[PATCH 00/12] net/xsc: Resolve issues from PVS and Coverity Scan

[PATCH 00/12] net/xsc: Resolve issues from PVS and Coverity Scan

[Renyong Wan]

This patch series resolves several issues reported by PVS and Coverity Scan,
which were earlier forwarded to us by Stephen Hemminger.

---
Renyong Wan (12):
  net/xsc: avoid integer overflow
  net/xsc: remove useless call
  net/xsc: address incorrect format warnings
  net/xsc: remove always-true if expressions
  net/xsc: avoid variable is assigned but not used
  net/xsc: check possible null pointer dereference
  net/xsc: avoid potential null pointer before used
  net/xsc: remove always-true part of if expression
  net/xsc: avoid assign the same value to a variable
  net/xsc: avoid initialize by same function
  net/xsc: optimize memcmp returns not 0 check
  net/xsc: avoid pointer cast to unrelated class

 drivers/net/xsc/xsc_dev.c       |  2 +-
 drivers/net/xsc/xsc_ethdev.c    | 35 ++++++++----
 drivers/net/xsc/xsc_np.c        | 17 +++---
 drivers/net/xsc/xsc_rx.c        | 31 ++++++-----
 drivers/net/xsc/xsc_tx.c        |  7 +--
 drivers/net/xsc/xsc_vfio.c      | 97 ++++++++++++++++++++-------------
 drivers/net/xsc/xsc_vfio_mbox.c |  2 +-
 7 files changed, 111 insertions(+), 80 deletions(-)

-- 
2.25.1

[PATCH 01/12] net/xsc: avoid integer overflow

[Renyong Wan]

Address the integer overflow issue reported by Coverity Scan.

Coverity issue: 456589

Signed-off-by: Renyong Wan <wanry@yunsilicon.com>
---
 drivers/net/xsc/xsc_tx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/xsc/xsc_tx.c b/drivers/net/xsc/xsc_tx.c
index 406fa95381..1d31e84d69 100644
--- a/drivers/net/xsc/xsc_tx.c
+++ b/drivers/net/xsc/xsc_tx.c
@@ -50,7 +50,7 @@ xsc_txq_obj_new(struct xsc_dev *xdev, struct xsc_txq_data *txq_data,
 	txq_data->cq_db = cq_info.cq_db;
 	txq_data->cqn = cq_info.cqn;
 	txq_data->cqes = cq_info.cqes;
-	txq_data->cqe_m = txq_data->cqe_s - 1;
+	txq_data->cqe_m = (uint16_t)(1 << cq_info.cqe_n) - 1;
 
 	PMD_DRV_LOG(INFO, "Create tx cq, cqe_s:%d, cqe_n:%d, cq_db=%p, cqn:%d",
 		    txq_data->cqe_s, txq_data->cqe_n,
-- 
2.25.1

[PATCH 02/12] net/xsc: remove useless call

[Renyong Wan]

Address incorrect expression (USELESS_CALL) reported by Coverity Scan.

Coverity issue: 456590

Signed-off-by: Renyong Wan <wanry@yunsilicon.com>
---
 drivers/net/xsc/xsc_np.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/net/xsc/xsc_np.c b/drivers/net/xsc/xsc_np.c
index d4eb833bf6..f032a0dbc2 100644
--- a/drivers/net/xsc/xsc_np.c
+++ b/drivers/net/xsc/xsc_np.c
@@ -384,7 +384,6 @@ xsc_dev_create_vfos_baselp(struct xsc_dev *xdev)
 void
 xsc_dev_pct_uninit(void)
 {
-	rte_bitmap_free(xsc_pct_mgr.bmp_pct);
 	rte_free(xsc_pct_mgr.bmp_mem);
 }
 
-- 
2.25.1

[PATCH 03/12] net/xsc: address incorrect format warnings

[Renyong Wan]

These warnings reported by PVS studio, described as:
https://pvs-studio.com/en/docs/warnings/v576/

Signed-off-by: Rong Qian <qianr@yunsilicon.com>
Signed-off-by: Renyong Wan <wanry@yunsilicon.com>
---
 drivers/net/xsc/xsc_dev.c       | 2 +-
 drivers/net/xsc/xsc_rx.c        | 4 ++--
 drivers/net/xsc/xsc_tx.c        | 4 ++--
 drivers/net/xsc/xsc_vfio.c      | 4 ++--
 drivers/net/xsc/xsc_vfio_mbox.c | 2 +-
 5 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/drivers/net/xsc/xsc_dev.c b/drivers/net/xsc/xsc_dev.c
index c836f2f35a..1e3dd493f9 100644
--- a/drivers/net/xsc/xsc_dev.c
+++ b/drivers/net/xsc/xsc_dev.c
@@ -289,7 +289,7 @@ xsc_dev_repr_ports_probe(struct xsc_dev *xdev, int nb_repr_ports, int max_eth_po
 
 	xdev->num_repr_ports = nb_repr_ports + XSC_PHY_PORT_NUM;
 	if (xdev->num_repr_ports > max_eth_ports) {
-		PMD_DRV_LOG(ERR, "Repr ports num %u, should be less than max %u",
+		PMD_DRV_LOG(ERR, "Repr ports num %d, should be less than max %d",
 			    xdev->num_repr_ports, max_eth_ports);
 		return -EINVAL;
 	}
diff --git a/drivers/net/xsc/xsc_rx.c b/drivers/net/xsc/xsc_rx.c
index 58a9cc2f26..3230710656 100644
--- a/drivers/net/xsc/xsc_rx.c
+++ b/drivers/net/xsc/xsc_rx.c
@@ -358,7 +358,7 @@ xsc_rss_qp_create(struct xsc_ethdev_priv *priv, int port_id)
 		xsc_rxq_initialize(xdev, rxq_data);
 		rxq_data->cq_ci = 0;
 		priv->dev_data->rx_queue_state[i] = RTE_ETH_QUEUE_STATE_STARTED;
-		PMD_DRV_LOG(INFO, "Port %u create rx qp, wqe_s:%d, wqe_n:%d, qp_db=%p, qpn:%d",
+		PMD_DRV_LOG(INFO, "Port %d create rx qp, wqe_s:%d, wqe_n:%d, qp_db=%p, qpn:%u",
 			    port_id,
 			    rxq_data->wqe_s, rxq_data->wqe_n,
 			    rxq_data->rq_db, rxq_data->qpn);
@@ -407,7 +407,7 @@ xsc_rxq_rss_obj_new(struct xsc_ethdev_priv *priv, uint16_t port_id)
 		rxq_data->cq_db = cq_info.cq_db;
 		rxq_data->cqn = cq_info.cqn;
 
