From 1d2695ef02771f8adecf6b173ad7bcd8ddbaec67 Mon Sep 17 00:00:00 2001 From: Julia Suvorova Date: Wed, 18 Mar 2020 14:48:49 +0100 Subject: [PATCH 1/4] hw/rdma/vmw/pvrdma_dev_ring: Replace strncpy with pstrcpy ring->name is defined as 'char name[MAX_RING_NAME_SZ]'. Replace untruncated strncpy with QEMU function. This case prevented QEMU from compiling with --enable-sanitizers. Signed-off-by: Julia Suvorova Message-Id: <20200318134849.237011-1-jusual@redhat.com> Reviewed-by: Yuval Shaia Reviewed-by: Stefan Hajnoczi Signed-off-by: Marcel Apfelbaum --- hw/rdma/vmw/pvrdma_dev_ring.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/rdma/vmw/pvrdma_dev_ring.c b/hw/rdma/vmw/pvrdma_dev_ring.c index d7bc7f5ccc..c2b3dd70a9 100644 --- a/hw/rdma/vmw/pvrdma_dev_ring.c +++ b/hw/rdma/vmw/pvrdma_dev_ring.c @@ -16,6 +16,7 @@ #include "qemu/osdep.h" #include "hw/pci/pci.h" #include "cpu.h" +#include "qemu/cutils.h" #include "trace.h" @@ -30,8 +31,7 @@ int pvrdma_ring_init(PvrdmaRing *ring, const char *name, PCIDevice *dev, int i; int rc = 0; - strncpy(ring->name, name, MAX_RING_NAME_SZ); - ring->name[MAX_RING_NAME_SZ - 1] = 0; + pstrcpy(ring->name, MAX_RING_NAME_SZ, name); ring->dev = dev; ring->ring_state = ring_state; ring->max_elems = max_elems; From f23601515b61ffe23398079cbfd6be0b9b99ec02 Mon Sep 17 00:00:00 2001 From: Yuval Shaia Date: Fri, 20 Mar 2020 16:34:28 +0200 Subject: [PATCH 2/4] hw/rdma: Cosmetic change - no need for two sge arrays The function build_host_sge_array uses two sge arrays, one for input and one for output. Since the size of the two arrays is the same, the function can write directly to the given source array (i.e. input/output argument). Signed-off-by: Yuval Shaia Reviewed-by: Marcel Apfelbaum Message-Id: <20200320143429.9490-2-yuval.shaia.ml@gmail.com> Signed-off-by: Marcel Apfelbaum --- hw/rdma/rdma_backend.c | 40 ++++++++++++++++------------------------ 1 file changed, 16 insertions(+), 24 deletions(-) diff --git a/hw/rdma/rdma_backend.c b/hw/rdma/rdma_backend.c index c346407cd3..b7ffbef9c0 100644 --- a/hw/rdma/rdma_backend.c +++ b/hw/rdma/rdma_backend.c @@ -378,30 +378,25 @@ static void ah_cache_init(void) } static int build_host_sge_array(RdmaDeviceResources *rdma_dev_res, - struct ibv_sge *dsge, struct ibv_sge *ssge, - uint8_t num_sge, uint64_t *total_length) + struct ibv_sge *sge, uint8_t num_sge, + uint64_t *total_length) { RdmaRmMR *mr; - int ssge_idx; + int idx; - for (ssge_idx = 0; ssge_idx < num_sge; ssge_idx++) { - mr = rdma_rm_get_mr(rdma_dev_res, ssge[ssge_idx].lkey); + for (idx = 0; idx < num_sge; idx++) { + mr = rdma_rm_get_mr(rdma_dev_res, sge[idx].lkey); if (unlikely(!mr)) { - rdma_error_report("Invalid lkey 0x%x", ssge[ssge_idx].lkey); - return VENDOR_ERR_INVLKEY | ssge[ssge_idx].lkey; + rdma_error_report("Invalid lkey 0x%x", sge[idx].lkey); + return VENDOR_ERR_INVLKEY | sge[idx].lkey; } #ifdef LEGACY_RDMA_REG_MR - dsge->addr = (uintptr_t)mr->virt + ssge[ssge_idx].addr - mr->start; -#else - dsge->addr = ssge[ssge_idx].addr; + sge[idx].addr = (uintptr_t)mr->virt + sge[idx].addr - mr->start; #endif - dsge->length = ssge[ssge_idx].length; - dsge->lkey = rdma_backend_mr_lkey(&mr->backend_mr); + sge[idx].lkey = rdma_backend_mr_lkey(&mr->backend_mr); - *total_length += dsge->length; - - dsge++; + *total_length += sge[idx].length; } return 0; @@ -484,7 +479,6 @@ void rdma_backend_post_send(RdmaBackendDev *backend_dev, void *ctx) { BackendCtx *bctx; - struct ibv_sge new_sge[MAX_SGE]; uint32_t bctx_id; int rc; struct ibv_send_wr wr = {}, *bad_wr; @@ -518,7 +512,7 @@ void rdma_backend_post_send(RdmaBackendDev *backend_dev, rdma_protected_gslist_append_int32(&qp->cqe_ctx_list, bctx_id); - rc = build_host_sge_array(backend_dev->rdma_dev_res, new_sge, sge, num_sge, + rc = build_host_sge_array(backend_dev->rdma_dev_res, sge, num_sge, &backend_dev->rdma_dev_res->stats.tx_len); if (rc) { complete_work(IBV_WC_GENERAL_ERR, rc, ctx); @@ -538,7 +532,7 @@ void rdma_backend_post_send(RdmaBackendDev *backend_dev, wr.num_sge = num_sge; wr.opcode = IBV_WR_SEND; wr.send_flags = IBV_SEND_SIGNALED; - wr.sg_list = new_sge; + wr.sg_list = sge; wr.wr_id = bctx_id; rc = ibv_post_send(qp->ibqp, &wr, &bad_wr); @@ -601,7 +595,6 @@ void rdma_backend_post_recv(RdmaBackendDev *backend_dev, struct ibv_sge *sge, uint32_t num_sge, void *ctx) { BackendCtx *bctx; - struct ibv_sge new_sge[MAX_SGE]; uint32_t bctx_id; int rc; struct ibv_recv_wr wr = {}, *bad_wr; @@ -635,7 +628,7 @@ void rdma_backend_post_recv(RdmaBackendDev *backend_dev, rdma_protected_gslist_append_int32(&qp->cqe_ctx_list, bctx_id); - rc = build_host_sge_array(backend_dev->rdma_dev_res, new_sge, sge, num_sge, + rc = build_host_sge_array(backend_dev->rdma_dev_res, sge, num_sge, &backend_dev->rdma_dev_res->stats.rx_bufs_len); if (rc) { complete_work(IBV_WC_GENERAL_ERR, rc, ctx); @@ -643,7 +636,7 @@ void rdma_backend_post_recv(RdmaBackendDev *backend_dev, } wr.num_sge = num_sge; - wr.sg_list = new_sge; + wr.sg_list = sge; wr.wr_id = bctx_id; rc = ibv_post_recv(qp->ibqp, &wr, &bad_wr); if (rc) { @@ -671,7 +664,6 @@ void rdma_backend_post_srq_recv(RdmaBackendDev *backend_dev, uint32_t num_sge, void *ctx) { BackendCtx *bctx; - struct ibv_sge new_sge[MAX_SGE]; uint32_t bctx_id; int rc; struct ibv_recv_wr wr = {}, *bad_wr; @@ -688,7 +680,7 @@ void rdma_backend_post_srq_recv(RdmaBackendDev *backend_dev, rdma_protected_gslist_append_int32(&srq->cqe_ctx_list, bctx_id); - rc = build_host_sge_array(backend_dev->rdma_dev_res, new_sge, sge, num_sge, + rc = build_host_sge_array(backend_dev->rdma_dev_res, sge, num_sge, &backend_dev->rdma_dev_res->stats.rx_bufs_len); if (rc) { complete_work(IBV_WC_GENERAL_ERR, rc, ctx); @@ -696,7 +688,7 @@ void rdma_backend_post_srq_recv(RdmaBackendDev *backend_dev, } wr.num_sge = num_sge; - wr.sg_list = new_sge; + wr.sg_list = sge; wr.wr_id = bctx_id; rc = ibv_post_srq_recv(srq->ibsrq, &wr, &bad_wr); if (rc) { From b196d4f1d62dc0976fd3999ff753f94944fcb657 Mon Sep 17 00:00:00 2001 