2 * Copyright (C) 2015, 2016 IBM Corporation
3 * Copyright (C) 2016 Intel Corporation
5 * Author: Stefan Berger <stefanb@us.ibm.com>
7 * Maintained by: <tpmdd-devel@lists.sourceforge.net>
9 * Device driver for vTPM (vTPM proxy driver)
11 * This program is free software; you can redistribute it and/or
12 * modify it under the terms of the GNU General Public License as
13 * published by the Free Software Foundation, version 2 of the
18 #include <linux/types.h>
19 #include <linux/spinlock.h>
20 #include <linux/uaccess.h>
21 #include <linux/wait.h>
22 #include <linux/miscdevice.h>
23 #include <linux/vtpm_proxy.h>
24 #include <linux/file.h>
25 #include <linux/anon_inodes.h>
26 #include <linux/poll.h>
27 #include <linux/compat.h>
31 #define VTPM_PROXY_REQ_COMPLETE_FLAG BIT(0)
34 struct tpm_chip *chip;
36 u32 flags; /* public API flags */
40 struct mutex buf_lock; /* protect buffer and flags */
42 long state; /* internal state */
43 #define STATE_OPENED_FLAG BIT(0)
44 #define STATE_WAIT_RESPONSE_FLAG BIT(1) /* waiting for emulator response */
45 #define STATE_REGISTERED_FLAG BIT(2)
46 #define STATE_DRIVER_COMMAND BIT(3) /* sending a driver specific command */
48 size_t req_len; /* length of queued TPM request */
49 size_t resp_len; /* length of queued TPM response */
50 u8 buffer[TPM_BUFSIZE]; /* request/response buffer */
52 struct work_struct work; /* task that retrieves TPM timeouts */
55 /* all supported flags */
56 #define VTPM_PROXY_FLAGS_ALL (VTPM_PROXY_FLAG_TPM2)
58 static struct workqueue_struct *workqueue;
60 static void vtpm_proxy_delete_device(struct proxy_dev *proxy_dev);
63 * Functions related to 'server side'
67 * vtpm_proxy_fops_read - Read TPM commands on 'server side'
71 * @count: number of bytes to read
75 * Number of bytes read or negative error code
77 static ssize_t vtpm_proxy_fops_read(struct file *filp, char __user *buf,
78 size_t count, loff_t *off)
80 struct proxy_dev *proxy_dev = filp->private_data;
84 sig = wait_event_interruptible(proxy_dev->wq,
85 proxy_dev->req_len != 0 ||
86 !(proxy_dev->state & STATE_OPENED_FLAG));
90 mutex_lock(&proxy_dev->buf_lock);
92 if (!(proxy_dev->state & STATE_OPENED_FLAG)) {
93 mutex_unlock(&proxy_dev->buf_lock);
97 len = proxy_dev->req_len;
100 mutex_unlock(&proxy_dev->buf_lock);
101 pr_debug("Invalid size in recv: count=%zd, req_len=%zd\n",
106 rc = copy_to_user(buf, proxy_dev->buffer, len);
107 memset(proxy_dev->buffer, 0, len);
108 proxy_dev->req_len = 0;
111 proxy_dev->state |= STATE_WAIT_RESPONSE_FLAG;
113 mutex_unlock(&proxy_dev->buf_lock);
122 * vtpm_proxy_fops_write - Write TPM responses on 'server side'
124 * @filp: file pointer
126 * @count: number of bytes to write
130 * Number of bytes read or negative error value
132 static ssize_t vtpm_proxy_fops_write(struct file *filp, const char __user *buf,
133 size_t count, loff_t *off)
135 struct proxy_dev *proxy_dev = filp->private_data;
137 mutex_lock(&proxy_dev->buf_lock);
139 if (!(proxy_dev->state & STATE_OPENED_FLAG)) {
140 mutex_unlock(&proxy_dev->buf_lock);
144 if (count > sizeof(proxy_dev->buffer) ||
145 !(proxy_dev->state & STATE_WAIT_RESPONSE_FLAG)) {
146 mutex_unlock(&proxy_dev->buf_lock);
150 proxy_dev->state &= ~STATE_WAIT_RESPONSE_FLAG;
152 proxy_dev->req_len = 0;
