1 /*
2 * Greybus Component Authentication Protocol (CAP) Driver.
3 *
4 * Copyright 2016 Google Inc.
5 * Copyright 2016 Linaro Ltd.
6 *
7 * Released under the GPLv2 only.
8 */
9
10 #include "greybus.h"
11
12 #include <linux/cdev.h>
13 #include <linux/fs.h>
14 #include <linux/ioctl.h>
15 #include <linux/uaccess.h>
16
17 #include "greybus_authentication.h"
18 #include "firmware.h"
19
20 #define CAP_TIMEOUT_MS 1000
21
22 /*
23 * Number of minor devices this driver supports.
24 * There will be exactly one required per Interface.
25 */
26 #define NUM_MINORS U8_MAX
27
28 struct gb_cap {
29 struct device *parent;
30 struct gb_connection *connection;
31 struct kref kref;
32 struct list_head node;
33 bool disabled; /* connection getting disabled */
34
35 struct mutex mutex;
36 struct cdev cdev;
37 struct device *class_device;
38 dev_t dev_num;
39 };
40
41 static struct class *cap_class;
42 static dev_t cap_dev_num;
43 static DEFINE_IDA(cap_minors_map);
44 static LIST_HEAD(cap_list);
45 static DEFINE_MUTEX(list_mutex);
46
cap_kref_release(struct kref * kref)47 static void cap_kref_release(struct kref *kref)
48 {
49 struct gb_cap *cap = container_of(kref, struct gb_cap, kref);
50
51 kfree(cap);
52 }
53
54 /*
55 * All users of cap take a reference (from within list_mutex lock), before
56 * they get a pointer to play with. And the structure will be freed only after
57 * the last user has put the reference to it.
58 */
put_cap(struct gb_cap * cap)59 static void put_cap(struct gb_cap *cap)
60 {
61 kref_put(&cap->kref, cap_kref_release);
62 }
63
64 /* Caller must call put_cap() after using struct gb_cap */
get_cap(struct cdev * cdev)65 static struct gb_cap *get_cap(struct cdev *cdev)
66 {
67 struct gb_cap *cap;
68
69 mutex_lock(&list_mutex);
70
71 list_for_each_entry(cap, &cap_list, node) {
72 if (&cap->cdev == cdev) {
73 kref_get(&cap->kref);
74 goto unlock;
75 }
76 }
77
78 cap = NULL;
79
80 unlock:
81 mutex_unlock(&list_mutex);
82
83 return cap;
84 }
85
cap_get_endpoint_uid(struct gb_cap * cap,u8 * euid)86 static int cap_get_endpoint_uid(struct gb_cap *cap, u8 *euid)
87 {
88 struct gb_connection *connection = cap->connection;
89 struct gb_cap_get_endpoint_uid_response response;
90 int ret;
91
92 ret = gb_operation_sync(connection, GB_CAP_TYPE_GET_ENDPOINT_UID, NULL,
93 0, &response, sizeof(response));
94 if (ret) {
95 dev_err(cap->parent, "failed to get endpoint uid (%d)\n", ret);
96 return ret;
97 }
98
99 memcpy(euid, response.uid, sizeof(response.uid));
100
101 return 0;
102 }
103
cap_get_ims_certificate(struct gb_cap * cap,u32 class,u32 id,u8 * certificate,u32 * size,u8 * result)104 static int cap_get_ims_certificate(struct gb_cap *cap, u32 class, u32 id,
105 u8 *certificate, u32 *size, u8 *result)
106 {
107 struct gb_connection *connection = cap->connection;
108 struct gb_cap_get_ims_certificate_request *request;
109 struct gb_cap_get_ims_certificate_response *response;
110 size_t max_size = gb_operation_get_payload_size_max(connection);
111 struct gb_operation *op;
112 int ret;
113
114 op = gb_operation_create_flags(connection,
115 GB_CAP_TYPE_GET_IMS_CERTIFICATE,
116 sizeof(*request), max_size,
117 GB_OPERATION_FLAG_SHORT_RESPONSE,
118 GFP_KERNEL);
119 if (!op)
120 return -ENOMEM;
121
122 request = op->request->payload;
123 request->certificate_class = cpu_to_le32(class);
124 request->certificate_id = cpu_to_le32(id);
125
126 ret = gb_operation_request_send_sync(op);
127 if (ret) {
128 dev_err(cap->parent, "failed to get certificate (%d)\n", ret);
129 goto done;
130 }
131
132 response = op->response->payload;
133 *result = response->result_code;
134 *size = op->response->payload_size - sizeof(*response);
135 memcpy(certificate, response->certificate, *size);
136
137 done:
138 gb_operation_put(op);
139 return ret;
140 }
141
cap_authenticate(struct gb_cap * cap,u32 auth_type,u8 * uid,u8 * challenge,u8 * result,u8 * auth_response,u32 * signature_size,u8 * signature)142 static int cap_authenticate(struct gb_cap *cap, u32 auth_type, u8 *uid,
