| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <5331B22C.6090100@linaro.org>
Date: Tue, 25 Mar 2014 17:43:24 +0100
From: Eric Auger <eric.auger@...aro.org>
To: a.motakis@...tualopensystems.com
CC: alex.williamson@...hat.com, kvmarm@...ts.cs.columbia.edu,
iommu@...ts.linux-foundation.org, linux-kernel@...r.kernel.org,
gregkh@...uxfoundation.org, tech@...tualopensystems.com,
a.rigo@...tualopensystems.com, B08248@...escale.com,
kim.phillips@...aro.org, jan.kiszka@...mens.com,
kvm@...r.kernel.org, R65777@...escale.com, B07421@...escale.com,
christoffer.dall@...aro.org, agraf@...e.de, B16395@...escale.com,
will.deacon@....com, a.motakis@...tualopensystems.com
Subject: Re: [RFC PATCH v4 06/10] VFIO_PLATFORM: Read and write support for
the device fd
> Date: Sat, 8 Feb 2014 18:29:36 +0100
> VFIO returns a file descriptor which we can use to manipulate the memory
> regions of the device. Since some memory regions we cannot mmap due to
> security concerns, we also allow to read and write to this file descriptor
> directly.
>
> Signed-off-by: Antonios Motakis <a.motakis@...tualopensystems.com>
> Tested-by: Alvise Rigo <a.rigo@...tualopensystems.com>
> ---
> drivers/vfio/platform/vfio_platform.c | 128 +++++++++++++++++++++++++++++++++-
> 1 file changed, 125 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/vfio/platform/vfio_platform.c b/drivers/vfio/platform/vfio_platform.c
> index f7db5c0..ee96078 100644
> --- a/drivers/vfio/platform/vfio_platform.c
> +++ b/drivers/vfio/platform/vfio_platform.c
> @@ -55,7 +55,8 @@ static int vfio_platform_regions_init(struct vfio_platform_device *vdev)
>
> region.addr = res->start;
> region.size = resource_size(res);
> - region.flags = 0;
> + region.flags = VFIO_REGION_INFO_FLAG_READ
> + | VFIO_REGION_INFO_FLAG_WRITE;
>
> vdev->region[i] = region;
> }
> @@ -150,13 +151,134 @@ static long vfio_platform_ioctl(void *device_data,
> static ssize_t vfio_platform_read(void *device_data, char __user *buf,
> size_t count, loff_t *ppos)
> {
> - return 0;
> + struct vfio_platform_device *vdev = device_data;
> + unsigned int *io;
> + int i;
> +
> + for (i = 0; i < vdev->num_regions; i++) {
> + struct vfio_platform_region region = vdev->region[i];
> + unsigned int done = 0;
> + loff_t off;
> +
> + if ((*ppos < region.addr)
> + || (*ppos + count - 1) >= (region.addr + region.size))
> + continue;
> +
> + io = ioremap_nocache(region.addr, region.size);
> +
> + off = *ppos - region.addr;
> +
> + while (count) {
> + size_t filled;
> +
> + if (count >= 4 && !(off % 4)) {
> + u32 val;
> +
> + val = ioread32(io + off);
Hi Antonios,
I suspect there is an issue with the read address. Indeed io being an
unsigned int* the read address is io + off x sizeof (unsigned int) ie.
io+ offx4 whereas we expect to read io + off. declaring io as a void*
corrects the issue (or void __iomem *io). Same issue on write.
Best Regards
Eric
> + if (copy_to_user(buf, &val, 4))
> + goto err;
> +
> + filled = 4;
> + } else if (count >= 2 && !(off % 2)) {
> + u16 val;
> +
> + val = ioread16(io + off);
> + if (copy_to_user(buf, &val, 2))
> + goto err;
> +
> + filled = 2;
> + } else {
> + u8 val;
> +
> + val = ioread8(io + off);
> + if (copy_to_user(buf, &val, 1))
> + goto err;
> +
> + filled = 1;
> + }
> +
> +
> + count -= filled;
> + done += filled;
> + off += filled;
> + buf += filled;
> + }
> +
> + iounmap(io);
> + return done;
> + }
> +
> + return -EFAULT;
> +
> +err:
> + iounmap(io);
> + return -EFAULT;
> }
>
> static ssize_t vfio_platform_write(void *device_data, const char __user *buf,
> size_t count, loff_t *ppos)
> {
> - return 0;
> + struct vfio_platform_device *vdev = device_data;
> + unsigned int *io;
> + int i;
> +
> + for (i = 0; i < vdev->num_regions; i++) {
> + struct vfio_platform_region region = vdev->region[i];
> + unsigned int done = 0;
> + loff_t off;
> +
> + if ((*ppos < region.addr)
> + || (*ppos + count - 1) >= (region.addr + region.size))
> + continue;
> +
> + io = ioremap_nocache(region.addr, region.size);
> +
> + off = *ppos - region.addr;
> +
> + while (count) {
> + size_t filled;
> +
> + if (count >= 4 && !(off % 4)) {
> + u32 val;
> +
> + if (copy_from_user(&val, buf, 4))
> + goto err;
> + iowrite32(val, io + off);
> +
> + filled = 4;
> + } else if (count >= 2 && !(off % 2)) {
> + u16 val;
> +
> + if (copy_from_user(&val, buf, 2))
> + goto err;
> + iowrite16(val, io + off);
> +
> + filled = 2;
> + } else {
> + u8 val;
> +
> + if (copy_from_user(&val, buf, 1))
> + goto err;
> + iowrite8(val, io + off);
> +
> + filled = 1;
> + }
> +
> + count -= filled;
> + done += filled;
> + off += filled;
> + buf += filled;
> + }
> +
> + iounmap(io);
> + return done;
> + }
> +
> + return -EINVAL;
> +
> +err:
> + iounmap(io);
> + return -EFAULT;
> }
>
> static int vfio_platform_mmap(void *device_data, struct vm_area_struct *vma)
>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists