2 * Copyright (C) 2015, 2016 IBM Corporation
3 * Copyright (C) 2016 Intel Corporation
5 * Author: Stefan Berger <stefanb@us.ibm.com>
7 * Maintained by: <tpmdd-devel@lists.sourceforge.net>
9 * Device driver for vTPM (vTPM proxy driver)
11 * This program is free software; you can redistribute it and/or
12 * modify it under the terms of the GNU General Public License as
13 * published by the Free Software Foundation, version 2 of the
18 #include <linux/types.h>
19 #include <linux/spinlock.h>
20 #include <linux/uaccess.h>
21 #include <linux/wait.h>
22 #include <linux/miscdevice.h>
23 #include <linux/vtpm_proxy.h>
24 #include <linux/file.h>
25 #include <linux/anon_inodes.h>
26 #include <linux/poll.h>
27 #include <linux/compat.h>
31 #define VTPM_PROXY_REQ_COMPLETE_FLAG BIT(0)
34 struct tpm_chip
*chip
;
36 u32 flags
; /* public API flags */
40 struct mutex buf_lock
; /* protect buffer and flags */
42 long state
; /* internal state */
43 #define STATE_OPENED_FLAG BIT(0)
44 #define STATE_WAIT_RESPONSE_FLAG BIT(1) /* waiting for emulator response */
45 #define STATE_REGISTERED_FLAG BIT(2)
47 size_t req_len
; /* length of queued TPM request */
48 size_t resp_len
; /* length of queued TPM response */
49 u8 buffer
[TPM_BUFSIZE
]; /* request/response buffer */
51 struct work_struct work
; /* task that retrieves TPM timeouts */
54 /* all supported flags */
55 #define VTPM_PROXY_FLAGS_ALL (VTPM_PROXY_FLAG_TPM2)
57 static struct workqueue_struct
*workqueue
;
59 static void vtpm_proxy_delete_device(struct proxy_dev
*proxy_dev
);
62 * Functions related to 'server side'
66 * vtpm_proxy_fops_read - Read TPM commands on 'server side'
69 * Number of bytes read or negative error code
71 static ssize_t
vtpm_proxy_fops_read(struct file
*filp
, char __user
*buf
,
72 size_t count
, loff_t
*off
)
74 struct proxy_dev
*proxy_dev
= filp
->private_data
;
78 sig
= wait_event_interruptible(proxy_dev
->wq
,
79 proxy_dev
->req_len
!= 0 ||
80 !(proxy_dev
->state
& STATE_OPENED_FLAG
));
84 mutex_lock(&proxy_dev
->buf_lock
);
86 if (!(proxy_dev
->state
& STATE_OPENED_FLAG
)) {
87 mutex_unlock(&proxy_dev
->buf_lock
);
91 len
= proxy_dev
->req_len
;
94 mutex_unlock(&proxy_dev
->buf_lock
);
95 pr_debug("Invalid size in recv: count=%zd, req_len=%zd\n",
100 rc
= copy_to_user(buf
, proxy_dev
->buffer
, len
);
101 memset(proxy_dev
->buffer
, 0, len
);
102 proxy_dev
->req_len
= 0;
105 proxy_dev
->state
|= STATE_WAIT_RESPONSE_FLAG
;
107 mutex_unlock(&proxy_dev
->buf_lock
);
116 * vtpm_proxy_fops_write - Write TPM responses on 'server side'
119 * Number of bytes read or negative error value
121 static ssize_t
vtpm_proxy_fops_write(struct file
*filp
, const char __user
*buf
,
122 size_t count
, loff_t
*off
)
124 struct proxy_dev
*proxy_dev
= filp
->private_data
;
126 mutex_lock(&proxy_dev
->buf_lock
);
128 if (!(proxy_dev
->state
& STATE_OPENED_FLAG
)) {
129 mutex_unlock(&proxy_dev
->buf_lock
);
133 if (count
> sizeof(proxy_dev
->buffer
) ||
134 !(proxy_dev
->state
& STATE_WAIT_RESPONSE_FLAG
)) {
135 mutex_unlock(&proxy_dev
->buf_lock
);
139 proxy_dev
->state
&= ~STATE_WAIT_RESPONSE_FLAG
;
141 proxy_dev
->req_len
= 0;
143 if (copy_from_user(proxy_dev
->buffer
, buf
, count
)) {
144 mutex_unlock(&proxy_dev
->buf_lock
);
148 proxy_dev
->resp_len
= count
;
150 mutex_unlock(&proxy_dev
->buf_lock
);
152 wake_up_interruptible(&proxy_dev
->wq
);
158 * vtpm_proxy_fops_poll: Poll status on 'server side'
163 static unsigned int vtpm_proxy_fops_poll(struct file
*filp
, poll_table
*wait
)
165 struct proxy_dev
*proxy_dev
= filp
->private_data
;
168 poll_wait(filp
, &proxy_dev
->wq
, wait
);
172 mutex_lock(&proxy_dev
->buf_lock
);
174 if (proxy_dev
->req_len
)
175 ret
|= POLLIN
| POLLRDNORM
;
177 if (!(proxy_dev
->state
& STATE_OPENED_FLAG
))
180 mutex_unlock(&proxy_dev
->buf_lock
);
