From nobody Thu Oct 2 02:05:53 2025 Received: from the.earth.li (the.earth.li [93.93.131.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 40F7425EFBC; Tue, 23 Sep 2025 17:10:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=93.93.131.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1758647406; cv=none; b=Gtlf8f2tJ9DPgjMh9ffqQUoFIsE3ovSUFSPseqiRHBJeQR2TDgB1+n+BUpGgPSq9BEWhqQqqiIhn8xVWIUMmVKKoZ+txDUz76xNcNKOCm71bMPFgxTCMAhnF7R7ZyF+//qtQvS0YYi81q/fNRgGKOtje9gT6Hnovk7C2LjUgeCc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1758647406; c=relaxed/simple; bh=HngppX3zDoSWNJcouxxXqYCOzP3MhY6z3RElywKN3D8=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=h0Ylz6uwCTNBqQGqrSFD6rrJtCnMb7Dr9+65H41hRHbXtAbNmXPXah0BCWkWMUkkUryrh0Oc5xWL/57ZHP0xhIpQTDEhpXGaF+/0xna0/x24WCHbNzzc+ITe9eTRHLJSDHFKtZTXUi+2c+R/rGZmf0Rps+J48XZ5Iw78kuLA0Qg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=earth.li; spf=pass smtp.mailfrom=earth.li; dkim=pass (2048-bit key) header.d=earth.li header.i=@earth.li header.b=OOd4Iojf; arc=none smtp.client-ip=93.93.131.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=earth.li Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=earth.li Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=earth.li header.i=@earth.li header.b="OOd4Iojf" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=earth.li; s=the; h=In-Reply-To:Content-Type:MIME-Version:References:Message-ID:Subject: Cc:To:From:Date:Sender:Reply-To:Content-Transfer-Encoding:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=FBVW4soCxOWuEIkXRxfq3EjsRQbfMDczzcfms+Yrbag=; b=OOd4Iojf4dv8Bjf/f/lGrA0ZIU myEvB4A/dwH1+xedTFBzpL1uHvID4OxW+ZUSsCpITVXCG0oK8qYRAgdSYDXk6Mc/XZW1IsyngJ3W4 /+EZNKSsN6QT44jjhXLGiVtTH5hyrWNvnFtJzuPWvBYRBFS6Gy673SYWRljN2/T8uUcp+UERfpW0J VRBt2wrGeIBCI7ih2nRffS+FASBIY4Dqn+8ZT95KYv7g57KfHsOzo7UrqAZsbrXe8ZnJs9wZbONL/ PxN7irBEcCn45FVq6XfpiMLxpm+6wVB9kvYkriLWqBngMJ3RohBmrHLZuRyHxGbE5a/cCsbFMpRUZ hp/aR6RA==; Received: from noodles by the.earth.li with local (Exim 4.96) (envelope-from ) id 1v16We-00CZjI-21; Tue, 23 Sep 2025 18:10:00 +0100 Date: Tue, 23 Sep 2025 18:10:00 +0100 From: Jonathan McDowell To: Peter Huewe , Jarkko Sakkinen , Jason Gunthorpe Cc: linux-integrity@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v2 1/4] tpm: Ensure exclusive userspace access when using /dev/tpm Message-ID: <5497b6bbaaed64fbd245aff0190904c9beba714b.1758646791.git.noodles@meta.com> References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Jonathan McDowell There is an is_open lock on /dev/tpm that dates back to at least 2013, but it only prevents multiple accesses via *this* interface. It is perfectly possible for userspace to use /dev/tpmrm, or the kernel to use the internal interfaces, to access the TPM. For tooling expecting exclusive access, such as firmware updates, this can cause issues. Close the userspace loophole by changing the simple bit lock to a full read/write mutex. Direct /dev/tpm access needs an exclusive write lock, the resource broker continues to allow concurrent access *except* when /dev/tpm is open. Signed-off-by: Jonathan McDowell Reviewed-by: Jarkko Sakkinen --- v2: Change error path label to err instead of out. Rework commit message. drivers/char/tpm/tpm-chip.c | 1 + drivers/char/tpm/tpm-dev.c | 14 ++++++++------ drivers/char/tpm/tpmrm-dev.c | 20 ++++++++++++++++++-- include/linux/tpm.h | 3 ++- 4 files changed, 29 