X-Git-Url: http://git.droids-corp.org/?a=blobdiff_plain;f=lib%2Flibrte_vhost%2Fvdpa.c;h=321e11f178d2daad1dbdc3e828c05fe140e484cd;hb=44889767af56da156e29e1883392c3ead020f0d9;hp=240a1fe3a18a0c8c78096f01c668f99a2cd0033c;hpb=b13ad2decc8344641658674414d0347beca4bec6;p=dpdk.git

diff --git a/lib/librte_vhost/vdpa.c b/lib/librte_vhost/vdpa.c
index 240a1fe3a1..321e11f178 100644
--- a/lib/librte_vhost/vdpa.c
+++ b/lib/librte_vhost/vdpa.c
@@ -66,7 +66,7 @@ rte_vdpa_register_device(struct rte_vdpa_dev_addr *addr,
 	if (i == MAX_VHOST_DEVICE)
 		return -1;
 
-	sprintf(device_name, "vdpa-dev-%d", i);
+	snprintf(device_name, sizeof(device_name), "vdpa-dev-%d", i);
 	dev = rte_zmalloc(device_name, sizeof(struct rte_vdpa_device),
 			RTE_CACHE_LINE_SIZE);
 	if (!dev)
@@ -123,117 +123,6 @@ rte_vdpa_get_device_num(void)
 	return vdpa_device_num;
 }
 
-static bool
-invalid_desc_check(struct virtio_net *dev, struct vhost_virtqueue *vq,
-		uint64_t desc_iova, uint64_t desc_len, uint8_t perm)
-{
-	uint64_t desc_addr, desc_chunck_len;
-
-	while (desc_len) {
-		desc_chunck_len = desc_len;
-		desc_addr = vhost_iova_to_vva(dev, vq,
-				desc_iova,
-				&desc_chunck_len,
-				perm);
-
-		if (!desc_addr)
-			return true;
-
-		desc_len -= desc_chunck_len;
-		desc_iova += desc_chunck_len;
-	}
-
-	return false;
-}
-
-int __rte_experimental
-rte_vdpa_relay_vring_avail(int vid, uint16_t qid, void *vring_m)
-{
-	struct virtio_net *dev = get_device(vid);
-	uint16_t idx, idx_m, desc_id;
-	struct vring_desc desc;
-	struct vhost_virtqueue *vq;
-	struct vring_desc *desc_ring;
-	struct vring_desc *idesc = NULL;
-	struct vring *s_vring;
-	uint64_t dlen;
-	int ret;
-	uint8_t perm;
-
-	if (!dev || !vring_m)
-		return -1;
-
-	if (qid >= dev->nr_vring)
-		return -1;
-
-	if (vq_is_packed(dev))
-		return -1;
-
-	s_vring = (struct vring *)vring_m;
-	vq = dev->virtqueue[qid];
-	idx = vq->avail->idx;
-	idx_m = s_vring->avail->idx;
-	ret = (uint16_t)(idx - idx_m);
-
-	while (idx_m != idx) {
-		/* avail entry copy */
-		desc_id = vq->avail->ring[idx_m & (vq->size - 1)];
-		s_vring->avail->ring[idx_m & (vq->size - 1)] = desc_id;
-		desc_ring = vq->desc;
-
-		if (vq->desc[desc_id].flags & VRING_DESC_F_INDIRECT) {
-			dlen = vq->desc[desc_id].len;
-			desc_ring = (struct vring_desc *)(uintptr_t)
-				vhost_iova_to_vva(dev, vq,
-						vq->desc[desc_id].addr, &dlen,
-						VHOST_ACCESS_RO);
-			if (unlikely(!desc_ring))
-				return -1;
-
-			if (unlikely(dlen < vq->desc[idx].len)) {
-				idesc = alloc_copy_ind_table(dev, vq,
-						vq->desc[idx].addr,
-						vq->desc[idx].len);
-				if (unlikely(!idesc))
-					return -1;
-
-				desc_ring = idesc;
-			}
-
-			desc_id = 0;
-		}
-
-		/* check if the buf addr is within the guest memory */
-		do {
-			desc = desc_ring[desc_id];
-			perm = desc.flags & VRING_DESC_F_WRITE ?
-				VHOST_ACCESS_WO : VHOST_ACCESS_RO;
-			if (invalid_desc_check(dev, vq, desc.addr, desc.len,
-						perm)) {
-				if (unlikely(idesc))
-					free_ind_table(idesc);
-				return -1;
-			}
-			desc_id = desc.next;
-		} while (desc.flags & VRING_DESC_F_NEXT);
-
-		if (unlikely(idesc)) {
-			free_ind_table(idesc);
-			idesc = NULL;
-		}
-
-		idx_m++;
-	}
-
-	rte_smp_wmb();
-	s_vring->avail->idx = idx;
-
-	if (dev->features & (1ULL << VIRTIO_RING_F_EVENT_IDX))
-		vhost_avail_event(vq) = idx;
-
-	return ret;
-}
-
 int __rte_experimental
 rte_vdpa_relay_vring_used(int vid, uint16_t qid, void *vring_m)
 {
@@ -245,6 +134,7 @@ rte_vdpa_relay_vring_used(int vid, uint16_t qid, void *vring_m)
 	struct vring_desc *idesc = NULL;
 	struct vring *s_vring;
 	uint64_t dlen;
+	uint32_t nr_descs;
 	int ret;
 