-		PMD_DRV_LOG(INFO, "Port %u create rx cq, cqe_s:%d, cqe_n:%d, cq_db=%p, cqn:%d",
+		PMD_DRV_LOG(INFO, "Port %u create rx cq, cqe_s:%d, cqe_n:%d, cq_db=%p, cqn:%u",
 			    port_id,
 			    rxq_data->cqe_s, rxq_data->cqe_n,
 			    rxq_data->cq_db, rxq_data->cqn);
diff --git a/drivers/net/xsc/xsc_tx.c b/drivers/net/xsc/xsc_tx.c
index 1d31e84d69..0d6a9981d0 100644
--- a/drivers/net/xsc/xsc_tx.c
+++ b/drivers/net/xsc/xsc_tx.c
@@ -52,7 +52,7 @@ xsc_txq_obj_new(struct xsc_dev *xdev, struct xsc_txq_data *txq_data,
 	txq_data->cqes = cq_info.cqes;
 	txq_data->cqe_m = (uint16_t)(1 << cq_info.cqe_n) - 1;
 
-	PMD_DRV_LOG(INFO, "Create tx cq, cqe_s:%d, cqe_n:%d, cq_db=%p, cqn:%d",
+	PMD_DRV_LOG(INFO, "Create tx cq, cqe_s:%d, cqe_n:%d, cq_db=%p, cqn:%u",
 		    txq_data->cqe_s, txq_data->cqe_n,
 		    txq_data->cq_db, txq_data->cqn);
 
@@ -83,7 +83,7 @@ xsc_txq_obj_new(struct xsc_dev *xdev, struct xsc_txq_data *txq_data,
 	txq_data->wqe_pi = 0;
 	txq_data->wqe_comp = 0;
 
-	PMD_DRV_LOG(INFO, "Create tx qp, wqe_s:%d, wqe_n:%d, qp_db=%p, qpn:%d",
+	PMD_DRV_LOG(INFO, "Create tx qp, wqe_s:%d, wqe_n:%d, qp_db=%p, qpn:%u",
 		    txq_data->wqe_s, txq_data->wqe_n,
 		    txq_data->qp_db, txq_data->qpn);
 	return 0;
diff --git a/drivers/net/xsc/xsc_vfio.c b/drivers/net/xsc/xsc_vfio.c
index e8fefb9e94..6c679449af 100644
--- a/drivers/net/xsc/xsc_vfio.c
+++ b/drivers/net/xsc/xsc_vfio.c
@@ -337,7 +337,7 @@ xsc_vfio_modify_qp_status(struct xsc_dev *xdev, uint32_t qpn, int num, int opcod
 
 		ret = xsc_vfio_mbox_exec(xdev, in, in_len, out, out_len);
 		if (ret != 0 || out->hdr.status != 0) {
-			PMD_DRV_LOG(ERR, "Modify qp status failed, qpn=%d, err=%d, out.status=%u",
+			PMD_DRV_LOG(ERR, "Modify qp status failed, qpn=%u, err=%d, out.status=%u",
 				    qpn + i, ret, out->hdr.status);
 			rte_errno = ENOEXEC;
 			ret = -rte_errno;
@@ -483,7 +483,7 @@ xsc_vfio_rx_cq_create(struct xsc_dev *xdev, struct xsc_rx_cq_params *cq_params,
 	cq_info->cqn = rte_be_to_cpu_32(out->cqn);
 	cq->cqn = cq_info->cqn;
 	cq->xdev = xdev;
-	PMD_DRV_LOG(INFO, "Port id=%d, Rx cqe_n:%d, cqn:%d",
+	PMD_DRV_LOG(INFO, "Port id=%d, Rx cqe_n:%d, cqn:%u",
 		    port_id, cq_info->cqe_n, cq_info->cqn);
 
 	free(in);
diff --git a/drivers/net/xsc/xsc_vfio_mbox.c b/drivers/net/xsc/xsc_vfio_mbox.c
index 454fe64645..c465679527 100644
--- a/drivers/net/xsc/xsc_vfio_mbox.c
+++ b/drivers/net/xsc/xsc_vfio_mbox.c
@@ -515,7 +515,7 @@ xsc_cmdq_req_status_restore(struct xsc_dev *xdev, struct xsc_cmd_queue *cmdq)
 	if (req_pid >= (uint32_t)(1 << cmdq->depth_n) ||
 	    req_cid >= (uint32_t)(1 << cmdq->depth_n)) {
 		PMD_DRV_LOG(ERR, "Request pid %u and cid %u must be less than %u",
-			    req_pid, req_cid, 1 << cmdq->depth_n);
+			    req_pid, req_cid, (uint32_t)(1 << cmdq->depth_n));
 		return -1;
 	}
 
-- 
2.25.1

[PATCH 04/12] net/xsc: remove always-true if expressions

[Renyong Wan]

This issue was reported by PVS studio, described as:
https://pvs-studio.com/en/docs/warnings/v547/

Signed-off-by: Renyong Wan <wanry@yunsilicon.com>
---
 drivers/net/xsc/xsc_ethdev.c | 13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

diff --git a/drivers/net/xsc/xsc_ethdev.c b/drivers/net/xsc/xsc_ethdev.c
index b9675a5218..0729d43884 100644
--- a/drivers/net/xsc/xsc_ethdev.c
+++ b/drivers/net/xsc/xsc_ethdev.c
@@ -721,16 +721,13 @@ xsc_ethdev_init_one_representor(struct rte_eth_dev *eth_dev, void *init_params)
 		config->tso = 0;
 	} else {
 		config->tso = 1;
-		if (config->tso)
-			config->tso_max_payload_sz = 1500;
+		config->tso_max_payload_sz = 1500;
 	}
 
-	priv->is_representor = (priv->eth_type == RTE_ETH_REPRESENTOR_NONE) ? 0 : 1;
-	if (priv->is_representor) {
-		eth_dev->data->dev_flags |= RTE_ETH_DEV_REPRESENTOR;
-		eth_dev->data->representor_id = priv->representor_id;
-		eth_dev->data->backer_port_id = eth_dev->data->port_id;
-	}
+	priv->is_representor = 1;
+	eth_dev->data->dev_flags |= RTE_ETH_DEV_REPRESENTOR;
+	eth_dev->data->representor_id = priv->representor_id;
+	eth_dev->data->backer_port_id = eth_dev->data->port_id;
 
 	eth_dev->dev_ops = &xsc_eth_dev_ops;
 	eth_dev->rx_pkt_burst = rte_eth_pkt_burst_dummy;
-- 
2.25.1

[PATCH 05/12] net/xsc: avoid variable is assigned but not used

[Renyong Wan]

This issue was reported by PVS studio, described as:
https://pvs-studio.com/en/docs/warnings/v1001/