insertions(+), 9 deletions(-) diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c index e25daf2396d3..8c8e9054762a 100644 --- a/drivers/char/tpm/tpm-chip.c +++ b/drivers/char/tpm/tpm-chip.c @@ -338,6 +338,7 @@ struct tpm_chip *tpm_chip_alloc(struct device *pdev, =20 mutex_init(&chip->tpm_mutex); init_rwsem(&chip->ops_sem); + init_rwsem(&chip->open_lock); =20 chip->ops =3D ops; =20 diff --git a/drivers/char/tpm/tpm-dev.c b/drivers/char/tpm/tpm-dev.c index 97c94b5e9340..80c4b3f3ad18 100644 --- a/drivers/char/tpm/tpm-dev.c +++ b/drivers/char/tpm/tpm-dev.c @@ -22,10 +22,12 @@ static int tpm_open(struct inode *inode, struct file *f= ile) =20 chip =3D container_of(inode->i_cdev, struct tpm_chip, cdev); =20 - /* It's assured that the chip will be opened just once, - * by the check of is_open variable, which is protected - * by driver_lock. */ - if (test_and_set_bit(0, &chip->is_open)) { + /* + * Only one client is allowed to have /dev/tpm0 open at a time, so we + * treat it as a write lock. The shared /dev/tpmrm0 is treated as a + * read lock. + */ + if (!down_write_trylock(&chip->open_lock)) { dev_dbg(&chip->dev, "Another process owns this TPM\n"); return -EBUSY; } @@ -39,7 +41,7 @@ static int tpm_open(struct inode *inode, struct file *fil= e) return 0; =20 out: - clear_bit(0, &chip->is_open); + up_write(&chip->open_lock); return -ENOMEM; } =20 @@ -51,7 +53,7 @@ static int tpm_release(struct inode *inode, struct file *= file) struct file_priv *priv =3D file->private_data; =20 tpm_common_release(file, priv); - clear_bit(0, &priv->chip->is_open); + up_write(&priv->chip->open_lock); kfree(priv); =20 return 0; diff --git a/drivers/char/tpm/tpmrm-dev.c b/drivers/char/tpm/tpmrm-dev.c index c25df7ea064e..13322dd9ac9e 100644 --- a/drivers/char/tpm/tpmrm-dev.c +++ b/drivers/char/tpm/tpmrm-dev.c @@ -17,19 +17,34 @@ static int tpmrm_open(struct inode *inode, struct file = *file) int rc; =20 chip =3D container_of(inode->i_cdev, struct tpm_chip, cdevs); + + /* + * Only one client is allowed to have /dev/tpm0 open at a time, so we + * treat it as a write lock. The shared /dev/tpmrm0 is treated as a + * read lock. + */ + if (!down_read_trylock(&chip->open_lock)) { + dev_dbg(&chip->dev, "Another process owns this TPM\n"); + return -EBUSY; + } + priv =3D kzalloc(sizeof(*priv), GFP_KERNEL); if (priv =3D=3D NULL) - return -ENOMEM; + goto err; =20 rc =3D tpm2_init_space(&priv->space, TPM2_SPACE_BUFFER_SIZE); if (rc) { kfree(priv); - return -ENOMEM; + goto err; } =20 tpm_common_open(file, chip, &priv->priv, &priv->space); =20 return 0; + +err: + up_read(&chip->open_lock); + return -ENOMEM; } =20 static int tpmrm_release(struct inode *inode, struct file *file) @@ -40,6 +55,7 @@ static int tpmrm_release(struct inode *inode, struct file= *file) tpm_common_release(file, fpriv); tpm2_del_space(fpriv->chip, &priv->space); kfree(priv); + up_read(&fpriv->chip->open_lock); =20 return 0; } diff --git a/include/linux/tpm.h b/include/linux/tpm.h index b0e9eb5ef022..548362d20b32 100644 --- a/include/linux/tpm.h +++ b/include/linux/tpm.h @@ -22,6 +22,7 @@ #include #include #include +#include #include #include =20 @@ -168,7 +169,7 @@ struct tpm_chip { unsigned int flags; =20 int dev_num; /* /dev/tpm# */ - unsigned long is_open; /* only one allowed */ + struct rw_semaphore open_lock; =20 char hwrng_name[64]; struct hwrng hwrng; --=20 2.51.0 From nobody Thu Oct 2 02:05:53 2025 Received: from the.earth.li (the.earth.li [93.93.131.