Loading...
1// SPDX-License-Identifier: GPL-2.0-or-later
2/* ----------------------------------------------------------------------- *
3 *
4 * Copyright 2000-2008 H. Peter Anvin - All Rights Reserved
5 * Copyright 2009 Intel Corporation; author: H. Peter Anvin
6 *
7 * ----------------------------------------------------------------------- */
8
9/*
10 * x86 MSR access device
11 *
12 * This device is accessed by lseek() to the appropriate register number
13 * and then read/write in chunks of 8 bytes. A larger size means multiple
14 * reads or writes of the same register.
15 *
16 * This driver uses /dev/cpu/%d/msr where %d is the minor number, and on
17 * an SMP box will direct the access to CPU %d.
18 */
19
20#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
21
22#include <linux/module.h>
23
24#include <linux/types.h>
25#include <linux/errno.h>
26#include <linux/fcntl.h>
27#include <linux/init.h>
28#include <linux/poll.h>
29#include <linux/smp.h>
30#include <linux/major.h>
31#include <linux/fs.h>
32#include <linux/device.h>
33#include <linux/cpu.h>
34#include <linux/notifier.h>
35#include <linux/uaccess.h>
36#include <linux/gfp.h>
37#include <linux/security.h>
38
39#include <asm/cpufeature.h>
40#include <asm/msr.h>
41
42static enum cpuhp_state cpuhp_msr_state;
43
44enum allow_write_msrs {
45 MSR_WRITES_ON,
46 MSR_WRITES_OFF,
47 MSR_WRITES_DEFAULT,
48};
49
50static enum allow_write_msrs allow_writes = MSR_WRITES_DEFAULT;
51
52static ssize_t msr_read(struct file *file, char __user *buf,
53 size_t count, loff_t *ppos)
54{
55 u32 __user *tmp = (u32 __user *) buf;
56 u32 data[2];
57 u32 reg = *ppos;
58 int cpu = iminor(file_inode(file));
59 int err = 0;
60 ssize_t bytes = 0;
61
62 if (count % 8)
63 return -EINVAL; /* Invalid chunk size */
64
65 for (; count; count -= 8) {
66 err = rdmsr_safe_on_cpu(cpu, reg, &data[0], &data[1]);
67 if (err)
68 break;
69 if (copy_to_user(tmp, &data, 8)) {
70 err = -EFAULT;
71 break;
72 }
73 tmp += 2;
74 bytes += 8;
75 }
76
77 return bytes ? bytes : err;
78}
79
80static int filter_write(u32 reg)
81{
82 /*
83 * MSRs writes usually happen all at once, and can easily saturate kmsg.
84 * Only allow one message every 30 seconds.
85 *
86 * It's possible to be smarter here and do it (for example) per-MSR, but
87 * it would certainly be more complex, and this is enough at least to
88 * avoid saturating the ring buffer.
