[mirror_ubuntu-jammy-kernel.git] / arch / x86 / kernel / msr.c

// SPDX-License-Identifier: GPL-2.0-or-later
/* ----------------------------------------------------------------------- *
 *
 *   Copyright 2000-2008 H. Peter Anvin - All Rights Reserved
 *   Copyright 2009 Intel Corporation; author: H. Peter Anvin
 *
 * ----------------------------------------------------------------------- */

/*
 * x86 MSR access device
 *
 * This device is accessed by lseek() to the appropriate register number
 * and then read/write in chunks of 8 bytes.  A larger size means multiple
 * reads or writes of the same register.
 *
 * This driver uses /dev/cpu/%d/msr where %d is the minor number, and on
 * an SMP box will direct the access to CPU %d.
 */

#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

#include <linux/module.h>

#include <linux/types.h>
#include <linux/errno.h>
#include <linux/fcntl.h>
#include <linux/init.h>
#include <linux/poll.h>
#include <linux/smp.h>
#include <linux/major.h>
#include <linux/fs.h>
#include <linux/device.h>
#include <linux/cpu.h>
#include <linux/notifier.h>
#include <linux/uaccess.h>
#include <linux/gfp.h>
#include <linux/security.h>

#include <asm/cpufeature.h>
#include <asm/msr.h>

static struct class *msr_class;
static enum cpuhp_state cpuhp_msr_state;

enum allow_write_msrs {
	MSR_WRITES_ON,
	MSR_WRITES_OFF,
	MSR_WRITES_DEFAULT,
};

static enum allow_write_msrs allow_writes = MSR_WRITES_DEFAULT;

static ssize_t msr_read(struct file *file, char __user *buf,
			size_t count, loff_t *ppos)
{
	u32 __user *tmp = (u32 __user *) buf;
	u32 data[2];
	u32 reg = *ppos;
	int cpu = iminor(file_inode(file));
	int err = 0;
	ssize_t bytes = 0;

	if (count % 8)
		return -EINVAL;	/* Invalid chunk size */

	for (; count; count -= 8) {
		err = rdmsr_safe_on_cpu(cpu, reg, &data[0], &data[1]);
		if (err)
			break;
		if (copy_to_user(tmp, &data, 8)) {
			err = -EFAULT;
			break;
		}
		tmp += 2;
		bytes += 8;
	}

	return bytes ? bytes : err;
}

static int filter_write(u32 reg)
{
	/*
	 * MSRs writes usually happen all at once, and can easily saturate kmsg.
	 * Only allow one message every 30 seconds.
	 *
	 * It's possible to be smarter here and do it (for example) per-MSR, but
	 * it would certainly be more complex, and this is enough at least to
	 * avoid saturating the ring buffer.
	 */
	static DEFINE_RATELIMIT_STATE(fw_rs, 30 * HZ, 1);

	switch (allow_writes) {
	case MSR_WRITES_ON:  return 0;
	case MSR_WRITES_OFF: return -EPERM;
	default: break;
	}

	if (!__ratelimit(&fw_rs))
		return 0;

	pr_warn("Write to unrecognized MSR 0x%x by %s (pid: %d).\n",
	        reg, current->comm, current->pid);
	pr_warn("See https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/about for details.\n");

	return 0;
}

static ssize_t msr_write(struct file *file, const char __user *buf,
			 size_t count, loff_t *ppos)
{
	const u32 __user *tmp = (const u32 __user *)buf;
	u32 data[2];
	u32 reg = *ppos;
	int cpu = iminor(file_inode(file));
	int err = 0;
	ssize_t bytes = 0;

	err = security_locked_down(LOCKDOWN_MSR);
	if (err)
		return err;

	err = filter_write(reg);
	if (err)
		return err;

	if (count % 8)
		return -EINVAL;	/* Invalid chunk size */

	for (; count; count -= 8) {
		if (copy_from_user(&data, tmp, 8)) {
			err = -EFAULT;
			break;
		}