186 * vtpm_proxy_fops_open - Open vTPM device on 'server side'
188 * Called when setting up the anonymous file descriptor
190 static void vtpm_proxy_fops_open(struct file
*filp
)
192 struct proxy_dev
*proxy_dev
= filp
->private_data
;
194 proxy_dev
->state
|= STATE_OPENED_FLAG
;
198 * vtpm_proxy_fops_undo_open - counter-part to vtpm_fops_open
200 * Call to undo vtpm_proxy_fops_open
202 static void vtpm_proxy_fops_undo_open(struct proxy_dev
*proxy_dev
)
204 mutex_lock(&proxy_dev
->buf_lock
);
206 proxy_dev
->state
&= ~STATE_OPENED_FLAG
;
208 mutex_unlock(&proxy_dev
->buf_lock
);
210 /* no more TPM responses -- wake up anyone waiting for them */
211 wake_up_interruptible(&proxy_dev
->wq
);
215 * vtpm_proxy_fops_release: Close 'server side'
220 static int vtpm_proxy_fops_release(struct inode
*inode
, struct file
*filp
)
222 struct proxy_dev
*proxy_dev
= filp
->private_data
;
224 filp
->private_data
= NULL
;
226 vtpm_proxy_delete_device(proxy_dev
);
231 static const struct file_operations vtpm_proxy_fops
= {
232 .owner
= THIS_MODULE
,
234 .read
= vtpm_proxy_fops_read
,
235 .write
= vtpm_proxy_fops_write
,
236 .poll
= vtpm_proxy_fops_poll
,
237 .release
= vtpm_proxy_fops_release
,
241 * Functions invoked by the core TPM driver to send TPM commands to
242 * 'server side' and receive responses from there.
246 * Called when core TPM driver reads TPM responses from 'server side'
249 * Number of TPM response bytes read, negative error value otherwise
251 static int vtpm_proxy_tpm_op_recv(struct tpm_chip
*chip
, u8
*buf
, size_t count
)
253 struct proxy_dev
*proxy_dev
= dev_get_drvdata(&chip
->dev
);
257 mutex_lock(&proxy_dev
->buf_lock
);
259 if (!(proxy_dev
->state
& STATE_OPENED_FLAG
)) {
260 mutex_unlock(&proxy_dev
->buf_lock
);
264 len
= proxy_dev
->resp_len
;
267 "Invalid size in recv: count=%zd, resp_len=%zd\n",
273 memcpy(buf
, proxy_dev
->buffer
, len
);
274 proxy_dev
->resp_len
= 0;
277 mutex_unlock(&proxy_dev
->buf_lock
);
283 * Called when core TPM driver forwards TPM requests to 'server side'.
286 * 0 in case of success, negative error value otherwise.
288 static int vtpm_proxy_tpm_op_send(struct tpm_chip
*chip
, u8
*buf
, size_t count
)
290 struct proxy_dev
*proxy_dev
= dev_get_drvdata(&chip
->dev
);
293 if (count
> sizeof(proxy_dev
->buffer
)) {
295 "Invalid size in send: count=%zd, buffer size=%zd\n",
296 count
, sizeof(proxy_dev
->buffer
));
300 mutex_lock(&proxy_dev
->buf_lock
);
302 if (!(proxy_dev
->state
& STATE_OPENED_FLAG
)) {
303 mutex_unlock(&proxy_dev
->buf_lock
);
307 proxy_dev
->resp_len
= 0;
309 proxy_dev
->req_len
= count
;
310 memcpy(proxy_dev
->buffer
, buf
, count
);
312 proxy_dev
->state
&= ~STATE_WAIT_RESPONSE_FLAG
;
314 mutex_unlock(&proxy_dev
->buf_lock
);
316 wake_up_interruptible(&proxy_dev
->wq
);
321 static void vtpm_proxy_tpm_op_cancel(struct tpm_chip
*chip
)
326 static u8
vtpm_proxy_tpm_op_status(struct tpm_chip
*chip
)
328 struct proxy_dev
*proxy_dev
= dev_get_drvdata(&chip
->dev
);
330 if (proxy_dev
->resp_len
)
331 return VTPM_PROXY_REQ_COMPLETE_FLAG
;
336 static bool vtpm_proxy_tpm_req_canceled(struct tpm_chip
*chip
, u8 status
)
338 struct proxy_dev
*proxy_dev
= dev_get_drvdata(&chip
->dev
);
341 mutex_lock(&proxy_dev
->buf_lock
);
343 ret
= !(proxy_dev
->state
& STATE_OPENED_FLAG
);
345 mutex_unlock(&proxy_dev
->buf_lock
);
350 static const struct tpm_class_ops vtpm_proxy_tpm_ops
= {
351 .flags
= TPM_OPS_AUTO_STARTUP
,
352 .recv
= vtpm_proxy_tpm_op_recv
,
353 .send
= vtpm_proxy_tpm_op_send
,
354 .cancel
= vtpm_proxy_tpm_op_cancel
,
355 .status
= vtpm_proxy_tpm_op_status
,
356 .req_complete_mask
= VTPM_PROXY_REQ_COMPLETE_FLAG
,
357 .req_complete_val
= VTPM_PROXY_REQ_COMPLETE_FLAG
,
358 .req_canceled
= vtpm_proxy_tpm_req_canceled
,
362 * Code related to the startup of the TPM 2 and startup of TPM 1.2 +
363 * retrieval of timeouts and durations.
