1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * Greybus Component Authentication Protocol (CAP) Driver. 4 * 5 * Copyright 2016 Google Inc. 6 * Copyright 2016 Linaro Ltd. 7 */ 8 9 #include <linux/greybus.h> 10 #include <linux/cdev.h> 11 #include <linux/fs.h> 12 #include <linux/ioctl.h> 13 #include <linux/uaccess.h> 14 15 #include "greybus_authentication.h" 16 #include "firmware.h" 17 18 #define CAP_TIMEOUT_MS 1000 19 20 /* 21 * Number of minor devices this driver supports. 22 * There will be exactly one required per Interface. 23 */ 24 #define NUM_MINORS U8_MAX 25 26 struct gb_cap { 27 struct device *parent; 28 struct gb_connection *connection; 29 struct kref kref; 30 struct list_head node; 31 bool disabled; /* connection getting disabled */ 32 33 struct mutex mutex; 34 struct cdev cdev; 35 struct device *class_device; 36 dev_t dev_num; 37 }; 38 39 static struct class *cap_class; 40 static dev_t cap_dev_num; 41 static DEFINE_IDA(cap_minors_map); 42 static LIST_HEAD(cap_list); 43 static DEFINE_MUTEX(list_mutex); 44 45 static void cap_kref_release(struct kref *kref) 46 { 47 struct gb_cap *cap = container_of(kref, struct gb_cap, kref); 48 49 kfree(cap); 50 } 51 52 /* 53 * All users of cap take a reference (from within list_mutex lock), before 54 * they get a pointer to play with. And the structure will be freed only after 55 * the last user has put the reference to it. 56 */ 57 static void put_cap(struct gb_cap *cap) 58 { 59 kref_put(&cap->kref, cap_kref_release); 60 } 61 62 /* Caller must call put_cap() after using struct gb_cap */ 63 static struct gb_cap *get_cap(struct cdev *cdev) 64 { 65 struct gb_cap *cap; 66 67 mutex_lock(&list_mutex); 68 69 list_for_each_entry(cap, &cap_list, node) { 70 if (&cap->cdev == cdev) { 71 kref_get(&cap->kref); 72 goto unlock; 73 } 74 } 75 76 cap = NULL; 77 78 unlock: 79 mutex_unlock(&list_mutex); 80 81 return cap; 82 } 83 84 static int cap_get_endpoint_uid(struct gb_cap *cap, u8 *euid) 85 { 86 struct gb_connection *connection = cap->connection; 87 struct gb_cap_get_endpoint_uid_response response; 88 int ret; 89 90 ret = gb_operation_sync(connection, GB_CAP_TYPE_GET_ENDPOINT_UID, NULL, 91 0, &response, sizeof(response)); 92 if (ret) { 93 dev_err(cap->parent, "failed to get endpoint uid (%d)\n", ret); 94 return ret; 95 } 96 97 memcpy(euid, response.uid, sizeof(response.uid)); 98 99 return 0; 100 } 101 102 static int cap_get_ims_certificate(struct gb_cap *cap, u32 class, u32 id, 103 u8 *certificate, u32 *size, u8 *result) 104 { 105 struct gb_connection *connection = cap->connection; 106 struct gb_cap_get_ims_certificate_request *request; 107 struct gb_cap_get_ims_certificate_response *response; 108 size_t max_size = gb_operation_get_payload_size_max(connection); 109 struct gb_operation *op; 110 int ret; 111 112 op = gb_operation_create_flags(connection, 113 GB_CAP_TYPE_GET_IMS_CERTIFICATE, 114 sizeof(*request), max_size, 115 GB_OPERATION_FLAG_SHORT_RESPONSE, 116 GFP_KERNEL); 117 if (!op) 118 return -ENOMEM; 119 120 request = op->request->payload; 121 request->certificate_class = cpu_to_le32(class); 122 request->certificate_id = cpu_to_le32(id); 123 124 ret = gb_operation_request_send_sync(op); 125 if (ret) { 126 dev_err(cap->parent, "failed to get certificate (%d)\n", ret); 127 goto done; 128 } 129 130 response = op->response->payload; 131 *result = response->result_code; 132 *size = op->response->payload_size - sizeof(*response); 133 memcpy(certificate, response->certificate, *size); 134 135 done: 136 gb_operation_put(op); 137 return ret; 138 } 139 140 static int cap_authenticate(struct gb_cap *cap, u32 auth_type, u8 *uid, 141 u8 *challenge, u8 *result, u8 *auth_response, 142 u32 *signature_size, u8 *signature) 143 { 144 struct gb_connection *connection = cap->connection; 145 struct gb_cap_authenticate_request *request; 146 struct gb_cap_authenticate_response *response; 147 size_t max_size = gb_operation_get_payload_size_max(connection); 148 struct gb_operation *op; 149 int ret; 150 151 op = gb_operation_create_flags(connection, GB_CAP_TYPE_AUTHENTICATE, 152 sizeof(*request), max_size, 153 GB_OPERATION_FLAG_SHORT_RESPONSE, 154 GFP_KERNEL); 155 if (!op) 156 return -ENOMEM; 157 158 request = op->request->payload; 159 request->auth_type = cpu_to_le32(auth_type); 160 memcpy(request->uid, uid, sizeof(request->uid)); 161 memcpy(request->challenge, challenge, sizeof(request->challenge)); 162 163 ret = gb_operation_request_send_sync(op); 164 if (ret) { 165 dev_err(cap->parent, "failed to authenticate (%d)\n", ret); 166 goto done; 167 } 168 169 response = op->response->payload; 170 *result = response->result_code; 171 *signature_size = op->response->payload_size - sizeof(*response); 172 memcpy(auth_response, response->response, sizeof(response->response)); 173 memcpy(signature, response->signature, *signature_size); 174 175 done: 176 gb_operation_put(op); 177 return ret; 178 } 179 180 /* Char device fops */ 181 182 static int cap_open(struct inode *inode, struct file *file) 183 { 184 struct gb_cap *cap = get_cap(inode->i_cdev); 185 186 /* cap structure can't get freed until file descriptor is closed */ 187 if (cap) { 188 file->private_data = cap; 189 return 0; 190 } 191 192 return -ENODEV; 193 } 194 195 static int cap_release(struct inode *inode, struct file *file) 196 { 197 struct gb_cap *cap = file->private_data; 198 199 put_cap(cap); 200 return 0; 201 } 202 203 static int cap_ioctl(struct gb_cap *cap, unsigned int cmd, 204 void __user *buf) 205 { 206 struct cap_ioc_get_endpoint_uid endpoint_uid; 207 struct cap_ioc_get_ims_certificate *ims_cert; 208 struct cap_ioc_authenticate *authenticate; 209 size_t size; 210 int ret; 211 212 switch (cmd) { 213 case CAP_IOC_GET_ENDPOINT_UID: 214 ret = cap_get_endpoint_uid(cap, endpoint_uid.uid); 215 if (ret) 216 return ret; 217 218 if (copy_to_user(buf, &endpoint_uid, sizeof(endpoint_uid))) 219 return -EFAULT; 220 221 return 0; 222 case CAP_IOC_GET_IMS_CERTIFICATE: 223 size = sizeof(*ims_cert); 224 ims_cert = memdup_user(buf, size); 225 if (IS_ERR(ims_cert)) 226 return PTR_ERR(ims_cert); 227 228 ret = cap_get_ims_certificate(cap, ims_cert->certificate_class, 229 ims_cert->certificate_id, 230 ims_cert->certificate, 231 &ims_cert->cert_size, 232 &ims_cert->result_code); 233 if (!ret && copy_to_user(buf, ims_cert, size)) 234 ret = -EFAULT; 235 kfree(ims_cert); 236 237 return ret; 238 case CAP_IOC_AUTHENTICATE: 239 size = sizeof(*authenticate); 240 authenticate = memdup_user(buf, size); 241 if (IS_ERR(authenticate)) 242 return PTR_ERR(authenticate); 243 244 ret = cap_authenticate(cap, authenticate->auth_type, 245 authenticate->uid, 246 authenticate->challenge, 247 &authenticate->result_code, 248 authenticate->response, 249 &authenticate->signature_size, 250 authenticate->signature); 251 if (!ret && copy_to_user(buf, authenticate, size)) 252 ret = -EFAULT; 253 kfree(authenticate); 254 255 return ret; 256 default: 257 return -ENOTTY; 258 } 259 } 260 261 static long cap_ioctl_unlocked(struct file *file, unsigned int cmd, 262 unsigned long arg) 263 { 264 struct gb_cap *cap = file->private_data; 265 struct gb_bundle *bundle = cap->connection->bundle; 266 int ret = -ENODEV; 267 268 /* 269 * Serialize ioctls. 270 * 271 * We don't want the user to do multiple authentication operations in 272 * parallel. 273 * 274 * This is also used to protect ->disabled, which is used to check if 275 * the connection is getting disconnected, so that we don't start any 276 * new operations. 