Merge branch 'next-tpm' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security

Pull TPM updates from James Morris:
 "From Jarkko: The only new feature is non-blocking operation for
  /dev/tpm0"

* 'next-tpm' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
  tpm: Restore functionality to xen vtpm driver.
  tpm: add support for nonblocking operation
  tpm: add ptr to the tpm_space struct to file_priv
  tpm: Make SECURITYFS a weak dependency
  tpm: suppress transmit cmd error logs when TPM 1.2 is disabled/deactivated
  tpm: fix response size validation in tpm_get_random()

9 files changed, 157 insertions, 74 deletions

diff --git a/drivers/char/tpm/Kconfig b/drivers/char/tpm/Kconfig
index 18c81cbe4704..536e55d3919f 100644
--- a/drivers/char/tpm/Kconfig
+++ b/drivers/char/tpm/Kconfig
@@ -5,7 +5,7 @@
 menuconfig TCG_TPM
         tristate "TPM Hardware Support"
         depends on HAS_IOMEM
-        select SECURITYFS
+        imply SECURITYFS
         select CRYPTO
         select CRYPTO_HASH_INFO
         ---help---
diff --git a/drivers/char/tpm/tpm-dev-common.c b/drivers/char/tpm/tpm-dev-common.c
index e4a04b2d3c32..99b5133a9d05 100644
--- a/drivers/char/tpm/tpm-dev-common.c
+++ b/drivers/char/tpm/tpm-dev-common.c
@@ -17,11 +17,36 @@
  * License.
  *
  */
+#include <linux/poll.h>
 #include <linux/slab.h>
 #include <linux/uaccess.h>
+#include <linux/workqueue.h>
 #include "tpm.h"
 #include "tpm-dev.h"
 
+static struct workqueue_struct *tpm_dev_wq;
+static DEFINE_MUTEX(tpm_dev_wq_lock);
+
+static void tpm_async_work(struct work_struct *work)
+{
+        struct file_priv *priv =
+                        container_of(work, struct file_priv, async_work);
+        ssize_t ret;
+
+        mutex_lock(&priv->buffer_mutex);
+        priv->command_enqueued = false;
+        ret = tpm_transmit(priv->chip, priv->space, priv->data_buffer,
+                           sizeof(priv->data_buffer), 0);
+
+        tpm_put_ops(priv->chip);
+        if (ret > 0) {
+                priv->data_pending = ret;
+                mod_timer(&priv->user_read_timer, jiffies + (120 * HZ));
+        }
+        mutex_unlock(&priv->buffer_mutex);
+        wake_up_interruptible(&priv->async_wait);
+}
+
 static void user_reader_timeout(struct timer_list *t)
 {
         struct file_priv *priv = from_timer(priv, t, user_read_timer);
@@ -29,27 +54,32 @@ static void user_reader_timeout(struct timer_list *t)
         pr_warn("TPM user space timeout is deprecated (pid=%d)\n",
                 task_tgid_nr(current));
 
-        schedule_work(&priv->work);
+        schedule_work(&priv->timeout_work);
 }
 
-static void timeout_work(struct work_struct *work)
+static void tpm_timeout_work(struct work_struct *work)
 {
-        struct file_priv *priv = container_of(work, struct file_priv, work);
+        struct file_priv *priv = container_of(work, struct file_priv,
+                                              timeout_work);
 
         mutex_lock(&priv->buffer_mutex);
         priv->data_pending = 0;
         memset(priv->data_buffer, 0, sizeof(priv->data_buffer));
         mutex_unlock(&priv->buffer_mutex);
+        wake_up_interruptible(&priv->async_wait);
 }
 
 void tpm_common_open(struct file *file, struct tpm_chip *chip,
-                     struct file_priv *priv)
+                     struct file_priv *priv, struct tpm_space *space)
 {
         priv->chip = chip;
+        priv->space = space;
+
         mutex_init(&priv->buffer_mutex);
         timer_setup(&priv->user_read_timer, user_reader_timeout, 0);
-        INIT_WORK(&priv->work, timeout_work);
-
+        INIT_WORK(&priv->timeout_work, tpm_timeout_work);
+        INIT_WORK(&priv->async_work, tpm_async_work);
+        init_waitqueue_head(&priv->async_wait);
         file->private_data = priv;
 }
 
