From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S965067AbcJRRR2 (ORCPT ); Tue, 18 Oct 2016 13:17:28 -0400 Received: from mx1.redhat.com ([209.132.183.28]:50994 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S964785AbcJRRRV (ORCPT ); Tue, 18 Oct 2016 13:17:21 -0400 Date: Tue, 18 Oct 2016 11:17:19 -0600 From: Alex Williamson To: Dong Jia Shi Cc: Kirti Wankhede , pbonzini@redhat.com, kraxel@redhat.com, cjia@nvidia.com, qemu-devel@nongnu.org, kvm@vger.kernel.org, kevin.tian@intel.com, jike.song@intel.com, linux-kernel@vger.kernel.org Subject: Re: [PATCH v9 12/12] docs: Sample driver to demonstrate how to use Mediated device framework. Message-ID: <20161018111719.141fcdaa@t450s.home> In-Reply-To: <20161018025411.GA22572@bjsdjshi@linux.vnet.ibm.com> References: <1476739332-4911-1-git-send-email-kwankhede@nvidia.com> <1476739332-4911-13-git-send-email-kwankhede@nvidia.com> <20161018025411.GA22572@bjsdjshi@linux.vnet.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.25]); Tue, 18 Oct 2016 17:17:20 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, 18 Oct 2016 10:54:11 +0800 Dong Jia Shi wrote: > * Kirti Wankhede [2016-10-18 02:52:12 +0530]: > > ...snip... > > > +static ssize_t mdev_access(struct mdev_device *mdev, char *buf, > > + size_t count, loff_t pos, bool is_write) > > +{ > > + struct mdev_state *mdev_state; > > + unsigned int index; > > + loff_t offset; > > + int ret = 0; > > + > > + if (!mdev || !buf) > > + return -EINVAL; > > + > > + mdev_state = mdev_get_drvdata(mdev); > > + if (!mdev_state) { > > + pr_err("%s mdev_state not found\n", __func__); > > + return -EINVAL; > > + } > > + > > + mutex_lock(&mdev_state->ops_lock); > > + > > + index = MTTY_VFIO_PCI_OFFSET_TO_INDEX(pos); > > + offset = pos & MTTY_VFIO_PCI_OFFSET_MASK; > > + switch (index) { > > + case VFIO_PCI_CONFIG_REGION_INDEX: > > + > > +#if defined(DEBUG) > > + pr_info("%s: PCI config space %s at offset 0x%llx\n", > > + __func__, is_write ? "write" : "read", offset); > > +#endif > > + if (is_write) { > > + dump_buffer(buf, count); > > + handle_pci_cfg_write(mdev_state, offset, buf, count); > > + } else { > > + memcpy(buf, (mdev_state->vconfig + offset), count); > > + dump_buffer(buf, count); > Dear Kirti: > > Shouldn't we use copy_from_user instead of memcpy on @buf here? And I'm > wondering if dump_buffer could really work since it tries to dereference > a *__user* marked pointor. I agree, the __user attribute is getting lost here and we're operating on user buffers as if they were kernel buffers. That's a bug. Thanks, Alex > Otherwise, this is a good example driver. Thanks! > > > + } > > + > > + break; > > + > > + case VFIO_PCI_BAR0_REGION_INDEX ... VFIO_PCI_BAR5_REGION_INDEX: > > + if (!mdev_state->region_info[index].start) > > + mdev_read_base(mdev_state); > > + > > + if (is_write) { > > + dump_buffer(buf, count); > > + > > +#if defined(DEBUG_REGS) > > + pr_info("%s: BAR%d WR @0x%llx %s val:0x%02x dlab:%d\n", > > + __func__, index, offset, wr_reg[offset], > > + (u8)*buf, mdev_state->s[index].dlab); > > +#endif > > + handle_bar_write(index, mdev_state, offset, buf, count); > > + } else { > > + handle_bar_read(index, mdev_state, offset, buf, count); > > + dump_buffer(buf, count); > > + > > +#if defined(DEBUG_REGS) > > + pr_info("%s: BAR%d RD @0x%llx %s val:0x%02x dlab:%d\n", > > + __func__, index, offset, rd_reg[offset], > > + (u8)*buf, mdev_state->s[index].dlab); > > +#endif > > + } > > + break; > > + > > + default: > > + ret = -1; > > + goto accessfailed; > > + } > > + > > + ret = count; > > + > > + > > +accessfailed: > > + mutex_unlock(&mdev_state->ops_lock); > > + > > + return ret; > > +} > > + > ...snip... > > > +ssize_t mtty_read(struct mdev_device *mdev, char __user *buf, > > + size_t count, loff_t *ppos) > > +{ > > + return mdev_access(mdev, buf, count, *ppos, false); > > +} > > + > > +ssize_t mtty_write(struct mdev_device *mdev, const char __user *buf, > > + size_t count, loff_t *ppos) > > +{ > > + return mdev_access(mdev, (char *)buf, count, *ppos, true); > > +} > > + > ...snip... > From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:38566) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bwY0y-0006lV-OP