Loading...
1// SPDX-License-Identifier: GPL-2.0-or-later
2/* ----------------------------------------------------------------------- *
3 *
4 * Copyright 2000-2008 H. Peter Anvin - All Rights Reserved
5 * Copyright 2009 Intel Corporation; author: H. Peter Anvin
6 *
7 * ----------------------------------------------------------------------- */
8
9/*
10 * x86 MSR access device
11 *
12 * This device is accessed by lseek() to the appropriate register number
13 * and then read/write in chunks of 8 bytes. A larger size means multiple
14 * reads or writes of the same register.
15 *
16 * This driver uses /dev/cpu/%d/msr where %d is the minor number, and on
17 * an SMP box will direct the access to CPU %d.
18 */
19
20#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
21
22#include <linux/module.h>
23
24#include <linux/types.h>
25#include <linux/errno.h>
26#include <linux/fcntl.h>
27#include <linux/init.h>
28#include <linux/poll.h>
29#include <linux/smp.h>
30#include <linux/major.h>
31#include <linux/fs.h>
32#include <linux/device.h>
33#include <linux/cpu.h>
34#include <linux/notifier.h>
35#include <linux/uaccess.h>
36#include <linux/gfp.h>
37#include <linux/security.h>
38
39#include <asm/cpufeature.h>
40#include <asm/msr.h>
41
42static struct class *msr_class;
43static enum cpuhp_state cpuhp_msr_state;
44
45enum allow_write_msrs {
46 MSR_WRITES_ON,
47 MSR_WRITES_OFF,
48 MSR_WRITES_DEFAULT,
49};
50
51static enum allow_write_msrs allow_writes = MSR_WRITES_DEFAULT;
52
53static ssize_t msr_read(struct file *file, char __user *buf,
54 size_t count, loff_t *ppos)
55{
56 u32 __user *tmp = (u32 __user *) buf;
57 u32 data[2];
58 u32 reg = *ppos;
59 int cpu = iminor(file_inode(file));
60 int err = 0;
61 ssize_t bytes = 0;
62
63 if (count % 8)
64 return -EINVAL; /* Invalid chunk size */
65
66 for (; count; count -= 8) {
67 err = rdmsr_safe_on_cpu(cpu, reg, &data[0], &data[1]);
68 if (err)
69 break;
70 if (copy_to_user(tmp, &data, 8)) {
71 err = -EFAULT;
72 break;
73 }
74 tmp += 2;
75 bytes += 8;
76 }
77
78 return bytes ? bytes : err;
79}
80
81static int filter_write(u32 reg)
82{
83 /*
84 * MSRs writes usually happen all at once, and can easily saturate kmsg.
85 * Only allow one message every 30 seconds.
86 *
87 * It's possible to be smarter here and do it (for example) per-MSR, but
88 * it would certainly be more complex, and this is enough at least to
89 * avoid saturating the ring buffer.
