* Kirti Wankhede <kwankh...@nvidia.com> [2016-10-18 02:52:12 +0530]:
...snip...
> +static ssize_t mdev_access(struct mdev_device *mdev, char *buf,
> + size_t count, loff_t pos, bool is_write)
> +{
> + struct mdev_state *mdev_state;
> + unsigned int index;
> + loff_t offset;
> + int ret = 0;
> +
> + if (!mdev || !buf)
> + return -EINVAL;
> +
> + mdev_state = mdev_get_drvdata(mdev);
> + if (!mdev_state) {
> + pr_err("%s mdev_state not found\n", __func__);
> + return -EINVAL;
> + }
> +
> + mutex_lock(&mdev_state->ops_lock);
> +
> + index = MTTY_VFIO_PCI_OFFSET_TO_INDEX(pos);
> + offset = pos & MTTY_VFIO_PCI_OFFSET_MASK;
> + switch (index) {
> + case VFIO_PCI_CONFIG_REGION_INDEX:
> +
> +#if defined(DEBUG)
> + pr_info("%s: PCI config space %s at offset 0x%llx\n",
> + __func__, is_write ? "write" : "read", offset);
> +#endif
> + if (is_write) {
> + dump_buffer(buf, count);
> + handle_pci_cfg_write(mdev_state, offset, buf, count);
> + } else {
> + memcpy(buf, (mdev_state->vconfig + offset), count);
> + dump_buffer(buf, count);
Dear Kirti:
Shouldn't we use copy_from_user instead of memcpy on @buf here? And I'm
wondering if dump_buffer could really work since it tries to dereference
a *__user* marked pointor.
Otherwise, this is a good example driver. Thanks!
> + }
> +
> + break;
> +
> + case VFIO_PCI_BAR0_REGION_INDEX ... VFIO_PCI_BAR5_REGION_INDEX:
> + if (!mdev_state->region_info[index].start)
> + mdev_read_base(mdev_state);
> +
> + if (is_write) {
> + dump_buffer(buf, count);
> +
> +#if defined(DEBUG_REGS)
> + pr_info("%s: BAR%d WR @0x%llx %s val:0x%02x dlab:%d\n",
> + __func__, index, offset, wr_reg[offset],
> + (u8)*buf, mdev_state->s[index].dlab);
> +#endif
> + handle_bar_write(index, mdev_state, offset, buf, count);
> + } else {
> + handle_bar_read(index, mdev_state, offset, buf, count);
> + dump_buffer(buf, count);
> +
> +#if defined(DEBUG_REGS)
> + pr_info("%s: BAR%d RD @0x%llx %s val:0x%02x dlab:%d\n",
> + __func__, index, offset, rd_reg[offset],
> + (u8)*buf, mdev_state->s[index].dlab);
> +#endif
> + }
> + break;
> +
> + default:
> + ret = -1;
> + goto accessfailed;
> + }
> +
> + ret = count;
> +
> +
> +accessfailed:
> + mutex_unlock(&mdev_state->ops_lock);
> +
> + return ret;
> +}
> +
...snip...
> +ssize_t mtty_read(struct mdev_device *mdev, char __user *buf,
> + size_t count, loff_t *ppos)
> +{
> + return mdev_access(mdev, buf, count, *ppos, false);
> +}
> +
> +ssize_t mtty_write(struct mdev_device *mdev, const char __user *buf,
> + size_t count, loff_t *ppos)
> +{
> + return mdev_access(mdev, (char *)buf, count, *ppos, true);
> +}
> +
...snip...
--
Dong Jia
