1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * Greybus Component Authentication Protocol (CAP) Driver. 4 * 5 * Copyright 2016 Google Inc. 6 * Copyright 2016 Linaro Ltd. 7 */ 8 9 #include <linux/greybus.h> 10 #include <linux/cdev.h> 11 #include <linux/fs.h> 12 #include <linux/ioctl.h> 13 #include <linux/uaccess.h> 14 15 #include "greybus_authentication.h" 16 #include "firmware.h" 17 18 #define CAP_TIMEOUT_MS 1000 19 20 /* 21 * Number of minor devices this driver supports. 22 * There will be exactly one required per Interface. 23 */ 24 #define NUM_MINORS U8_MAX 25 26 struct gb_cap { 27 struct device *parent; 28 struct gb_connection *connection; 29 struct kref kref; 30 struct list_head node; 31 bool disabled; /* connection getting disabled */ 32 33 struct mutex mutex; 34 struct cdev cdev; 35 struct device *class_device; 36 dev_t dev_num; 37 }; 38 39 static const struct class cap_class = { 40 .name = "gb_authenticate", 41 }; 42 43 static dev_t cap_dev_num; 44 static DEFINE_IDA(cap_minors_map); 45 static LIST_HEAD(cap_list); 46 static DEFINE_MUTEX(list_mutex); 47 cap_kref_release(struct kref * kref)48 static void cap_kref_release(struct kref *kref) 49 { 50 struct gb_cap *cap = container_of(kref, struct gb_cap, kref); 51 52 kfree(cap); 53 } 54 55 /* 56 * All users of cap take a reference (from within list_mutex lock), before 57 * they get a pointer to play with. And the structure will be freed only after 58 * the last user has put the reference to it. 59 */ put_cap(struct gb_cap * cap)60 static void put_cap(struct gb_cap *cap) 61 { 62 kref_put(&cap->kref, cap_kref_release); 63 } 64 65 /* Caller must call put_cap() after using struct gb_cap */ get_cap(struct cdev * cdev)66 static struct gb_cap *get_cap(struct cdev *cdev) 67 { 68 struct gb_cap *cap; 69 70 mutex_lock(&list_mutex); 71 72 list_for_each_entry(cap, &cap_list, node) { 73 if (&cap->cdev == cdev) { 74 kref_get(&cap->kref); 75 goto unlock; 76 } 77 } 78 79 cap = NULL; 80 81 unlock: 82 mutex_unlock(&list_mutex); 83 84 return cap; 85 } 86 cap_get_endpoint_uid(struct gb_cap * cap,u8 * euid)87 static int cap_get_endpoint_uid(struct gb_cap *cap, u8 *euid) 88 { 89 struct gb_connection *connection = cap->connection; 90 struct gb_cap_get_endpoint_uid_response response; 91 int ret; 92 93 ret = gb_operation_sync(connection, GB_CAP_TYPE_GET_ENDPOINT_UID, NULL, 94 0, &response, sizeof(response)); 95 if (ret) { 96 dev_err(cap->parent, "failed to get endpoint uid (%d)\n", ret); 97 return ret; 98 } 99 100 memcpy(euid, response.uid, sizeof(response.uid)); 101 102 return 0; 103 } 104 cap_get_ims_certificate(struct gb_cap * cap,u32 class,u32 id,u8 * certificate,u32 * size,u8 * result)105 static int cap_get_ims_certificate(struct gb_cap *cap, u32 class, u32 id, 106 u8 *certificate, u32 *size, u8 *result) 107 { 108 struct gb_connection *connection = cap->connection; 109 struct gb_cap_get_ims_certificate_request *request; 110 struct gb_cap_get_ims_certificate_response *response; 111 size_t max_size = gb_operation_get_payload_size_max(connection); 112 struct gb_operation *op; 113 int ret; 114 115 op = gb_operation_create_flags(connection, 116 GB_CAP_TYPE_GET_IMS_CERTIFICATE, 117 sizeof(*request), max_size, 118 GB_OPERATION_FLAG_SHORT_RESPONSE, 119 GFP_KERNEL); 120 if (!op) 121 return -ENOMEM; 122 123 request = op->request->payload; 124 request->certificate_class = cpu_to_le32(class); 125 request->certificate_id = cpu_to_le32(id); 126 127 ret = gb_operation_request_send_sync(op); 128 if (ret) { 129 dev_err(cap->parent, "failed to get certificate (%d)\n", ret); 130 goto done; 131 } 132 133 response = op->response->payload; 134 *result = response->result_code; 135 *size = op->response->payload_size - sizeof(*response); 136 memcpy(certificate, response->certificate, *size); 137 138 done: 139 gb_operation_put(op); 140 return ret; 141 } 142 cap_authenticate(struct gb_cap * cap,u32 auth_type,u8 * uid,u8 * challenge,u8 * result,u8 * auth_response,u32 * signature_size,u8 * signature)143 static int cap_authenticate(struct gb_cap *cap, u32 auth_type, u8 *uid, 144 u8 *challenge, u8 *result, u8 *auth_response, 145 u32 *signature_size, u8 *signature) 146 { 147 struct gb_connection *connection = cap->connection; 148 struct gb_cap_authenticate_request *request; 149 struct gb_cap_authenticate_response *response; 150 size_t max_size = gb_operation_get_payload_size_max(connection); 151 struct gb_operation *op; 152 int ret; 153 154 op = gb_operation_create_flags(connection, GB_CAP_TYPE_AUTHENTICATE, 155 sizeof(*request), max_size, 156 GB_OPERATION_FLAG_SHORT_RESPONSE, 157 GFP_KERNEL); 158 if (!op) 159 return -ENOMEM; 160 161 request = op->request->payload; 162 request->auth_type = cpu_to_le32(auth_type); 163 memcpy(request->uid, uid, sizeof(request->uid)); 164 memcpy(request->challenge, challenge, sizeof(request->challenge)); 165 166 ret = gb_operation_request_send_sync(op); 167 if (ret) { 168 dev_err(cap->parent, "failed to authenticate (%d)\n", ret); 169 goto done; 170 } 171 172 response = op->response->payload; 173 *result = response->result_code; 174 *signature_size = op->response->payload_size - sizeof(*response); 175 memcpy(auth_response, response->response, sizeof(response->response)); 176 memcpy(signature, response->signature, *signature_size); 177 178 done: 179 gb_operation_put(op); 180 return ret; 181 } 182 183 /* Char device fops */ 184 cap_open(struct inode * inode,struct file * file)185 static int cap_open(struct inode *inode, struct file *file) 186 { 187 struct gb_cap *cap = get_cap(inode->i_cdev); 188 189 /* cap structure can't get freed until file descriptor is closed */ 190 if (cap) { 191 file->private_data = cap; 192 return 0; 193 } 194 195 return -ENODEV; 196 } 197 cap_release(struct inode * inode,struct file * file)198 static int cap_release(struct inode *inode, struct file *file) 199 { 200 struct gb_cap *cap = file->private_data; 201 202 put_cap(cap); 203 return 0; 204 } 205 cap_ioctl(struct gb_cap * cap,unsigned int cmd,void __user * buf)206 static int cap_ioctl(struct gb_cap *cap, unsigned int cmd, 207 void __user *buf) 208 { 209 struct cap_ioc_get_endpoint_uid endpoint_uid; 210 struct cap_ioc_get_ims_certificate *ims_cert; 211 struct cap_ioc_authenticate *authenticate; 212 size_t size; 213 int ret; 214 215 switch (cmd) { 216 case CAP_IOC_GET_ENDPOINT_UID: 217 ret = cap_get_endpoint_uid(cap, endpoint_uid.uid); 218 if (ret) 219 return ret; 220 221 if (copy_to_user(buf, &endpoint_uid, sizeof(endpoint_uid))) 222 return -EFAULT; 223 224 return 0; 225 case CAP_IOC_GET_IMS_CERTIFICATE: 226 size = sizeof(*ims_cert); 227 ims_cert = memdup_user(buf, size); 228 if (IS_ERR(ims_cert)) 229 return PTR_ERR(ims_cert); 230 231 ret = cap_get_ims_certificate(cap, ims_cert->certificate_class, 232 ims_cert->certificate_id, 233 ims_cert->certificate, 234 &ims_cert->cert_size, 235 &ims_cert->result_code); 236 if (!ret && copy_to_user(buf, ims_cert, size)) 237 ret = -EFAULT; 238 kfree(ims_cert); 239 240 return ret; 241 case CAP_IOC_AUTHENTICATE: 242 size = sizeof(*authenticate); 243 authenticate = memdup_user(buf, size); 244 if (IS_ERR(authenticate)) 245 return PTR_ERR(authenticate); 246 247 ret = cap_authenticate(cap, authenticate->auth_type, 248 authenticate->uid, 249 authenticate->challenge, 250 &authenticate->result_code, 251 authenticate->response, 252 &authenticate->signature_size, 253 authenticate->signature); 254 if (!ret && copy_to_user(buf, authenticate, size)) 255 ret = -EFAULT; 256 kfree(authenticate); 257 258 return ret; 259 default: 260 return -ENOTTY; 261 } 262 } 263 cap_ioctl_unlocked(struct file * file,unsigned int cmd,unsigned long arg)264 static long cap_ioctl_unlocked(struct file *file, unsigned int cmd, 265 unsigned long arg) 266 { 267 struct gb_cap *cap = file->private_data; 268 struct gb_bundle *bundle = cap->connection->bundle; 269 int ret = -ENODEV; 270 271 /* 272 * Serialize ioctls. 273 * 274 * We don't want the user to do multiple authentication operations in 275 * parallel. 