Signed-off-by: Rong Qian <qianr@yunsilicon.com>
Signed-off-by: Renyong Wan <wanry@yunsilicon.com>
---
 drivers/net/xsc/xsc_ethdev.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/xsc/xsc_ethdev.c b/drivers/net/xsc/xsc_ethdev.c
index 0729d43884..d04fe78d3f 100644
--- a/drivers/net/xsc/xsc_ethdev.c
+++ b/drivers/net/xsc/xsc_ethdev.c
@@ -314,6 +314,11 @@ xsc_ethdev_start(struct rte_eth_dev *dev)
 	dev->tx_pkt_burst = xsc_tx_burst;
 
 	ret = xsc_ethdev_enable(dev);
+	if (ret) {
+		PMD_DRV_LOG(ERR, "Failed to enable port: %u",
+			    dev->data->port_id);
+		goto error;
+	}
 
 	return 0;
 
-- 
2.25.1

[PATCH 06/12] net/xsc: check possible null pointer dereference

[Renyong Wan]

This issue was reported by PVS studio, described as:
https://pvs-studio.com/en/docs/warnings/v522/

Signed-off-by: Rong Qian <qianr@yunsilicon.com>
Signed-off-by: Renyong Wan <wanry@yunsilicon.com>
---
 drivers/net/xsc/xsc_ethdev.c | 15 +++++++++++++--
 drivers/net/xsc/xsc_rx.c     |  5 +++++
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/drivers/net/xsc/xsc_ethdev.c b/drivers/net/xsc/xsc_ethdev.c
index d04fe78d3f..44d861e484 100644
--- a/drivers/net/xsc/xsc_ethdev.c
+++ b/drivers/net/xsc/xsc_ethdev.c
@@ -137,8 +137,8 @@ xsc_ethdev_enable(struct rte_eth_dev *dev)
 	int pcie_logic_port = 0;
 	int qp_set_id;
 	int repr_id;
-	struct xsc_rxq_data *rxq = xsc_rxq_get(priv, 0);
-	uint16_t rx_qpn = (uint16_t)rxq->qpn;
+	struct xsc_rxq_data *rxq;
+	uint16_t rx_qpn;
 	int i, vld;
 	struct xsc_txq_data *txq;
 	struct xsc_repr_port *repr;
@@ -147,6 +147,11 @@ xsc_ethdev_enable(struct rte_eth_dev *dev)
 	if (priv->funcid_type != XSC_PHYPORT_MAC_FUNCID)
 		return -ENODEV;
 
+	rxq = xsc_rxq_get(priv, 0);
+	if (rxq == NULL)
+		return -EINVAL;
+
+	rx_qpn = (uint16_t)rxq->qpn;
 	hwinfo = &priv->xdev->hwinfo;
 	repr_id = priv->representor_id;
 	repr = &priv->xdev->repr_ports[repr_id];
@@ -162,6 +167,8 @@ xsc_ethdev_enable(struct rte_eth_dev *dev)
 
 	for (i = 0; i < priv->num_sq; i++) {
 		txq = xsc_txq_get(priv, i);
+		if (txq == NULL)
+			return -EINVAL;
 		xsc_dev_modify_qp_status(priv->xdev, txq->qpn, 1, XSC_CMD_OP_RTR2RTS_QP);
 		xsc_dev_modify_qp_qostree(priv->xdev, txq->qpn);
 		xsc_dev_set_qpsetid(priv->xdev, txq->qpn, qp_set_id);
@@ -229,6 +236,8 @@ xsc_txq_start(struct xsc_ethdev_priv *priv)
 
 	for (i = 0; i != priv->num_sq; ++i) {
 		txq_data = xsc_txq_get(priv, i);
+		if (txq_data == NULL)
+			goto error;
 		xsc_txq_elts_alloc(txq_data);
 		ret = xsc_txq_obj_new(priv->xdev, txq_data, offloads, i);
 		if (ret < 0)
@@ -270,6 +279,8 @@ xsc_rxq_start(struct xsc_ethdev_priv *priv)
 
 	for (i = 0; i != priv->num_rq; ++i) {
 		rxq_data = xsc_rxq_get(priv, i);
+		if (rxq_data == NULL)
+			goto error;
 		if (dev->data->rx_queue_state[i] != RTE_ETH_QUEUE_STATE_STARTED) {
 			ret = xsc_rxq_elts_alloc(rxq_data);
 			if (ret != 0)
diff --git a/drivers/net/xsc/xsc_rx.c b/drivers/net/xsc/xsc_rx.c
index 3230710656..140d7728d6 100644
--- a/drivers/net/xsc/xsc_rx.c
+++ b/drivers/net/xsc/xsc_rx.c
@@ -280,6 +280,9 @@ xsc_rss_qp_create(struct xsc_ethdev_priv *priv, int port_id)
 	char name[RTE_ETH_NAME_MAX_LEN] = { 0 };
 
 	rxq_data = xsc_rxq_get(priv, 0);
+	if (rxq_data == NULL)
+		return -EINVAL;
+
 	log_ele = rte_log2_u32(sizeof(struct xsc_wqe_data_seg));
 	wqe_n = rxq_data->wqe_s;
 	log_rq_sz = rte_log2_u32(wqe_n * hwinfo->recv_seg_num);
@@ -385,6 +388,8 @@ xsc_rxq_rss_obj_new(struct xsc_ethdev_priv *priv, uint16_t port_id)
 	/* Create CQ */
 	for (i = 0; i < priv->num_rq; ++i) {
 		rxq_data = xsc_rxq_get(priv, i);
+		if (rxq_data == NULL)
+			return -EINVAL;
 
 		memset(&cq_params, 0, sizeof(cq_params));
 		memset(&cq_info, 0, sizeof(cq_info));
-- 
2.25.1

[PATCH 07/12] net/xsc: avoid potential null pointer before used

[Renyong Wan]

This issue reported by PVS studio, described as:
https://pvs-studio.com/en/docs/warnings/v595/

Signed-off-by: Renyong Wan <wanry@yunsilicon.com>
---
 drivers/net/xsc/xsc_np.c   | 2 +-
 drivers/net/xsc/xsc_rx.c   | 2 +-
 drivers/net/xsc/xsc_vfio.c | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/xsc/xsc_np.c b/drivers/net/xsc/xsc_np.c
index f032a0dbc2..eff7497255 100644
--- a/drivers/net/xsc/xsc_np.c
+++ b/drivers/net/xsc/xsc_np.c
@@ -172,13 +172,13 @@ xsc_dev_np_exec(struct xsc_dev *xdev, void *cmd, int len, int table, int opmod)
 	out_len = sizeof(struct xsc_np_mbox_out) + data_len;
 	cmd_len = RTE_MAX(in_len, out_len);
 	in = malloc(cmd_len);
-	memset(in, 0, cmd_len);
 	if (in == NULL) {
 		rte_errno = ENOMEM;
 		PMD_DRV_LOG(ERR, "Failed to alloc np cmd memory");
 		return -rte_errno;
 	}
 