@@ -61,15 +91,17 @@ ssize_t tpm_common_read(struct file *file, char __user *buf,
         int rc;
 
         del_singleshot_timer_sync(&priv->user_read_timer);
-        flush_work(&priv->work);
+        flush_work(&priv->timeout_work);
         mutex_lock(&priv->buffer_mutex);
 
         if (priv->data_pending) {
                 ret_size = min_t(ssize_t, size, priv->data_pending);
-                rc = copy_to_user(buf, priv->data_buffer, ret_size);
-                memset(priv->data_buffer, 0, priv->data_pending);
-                if (rc)
-                        ret_size = -EFAULT;
+                if (ret_size > 0) {
+                        rc = copy_to_user(buf, priv->data_buffer, ret_size);
+                        memset(priv->data_buffer, 0, priv->data_pending);
+                        if (rc)
+                                ret_size = -EFAULT;
+                }
 
                 priv->data_pending = 0;
         }
@@ -79,13 +111,12 @@ ssize_t tpm_common_read(struct file *file, char __user *buf,
 }
 
 ssize_t tpm_common_write(struct file *file, const char __user *buf,
-                         size_t size, loff_t *off, struct tpm_space *space)
+                         size_t size, loff_t *off)
 {
         struct file_priv *priv = file->private_data;
-        size_t in_size = size;
-        ssize_t out_size;
+        int ret = 0;
 
-        if (in_size > TPM_BUFSIZE)
+        if (size > TPM_BUFSIZE)
                 return -E2BIG;
 
         mutex_lock(&priv->buffer_mutex);
@@ -94,21 +125,20 @@ ssize_t tpm_common_write(struct file *file, const char __user *buf,
          * tpm_read or a user_read_timer timeout. This also prevents split
          * buffered writes from blocking here.
          */
-        if (priv->data_pending != 0) {
-                mutex_unlock(&priv->buffer_mutex);
-                return -EBUSY;
+        if (priv->data_pending != 0 || priv->command_enqueued) {
+                ret = -EBUSY;
+                goto out;
         }
 
-        if (copy_from_user
-            (priv->data_buffer, (void __user *) buf, in_size)) {
-                mutex_unlock(&priv->buffer_mutex);
-                return -EFAULT;
+        if (copy_from_user(priv->data_buffer, buf, size)) {
+                ret = -EFAULT;
+                goto out;
         }
 
-        if (in_size < 6 ||
-            in_size < be32_to_cpu(*((__be32 *) (priv->data_buffer + 2)))) {
-                mutex_unlock(&priv->buffer_mutex);
-                return -EINVAL;
+        if (size < 6 ||
+            size < be32_to_cpu(*((__be32 *)(priv->data_buffer + 2)))) {
+                ret = -EINVAL;
+                goto out;
         }
 
         /* atomic tpm command send and result receive. We only hold the ops
@@ -116,25 +146,50 @@ ssize_t tpm_common_write(struct file *file, const char __user *buf,
          * the char dev is held open.
          */
         if (tpm_try_get_ops(priv->chip)) {
-                mutex_unlock(&priv->buffer_mutex);
-                return -EPIPE;
+                ret = -EPIPE;
+                goto out;
         }
-        out_size = tpm_transmit(priv->chip, space, priv->data_buffer,
-                                sizeof(priv->data_buffer), 0);
 