		add_taint(TAINT_CPU_OUT_OF_SPEC, LOCKDEP_STILL_OK);

		err = wrmsr_safe_on_cpu(cpu, reg, data[0], data[1]);
		if (err)
			break;

		tmp += 2;
		bytes += 8;
	}

	return bytes ? bytes : err;
}

static long msr_ioctl(struct file *file, unsigned int ioc, unsigned long arg)
{
	u32 __user *uregs = (u32 __user *)arg;
	u32 regs[8];
	int cpu = iminor(file_inode(file));
	int err;

	switch (ioc) {
	case X86_IOC_RDMSR_REGS:
		if (!(file->f_mode & FMODE_READ)) {
			err = -EBADF;
			break;
		}
		if (copy_from_user(&regs, uregs, sizeof(regs))) {
			err = -EFAULT;
			break;
		}
		err = rdmsr_safe_regs_on_cpu(cpu, regs);
		if (err)
			break;
		if (copy_to_user(uregs, &regs, sizeof(regs)))
			err = -EFAULT;
		break;

	case X86_IOC_WRMSR_REGS:
		if (!(file->f_mode & FMODE_WRITE)) {
			err = -EBADF;
			break;
		}
		if (copy_from_user(&regs, uregs, sizeof(regs))) {
			err = -EFAULT;
			break;
		}
		err = security_locked_down(LOCKDOWN_MSR);
		if (err)
			break;

		err = filter_write(regs[1]);
		if (err)
			return err;

		add_taint(TAINT_CPU_OUT_OF_SPEC, LOCKDEP_STILL_OK);

		err = wrmsr_safe_regs_on_cpu(cpu, regs);
		if (err)
			break;
		if (copy_to_user(uregs, &regs, sizeof(regs)))
			err = -EFAULT;
		break;

	default:
		err = -ENOTTY;
		break;
	}

	return err;
}

static int msr_open(struct inode *inode, struct file *file)
{
	unsigned int cpu = iminor(file_inode(file));
	struct cpuinfo_x86 *c;

	if (!capable(CAP_SYS_RAWIO))
		return -EPERM;

	if (cpu >= nr_cpu_ids || !cpu_online(cpu))
		return -ENXIO;	/* No such CPU */

	c = &cpu_data(cpu);
	if (!cpu_has(c, X86_FEATURE_MSR))
		return -EIO;	/* MSR not supported */

	return 0;
}

/*
 * File operations we support
 */
static const struct file_operations msr_fops = {
	.owner = THIS_MODULE,
	.llseek = no_seek_end_llseek,
	.read = msr_read,
	.write = msr_write,
	.open = msr_open,
	.unlocked_ioctl = msr_ioctl,
	.compat_ioctl = msr_ioctl,
};

static int msr_device_create(unsigned int cpu)
{
	struct device *dev;

	dev = device_create(msr_class, NULL, MKDEV(MSR_MAJOR, cpu), NULL,
			    "msr%d", cpu);
	return PTR_ERR_OR_ZERO(dev);
}

static int msr_device_destroy(unsigned int cpu)
{
	device_destroy(msr_class, MKDEV(MSR_MAJOR, cpu));
	return 0;
}

static char *msr_devnode(struct device *dev, umode_t *mode)
{
	return kasprintf(GFP_KERNEL, "cpu/%u/msr", MINOR(dev->devt));
}

static int __init msr_init(void)
{
	int err;

	if (__register_chrdev(MSR_MAJOR, 0, NR_CPUS, "cpu/msr", &msr_fops)) {
		pr_err("unable to get major %d for msr\n", MSR_MAJOR);
		return -EBUSY;
	}
	msr_class = class_create(THIS_MODULE, "msr");
	if (IS_ERR(msr_class)) {
		err = PTR_ERR(msr_class);
		goto out_chrdev;
	}
	msr_class->devnode = msr_devnode;

	err  = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "x86/msr:online",
				 msr_device_create, msr_device_destroy);
	if (err < 0)
		goto out_class;
	cpuhp_msr_state = err;
	return 0;