for qemu-devel@nongnu.org; Tue, 18 Oct 2016 13:17:27 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bwY0w-00019h-2G for qemu-devel@nongnu.org; Tue, 18 Oct 2016 13:17:24 -0400 Received: from mx1.redhat.com ([209.132.183.28]:33558) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1bwY0v-00019S-Qj for qemu-devel@nongnu.org; Tue, 18 Oct 2016 13:17:21 -0400 Date: Tue, 18 Oct 2016 11:17:19 -0600 From: Alex Williamson Message-ID: <20161018111719.141fcdaa@t450s.home> In-Reply-To: <20161018025411.GA22572@bjsdjshi@linux.vnet.ibm.com> References: <1476739332-4911-1-git-send-email-kwankhede@nvidia.com> <1476739332-4911-13-git-send-email-kwankhede@nvidia.com> <20161018025411.GA22572@bjsdjshi@linux.vnet.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH v9 12/12] docs: Sample driver to demonstrate how to use Mediated device framework. List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Dong Jia Shi Cc: Kirti Wankhede , pbonzini@redhat.com, kraxel@redhat.com, cjia@nvidia.com, qemu-devel@nongnu.org, kvm@vger.kernel.org, kevin.tian@intel.com, jike.song@intel.com, linux-kernel@vger.kernel.org On Tue, 18 Oct 2016 10:54:11 +0800 Dong Jia Shi wrote: > * Kirti Wankhede [2016-10-18 02:52:12 +0530]: > > ...snip... > > > +static ssize_t mdev_access(struct mdev_device *mdev, char *buf, > > + size_t count, loff_t pos, bool is_write) > > +{ > > + struct mdev_state *mdev_state; > > + unsigned int index; > > + loff_t offset; > > + int ret = 0; > > + > > + if (!mdev || !buf) > > + return -EINVAL; > > + > > + mdev_state = mdev_get_drvdata(mdev); > > + if (!mdev_state) { > > + pr_err("%s mdev_state not found\n", __func__); > > + return -EINVAL; > > + } > > + > > + mutex_lock(&mdev_state->ops_lock); > > + > > + index = MTTY_VFIO_PCI_OFFSET_TO_INDEX(pos); > > + offset = pos & MTTY_VFIO_PCI_OFFSET_MASK; > > + switch (index) { > > + case VFIO_PCI_CONFIG_REGION_INDEX: > > + > > +#if defined(DEBUG) > > + pr_info("%s: PCI config space %s at offset 0x%llx\n", > > + __func__, is_write ? "write" : "read", offset); > > +#endif > > + if (is_write) { > > + dump_buffer(buf, count); > > + handle_pci_cfg_write(mdev_state, offset, buf, count); > > + } else { > > + memcpy(buf, (mdev_state->vconfig + offset), count); > > + dump_buffer(buf, count); > Dear Kirti: > > Shouldn't we use copy_from_user instead of memcpy on @buf here? And I'm > wondering if dump_buffer could really work since it tries to dereference > a *__user* marked pointor. I agree, the __user attribute is getting lost here and we're operating on user buffers as if they were kernel buffers. That's a bug. Thanks, Alex > Otherwise, this is a good example driver. Thanks! > > > + } > > + > > + break; > > + > > + case VFIO_PCI_BAR0_REGION_INDEX ... VFIO_PCI_BAR5_REGION_INDEX: > > + if (!mdev_state->region_info[index].start) > > + mdev_read_base(mdev_state); > > + > > + if (is_write) { > > + dump_buffer(buf, count); > > + > > +#if defined(DEBUG_REGS) > > + pr_info("%s: BAR%d WR @0x%llx %s val:0x%02x dlab:%d\n", > > + __func__, index, offset, wr_reg[offset], > > + (u8)*buf, mdev_state->s[index].dlab); > > +#endif > > + handle_bar_write(index, mdev_state, offset, buf, count); > > + } else { > > + handle_bar_read(index, mdev_state, offset, buf, count); > > + dump_buffer(buf, count); > > + > > +#if defined(DEBUG_REGS) > > + pr_info("%s: BAR%d RD @0x%llx %s val:0x%02x dlab:%d\n", > > + __func__, index, offset, rd_reg[offset], > > + (u8)*buf, mdev_state->s[index].dlab); > > +#endif > > + } > > + break; > > + > > + default: > > + ret = -1; > > + goto accessfailed; > > + } > > + > > + ret = count; > > + > > + > > +accessfailed: > > + mutex_unlock(&mdev_state->ops_lock); > > + > > + return ret; > > +} > > + > ...snip... > > > +ssize_t mtty_read(struct mdev_device *mdev, char __user *buf, > > + size_t count, loff_t *ppos) > > +{ > > + return mdev_access(mdev, buf, count, *ppos, false); > > +} > > + > > +ssize_t mtty_write(struct mdev_device *mdev, const char __user *buf, > > + size_t count, loff_t *ppos) > > +{ > > + return mdev_access(mdev, (char *)buf, count, *ppos, true); > > +} > > + > ...snip... >