90 */
91 static DEFINE_RATELIMIT_STATE(fw_rs, 30 * HZ, 1);
92
93 switch (allow_writes) {
94 case MSR_WRITES_ON: return 0;
95 case MSR_WRITES_OFF: return -EPERM;
96 default: break;
97 }
98
99 if (!__ratelimit(&fw_rs))
100 return 0;
101
102 pr_warn("Write to unrecognized MSR 0x%x by %s (pid: %d).\n",
103 reg, current->comm, current->pid);
104 pr_warn("See https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/about for details.\n");
105
106 return 0;
107}
108
109static ssize_t msr_write(struct file *file, const char __user *buf,
110 size_t count, loff_t *ppos)
111{
112 const u32 __user *tmp = (const u32 __user *)buf;
113 u32 data[2];
114 u32 reg = *ppos;
115 int cpu = iminor(file_inode(file));
116 int err = 0;
117 ssize_t bytes = 0;
118
119 err = security_locked_down(LOCKDOWN_MSR);
120 if (err)
121 return err;
122
123 err = filter_write(reg);
124 if (err)
125 return err;
126
127 if (count % 8)
128 return -EINVAL; /* Invalid chunk size */
129
130 for (; count; count -= 8) {
131 if (copy_from_user(&data, tmp, 8)) {
132 err = -EFAULT;
133 break;
134 }
135
136 add_taint(TAINT_CPU_OUT_OF_SPEC, LOCKDEP_STILL_OK);
137
138 err = wrmsr_safe_on_cpu(cpu, reg, data[0], data[1]);
139 if (err)
140 break;
141
142 tmp += 2;
143 bytes += 8;
144 }
145
146 return bytes ? bytes : err;
147}
148
149static long msr_ioctl(struct file *file, unsigned int ioc, unsigned long arg)
150{
151 u32 __user *uregs = (u32 __user *)arg;
152 u32 regs[8];
153 int cpu = iminor(file_inode(file));
154 int err;
155
156 switch (ioc) {
157 case X86_IOC_RDMSR_REGS:
158 if (!(file->f_mode & FMODE_READ)) {
159 err = -EBADF;
160 break;
161 }
162 if (copy_from_user(®s, uregs, sizeof(regs))) {
163 err = -EFAULT;
164 break;
165 }
166 err = rdmsr_safe_regs_on_cpu(cpu, regs);
167 if (err)
168 break;
169 if (copy_to_user(uregs, ®s, sizeof(regs)))
170 err = -EFAULT;
171 break;
172
173 case X86_IOC_WRMSR_REGS:
174 if (!(file->f_mode & FMODE_WRITE)) {
175 err = -EBADF;
176 break;
177 }
178 if (copy_from_user(®s, uregs, sizeof(regs))) {
179 err = -EFAULT;
180 break;
181 }
182 err = security_locked_down(LOCKDOWN_MSR);
183 if (err)
184 break;
185
186 err = filter_write(regs[1]);
187 if (err)
188 return err;
189
190 add_taint(TAINT_CPU_OUT_OF_SPEC, LOCKDEP_STILL_OK);
191
192 err = wrmsr_safe_regs_on_cpu(cpu, regs);
193 if (err)
194 break;
195 if (copy_to_user(uregs, ®s, sizeof(regs)))
196 err = -EFAULT;
197 break;
198
199 default:
200 err = -ENOTTY;
201 break;
202 }
203
204 return err;
205}
206
207static int msr_open(struct inode *inode, struct file *file)
208{
209 unsigned int cpu = iminor(file_inode(file));
210 struct cpuinfo_x86 *c;
211
212 if (!capable(CAP_SYS_RAWIO))
213 return -EPERM;
214
215 if (cpu >= nr_cpu_ids || !cpu_online(cpu))
216 return -ENXIO; /* No such CPU */
217
218 c = &cpu_data(cpu);
219 if (!cpu_has(c, X86_FEATURE_MSR))
220 return -EIO; /* MSR not supported */
221
222 return 0;
223}
224
225/*
226 * File operations we support
227 */
228static const struct file_operations msr_fops = {
229 .owner = THIS_MODULE,
230 .llseek = no_seek_end_llseek,
231 .read = msr_read,
232 .write = msr_write,
233 .open = msr_open,
234 .unlocked_ioctl = msr_ioctl,
235 .compat_ioctl = msr_ioctl,
236};
237
238static int msr_device_create(unsigned int cpu)
239{
240 struct device *dev;