89 */
90 static DEFINE_RATELIMIT_STATE(fw_rs, 30 * HZ, 1);
91
92 switch (allow_writes) {
93 case MSR_WRITES_ON: return 0;
94 case MSR_WRITES_OFF: return -EPERM;
95 default: break;
96 }
97
98 if (!__ratelimit(&fw_rs))
99 return 0;
100
101 pr_warn("Write to unrecognized MSR 0x%x by %s (pid: %d).\n",
102 reg, current->comm, current->pid);
103 pr_warn("See https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/about for details.\n");
104
105 return 0;
106}
107
108static ssize_t msr_write(struct file *file, const char __user *buf,
109 size_t count, loff_t *ppos)
110{
111 const u32 __user *tmp = (const u32 __user *)buf;
112 u32 data[2];
113 u32 reg = *ppos;
114 int cpu = iminor(file_inode(file));
115 int err = 0;
116 ssize_t bytes = 0;
117
118 err = security_locked_down(LOCKDOWN_MSR);
119 if (err)
120 return err;
121
122 err = filter_write(reg);
123 if (err)
124 return err;
125
126 if (count % 8)
127 return -EINVAL; /* Invalid chunk size */
128
129 for (; count; count -= 8) {
130 if (copy_from_user(&data, tmp, 8)) {
131 err = -EFAULT;
132 break;
133 }
134
135 add_taint(TAINT_CPU_OUT_OF_SPEC, LOCKDEP_STILL_OK);
136
137 err = wrmsr_safe_on_cpu(cpu, reg, data[0], data[1]);
138 if (err)
139 break;
140
141 tmp += 2;
142 bytes += 8;
143 }
144
145 return bytes ? bytes : err;
146}
147
148static long msr_ioctl(struct file *file, unsigned int ioc, unsigned long arg)
149{
150 u32 __user *uregs = (u32 __user *)arg;
151 u32 regs[8];
152 int cpu = iminor(file_inode(file));
153 int err;
154
155 switch (ioc) {
156 case X86_IOC_RDMSR_REGS:
157 if (!(file->f_mode & FMODE_READ)) {
158 err = -EBADF;
159 break;
160 }
161 if (copy_from_user(®s, uregs, sizeof(regs))) {
162 err = -EFAULT;
163 break;
164 }
165 err = rdmsr_safe_regs_on_cpu(cpu, regs);
166 if (err)
167 break;
168 if (copy_to_user(uregs, ®s, sizeof(regs)))
169 err = -EFAULT;
170 break;
171
172 case X86_IOC_WRMSR_REGS:
173 if (!(file->f_mode & FMODE_WRITE)) {
174 err = -EBADF;
175 break;
176 }
177 if (copy_from_user(®s, uregs, sizeof(regs))) {
178 err = -EFAULT;
179 break;
180 }
181 err = security_locked_down(LOCKDOWN_MSR);
182 if (err)
183 break;
184
185 err = filter_write(regs[1]);
186 if (err)
187 return err;
188
189 add_taint(TAINT_CPU_OUT_OF_SPEC, LOCKDEP_STILL_OK);
190
191 err = wrmsr_safe_regs_on_cpu(cpu, regs);
192 if (err)
193 break;
194 if (copy_to_user(uregs, ®s, sizeof(regs)))
195 err = -EFAULT;
196 break;
197
198 default:
199 err = -ENOTTY;
200 break;
201 }
202
203 return err;
204}
205
206static int msr_open(struct inode *inode, struct file *file)
207{
208 unsigned int cpu = iminor(file_inode(file));
209 struct cpuinfo_x86 *c;
210
211 if (!capable(CAP_SYS_RAWIO))
212 return -EPERM;
213
214 if (cpu >= nr_cpu_ids || !cpu_online(cpu))
215 return -ENXIO; /* No such CPU */
216
217 c = &cpu_data(cpu);
218 if (!cpu_has(c, X86_FEATURE_MSR))
219 return -EIO; /* MSR not supported */
220
221 return 0;
222}
223
224/*
225 * File operations we support
226 */
227static const struct file_operations msr_fops = {
228 .owner = THIS_MODULE,
229 .llseek = no_seek_end_llseek,
230 .read = msr_read,
231 .write = msr_write,
232 .open = msr_open,
233 .unlocked_ioctl = msr_ioctl,
234 .compat_ioctl = msr_ioctl,
235};
236
237static char *msr_devnode(const struct device *dev, umode_t *mode)
238{
