4 * Copyright (C) 2016 Intel Corporation
6 * Author: Stefan Berger <stefanb@us.ibm.com>
8 * Maintained by: <tpmdd-devel@lists.sourceforge.net>
10 * Device driver for vTPM (vTPM proxy driver)
13 #include <linux/types.h>
14 #include <linux/spinlock.h>
15 #include <linux/uaccess.h>
16 #include <linux/wait.h>
17 #include <linux/miscdevice.h>
18 #include <linux/vtpm_proxy.h>
19 #include <linux/file.h>
20 #include <linux/anon_inodes.h>
21 #include <linux/poll.h>
22 #include <linux/compat.h>
26 #define VTPM_PROXY_REQ_COMPLETE_FLAG BIT(0)
29 struct tpm_chip
*chip
;
31 u32 flags
; /* public API flags */
35 struct mutex buf_lock
; /* protect buffer and flags */
37 long state
; /* internal state */
38 #define STATE_OPENED_FLAG BIT(0)
39 #define STATE_WAIT_RESPONSE_FLAG BIT(1) /* waiting for emulator response */
40 #define STATE_REGISTERED_FLAG BIT(2)
41 #define STATE_DRIVER_COMMAND BIT(3) /* sending a driver specific command */
43 size_t req_len
; /* length of queued TPM request */
44 size_t resp_len
; /* length of queued TPM response */
45 u8 buffer
[TPM_BUFSIZE
]; /* request/response buffer */
47 struct work_struct work
; /* task that retrieves TPM timeouts */
50 /* all supported flags */
51 #define VTPM_PROXY_FLAGS_ALL (VTPM_PROXY_FLAG_TPM2)
53 static struct workqueue_struct
*workqueue
;
55 static void vtpm_proxy_delete_device(struct proxy_dev
*proxy_dev
);
58 * Functions related to 'server side'
62 * vtpm_proxy_fops_read - Read TPM commands on 'server side'
66 * @count: number of bytes to read
70 * Number of bytes read or negative error code
72 static ssize_t
vtpm_proxy_fops_read(struct file
*filp
, char __user
*buf
,
73 size_t count
, loff_t
*off
)
75 struct proxy_dev
*proxy_dev
= filp
->private_data
;
79 sig
= wait_event_interruptible(proxy_dev
->wq
,
80 proxy_dev
->req_len
!= 0 ||
81 !(proxy_dev
->state
& STATE_OPENED_FLAG
));
85 mutex_lock(&proxy_dev
->buf_lock
);
87 if (!(proxy_dev
->state
& STATE_OPENED_FLAG
)) {
88 mutex_unlock(&proxy_dev
->buf_lock
);
92 len
= proxy_dev
->req_len
;
94 if (count
< len
|| len
> sizeof(proxy_dev
->buffer
)) {
95 mutex_unlock(&proxy_dev
->buf_lock
);
96 pr_debug("Invalid size in recv: count=%zd, req_len=%zd\n",
101 rc
= copy_to_user(buf
, proxy_dev
->buffer
, len
);
102 memset(proxy_dev
->buffer
, 0, len
);
103 proxy_dev
->req_len
= 0;
106 proxy_dev
->state
|= STATE_WAIT_RESPONSE_FLAG
;
108 mutex_unlock(&proxy_dev
->buf_lock
);
117 * vtpm_proxy_fops_write - Write TPM responses on 'server side'
119 * @filp: file pointer
121 * @count: number of bytes to write
125 * Number of bytes read or negative error value
127 static ssize_t
vtpm_proxy_fops_write(struct file
*filp
, const char __user
*buf
,
128 size_t count
, loff_t
*off
)
130 struct proxy_dev
*proxy_dev
= filp
->private_data
;
132 mutex_lock(&proxy_dev
->buf_lock
);
134 if (!(proxy_dev
->state
& STATE_OPENED_FLAG
)) {
135 mutex_unlock(&proxy_dev
->buf_lock
);
139 if (count
> sizeof(proxy_dev
->buffer
) ||
140 !(proxy_dev
->state
& STATE_WAIT_RESPONSE_FLAG
)) {
141 mutex_unlock(&proxy_dev
->buf_lock
);
145 proxy_dev
->state
&= ~STATE_WAIT_RESPONSE_FLAG
;
147 proxy_dev
->req_len
= 0;
149 if (copy_from_user(proxy_dev
->buffer
, buf
, count
)) {
150 mutex_unlock(&proxy_dev
