ShuriZma
/
xemu
mirror of https://github.com/xemu-project/xemu.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

* fix PVRDMA coverity errors 

* update MAINTAINERS file
 -----BEGIN PGP SIGNATURE-----
 
 iQEcBAABAgAGBQJa60x8AAoJEDbUwPDPL+Rt9nsIAIW4rPA0amDpuZr6JVDPKhWH
 Dp9C9ESSqUcPCG8FEddqpwhxXWI7knIaMjOMNnDHQJBqtSC7lqp6RpuEqMv8wJz4
 SniYeP76UycoetWPF8zg3QnoJkgZOv3D+jRFUQuEMqX33xevkZEfR+uF70GUZc1F
 jlFzWW2SJnEi3t1KQYIBq0jQpYVA5tw48FBbLPyUMQTKvaCQ6KZmRd/I3CGbSKxV
 3NPWXTjdgL0I1QSlBlDUYUSMf1VwyxxQVz0/wCMpu+4odomWfW6Q/eQudkDbrfbq
 7HrtFZzesUpnVptKmEBfO7cyrv3mW12AmqhpvjBXqQdZhjYLW90apcFp7X+xndU=
 =4jcH
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/marcel/tags/rdma-pull-request' into staging

* fix PVRDMA coverity errors
* update MAINTAINERS file

# gpg: Signature made Thu 03 May 2018 18:53:00 BST
# gpg:                using RSA key 36D4C0F0CF2FE46D
# gpg: Good signature from "Marcel Apfelbaum <marcel@redhat.com>"
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg:          It is not certain that the signature belongs to the owner.
# Primary key fingerprint: B1C6 3A57 F92E 08F2 640F  31F5 36D4 C0F0 CF2F E46D

* remotes/marcel/tags/rdma-pull-request:
  MAINTAINERS: update Marcel Apfelbaum email
  hw/rdma: Fix possible out of bounds access to port GID index
  hw/rdma: Delete duplicate definition of MAX_RM_TBL_NAME
  hw/rdma: Fix possible out of bounds access to regs array
  hw/rdma: Fix possible out of bounds access to GID table
  hw/rdma: Delete port's pkey table
  hw/rdma: Fix possible usage of a NULL pointer
  hw/rdma: Fix possible munmap call on a NULL pointer

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
This commit is contained in:
Peter Maydell 2018-05-03 19:22:24 +01:00
parent 59255887e6 fe355cbda2
commit e2f557f988
8 changed files with 22 additions and 35 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
MAINTAINERS
View File

@ -909,7 +909,7 @@ X86 Machines
------------ ------------
PC PC
M: Michael S. Tsirkin <mst@redhat.com> M: Michael S. Tsirkin <mst@redhat.com>
M: Marcel Apfelbaum <marcel@redhat.com> M: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
S: Supported S: Supported
F: include/hw/i386/ F: include/hw/i386/
F: hw/i386/ F: hw/i386/
@ -959,7 +959,7 @@ F: include/hw/timer/mc146818rtc*
Machine core Machine core
M: Eduardo Habkost <ehabkost@redhat.com> M: Eduardo Habkost <ehabkost@redhat.com>
M: Marcel Apfelbaum <marcel@redhat.com> M: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
S: Supported S: Supported
F: hw/core/machine.c F: hw/core/machine.c
F: hw/core/null-machine.c F: hw/core/null-machine.c
@ -1033,7 +1033,7 @@ F: hw/ipack/
PCI PCI
M: Michael S. Tsirkin <mst@redhat.com> M: Michael S. Tsirkin <mst@redhat.com>
M: Marcel Apfelbaum <marcel@redhat.com> M: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
S: Supported S: Supported
F: include/hw/pci/* F: include/hw/pci/*
F: hw/misc/pci-testdev.c F: hw/misc/pci-testdev.c
@ -2075,7 +2075,7 @@ F: docs/block-replication.txt
PVRDMA PVRDMA
M: Yuval Shaia <yuval.shaia@oracle.com> M: Yuval Shaia <yuval.shaia@oracle.com>
M: Marcel Apfelbaum <marcel@redhat.com> M: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
S: Maintained S: Maintained
F: hw/rdma/* F: hw/rdma/*
F: hw/rdma/vmw/* F: hw/rdma/vmw/*

2
hw/rdma/rdma_backend.c
View File

@ -774,7 +774,7 @@ int rdma_backend_init(RdmaBackendDev *backend_dev,
goto out_destroy_comm_channel; goto out_destroy_comm_channel;
} }
if (backend_dev->backend_gid_idx > port_attr.gid_tbl_len) { if (backend_dev->backend_gid_idx >= port_attr.gid_tbl_len) {
error_setg(errp, "Invalid backend_gid_idx, should be less than %d", error_setg(errp, "Invalid backend_gid_idx, should be less than %d",
port_attr.gid_tbl_len); port_attr.gid_tbl_len);
goto out_destroy_comm_channel; goto out_destroy_comm_channel;

