Back to home page

OSCL-LXR

 
 

    


0001 // SPDX-License-Identifier: GPL-2.0-or-later
0002 /* ----------------------------------------------------------------------- *
0003  *
0004  *   Copyright 2000-2008 H. Peter Anvin - All Rights Reserved
0005  *   Copyright 2009 Intel Corporation; author: H. Peter Anvin
0006  *
0007  * ----------------------------------------------------------------------- */
0008 
0009 /*
0010  * x86 MSR access device
0011  *
0012  * This device is accessed by lseek() to the appropriate register number
0013  * and then read/write in chunks of 8 bytes.  A larger size means multiple
0014  * reads or writes of the same register.
0015  *
0016  * This driver uses /dev/cpu/%d/msr where %d is the minor number, and on
0017  * an SMP box will direct the access to CPU %d.
0018  */
0019 
0020 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
0021 
0022 #include <linux/module.h>
0023 
0024 #include <linux/types.h>
0025 #include <linux/errno.h>
0026 #include <linux/fcntl.h>
0027 #include <linux/init.h>
0028 #include <linux/poll.h>
0029 #include <linux/smp.h>
0030 #include <linux/major.h>
0031 #include <linux/fs.h>
0032 #include <linux/device.h>
0033 #include <linux/cpu.h>
0034 #include <linux/notifier.h>
0035 #include <linux/uaccess.h>
0036 #include <linux/gfp.h>
0037 #include <linux/security.h>
0038 
0039 #include <asm/cpufeature.h>
0040 #include <asm/msr.h>
0041 
0042 static struct class *msr_class;
0043 static enum cpuhp_state cpuhp_msr_state;
0044 
0045 enum allow_write_msrs {
0046     MSR_WRITES_ON,
0047     MSR_WRITES_OFF,
0048     MSR_WRITES_DEFAULT,
0049 };
0050 
0051 static enum allow_write_msrs allow_writes = MSR_WRITES_DEFAULT;
0052 
0053 static ssize_t msr_read(struct file *file, char __user *buf,
0054             size_t count, loff_t *ppos)
0055 {
0056     u32 __user *tmp = (u32 __user *) buf;
0057     u32 data[2];
0058     u32 reg = *ppos;
0059     int cpu = iminor(file_inode(file));
0060     int err = 0;
0061     ssize_t bytes = 0;
0062 
0063     if (count % 8)
0064         return -EINVAL; /* Invalid chunk size */
0065 
0066     for (; count; count -= 8) {
0067         err = rdmsr_safe_on_cpu(cpu, reg, &data[0], &data[1]);
0068         if (err)
0069             break;
0070         if (copy_to_user(tmp, &data, 8)) {
0071             err = -EFAULT;
0072             break;
0073         }
0074         tmp += 2;
0075         bytes += 8;
0076     }
0077 
0078     return bytes ? bytes : err;
0079 }
0080 
0081 static int filter_write(u32 reg)
0082 {
0083     /*
0084      * MSRs writes usually happen all at once, and can easily saturate kmsg.
0085      * Only allow one message every 30 seconds.
0086      *
0087      * It's possible to be smarter here and do it (for example) per-MSR, but
0088      * it would certainly be more complex, and this is enough at least to
0089      * avoid saturating the ring buffer.