154 if (copy_from_user(proxy_dev->buffer, buf, count)) {
155 mutex_unlock(&proxy_dev->buf_lock);
159 proxy_dev->resp_len = count;
161 mutex_unlock(&proxy_dev->buf_lock);
163 wake_up_interruptible(&proxy_dev->wq);
169 * vtpm_proxy_fops_poll - Poll status on 'server side'
171 * @filp: file pointer
176 static unsigned int vtpm_proxy_fops_poll(struct file *filp, poll_table *wait)
178 struct proxy_dev *proxy_dev = filp->private_data;
181 poll_wait(filp, &proxy_dev->wq, wait);
185 mutex_lock(&proxy_dev->buf_lock);
187 if (proxy_dev->req_len)
188 ret |= POLLIN | POLLRDNORM;
190 if (!(proxy_dev->state & STATE_OPENED_FLAG))
193 mutex_unlock(&proxy_dev->buf_lock);
199 * vtpm_proxy_fops_open - Open vTPM device on 'server side'
201 * @filp: file pointer
203 * Called when setting up the anonymous file descriptor
205 static void vtpm_proxy_fops_open(struct file *filp)
207 struct proxy_dev *proxy_dev = filp->private_data;
209 proxy_dev->state |= STATE_OPENED_FLAG;
213 * vtpm_proxy_fops_undo_open - counter-part to vtpm_fops_open
214 * Call to undo vtpm_proxy_fops_open
216 *@proxy_dev: tpm proxy device
218 static void vtpm_proxy_fops_undo_open(struct proxy_dev *proxy_dev)
220 mutex_lock(&proxy_dev->buf_lock);
222 proxy_dev->state &= ~STATE_OPENED_FLAG;
224 mutex_unlock(&proxy_dev->buf_lock);
226 /* no more TPM responses -- wake up anyone waiting for them */
227 wake_up_interruptible(&proxy_dev->wq);
231 * vtpm_proxy_fops_release - Close 'server side'
234 * @filp: file pointer
238 static int vtpm_proxy_fops_release(struct inode *inode, struct file *filp)
240 struct proxy_dev *proxy_dev = filp->private_data;
242 filp->private_data = NULL;
244 vtpm_proxy_delete_device(proxy_dev);
249 static const struct file_operations vtpm_proxy_fops = {
250 .owner = THIS_MODULE,
252 .read = vtpm_proxy_fops_read,
253 .write = vtpm_proxy_fops_write,
254 .poll = vtpm_proxy_fops_poll,
255 .release = vtpm_proxy_fops_release,
259 * Functions invoked by the core TPM driver to send TPM commands to
260 * 'server side' and receive responses from there.
264 * Called when core TPM driver reads TPM responses from 'server side'
266 * @chip: tpm chip to use
267 * @buf: receive buffer
268 * @count: bytes to read
270 * Number of TPM response bytes read, negative error value otherwise
272 static int vtpm_proxy_tpm_op_recv(struct tpm_chip *chip, u8 *buf, size_t count)
274 struct proxy_dev *proxy_dev = dev_get_drvdata(&chip->dev);
278 mutex_lock(&proxy_dev->buf_lock);
280 if (!(proxy_dev->state & STATE_OPENED_FLAG)) {
281 mutex_unlock(&proxy_dev->buf_lock);
285 len = proxy_dev->resp_len;
288 "Invalid size in recv: count=%zd, resp_len=%zd\n",
294 memcpy(buf, proxy_dev->buffer, len);
295 proxy_dev->resp_len = 0;
298 mutex_unlock(&proxy_dev->buf_lock);
303 static int vtpm_proxy_is_driver_command(struct tpm_chip *chip,
304 u8 *buf, size_t count)
306 struct tpm_input_header *hdr = (struct tpm_input_header *)buf;
308 if (count < sizeof(struct tpm_input_header))
311 if (chip->flags & TPM_CHIP_FLAG_TPM2) {
312 switch (be32_to_cpu(hdr->ordinal)) {
313 case TPM2_CC_SET_LOCALITY:
317 switch (be32_to_cpu(hdr->ordinal)) {
318 case TPM_ORD_SET_LOCALITY:
326 * Called when core TPM driver forwards TPM requests to 'server side'.