->buf_lock
);
154 proxy_dev
->resp_len
= count
;
156 mutex_unlock(&proxy_dev
->buf_lock
);
158 wake_up_interruptible(&proxy_dev
->wq
);
164 * vtpm_proxy_fops_poll - Poll status on 'server side'
166 * @filp: file pointer
171 static __poll_t
vtpm_proxy_fops_poll(struct file
*filp
, poll_table
*wait
)
173 struct proxy_dev
*proxy_dev
= filp
->private_data
;
176 poll_wait(filp
, &proxy_dev
->wq
, wait
);
180 mutex_lock(&proxy_dev
->buf_lock
);
182 if (proxy_dev
->req_len
)
183 ret
|= EPOLLIN
| EPOLLRDNORM
;
185 if (!(proxy_dev
->state
& STATE_OPENED_FLAG
))
188 mutex_unlock(&proxy_dev
->buf_lock
);
194 * vtpm_proxy_fops_open - Open vTPM device on 'server side'
196 * @filp: file pointer
198 * Called when setting up the anonymous file descriptor
200 static void vtpm_proxy_fops_open(struct file
*filp
)
202 struct proxy_dev
*proxy_dev
= filp
->private_data
;
204 proxy_dev
->state
|= STATE_OPENED_FLAG
;
208 * vtpm_proxy_fops_undo_open - counter-part to vtpm_fops_open
209 * Call to undo vtpm_proxy_fops_open
211 *@proxy_dev: tpm proxy device
213 static void vtpm_proxy_fops_undo_open(struct proxy_dev
*proxy_dev
)
215 mutex_lock(&proxy_dev
->buf_lock
);
217 proxy_dev
->state
&= ~STATE_OPENED_FLAG
;
219 mutex_unlock(&proxy_dev
->buf_lock
);
221 /* no more TPM responses -- wake up anyone waiting for them */
222 wake_up_interruptible(&proxy_dev
->wq
);
226 * vtpm_proxy_fops_release - Close 'server side'
229 * @filp: file pointer
233 static int vtpm_proxy_fops_release(struct inode
*inode
, struct file
*filp
)
235 struct proxy_dev
*proxy_dev
= filp
->private_data
;
237 filp
->private_data
= NULL
;
239 vtpm_proxy_delete_device(proxy_dev
);
244 static const struct file_operations vtpm_proxy_fops
= {
245 .owner
= THIS_MODULE
,
246 .read
= vtpm_proxy_fops_read
,
247 .write
= vtpm_proxy_fops_write
,
248 .poll
= vtpm_proxy_fops_poll
,
249 .release
= vtpm_proxy_fops_release
,
253 * Functions invoked by the core TPM driver to send TPM commands to
254 * 'server side' and receive responses from there.
258 * Called when core TPM driver reads TPM responses from 'server side'
260 * @chip: tpm chip to use
261 * @buf: receive buffer
262 * @count: bytes to read
264 * Number of TPM response bytes read, negative error value otherwise
266 static int vtpm_proxy_tpm_op_recv(struct tpm_chip
*chip
, u8
*buf
, size_t count
)
268 struct proxy_dev
*proxy_dev
= dev_get_drvdata(&chip
->dev
);
272 mutex_lock(&proxy_dev
->buf_lock
);
274 if (!(proxy_dev
->state
& STATE_OPENED_FLAG
)) {
275 mutex_unlock(&proxy_dev
->buf_lock
);
279 len
= proxy_dev
->resp_len
;
282 "Invalid size in recv: count=%zd, resp_len=%zd\n",
288 memcpy(buf
, proxy_dev
->buffer
, len
);
289 proxy_dev
->resp_len
= 0;
292 mutex_unlock(&proxy_dev
->buf_lock
);
297 static int vtpm_proxy_is_driver_command(struct tpm_chip
*chip
,
298 u8
*buf
, size_t count
)
300 struct tpm_header
*hdr
= (struct tpm_header
*)buf
;
302 if (count
< sizeof(struct tpm_header
))
305 if (chip
->flags
& TPM_CHIP_FLAG_TPM2
) {
306 switch (be32_to_cpu(hdr
->ordinal
)) {
307 case TPM2_CC_SET_LOCALITY
:
311 switch (be32_to_cpu(hdr
->ordinal
)) {
312 case TPM_ORD_SET_LOCALITY
:
320 * Called when core TPM driver forwards TPM requests to 'server side'.