+	memset(in, 0, cmd_len);
 	in->hdr.opcode = rte_cpu_to_be_16(XSC_CMD_OP_EXEC_NP);
 	in->len = rte_cpu_to_be_16(data_len);
 
diff --git a/drivers/net/xsc/xsc_rx.c b/drivers/net/xsc/xsc_rx.c
index 140d7728d6..dfb71ed087 100644
--- a/drivers/net/xsc/xsc_rx.c
+++ b/drivers/net/xsc/xsc_rx.c
@@ -296,13 +296,13 @@ xsc_rss_qp_create(struct xsc_ethdev_priv *priv, int port_id)
 	out_len = sizeof(struct xsc_cmd_create_multiqp_mbox_out) + entry_total_len;
 	cmd_len = RTE_MAX(in_len, out_len);
 	in = malloc(cmd_len);
-	memset(in, 0, cmd_len);
 	if (in == NULL) {
 		rte_errno = ENOMEM;
 		PMD_DRV_LOG(ERR, "Alloc rss qp create cmd memory failed");
 		goto error;
 	}
 
+	memset(in, 0, cmd_len);
 	in->qp_num = rte_cpu_to_be_16((uint16_t)priv->num_rq);
 	in->qp_type = XSC_QUEUE_TYPE_RAW;
 	in->req_len = rte_cpu_to_be_32(cmd_len);
diff --git a/drivers/net/xsc/xsc_vfio.c b/drivers/net/xsc/xsc_vfio.c
index 6c679449af..2cd796ba26 100644
--- a/drivers/net/xsc/xsc_vfio.c
+++ b/drivers/net/xsc/xsc_vfio.c
@@ -431,13 +431,13 @@ xsc_vfio_rx_cq_create(struct xsc_dev *xdev, struct xsc_rx_cq_params *cq_params,
 	}
 
 	in = malloc(cmd_len);
-	memset(in, 0, cmd_len);
 	if (in == NULL) {
 		rte_errno = ENOMEM;
 		PMD_DRV_LOG(ERR, "Failed to alloc rx cq exec cmd memory");
 		goto error;
 	}
 
+	memset(in, 0, cmd_len);
 	in->hdr.opcode = rte_cpu_to_be_16(XSC_CMD_OP_CREATE_CQ);
 	in->ctx.eqn = 0;
 	in->ctx.pa_num = rte_cpu_to_be_16(pa_num);
-- 
2.25.1

[PATCH 08/12] net/xsc: remove always-true part of if expression

[Renyong Wan]

This issue was reported by PVS studio, described as:
https://pvs-studio.com/en/docs/warnings/v560/

Signed-off-by: Rong Qian <qianr@yunsilicon.com>
Signed-off-by: Renyong Wan <wanry@yunsilicon.com>
---
 drivers/net/xsc/xsc_rx.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/net/xsc/xsc_rx.c b/drivers/net/xsc/xsc_rx.c
index dfb71ed087..c031e56a94 100644
--- a/drivers/net/xsc/xsc_rx.c
+++ b/drivers/net/xsc/xsc_rx.c
@@ -42,8 +42,6 @@ xsc_rx_poll_len(struct xsc_rxq_data *rxq, volatile struct xsc_cqe *cqe)
 		if (unlikely(ret != XSC_CQE_OWNER_SW)) {
 			if (unlikely(ret == XSC_CQE_OWNER_ERR)) {
 				++rxq->stats.rx_errors;
-				if (ret == XSC_CQE_OWNER_HW || ret == -1)
-					return 0;
 			} else {
 				return 0;
 			}
-- 
2.25.1

[PATCH 09/12] net/xsc: avoid assign the same value to a variable

[Renyong Wan]

This issue was reported by PVS studio, described as:
https://pvs-studio.com/en/docs/warnings/v1048/

Signed-off-by: Rong Qian <qianr@yunsilicon.com>
Signed-off-by: Renyong Wan <wanry@yunsilicon.com>
---
 drivers/net/xsc/xsc_np.c | 4 ----
 drivers/net/xsc/xsc_tx.c | 1 -
 2 files changed, 5 deletions(-)

diff --git a/drivers/net/xsc/xsc_np.c b/drivers/net/xsc/xsc_np.c
index eff7497255..7ff39f83c9 100644
--- a/drivers/net/xsc/xsc_np.c
+++ b/drivers/net/xsc/xsc_np.c
@@ -137,10 +137,6 @@ xsc_rss_hash_template_get(struct rte_eth_rss_conf *rss_conf)
 		rss_hf &= ~XSC_RSS_HASH_BIT_IPV6_SPORT;
 	}
 
-	if ((rss_conf->rss_hf & RTE_ETH_RSS_LEVEL_PMD_DEFAULT) ||
-	    (rss_conf->rss_hf & RTE_ETH_RSS_LEVEL_OUTERMOST))
-		outer = 1;
-
 	if (rss_conf->rss_hf & RTE_ETH_RSS_LEVEL_INNERMOST)
 		outer = 0;
 
diff --git a/drivers/net/xsc/xsc_tx.c b/drivers/net/xsc/xsc_tx.c
index 0d6a9981d0..d1a0f3284b 100644
--- a/drivers/net/xsc/xsc_tx.c
+++ b/drivers/net/xsc/xsc_tx.c
@@ -215,7 +215,6 @@ xsc_tx_wqe_ctrl_seg_init(struct xsc_txq_data *__rte_restrict txq,
 		cs->csum_en = 0;
 
 	if (txq->tso_en == 1 && (mbuf->ol_flags & RTE_MBUF_F_TX_TCP_SEG)) {
-		cs->has_pph = 0;
 		cs->so_type = 1;
 		cs->so_hdr_len = mbuf->l2_len + mbuf->l3_len + mbuf->l4_len;
 		cs->so_data_size = rte_cpu_to_le_16(mbuf->tso_segsz);
-- 
2.25.1

[PATCH 10/12] net/xsc: avoid initialize by same function

[Renyong Wan]

This issue was reported by PVS studio, described as:
https://pvs-studio.com/en/docs/warnings/v656

Signed-off-by: Renyong Wan <wanry@yunsilicon.com>
---
 drivers/net/xsc/xsc_rx.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/drivers/net/xsc/xsc_rx.c b/drivers/net/xsc/xsc_rx.c
index c031e56a94..ca832dab23 100644
--- a/drivers/net/xsc/xsc_rx.c
+++ b/drivers/net/xsc/xsc_rx.c
@@ -445,10 +445,8 @@ xsc_rxq_elts_alloc(struct xsc_rxq_data *rxq_data)
 
 		mbuf->port = rxq_data->port_id;
 		mbuf->nb_segs = 1;
-		rte_pktmbuf_data_len(mbuf) = rte_pktmbuf_data_room_size(rxq_data->mp)
-						- mbuf->data_off;
-		rte_pktmbuf_pkt_len(mbuf) = rte_pktmbuf_data_room_size(rxq_data->mp)
-						- mbuf->data_off;
+		rte_pktmbuf_data_len(mbuf) = mbuf->buf_len - mbuf->data_off;
+		rte_pktmbuf_pkt_len(mbuf) = rte_pktmbuf_data_len(mbuf);
 		(*rxq_data->elts)[i] = mbuf;
 	}
 