out_class:
	class_destroy(msr_class);
out_chrdev:
	__unregister_chrdev(MSR_MAJOR, 0, NR_CPUS, "cpu/msr");
	return err;
}
module_init(msr_init);

static void __exit msr_exit(void)
{
	cpuhp_remove_state(cpuhp_msr_state);
	class_destroy(msr_class);
	__unregister_chrdev(MSR_MAJOR, 0, NR_CPUS, "cpu/msr");
}
module_exit(msr_exit)

static int set_allow_writes(const char *val, const struct kernel_param *cp)
{
	/* val is NUL-terminated, see kernfs_fop_write() */
	char *s = strstrip((char *)val);

	if (!strcmp(s, "on"))
		allow_writes = MSR_WRITES_ON;
	else if (!strcmp(s, "off"))
		allow_writes = MSR_WRITES_OFF;
	else
		allow_writes = MSR_WRITES_DEFAULT;

	return 0;
}

static int get_allow_writes(char *buf, const struct kernel_param *kp)
{
	const char *res;

	switch (allow_writes) {
	case MSR_WRITES_ON:  res = "on"; break;
	case MSR_WRITES_OFF: res = "off"; break;
	default: res = "default"; break;
	}

	return sprintf(buf, "%s\n", res);
}

static const struct kernel_param_ops allow_writes_ops = {
	.set = set_allow_writes,
	.get = get_allow_writes
};

module_param_cb(allow_writes, &allow_writes_ops, NULL, 0600);