366 static void vtpm_proxy_work(struct work_struct
*work
)
368 struct proxy_dev
*proxy_dev
= container_of(work
, struct proxy_dev
,
372 rc
= tpm_chip_register(proxy_dev
->chip
);
374 vtpm_proxy_fops_undo_open(proxy_dev
);
376 proxy_dev
->state
|= STATE_REGISTERED_FLAG
;
380 * vtpm_proxy_work_stop: make sure the work has finished
382 * This function is useful when user space closed the fd
383 * while the driver still determines timeouts.
385 static void vtpm_proxy_work_stop(struct proxy_dev
*proxy_dev
)
387 vtpm_proxy_fops_undo_open(proxy_dev
);
388 flush_work(&proxy_dev
->work
);
392 * vtpm_proxy_work_start: Schedule the work for TPM 1.2 & 2 initialization
394 static inline void vtpm_proxy_work_start(struct proxy_dev
*proxy_dev
)
396 queue_work(workqueue
, &proxy_dev
->work
);
400 * Code related to creation and deletion of device pairs
402 static struct proxy_dev
*vtpm_proxy_create_proxy_dev(void)
404 struct proxy_dev
*proxy_dev
;
405 struct tpm_chip
*chip
;
408 proxy_dev
= kzalloc(sizeof(*proxy_dev
), GFP_KERNEL
);
409 if (proxy_dev
== NULL
)
410 return ERR_PTR(-ENOMEM
);
412 init_waitqueue_head(&proxy_dev
->wq
);
413 mutex_init(&proxy_dev
->buf_lock
);
414 INIT_WORK(&proxy_dev
->work
, vtpm_proxy_work
);
416 chip
= tpm_chip_alloc(NULL
, &vtpm_proxy_tpm_ops
);
419 goto err_proxy_dev_free
;
421 dev_set_drvdata(&chip
->dev
, proxy_dev
);
423 proxy_dev
->chip
= chip
;
434 * Undo what has been done in vtpm_create_proxy_dev
436 static inline void vtpm_proxy_delete_proxy_dev(struct proxy_dev
*proxy_dev
)
438 put_device(&proxy_dev
->chip
->dev
); /* frees chip */
443 * Create a /dev/tpm%d and 'server side' file descriptor pair
446 * Returns file pointer on success, an error value otherwise
448 static struct file
*vtpm_proxy_create_device(
449 struct vtpm_proxy_new_dev
*vtpm_new_dev
)
451 struct proxy_dev
*proxy_dev
;
455 if (vtpm_new_dev
->flags
& ~VTPM_PROXY_FLAGS_ALL
)
456 return ERR_PTR(-EOPNOTSUPP
);
458 proxy_dev
= vtpm_proxy_create_proxy_dev();
459 if (IS_ERR(proxy_dev
))
460 return ERR_CAST(proxy_dev
);
462 proxy_dev
->flags
= vtpm_new_dev
->flags
;
464 /* setup an anonymous file for the server-side */
465 fd
= get_unused_fd_flags(O_RDWR
);
468 goto err_delete_proxy_dev
;
471 file
= anon_inode_getfile("[vtpms]", &vtpm_proxy_fops
, proxy_dev
,
475 goto err_put_unused_fd
;
478 /* from now on we can unwind with put_unused_fd() + fput() */
479 /* simulate an open() on the server side */
480 vtpm_proxy_fops_open(file
);
482 if (proxy_dev
->flags
& VTPM_PROXY_FLAG_TPM2
)
483 proxy_dev
->chip
->flags
|= TPM_CHIP_FLAG_TPM2
;
485 vtpm_proxy_work_start(proxy_dev
);
487 vtpm_new_dev
->fd
= fd
;
488 vtpm_new_dev
->major
= MAJOR(proxy_dev
->chip
->dev
.devt
);
489 vtpm_new_dev
->minor
= MINOR(proxy_dev
->chip
->dev
.devt
);
490 vtpm_new_dev
->tpm_num
= proxy_dev
->chip
->dev_num
;
497 err_delete_proxy_dev
:
498 vtpm_proxy_delete_proxy_dev(proxy_dev
);
504 * Counter part to vtpm_create_device.