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BFED025EFBC; Tue, 23 Sep 2025 17:10:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=93.93.131.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1758647417; cv=none; b=E8gKM9l23/Sm7Jxm+40awkLYz9mAm6yC8OKkIsrg1SsZVzYXVJxxo35rGJDbF20T3cGm9zWmJkEtUDAXrODKqXWMCf80IRwJXyrBkJE6vCWdGvzqGI5Y5Cg+jeWD/mi5ajpNbPJ9D0cIpPur8R04HLnGbETl4pG1r3P3MWzjNpg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1758647417; c=relaxed/simple; bh=n/1wJvk7cUxtUo5D3CLr0c9F7ji6NEtrrTkQ7t0O2oo=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=Fnap1chr13cMrT88Pu/4ZdYLeRf5Sg3qHP38WbmsvVn6lfrmDDcuAxf8nUzy645k8xsGL3ft9/2r+JaaKv2wgny7i2mQmYOUFVZk4yc40YbTGoYAqtUSSL5XRknT8+B/7z9/xDJJKNP5NwnmVw51VVOHvleQp7FfzK+9mef/cv8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=earth.li; spf=pass smtp.mailfrom=earth.li; dkim=pass (2048-bit key) header.d=earth.li header.i=@earth.li header.b=j6ru4rbx; arc=none smtp.client-ip=93.93.131.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=earth.li Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=earth.li Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=earth.li header.i=@earth.li header.b="j6ru4rbx" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=earth.li; s=the; h=In-Reply-To:Content-Type:MIME-Version:References:Message-ID:Subject: Cc:To:From:Date:Sender:Reply-To:Content-Transfer-Encoding:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=jeuRux8KutMZCxL3uAp/qcVlCoRxYUQEyQCWvID7MmY=; b=j6ru4rbx1ifBBCWD19tb/l3e5L HiBWVS3ugYUngbYGfbra66QwVxCjKMp5z3yJzKNO/R9lKnPhRNk8/xQF7JSCVOLtrPttQ/3ttDonu wGQG206bIJmeYh4Ng7V78+q3CYskPBTHE1Uq/76yYg3gFjpO4hiojiGx7b41ySaoQyKOBClTbq4ts zYMNlMVRnNWBIceSuLH/CwDVCNopvVJ8lETqZ+i54AhxFyWTMwcWX8MebA5pukiXa357cCxDR+v/d mXJgCTUnFWI/87nhaJWXNDfZXzuo+jVXrqZweq//rq3Awl5JhSx0KLBK9xusck+kIC6wRwM3dLhm4 ysestk5w==; Received: from noodles by the.earth.li with local (Exim 4.96) (envelope-from ) id 1v16Wp-00CZlE-0x; Tue, 23 Sep 2025 18:10:11 +0100 Date: Tue, 23 Sep 2025 18:10:11 +0100 From: Jonathan McDowell To: Peter Huewe , Jarkko Sakkinen , Jason Gunthorpe Cc: linux-integrity@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v2 2/4] tpm: Remove tpm_find_get_ops Message-ID: <99f6216783c4c1c71668ec951cfd8f73bbf93bc6.1758646791.git.noodles@meta.com> References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Jonathan McDowell tpm_find_get_ops() looks for the first valid TPM if the caller passes in NULL. All internal users have been converted to either associate themselves with a TPM directly, or call tpm_default_chip() as part of their setup. Remove the no longer necessary tpm_find_get_ops(). Signed-off-by: Jonathan McDowell Reviewed-by: Jarkko Sakkinen --- drivers/char/tpm/tpm-chip.c | 36 -------------------------------- drivers/char/tpm/tpm-interface.c | 20 ++++++++++++++---- drivers/char/tpm/tpm.h | 1 - drivers/char/tpm/tpm_tis_core.c | 3 +-- 4 files changed, 17 insertions(+), 43 deletions(-) diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c index 8c8e9054762a..ba906966721a 100644 --- a/drivers/char/tpm/tpm-chip.c +++ b/drivers/char/tpm/tpm-chip.c @@ -230,42 +230,6 @@ struct tpm_chip *tpm_default_chip(void) } EXPORT_SYMBOL_GPL(tpm_default_chip); =20 -/** - * tpm_find_get_ops() - find and reserve a TPM chip - * @chip: a &struct tpm_chip instance, %NULL for the default