-- 
2.25.1

[PATCH 11/12] net/xsc: optimize memcmp returns not 0 check

[Renyong Wan]

This issue was reported by PVS studio, described as:
https://pvs-studio.com/en/docs/warnings/v526/

Signed-off-by: Renyong Wan <wanry@yunsilicon.com>
---
 drivers/net/xsc/xsc_ethdev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/xsc/xsc_ethdev.c b/drivers/net/xsc/xsc_ethdev.c
index 44d861e484..28af9c5d15 100644
--- a/drivers/net/xsc/xsc_ethdev.c
+++ b/drivers/net/xsc/xsc_ethdev.c
@@ -663,7 +663,7 @@ xsc_ethdev_mac_addr_add(struct rte_eth_dev *dev, struct rte_ether_addr *mac, uin
 	for (i = 0; i != XSC_MAX_MAC_ADDRESSES; ++i) {
 		if (i == (int)index)
 			continue;
-		if (memcmp(&dev->data->mac_addrs[i], mac, sizeof(*mac)))
+		if (memcmp(&dev->data->mac_addrs[i], mac, sizeof(*mac)) != 0)
 			continue;
 		/* Address already configured elsewhere, return with error */
 		rte_errno = EADDRINUSE;
-- 
2.25.1

[PATCH 12/12] net/xsc: avoid pointer cast to unrelated class

[Renyong Wan]

This issue was reported by PVS studio, described as:
https://pvs-studio.com/en/docs/warnings/v1027/

Signed-off-by: Renyong Wan <wanry@yunsilicon.com>
---
 drivers/net/xsc/xsc_np.c   | 10 +++--
 drivers/net/xsc/xsc_rx.c   | 12 ++---
 drivers/net/xsc/xsc_vfio.c | 91 +++++++++++++++++++++++---------------
 3 files changed, 68 insertions(+), 45 deletions(-)

diff --git a/drivers/net/xsc/xsc_np.c b/drivers/net/xsc/xsc_np.c
index 7ff39f83c9..f96797b7a4 100644
--- a/drivers/net/xsc/xsc_np.c
+++ b/drivers/net/xsc/xsc_np.c
@@ -162,18 +162,20 @@ xsc_dev_np_exec(struct xsc_dev *xdev, void *cmd, int len, int table, int opmod)
 	int data_len;
 	int cmd_len;
 	int ret;
+	void *cmd_buf;
 
 	data_len = sizeof(struct xsc_np_data_tl) + len;
 	in_len = sizeof(struct xsc_np_mbox_in) + data_len;
 	out_len = sizeof(struct xsc_np_mbox_out) + data_len;
 	cmd_len = RTE_MAX(in_len, out_len);
-	in = malloc(cmd_len);
-	if (in == NULL) {
+	cmd_buf = malloc(cmd_len);
+	if (cmd_buf == NULL) {
 		rte_errno = ENOMEM;
 		PMD_DRV_LOG(ERR, "Failed to alloc np cmd memory");
 		return -rte_errno;
 	}
 
+	in = cmd_buf;
 	memset(in, 0, cmd_len);
 	in->hdr.opcode = rte_cpu_to_be_16(XSC_CMD_OP_EXEC_NP);
 	in->len = rte_cpu_to_be_16(data_len);
@@ -185,10 +187,10 @@ xsc_dev_np_exec(struct xsc_dev *xdev, void *cmd, int len, int table, int opmod)
 	if (cmd && len)
 		memcpy(tl + 1, cmd, len);
 
-	out = (struct xsc_np_mbox_out *)in;
+	out = cmd_buf;
 	ret = xsc_dev_mailbox_exec(xdev, in, in_len, out, out_len);
 
-	free(in);
+	free(cmd_buf);
 	return ret;
 }
 
diff --git a/drivers/net/xsc/xsc_rx.c b/drivers/net/xsc/xsc_rx.c
index ca832dab23..a702b9592b 100644
--- a/drivers/net/xsc/xsc_rx.c
+++ b/drivers/net/xsc/xsc_rx.c
@@ -276,6 +276,7 @@ xsc_rss_qp_create(struct xsc_ethdev_priv *priv, int port_id)
 	struct xsc_dev *xdev = priv->xdev;
 	struct xsc_hwinfo *hwinfo = &xdev->hwinfo;
 	char name[RTE_ETH_NAME_MAX_LEN] = { 0 };
+	void *cmd_buf;
 
 	rxq_data = xsc_rxq_get(priv, 0);
 	if (rxq_data == NULL)
@@ -293,13 +294,14 @@ xsc_rss_qp_create(struct xsc_ethdev_priv *priv, int port_id)
 	in_len = sizeof(struct xsc_cmd_create_multiqp_mbox_in) + entry_total_len;
 	out_len = sizeof(struct xsc_cmd_create_multiqp_mbox_out) + entry_total_len;
 	cmd_len = RTE_MAX(in_len, out_len);
-	in = malloc(cmd_len);
-	if (in == NULL) {
+	cmd_buf = malloc(cmd_len);
+	if (cmd_buf == NULL) {
 		rte_errno = ENOMEM;
 		PMD_DRV_LOG(ERR, "Alloc rss qp create cmd memory failed");
 		goto error;
 	}
 
+	in = cmd_buf;
 	memset(in, 0, cmd_len);
 	in->qp_num = rte_cpu_to_be_16((uint16_t)priv->num_rq);
 	in->qp_type = XSC_QUEUE_TYPE_RAW;
@@ -333,7 +335,7 @@ xsc_rss_qp_create(struct xsc_ethdev_priv *priv, int port_id)
 	}
 
 	in->hdr.opcode = rte_cpu_to_be_16(XSC_CMD_OP_CREATE_MULTI_QP);
-	out = (struct xsc_cmd_create_multiqp_mbox_out *)in;
+	out = cmd_buf;
 	ret = xsc_dev_mailbox_exec(xdev, in, in_len, out, out_len);
 	if (ret != 0 || out->hdr.status != 0) {
 		PMD_DRV_LOG(ERR,
@@ -365,11 +367,11 @@ xsc_rss_qp_create(struct xsc_ethdev_priv *priv, int port_id)
 			    rxq_data->rq_db, rxq_data->qpn);
 	}
 
-	free(in);
+	free(cmd_buf);
 	return 0;
 
 error:
-	free(in);
+	free(cmd_buf);
 	return -rte_errno;
 }
 
diff --git a/drivers/net/xsc/xsc_vfio.c b/drivers/net/xsc/xsc_vfio.c
index 2cd796ba26..8330483523 100644
--- a/drivers/net/xsc/xsc_vfio.c
+++ b/drivers/net/xsc/xsc_vfio.c
@@ -70,22 +70,24 @@ xsc_vfio_hwinfo_init(struct xsc_dev *xdev)
 	struct xsc_cmd_query_hca_cap_mbox_in *in;
 	struct xsc_cmd_query_hca_cap_mbox_out *out;
 	struct xsc_cmd_hca_cap *hca_cap;
+	void *cmd_buf;
 
 	in_len = sizeof(struct xsc_cmd_query_hca_cap_mbox_in);
 	out_len = sizeof(struct xsc_cmd_query_hca_cap_mbox_out);
 	cmd_len = RTE_MAX(in_len, out_len);
 
