Re: [PATCH v1 14/19] cxl: Add support for fwctl RPC command to enable CXL feature commands

[Dan Williams <dan.j.williams@intel.com>]

Dave Jiang wrote:
> fwctl provides a fwctl_ops->fw_rpc() callback in order to issue ioctls
> to a device. The cxl fwctl driver will start by supporting the CXL
> feature commands: Get Supported Features, Get Feature, and Set Feature.
> 
> The fw_rpc() callback provides 'enum fwctl_rpc_scope' parameter where
> it indicates the security scope of the call. The Get Supported Features
> and Get Feature calls can be executed with the scope of
> FWCTL_RPC_CONFIGRATION. The Set Feature call is gated by the effects
> of the feature reported by Get Supported Features call for the specific
> feature.
> 
> Only "get supported features" is supported in this patch. Additional
> commands will be added in follow on patches. "Get supported features"
> will filter the features that are exclusive to the kernel and only
> report out features that are not kernel only.
> 
> Signed-off-by: Dave Jiang <dave.jiang@intel.com>
> ---
>  drivers/cxl/core/mbox.c     |  12 +++
>  drivers/cxl/features.c      | 198 +++++++++++++++++++++++++++++++++++-
>  include/cxl/features.h      |   1 +
>  include/uapi/cxl/features.h |  13 +++
>  include/uapi/fwctl/cxl.h    |  29 ++++++
>  5 files changed, 250 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/cxl/core/mbox.c b/drivers/cxl/core/mbox.c
> index 0b4946205910..f818e452dbca 100644
> --- a/drivers/cxl/core/mbox.c
> +++ b/drivers/cxl/core/mbox.c
> @@ -246,6 +246,18 @@ struct cxl_mem_command *cxl_find_feature_command(u16 opcode)
>  }
>  EXPORT_SYMBOL_NS_GPL(cxl_find_feature_command, "CXL");
>  
> +struct cxl_mem_command *cxl_find_feature_command_by_id(u32 id)
> +{
> +	struct cxl_mem_command *c;
> +
> +	cxl_for_each_feature_cmd(c)
> +		if (c->info.id == id)
> +			return c;
> +
> +	return NULL;
> +}
> +EXPORT_SYMBOL_NS_GPL(cxl_find_feature_command_by_id, "CXL");

I assume this will go with the deletion of a cxl_mem_command array for
Features. Just do a simple hard-coded switch statement.

> +
>  static const char *cxl_mem_opcode_to_name(u16 opcode)
>  {
>  	struct cxl_mem_command *c;
> diff --git a/drivers/cxl/features.c b/drivers/cxl/features.c
> index cc72e73ae8d6..e65fc8479d21 100644
> --- a/drivers/cxl/features.c
> +++ b/drivers/cxl/features.c
> @@ -50,11 +50,203 @@ static void *cxlctl_info(struct fwctl_uctx *uctx, size_t *length)
>  	return info;
>  }
>  
> +static struct cxl_feat_entry *
> +get_support_feature_info(struct cxl_features_state *cfs,
> +			 const struct fwctl_rpc_cxl *rpc_in)
> +{
> +	struct cxl_feat_entry *feat;
> +	uuid_t uuid;
> +
> +	if (rpc_in->op_size < sizeof(uuid))
> +		return ERR_PTR(-EINVAL);
> +
> +	if (copy_from_user(&uuid, u64_to_user_ptr(rpc_in->in_payload),
> +			   sizeof(uuid)))
> +		return ERR_PTR(-EFAULT);
> +
> +	for (int i = 0; i < cfs->num_features; i++) {
> +		feat = &cfs->entries[i];
> +		if (uuid_equal(&uuid, &feat->uuid))
> +			return feat;
> +	}
> +
> +	return ERR_PTR(-ENOENT);

I expect user space to be surprised that it is getting "No such file or
directory" after successfully opening the fwctl fd. Just use EINVAL for
attempts to access Features that were not captured via the init-time Get
Supported Features.

> +}
> +
> +static void *cxlctl_get_supported_features(struct cxl_features_state *cfs,
> +					   const struct fwctl_rpc_cxl *rpc_in,
> +					   size_t *out_len)
> +{
> +	struct cxl_mbox_get_sup_feats_out *feat_out;
> +	struct cxl_mbox_get_sup_feats_in feat_in;
> +	struct cxl_feat_entry *saved, *pos;
> +	int requested, copied;
> +	size_t out_size;
> +	u32 count;
> +	u16 start;
> +
> +	if (rpc_in->op_size != sizeof(feat_in))
> +		return ERR_PTR(-EINVAL);
> +
> +	if (copy_from_user(&feat_in, u64_to_user_ptr(rpc_in->in_payload),
> +			   rpc_in->op_size))
> +		return ERR_PTR(-EFAULT);
> +
> +	count = le32_to_cpu(feat_in.count);
> +	start = le16_to_cpu(feat_in.start_idx);
> +	requested = count / sizeof(*pos);
> +
> +	/*
> +	 * Make sure that the total requested number of entries is not greater
> +	 * than the total number of supported features allowed for userspace.
> +	 */
> +	if (start >= cfs->num_user_features)
> +		return ERR_PTR(-EINVAL);
> +
> +	requested = min_t(int, requested, cfs->num_user_features - start);
> +
> +	out_size = sizeof(struct fwctl_rpc_cxl_out) + sizeof(*feat_out) +
> +		   requested * sizeof(*pos);
> +
> +	struct fwctl_rpc_cxl_out *rpc_out __free(kvfree) =
> +		kvzalloc(out_size, GFP_KERNEL);
> +	if (!rpc_out)
> +		return ERR_PTR(-ENOMEM);
> +
> +	rpc_out->size = sizeof(*feat_out) + requested * sizeof(*pos);
> +	feat_out = (struct cxl_mbox_get_sup_feats_out *)rpc_out->payload;
> +	if (requested == 0) {
> +		feat_out->num_entries = cpu_to_le16(requested);
> +		feat_out->supported_feats = cpu_to_le16(cfs->num_user_features);
> +		rpc_out->retval = CXL_MBOX_CMD_RC_SUCCESS;
> +		*out_len = out_size;
> +		return no_free_ptr(rpc_out);
> +	}
> +
> +	pos = &feat_out->ents[0];
> +	saved = &cfs->entries[0];
> +
> +	copied = 0;
> +	for (int i = 0; i < cfs->num_features; i++, saved++) {
> +		if (is_cxl_feature_exclusive(saved))
> +			continue;