chip - * - * Finds a TPM chip and reserves its class device and operations. The chip= must - * be released with tpm_put_ops() after use. - * This function is for internal use only. It supports existing TPM callers - * by accepting NULL, but those callers should be converted to pass in a c= hip - * directly. - * - * Return: - * A reserved &struct tpm_chip instance. - * %NULL if a chip is not found. - * %NULL if the chip is not available. - */ -struct tpm_chip *tpm_find_get_ops(struct tpm_chip *chip) -{ - int rc; - - if (chip) { - if (!tpm_try_get_ops(chip)) - return chip; - return NULL; - } - - chip =3D tpm_default_chip(); - if (!chip) - return NULL; - rc =3D tpm_try_get_ops(chip); - /* release additional reference we got from tpm_default_chip() */ - put_device(&chip->dev); - if (rc) - return NULL; - return chip; -} - /** * tpm_dev_release() - free chip memory and the device number * @dev: the character device for the TPM chip diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interf= ace.c index b71725827743..8f65dc06a157 100644 --- a/drivers/char/tpm/tpm-interface.c +++ b/drivers/char/tpm/tpm-interface.c @@ -313,10 +313,13 @@ int tpm_is_tpm2(struct tpm_chip *chip) { int rc; =20 - chip =3D tpm_find_get_ops(chip); if (!chip) return -ENODEV; =20 + rc =3D tpm_try_get_ops(chip); + if (rc) + return rc; + rc =3D (chip->flags & TPM_CHIP_FLAG_TPM2) !=3D 0; =20 tpm_put_ops(chip); @@ -338,10 +341,13 @@ int tpm_pcr_read(struct tpm_chip *chip, u32 pcr_idx, { int rc; =20 - chip =3D tpm_find_get_ops(chip); if (!chip) return -ENODEV; =20 + rc =3D tpm_try_get_ops(chip); + if (rc) + return rc; + if (chip->flags & TPM_CHIP_FLAG_TPM2) rc =3D tpm2_pcr_read(chip, pcr_idx, digest, NULL); else @@ -369,10 +375,13 @@ int tpm_pcr_extend(struct tpm_chip *chip, u32 pcr_idx, int rc; int i; =20 - chip =3D tpm_find_get_ops(chip); if (!chip) return -ENODEV; =20 + rc =3D tpm_try_get_ops(chip); + if (rc) + return rc; + for (i =3D 0; i < chip->nr_allocated_banks; i++) { if (digests[i].alg_id !=3D chip->allocated_banks[i].alg_id) { rc =3D -EINVAL; @@ -492,10 +501,13 @@ int tpm_get_random(struct tpm_chip *chip, u8 *out, si= ze_t max) if (!out || max > TPM_MAX_RNG_DATA) return -EINVAL; =20 - chip =3D tpm_find_get_ops(chip); if (!chip) return -ENODEV; =20 + rc =3D tpm_try_get_ops(chip); + if (rc) + return rc; + if (chip->flags & TPM_CHIP_FLAG_TPM2) rc =3D tpm2_get_random(chip, out, max); else diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h index 7bb87fa5f7a1..9c158c55c05f 100644 --- a/drivers/char/tpm/tpm.h +++ b/drivers/char/tpm/tpm.h @@ -267,7 +267,6 @@ static inline void tpm_msleep(unsigned int delay_msec) int tpm_chip_bootstrap(struct tpm_chip *chip); int tpm_chip_start(struct tpm_chip *chip); void tpm_chip_stop(struct tpm_chip *chip); -struct tpm_chip *tpm_find_get_ops(struct tpm_chip *chip); =20 struct tpm_chip *tpm_chip_alloc(struct device *dev, const struct tpm_class_ops *ops); diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_cor= e.c index 4b12c4b9da8b..73b94f4daf4b 100644 --- a/drivers/char/tpm/tpm_tis_core.c +++ b/drivers/char/tpm/tpm_tis_core.c @@ -265,8 +265,7 @@ static u8 tpm_tis_status(struct tpm_chip *chip) =20 /* * Dump stack for forensics, as invalid TPM_STS.x could be - * potentially triggered by impaired tpm_try_get_ops() or - * tpm_find_get_ops(). + * potentially triggered by impaired tpm_try_get_ops(). */ dump_stack(); } --=20 2.51.0 From nobody Thu Oct 2 02:05:53 2025 Received: from the.earth.li (the.earth.li [93.93.131.