322 * @chip: tpm chip to use
324 * @count: bytes to send
327 * 0 in case of success, negative error value otherwise.
329 static int vtpm_proxy_tpm_op_send(struct tpm_chip
*chip
, u8
*buf
, size_t count
)
331 struct proxy_dev
*proxy_dev
= dev_get_drvdata(&chip
->dev
);
333 if (count
> sizeof(proxy_dev
->buffer
)) {
335 "Invalid size in send: count=%zd, buffer size=%zd\n",
336 count
, sizeof(proxy_dev
->buffer
));
340 if (!(proxy_dev
->state
& STATE_DRIVER_COMMAND
) &&
341 vtpm_proxy_is_driver_command(chip
, buf
, count
))
344 mutex_lock(&proxy_dev
->buf_lock
);
346 if (!(proxy_dev
->state
& STATE_OPENED_FLAG
)) {
347 mutex_unlock(&proxy_dev
->buf_lock
);
351 proxy_dev
->resp_len
= 0;
353 proxy_dev
->req_len
= count
;
354 memcpy(proxy_dev
->buffer
, buf
, count
);
356 proxy_dev
->state
&= ~STATE_WAIT_RESPONSE_FLAG
;
358 mutex_unlock(&proxy_dev
->buf_lock
);
360 wake_up_interruptible(&proxy_dev
->wq
);
365 static void vtpm_proxy_tpm_op_cancel(struct tpm_chip
*chip
)
370 static u8
vtpm_proxy_tpm_op_status(struct tpm_chip
*chip
)
372 struct proxy_dev
*proxy_dev
= dev_get_drvdata(&chip
->dev
);
374 if (proxy_dev
->resp_len
)
375 return VTPM_PROXY_REQ_COMPLETE_FLAG
;
380 static bool vtpm_proxy_tpm_req_canceled(struct tpm_chip
*chip
, u8 status
)
382 struct proxy_dev
*proxy_dev
= dev_get_drvdata(&chip
->dev
);
385 mutex_lock(&proxy_dev
->buf_lock
);
387 ret
= !(proxy_dev
->state
& STATE_OPENED_FLAG
);
389 mutex_unlock(&proxy_dev
->buf_lock
);
394 static int vtpm_proxy_request_locality(struct tpm_chip
*chip
, int locality
)
398 const struct tpm_header
*header
;
399 struct proxy_dev
*proxy_dev
= dev_get_drvdata(&chip
->dev
);
401 if (chip
->flags
& TPM_CHIP_FLAG_TPM2
)
402 rc
= tpm_buf_init(&buf
, TPM2_ST_SESSIONS
,
403 TPM2_CC_SET_LOCALITY
);
405 rc
= tpm_buf_init(&buf
, TPM_TAG_RQU_COMMAND
,
406 TPM_ORD_SET_LOCALITY
);
409 tpm_buf_append_u8(&buf
, locality
);
411 proxy_dev
->state
|= STATE_DRIVER_COMMAND
;
413 rc
= tpm_transmit_cmd(chip
, &buf
, 0, "attempting to set locality");
415 proxy_dev
->state
&= ~STATE_DRIVER_COMMAND
;
422 header
= (const struct tpm_header
*)buf
.data
;
423 rc
= be32_to_cpu(header
->return_code
);
428 tpm_buf_destroy(&buf
);
433 static const struct tpm_class_ops vtpm_proxy_tpm_ops
= {
434 .flags
= TPM_OPS_AUTO_STARTUP
,
435 .recv
= vtpm_proxy_tpm_op_recv
,
436 .send
= vtpm_proxy_tpm_op_send
,
437 .cancel
= vtpm_proxy_tpm_op_cancel
,
438 .status
= vtpm_proxy_tpm_op_status
,
439 .req_complete_mask
= VTPM_PROXY_REQ_COMPLETE_FLAG
,
440 .req_complete_val
= VTPM_PROXY_REQ_COMPLETE_FLAG
,
441 .req_canceled
= vtpm_proxy_tpm_req_canceled
,
442 .request_locality
= vtpm_proxy_request_locality
,
446 * Code related to the startup of the TPM 2 and startup of TPM 1.2 +
447 * retrieval of timeouts and durations.