2
hw/rdma/rdma_rm.c
View File

@ -21,8 +21,6 @@
#include "rdma_backend.h" #include "rdma_backend.h"
#include "rdma_rm.h" #include "rdma_rm.h"
#define MAX_RM_TBL_NAME 16
/* Page directory and page tables */ /* Page directory and page tables */
#define PG_DIR_SZ { TARGET_PAGE_SIZE / sizeof(__u64) } #define PG_DIR_SZ { TARGET_PAGE_SIZE / sizeof(__u64) }
#define PG_TBL_SZ { TARGET_PAGE_SIZE / sizeof(__u64) } #define PG_TBL_SZ { TARGET_PAGE_SIZE / sizeof(__u64) }

9
hw/rdma/rdma_rm_defs.h
View File

@ -20,9 +20,9 @@
#define MAX_PORTS 1 #define MAX_PORTS 1
#define MAX_PORT_GIDS 1 #define MAX_PORT_GIDS 1
#define MAX_GIDS MAX_PORT_GIDS
#define MAX_PORT_PKEYS 1 #define MAX_PORT_PKEYS 1
#define MAX_PKEYS 1 #define MAX_PKEYS MAX_PORT_PKEYS
#define MAX_GIDS 2048
#define MAX_UCS 512 #define MAX_UCS 512
#define MAX_MR_SIZE (1UL << 27) #define MAX_MR_SIZE (1UL << 27)
#define MAX_QP 1024 #define MAX_QP 1024
@ -34,9 +34,9 @@
#define MAX_QP_INIT_RD_ATOM 16 #define MAX_QP_INIT_RD_ATOM 16
#define MAX_AH 64 #define MAX_AH 64
#define MAX_RMRESTBL_NAME_SZ 16 #define MAX_RM_TBL_NAME 16
typedef struct RdmaRmResTbl { typedef struct RdmaRmResTbl {
char name[MAX_RMRESTBL_NAME_SZ]; char name[MAX_RM_TBL_NAME];
QemuMutex lock; QemuMutex lock;
unsigned long *bitmap; unsigned long *bitmap;
size_t tbl_sz; size_t tbl_sz;
@ -87,7 +87,6 @@ typedef struct RdmaRmQP {
typedef struct RdmaRmPort { typedef struct RdmaRmPort {
union ibv_gid gid_tbl[MAX_PORT_GIDS]; union ibv_gid gid_tbl[MAX_PORT_GIDS];
enum ibv_port_state state; enum ibv_port_state state;
int *pkey_tbl; /* TODO: Not yet supported */
} RdmaRmPort; } RdmaRmPort;
typedef struct RdmaDeviceResources { typedef struct RdmaDeviceResources {

6
hw/rdma/vmw/pvrdma.h
View File

@ -31,7 +31,7 @@
#define RDMA_REG_BAR_IDX 1 #define RDMA_REG_BAR_IDX 1
#define RDMA_UAR_BAR_IDX 2 #define RDMA_UAR_BAR_IDX 2
#define RDMA_BAR0_MSIX_SIZE (16 * 1024) #define RDMA_BAR0_MSIX_SIZE (16 * 1024)
#define RDMA_BAR1_REGS_SIZE 256 #define RDMA_BAR1_REGS_SIZE 64
#define RDMA_BAR2_UAR_SIZE (0x1000 * MAX_UCS) /* each uc gets page */ #define RDMA_BAR2_UAR_SIZE (0x1000 * MAX_UCS) /* each uc gets page */
/* MSIX */ /* MSIX */
@ -86,7 +86,7 @@ static inline int get_reg_val(PVRDMADev *dev, hwaddr addr, uint32_t *val)
{ {
int idx = addr >> 2; int idx = addr >> 2;
if (idx > RDMA_BAR1_REGS_SIZE) { if (idx >= RDMA_BAR1_REGS_SIZE) {
return -EINVAL; return -EINVAL;
} }
@ -99,7 +99,7 @@ static inline int set_reg_val(PVRDMADev *dev, hwaddr addr, uint32_t val)
{ {
int idx = addr >> 2; int idx = addr >> 2;
if (idx > RDMA_BAR1_REGS_SIZE) { if (idx >= RDMA_BAR1_REGS_SIZE) {
return -EINVAL; return -EINVAL;
} }