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B30E61E2614; Tue, 23 Sep 2025 17:10:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=93.93.131.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1758647425; cv=none; b=htY6VCegPNX+mN43Bz4flv1uMbq0A6W3lElDCEpVJF41bU6c2R7v+QVFPlAgcFn1jZ10xaj8hEGYVvC/juwWwq5N5NW5XzKM4XSRKkszbaCIhD67gbY4AjapkJUA41uvPLdeg8GD6Wpr9B3lBMPKLk/ARMF0GOLkT5tjQdFSF+E= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1758647425; c=relaxed/simple; bh=ZOzu9BdZ0SlwHBmXmTTqAUFZJ8YWSzPhWk3/MnnRPCs=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=PAuBWma1tRKOlW45rb9j27ddnqFlqq/0CJhQRqPVUMaEvDMMhwJHt4/uair90LKGbxSXBh+Ijpw1LxmwqkvIKNrnFwOkf0InSesV4VCAWiTNh40TZcd7iBrHBuLnPk10YoApBQATI6Ic+AO1ueIsbmncAzHSVU4BrL6rpiY4ztY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=earth.li; spf=pass smtp.mailfrom=earth.li; dkim=pass (2048-bit key) header.d=earth.li header.i=@earth.li header.b=kGZX5MMY; arc=none smtp.client-ip=93.93.131.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=earth.li Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=earth.li Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=earth.li header.i=@earth.li header.b="kGZX5MMY" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=earth.li; s=the; h=In-Reply-To:Content-Type:MIME-Version:References:Message-ID:Subject: Cc:To:From:Date:Sender:Reply-To:Content-Transfer-Encoding:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=AkJbGSmYgk7y1LEJPqfv5uvY4sEAiOWetkFPsQTO1RI=; b=kGZX5MMYK0xSsHQq4NbkyhaP+6 YEMFQQHdmHk6lEdDizpbaFfZHurqG1serbJ/2h1skupTSQeQ2pIoolneB+kfVkLLY9n54LMiOm2SY 3RLNGzCOBIuZlK/ak1jtI97Q/zFyXdmcPZb8JExoNNu2cQDlOLAVcsjr/mUQdl80CWGyT9CqGe9w4 HpItYmLirhR5Igdbv1fBmyvVGnLs38mThLwP0bvWdjrJjJSOWXDQihVAQcnM/gybmk3rNMZT1877j Ah1hqcMYBe5wIxMxbn859zb4Cm/XYBkCBRwae36onHeJzGulzW/qK0GZR5uaYWD5qYTL3oUY5kJ9s 2jCbBq+Q==; Received: from noodles by the.earth.li with local (Exim 4.96) (envelope-from ) id 1v16Wx-00CZmE-2e; Tue, 23 Sep 2025 18:10:19 +0100 Date: Tue, 23 Sep 2025 18:10:19 +0100 From: Jonathan McDowell To: Peter Huewe , Jarkko Sakkinen , Jason Gunthorpe Cc: linux-integrity@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v2 3/4] tpm: Allow for exclusive TPM access when using /dev/tpm Message-ID: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Jonathan McDowell There are situations where userspace might reasonably desire exclusive access to the TPM, or the kernel's internal context saving + flushing may cause issues, for example when performing firmware upgrades. Extend the locking already used for avoiding concurrent userspace access to prevent internal users of the TPM when /dev/tpm is in use. The few internal users who already hold the open_lock are changed to use tpm_(try_get|put)_ops_locked, with the old tpm_(try_get|put)_ops functions changing to obtain read access to the open_lock. We return -EBUSY when another user has exclusive access, rather than adding waits. Signed-off-by: Jonathan McDowell Reviewed-by: Jarkko Sakkinen --- v2: Switch to _locked instead of _internal_ for function names. drivers/char/tpm/tpm-chip.c | 53 +++++++++++++++++++++++++------ drivers/char/tpm/tpm-dev-common.c | 8 ++--- drivers/char/tpm/tpm.h | 2 ++ drivers/char/tpm/tpm2-space.c | 5 ++- 4 files changed, 52 insertions(+), 16 