241
242 dev = device_create(msr_class, NULL, MKDEV(MSR_MAJOR, cpu), NULL,
243 "msr%d", cpu);
244 return PTR_ERR_OR_ZERO(dev);
245}
246
247static int msr_device_destroy(unsigned int cpu)
248{
249 device_destroy(msr_class, MKDEV(MSR_MAJOR, cpu));
250 return 0;
251}
252
253static char *msr_devnode(const struct device *dev, umode_t *mode)
254{
255 return kasprintf(GFP_KERNEL, "cpu/%u/msr", MINOR(dev->devt));
256}
257
258static int __init msr_init(void)
259{
260 int err;
261
262 if (__register_chrdev(MSR_MAJOR, 0, NR_CPUS, "cpu/msr", &msr_fops)) {
263 pr_err("unable to get major %d for msr\n", MSR_MAJOR);
264 return -EBUSY;
265 }
266 msr_class = class_create(THIS_MODULE, "msr");
267 if (IS_ERR(msr_class)) {
268 err = PTR_ERR(msr_class);
269 goto out_chrdev;
270 }
271 msr_class->devnode = msr_devnode;
272
273 err = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "x86/msr:online",
274 msr_device_create, msr_device_destroy);
275 if (err < 0)
276 goto out_class;
277 cpuhp_msr_state = err;
278 return 0;
279
280out_class:
281 class_destroy(msr_class);
282out_chrdev:
283 __unregister_chrdev(MSR_MAJOR, 0, NR_CPUS, "cpu/msr");
284 return err;
285}
286module_init(msr_init);
287
288static void __exit msr_exit(void)
289{
290 cpuhp_remove_state(cpuhp_msr_state);
291 class_destroy(msr_class);
292 __unregister_chrdev(MSR_MAJOR, 0, NR_CPUS, "cpu/msr");
293}
294module_exit(msr_exit)
295
296static int set_allow_writes(const char *val, const struct kernel_param *cp)
297{
298 /* val is NUL-terminated, see kernfs_fop_write() */
299 char *s = strstrip((char *)val);
300
301 if (!strcmp(s, "on"))
302 allow_writes = MSR_WRITES_ON;
303 else if (!strcmp(s, "off"))
304 allow_writes = MSR_WRITES_OFF;
305 else
306 allow_writes = MSR_WRITES_DEFAULT;
307
308 return 0;
309}
310
311static int get_allow_writes(char *buf, const struct kernel_param *kp)
312{
313 const char *res;
314
315 switch (allow_writes) {
316 case MSR_WRITES_ON: res = "on"; break;
317 case MSR_WRITES_OFF: res = "off"; break;
318 default: res = "default"; break;
319 }
320
321 return sprintf(buf, "%s\n", res);
322}
323
324static const struct kernel_param_ops allow_writes_ops = {
325 .set = set_allow_writes,
326 .get = get_allow_writes
327};
328
329module_param_cb(allow_writes, &allow_writes_ops, NULL, 0600);
330
331MODULE_AUTHOR("H. Peter Anvin <hpa@zytor.com>");
332MODULE_DESCRIPTION("x86 generic MSR driver");
333MODULE_LICENSE("GPL");
1/* ----------------------------------------------------------------------- *
2 *
3 * Copyright 2000-2008 H. Peter Anvin - All Rights Reserved
4 * Copyright 2009 Intel Corporation; author: H. Peter Anvin
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation, Inc., 675 Mass Ave, Cambridge MA 02139,
9 * USA; either version 2 of the License, or (at your option) any later
10 * version; incorporated herein by reference.
11 *
12 * ----------------------------------------------------------------------- */
13
14/*
15 * x86 MSR access device
16 *
17 * This device is accessed by lseek() to the appropriate register number
18 * and then read/write in chunks of 8 bytes. A larger size means multiple
19 * reads or writes of the same register.
20 *
21 * This driver uses /dev/cpu/%d/msr where %d is the minor number, and on
22 * an SMP box will direct the access to CPU %d.