-	in = malloc(cmd_len);
-	if (in == NULL) {
+	cmd_buf = malloc(cmd_len);
+	if (cmd_buf == NULL) {
 		PMD_DRV_LOG(ERR, "Failed to alloc dev hwinfo cmd memory");
 		rte_errno = ENOMEM;
 		return -rte_errno;
 	}
 
+	in = cmd_buf;
 	memset(in, 0, cmd_len);
 	in->hdr.opcode = rte_cpu_to_be_16(XSC_CMD_OP_QUERY_HCA_CAP);
 	in->hdr.ver = rte_cpu_to_be_16(XSC_CMD_QUERY_HCA_CAP_V1);
-	out = (struct xsc_cmd_query_hca_cap_mbox_out *)in;
+	out = cmd_buf;
 
 	ret = xsc_vfio_mbox_exec(xdev, in, in_len, out, out_len);
 	if (ret != 0 || out->hdr.status != 0) {
@@ -126,7 +128,7 @@ xsc_vfio_hwinfo_init(struct xsc_dev *xdev)
 	xsc_vfio_pcie_no_init(&xdev->hwinfo);
 
 exit:
-	free(in);
+	free(cmd_buf);
 	return ret;
 }
 
@@ -189,22 +191,24 @@ xsc_vfio_destroy_qp(void *qp)
 	struct xsc_cmd_destroy_qp_mbox_in *in;
 	struct xsc_cmd_destroy_qp_mbox_out *out;
 	struct xsc_vfio_qp *data = (struct xsc_vfio_qp *)qp;
+	void *cmd_buf;
 
 	in_len = sizeof(struct xsc_cmd_destroy_qp_mbox_in);
 	out_len = sizeof(struct xsc_cmd_destroy_qp_mbox_out);
 	cmd_len = RTE_MAX(in_len, out_len);
 
-	in = malloc(cmd_len);
-	if (in == NULL) {
+	cmd_buf = malloc(cmd_len);
+	if (cmd_buf == NULL) {
 		rte_errno = ENOMEM;
 		PMD_DRV_LOG(ERR, "Failed to alloc qp destroy cmd memory");
 		return -rte_errno;
 	}
-	memset(in, 0, cmd_len);
 
+	in = cmd_buf;
+	memset(in, 0, cmd_len);
 	in->hdr.opcode = rte_cpu_to_be_16(XSC_CMD_OP_DESTROY_QP);
 	in->qpn = rte_cpu_to_be_32(data->qpn);
-	out = (struct xsc_cmd_destroy_qp_mbox_out *)in;
+	out = cmd_buf;
 	ret = xsc_vfio_mbox_exec(data->xdev, in, in_len, out, out_len);
 	if (ret != 0 || out->hdr.status != 0) {
 		PMD_DRV_LOG(ERR, "Failed to destroy qp, type=%d, err=%d, out.status=%u",
@@ -218,7 +222,7 @@ xsc_vfio_destroy_qp(void *qp)
 	rte_free(qp);
 
 exit:
-	free(in);
+	free(cmd_buf);
 	return ret;
 }
 
@@ -230,22 +234,25 @@ xsc_vfio_destroy_cq(void *cq)
 	struct xsc_cmd_destroy_cq_mbox_in *in;
 	struct xsc_cmd_destroy_cq_mbox_out *out;
 	struct xsc_vfio_cq *data = (struct xsc_vfio_cq *)cq;
+	void *cmd_buf;
 
 	in_len = sizeof(struct xsc_cmd_destroy_cq_mbox_in);
 	out_len = sizeof(struct xsc_cmd_destroy_cq_mbox_out);
 	cmd_len = RTE_MAX(in_len, out_len);
 
-	in = malloc(cmd_len);
-	if (in == NULL) {
+	cmd_buf = malloc(cmd_len);
+	if (cmd_buf == NULL) {
 		rte_errno = ENOMEM;
 		PMD_DRV_LOG(ERR, "Failed to alloc cq destroy cmd memory");
 		return -rte_errno;
 	}
+
+	in = cmd_buf;
 	memset(in, 0, cmd_len);
 
 	in->hdr.opcode = rte_cpu_to_be_16(XSC_CMD_OP_DESTROY_CQ);
 	in->cqn = rte_cpu_to_be_32(data->cqn);
-	out = (struct xsc_cmd_destroy_cq_mbox_out *)in;
+	out = cmd_buf;
 	ret = xsc_vfio_mbox_exec(data->xdev, in, in_len, out, out_len);
 	if (ret != 0 || out->hdr.status != 0) {
 		PMD_DRV_LOG(ERR, "Failed to destroy cq, type=%d, err=%d, out.status=%u",
@@ -259,7 +266,7 @@ xsc_vfio_destroy_cq(void *cq)
 	rte_free(cq);
 
 exit:
-	free(in);
+	free(cmd_buf);
 	return ret;
 }
 
@@ -314,20 +321,22 @@ xsc_vfio_modify_qp_status(struct xsc_dev *xdev, uint32_t qpn, int num, int opcod
 	int in_len, out_len, cmd_len;
 	struct xsc_cmd_modify_qp_mbox_in *in;
 	struct xsc_cmd_modify_qp_mbox_out *out;
+	void *cmd_buf;
 
 	in_len = sizeof(struct xsc_cmd_modify_qp_mbox_in);
 	out_len = sizeof(struct xsc_cmd_modify_qp_mbox_out);
 	cmd_len = RTE_MAX(in_len, out_len);
 
-	in = malloc(cmd_len);
-	if (in == NULL) {
+	cmd_buf = malloc(cmd_len);
+	if (cmd_buf == NULL) {
 		PMD_DRV_LOG(ERR, "Failed to alloc cmdq qp modify status");
 		rte_errno = ENOMEM;
 		return -rte_errno;
 	}
 
+	in = cmd_buf;
 	memset(in, 0, cmd_len);
-	out = (struct xsc_cmd_modify_qp_mbox_out *)in;
+	out = cmd_buf;
 
 	for (i = 0; i < num; i++) {
 		in->hdr.opcode = rte_cpu_to_be_16(opcode);
@@ -346,7 +355,7 @@ xsc_vfio_modify_qp_status(struct xsc_dev *xdev, uint32_t qpn, int num, int opcod
 	}
 
 exit:
-	free(in);
+	free(cmd_buf);
 	return ret;
 }
 
@@ -357,18 +366,20 @@ xsc_vfio_modify_qp_qostree(struct xsc_dev *xdev, uint16_t qpn)
 	int in_len, out_len, cmd_len;
 	struct xsc_cmd_modify_raw_qp_mbox_in *in;
 	struct xsc_cmd_modify_raw_qp_mbox_out *out;
+	void *cmd_buf;
 
 	in_len = sizeof(struct xsc_cmd_modify_raw_qp_mbox_in);
 	out_len = sizeof(struct xsc_cmd_modify_raw_qp_mbox_out);
 	cmd_len = RTE_MAX(in_len, out_len);
 
