1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* ----------------------------------------------------------------------- * 3 * 4 * Copyright 2000-2008 H. Peter Anvin - All Rights Reserved 5 * Copyright 2009 Intel Corporation; author: H. Peter Anvin 6 * 7 * ----------------------------------------------------------------------- */ 8 9 /* 10 * x86 MSR access device 11 * 12 * This device is accessed by lseek() to the appropriate register number 13 * and then read/write in chunks of 8 bytes. A larger size means multiple 14 * reads or writes of the same register. 15 * 16 * Writing the same register multiple times can be useful for MSRs with 17 * I/O-like semantics, e.g. a virtual MSR that accepts logging information. 18 * 19 * This driver uses /dev/cpu/%d/msr where %d is the minor number, and on 20 * an SMP box will direct the access to CPU %d. 21 */ 22 23 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 24 25 #include <linux/module.h> 26 27 #include <linux/types.h> 28 #include <linux/errno.h> 29 #include <linux/fcntl.h> 30 #include <linux/init.h> 31 #include <linux/poll.h> 32 #include <linux/smp.h> 33 #include <linux/major.h> 34 #include <linux/fs.h> 35 #include <linux/device.h> 36 #include <linux/cpu.h> 37 #include <linux/notifier.h> 38 #include <linux/uaccess.h> 39 #include <linux/gfp.h> 40 #include <linux/security.h> 41 42 #include <asm/cpufeature.h> 43 #include <asm/msr.h> 44 45 static enum cpuhp_state cpuhp_msr_state; 46 47 enum allow_write_msrs { 48 MSR_WRITES_ON, 49 MSR_WRITES_OFF, 50 MSR_WRITES_DEFAULT, 51 }; 52 53 static enum allow_write_msrs allow_writes = MSR_WRITES_DEFAULT; 54 55 static ssize_t msr_read(struct file *file, char __user *buf, 56 size_t count, loff_t *ppos) 57 { 58 u32 __user *tmp = (u32 __user *) buf; 59 u64 data; 60 u32 reg = *ppos; 61 int cpu = iminor(file_inode(file)); 62 int err = 0; 63 ssize_t bytes = 0; 64 65 if (count % 8) 66 return -EINVAL; /* Invalid chunk size */ 67 68 for (; count; count -= 8) { 69 err = rdmsrq_safe_on_cpu(cpu, reg, &data); 70 if (err) 71 break; 72 if (copy_to_user(tmp, &data, 8)) { 73 err = -EFAULT; 74 break; 75 } 76 tmp += 2; 77 bytes += 8; 78 } 79 80 return bytes ? bytes : err; 81 } 82 83 static int filter_write(u32 reg) 84 { 85 /* 86 * MSRs writes usually happen all at once, and can easily saturate kmsg. 87 * Only allow one message every 30 seconds. 88 * 89 * It's possible to be smarter here and do it (for example) per-MSR, but 90 * it would certainly be more complex, and this is enough at least to 91 * avoid saturating the ring buffer. 92 */ 93 static DEFINE_RATELIMIT_STATE(fw_rs, 30 * HZ, 1); 94 95 switch (allow_writes) { 96 case MSR_WRITES_ON: return 0; 97 case MSR_WRITES_OFF: return -EPERM; 98 default: break; 99 } 100 101 if (!__ratelimit(&fw_rs)) 102 return 0; 103 104 pr_warn("Write to unrecognized MSR 0x%x by %s (pid: %d), tainting CPU_OUT_OF_SPEC.\n", 105 reg, current->comm, current->pid); 106 pr_warn("See https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/about for details.\n"); 107 108 return 0; 109 } 110 111 static ssize_t msr_write(struct file *file, const char __user *buf, 112 size_t count, loff_t *ppos) 113 { 114 const u32 __user *tmp = (const u32 __user *)buf; 115 u64 data; 116 u32 reg = *ppos; 117 int cpu = iminor(file_inode(file)); 118 int err = 0; 119 ssize_t bytes = 0; 120 121 err = security_locked_down(LOCKDOWN_MSR); 122 if (err) 123 return err; 124 125 err = filter_write(reg); 126 if (err) 127 return err; 128 129 if (count % 8) 130 return -EINVAL; /* Invalid chunk size */ 131 132 for (; count; count -= 8) { 133 if (copy_from_user(&data, tmp, 8)) { 134 err = -EFAULT; 135 break; 136 } 137 138 add_taint(TAINT_CPU_OUT_OF_SPEC, LOCKDEP_STILL_OK); 139 140 err = wrmsrq_safe_on_cpu(cpu, reg, data); 141 if (err) 142 break; 143 144 tmp += 2; 145 bytes += 8; 146 } 147 148 return bytes ? bytes : err; 149 } 150 151 static long msr_ioctl(struct file *file, unsigned int ioc, unsigned long arg) 152 { 153 u32 __user *uregs = (u32 __user *)arg; 154 u32 regs[8]; 155 int cpu = iminor(file_inode(file)); 156 int err; 157 158 switch (ioc) { 159 case X86_IOC_RDMSR_REGS: 160 if (!