23 */
24
25#include <linux/module.h>
26
27#include <linux/types.h>
28#include <linux/errno.h>
29#include <linux/fcntl.h>
30#include <linux/init.h>
31#include <linux/poll.h>
32#include <linux/smp.h>
33#include <linux/major.h>
34#include <linux/fs.h>
35#include <linux/device.h>
36#include <linux/cpu.h>
37#include <linux/notifier.h>
38#include <linux/uaccess.h>
39#include <linux/gfp.h>
40
41#include <asm/processor.h>
42#include <asm/msr.h>
43#include <asm/system.h>
44
45static struct class *msr_class;
46
47static loff_t msr_seek(struct file *file, loff_t offset, int orig)
48{
49 loff_t ret;
50 struct inode *inode = file->f_mapping->host;
51
52 mutex_lock(&inode->i_mutex);
53 switch (orig) {
54 case 0:
55 file->f_pos = offset;
56 ret = file->f_pos;
57 break;
58 case 1:
59 file->f_pos += offset;
60 ret = file->f_pos;
61 break;
62 default:
63 ret = -EINVAL;
64 }
65 mutex_unlock(&inode->i_mutex);
66 return ret;
67}
68
69static ssize_t msr_read(struct file *file, char __user *buf,
70 size_t count, loff_t *ppos)
71{
72 u32 __user *tmp = (u32 __user *) buf;
73 u32 data[2];
74 u32 reg = *ppos;
75 int cpu = iminor(file->f_path.dentry->d_inode);
76 int err = 0;
77 ssize_t bytes = 0;
78
79 if (count % 8)
80 return -EINVAL; /* Invalid chunk size */
81
82 for (; count; count -= 8) {
83 err = rdmsr_safe_on_cpu(cpu, reg, &data[0], &data[1]);
84 if (err)
85 break;
86 if (copy_to_user(tmp, &data, 8)) {
87 err = -EFAULT;
88 break;
89 }
90 tmp += 2;
91 bytes += 8;
92 }
93
94 return bytes ? bytes : err;
95}
96
97static ssize_t msr_write(struct file *file, const char __user *buf,
98 size_t count, loff_t *ppos)
99{
100 const u32 __user *tmp = (const u32 __user *)buf;
101 u32 data[2];
102 u32 reg = *ppos;
103 int cpu = iminor(file->f_path.dentry->d_inode);
104 int err = 0;
105 ssize_t bytes = 0;
106
107 if (count % 8)
108 return -EINVAL; /* Invalid chunk size */
109
110 for (; count; count -= 8) {
111 if (copy_from_user(&data, tmp, 8)) {
112 err = -EFAULT;
113 break;
114 }
115 err = wrmsr_safe_on_cpu(cpu, reg, data[0], data[1]);
116 if (err)
117 break;
118 tmp += 2;
119 bytes += 8;
120 }
121
122 return bytes ? bytes : err;
123}
124
125static long msr_ioctl(struct file *file, unsigned int ioc, unsigned long arg)
126{
127 u32 __user *uregs = (u32 __user *)arg;
128 u32 regs[8];
129 int cpu = iminor(file->f_path.dentry->d_inode);
130 int err;
131
132 switch (ioc) {
133 case X86_IOC_RDMSR_REGS:
134 if (!(file->f_mode & FMODE_READ)) {
135 err = -EBADF;
136 break;
137 }
138 if (copy_from_user(®s, uregs, sizeof regs)) {
139 err = -EFAULT;
140 break;
141 }
142 err = rdmsr_safe_regs_on_cpu(cpu, regs);
143 if (err)
144 break;
145 if (copy_to_user(uregs, ®s, sizeof regs))
146 err = -EFAULT;
147 break;
148
149 case X86_IOC_WRMSR_REGS:
150 if (!(file->f_mode & FMODE_WRITE)) {
151 err = -EBADF;
152 break;
153 }
154 if (copy_from_user(®s, uregs, sizeof regs)) {
155 err = -EFAULT;
156 break;
157 }
158 err = wrmsr_safe_regs_on_cpu(cpu, regs);
159 if (err)
160 break;
161 if (copy_to_user(uregs, ®s, sizeof regs))
162 err = -EFAULT;
163 break;
164
165 default:
166 err = -ENOTTY;