-	in = malloc(cmd_len);
-	if (in == NULL) {
+	cmd_buf = malloc(cmd_len);
+	if (cmd_buf == NULL) {
 		PMD_DRV_LOG(ERR, "Failed to alloc cmdq qp modify qostree");
 		rte_errno = ENOMEM;
 		return -rte_errno;
 	}
 
+	in = cmd_buf;
 	memset(in, 0, cmd_len);
 	in->hdr.opcode = rte_cpu_to_be_16(XSC_CMD_OP_MODIFY_RAW_QP);
 	in->req.prio = 0;
@@ -377,7 +388,7 @@ xsc_vfio_modify_qp_qostree(struct xsc_dev *xdev, uint16_t qpn)
 	in->req.func_id = rte_cpu_to_be_16(xdev->hwinfo.func_id);
 	in->req.dma_direct = 0;
 	in->req.qpn = rte_cpu_to_be_16(qpn);
-	out = (struct xsc_cmd_modify_raw_qp_mbox_out *)in;
+	out = cmd_buf;
 
 	ret = xsc_vfio_mbox_exec(xdev, in, in_len, out, out_len);
 	if (ret != 0 || out->hdr.status != 0) {
@@ -389,7 +400,7 @@ xsc_vfio_modify_qp_qostree(struct xsc_dev *xdev, uint16_t qpn)
 	}
 
 exit:
-	free(in);
+	free(cmd_buf);
 	return ret;
 }
 
@@ -413,6 +424,7 @@ xsc_vfio_rx_cq_create(struct xsc_dev *xdev, struct xsc_rx_cq_params *cq_params,
 	struct xsc_cqe *cqes;
 	struct xsc_cmd_create_cq_mbox_in *in = NULL;
 	struct xsc_cmd_create_cq_mbox_out *out = NULL;
+	void *cmd_buf;
 
 	cqe_n = cq_params->wqe_s;
 	log_cq_sz = rte_log2_u32(cqe_n);
@@ -430,13 +442,14 @@ xsc_vfio_rx_cq_create(struct xsc_dev *xdev, struct xsc_rx_cq_params *cq_params,
 		return -rte_errno;
 	}
 
-	in = malloc(cmd_len);
-	if (in == NULL) {
+	cmd_buf = malloc(cmd_len);
+	if (cmd_buf == NULL) {
 		rte_errno = ENOMEM;
 		PMD_DRV_LOG(ERR, "Failed to alloc rx cq exec cmd memory");
 		goto error;
 	}
 
+	in = cmd_buf;
 	memset(in, 0, cmd_len);
 	in->hdr.opcode = rte_cpu_to_be_16(XSC_CMD_OP_CREATE_CQ);
 	in->ctx.eqn = 0;
@@ -460,7 +473,7 @@ xsc_vfio_rx_cq_create(struct xsc_dev *xdev, struct xsc_rx_cq_params *cq_params,
 	for (i = 0; i < pa_num; i++)
 		in->pas[i] = rte_cpu_to_be_64(cq_pas->iova + i * XSC_PAGE_SIZE);
 
-	out = (struct xsc_cmd_create_cq_mbox_out *)in;
+	out = cmd_buf;
 	ret = xsc_vfio_mbox_exec(xdev, in, in_len, out, out_len);
 	if (ret != 0 || out->hdr.status != 0) {
 		PMD_DRV_LOG(ERR,
@@ -486,11 +499,11 @@ xsc_vfio_rx_cq_create(struct xsc_dev *xdev, struct xsc_rx_cq_params *cq_params,
 	PMD_DRV_LOG(INFO, "Port id=%d, Rx cqe_n:%d, cqn:%u",
 		    port_id, cq_info->cqe_n, cq_info->cqn);
 
-	free(in);
+	free(cmd_buf);
 	return 0;
 
 error:
-	free(in);
+	free(cmd_buf);
 	rte_memzone_free(cq_pas);
 	rte_free(cq);
 	return -rte_errno;
@@ -513,6 +526,7 @@ xsc_vfio_tx_cq_create(struct xsc_dev *xdev, struct xsc_tx_cq_params *cq_params,
 	int cqe_s = 1 << cq_params->elts_n;
 	uint64_t iova;
 	int i;
+	void *cmd_buf = NULL;
 
 	cq = rte_zmalloc(NULL, sizeof(struct xsc_vfio_cq), 0);
 	if (cq == NULL) {
@@ -539,12 +553,14 @@ xsc_vfio_tx_cq_create(struct xsc_dev *xdev, struct xsc_tx_cq_params *cq_params,
 	in_len = (sizeof(struct xsc_cmd_create_cq_mbox_in) + (pa_num * sizeof(uint64_t)));
 	out_len = sizeof(struct xsc_cmd_create_cq_mbox_out);
 	cmd_len = RTE_MAX(in_len, out_len);
-	in = (struct xsc_cmd_create_cq_mbox_in *)malloc(cmd_len);
-	if (in == NULL) {
+	cmd_buf = malloc(cmd_len);
+	if (cmd_buf == NULL) {
 		rte_errno = ENOMEM;
 		PMD_DRV_LOG(ERR, "Failed to alloc tx cq exec cmd memory");
 		goto error;
 	}
+
+	in = cmd_buf;
 	memset(in, 0, cmd_len);
 
 	in->hdr.opcode = rte_cpu_to_be_16(XSC_CMD_OP_CREATE_CQ);
@@ -557,7 +573,7 @@ xsc_vfio_tx_cq_create(struct xsc_dev *xdev, struct xsc_tx_cq_params *cq_params,
 	for (i = 0; i < pa_num; i++)
 		in->pas[i] = rte_cpu_to_be_64(iova + i * XSC_PAGE_SIZE);
 
-	out = (struct xsc_cmd_create_cq_mbox_out *)in;
+	out = cmd_buf;
 	ret = xsc_vfio_mbox_exec(xdev, in, in_len, out, out_len);
 	if (ret != 0 || out->hdr.status != 0) {
 		PMD_DRV_LOG(ERR, "Failed to create tx cq, port id=%u, err=%d, out.status=%u",
@@ -583,11 +599,11 @@ xsc_vfio_tx_cq_create(struct xsc_dev *xdev, struct xsc_tx_cq_params *cq_params,
 		((volatile struct xsc_cqe *)(cqes + i))->owner = 1;
 	cq_info->cqes = cqes;
 