276 * 277 * This is also used to protect ->disabled, which is used to check if 278 * the connection is getting disconnected, so that we don't start any 279 * new operations. 280 */ 281 mutex_lock(&cap->mutex); 282 if (!cap->disabled) { 283 ret = gb_pm_runtime_get_sync(bundle); 284 if (!ret) { 285 ret = cap_ioctl(cap, cmd, (void __user *)arg); 286 gb_pm_runtime_put_autosuspend(bundle); 287 } 288 } 289 mutex_unlock(&cap->mutex); 290 291 return ret; 292 } 293 294 static const struct file_operations cap_fops = { 295 .owner = THIS_MODULE, 296 .open = cap_open, 297 .release = cap_release, 298 .unlocked_ioctl = cap_ioctl_unlocked, 299 }; 300 gb_cap_connection_init(struct gb_connection * connection)301 int gb_cap_connection_init(struct gb_connection *connection) 302 { 303 struct gb_cap *cap; 304 int ret, minor; 305 306 if (!connection) 307 return 0; 308 309 cap = kzalloc(sizeof(*cap), GFP_KERNEL); 310 if (!cap) 311 return -ENOMEM; 312 313 cap->parent = &connection->bundle->dev; 314 cap->connection = connection; 315 mutex_init(&cap->mutex); 316 gb_connection_set_data(connection, cap); 317 kref_init(&cap->kref); 318 319 mutex_lock(&list_mutex); 320 list_add(&cap->node, &cap_list); 321 mutex_unlock(&list_mutex); 322 323 ret = gb_connection_enable(connection); 324 if (ret) 325 goto err_list_del; 326 327 minor = ida_alloc_max(&cap_minors_map, NUM_MINORS - 1, GFP_KERNEL); 328 if (minor < 0) { 329 ret = minor; 330 goto err_connection_disable; 331 } 332 333 /* Add a char device to allow userspace to interact with cap */ 334 cap->dev_num = MKDEV(MAJOR(cap_dev_num), minor); 335 cdev_init(&cap->cdev, &cap_fops); 336 337 ret = cdev_add(&cap->cdev, cap->dev_num, 1); 338 if (ret) 339 goto err_remove_ida; 340 341 /* Add a soft link to the previously added char-dev within the bundle */ 342 cap->class_device = device_create(&cap_class, cap->parent, cap->dev_num, 343 NULL, "gb-authenticate-%d", minor); 344 if (IS_ERR(cap->class_device)) { 345 ret = PTR_ERR(cap->class_device); 346 goto err_del_cdev; 347 } 348 349 return 0; 350 351 err_del_cdev: 352 cdev_del(&cap->cdev); 353 err_remove_ida: 354 ida_free(&cap_minors_map, minor); 355 err_connection_disable: 356 gb_connection_disable(connection); 357 err_list_del: 358 mutex_lock(&list_mutex); 359 list_del(&cap->node); 360 mutex_unlock(&list_mutex); 361 362 put_cap(cap); 363 364 return ret; 365 } 366 gb_cap_connection_exit(struct gb_connection * connection)367 void gb_cap_connection_exit(struct gb_connection *connection) 368 { 369 struct gb_cap *cap; 370 371 if (!connection) 372 return; 373 374 cap = gb_connection_get_data(connection); 375 376 device_destroy(&cap_class, cap->dev_num); 377 cdev_del(&cap->cdev); 378 ida_free(&cap_minors_map, MINOR(cap->dev_num)); 379 380 /* 381 * Disallow any new ioctl operations on the char device and wait for 382 * existing ones to finish. 383 */ 384 mutex_lock(&cap->mutex); 385 cap->disabled = true; 386 mutex_unlock(&cap->mutex); 387 388 /* All pending greybus operations should have finished by now */ 389 gb_connection_disable(cap->connection); 390 391 /* Disallow new users to get access to the cap structure */ 392 mutex_lock(&list_mutex); 393 list_del(&cap->node); 394 mutex_unlock(&list_mutex); 395 396 /* 397 * All current users of cap would have taken a reference to it by 398 * now, we can drop our reference and wait the last user will get 399 * cap freed. 400 */ 401 put_cap(cap); 402 } 403 cap_init(void)404 int cap_init(void) 405 { 406 int ret; 407 408 ret = class_register(&cap_class); 409 if (ret) 410 return ret; 411 412 ret = alloc_chrdev_region(&cap_dev_num, 0, NUM_MINORS, 413 "gb_authenticate"); 414 if (ret) 415 goto err_remove_class; 416 417 return 0; 418 419 err_remove_class: 420 class_unregister(&cap_class); 421 return ret; 422 } 423 cap_exit(void)424 void cap_exit(void) 425 { 426 unregister_chrdev_region(cap_dev_num, NUM_MINORS); 427 class_unregister(&cap_class); 428 ida_destroy(&cap_minors_map); 429 } 430