239 return kasprintf(GFP_KERNEL, "cpu/%u/msr", MINOR(dev->devt));
240}
241
242static const struct class msr_class = {
243 .name = "msr",
244 .devnode = msr_devnode,
245};
246
247static int msr_device_create(unsigned int cpu)
248{
249 struct device *dev;
250
251 dev = device_create(&msr_class, NULL, MKDEV(MSR_MAJOR, cpu), NULL,
252 "msr%d", cpu);
253 return PTR_ERR_OR_ZERO(dev);
254}
255
256static int msr_device_destroy(unsigned int cpu)
257{
258 device_destroy(&msr_class, MKDEV(MSR_MAJOR, cpu));
259 return 0;
260}
261
262static int __init msr_init(void)
263{
264 int err;
265
266 if (__register_chrdev(MSR_MAJOR, 0, NR_CPUS, "cpu/msr", &msr_fops)) {
267 pr_err("unable to get major %d for msr\n", MSR_MAJOR);
268 return -EBUSY;
269 }
270 err = class_register(&msr_class);
271 if (err)
272 goto out_chrdev;
273
274 err = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "x86/msr:online",
275 msr_device_create, msr_device_destroy);
276 if (err < 0)
277 goto out_class;
278 cpuhp_msr_state = err;
279 return 0;
280
281out_class:
282 class_unregister(&msr_class);
283out_chrdev:
284 __unregister_chrdev(MSR_MAJOR, 0, NR_CPUS, "cpu/msr");
285 return err;
286}
287module_init(msr_init);
288
289static void __exit msr_exit(void)
290{
291 cpuhp_remove_state(cpuhp_msr_state);
292 class_unregister(&msr_class);
293 __unregister_chrdev(MSR_MAJOR, 0, NR_CPUS, "cpu/msr");
294}
295module_exit(msr_exit)
296
297static int set_allow_writes(const char *val, const struct kernel_param *cp)
298{
299 /* val is NUL-terminated, see kernfs_fop_write() */
300 char *s = strstrip((char *)val);
301
302 if (!strcmp(s, "on"))
303 allow_writes = MSR_WRITES_ON;
304 else if (!strcmp(s, "off"))
305 allow_writes = MSR_WRITES_OFF;
306 else
307 allow_writes = MSR_WRITES_DEFAULT;
308
309 return 0;
310}
311
312static int get_allow_writes(char *buf, const struct kernel_param *kp)
313{
314 const char *res;
315
316 switch (allow_writes) {
317 case MSR_WRITES_ON: res = "on"; break;
318 case MSR_WRITES_OFF: res = "off"; break;
319 default: res = "default"; break;
320 }
321
322 return sprintf(buf, "%s\n", res);
323}
324
325static const struct kernel_param_ops allow_writes_ops = {
326 .set = set_allow_writes,
327 .get = get_allow_writes
328};
329
330module_param_cb(allow_writes, &allow_writes_ops, NULL, 0600);
331
332MODULE_AUTHOR("H. Peter Anvin <hpa@zytor.com>");
333MODULE_DESCRIPTION("x86 generic MSR driver");
334MODULE_LICENSE("GPL");
1/* ----------------------------------------------------------------------- *
2 *
3 * Copyright 2000-2008 H. Peter Anvin - All Rights Reserved
4 * Copyright 2009 Intel Corporation; author: H. Peter Anvin
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation, Inc., 675 Mass Ave, Cambridge MA 02139,
9 * USA; either version 2 of the License, or (at your option) any later
10 * version; incorporated herein by reference.
11 *
12 * ----------------------------------------------------------------------- */
13
14/*
15 * x86 MSR access device
16 *
17 * This device is accessed by lseek() to the appropriate register number
18 * and then read/write in chunks of 8 bytes. A larger size means multiple
19 * reads or writes of the same register.
20 *
21 * This driver uses /dev/cpu/%d/msr where %d is the minor number, and on
22 * an SMP box will direct the access to CPU %d.