-        tpm_put_ops(priv->chip);
-        if (out_size < 0) {
+        /*
+         * If in nonblocking mode schedule an async job to send
+         * the command return the size.
+         * In case of error the err code will be returned in
+         * the subsequent read call.
+         */
+        if (file->f_flags & O_NONBLOCK) {
+                priv->command_enqueued = true;
+                queue_work(tpm_dev_wq, &priv->async_work);
                 mutex_unlock(&priv->buffer_mutex);
-                return out_size;
+                return size;
         }
 
-        priv->data_pending = out_size;
+        ret = tpm_transmit(priv->chip, priv->space, priv->data_buffer,
+                           sizeof(priv->data_buffer), 0);
+        tpm_put_ops(priv->chip);
+
+        if (ret > 0) {
+                priv->data_pending = ret;
+                mod_timer(&priv->user_read_timer, jiffies + (120 * HZ));
+                ret = size;
+        }
+out:
         mutex_unlock(&priv->buffer_mutex);
+        return ret;
+}
+
+__poll_t tpm_common_poll(struct file *file, poll_table *wait)
+{
+        struct file_priv *priv = file->private_data;
+        __poll_t mask = 0;
+
+        poll_wait(file, &priv->async_wait, wait);
 
-        /* Set a timeout by which the reader must come claim the result */
-        mod_timer(&priv->user_read_timer, jiffies + (120 * HZ));
+        if (priv->data_pending)
+                mask = EPOLLIN | EPOLLRDNORM;
+        else
+                mask = EPOLLOUT | EPOLLWRNORM;
 
-        return in_size;
+        return mask;
 }
 
 /*
@@ -142,8 +197,24 @@ ssize_t tpm_common_write(struct file *file, const char __user *buf,
  */
 void tpm_common_release(struct file *file, struct file_priv *priv)
 {
+        flush_work(&priv->async_work);
         del_singleshot_timer_sync(&priv->user_read_timer);
-        flush_work(&priv->work);
+        flush_work(&priv->timeout_work);
         file->private_data = NULL;
         priv->data_pending = 0;
 }
+
+int __init tpm_dev_common_init(void)
+{
+        tpm_dev_wq = alloc_workqueue("tpm_dev_wq", WQ_MEM_RECLAIM, 0);
+
+        return !tpm_dev_wq ? -ENOMEM : 0;
+}
+
+void __exit tpm_dev_common_exit(void)
+{
+        if (tpm_dev_wq) {
+                destroy_workqueue(tpm_dev_wq);
+                tpm_dev_wq = NULL;
+        }
+}
diff --git a/drivers/char/tpm/tpm-dev.c b/drivers/char/tpm/tpm-dev.c
index ebd74ab5abef..32f9738f1cb2 100644
--- a/drivers/char/tpm/tpm-dev.c
+++ b/drivers/char/tpm/tpm-dev.c
@@ -39,7 +39,7 @@ static int tpm_open(struct inode *inode, struct file *file)
         if (priv == NULL)
                 goto out;
 
-        tpm_common_open(file, chip, priv);
+        tpm_common_open(file, chip, priv, NULL);
 
         return 0;
 
@@ -48,12 +48,6 @@ static int tpm_open(struct inode *inode, struct file *file)
         return -ENOMEM;
 }
 
-static ssize_t tpm_write(struct file *file, const char __user *buf,
-                         size_t size, loff_t *off)
-{
-        return tpm_common_write(file, buf, size, off, NULL);
-}
-
 /*
  * Called on file close
  */
@@ -73,6 +67,7 @@ const struct file_operations tpm_fops = {
         .llseek = no_llseek,
         .open = tpm_open,
         .read = tpm_common_read,
-        .write = tpm_write,
+        .write = tpm_common_write,
+        .poll = tpm_common_poll,
         .release = tpm_release,
 };
diff --git a/drivers/char/tpm/tpm-dev.h b/drivers/char/tpm/tpm-dev.h
index b24cfb4d3ee1..a126b575cb8c 100644
--- a/drivers/char/tpm/tpm-dev.h
+++ b/drivers/char/tpm/tpm-dev.h
@@ -2,27 +2,33 @@
 #ifndef _TPM_DEV_H
 #define _TPM_DEV_H
 
+#include <linux/poll.h>
 #include "tpm.h"
 
 struct file_priv {
         struct tpm_chip *chip;
+        struct tpm_space *space;
 
-        /* Data passed to and from the tpm via the read/write calls */
-        size_t data_pending;
+        /* Holds the amount of data passed or an error code from async op */
+        ssize_t data_pending;
         struct mutex buffer_mutex;
 
         struct timer_list user_read_timer;      /* user needs to claim result */
-        struct work_struct work;
+        struct work_struct timeout_work;
+        struct work_struct async_work;
+        wait_queue_head_t async_wait;
+        bool command_enqueued;
 
         u8 data_buffer[TPM_BUFSIZE];
 };
 
 void tpm_common_open(struct file *file, struct tpm_chip *chip,
-                     struct file_priv *priv);
+                     struct file_priv *priv, struct tpm_space *space);
 ssize_t tpm_common_read(struct file *file, char __user *buf,
                         size_t size, loff_t *off);
 ssize_t tpm_common_write(struct file *file, const char __user *buf,
-                         size_t size, loff_t *off, struct tpm_space *space);
-void tpm_common_release(struct file *file, struct file_priv *priv);
+                         size_t size, loff_t *off);
+__poll_t tpm_common_poll(struct file *file, poll_table *wait);
 
+void tpm_common_release(struct file *file, struct file_priv *priv);
 #endif
diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
index 1a803b0cf980..129f640424b7 100644
--- a/drivers/char/tpm/tpm-interface.c
+++ b/drivers/char/tpm/tpm-interface.c
@@ -663,7 +663,8 @@ ssize_t tpm_transmit_cmd(struct tpm_chip *chip, struct tpm_space *space,
                 return len;
 
         err = be32_to_cpu(header->return_code);
-        if (err != 0 && desc)
+        if (err != 0 && err != TPM_ERR_DISABLED && err != TPM_ERR_DEACTIVATED
+            && desc)
                 dev_err(&chip->dev, "A TPM error (%d) occurred %s\n", err,
                         desc);
         if (err)
@@ -1321,7 +1322,8 @@ int tpm_get_random(struct tpm_chip *chip, u8 *out, size_t max)
                 }
 
                 rlength = be32_to_cpu(tpm_cmd.header.out.length);
-                if (rlength < offsetof(struct tpm_getrandom_out, rng_data) +
+                if (rlength < TPM_HEADER_SIZE +
+                              offsetof(struct tpm_getrandom_out, rng_data) +
                               recd) {
                         total = -EFAULT;
                         break;
@@ -1407,19 +1409,32 @@ static int __init tpm_init(void)
         tpmrm_class = class_create(THIS_MODULE, "tpmrm");
         if (IS_ERR(tpmrm_class)) {
                 pr_err("couldn't create tpmrm class\n");
-                class_destroy(tpm_class);
-                return PTR_ERR(tpmrm_class);
+                rc = PTR_ERR(tpmrm_class);
+                goto out_destroy_tpm_class;
         }
 
         rc = alloc_chrdev_region(&tpm_devt, 0, 2*TPM_NUM_DEVICES, "tpm");
         if (rc < 0) {
                 pr_err("tpm: failed to allocate char dev region\n");
-                class_destroy(tpmrm_class);
-                class_destroy(tpm_class);
-                return rc;
+                goto out_destroy_tpmrm_class;
+        }
+
+        rc = tpm_dev_common_init();
+        if (rc) {
+                pr_err("tpm: failed to allocate char dev region\n");
+                goto out_unreg_chrdev;
         }
 
         return 0;
+
+out_unreg_chrdev:
+        unregister_chrdev_region(tpm_devt, 2 * TPM_NUM_DEVICES);
+out_destroy_tpmrm_class:
+        class_destroy(tpmrm_class);
+out_destroy_tpm_class:
+        class_destroy(tpm_class);
+
+        return rc;
 }
 
