Re: [PATCH 4/4] drivers/mailbox: Add ASpeed mailbox driver

On Tue, 2017-02-07 at 16:10 +1030, Joel Stanley wrote:

quoted

+static ssize_t aspeed_mbox_read(struct file *file, char __user *buf,
+                               size_t count, loff_t *ppos)
+{
+       struct aspeed_mbox *mbox = file_mbox(file);
+       char __user *p = buf;
+       ssize_t ret;
+       int i;
+
+       if (!access_ok(VERIFY_WRITE, buf, count))
+               return -EFAULT;

As discussed in the LPC driver review:

 "And don't call access_ok(), it's racy and no driver should ever do that."

Make sure all of the things you fixed in that driver are fixed in this one.

Well... I don't entirely agree with Greg on that one :-) In this specific
case, since he's using __put_user() below, he must use access_ok() first.

The "alternate" option is to bounce everything via a local memory array,
copy_to/from_user (to/from that array) and then do the loop of inb/outb,
but in the grand scheme of things, what is written here is correct *and*
more efficient than the alternate approach. On such a slow SoC, those
cycles do count.

quoted

+
+       if (count + *ppos > ASPEED_MBOX_NUM_REGS)
+               return -EINVAL;
+
+       if (file->f_flags & O_NONBLOCK) {
+               if (!(aspeed_mbox_inb(mbox, ASPEED_MBOX_BMC_CTRL) &
+                               ASPEED_MBOX_CTRL_RECV))
+                       return -EAGAIN;
+       } else if (wait_event_interruptible(mbox->queue,
+                               aspeed_mbox_inb(mbox, ASPEED_MBOX_BMC_CTRL) &
+                               ASPEED_MBOX_CTRL_RECV)) {
+               return -ERESTARTSYS;
+       }
+
+       mutex_lock(&mbox->mutex);
+
+       for (i = *ppos; count > 0 && i < ASPEED_MBOX_NUM_REGS; i++) {
+               uint8_t reg = aspeed_mbox_inb(mbox, ASPEED_MBOX_DATA_0 + (i * 4));
+
+               ret = __put_user(reg, p);
+               if (ret)
+                       goto out_unlock;
+
+               p++;
+               count--;
+       }
+
+       /* ASPEED_MBOX_CTRL_RECV bit is W1C, this also unmasks in 1 step */

W1C? Write to clear?

quoted

+       aspeed_mbox_outb(mbox, ASPEED_MBOX_CTRL_RECV, ASPEED_MBOX_BMC_CTRL);
+       ret = p - buf;
+
+out_unlock:
+       mutex_unlock(&mbox->mutex);
+       return ret;
+}
+
+module_platform_driver(aspeed_mbox_driver);
+
+MODULE_DEVICE_TABLE(of, aspeed_mbox_match);
+MODULE_LICENSE("GPL");

quoted

quoted

+MODULE_AUTHOR("Cyril Bur [off-list ref]");

+MODULE_DESCRIPTION("ASpeed mailbox device driver");

ASPEED or Aspeed.

quoted

--
2.11.0

--
To unsubscribe from this list: send the line "unsubscribe devicetree" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html