277 */ 278 mutex_lock(&cap->mutex); 279 if (!cap->disabled) { 280 ret = gb_pm_runtime_get_sync(bundle); 281 if (!ret) { 282 ret = cap_ioctl(cap, cmd, (void __user *)arg); 283 gb_pm_runtime_put_autosuspend(bundle); 284 } 285 } 286 mutex_unlock(&cap->mutex); 287 288 return ret; 289 } 290 291 static const struct file_operations cap_fops = { 292 .owner = THIS_MODULE, 293 .open = cap_open, 294 .release = cap_release, 295 .unlocked_ioctl = cap_ioctl_unlocked, 296 }; 297 298 int gb_cap_connection_init(struct gb_connection *connection) 299 { 300 struct gb_cap *cap; 301 int ret, minor; 302 303 if (!connection) 304 return 0; 305 306 cap = kzalloc(sizeof(*cap), GFP_KERNEL); 307 if (!cap) 308 return -ENOMEM; 309 310 cap->parent = &connection->bundle->dev; 311 cap->connection = connection; 312 mutex_init(&cap->mutex); 313 gb_connection_set_data(connection, cap); 314 kref_init(&cap->kref); 315 316 mutex_lock(&list_mutex); 317 list_add(&cap->node, &cap_list); 318 mutex_unlock(&list_mutex); 319 320 ret = gb_connection_enable(connection); 321 if (ret) 322 goto err_list_del; 323 324 minor = ida_simple_get(&cap_minors_map, 0, NUM_MINORS, GFP_KERNEL); 325 if (minor < 0) { 326 ret = minor; 327 goto err_connection_disable; 328 } 329 330 /* Add a char device to allow userspace to interact with cap */ 331 cap->dev_num = MKDEV(MAJOR(cap_dev_num), minor); 332 cdev_init(&cap->cdev, &cap_fops); 333 334 ret = cdev_add(&cap->cdev, cap->dev_num, 1); 335 if (ret) 336 goto err_remove_ida; 337 338 /* Add a soft link to the previously added char-dev within the bundle */ 339 cap->class_device = device_create(cap_class, cap->parent, cap->dev_num, 340 NULL, "gb-authenticate-%d", minor); 341 if (IS_ERR(cap->class_device)) { 342 ret = PTR_ERR(cap->class_device); 343 goto err_del_cdev; 344 } 345 346 return 0; 347 348 err_del_cdev: 349 cdev_del(&cap->cdev); 350 err_remove_ida: 351 ida_simple_remove(&cap_minors_map, minor); 352 err_connection_disable: 353 gb_connection_disable(connection); 354 err_list_del: 355 mutex_lock(&list_mutex); 356 list_del(&cap->node); 357 mutex_unlock(&list_mutex); 358 359 put_cap(cap); 360 361 return ret; 362 } 363 364 void gb_cap_connection_exit(struct gb_connection *connection) 365 { 366 struct gb_cap *cap; 367 368 if (!connection) 369 return; 370 371 cap = gb_connection_get_data(connection); 372 373 device_destroy(cap_class, cap->dev_num); 374 cdev_del(&cap->cdev); 375 ida_simple_remove(&cap_minors_map, MINOR(cap->dev_num)); 376 377 /* 378 * Disallow any new ioctl operations on the char device and wait for 379 * existing ones to finish. 380 */ 381 mutex_lock(&cap->mutex); 382 cap->disabled = true; 383 mutex_unlock(&cap->mutex); 384 385 /* All pending greybus operations should have finished by now */ 386 gb_connection_disable(cap->connection); 387 388 /* Disallow new users to get access to the cap structure */ 389 mutex_lock(&list_mutex); 390 list_del(&cap->node); 391 mutex_unlock(&list_mutex); 392 393 /* 394 * All current users of cap would have taken a reference to it by 395 * now, we can drop our reference and wait the last user will get 396 * cap freed. 397 */ 398 put_cap(cap); 399 } 400 401 int cap_init(void) 402 { 403 int ret; 404 405 cap_class = class_create(THIS_MODULE, "gb_authenticate"); 406 if (IS_ERR(cap_class)) 407 return PTR_ERR(cap_class); 408 409 ret = alloc_chrdev_region(&cap_dev_num, 0, NUM_MINORS, 410 "gb_authenticate"); 411 if (ret) 412 goto err_remove_class; 413 414 return 0; 415 416 err_remove_class: 417 class_destroy(cap_class); 418 return ret; 419 } 420 421 void cap_exit(void) 422 { 423 unregister_chrdev_region(cap_dev_num, NUM_MINORS); 424 class_destroy(cap_class); 425 ida_destroy(&cap_minors_map); 426 } 427