-	free(in);
+	free(cmd_buf);
 	return 0;
 
 error:
-	free(in);
+	free(cmd_buf);
 	rte_memzone_free(cq_pas);
 	rte_free(cq);
 	return -rte_errno;
@@ -613,6 +629,7 @@ xsc_vfio_tx_qp_create(struct xsc_dev *xdev, struct xsc_tx_qp_params *qp_params,
 	int i;
 	uint64_t iova;
 	char name[RTE_ETH_NAME_MAX_LEN] = {0};
+	void *cmd_buf = NULL;
 
 	qp = rte_zmalloc(NULL, sizeof(struct xsc_vfio_qp), 0);
 	if (qp == NULL) {
@@ -640,12 +657,14 @@ xsc_vfio_tx_qp_create(struct xsc_dev *xdev, struct xsc_tx_qp_params *qp_params,
 	in_len = (sizeof(struct xsc_cmd_create_qp_mbox_in) + (pa_num * sizeof(uint64_t)));
 	out_len = sizeof(struct xsc_cmd_create_qp_mbox_out);
 	cmd_len = RTE_MAX(in_len, out_len);
-	in = (struct xsc_cmd_create_qp_mbox_in *)malloc(cmd_len);
-	if (in == NULL) {
+	cmd_buf = malloc(cmd_len);
+	if (cmd_buf == NULL) {
 		rte_errno = ENOMEM;
 		PMD_DRV_LOG(ERR, "Failed to alloc tx qp exec cmd memory");
 		goto error;
 	}
+
+	in = cmd_buf;
 	memset(in, 0, cmd_len);
 
 	in->hdr.opcode = rte_cpu_to_be_16(XSC_CMD_OP_CREATE_QP);
@@ -663,7 +682,7 @@ xsc_vfio_tx_qp_create(struct xsc_dev *xdev, struct xsc_tx_qp_params *qp_params,
 	for (i = 0; i < pa_num; i++)
 		in->req.pas[i] = rte_cpu_to_be_64(iova + i * XSC_PAGE_SIZE);
 
-	out = (struct xsc_cmd_create_qp_mbox_out *)in;
+	out = cmd_buf;
 	ret = xsc_vfio_mbox_exec(xdev, in, in_len, out, out_len);
 	if (ret != 0 || out->hdr.status != 0) {
 		PMD_DRV_LOG(ERR, "Failed to create tx qp, port id=%u, err=%d, out.status=%u",
@@ -685,11 +704,11 @@ xsc_vfio_tx_qp_create(struct xsc_dev *xdev, struct xsc_tx_qp_params *qp_params,
 	else
 		qp_info->qp_db = (uint32_t *)((uint8_t *)xdev->bar_addr + XSC_PF_TX_DB_ADDR);
 
-	free(in);
+	free(cmd_buf);
 	return 0;
 
 error:
-	free(in);
+	free(cmd_buf);
 	rte_memzone_free(qp_pas);
 	rte_free(qp);
 	return -rte_errno;
-- 
2.25.1

Re: [PATCH 00/12] net/xsc: Resolve issues from PVS and Coverity Scan

[Stephen Hemminger]

On Sat, 22 Feb 2025 11:57:59 +0800
"Renyong Wan" <wanry@yunsilicon.com> wrote:

> This patch series resolves several issues reported by PVS and Coverity Scan,
> which were earlier forwarded to us by Stephen Hemminger.
> 
> ---
> Renyong Wan (12):
>   net/xsc: avoid integer overflow
>   net/xsc: remove useless call
>   net/xsc: address incorrect format warnings
>   net/xsc: remove always-true if expressions
>   net/xsc: avoid variable is assigned but not used
>   net/xsc: check possible null pointer dereference
>   net/xsc: avoid potential null pointer before used
>   net/xsc: remove always-true part of if expression
>   net/xsc: avoid assign the same value to a variable
>   net/xsc: avoid initialize by same function
>   net/xsc: optimize memcmp returns not 0 check
>   net/xsc: avoid pointer cast to unrelated class
> 
>  drivers/net/xsc/xsc_dev.c       |  2 +-
>  drivers/net/xsc/xsc_ethdev.c    | 35 ++++++++----
>  drivers/net/xsc/xsc_np.c        | 17 +++---
>  drivers/net/xsc/xsc_rx.c        | 31 ++++++-----
>  drivers/net/xsc/xsc_tx.c        |  7 +--
>  drivers/net/xsc/xsc_vfio.c      | 97 ++++++++++++++++++++-------------
>  drivers/net/xsc/xsc_vfio_mbox.c |  2 +-
>  7 files changed, 111 insertions(+), 80 deletions(-)
> 

Applied to next-net Great to see the Coverity issues fixed.
Ran PVS Studio on it, and there are three potential things that could be fixed later.

1. xsc_ethdev.c (838)
V1027	Pointer to an object of the 'rte_device' class is cast to unrelated 'rte_pci_device' class.

This is a generic issue in bus_pci_driver.h that can be suppressed there.

2. xsc_rx.c (351)
V522	There might be dereferencing of a potential null pointer 'rxq_data'.

Looking at the code, there are two loops over the rxq's the first one just
dereferences, and the second pass uses a helper function that could return NULL.
Why not just use do direct index in second one:

-- a/drivers/net/xsc/xsc_rx.c
+++ b/drivers/net/xsc/xsc_rx.c
@@ -347,7 +347,7 @@ xsc_rss_qp_create(struct xsc_ethdev_priv *priv, int port_id)
        rqn_base = rte_be_to_cpu_32(out->qpn_base) & 0xffffff;

        for (i = 0; i < priv->num_rq; i++) {
-               rxq_data = xsc_rxq_get(priv, i);
+               rxq_data = (*priv->rxqs)[i];
                rxq_data->wqes = rxq_data->rq_pas->addr;
                if (!xsc_dev_is_vf(xdev))
                        rxq_data->rq_db = (uint32_t *)((uint8_t *)xdev->bar_addr +


3. xsc_vfio_mbox.c (575)
V1048	The 'size' variable was assigned the same value.

This one is harmless, since both commands have same size, the tool
is just being annoying. Can suppress via comment

--- a/drivers/net/xsc/xsc_vfio_mbox.c
+++ b/drivers/net/xsc/xsc_vfio_mbox.c
@@ -572,7 +572,7 @@ xsc_vfio_mbox_init(struct xsc_dev *xdev)
        cmdq->req_lay = cmdq->req_mz->addr;

        snprintf(name, RTE_MEMZONE_NAMESIZE, "%s_cmd_cq", xdev->pci_dev->device.name);
-       size = (1 << XSC_CMDQ_DEPTH_LOG) * sizeof(struct xsc_cmdq_rsp_layout);
+       size = (1 << XSC_CMDQ_DEPTH_LOG) * sizeof(struct xsc_cmdq_rsp_layout); // -V1048
        cmdq->rsp_mz = rte_memzone_reserve_aligned(name,
                                                   size, SOCKET_ID_ANY,
                                                   RTE_MEMZONE_IOVA_CONTIG,