david.venhoff/QEMU-Nyx-fork
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

* fix PVRDMA coverity errors

Browse Source 
* update MAINTAINERS file
 -----BEGIN PGP SIGNATURE-----
 
 iQEcBAABAgAGBQJa60x8AAoJEDbUwPDPL+Rt9nsIAIW4rPA0amDpuZr6JVDPKhWH
 Dp9C9ESSqUcPCG8FEddqpwhxXWI7knIaMjOMNnDHQJBqtSC7lqp6RpuEqMv8wJz4
 SniYeP76UycoetWPF8zg3QnoJkgZOv3D+jRFUQuEMqX33xevkZEfR+uF70GUZc1F
 jlFzWW2SJnEi3t1KQYIBq0jQpYVA5tw48FBbLPyUMQTKvaCQ6KZmRd/I3CGbSKxV
 3NPWXTjdgL0I1QSlBlDUYUSMf1VwyxxQVz0/wCMpu+4odomWfW6Q/eQudkDbrfbq
 7HrtFZzesUpnVptKmEBfO7cyrv3mW12AmqhpvjBXqQdZhjYLW90apcFp7X+xndU=
 =4jcH
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/marcel/tags/rdma-pull-request' into staging

* fix PVRDMA coverity errors
* update MAINTAINERS file

# gpg: Signature made Thu 03 May 2018 18:53:00 BST
# gpg:                using RSA key 36D4C0F0CF2FE46D
# gpg: Good signature from "Marcel Apfelbaum <marcel@redhat.com>"
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg:          It is not certain that the signature belongs to the owner.
# Primary key fingerprint: B1C6 3A57 F92E 08F2 640F  31F5 36D4 C0F0 CF2F E46D

* remotes/marcel/tags/rdma-pull-request:
  MAINTAINERS: update Marcel Apfelbaum email
  hw/rdma: Fix possible out of bounds access to port GID index
  hw/rdma: Delete duplicate definition of MAX_RM_TBL_NAME
  hw/rdma: Fix possible out of bounds access to regs array
  hw/rdma: Fix possible out of bounds access to GID table
  hw/rdma: Delete port's pkey table
  hw/rdma: Fix possible usage of a NULL pointer
  hw/rdma: Fix possible munmap call on a NULL pointer

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
This commit is contained in:
Peter Maydell 2018-05-03 19:22:24 +01:00
commit e2f557f988
8 changed files with 22 additions and 35 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
MAINTAINERS
View File

@ -909,7 +909,7 @@ X86 Machines
------------
PC
M: Michael S. Tsirkin <mst@redhat.com>
M: Marcel Apfelbaum <marcel@redhat.com>
M: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
S: Supported
F: include/hw/i386/
F: hw/i386/
@ -959,7 +959,7 @@ F: include/hw/timer/mc146818rtc*
Machine core
M: Eduardo Habkost <ehabkost@redhat.com>
M: Marcel Apfelbaum <marcel@redhat.com>
M: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
S: Supported
F: hw/core/machine.c
F: hw/core/null-machine.c
@ -1033,7 +1033,7 @@ F: hw/ipack/
PCI
M: Michael S. Tsirkin <mst@redhat.com>
M: Marcel Apfelbaum <marcel@redhat.com>
M: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
S: Supported
F: include/hw/pci/*
F: hw/misc/pci-testdev.c
@ -2075,7 +2075,7 @@ F: docs/block-replication.txt
PVRDMA
M: Yuval Shaia <yuval.shaia@oracle.com>
M: Marcel Apfelbaum <marcel@redhat.com>
M: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
S: Maintained
F: hw/rdma/*
F: hw/rdma/vmw/*

2
hw/rdma/rdma_backend.c
View File

@ -774,7 +774,7 @@ int rdma_backend_init(RdmaBackendDev *backend_dev,
goto out_destroy_comm_channel;
}
if (backend_dev->backend_gid_idx > port_attr.gid_tbl_len) {
if (backend_dev->backend_gid_idx >= port_attr.gid_tbl_len) {
error_setg(errp, "Invalid backend_gid_idx, should be less than %d",
port_attr.gid_tbl_len);
goto out_destroy_comm_channel;

2
hw/rdma/rdma_rm.c
View File

@ -21,8 +21,6 @@
#include "rdma_backend.h"
#include "rdma_rm.h"
#define MAX_RM_TBL_NAME 16
/* Page directory and page tables */
#define PG_DIR_SZ { TARGET_PAGE_SIZE / sizeof(__u64) }
#define PG_TBL_SZ { TARGET_PAGE_SIZE / sizeof(__u64) }

9
hw/rdma/rdma_rm_defs.h
View File

@ -20,9 +20,9 @@
#define MAX_PORTS 1
#define MAX_PORT_GIDS 1
#define MAX_GIDS MAX_PORT_GIDS
#define MAX_PORT_PKEYS 1
#define MAX_PKEYS 1
#define MAX_GIDS 2048
#define MAX_PKEYS MAX_PORT_PKEYS
#define MAX_UCS 512
#define MAX_MR_SIZE (1UL << 27)
#define MAX_QP 1024
@ -34,9 +34,9 @@
#define MAX_QP_INIT_RD_ATOM 16
#define MAX_AH 64
#define MAX_RMRESTBL_NAME_SZ 16
#define MAX_RM_TBL_NAME 16
typedef struct RdmaRmResTbl {
char name[MAX_RMRESTBL_NAME_SZ];
char name[MAX_RM_TBL_NAME];
QemuMutex lock;
unsigned long *bitmap;
size_t tbl_sz;
@ -87,7 +87,6 @@ typedef struct RdmaRmQP {
typedef struct RdmaRmPort {
union ibv_gid gid_tbl[MAX_PORT_GIDS];
enum ibv_port_state state;
int *pkey_tbl; /* TODO: Not yet supported */
} RdmaRmPort;
typedef struct RdmaDeviceResources {