143 u8 *challenge, u8 *result, u8 *auth_response,
144 u32 *signature_size, u8 *signature)
145 {
146 struct gb_connection *connection = cap->connection;
147 struct gb_cap_authenticate_request *request;
148 struct gb_cap_authenticate_response *response;
149 size_t max_size = gb_operation_get_payload_size_max(connection);
150 struct gb_operation *op;
151 int ret;
152
153 op = gb_operation_create_flags(connection, GB_CAP_TYPE_AUTHENTICATE,
154 sizeof(*request), max_size,
155 GB_OPERATION_FLAG_SHORT_RESPONSE,
156 GFP_KERNEL);
157 if (!op)
158 return -ENOMEM;
159
160 request = op->request->payload;
161 request->auth_type = cpu_to_le32(auth_type);
162 memcpy(request->uid, uid, sizeof(request->uid));
163 memcpy(request->challenge, challenge, sizeof(request->challenge));
164
165 ret = gb_operation_request_send_sync(op);
166 if (ret) {
167 dev_err(cap->parent, "failed to authenticate (%d)\n", ret);
168 goto done;
169 }
170
171 response = op->response->payload;
172 *result = response->result_code;
173 *signature_size = op->response->payload_size - sizeof(*response);
174 memcpy(auth_response, response->response, sizeof(response->response));
175 memcpy(signature, response->signature, *signature_size);
176
177 done:
178 gb_operation_put(op);
179 return ret;
180 }
181
182 /* Char device fops */
183
cap_open(struct inode * inode,struct file * file)184 static int cap_open(struct inode *inode, struct file *file)
185 {
186 struct gb_cap *cap = get_cap(inode->i_cdev);
187
188 /* cap structure can't get freed until file descriptor is closed */
189 if (cap) {
190 file->private_data = cap;
191 return 0;
192 }
193
194 return -ENODEV;
195 }
196
cap_release(struct inode * inode,struct file * file)197 static int cap_release(struct inode *inode, struct file *file)
198 {
199 struct gb_cap *cap = file->private_data;
200
201 put_cap(cap);
202 return 0;
203 }
204
cap_ioctl(struct gb_cap * cap,unsigned int cmd,void __user * buf)205 static int cap_ioctl(struct gb_cap *cap, unsigned int cmd,
206 void __user *buf)
207 {
208 struct cap_ioc_get_endpoint_uid endpoint_uid;
209 struct cap_ioc_get_ims_certificate *ims_cert;
210 struct cap_ioc_authenticate *authenticate;
211 size_t size;
212 int ret;
213
214 switch (cmd) {
215 case CAP_IOC_GET_ENDPOINT_UID:
216 ret = cap_get_endpoint_uid(cap, endpoint_uid.uid);
217 if (ret)
218 return ret;
219
220 if (copy_to_user(buf, &endpoint_uid, sizeof(endpoint_uid)))
221 return -EFAULT;
222
223 return 0;
224 case CAP_IOC_GET_IMS_CERTIFICATE:
225 size = sizeof(*ims_cert);
226 ims_cert = memdup_user(buf, size);
227 if (IS_ERR(ims_cert))
228 return PTR_ERR(ims_cert);
229
230 ret = cap_get_ims_certificate(cap, ims_cert->certificate_class,
231 ims_cert->certificate_id,
232 ims_cert->certificate,
233 &ims_cert->cert_size,
234 &ims_cert->result_code);
235 if (!ret && copy_to_user(buf, ims_cert, size))
236 ret = -EFAULT;
237 kfree(ims_cert);
238
239 return ret;
240 case CAP_IOC_AUTHENTICATE:
241 size = sizeof(*authenticate);
242 authenticate = memdup_user(buf, size);
243 if (IS_ERR(authenticate))
244 return PTR_ERR(authenticate);
245
246 ret = cap_authenticate(cap, authenticate->auth_type,
247 authenticate->uid,
248 authenticate->challenge,
249 &authenticate->result_code,
250 authenticate->response,
251 &authenticate->signature_size,
252 authenticate->signature);
253 if (!ret && copy_to_user(buf, authenticate, size))
254 ret = -EFAULT;
255 kfree(authenticate);
256
257 return ret;
258 default:
259 return -ENOTTY;
260 }
261 }
262
cap_ioctl_unlocked(struct file * file,unsigned int cmd,unsigned long arg)263 static long cap_ioctl_unlocked(struct file *file, unsigned int cmd,
264 unsigned long arg)
265 {
266 struct gb_cap *cap = file->private_data;
267 struct gb_bundle *bundle = cap->connection->bundle;
268 int ret = -ENODEV;
269
270 /*
271 * Serialize ioctls.
272 *
273 * We don't want the user to do multiple authentication operations in
274 * parallel.