deletions(-) diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c index ba906966721a..687f6d8cd601 100644 --- a/drivers/char/tpm/tpm-chip.c +++ b/drivers/char/tpm/tpm-chip.c @@ -144,7 +144,7 @@ void tpm_chip_stop(struct tpm_chip *chip) EXPORT_SYMBOL_GPL(tpm_chip_stop); =20 /** - * tpm_try_get_ops() - Get a ref to the tpm_chip + * tpm_try_get_ops_locked() - Get a ref to the tpm_chip * @chip: Chip to ref * * The caller must already have some kind of locking to ensure that chip is @@ -154,7 +154,7 @@ EXPORT_SYMBOL_GPL(tpm_chip_stop); * * Returns -ERRNO if the chip could not be got. */ -int tpm_try_get_ops(struct tpm_chip *chip) +int tpm_try_get_ops_locked(struct tpm_chip *chip) { int rc =3D -EIO; =20 @@ -185,22 +185,57 @@ int tpm_try_get_ops(struct tpm_chip *chip) put_device(&chip->dev); return rc; } -EXPORT_SYMBOL_GPL(tpm_try_get_ops); =20 /** - * tpm_put_ops() - Release a ref to the tpm_chip + * tpm_put_ops_locked() - Release a ref to the tpm_chip * @chip: Chip to put * - * This is the opposite pair to tpm_try_get_ops(). After this returns chip= may - * be kfree'd. + * This is the opposite pair to tpm_try_get_ops_locked(). After this retur= ns + * chip may be kfree'd. */ -void tpm_put_ops(struct tpm_chip *chip) +void tpm_put_ops_locked(struct tpm_chip *chip) { tpm_chip_stop(chip); mutex_unlock(&chip->tpm_mutex); up_read(&chip->ops_sem); put_device(&chip->dev); } + +/** + * tpm_try_get_ops() - Get a ref to the tpm_chip + * @chip: Chip to ref + * + * The caller must already have some kind of locking to ensure that chip is + * valid. This function will attempt to get the open_lock for the chip, + * ensuring no other user is expecting exclusive access, before locking the + * chip so that the ops member can be accessed safely. The locking prevents + * tpm_chip_unregister from completing, so it should not be held for long + * periods. + * + * Returns -ERRNO if the chip could not be got. + */ +int tpm_try_get_ops(struct tpm_chip *chip) +{ + if (!down_read_trylock(&chip->open_lock)) + return -EBUSY; + + return tpm_try_get_ops_locked(chip); +} +EXPORT_SYMBOL_GPL(tpm_try_get_ops); + +/** + * tpm_put_ops() - Release a ref to the tpm_chip + * @chip: Chip to put + * + * This is the opposite pair to tpm_try_get_ops(). After this returns + * chip may be kfree'd. + */ +void tpm_put_ops(struct tpm_chip *chip) +{ + tpm_put_ops_locked(chip); + + up_read(&chip->open_lock); +} EXPORT_SYMBOL_GPL(tpm_put_ops); =20 /** @@ -644,10 +679,10 @@ void tpm_chip_unregister(struct tpm_chip *chip) #ifdef CONFIG_TCG_TPM2_HMAC int rc; =20 - rc =3D tpm_try_get_ops(chip); + rc =3D tpm_try_get_ops_locked(chip); if (!rc) { tpm2_end_auth_session(chip); - tpm_put_ops(chip); + tpm_put_ops_locked(chip); } #endif =20 diff --git a/drivers/char/tpm/tpm-dev-common.c b/drivers/char/tpm/tpm-dev-c= ommon.c index f2a5e09257dd..0f5bc63411aa 100644 --- a/drivers/char/tpm/tpm-dev-common.c +++ b/drivers/char/tpm/tpm-dev-common.c @@ -65,7 +65,7 @@ static void tpm_dev_async_work(struct work_struct *work) =20 mutex_lock(&priv->buffer_mutex); priv->command_enqueued =3D false; - ret =3D tpm_try_get_ops(priv->chip); + ret =3D tpm_try_get_ops_locked(priv->chip); if (ret) { priv->response_length =3D ret; goto out; @@ -73,7 +73,7 @@ static void tpm_dev_async_work(struct work_struct *work) =20 ret =3D tpm_dev_transmit(priv->chip, priv->space, priv->data_buffer, sizeof(priv->data_buffer)); - tpm_put_ops(priv->chip); + tpm_put_ops_locked(priv->chip); =20 /* * If ret is > 0 then tpm_dev_transmit returned the size of the @@ -220,14 +220,14 @@ ssize_t tpm_common_write(struct file *file, const cha= r __user *buf, * lock during this period so that the tpm can be unregistered even if * the char dev is held open. */ - if (tpm_try_get_ops(priv->chip)) { + if (tpm_try_get_ops_locked(priv->chip)) { ret =3D -EPIPE; goto out; } =20 ret =3D tpm_dev_transmit(priv->chip, priv->space, priv->data_buffer, sizeof(priv->data_buffer)); - tpm_put_ops(priv->chip); + tpm_put_ops_locked(priv->chip); =20 if (ret > 0) { priv->response_length =3D ret; diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h index 9c158c55c05f..c2ec56e2cd24 100644 --- a/drivers/char/tpm/tpm.h +++ b/drivers/char/tpm/tpm.h @@ -272,6 +272,8 @@ struct tpm_chip *tpm_chip_alloc(struct device *dev, const struct tpm_class_ops *ops); struct tpm_chip *tpmm_chip_alloc(struct device *pdev, const struct tpm_class_ops *ops); +int tpm_try_get_ops_locked(struct tpm_chip *chip); +void tpm_put_ops_locked(struct tpm_chip *chip); int tpm_chip_register(struct tpm_chip *chip); void tpm_chip_unregister(struct tpm_chip *chip); =20 diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c index 60354cd53b5c..0ad5e18355e0 100644 --- a/drivers/char/tpm/tpm2-space.c +++ b/drivers/char/tpm/tpm2-space.c @@ -58,10 +58,9 @@ int tpm2_init_space(struct tpm_space *space, unsigned in= t buf_size) =20 void tpm2_del_space(struct tpm_chip *chip, struct tpm_space *space) { - - if (tpm_try_get_ops(chip) =3D=3D 0) { + if (tpm_try_get_ops_locked(chip) =3D=3D 0) { tpm2_flush_sessions(chip, space); - tpm_put_ops(chip); + tpm_put_ops_locked(chip); } =20 kfree(space->context_buf); --=20 2.51.0 From nobody Thu Oct 2 02:05:53 2025 Received: from the.earth.li (the.earth.li [93.93.131.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B233F27A446; Tue, 23 Sep 2025 17:10:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=93.93.131.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1758647433; cv=none; b=VO0A/fkoTib91osp40fV1eUWi3IVQqPsrJRV30hfSWxxN3xFy5MWIRIjaPWzbZsu4udzWc4hUWkhXZ2DZkH1unH5Y2mXz21gKXwETf5A0Qlz9gJe4KwPT/51HmDwZIMX9Z0IpWj4jkKYL+aKb7uYZU4F6tv8pwzYTdVMYxlc9to= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1758647433; c=relaxed/simple; bh=epzen24Lm8XzZMpzLT7sc1zAzVAnYPLwQkRE282JBxU=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=aHmDKmMXcQNhgTFbECU2KLQ1MZt4jN1IsUxTzfn9IRh7WKhd2DDJvNU5eMXppvjKu7TuWn9+mikziRIZuZIVYQCx7JYqwBWC3ptMBJDpW1Tf5loYvpjhqSKgjp/ewviSKJPlpFrHQ5QpOR1ENIf6+nc6rCl5J8vcnKe+JIcUx4Q= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=earth.li; spf=pass smtp.mailfrom=earth.li; dkim=pass (2048-bit key) header.d=earth.li header.i=@earth.li header.b=X93kTL2h; arc=none smtp.client-ip=93.93.131.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=earth.li Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=earth.li Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=earth.li header.i=@earth.li header.b="X93kTL2h" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=earth.li; s=the; h=In-Reply-To:Content-Type:MIME-Version:References:Message-ID:Subject: Cc:To:From:Date:Sender:Reply-To:Content-Transfer-Encoding:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=/AClO5jmdv6vuid5xiiEBjr0hK793sZbq2gbKxWSDR0=; b=X93kTL2hChVR0+wDn6jAJ2b55t Qe8OTtnj4H5jmhy+7/M0BQbDQW1pUQbZyQV1WVzWuhgNZakEAeBGnpEN6M9OPmYEQizaEDxkBrHTd