450 static void vtpm_proxy_work(struct work_struct
*work
)
452 struct proxy_dev
*proxy_dev
= container_of(work
, struct proxy_dev
,
456 rc
= tpm_chip_register(proxy_dev
->chip
);
458 vtpm_proxy_fops_undo_open(proxy_dev
);
460 proxy_dev
->state
|= STATE_REGISTERED_FLAG
;
464 * vtpm_proxy_work_stop: make sure the work has finished
466 * This function is useful when user space closed the fd
467 * while the driver still determines timeouts.
469 static void vtpm_proxy_work_stop(struct proxy_dev
*proxy_dev
)
471 vtpm_proxy_fops_undo_open(proxy_dev
);
472 flush_work(&proxy_dev
->work
);
476 * vtpm_proxy_work_start: Schedule the work for TPM 1.2 & 2 initialization
478 static inline void vtpm_proxy_work_start(struct proxy_dev
*proxy_dev
)
480 queue_work(workqueue
, &proxy_dev
->work
);
484 * Code related to creation and deletion of device pairs
486 static struct proxy_dev
*vtpm_proxy_create_proxy_dev(void)
488 struct proxy_dev
*proxy_dev
;
489 struct tpm_chip
*chip
;
492 proxy_dev
= kzalloc(sizeof(*proxy_dev
), GFP_KERNEL
);
493 if (proxy_dev
== NULL
)
494 return ERR_PTR(-ENOMEM
);
496 init_waitqueue_head(&proxy_dev
->wq
);
497 mutex_init(&proxy_dev
->buf_lock
);
498 INIT_WORK(&proxy_dev
->work
, vtpm_proxy_work
);
500 chip
= tpm_chip_alloc(NULL
, &vtpm_proxy_tpm_ops
);
503 goto err_proxy_dev_free
;
505 dev_set_drvdata(&chip
->dev
, proxy_dev
);
507 proxy_dev
->chip
= chip
;
518 * Undo what has been done in vtpm_create_proxy_dev
520 static inline void vtpm_proxy_delete_proxy_dev(struct proxy_dev
*proxy_dev
)
522 put_device(&proxy_dev
->chip
->dev
); /* frees chip */
527 * Create a /dev/tpm%d and 'server side' file descriptor pair
530 * Returns file pointer on success, an error value otherwise
532 static struct file
*vtpm_proxy_create_device(
533 struct vtpm_proxy_new_dev
*vtpm_new_dev
)
535 struct proxy_dev
*proxy_dev
;
539 if (vtpm_new_dev
->flags
& ~VTPM_PROXY_FLAGS_ALL
)
540 return ERR_PTR(-EOPNOTSUPP
);
542 proxy_dev
= vtpm_proxy_create_proxy_dev();
543 if (IS_ERR(proxy_dev
))
544 return ERR_CAST(proxy_dev
);
546 proxy_dev
->flags
= vtpm_new_dev
->flags
;
548 /* setup an anonymous file for the server-side */
549 fd
= get_unused_fd_flags(O_RDWR
);
552 goto err_delete_proxy_dev
;
555 file
= anon_inode_getfile("[vtpms]", &vtpm_proxy_fops
, proxy_dev
,
559 goto err_put_unused_fd
;
562 /* from now on we can unwind with put_unused_fd() + fput() */
563 /* simulate an open() on the server side */
564 vtpm_proxy_fops_open(file
);
566 if (proxy_dev
->flags
& VTPM_PROXY_FLAG_TPM2
)
567 proxy_dev
->chip
->flags
|= TPM_CHIP_FLAG_TPM2
;
569 vtpm_proxy_work_start(proxy_dev
);
571 vtpm_new_dev
->fd
= fd
;
572 vtpm_new_dev
->major
= MAJOR(proxy_dev
->chip
->dev
.devt
);
573 vtpm_new_dev
->minor
= MINOR(proxy_dev
->chip
->dev
.devt
);
574 vtpm_new_dev
->tpm_num
= proxy_dev
->chip
->dev_num
;
581 err_delete_proxy_dev
:
582 vtpm_proxy_delete_proxy_dev(proxy_dev
);
588 * Counter part to vtpm_create_device.