167 break;
168 }
169
170 return err;
171}
172
173static int msr_open(struct inode *inode, struct file *file)
174{
175 unsigned int cpu;
176 struct cpuinfo_x86 *c;
177
178 cpu = iminor(file->f_path.dentry->d_inode);
179 if (cpu >= nr_cpu_ids || !cpu_online(cpu))
180 return -ENXIO; /* No such CPU */
181
182 c = &cpu_data(cpu);
183 if (!cpu_has(c, X86_FEATURE_MSR))
184 return -EIO; /* MSR not supported */
185
186 return 0;
187}
188
189/*
190 * File operations we support
191 */
192static const struct file_operations msr_fops = {
193 .owner = THIS_MODULE,
194 .llseek = msr_seek,
195 .read = msr_read,
196 .write = msr_write,
197 .open = msr_open,
198 .unlocked_ioctl = msr_ioctl,
199 .compat_ioctl = msr_ioctl,
200};
201
202static int __cpuinit msr_device_create(int cpu)
203{
204 struct device *dev;
205
206 dev = device_create(msr_class, NULL, MKDEV(MSR_MAJOR, cpu), NULL,
207 "msr%d", cpu);
208 return IS_ERR(dev) ? PTR_ERR(dev) : 0;
209}
210
211static void msr_device_destroy(int cpu)
212{
213 device_destroy(msr_class, MKDEV(MSR_MAJOR, cpu));
214}
215
216static int __cpuinit msr_class_cpu_callback(struct notifier_block *nfb,
217 unsigned long action, void *hcpu)
218{
219 unsigned int cpu = (unsigned long)hcpu;
220 int err = 0;
221
222 switch (action) {
223 case CPU_UP_PREPARE:
224 err = msr_device_create(cpu);
225 break;
226 case CPU_UP_CANCELED:
227 case CPU_UP_CANCELED_FROZEN:
228 case CPU_DEAD:
229 msr_device_destroy(cpu);
230 break;
231 }
232 return notifier_from_errno(err);
233}
234
235static struct notifier_block __refdata msr_class_cpu_notifier = {
236 .notifier_call = msr_class_cpu_callback,
237};
238
239static char *msr_devnode(struct device *dev, mode_t *mode)
240{
241 return kasprintf(GFP_KERNEL, "cpu/%u/msr", MINOR(dev->devt));
242}
243
244static int __init msr_init(void)
245{
246 int i, err = 0;
247 i = 0;
248
249 if (__register_chrdev(MSR_MAJOR, 0, NR_CPUS, "cpu/msr", &msr_fops)) {
250 printk(KERN_ERR "msr: unable to get major %d for msr\n",
251 MSR_MAJOR);
252 err = -EBUSY;
253 goto out;
254 }
255 msr_class = class_create(THIS_MODULE, "msr");
256 if (IS_ERR(msr_class)) {
257 err = PTR_ERR(msr_class);
258 goto out_chrdev;
259 }
260 msr_class->devnode = msr_devnode;
261 for_each_online_cpu(i) {
262 err = msr_device_create(i);
263 if (err != 0)
264 goto out_class;
265 }
266 register_hotcpu_notifier(&msr_class_cpu_notifier);
267
268 err = 0;
269 goto out;
270
271out_class:
272 i = 0;
273 for_each_online_cpu(i)
274 msr_device_destroy(i);
275 class_destroy(msr_class);
276out_chrdev:
277 __unregister_chrdev(MSR_MAJOR, 0, NR_CPUS, "cpu/msr");
278out:
279 return err;
280}
281
282static void __exit msr_exit(void)
283{
284 int cpu = 0;
285 for_each_online_cpu(cpu)
286 msr_device_destroy(cpu);
287 class_destroy(msr_class);
288 __unregister_chrdev(MSR_MAJOR, 0, NR_CPUS, "cpu/msr");
289 unregister_hotcpu_notifier(&msr_class_cpu_notifier);
290}
291
292module_init(msr_init);
293module_exit(msr_exit)
294
295MODULE_AUTHOR("H. Peter Anvin <hpa@zytor.com>");
296MODULE_DESCRIPTION("x86 generic MSR driver");
297MODULE_LICENSE("GPL");