From: Yuval Shaia Date: Fri, 20 Mar 2020 16:34:29 +0200 Subject: [PATCH 3/4] hw/rdma: Skip data-path mr_id translation With the change made in commit 68b89aee71 ("Utilize ibv_reg_mr_iova for memory registration") the MR emulation is no longer needed in order to translate the guest addresses into host addresses. With that, the next obvious step is to skip entirely the processing in data-path. To accomplish this, return the backend's lkey to driver so we will not need to do the emulated mr_id to backend mr_id translation in data-path. The function build_host_sge_array is still called in data-path but only for backward computability with statistics collection. While there, as a cosmetic change to make the code cleaner - make one copy of the function rdma_backend_create_mr and leave the redundant guest_start argument in the legacy code. Signed-off-by: Yuval Shaia Reviewed-by: Marcel Apfelbaum Message-Id: <20200320143429.9490-3-yuval.shaia.ml@gmail.com> Signed-off-by: Marcel Apfelbaum --- hw/rdma/rdma_backend.c | 21 ++++++++++++++------- hw/rdma/rdma_backend.h | 5 ----- hw/rdma/rdma_rm.c | 13 ++++++------- 3 files changed, 20 insertions(+), 19 deletions(-) diff --git a/hw/rdma/rdma_backend.c b/hw/rdma/rdma_backend.c index b7ffbef9c0..3dd39fe1a7 100644 --- a/hw/rdma/rdma_backend.c +++ b/hw/rdma/rdma_backend.c @@ -377,6 +377,7 @@ static void ah_cache_init(void) destroy_ah_hash_key, destroy_ah_hast_data); } +#ifdef LEGACY_RDMA_REG_MR static int build_host_sge_array(RdmaDeviceResources *rdma_dev_res, struct ibv_sge *sge, uint8_t num_sge, uint64_t *total_length) @@ -391,9 +392,7 @@ static int build_host_sge_array(RdmaDeviceResources *rdma_dev_res, return VENDOR_ERR_INVLKEY | sge[idx].lkey; } -#ifdef LEGACY_RDMA_REG_MR sge[idx].addr = (uintptr_t)mr->virt + sge[idx].addr - mr->start; -#endif sge[idx].lkey = rdma_backend_mr_lkey(&mr->backend_mr); *total_length += sge[idx].length; @@ -401,6 +400,19 @@ static int build_host_sge_array(RdmaDeviceResources *rdma_dev_res, return 0; } +#else +static inline int build_host_sge_array(RdmaDeviceResources *rdma_dev_res, + struct ibv_sge *sge, uint8_t num_sge, + uint64_t *total_length) +{ + int idx; + + for (idx = 0; idx < num_sge; idx++) { + *total_length += sge[idx].length; + } + return 0; +} +#endif static void trace_mad_message(const char *title, char *buf, int len) { @@ -731,13 +743,8 @@ void rdma_backend_destroy_pd(RdmaBackendPD *pd) } } -#ifdef LEGACY_RDMA_REG_MR -int rdma_backend_create_mr(RdmaBackendMR *mr, RdmaBackendPD *pd, void *addr, - size_t length, int access) -#else int rdma_backend_create_mr(RdmaBackendMR *mr, RdmaBackendPD *pd, void *addr, size_t length, uint64_t guest_start, int access) -#endif { #ifdef LEGACY_RDMA_REG_MR mr->ibmr = ibv_reg_mr(pd->ibpd, addr, length, access); diff --git a/hw/rdma/rdma_backend.h b/hw/rdma/rdma_backend.h index 127f96e2d5..225af481e0 100644 --- a/hw/rdma/rdma_backend.h +++ b/hw/rdma/rdma_backend.h @@ -78,13 +78,8 @@ int rdma_backend_query_port(RdmaBackendDev *backend_dev, int rdma_backend_create_pd(RdmaBackendDev *backend_dev, RdmaBackendPD *pd); void rdma_backend_destroy_pd(RdmaBackendPD *pd); -#ifdef LEGACY_RDMA_REG_MR -int rdma_backend_create_mr(RdmaBackendMR *mr, RdmaBackendPD *pd, void *addr, - size_t length, int access); -#else int rdma_backend_create_mr(RdmaBackendMR *mr, RdmaBackendPD *pd, void *addr, size_t length, uint64_t guest_start, int access); -#endif void rdma_backend_destroy_mr(RdmaBackendMR *mr); int rdma_backend_create_cq(RdmaBackendDev *backend_dev, RdmaBackendCQ *cq, diff --git a/hw/rdma/rdma_rm.c b/hw/rdma/rdma_rm.c index 1524dfaeaa..7e9ea283c9 100644 --- a/hw/rdma/rdma_rm.c +++ b/hw/rdma/rdma_rm.c @@ -227,21 +227,20 @@ int rdma_rm_alloc_mr(RdmaDeviceResources *dev_res, uint32_t pd_handle, mr->length = guest_length; mr->virt += (mr->start & (TARGET_PAGE_SIZE - 1)); -#ifdef LEGACY_RDMA_REG_MR - ret = rdma_backend_create_mr(&mr->backend_mr, &pd->backend_pd, mr->virt, - mr->length, access_flags); -#else ret = rdma_backend_create_mr(&mr->backend_mr, &pd->backend_pd, mr->virt, mr->length, guest_start, access_flags); -#endif if (ret) { ret = -EIO; goto out_dealloc_mr; } +#ifdef LEGACY_RDMA_REG_MR + /* We keep mr_handle in lkey so send and recv get get mr ptr */ + *lkey = *mr_handle; +#else + *lkey = rdma_backend_mr_lkey(&mr->backend_mr); +#endif } - /* We keep mr_handle in lkey so send and recv get get mr ptr */ - *lkey = *mr_handle; *rkey = -1; mr->pd_handle = pd_handle; From f93cfdc583d4c26b2a878642adf574e11909863c Mon Sep 17 00:00:00 2001 From: Stefan Hajnoczi Date: Mon, 16 Mar 2020 16:07:02 +0000 Subject: [PATCH 4/4] hw/rdma: avoid suspicious strncpy() use MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit gcc (GCC) 9.2.1 20190827 (Red Hat 9.2.1-1) with sanitizers enabled reports the following error: CC x86_64-softmmu/hw/rdma/vmw/pvrdma_dev_ring.o In file included from /usr/include/string.h:495, from include/qemu/osdep.h:101, from hw/rdma/vmw/pvrdma_dev_ring.c:16: In function ‘strncpy’, inlined from ‘pvrdma_ring_init’ at hw/rdma/vmw/pvrdma_dev_ring.c:33:5: /usr/include/bits/string_fortified.h:106:10: error: ‘__builtin_strncpy’ specified bound 32 equals destination size [-Werror=stringop-truncation] 106 | return __builtin___strncpy_chk (__dest, __src, __len, __bos (__dest)); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Use pstrcpy() instead of strncpy(). It is guaranteed to NUL-terminate strings. Signed-off-by: Stefan Hajnoczi Reviewed-by: Juan Quintela Reviewed-by: Yuval Shaia Message-Id: <20200316160702.478964-3-stefanha@redhat.com> Signed-off-by: Marcel Apfelbaum --- hw/rdma/vmw/pvrdma_dev_ring.c | 1 + 1 file changed, 1 insertion(+) diff --git a/hw/rdma/vmw/pvrdma_dev_ring.c b/hw/rdma/vmw/pvrdma_dev_ring.c index c2b3dd70a9..c122fe7035 100644 --- a/hw/rdma/vmw/pvrdma_dev_ring.c +++ b/hw/rdma/vmw/pvrdma_dev_ring.c @@ -14,6 +14,7 @@ */ #include "qemu/osdep.h" +#include "qemu/cutils.h" #include "hw/pci/pci.h" #include "cpu.h" #include "qemu/cutils.h"