328 * @chip: tpm chip to use
330 * @count: bytes to send
333 * 0 in case of success, negative error value otherwise.
335 static int vtpm_proxy_tpm_op_send(struct tpm_chip *chip, u8 *buf, size_t count)
337 struct proxy_dev *proxy_dev = dev_get_drvdata(&chip->dev);
339 if (count > sizeof(proxy_dev->buffer)) {
341 "Invalid size in send: count=%zd, buffer size=%zd\n",
342 count, sizeof(proxy_dev->buffer));
346 if (!(proxy_dev->state & STATE_DRIVER_COMMAND) &&
347 vtpm_proxy_is_driver_command(chip, buf, count))
350 mutex_lock(&proxy_dev->buf_lock);
352 if (!(proxy_dev->state & STATE_OPENED_FLAG)) {
353 mutex_unlock(&proxy_dev->buf_lock);
357 proxy_dev->resp_len = 0;
359 proxy_dev->req_len = count;
360 memcpy(proxy_dev->buffer, buf, count);
362 proxy_dev->state &= ~STATE_WAIT_RESPONSE_FLAG;
364 mutex_unlock(&proxy_dev->buf_lock);
366 wake_up_interruptible(&proxy_dev->wq);
371 static void vtpm_proxy_tpm_op_cancel(struct tpm_chip *chip)
376 static u8 vtpm_proxy_tpm_op_status(struct tpm_chip *chip)
378 struct proxy_dev *proxy_dev = dev_get_drvdata(&chip->dev);
380 if (proxy_dev->resp_len)
381 return VTPM_PROXY_REQ_COMPLETE_FLAG;
386 static bool vtpm_proxy_tpm_req_canceled(struct tpm_chip *chip, u8 status)
388 struct proxy_dev *proxy_dev = dev_get_drvdata(&chip->dev);
391 mutex_lock(&proxy_dev->buf_lock);
393 ret = !(proxy_dev->state & STATE_OPENED_FLAG);
395 mutex_unlock(&proxy_dev->buf_lock);
400 static int vtpm_proxy_request_locality(struct tpm_chip *chip, int locality)
404 const struct tpm_output_header *header;
405 struct proxy_dev *proxy_dev = dev_get_drvdata(&chip->dev);
407 if (chip->flags & TPM_CHIP_FLAG_TPM2)
408 rc = tpm_buf_init(&buf, TPM2_ST_SESSIONS,
409 TPM2_CC_SET_LOCALITY);
411 rc = tpm_buf_init(&buf, TPM_TAG_RQU_COMMAND,
412 TPM_ORD_SET_LOCALITY);
415 tpm_buf_append_u8(&buf, locality);
417 proxy_dev->state |= STATE_DRIVER_COMMAND;
419 rc = tpm_transmit_cmd(chip, NULL, buf.data, tpm_buf_length(&buf), 0,
420 TPM_TRANSMIT_UNLOCKED | TPM_TRANSMIT_RAW,
421 "attempting to set locality");
423 proxy_dev->state &= ~STATE_DRIVER_COMMAND;
430 header = (const struct tpm_output_header *)buf.data;
431 rc = be32_to_cpu(header->return_code);
436 tpm_buf_destroy(&buf);
441 static const struct tpm_class_ops vtpm_proxy_tpm_ops = {
442 .flags = TPM_OPS_AUTO_STARTUP,
443 .recv = vtpm_proxy_tpm_op_recv,
444 .send = vtpm_proxy_tpm_op_send,
445 .cancel = vtpm_proxy_tpm_op_cancel,
446 .status = vtpm_proxy_tpm_op_status,
447 .req_complete_mask = VTPM_PROXY_REQ_COMPLETE_FLAG,
448 .req_complete_val = VTPM_PROXY_REQ_COMPLETE_FLAG,
449 .req_canceled = vtpm_proxy_tpm_req_canceled,
450 .request_locality = vtpm_proxy_request_locality,
454 * Code related to the startup of the TPM 2 and startup of TPM 1.2 +
455 * retrieval of timeouts and durations.