6
hw/rdma/vmw/pvrdma.h
View File

@ -31,7 +31,7 @@
#define RDMA_REG_BAR_IDX 1
#define RDMA_UAR_BAR_IDX 2
#define RDMA_BAR0_MSIX_SIZE (16 * 1024)
#define RDMA_BAR1_REGS_SIZE 256
#define RDMA_BAR1_REGS_SIZE 64
#define RDMA_BAR2_UAR_SIZE (0x1000 * MAX_UCS) /* each uc gets page */
/* MSIX */
@ -86,7 +86,7 @@ static inline int get_reg_val(PVRDMADev *dev, hwaddr addr, uint32_t *val)
{
int idx = addr >> 2;
if (idx > RDMA_BAR1_REGS_SIZE) {
if (idx >= RDMA_BAR1_REGS_SIZE) {
return -EINVAL;
}
@ -99,7 +99,7 @@ static inline int set_reg_val(PVRDMADev *dev, hwaddr addr, uint32_t val)
{
int idx = addr >> 2;
if (idx > RDMA_BAR1_REGS_SIZE) {
if (idx >= RDMA_BAR1_REGS_SIZE) {
return -EINVAL;
}

10
hw/rdma/vmw/pvrdma_cmd.c
View File

@ -232,7 +232,7 @@ static int create_mr(PVRDMADev *dev, union pvrdma_cmd_req *req,
cmd->start, cmd->length, host_virt,
cmd->access_flags, &resp->mr_handle,
&resp->lkey, &resp->rkey);
if (!resp->hdr.err) {
if (host_virt && !resp->hdr.err) {
munmap(host_virt, cmd->length);
}
@ -576,7 +576,7 @@ static int create_bind(PVRDMADev *dev, union pvrdma_cmd_req *req,
pr_dbg("index=%d\n", cmd->index);
if (cmd->index > MAX_PORT_GIDS) {
if (cmd->index >= MAX_PORT_GIDS) {
return -EINVAL;
}
@ -603,7 +603,11 @@ static int destroy_bind(PVRDMADev *dev, union pvrdma_cmd_req *req,
{
struct pvrdma_cmd_destroy_bind *cmd = &req->destroy_bind;
pr_dbg("clear index %d\n", cmd->index);
pr_dbg("index=%d\n", cmd->index);
if (cmd->index >= MAX_PORT_GIDS) {
return -EINVAL;
}
memset(dev->rdma_dev_res.ports[0].gid_tbl[cmd->index].raw, 0,
sizeof(dev->rdma_dev_res.ports[0].gid_tbl[cmd->index].raw));

19
hw/rdma/vmw/pvrdma_main.c
View File

@ -275,15 +275,6 @@ static void init_dsr_dev_caps(PVRDMADev *dev)
pr_dbg("Initialized\n");
}
static void free_ports(PVRDMADev *dev)
{
int i;
for (i = 0; i < MAX_PORTS; i++) {
g_free(dev->rdma_dev_res.ports[i].gid_tbl);
}
}
static void init_ports(PVRDMADev *dev, Error **errp)
{
int i;
@ -292,10 +283,6 @@ static void init_ports(PVRDMADev *dev, Error **errp)
for (i = 0; i < MAX_PORTS; i++) {
dev->rdma_dev_res.ports[i].state = IBV_PORT_DOWN;
dev->rdma_dev_res.ports[i].pkey_tbl =
g_malloc0(sizeof(*dev->rdma_dev_res.ports[i].pkey_tbl) *
MAX_PORT_PKEYS);
}
}
@ -462,14 +449,14 @@ static void init_bars(PCIDevice *pdev)
/* BAR 1 - Registers */
memset(&dev->regs_data, 0, sizeof(dev->regs_data));
memory_region_init_io(&dev->regs, OBJECT(dev), &regs_ops, dev,
"pvrdma-regs", RDMA_BAR1_REGS_SIZE);
"pvrdma-regs", sizeof(dev->regs_data));
pci_register_bar(pdev, RDMA_REG_BAR_IDX, PCI_BASE_ADDRESS_SPACE_MEMORY,
&dev->regs);
/* BAR 2 - UAR */
memset(&dev->uar_data, 0, sizeof(dev->uar_data));
memory_region_init_io(&dev->uar, OBJECT(dev), &uar_ops, dev, "rdma-uar",
RDMA_BAR2_UAR_SIZE);
sizeof(dev->uar_data));
pci_register_bar(pdev, RDMA_UAR_BAR_IDX, PCI_BASE_ADDRESS_SPACE_MEMORY,
&dev->uar);
}
@ -622,8 +609,6 @@ static void pvrdma_exit(PCIDevice *pdev)
pvrdma_qp_ops_fini();
free_ports(dev);
rdma_rm_fini(&dev->rdma_dev_res);
rdma_backend_fini(&dev->backend_dev);

1
hw/rdma/vmw/pvrdma_qp_ops.c
View File

@ -216,6 +216,7 @@ void pvrdma_cq_poll(RdmaDeviceResources *dev_res, uint32_t cq_handle)
cq = rdma_rm_get_cq(dev_res, cq_handle);
if (!cq) {
pr_dbg("Invalid CQ# %d\n", cq_handle);
return;
}
rdma_backend_poll_cq(dev_res, &cq->backend_cq);