23 */
24
25#include <linux/module.h>
26
27#include <linux/types.h>
28#include <linux/errno.h>
29#include <linux/fcntl.h>
30#include <linux/init.h>
31#include <linux/poll.h>
32#include <linux/smp.h>
33#include <linux/major.h>
34#include <linux/fs.h>
35#include <linux/device.h>
36#include <linux/cpu.h>
37#include <linux/notifier.h>
38#include <linux/uaccess.h>
39#include <linux/gfp.h>
40
41#include <asm/processor.h>
42#include <asm/msr.h>
43
44static struct class *msr_class;
45
46static loff_t msr_seek(struct file *file, loff_t offset, int orig)
47{
48 loff_t ret;
49 struct inode *inode = file->f_mapping->host;
50
51 mutex_lock(&inode->i_mutex);
52 switch (orig) {
53 case 0:
54 file->f_pos = offset;
55 ret = file->f_pos;
56 break;
57 case 1:
58 file->f_pos += offset;
59 ret = file->f_pos;
60 break;
61 default:
62 ret = -EINVAL;
63 }
64 mutex_unlock(&inode->i_mutex);
65 return ret;
66}
67
68static ssize_t msr_read(struct file *file, char __user *buf,
69 size_t count, loff_t *ppos)
70{
71 u32 __user *tmp = (u32 __user *) buf;
72 u32 data[2];
73 u32 reg = *ppos;
74 int cpu = iminor(file->f_path.dentry->d_inode);
75 int err = 0;
76 ssize_t bytes = 0;
77
78 if (count % 8)
79 return -EINVAL; /* Invalid chunk size */
80
81 for (; count; count -= 8) {
82 err = rdmsr_safe_on_cpu(cpu, reg, &data[0], &data[1]);
83 if (err)
84 break;
85 if (copy_to_user(tmp, &data, 8)) {
86 err = -EFAULT;
87 break;
88 }
89 tmp += 2;
90 bytes += 8;
91 }
92
93 return bytes ? bytes : err;
94}
95
96static ssize_t msr_write(struct file *file, const char __user *buf,
97 size_t count, loff_t *ppos)
98{
99 const u32 __user *tmp = (const u32 __user *)buf;
100 u32 data[2];
101 u32 reg = *ppos;
102 int cpu = iminor(file->f_path.dentry->d_inode);
103 int err = 0;
104 ssize_t bytes = 0;
105
106 if (count % 8)
107 return -EINVAL; /* Invalid chunk size */
108
109 for (; count; count -= 8) {
110 if (copy_from_user(&data, tmp, 8)) {
111 err = -EFAULT;
112 break;
113 }
114 err = wrmsr_safe_on_cpu(cpu, reg, data[0], data[1]);
115 if (err)
116 break;
117 tmp += 2;
118 bytes += 8;
119 }
120
121 return bytes ? bytes : err;
122}
123
124static long msr_ioctl(struct file *file, unsigned int ioc, unsigned long arg)
125{
126 u32 __user *uregs = (u32 __user *)arg;
127 u32 regs[8];
128 int cpu = iminor(file->f_path.dentry->d_inode);
129 int err;
130
131 switch (ioc) {
132 case X86_IOC_RDMSR_REGS:
133 if (!(file->f_mode & FMODE_READ)) {
134 err = -EBADF;
135 break;
136 }
137 if (copy_from_user(®s, uregs, sizeof regs)) {
138 err = -EFAULT;
139 break;
140 }
141 err = rdmsr_safe_regs_on_cpu(cpu, regs);
142 if (err)
143 break;
144 if (copy_to_user(uregs, ®s, sizeof regs))
145 err = -EFAULT;
146 break;
147
148 case X86_IOC_WRMSR_REGS:
149 if (!(file->f_mode & FMODE_WRITE)) {
150 err = -EBADF;
151 break;
152 }
153 if (copy_from_user(®s, uregs, sizeof regs)) {
154 err = -EFAULT;
155 break;
156 }
157 err = wrmsr_safe_regs_on_cpu(cpu, regs);
158 if (err)
159 break;
160 if (copy_to_user(uregs, ®s, sizeof regs))
161 err = -EFAULT;
162 break;
163
164 default:
165 err = -ENOTTY;
166 break;