506 static void vtpm_proxy_delete_device(struct proxy_dev
*proxy_dev
)
508 vtpm_proxy_work_stop(proxy_dev
);
511 * A client may hold the 'ops' lock, so let it know that the server
512 * side shuts down before we try to grab the 'ops' lock when
513 * unregistering the chip.
515 vtpm_proxy_fops_undo_open(proxy_dev
);
517 if (proxy_dev
->state
& STATE_REGISTERED_FLAG
)
518 tpm_chip_unregister(proxy_dev
->chip
);
520 vtpm_proxy_delete_proxy_dev(proxy_dev
);
524 * Code related to the control device /dev/vtpmx
528 * vtpmx_ioc_new_dev - handler for the %VTPM_PROXY_IOC_NEW_DEV ioctl
530 * @ioctl: the ioctl number
531 * @arg: pointer to the struct vtpmx_proxy_new_dev
533 * Creates an anonymous file that is used by the process acting as a TPM to
534 * communicate with the client processes. The function will also add a new TPM
535 * device through which data is proxied to this TPM acting process. The caller
536 * will be provided with a file descriptor to communicate with the clients and
537 * major and minor numbers for the TPM device.
539 static long vtpmx_ioc_new_dev(struct file
*file
, unsigned int ioctl
,
542 void __user
*argp
= (void __user
*)arg
;
543 struct vtpm_proxy_new_dev __user
*vtpm_new_dev_p
;
544 struct vtpm_proxy_new_dev vtpm_new_dev
;
545 struct file
*vtpm_file
;
547 if (!capable(CAP_SYS_ADMIN
))
550 vtpm_new_dev_p
= argp
;
552 if (copy_from_user(&vtpm_new_dev
, vtpm_new_dev_p
,
553 sizeof(vtpm_new_dev
)))
556 vtpm_file
= vtpm_proxy_create_device(&vtpm_new_dev
);
557 if (IS_ERR(vtpm_file
))
558 return PTR_ERR(vtpm_file
);
560 if (copy_to_user(vtpm_new_dev_p
, &vtpm_new_dev
,
561 sizeof(vtpm_new_dev
))) {
562 put_unused_fd(vtpm_new_dev
.fd
);
567 fd_install(vtpm_new_dev
.fd
, vtpm_file
);
572 * vtpmx_fops_ioctl: ioctl on /dev/vtpmx
575 * Returns 0 on success, a negative error code otherwise.
577 static long vtpmx_fops_ioctl(struct file
*f
, unsigned int ioctl
,
581 case VTPM_PROXY_IOC_NEW_DEV
:
582 return vtpmx_ioc_new_dev(f
, ioctl
, arg
);
589 static long vtpmx_fops_compat_ioctl(struct file
*f
, unsigned int ioctl
,
592 return vtpmx_fops_ioctl(f
, ioctl
, (unsigned long)compat_ptr(arg
));
596 static const struct file_operations vtpmx_fops
= {
597 .owner
= THIS_MODULE
,
598 .unlocked_ioctl
= vtpmx_fops_ioctl
,
600 .compat_ioctl
= vtpmx_fops_compat_ioctl
,
602 .llseek
= noop_llseek
,
605 static struct miscdevice vtpmx_miscdev
= {
606 .minor
= MISC_DYNAMIC_MINOR
,
611 static int vtpmx_init(void)
613 return misc_register(&vtpmx_miscdev
);
616 static void vtpmx_cleanup(void)
618 misc_deregister(&vtpmx_miscdev
);
621 static int __init
vtpm_module_init(void)
627 pr_err("couldn't create vtpmx device\n");
631 workqueue
= create_workqueue("tpm-vtpm");
633 pr_err("couldn't create workqueue\n");
635 goto err_vtpmx_cleanup
;
646 static void __exit
vtpm_module_exit(void)
648 destroy_workqueue(workqueue
);
652 module_init(vtpm_module_init
);
653 module_exit(vtpm_module_exit
);
655 MODULE_AUTHOR("Stefan Berger (stefanb@us.ibm.com)");
656 MODULE_DESCRIPTION("vTPM Driver");
657 MODULE_VERSION("0.1");
658 MODULE_LICENSE("GPL");