MODULE_AUTHOR("H. Peter Anvin <hpa@zytor.com>");
MODULE_DESCRIPTION("x86 generic MSR driver");
MODULE_LICENSE("GPL");
Commit	Line	Data
a94da204	1	// SPDX-License-Identifier: GPL-2.0-or-later
1da177e4	2	/* ----------------------------------------------------------------------- *
2b06ac86 PA	3	*
2b06ac86 PA	4	* Copyright 2000-2008 H. Peter Anvin - All Rights Reserved
ff55df53	5	* Copyright 2009 Intel Corporation; author: H. Peter Anvin
1da177e4	6	*
1da177e4 LT	7	* ----------------------------------------------------------------------- */
	8
	9	/*
1da177e4 LT	10	* x86 MSR access device
	11	*
	12	* This device is accessed by lseek() to the appropriate register number
	13	* and then read/write in chunks of 8 bytes. A larger size means multiple
	14	* reads or writes of the same register.
	15	*
	16	* This driver uses /dev/cpu/%d/msr where %d is the minor number, and on
	17	* an SMP box will direct the access to CPU %d.
	18	*/
	19
951a18c6 FF	20	#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
951a18c6 FF	21
1da177e4	22	#include <linux/module.h>
1da177e4 LT	23
	24	#include <linux/types.h>
	25	#include <linux/errno.h>
	26	#include <linux/fcntl.h>
	27	#include <linux/init.h>
	28	#include <linux/poll.h>
	29	#include <linux/smp.h>
1da177e4 LT	30	#include <linux/major.h>
	31	#include <linux/fs.h>
	32	#include <linux/device.h>
	33	#include <linux/cpu.h>
	34	#include <linux/notifier.h>
448dd2fa	35	#include <linux/uaccess.h>
5a0e3ad6	36	#include <linux/gfp.h>
95f5e95f	37	#include <linux/security.h>
1da177e4	38
cd4d09ec	39	#include <asm/cpufeature.h>
1da177e4	40	#include <asm/msr.h>
1da177e4	41
8874b414	42	static struct class *msr_class;
8fba38c9	43	static enum cpuhp_state cpuhp_msr_state;
1da177e4	44
a7e1f67e BP	45	enum allow_write_msrs {
	46	MSR_WRITES_ON,
	47	MSR_WRITES_OFF,
	48	MSR_WRITES_DEFAULT,
	49	};
	50
	51	static enum allow_write_msrs allow_writes = MSR_WRITES_DEFAULT;
	52
94a9fa41 PC	53	static ssize_t msr_read(struct file file, char __user buf,
94a9fa41 PC	54	size_t count, loff_t *ppos)
1da177e4 LT	55	{
	56	u32 __user tmp = (u32 __user ) buf;
	57	u32 data[2];
1da177e4	58	u32 reg = *ppos;
6131ffaa	59	int cpu = iminor(file_inode(file));
85f1cb60 PA	60	int err = 0;
85f1cb60 PA	61	ssize_t bytes = 0;
1da177e4 LT	62
	63	if (count % 8)
	64	return -EINVAL; /* Invalid chunk size */
	65
6926d570	66	for (; count; count -= 8) {
78a62d2c	67	err = rdmsr_safe_on_cpu(cpu, reg, &data[0], &data[1]);
0cc0213e	68	if (err)
85f1cb60	69	break;
85f1cb60 PA	70	if (copy_to_user(tmp, &data, 8)) {
	71	err = -EFAULT;
	72	break;
c6f31932	73	}
1da177e4	74	tmp += 2;
85f1cb60	75	bytes += 8;
1da177e4 LT	76	}
1da177e4 LT	77
85f1cb60	78	return bytes ? bytes : err;
1da177e4 LT	79	}
1da177e4 LT	80
a7e1f67e BP	81	static int filter_write(u32 reg)
a7e1f67e BP	82	{
1f35c9c0 CD	83	/*
	84	* MSRs writes usually happen all at once, and can easily saturate kmsg.
	85	* Only allow one message every 30 seconds.
	86	*
	87	* It's possible to be smarter here and do it (for example) per-MSR, but
	88	* it would certainly be more complex, and this is enough at least to
	89	* avoid saturating the ring buffer.
	90	*/
	91	static DEFINE_RATELIMIT_STATE(fw_rs, 30 * HZ, 1);
	92
a7e1f67e BP	93	switch (allow_writes) {
	94	case MSR_WRITES_ON: return 0;
	95	case MSR_WRITES_OFF: return -EPERM;
	96	default: break;
	97	}
	98
1f35c9c0 CD	99	if (!__ratelimit(&fw_rs))
	100	return 0;
	101
