From mboxrd@z Thu Jan  1 00:00:00 1970
From: Dong Jia Shi <bjsdjshi@linux.vnet.ibm.com>
Subject: Re: [PATCH v9 12/12] docs: Sample driver to
 demonstrate how to use Mediated device framework.
Date: Tue, 18 Oct 2016 10:54:11 +0800
Message-ID: <46242.2564546161$1505293509@news.gmane.org>
References: <1476739332-4911-1-git-send-email-kwankhede@nvidia.com>
	<1476739332-4911-13-git-send-email-kwankhede@nvidia.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Cc: kevin.tian@intel.com, cjia@nvidia.com, kvm@vger.kernel.org,
	qemu-devel@nongnu.org, linux-kernel@vger.kernel.org,
	jike.song@intel.com, alex.williamson@redhat.com,
	kraxel@redhat.com, pbonzini@redhat.com, bjsdjshi@linux.vnet.ibm.com
To: Kirti Wankhede <kwankhede@nvidia.com>
Return-path: <qemu-devel-bounces+gceq-qemu-devel=gmane.org@nongnu.org>
Content-Disposition: inline
In-Reply-To: <1476739332-4911-13-git-send-email-kwankhede@nvidia.com>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel/>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
Errors-To: qemu-devel-bounces+gceq-qemu-devel=gmane.org@nongnu.org
Sender: "Qemu-devel" <qemu-devel-bounces+gceq-qemu-devel=gmane.org@nongnu.org>
List-Id: kvm.vger.kernel.org

* Kirti Wankhede <kwankhede@nvidia.com> [2016-10-18 02:52:12 +0530]:

...snip...

> +static ssize_t mdev_access(struct mdev_device *mdev, char *buf,
> +		size_t count, loff_t pos, bool is_write)
> +{
> +	struct mdev_state *mdev_state;
> +	unsigned int index;
> +	loff_t offset;
> +	int ret = 0;
> +
> +	if (!mdev || !buf)
> +		return -EINVAL;
> +
> +	mdev_state = mdev_get_drvdata(mdev);
> +	if (!mdev_state) {
> +		pr_err("%s mdev_state not found\n", __func__);
> +		return -EINVAL;
> +	}
> +
> +	mutex_lock(&mdev_state->ops_lock);
> +
> +	index = MTTY_VFIO_PCI_OFFSET_TO_INDEX(pos);
> +	offset = pos & MTTY_VFIO_PCI_OFFSET_MASK;
> +	switch (index) {
> +	case VFIO_PCI_CONFIG_REGION_INDEX:
> +
> +#if defined(DEBUG)
> +		pr_info("%s: PCI config space %s at offset 0x%llx\n",
> +			 __func__, is_write ? "write" : "read", offset);
> +#endif
> +		if (is_write) {
> +			dump_buffer(buf, count);
> +			handle_pci_cfg_write(mdev_state, offset, buf, count);
> +		} else {
> +			memcpy(buf, (mdev_state->vconfig + offset), count);
> +			dump_buffer(buf, count);
Dear Kirti:

Shouldn't we use copy_from_user instead of memcpy on @buf here? And I'm
wondering if dump_buffer could really work since it tries to dereference
a *__user* marked pointor.

Otherwise, this is a good example driver. Thanks!

> +		}
> +
> +		break;
> +
> +	case VFIO_PCI_BAR0_REGION_INDEX ... VFIO_PCI_BAR5_REGION_INDEX:
> +		if (!mdev_state->region_info[index].start)
> +			mdev_read_base(mdev_state);
> +
> +		if (is_write) {
> +			dump_buffer(buf, count);
> +
> +#if defined(DEBUG_REGS)
> +			pr_info("%s: BAR%d  WR @0x%llx %s val:0x%02x dlab:%d\n",
> +				__func__, index, offset, wr_reg[offset],
> +				(u8)*buf, mdev_state->s[index].dlab);
> +#endif
> +			handle_bar_write(index, mdev_state, offset, buf, count);
> +		} else {
> +			handle_bar_read(index, mdev_state, offset, buf, count);
> +			dump_buffer(buf, count);
> +
> +#if defined(DEBUG_REGS)
> +			pr_info("%s: BAR%d  RD @0x%llx %s val:0x%02x dlab:%d\n",
> +				__func__, index, offset, rd_reg[offset],
> +				(u8)*buf, mdev_state->s[index].dlab);
> +#endif
> +		}
> +		break;
> +
> +	default:
> +		ret = -1;
> +		goto accessfailed;
> +	}
> +
> +	ret = count;
> +
> +
> +accessfailed:
> +	mutex_unlock(&mdev_state->ops_lock);
> +
> +	return ret;
> +}
> +
...snip...

> +ssize_t mtty_read(struct mdev_device *mdev, char __user *buf,
> +			size_t count, loff_t *ppos)
> +{
> +	return mdev_access(mdev, buf, count, *ppos, false);
> +}
> +
> +ssize_t mtty_write(struct mdev_device *mdev, const char __user *buf,
> +			 size_t count, loff_t *ppos)
> +{
> +	return mdev_access(mdev, (char *)buf, count, *ppos, true);
> +}
> +
...snip...

-- 
Dong Jia