1 /*
2 * Copyright (C) 2004 IBM Corporation
3 * Authors:
4 * Leendert van Doorn <leendert@watson.ibm.com>
5 * Dave Safford <safford@watson.ibm.com>
6 * Reiner Sailer <sailer@watson.ibm.com>
7 * Kylene Hall <kjhall@us.ibm.com>
8 *
9 * Copyright (C) 2013 Obsidian Research Corp
10 * Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
11 *
12 * Device file system interface to the TPM
13 *
14 * This program is free software; you can redistribute it and/or
15 * modify it under the terms of the GNU General Public License as
16 * published by the Free Software Foundation, version 2 of the
17 * License.
18 *
19 */
20 #include <linux/slab.h>
21 #include <linux/uaccess.h>
22 #include "tpm.h"
23
24 struct file_priv {
25 struct tpm_chip *chip;
26
27 /* Data passed to and from the tpm via the read/write calls */
28 atomic_t data_pending;
29 struct mutex buffer_mutex;
30
31 struct timer_list user_read_timer; /* user needs to claim result */
32 struct work_struct work;
33
34 u8 data_buffer[TPM_BUFSIZE];
35 };
36
user_reader_timeout(unsigned long ptr)37 static void user_reader_timeout(unsigned long ptr)
38 {
39 struct file_priv *priv = (struct file_priv *)ptr;
40
41 schedule_work(&priv->work);
42 }
43
timeout_work(struct work_struct * work)44 static void timeout_work(struct work_struct *work)
45 {
46 struct file_priv *priv = container_of(work, struct file_priv, work);
47
48 mutex_lock(&priv->buffer_mutex);
49 atomic_set(&priv->data_pending, 0);
50 memset(priv->data_buffer, 0, sizeof(priv->data_buffer));
51 mutex_unlock(&priv->buffer_mutex);
52 }
53
tpm_open(struct inode * inode,struct file * file)54 static int tpm_open(struct inode *inode, struct file *file)
55 {
56 struct tpm_chip *chip =
57 container_of(inode->i_cdev, struct tpm_chip, cdev);
58 struct file_priv *priv;
59
60 /* It's assured that the chip will be opened just once,
61 * by the check of is_open variable, which is protected
62 * by driver_lock. */
63 if (test_and_set_bit(0, &chip->is_open)) {
64 dev_dbg(&chip->dev, "Another process owns this TPM\n");
65 return -EBUSY;
66 }
67
68 priv = kzalloc(sizeof(*priv), GFP_KERNEL);
69 if (priv == NULL) {
70 clear_bit(0, &chip->is_open);
71 return -ENOMEM;
72 }
73
74 priv->chip = chip;
75 atomic_set(&priv->data_pending, 0);
76 mutex_init(&priv->buffer_mutex);
77 setup_timer(&priv->user_read_timer, user_reader_timeout,
78 (unsigned long)priv);
79 INIT_WORK(&priv->work, timeout_work);
80
81 file->private_data = priv;
82 return 0;
83 }
84
tpm_read(struct file * file,char __user * buf,size_t size,loff_t * off)85 static ssize_t tpm_read(struct file *file, char __user *buf,
86 size_t size, loff_t *off)
87 {
88 struct file_priv *priv = file->private_data;
89 ssize_t ret_size;
90 int rc;
91
92 del_singleshot_timer_sync(&priv->user_read_timer);
93 flush_work(&priv->work);
94 ret_size = atomic_read(&priv->data_pending);
95 if (ret_size > 0) { /* relay data */
96 ssize_t orig_ret_size = ret_size;
97 if (size < ret_size)
98 ret_size = size;
99
100 mutex_lock(&priv->buffer_mutex);
101 rc = copy_to_user(buf, priv->data_buffer, ret_size);
102 memset(priv->data_buffer, 0, orig_ret_size);
103 if (rc)
104 ret_size = -EFAULT;
105
106 mutex_unlock(&priv->buffer_mutex);
107 }
108
109 atomic_set(&priv->data_pending, 0);
110
111 return ret_size;
112 }
113
tpm_write(struct file * file,const char __user * buf,size_t size,loff_t * off)114 static ssize_t tpm_write(struct file *file, const char __user *buf,
115 size_t size, loff_t *off)
116 {
117 struct file_priv *priv = file->private_data;
118 size_t in_size = size;
119 ssize_t out_size;
120
121 /* cannot perform a write until the read has cleared
122 either via tpm_read or a user_read_timer timeout.
123 This also prevents splitted buffered writes from blocking here.
124 */
125 if (atomic_read(&priv->data_pending) != 0)
126 return -EBUSY;
127
128 if (in_size > TPM_BUFSIZE)
129 return -E2BIG;
130
131 mutex_lock(&priv->buffer_mutex);
132
133 if (copy_from_user
134 (priv->data_buffer, (void __user *) buf, in_size)) {
135 mutex_unlock(&priv->buffer_mutex);
136 return -EFAULT;
137 }
138
139 if (in_size < 6 ||
140 in_size < be32_to_cpu(*((__be32 *) (priv->data_buffer + 2)))) {
141 mutex_unlock(&priv->buffer_mutex);
142 return -EINVAL;
143 }
144
145 /* atomic tpm command send and result receive. We only hold the ops
146 * lock during this period so that the tpm can be unregistered even if
147 * the char dev is held open.
148 */
149 if (tpm_try_get_ops(priv->chip)) {
150 mutex_unlock(&priv->buffer_mutex);
151 return -EPIPE;
152 }
153 out_size = tpm_transmit(priv->chip, priv->data_buffer,
154 sizeof(priv->data_buffer), 0);
155
156 tpm_put_ops(priv->chip);
157 if (out_size < 0) {
158 mutex_unlock(&priv->buffer_mutex);
159 return out_size;
160 }
161
162 atomic_set(&priv->data_pending, out_size);
163 mutex_unlock(&priv->buffer_mutex);
164
165 /* Set a timeout by which the reader must come claim the result */
166 mod_timer(&priv->user_read_timer, jiffies + (60 * HZ));
167
168 return in_size;
169 }
170
171 /*
172 * Called on file close
173 */
tpm_release(struct inode * inode,struct file * file)174 static int tpm_release(struct inode *inode, struct file *file)
175 {
176 struct file_priv *priv = file->private_data;
177
178 del_singleshot_timer_sync(&priv->user_read_timer);
179 flush_work(&priv->work);
180 file->private_data = NULL;
181 atomic_set(&priv->data_pending, 0);
182 clear_bit(0, &priv->chip->is_open);
183 kfree(priv);
184 return 0;
185 }
186
187 const struct file_operations tpm_fops = {
188 .owner = THIS_MODULE,
189 .llseek = no_llseek,
190 .open = tpm_open,
191 .read = tpm_read,
192 .write = tpm_write,
193 .release = tpm_release,
194 };
195
196
197