458 static void vtpm_proxy_work(struct work_struct *work)
460 struct proxy_dev *proxy_dev = container_of(work, struct proxy_dev,
464 rc = tpm_chip_register(proxy_dev->chip);
466 vtpm_proxy_fops_undo_open(proxy_dev);
468 proxy_dev->state |= STATE_REGISTERED_FLAG;
472 * vtpm_proxy_work_stop: make sure the work has finished
474 * This function is useful when user space closed the fd
475 * while the driver still determines timeouts.
477 static void vtpm_proxy_work_stop(struct proxy_dev *proxy_dev)
479 vtpm_proxy_fops_undo_open(proxy_dev);
480 flush_work(&proxy_dev->work);
484 * vtpm_proxy_work_start: Schedule the work for TPM 1.2 & 2 initialization
486 static inline void vtpm_proxy_work_start(struct proxy_dev *proxy_dev)
488 queue_work(workqueue, &proxy_dev->work);
492 * Code related to creation and deletion of device pairs
494 static struct proxy_dev *vtpm_proxy_create_proxy_dev(void)
496 struct proxy_dev *proxy_dev;
497 struct tpm_chip *chip;
500 proxy_dev = kzalloc(sizeof(*proxy_dev), GFP_KERNEL);
501 if (proxy_dev == NULL)
502 return ERR_PTR(-ENOMEM);
504 init_waitqueue_head(&proxy_dev->wq);
505 mutex_init(&proxy_dev->buf_lock);
506 INIT_WORK(&proxy_dev->work, vtpm_proxy_work);
508 chip = tpm_chip_alloc(NULL, &vtpm_proxy_tpm_ops);
511 goto err_proxy_dev_free;
513 dev_set_drvdata(&chip->dev, proxy_dev);
515 proxy_dev->chip = chip;
526 * Undo what has been done in vtpm_create_proxy_dev
528 static inline void vtpm_proxy_delete_proxy_dev(struct proxy_dev *proxy_dev)
530 put_device(&proxy_dev->chip->dev); /* frees chip */
535 * Create a /dev/tpm%d and 'server side' file descriptor pair
538 * Returns file pointer on success, an error value otherwise
540 static struct file *vtpm_proxy_create_device(
541 struct vtpm_proxy_new_dev *vtpm_new_dev)
543 struct proxy_dev *proxy_dev;
547 if (vtpm_new_dev->flags & ~VTPM_PROXY_FLAGS_ALL)
548 return ERR_PTR(-EOPNOTSUPP);
550 proxy_dev = vtpm_proxy_create_proxy_dev();
551 if (IS_ERR(proxy_dev))
552 return ERR_CAST(proxy_dev);
554 proxy_dev->flags = vtpm_new_dev->flags;
556 /* setup an anonymous file for the server-side */
557 fd = get_unused_fd_flags(O_RDWR);
560 goto err_delete_proxy_dev;
563 file = anon_inode_getfile("[vtpms]", &vtpm_proxy_fops, proxy_dev,
567 goto err_put_unused_fd;
570 /* from now on we can unwind with put_unused_fd() + fput() */
571 /* simulate an open() on the server side */
572 vtpm_proxy_fops_open(file);
574 if (proxy_dev->flags & VTPM_PROXY_FLAG_TPM2)
575 proxy_dev->chip->flags |= TPM_CHIP_FLAG_TPM2;
577 vtpm_proxy_work_start(proxy_dev);
579 vtpm_new_dev->fd = fd;
580 vtpm_new_dev->major = MAJOR(proxy_dev->chip->dev.devt);
581 vtpm_new_dev->minor = MINOR(proxy_dev->chip->dev.devt);
582 vtpm_new_dev->tpm_num = proxy_dev->chip->dev_num;
589 err_delete_proxy_dev:
590 vtpm_proxy_delete_proxy_dev(proxy_dev);
596 * Counter part to vtpm_create_device.