0090      */
0091     static DEFINE_RATELIMIT_STATE(fw_rs, 30 * HZ, 1);
0092 
0093     switch (allow_writes) {
0094     case MSR_WRITES_ON:  return 0;
0095     case MSR_WRITES_OFF: return -EPERM;
0096     default: break;
0097     }
0098 
0099     if (!__ratelimit(&fw_rs))
0100         return 0;
0101 
0102     pr_warn("Write to unrecognized MSR 0x%x by %s (pid: %d).\n",
0103             reg, current->comm, current->pid);
0104     pr_warn("See https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/about for details.\n");
0105 
0106     return 0;
0107 }
0108 
0109 static ssize_t msr_write(struct file *file, const char __user *buf,
0110              size_t count, loff_t *ppos)
0111 {
0112     const u32 __user *tmp = (const u32 __user *)buf;
0113     u32 data[2];
0114     u32 reg = *ppos;
0115     int cpu = iminor(file_inode(file));
0116     int err = 0;
0117     ssize_t bytes = 0;
0118 
0119     err = security_locked_down(LOCKDOWN_MSR);
0120     if (err)
0121         return err;
0122 
0123     err = filter_write(reg);
0124     if (err)
0125         return err;
0126 
0127     if (count % 8)
0128         return -EINVAL; /* Invalid chunk size */
0129 
0130     for (; count; count -= 8) {
0131         if (copy_from_user(&data, tmp, 8)) {
0132             err = -EFAULT;
0133             break;
0134         }
0135 
0136         add_taint(TAINT_CPU_OUT_OF_SPEC, LOCKDEP_STILL_OK);
0137 
0138         err = wrmsr_safe_on_cpu(cpu, reg, data[0], data[1]);
0139         if (err)
0140             break;
0141 
0142         tmp += 2;
0143         bytes += 8;
0144     }
0145 
0146     return bytes ? bytes : err;
0147 }
0148 
0149 static long msr_ioctl(struct file *file, unsigned int ioc, unsigned long arg)
0150 {
0151     u32 __user *uregs = (u32 __user *)arg;
0152     u32 regs[8];
0153     int cpu = iminor(file_inode(file));
0154     int err;
0155 
0156     switch (ioc) {
0157     case X86_IOC_RDMSR_REGS:
0158         if (!(file->f_mode & FMODE_READ)) {
0159             err = -EBADF;
0160             break;
0161         }
0162         if (copy_from_user(&regs, uregs, sizeof(regs))) {
0163             err = -EFAULT;
0164             break;
0165         }
0166         err = rdmsr_safe_regs_on_cpu(cpu, regs);
0167         if (err)
0168             break;
0169         if (copy_to_user(uregs, &regs, sizeof(regs)))
0170             err = -EFAULT;
0171         break;
0172 
0173     case X86_IOC_WRMSR_REGS:
0174         if (!(file->f_mode & FMODE_WRITE)) {
0175             err = -EBADF;
0176             break;
0177         }
0178         if (copy_from_user(&regs, uregs, sizeof(regs))) {
0179             err = -EFAULT;
0180             break;
0181         }
0182         err = security_locked_down(LOCKDOWN_MSR);
0183         if (err)
0184             break;
0185 
0186         err = filter_write(regs[1]);
0187         if (err)
0188             return err;
0189 
0190         add_taint(TAINT_CPU_OUT_OF_SPEC, LOCKDEP_STILL_OK);
0191 
0192         err = wrmsr_safe_regs_on_cpu(cpu, regs);
0193         if (err)
0194             break;
0195         if (copy_to_user(uregs, &regs, sizeof(regs)))
0196             err = -EFAULT;
0197         break;
0198 
0199     default:
0200         err = -ENOTTY;
0201         break;
0202     }
0203 
0204     return err;
0205 }
0206 
0207 static int msr_open(struct inode *inode, struct file *file)
0208 {
0209     unsigned int cpu = iminor(file_inode(file));
0210     struct cpuinfo_x86 *c;
0211 
0212     if (!capable(CAP_SYS_RAWIO))
0213         return -EPERM;