f77f420d	102	pr_warn("Write to unrecognized MSR 0x%x by %s (pid: %d).\n",
b023fd5f	103	reg, current->comm, current->pid);
f77f420d	104	pr_warn("See https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/about for details.\n");
a7e1f67e BP	105
	106	return 0;
	107	}
	108
1da177e4 LT	109	static ssize_t msr_write(struct file file, const char __user buf,
	110	size_t count, loff_t *ppos)
	111	{
	112	const u32 __user tmp = (const u32 __user )buf;
	113	u32 data[2];
1da177e4	114	u32 reg = *ppos;
6131ffaa	115	int cpu = iminor(file_inode(file));
85f1cb60 PA	116	int err = 0;
85f1cb60 PA	117	ssize_t bytes = 0;
1da177e4	118
95f5e95f MG	119	err = security_locked_down(LOCKDOWN_MSR);
	120	if (err)
	121	return err;
	122
a7e1f67e BP	123	err = filter_write(reg);
	124	if (err)
	125	return err;
	126
1da177e4 LT	127	if (count % 8)
	128	return -EINVAL; /* Invalid chunk size */
	129
f475ff35	130	for (; count; count -= 8) {
85f1cb60 PA	131	if (copy_from_user(&data, tmp, 8)) {
	132	err = -EFAULT;
	133	break;
	134	}
a7e1f67e BP	135
	136	add_taint(TAINT_CPU_OUT_OF_SPEC, LOCKDEP_STILL_OK);
	137
78a62d2c	138	err = wrmsr_safe_on_cpu(cpu, reg, data[0], data[1]);
0cc0213e	139	if (err)
85f1cb60	140	break;
a7e1f67e	141
1da177e4	142	tmp += 2;
85f1cb60	143	bytes += 8;
1da177e4 LT	144	}
1da177e4 LT	145
85f1cb60	146	return bytes ? bytes : err;
1da177e4 LT	147	}
1da177e4 LT	148
ff55df53 PA	149	static long msr_ioctl(struct file *file, unsigned int ioc, unsigned long arg)
	150	{
	151	u32 __user uregs = (u32 __user )arg;
	152	u32 regs[8];
6131ffaa	153	int cpu = iminor(file_inode(file));
ff55df53 PA	154	int err;
	155
	156	switch (ioc) {
	157	case X86_IOC_RDMSR_REGS:
	158	if (!(file->f_mode & FMODE_READ)) {
	159	err = -EBADF;
	160	break;
	161	}
0e96f31e	162	if (copy_from_user(&regs, uregs, sizeof(regs))) {
ff55df53 PA	163	err = -EFAULT;
	164	break;
	165	}
	166	err = rdmsr_safe_regs_on_cpu(cpu, regs);
	167	if (err)
	168	break;
0e96f31e	169	if (copy_to_user(uregs, &regs, sizeof(regs)))
ff55df53 PA	170	err = -EFAULT;
	171	break;
	172
	173	case X86_IOC_WRMSR_REGS:
	174	if (!(file->f_mode & FMODE_WRITE)) {
	175	err = -EBADF;
	176	break;
	177	}
0e96f31e	178	if (copy_from_user(&regs, uregs, sizeof(regs))) {
ff55df53 PA	179	err = -EFAULT;
	180	break;
	181	}
95f5e95f MG	182	err = security_locked_down(LOCKDOWN_MSR);
	183	if (err)
	184	break;
02a16aa1 MT	185
	186	err = filter_write(regs[1]);
	187	if (err)
	188	return err;
	189
	190	add_taint(TAINT_CPU_OUT_OF_SPEC, LOCKDEP_STILL_OK);
	191
ff55df53 PA	192	err = wrmsr_safe_regs_on_cpu(cpu, regs);
	193	if (err)
	194	break;
0e96f31e	195	if (copy_to_user(uregs, &regs, sizeof(regs)))
ff55df53 PA	196	err = -EFAULT;
	197	break;
	198
	199	default:
	200	err = -ENOTTY;
	201	break;
	202	}
	203
	204	return err;
	205	}
	206
1da177e4 LT	207	static int msr_open(struct inode inode, struct file file)
1da177e4 LT	208	{
6131ffaa	209	unsigned int cpu = iminor(file_inode(file));
494c2ebf	210	struct cpuinfo_x86 *c;
1da177e4	211
c903f045 AC	212	if (!capable(CAP_SYS_RAWIO))
	213	return -EPERM;
	214
d6c30405 FW	215	if (cpu >= nr_cpu_ids \|\| !cpu_online(cpu))
	216	return -ENXIO; /* No such CPU */
	217
5119e92e JC	218	c = &cpu_data(cpu);
5119e92e JC	219	if (!cpu_has(c, X86_FEATURE_MSR))
d6c30405 FW	220	return -EIO; /* MSR not supported */
	221
	222	return 0;
1da177e4 LT	223	}
	224
	225	/*
	226	* File operations we support
	227	*/