275 *
276 * This is also used to protect ->disabled, which is used to check if
277 * the connection is getting disconnected, so that we don't start any
278 * new operations.
279 */
280 mutex_lock(&cap->mutex);
281 if (!cap->disabled) {
282 ret = gb_pm_runtime_get_sync(bundle);
283 if (!ret) {
284 ret = cap_ioctl(cap, cmd, (void __user *)arg);
285 gb_pm_runtime_put_autosuspend(bundle);
286 }
287 }
288 mutex_unlock(&cap->mutex);
289
290 return ret;
291 }
292
293 static const struct file_operations cap_fops = {
294 .owner = THIS_MODULE,
295 .open = cap_open,
296 .release = cap_release,
297 .unlocked_ioctl = cap_ioctl_unlocked,
298 };
299
gb_cap_connection_init(struct gb_connection * connection)300 int gb_cap_connection_init(struct gb_connection *connection)
301 {
302 struct gb_cap *cap;
303 int ret, minor;
304
305 if (!connection)
306 return 0;
307
308 cap = kzalloc(sizeof(*cap), GFP_KERNEL);
309 if (!cap)
310 return -ENOMEM;
311
312 cap->parent = &connection->bundle->dev;
313 cap->connection = connection;
314 mutex_init(&cap->mutex);
315 gb_connection_set_data(connection, cap);
316 kref_init(&cap->kref);
317
318 mutex_lock(&list_mutex);
319 list_add(&cap->node, &cap_list);
320 mutex_unlock(&list_mutex);
321
322 ret = gb_connection_enable(connection);
323 if (ret)
324 goto err_list_del;
325
326 minor = ida_simple_get(&cap_minors_map, 0, NUM_MINORS, GFP_KERNEL);
327 if (minor < 0) {
328 ret = minor;
329 goto err_connection_disable;
330 }
331
332 /* Add a char device to allow userspace to interact with cap */
333 cap->dev_num = MKDEV(MAJOR(cap_dev_num), minor);
334 cdev_init(&cap->cdev, &cap_fops);
335
336 ret = cdev_add(&cap->cdev, cap->dev_num, 1);
337 if (ret)
338 goto err_remove_ida;
339
340 /* Add a soft link to the previously added char-dev within the bundle */
341 cap->class_device = device_create(cap_class, cap->parent, cap->dev_num,
342 NULL, "gb-authenticate-%d", minor);
343 if (IS_ERR(cap->class_device)) {
344 ret = PTR_ERR(cap->class_device);
345 goto err_del_cdev;
346 }
347
348 return 0;
349
350 err_del_cdev:
351 cdev_del(&cap->cdev);
352 err_remove_ida:
353 ida_simple_remove(&cap_minors_map, minor);
354 err_connection_disable:
355 gb_connection_disable(connection);
356 err_list_del:
357 mutex_lock(&list_mutex);
358 list_del(&cap->node);
359 mutex_unlock(&list_mutex);
360
361 put_cap(cap);
362
363 return ret;
364 }
365
gb_cap_connection_exit(struct gb_connection * connection)366 void gb_cap_connection_exit(struct gb_connection *connection)
367 {
368 struct gb_cap *cap;
369
370 if (!connection)
371 return;
372
373 cap = gb_connection_get_data(connection);
374
375 device_destroy(cap_class, cap->dev_num);
376 cdev_del(&cap->cdev);
377 ida_simple_remove(&cap_minors_map, MINOR(cap->dev_num));
378
379 /*
380 * Disallow any new ioctl operations on the char device and wait for
381 * existing ones to finish.
382 */
383 mutex_lock(&cap->mutex);
384 cap->disabled = true;
385 mutex_unlock(&cap->mutex);
386
387 /* All pending greybus operations should have finished by now */
388 gb_connection_disable(cap->connection);
389
390 /* Disallow new users to get access to the cap structure */
391 mutex_lock(&list_mutex);
392 list_del(&cap->node);
393 mutex_unlock(&list_mutex);
394
395 /*
396 * All current users of cap would have taken a reference to it by
397 * now, we can drop our reference and wait the last user will get
398 * cap freed.
399 */
400 put_cap(cap);
401 }
402
cap_init(void)403 int cap_init(void)
404 {
405 int ret;
406
407 cap_class = class_create(THIS_MODULE, "gb_authenticate");
408 if (IS_ERR(cap_class))
409 return PTR_ERR(cap_class);
410
411 ret = alloc_chrdev_region(&cap_dev_num, 0, NUM_MINORS,
412 "gb_authenticate");
413 if (ret)
414 goto err_remove_class;
415
416 return 0;
417
418 err_remove_class:
419 class_destroy(cap_class);
420 return ret;
421 }
422
cap_exit(void)423 void cap_exit(void)
424 {
425 unregister_chrdev_region(cap_dev_num, NUM_MINORS);
426 class_destroy(cap_class);
427 ida_destroy(&cap_minors_map);
428 }
429