(file->f_mode & FMODE_READ)) { 161 err = -EBADF; 162 break; 163 } 164 if (copy_from_user(®s, uregs, sizeof(regs))) { 165 err = -EFAULT; 166 break; 167 } 168 err = rdmsr_safe_regs_on_cpu(cpu, regs); 169 if (err) 170 break; 171 if (copy_to_user(uregs, ®s, sizeof(regs))) 172 err = -EFAULT; 173 break; 174 175 case X86_IOC_WRMSR_REGS: 176 if (!(file->f_mode & FMODE_WRITE)) { 177 err = -EBADF; 178 break; 179 } 180 if (copy_from_user(®s, uregs, sizeof(regs))) { 181 err = -EFAULT; 182 break; 183 } 184 err = security_locked_down(LOCKDOWN_MSR); 185 if (err) 186 break; 187 188 err = filter_write(regs[1]); 189 if (err) 190 return err; 191 192 add_taint(TAINT_CPU_OUT_OF_SPEC, LOCKDEP_STILL_OK); 193 194 err = wrmsr_safe_regs_on_cpu(cpu, regs); 195 if (err) 196 break; 197 if (copy_to_user(uregs, ®s, sizeof(regs))) 198 err = -EFAULT; 199 break; 200 201 default: 202 err = -ENOTTY; 203 break; 204 } 205 206 return err; 207 } 208 209 static int msr_open(struct inode *inode, struct file *file) 210 { 211 unsigned int cpu = iminor(file_inode(file)); 212 struct cpuinfo_x86 *c; 213 214 if (!capable(CAP_SYS_RAWIO)) 215 return -EPERM; 216 217 if (cpu >= nr_cpu_ids || !cpu_online(cpu)) 218 return -ENXIO; /* No such CPU */ 219 220 c = &cpu_data(cpu); 221 if (!cpu_has(c, X86_FEATURE_MSR)) 222 return -EIO; /* MSR not supported */ 223 224 return 0; 225 } 226 227 /* 228 * File operations we support 229 */ 230 static const struct file_operations msr_fops = { 231 .owner = THIS_MODULE, 232 .llseek = no_seek_end_llseek, 233 .read = msr_read, 234 .write = msr_write, 235 .open = msr_open, 236 .unlocked_ioctl = msr_ioctl, 237 .compat_ioctl = msr_ioctl, 238 }; 239 240 static char *msr_devnode(const struct device *dev, umode_t *mode) 241 { 242 return kasprintf(GFP_KERNEL, "cpu/%u/msr", MINOR(dev->devt)); 243 } 244 245 static const struct class msr_class = { 246 .name = "msr", 247 .devnode = msr_devnode, 248 }; 249 250 static int msr_device_create(unsigned int cpu) 251 { 252 struct device *dev; 253 254 dev = device_create(&msr_class, NULL, MKDEV(MSR_MAJOR, cpu), NULL, 255 "msr%d", cpu); 256 return PTR_ERR_OR_ZERO(dev); 257 } 258 259 static int msr_device_destroy(unsigned int cpu) 260 { 261 device_destroy(&msr_class, MKDEV(MSR_MAJOR, cpu)); 262 return 0; 263 } 264 265 static int __init msr_init(void) 266 { 267 int err; 268 269 if (__register_chrdev(MSR_MAJOR, 0, NR_CPUS, "cpu/msr", &msr_fops)) { 270 pr_err("unable to get major %d for msr\n", MSR_MAJOR); 271 return -EBUSY; 272 } 273 err = class_register(&msr_class); 274 if (err) 275 goto out_chrdev; 276 277 err = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "x86/msr:online", 278 msr_device_create, msr_device_destroy); 279 if (err < 0) 280 goto out_class; 281 cpuhp_msr_state = err; 282 return 0; 283 284 out_class: 285 class_unregister(&msr_class); 286 out_chrdev: 287 __unregister_chrdev(MSR_MAJOR, 0, NR_CPUS, "cpu/msr"); 288 return err; 289 } 290 module_init(msr_init); 291 292 static void __exit msr_exit(void) 293 { 294 cpuhp_remove_state(cpuhp_msr_state); 295 class_unregister(&msr_class); 296 __unregister_chrdev(MSR_MAJOR, 0, NR_CPUS, "cpu/msr"); 297 } 298 module_exit(msr_exit) 299 300 static int set_allow_writes(const char *val, const struct kernel_param *cp) 301 { 302 /* val is NUL-terminated, see kernfs_fop_write() */ 303 char *s = strstrip((char *)val); 304 305 if (!strcmp(s, "on")) 306 allow_writes = MSR_WRITES_ON; 307 else if (!strcmp(s, "off")) 308 allow_writes = MSR_WRITES_OFF; 309 else 310 allow_writes = MSR_WRITES_DEFAULT; 311 312 return 0; 313 } 314 315 static int get_allow_writes(char *buf, const struct kernel_param *kp) 316 { 317 const char *res; 318 319 switch (allow_writes) { 320 case MSR_WRITES_ON: res = "on"; break; 321 case MSR_WRITES_OFF: res = "off"; break; 322 default: res = "default"; break; 323 } 324 325 return sprintf(buf, "%s\n", res); 326 } 327 328 static const struct kernel_param_ops allow_writes_ops = { 329 .set = set_allow_writes, 330 .get = get_allow_writes 331 }; 332 333 module_param_cb(allow_writes, &allow_writes_ops, NULL, 0600); 334 335 MODULE_AUTHOR("H. Peter Anvin <hpa@zytor.com>"); 336 MODULE_DESCRIPTION("x86 generic MSR driver"); 337 MODULE_LICENSE("GPL"); 338