167 }
168
169 return err;
170}
171
172static int msr_open(struct inode *inode, struct file *file)
173{
174 unsigned int cpu;
175 struct cpuinfo_x86 *c;
176
177 cpu = iminor(file->f_path.dentry->d_inode);
178 if (cpu >= nr_cpu_ids || !cpu_online(cpu))
179 return -ENXIO; /* No such CPU */
180
181 c = &cpu_data(cpu);
182 if (!cpu_has(c, X86_FEATURE_MSR))
183 return -EIO; /* MSR not supported */
184
185 return 0;
186}
187
188/*
189 * File operations we support
190 */
191static const struct file_operations msr_fops = {
192 .owner = THIS_MODULE,
193 .llseek = msr_seek,
194 .read = msr_read,
195 .write = msr_write,
196 .open = msr_open,
197 .unlocked_ioctl = msr_ioctl,
198 .compat_ioctl = msr_ioctl,
199};
200
201static int __cpuinit msr_device_create(int cpu)
202{
203 struct device *dev;
204
205 dev = device_create(msr_class, NULL, MKDEV(MSR_MAJOR, cpu), NULL,
206 "msr%d", cpu);
207 return IS_ERR(dev) ? PTR_ERR(dev) : 0;
208}
209
210static void msr_device_destroy(int cpu)
211{
212 device_destroy(msr_class, MKDEV(MSR_MAJOR, cpu));
213}
214
215static int __cpuinit msr_class_cpu_callback(struct notifier_block *nfb,
216 unsigned long action, void *hcpu)
217{
218 unsigned int cpu = (unsigned long)hcpu;
219 int err = 0;
220
221 switch (action) {
222 case CPU_UP_PREPARE:
223 err = msr_device_create(cpu);
224 break;
225 case CPU_UP_CANCELED:
226 case CPU_UP_CANCELED_FROZEN:
227 case CPU_DEAD:
228 msr_device_destroy(cpu);
229 break;
230 }
231 return notifier_from_errno(err);
232}
233
234static struct notifier_block __refdata msr_class_cpu_notifier = {
235 .notifier_call = msr_class_cpu_callback,
236};
237
238static char *msr_devnode(struct device *dev, umode_t *mode)
239{
240 return kasprintf(GFP_KERNEL, "cpu/%u/msr", MINOR(dev->devt));
241}
242
243static int __init msr_init(void)
244{
245 int i, err = 0;
246 i = 0;
247
248 if (__register_chrdev(MSR_MAJOR, 0, NR_CPUS, "cpu/msr", &msr_fops)) {
249 printk(KERN_ERR "msr: unable to get major %d for msr\n",
250 MSR_MAJOR);
251 err = -EBUSY;
252 goto out;
253 }
254 msr_class = class_create(THIS_MODULE, "msr");
255 if (IS_ERR(msr_class)) {
256 err = PTR_ERR(msr_class);
257 goto out_chrdev;
258 }
259 msr_class->devnode = msr_devnode;
260 for_each_online_cpu(i) {
261 err = msr_device_create(i);
262 if (err != 0)
263 goto out_class;
264 }
265 register_hotcpu_notifier(&msr_class_cpu_notifier);
266
267 err = 0;
268 goto out;
269
270out_class:
271 i = 0;
272 for_each_online_cpu(i)
273 msr_device_destroy(i);
274 class_destroy(msr_class);
275out_chrdev:
276 __unregister_chrdev(MSR_MAJOR, 0, NR_CPUS, "cpu/msr");
277out:
278 return err;
279}
280
281static void __exit msr_exit(void)
282{
283 int cpu = 0;
284 for_each_online_cpu(cpu)
285 msr_device_destroy(cpu);
286 class_destroy(msr_class);
287 __unregister_chrdev(MSR_MAJOR, 0, NR_CPUS, "cpu/msr");
288 unregister_hotcpu_notifier(&msr_class_cpu_notifier);
289}
290
291module_init(msr_init);
292module_exit(msr_exit)
293
294MODULE_AUTHOR("H. Peter Anvin <hpa@zytor.com>");
295MODULE_DESCRIPTION("x86 generic MSR driver");
296MODULE_LICENSE("GPL");