 	if (!dev || !vring_m)
@@ -269,9 +159,17 @@ rte_vdpa_relay_vring_used(int vid, uint16_t qid, void *vring_m)
 
 		desc_id = vq->used->ring[idx & (vq->size - 1)].id;
 		desc_ring = vq->desc;
+		nr_descs = vq->size;
+
+		if (unlikely(desc_id >= vq->size))
+			return -1;
 
 		if (vq->desc[desc_id].flags & VRING_DESC_F_INDIRECT) {
 			dlen = vq->desc[desc_id].len;
+			nr_descs = dlen / sizeof(struct vring_desc);
+			if (unlikely(nr_descs > vq->size))
+				return -1;
+
 			desc_ring = (struct vring_desc *)(uintptr_t)
 				vhost_iova_to_vva(dev, vq,
 						vq->desc[desc_id].addr, &dlen,
@@ -279,10 +177,10 @@ rte_vdpa_relay_vring_used(int vid, uint16_t qid, void *vring_m)
 			if (unlikely(!desc_ring))
 				return -1;
 
-			if (unlikely(dlen < vq->desc[idx].len)) {
+			if (unlikely(dlen < vq->desc[desc_id].len)) {
 				idesc = alloc_copy_ind_table(dev, vq,
-						vq->desc[idx].addr,
-						vq->desc[idx].len);
+						vq->desc[desc_id].addr,
+						vq->desc[desc_id].len);
 				if (unlikely(!idesc))
 					return -1;
 
@@ -294,6 +192,10 @@ rte_vdpa_relay_vring_used(int vid, uint16_t qid, void *vring_m)
 
 		/* dirty page logging for DMA writeable buffer */
 		do {
+			if (unlikely(desc_id >= vq->size))
+				goto fail;
+			if (unlikely(nr_descs-- == 0))
+				goto fail;
 			desc = desc_ring[desc_id];
 			if (desc.flags & VRING_DESC_F_WRITE)
 				vhost_log_write(dev, desc.addr, desc.len);
@@ -315,4 +217,9 @@ rte_vdpa_relay_vring_used(int vid, uint16_t qid, void *vring_m)
 		vring_used_event(s_vring) = idx_m;
 
 	return ret;
+
+fail:
+	if (unlikely(idesc))
+		free_ind_table(idesc);
+	return -1;
 }