 static void __exit tpm_exit(void)
@@ -1428,6 +1443,7 @@ static void __exit tpm_exit(void)
         class_destroy(tpm_class);
         class_destroy(tpmrm_class);
         unregister_chrdev_region(tpm_devt, 2*TPM_NUM_DEVICES);
+        tpm_dev_common_exit();
 }
 
 subsys_initcall(tpm_init);
diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
index f3501d05264f..f20dc8ece348 100644
--- a/drivers/char/tpm/tpm.h
+++ b/drivers/char/tpm/tpm.h
@@ -604,4 +604,6 @@ int tpm2_commit_space(struct tpm_chip *chip, struct tpm_space *space,
 
 int tpm_bios_log_setup(struct tpm_chip *chip);
 void tpm_bios_log_teardown(struct tpm_chip *chip);
+int tpm_dev_common_init(void);
+void tpm_dev_common_exit(void);
 #endif
diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
index c31b490bd41d..3acf4fd4e5a5 100644
--- a/drivers/char/tpm/tpm2-cmd.c
+++ b/drivers/char/tpm/tpm2-cmd.c
@@ -329,7 +329,9 @@ int tpm2_get_random(struct tpm_chip *chip, u8 *dest, size_t max)
                         &buf.data[TPM_HEADER_SIZE];
                 recd = min_t(u32, be16_to_cpu(out->size), num_bytes);
                 if (tpm_buf_length(&buf) <
-                    offsetof(struct tpm2_get_random_out, buffer) + recd) {
+                    TPM_HEADER_SIZE +
+                    offsetof(struct tpm2_get_random_out, buffer) +
+                    recd) {
                         err = -EFAULT;
                         goto out;
                 }
diff --git a/drivers/char/tpm/tpmrm-dev.c b/drivers/char/tpm/tpmrm-dev.c
index 1a0e97a5da5a..0c751a79bbed 100644
--- a/drivers/char/tpm/tpmrm-dev.c
+++ b/drivers/char/tpm/tpmrm-dev.c
@@ -28,7 +28,7 @@ static int tpmrm_open(struct inode *inode, struct file *file)
                 return -ENOMEM;
         }
 
-        tpm_common_open(file, chip, &priv->priv);
+        tpm_common_open(file, chip, &priv->priv, &priv->space);
 
         return 0;
 }
@@ -45,21 +45,12 @@ static int tpmrm_release(struct inode *inode, struct file *file)
         return 0;
 }
 
-static ssize_t tpmrm_write(struct file *file, const char __user *buf,
-                   size_t size, loff_t *off)
-{
-        struct file_priv *fpriv = file->private_data;
-        struct tpmrm_priv *priv = container_of(fpriv, struct tpmrm_priv, priv);
-
-        return tpm_common_write(file, buf, size, off, &priv->space);
-}
-
 const struct file_operations tpmrm_fops = {
         .owner = THIS_MODULE,
         .llseek = no_llseek,
         .open = tpmrm_open,
         .read = tpm_common_read,
-        .write = tpmrm_write,
+        .write = tpm_common_write,
+        .poll = tpm_common_poll,
         .release = tpmrm_release,
 };
-
diff --git a/drivers/char/tpm/xen-tpmfront.c b/drivers/char/tpm/xen-tpmfront.c
index 911475d36800..b150f87f38f5 100644
--- a/drivers/char/tpm/xen-tpmfront.c
+++ b/drivers/char/tpm/xen-tpmfront.c
@@ -264,7 +264,7 @@ static int setup_ring(struct xenbus_device *dev, struct tpm_private *priv)
                 return -ENOMEM;
         }
 
-        rv = xenbus_grant_ring(dev, &priv->shr, 1, &gref);
+        rv = xenbus_grant_ring(dev, priv->shr, 1, &gref);
         if (rv < 0)
                 return rv;