598 static void vtpm_proxy_delete_device(struct proxy_dev *proxy_dev)
600 vtpm_proxy_work_stop(proxy_dev);
603 * A client may hold the 'ops' lock, so let it know that the server
604 * side shuts down before we try to grab the 'ops' lock when
605 * unregistering the chip.
607 vtpm_proxy_fops_undo_open(proxy_dev);
609 if (proxy_dev->state & STATE_REGISTERED_FLAG)
610 tpm_chip_unregister(proxy_dev->chip);
612 vtpm_proxy_delete_proxy_dev(proxy_dev);
616 * Code related to the control device /dev/vtpmx
620 * vtpmx_ioc_new_dev - handler for the %VTPM_PROXY_IOC_NEW_DEV ioctl
622 * @ioctl: the ioctl number
623 * @arg: pointer to the struct vtpmx_proxy_new_dev
625 * Creates an anonymous file that is used by the process acting as a TPM to
626 * communicate with the client processes. The function will also add a new TPM
627 * device through which data is proxied to this TPM acting process. The caller
628 * will be provided with a file descriptor to communicate with the clients and
629 * major and minor numbers for the TPM device.
631 static long vtpmx_ioc_new_dev(struct file *file, unsigned int ioctl,
634 void __user *argp = (void __user *)arg;
635 struct vtpm_proxy_new_dev __user *vtpm_new_dev_p;
636 struct vtpm_proxy_new_dev vtpm_new_dev;
637 struct file *vtpm_file;
639 if (!capable(CAP_SYS_ADMIN))
642 vtpm_new_dev_p = argp;
644 if (copy_from_user(&vtpm_new_dev, vtpm_new_dev_p,
645 sizeof(vtpm_new_dev)))
648 vtpm_file = vtpm_proxy_create_device(&vtpm_new_dev);
649 if (IS_ERR(vtpm_file))
650 return PTR_ERR(vtpm_file);
652 if (copy_to_user(vtpm_new_dev_p, &vtpm_new_dev,
653 sizeof(vtpm_new_dev))) {
654 put_unused_fd(vtpm_new_dev.fd);
659 fd_install(vtpm_new_dev.fd, vtpm_file);
664 * vtpmx_fops_ioctl: ioctl on /dev/vtpmx
667 * Returns 0 on success, a negative error code otherwise.
669 static long vtpmx_fops_ioctl(struct file *f, unsigned int ioctl,
673 case VTPM_PROXY_IOC_NEW_DEV:
674 return vtpmx_ioc_new_dev(f, ioctl, arg);
681 static long vtpmx_fops_compat_ioctl(struct file *f, unsigned int ioctl,
684 return vtpmx_fops_ioctl(f, ioctl, (unsigned long)compat_ptr(arg));
688 static const struct file_operations vtpmx_fops = {
689 .owner = THIS_MODULE,
690 .unlocked_ioctl = vtpmx_fops_ioctl,
692 .compat_ioctl = vtpmx_fops_compat_ioctl,
694 .llseek = noop_llseek,
697 static struct miscdevice vtpmx_miscdev = {
698 .minor = MISC_DYNAMIC_MINOR,
703 static int __init vtpm_module_init(void)
707 workqueue = create_workqueue("tpm-vtpm");
709 pr_err("couldn't create workqueue\n");
713 rc = misc_register(&vtpmx_miscdev);
715 pr_err("couldn't create vtpmx device\n");
716 destroy_workqueue(workqueue);
722 static void __exit vtpm_module_exit(void)
724 destroy_workqueue(workqueue);
725 misc_deregister(&vtpmx_miscdev);
728 module_init(vtpm_module_init);
729 module_exit(vtpm_module_exit);
731 MODULE_AUTHOR("Stefan Berger (stefanb@us.ibm.com)");
732 MODULE_DESCRIPTION("vTPM Driver");
733 MODULE_VERSION("0.1");
734 MODULE_LICENSE("GPL");