0214 
0215     if (cpu >= nr_cpu_ids || !cpu_online(cpu))
0216         return -ENXIO;  /* No such CPU */
0217 
0218     c = &cpu_data(cpu);
0219     if (!cpu_has(c, X86_FEATURE_MSR))
0220         return -EIO;    /* MSR not supported */
0221 
0222     return 0;
0223 }
0224 
0225 /*
0226  * File operations we support
0227  */
0228 static const struct file_operations msr_fops = {
0229     .owner = THIS_MODULE,
0230     .llseek = no_seek_end_llseek,
0231     .read = msr_read,
0232     .write = msr_write,
0233     .open = msr_open,
0234     .unlocked_ioctl = msr_ioctl,
0235     .compat_ioctl = msr_ioctl,
0236 };
0237 
0238 static int msr_device_create(unsigned int cpu)
0239 {
0240     struct device *dev;
0241 
0242     dev = device_create(msr_class, NULL, MKDEV(MSR_MAJOR, cpu), NULL,
0243                 "msr%d", cpu);
0244     return PTR_ERR_OR_ZERO(dev);
0245 }
0246 
0247 static int msr_device_destroy(unsigned int cpu)
0248 {
0249     device_destroy(msr_class, MKDEV(MSR_MAJOR, cpu));
0250     return 0;
0251 }
0252 
0253 static char *msr_devnode(struct device *dev, umode_t *mode)
0254 {
0255     return kasprintf(GFP_KERNEL, "cpu/%u/msr", MINOR(dev->devt));
0256 }
0257 
0258 static int __init msr_init(void)
0259 {
0260     int err;
0261 
0262     if (__register_chrdev(MSR_MAJOR, 0, NR_CPUS, "cpu/msr", &msr_fops)) {
0263         pr_err("unable to get major %d for msr\n", MSR_MAJOR);
0264         return -EBUSY;
0265     }
0266     msr_class = class_create(THIS_MODULE, "msr");
0267     if (IS_ERR(msr_class)) {
0268         err = PTR_ERR(msr_class);
0269         goto out_chrdev;
0270     }
0271     msr_class->devnode = msr_devnode;
0272 
0273     err  = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "x86/msr:online",
0274                  msr_device_create, msr_device_destroy);
0275     if (err < 0)
0276         goto out_class;
0277     cpuhp_msr_state = err;
0278     return 0;
0279 
0280 out_class:
0281     class_destroy(msr_class);
0282 out_chrdev:
0283     __unregister_chrdev(MSR_MAJOR, 0, NR_CPUS, "cpu/msr");
0284     return err;
0285 }
0286 module_init(msr_init);
0287 
0288 static void __exit msr_exit(void)
0289 {
0290     cpuhp_remove_state(cpuhp_msr_state);
0291     class_destroy(msr_class);
0292     __unregister_chrdev(MSR_MAJOR, 0, NR_CPUS, "cpu/msr");
0293 }
0294 module_exit(msr_exit)
0295 
0296 static int set_allow_writes(const char *val, const struct kernel_param *cp)
0297 {
0298     /* val is NUL-terminated, see kernfs_fop_write() */
0299     char *s = strstrip((char *)val);
0300 
0301     if (!strcmp(s, "on"))
0302         allow_writes = MSR_WRITES_ON;
0303     else if (!strcmp(s, "off"))
0304         allow_writes = MSR_WRITES_OFF;
0305     else
0306         allow_writes = MSR_WRITES_DEFAULT;
0307 
0308     return 0;
0309 }
0310 
0311 static int get_allow_writes(char *buf, const struct kernel_param *kp)
0312 {
0313     const char *res;
0314 
0315     switch (allow_writes) {
0316     case MSR_WRITES_ON:  res = "on"; break;
0317     case MSR_WRITES_OFF: res = "off"; break;
0318     default: res = "default"; break;
0319     }
0320 
0321     return sprintf(buf, "%s\n", res);
0322 }
0323 
0324 static const struct kernel_param_ops allow_writes_ops = {
0325     .set = set_allow_writes,
0326     .get = get_allow_writes
0327 };
0328 
0329 module_param_cb(allow_writes, &allow_writes_ops, NULL, 0600);
0330 
0331 MODULE_AUTHOR("H. Peter Anvin <hpa@zytor.com>");
0332 MODULE_DESCRIPTION("x86 generic MSR driver");
0333 MODULE_LICENSE("GPL");