5dfe4c96	228	static const struct file_operations msr_fops = {
1da177e4	229	.owner = THIS_MODULE,
b25472f9	230	.llseek = no_seek_end_llseek,
1da177e4 LT	231	.read = msr_read,
	232	.write = msr_write,
	233	.open = msr_open,
ff55df53 PA	234	.unlocked_ioctl = msr_ioctl,
ff55df53 PA	235	.compat_ioctl = msr_ioctl,
1da177e4 LT	236	};
1da177e4 LT	237
8fba38c9	238	static int msr_device_create(unsigned int cpu)
1da177e4	239	{
a271aaf1	240	struct device *dev;
1da177e4	241
a9b12619 GKH	242	dev = device_create(msr_class, NULL, MKDEV(MSR_MAJOR, cpu), NULL,
a9b12619 GKH	243	"msr%d", cpu);
cba0fdbc	244	return PTR_ERR_OR_ZERO(dev);
881a841f AM	245	}
881a841f AM	246
8fba38c9	247	static int msr_device_destroy(unsigned int cpu)
881a841f AM	248	{
881a841f AM	249	device_destroy(msr_class, MKDEV(MSR_MAJOR, cpu));
8fba38c9	250	return 0;
1da177e4 LT	251	}
1da177e4 LT	252
2c9ede55	253	static char msr_devnode(struct device dev, umode_t *mode)
07e9bb8e KS	254	{
	255	return kasprintf(GFP_KERNEL, "cpu/%u/msr", MINOR(dev->devt));
	256	}
	257
1da177e4 LT	258	static int __init msr_init(void)
1da177e4 LT	259	{
8fba38c9	260	int err;
1da177e4	261
0b962d47	262	if (__register_chrdev(MSR_MAJOR, 0, NR_CPUS, "cpu/msr", &msr_fops)) {
951a18c6	263	pr_err("unable to get major %d for msr\n", MSR_MAJOR);
8fba38c9	264	return -EBUSY;
1da177e4	265	}
8874b414	266	msr_class = class_create(THIS_MODULE, "msr");
1da177e4 LT	267	if (IS_ERR(msr_class)) {
	268	err = PTR_ERR(msr_class);
	269	goto out_chrdev;
	270	}
e454cea2	271	msr_class->devnode = msr_devnode;
de82a01b	272
8fba38c9 SAS	273	err = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "x86/msr:online",
	274	msr_device_create, msr_device_destroy);
	275	if (err < 0)
	276	goto out_class;
	277	cpuhp_msr_state = err;
	278	return 0;
1da177e4 LT	279
1da177e4 LT	280	out_class:
8874b414	281	class_destroy(msr_class);
1da177e4	282	out_chrdev:
0b962d47	283	__unregister_chrdev(MSR_MAJOR, 0, NR_CPUS, "cpu/msr");
1da177e4 LT	284	return err;
1da177e4 LT	285	}
8fba38c9	286	module_init(msr_init);
1da177e4 LT	287
	288	static void __exit msr_exit(void)
	289	{
8fba38c9	290	cpuhp_remove_state(cpuhp_msr_state);
8874b414	291	class_destroy(msr_class);
da482474	292	__unregister_chrdev(MSR_MAJOR, 0, NR_CPUS, "cpu/msr");
1da177e4	293	}
1da177e4 LT	294	module_exit(msr_exit)
1da177e4 LT	295
a7e1f67e BP	296	static int set_allow_writes(const char val, const struct kernel_param cp)
	297	{
	298	/* val is NUL-terminated, see kernfs_fop_write() */
	299	char s = strstrip((char )val);
	300
	301	if (!strcmp(s, "on"))
	302	allow_writes = MSR_WRITES_ON;
	303	else if (!strcmp(s, "off"))
	304	allow_writes = MSR_WRITES_OFF;
	305	else
	306	allow_writes = MSR_WRITES_DEFAULT;
	307
	308	return 0;
	309	}
	310
	311	static int get_allow_writes(char buf, const struct kernel_param kp)
	312	{
	313	const char *res;
	314
	315	switch (allow_writes) {
	316	case MSR_WRITES_ON: res = "on"; break;
	317	case MSR_WRITES_OFF: res = "off"; break;
	318	default: res = "default"; break;
	319	}
	320
	321	return sprintf(buf, "%s\n", res);
	322	}
	323
	324	static const struct kernel_param_ops allow_writes_ops = {
	325	.set = set_allow_writes,
	326	.get = get_allow_writes
	327	};
	328
	329	module_param_cb(allow_writes, &allow_writes_ops, NULL, 0600);
	330
1da177e4 LT	331	MODULE_AUTHOR("H. Peter Anvin <hpa@zytor.com>");
	332	MODULE_DESCRIPTION("x86 generic MSR driver");
	333	MODULE_LICENSE("GPL");