10
hw/rdma/vmw/pvrdma_cmd.c
View File

@ -232,7 +232,7 @@ static int create_mr(PVRDMADev *dev, union pvrdma_cmd_req *req,
cmd->start, cmd->length, host_virt, cmd->start, cmd->length, host_virt,
cmd->access_flags, &resp->mr_handle, cmd->access_flags, &resp->mr_handle,
&resp->lkey, &resp->rkey); &resp->lkey, &resp->rkey);
if (!resp->hdr.err) { if (host_virt && !resp->hdr.err) {
munmap(host_virt, cmd->length); munmap(host_virt, cmd->length);
} }
@ -576,7 +576,7 @@ static int create_bind(PVRDMADev *dev, union pvrdma_cmd_req *req,
pr_dbg("index=%d\n", cmd->index); pr_dbg("index=%d\n", cmd->index);
if (cmd->index > MAX_PORT_GIDS) { if (cmd->index >= MAX_PORT_GIDS) {
return -EINVAL; return -EINVAL;
} }
@ -603,7 +603,11 @@ static int destroy_bind(PVRDMADev *dev, union pvrdma_cmd_req *req,
{ {
struct pvrdma_cmd_destroy_bind *cmd = &req->destroy_bind; struct pvrdma_cmd_destroy_bind *cmd = &req->destroy_bind;
pr_dbg("clear index %d\n", cmd->index); pr_dbg("index=%d\n", cmd->index);
if (cmd->index >= MAX_PORT_GIDS) {
return -EINVAL;
}
memset(dev->rdma_dev_res.ports[0].gid_tbl[cmd->index].raw, 0, memset(dev->rdma_dev_res.ports[0].gid_tbl[cmd->index].raw, 0,
sizeof(dev->rdma_dev_res.ports[0].gid_tbl[cmd->index].raw)); sizeof(dev->rdma_dev_res.ports[0].gid_tbl[cmd->index].raw));

19
hw/rdma/vmw/pvrdma_main.c
View File

@ -275,15 +275,6 @@ static void init_dsr_dev_caps(PVRDMADev *dev)
pr_dbg("Initialized\n"); pr_dbg("Initialized\n");
} }
static void free_ports(PVRDMADev *dev)
{
int i;
for (i = 0; i < MAX_PORTS; i++) {
g_free(dev->rdma_dev_res.ports[i].gid_tbl);
}
}
static void init_ports(PVRDMADev *dev, Error **errp) static void init_ports(PVRDMADev *dev, Error **errp)
{ {
int i; int i;
@ -292,10 +283,6 @@ static void init_ports(PVRDMADev *dev, Error **errp)
for (i = 0; i < MAX_PORTS; i++) { for (i = 0; i < MAX_PORTS; i++) {
dev->rdma_dev_res.ports[i].state = IBV_PORT_DOWN; dev->rdma_dev_res.ports[i].state = IBV_PORT_DOWN;
dev->rdma_dev_res.ports[i].pkey_tbl =
g_malloc0(sizeof(*dev->rdma_dev_res.ports[i].pkey_tbl) *
MAX_PORT_PKEYS);
} }
} }
@ -462,14 +449,14 @@ static void init_bars(PCIDevice *pdev)
/* BAR 1 - Registers */ /* BAR 1 - Registers */
memset(&dev->regs_data, 0, sizeof(dev->regs_data)); memset(&dev->regs_data, 0, sizeof(dev->regs_data));
memory_region_init_io(&dev->regs, OBJECT(dev), &regs_ops, dev, memory_region_init_io(&dev->regs, OBJECT(dev), &regs_ops, dev,
"pvrdma-regs", RDMA_BAR1_REGS_SIZE); "pvrdma-regs", sizeof(dev->regs_data));
pci_register_bar(pdev, RDMA_REG_BAR_IDX, PCI_BASE_ADDRESS_SPACE_MEMORY, pci_register_bar(pdev, RDMA_REG_BAR_IDX, PCI_BASE_ADDRESS_SPACE_MEMORY,
&dev->regs); &dev->regs);
/* BAR 2 - UAR */ /* BAR 2 - UAR */
memset(&dev->uar_data, 0, sizeof(dev->uar_data)); memset(&dev->uar_data, 0, sizeof(dev->uar_data));
memory_region_init_io(&dev->uar, OBJECT(dev), &uar_ops, dev, "rdma-uar", memory_region_init_io(&dev->uar, OBJECT(dev), &uar_ops, dev, "rdma-uar",
RDMA_BAR2_UAR_SIZE); sizeof(dev->uar_data));
pci_register_bar(pdev, RDMA_UAR_BAR_IDX, PCI_BASE_ADDRESS_SPACE_MEMORY, pci_register_bar(pdev, RDMA_UAR_BAR_IDX, PCI_BASE_ADDRESS_SPACE_MEMORY,
&dev->uar); &dev->uar);
} }
@ -622,8 +609,6 @@ static void pvrdma_exit(PCIDevice *pdev)
pvrdma_qp_ops_fini(); pvrdma_qp_ops_fini();
free_ports(dev);
rdma_rm_fini(&dev->rdma_dev_res); rdma_rm_fini(&dev->rdma_dev_res);
rdma_backend_fini(&dev->backend_dev); rdma_backend_fini(&dev->backend_dev);

1
hw/rdma/vmw/pvrdma_qp_ops.c
View File

@ -216,6 +216,7 @@ void pvrdma_cq_poll(RdmaDeviceResources *dev_res, uint32_t cq_handle)
cq = rdma_rm_get_cq(dev_res, cq_handle); cq = rdma_rm_get_cq(dev_res, cq_handle);
if (!cq) { if (!cq) {
pr_dbg("Invalid CQ# %d\n", cq_handle); pr_dbg("Invalid CQ# %d\n", cq_handle);
return;
} }
rdma_backend_poll_cq(dev_res, &cq->backend_cq); rdma_backend_poll_cq(dev_res, &cq->backend_cq);