IRYYurViR2bMw01MFxVCv29FGW37+80M0faOgatpnGvpCYxdoeior0XVk8xkI+WEC6f5/DyLv+vOb 0wzYeEfQMitcfqobDxfsYNvBZEwlhBb1gUOnrKi6BIKLezFMmUfSDu1NaPNMxn4aN86eKrhw8p77o z5/m/3XBY81wfXanGR13DMZDG3isOicwaqVOoNmyeoiazovbFm8K+qSkf4FX3Bhx7PUKqhiY/04fP vfp/RRvw==; Received: from noodles by the.earth.li with local (Exim 4.96) (envelope-from ) id 1v16X6-00CZpf-2E; Tue, 23 Sep 2025 18:10:28 +0100 Date: Tue, 23 Sep 2025 18:10:28 +0100 From: Jonathan McDowell To: Peter Huewe , Jarkko Sakkinen , Jason Gunthorpe Cc: linux-integrity@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v2 4/4] tpm: Require O_EXCL for exclusive /dev/tpm access Message-ID: <83a323d597819d928da45b5b3914b37375c67869.1758646791.git.noodles@meta.com> References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Jonathan McDowell Given that /dev/tpm has not had exclusive access to the TPM since the existence of the kernel resource broker and other internal users, stop defaulted to exclusive access to the first client that opens the device. Continue to support exclusive access, but only with the use of the O_EXCL flag on device open. Signed-off-by: Jonathan McDowell Reviewed-by: Jarkko Sakkinen --- drivers/char/tpm/tpm-dev.c | 25 +++++++++++++++++++------ drivers/char/tpm/tpm-dev.h | 1 + 2 files changed, 20 insertions(+), 6 deletions(-) diff --git a/drivers/char/tpm/tpm-dev.c b/drivers/char/tpm/tpm-dev.c index 80c4b3f3ad18..8921bbb541c1 100644 --- a/drivers/char/tpm/tpm-dev.c +++ b/drivers/char/tpm/tpm-dev.c @@ -19,15 +19,21 @@ static int tpm_open(struct inode *inode, struct file *f= ile) { struct tpm_chip *chip; struct file_priv *priv; + int rc; =20 chip =3D container_of(inode->i_cdev, struct tpm_chip, cdev); =20 /* - * Only one client is allowed to have /dev/tpm0 open at a time, so we - * treat it as a write lock. The shared /dev/tpmrm0 is treated as a - * read lock. + * If a client uses the O_EXCL flag then it expects to be the only TPM + * user, so we treat it as a write lock. Otherwise we do as /dev/tpmrm + * and use a read lock. */ - if (!down_write_trylock(&chip->open_lock)) { + if (file->f_flags & O_EXCL) + rc =3D down_write_trylock(&chip->open_lock); + else + rc =3D down_read_trylock(&chip->open_lock); + + if (!rc) { dev_dbg(&chip->dev, "Another process owns this TPM\n"); return -EBUSY; } @@ -35,13 +41,17 @@ static int tpm_open(struct inode *inode, struct file *f= ile) priv =3D kzalloc(sizeof(*priv), GFP_KERNEL); if (priv =3D=3D NULL) goto out; + priv->exclusive =3D (file->f_flags & O_EXCL); =20 tpm_common_open(file, chip, priv, NULL); =20 return 0; =20 out: - up_write(&chip->open_lock); + if (file->f_flags & O_EXCL) + up_write(&chip->open_lock); + else + up_read(&chip->open_lock); return -ENOMEM; } =20 @@ -53,7 +63,10 @@ static int tpm_release(struct inode *inode, struct file = *file) struct file_priv *priv =3D file->private_data; =20 tpm_common_release(file, priv); - up_write(&priv->chip->open_lock); + if (priv->exclusive) + up_write(&priv->chip->open_lock); + else + up_read(&priv->chip->open_lock); kfree(priv); =20 return 0; diff --git a/drivers/char/tpm/tpm-dev.h b/drivers/char/tpm/tpm-dev.h index f3742bcc73e3..0ad8504c73e4 100644 --- a/drivers/char/tpm/tpm-dev.h +++ b/drivers/char/tpm/tpm-dev.h @@ -17,6 +17,7 @@ struct file_priv { ssize_t response_length; bool response_read; bool command_enqueued; + bool exclusive; =20 u8 data_buffer[TPM_BUFSIZE]; }; --=20 2.51.0