590 static void vtpm_proxy_delete_device(struct proxy_dev
*proxy_dev
)
592 vtpm_proxy_work_stop(proxy_dev
);
595 * A client may hold the 'ops' lock, so let it know that the server
596 * side shuts down before we try to grab the 'ops' lock when
597 * unregistering the chip.
599 vtpm_proxy_fops_undo_open(proxy_dev
);
601 if (proxy_dev
->state
& STATE_REGISTERED_FLAG
)
602 tpm_chip_unregister(proxy_dev
->chip
);
604 vtpm_proxy_delete_proxy_dev(proxy_dev
);
608 * Code related to the control device /dev/vtpmx
612 * vtpmx_ioc_new_dev - handler for the %VTPM_PROXY_IOC_NEW_DEV ioctl
614 * @ioctl: the ioctl number
615 * @arg: pointer to the struct vtpmx_proxy_new_dev
617 * Creates an anonymous file that is used by the process acting as a TPM to
618 * communicate with the client processes. The function will also add a new TPM
619 * device through which data is proxied to this TPM acting process. The caller
620 * will be provided with a file descriptor to communicate with the clients and
621 * major and minor numbers for the TPM device.
623 static long vtpmx_ioc_new_dev(struct file
*file
, unsigned int ioctl
,
626 void __user
*argp
= (void __user
*)arg
;
627 struct vtpm_proxy_new_dev __user
*vtpm_new_dev_p
;
628 struct vtpm_proxy_new_dev vtpm_new_dev
;
629 struct file
*vtpm_file
;
631 if (!capable(CAP_SYS_ADMIN
))
634 vtpm_new_dev_p
= argp
;
636 if (copy_from_user(&vtpm_new_dev
, vtpm_new_dev_p
,
637 sizeof(vtpm_new_dev
)))
640 vtpm_file
= vtpm_proxy_create_device(&vtpm_new_dev
);
641 if (IS_ERR(vtpm_file
))
642 return PTR_ERR(vtpm_file
);
644 if (copy_to_user(vtpm_new_dev_p
, &vtpm_new_dev
,
645 sizeof(vtpm_new_dev
))) {
646 put_unused_fd(vtpm_new_dev
.fd
);
651 fd_install(vtpm_new_dev
.fd
, vtpm_file
);
656 * vtpmx_fops_ioctl: ioctl on /dev/vtpmx
659 * Returns 0 on success, a negative error code otherwise.
661 static long vtpmx_fops_ioctl(struct file
*f
, unsigned int ioctl
,
665 case VTPM_PROXY_IOC_NEW_DEV
:
666 return vtpmx_ioc_new_dev(f
, ioctl
, arg
);
672 static const struct file_operations vtpmx_fops
= {
673 .owner
= THIS_MODULE
,
674 .unlocked_ioctl
= vtpmx_fops_ioctl
,
675 .compat_ioctl
= compat_ptr_ioctl
,
676 .llseek
= noop_llseek
,
679 static struct miscdevice vtpmx_miscdev
= {
680 .minor
= MISC_DYNAMIC_MINOR
,
685 static int __init
vtpm_module_init(void)
689 workqueue
= create_workqueue("tpm-vtpm");
691 pr_err("couldn't create workqueue\n");
695 rc
= misc_register(&vtpmx_miscdev
);
697 pr_err("couldn't create vtpmx device\n");
698 destroy_workqueue(workqueue
);
704 static void __exit
vtpm_module_exit(void)
706 destroy_workqueue(workqueue
);
707 misc_deregister(&vtpmx_miscdev
);
710 module_init(vtpm_module_init
);
711 module_exit(vtpm_module_exit
);
713 MODULE_AUTHOR("Stefan Berger <stefanb@us.ibm.com>");
714 MODULE_DESCRIPTION("vTPM Driver");
715 MODULE_VERSION("0.1");
716 MODULE_LICENSE("GPL");