I think it's fine to let userspace see that exclusive features are
present, just need to return EBUSY if userspace actually tries to use
them.

> +
> +		memcpy(pos, saved, sizeof(*saved));
> +		copied++;
> +		if (copied == requested)
> +			break;
> +		pos++;
> +	}
> +
> +	feat_out->num_entries = cpu_to_le16(requested);
> +	feat_out->supported_feats = cpu_to_le16(cfs->num_user_features);
> +	rpc_out->retval = CXL_MBOX_CMD_RC_SUCCESS;
> +	*out_len = out_size;
> +
> +	return no_free_ptr(rpc_out);
> +}
> +
> +static bool cxlctl_validate_set_features(struct cxl_features_state *cfs,
> +					 const struct fwctl_rpc_cxl *rpc_in,
> +					 enum fwctl_rpc_scope scope)
> +{
> +	struct cxl_feat_entry *feat;
> +	u16 effects, mask;
> +	u32 flags;
> +
> +	feat = get_support_feature_info(cfs, rpc_in);
> +	if (IS_ERR(feat))
> +		return false;
> +
> +	/* Ensure that the attribute is changeable */
> +	flags = le32_to_cpu(feat->flags);
> +	if (!(flags & CXL_FEATURE_F_CHANGEABLE))
> +		return false;
> +
> +	effects = le16_to_cpu(feat->effects);
> +	/* Currently no user background command support */
> +	if (effects & CXL_CMD_BACKGROUND)
> +		return false;
> +
> +	mask = CXL_CMD_CONFIG_CHANGE_IMMEDIATE |
> +	       CXL_CMD_DATA_CHANGE_IMMEDIATE |
> +	       CXL_CMD_POLICY_CHANGE_IMMEDIATE |
> +	       CXL_CMD_LOG_CHANGE_IMMEDIATE;
> +	if (effects & mask && scope >= FWCTL_RPC_DEBUG_WRITE_FULL)
> +		return true;
> +
> +	/* These effects supported for all scope */
> +	if ((effects & CXL_CMD_CONFIG_CHANGE_COLD_RESET ||
> +	     (effects & CXL_CMD_EFFECTS_EXTEND &&
> +	      (effects & CXL_CMD_CONFIG_CHANGE_CONV_RESET ||
> +	       effects & CXL_CMD_CONFIG_CHANGE_CXL_RESET))) &&
> +	    scope >= FWCTL_RPC_DEBUG_WRITE)
> +		return true;

Looks good for the known bits, but this needs to return false for the
currently reserved bits because the driver can not assume a security
model for future effects. If a future spec adds
FWCTL_RPC_DEBUG_WRITE-safe effects, a new kernel is needed to allow
those Feature commands through.

Sidenote: I wonder why the spec wasted one of its bits on an extend bit,
but here we are. The 'extend' concept is typically something like
"bit15: go look at this other field in this payload as this 16-bit field
was exhausted", not "bit9: the bits above this originally defined 16 bit
field now has more bits", oh well.

> +
> +	return false;
> +}
> +
> +static struct cxl_mem_command *
> +cxlctl_get_valid_hw_command(struct cxl_features_state *cfs,
> +			    const struct fwctl_rpc_cxl *rpc_in,
> +			    enum fwctl_rpc_scope scope)
> +{
> +	struct cxl_mem_command *cmd;
> +
> +	if (!cfs->num_features)
> +		return ERR_PTR(-EOPNOTSUPP);
> +
> +	cmd = cxl_find_feature_command_by_id(rpc_in->command_id);
> +	if (!cmd)
> +		return ERR_PTR(-ENOENT);
> +
> +	if (!cxl_feature_enabled(cfs, cmd->opcode))
> +		return ERR_PTR(-EPERM);

Why "Permission denied", because the base command is missing? The
cxl_fwctl interface would not even be availble to userspace if the above
was true.

No need to worry about optional Set Feature becuase that should be
consistent with the Set Feature Size data in Get Supported Features.

> +

Per above, need to add EBUSY for exclusive features in this path.

> +	switch (cmd->opcode) {
> +	case CXL_MBOX_OP_GET_SUPPORTED_FEATURES:
> +	case CXL_MBOX_OP_GET_FEATURE:

I would still check if a Get Feature has a configuration change
side-effect. You never know if someone purposefully or accidentally
introduces "read causes side effects" commands.

[..]