Re: Device model operation hypercall (DMOP, re qemu depriv)

From: David Vrabel <david.vrabel@citrix.com>
To: Jan Beulich <JBeulich@suse.com>,
	Jennifer Herbert <Jennifer.Herbert@citrix.com>
Cc: StefanoStabellini <sstabellini@kernel.org>,
	Wei Liu <wei.liu2@citrix.com>,
	George Dunlap <George.Dunlap@eu.citrix.com>,
	Andrew Cooper <andrew.cooper3@citrix.com>,
	Ian Jackson <ian.jackson@eu.citrix.com>, Tim Deegan <tim@xen.org>,
	David Vrabel <david.vrabel@citrix.com>,
	Anthony Perard <anthony.perard@citrix.com>,
	xen-devel <xen-devel@lists.xenproject.org>,
	dgdegra@tycho.nsa.gov
Subject: Re: Device model operation hypercall (DMOP, re qemu depriv)
Date: Tue, 13 Sep 2016 17:07:43 +0100	[thread overview]
Message-ID: <57D8244F.3070707@citrix.com> (raw)
In-Reply-To: <57D6D889020000780010E195@prv-mh.provo.novell.com>

On 12/09/16 15:32, Jan Beulich wrote:
>>>> On 09.09.16 at 17:16, <Jennifer.Herbert@citrix.com> wrote:
>> The following code illustrates this idea:
>>
>> typedef struct dm_op_buffer {
>>      XEN_GUEST_HANDLE(void) h;
>>      size_t len;
>> } dm_op_buffer_t;
> 
> This implies that we'll lose all type safety on the handles passed, as
> is also emphasized by the use of raw_copy_from_guest() in the code
> outline further down.

This is an direct result of the requirement that the privcmd driver does
not know the types of the sub-ops themselves.  We can't have this
requirement and type safety.  Which do we want?

I would point out that Linux copy_from_user() and copy_to_user()
functions are not type safe and I'm not aware that this causes many
problems.

David

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel