[dpdk-dev] [PATCH v2 0/2] netvsc: event buffer bug fixes

[dpdk-dev] [PATCH v2 0/2] netvsc: event buffer bug fixes

[Stephen Hemminger]

A couple of bugs were introduced by the way the event
buffer is handled.

Stephen Hemminger (2):
  netvsc: fix rte malloc pool corruption
  netvsc: resize event buffer as needed

v2 - split into two patches and fix whitespace

 drivers/net/netvsc/hn_rxtx.c | 49 +++++++++++++++++++++++++-----------
 drivers/net/netvsc/hn_var.h  |  2 +-
 2 files changed, 35 insertions(+), 16 deletions(-)

-- 
2.18.0

[dpdk-dev] [PATCH v2 1/2] netvsc: fix rte malloc pool corruption

[Stephen Hemminger]

The event buffer was changed to be a fixed size value, but
calls to rte_free were left. That causes bugs because
it calls to rte_free() for a pointer that was not setup with
rte_malloc().

Fixes: 530af95a7849 ("bus/vmbus: avoid signalling host on read")
Signed-off-by: Stephen Hemminger <sthemmin@microsoft.com>
---
 drivers/net/netvsc/hn_rxtx.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/drivers/net/netvsc/hn_rxtx.c b/drivers/net/netvsc/hn_rxtx.c
index 02ef27e363cc..3e52a328b152 100644
--- a/drivers/net/netvsc/hn_rxtx.c
+++ b/drivers/net/netvsc/hn_rxtx.c
@@ -776,7 +776,6 @@ hn_dev_rx_queue_setup(struct rte_eth_dev *dev,
 
 fail:
 	rte_ring_free(rxq->rx_ring);
-	rte_free(rxq->event_buf);
 	rte_free(rxq);
 	return -ENOMEM;
 }
@@ -795,10 +794,8 @@ hn_dev_rx_queue_release(void *arg)
 	rxq->rx_ring = NULL;
 	rxq->mb_pool = NULL;
 
-	if (rxq != rxq->hv->primary) {
-		rte_free(rxq->event_buf);
+	if (rxq != rxq->hv->primary)
 		rte_free(rxq);
-	}
 }
 
 void
-- 
2.18.0

[dpdk-dev] [PATCH v2 2/2] netvsc: resize event buffer as needed

[Stephen Hemminger]

The event buffer was changed to be a fixed size value, but it
is not large enough for a forwarding stress test.

This version of event buffer code uses malloc/realloc to size
the event buffer as needed. Malloc is preferred over rte_malloc
because the event buffer does not need to be used for DMA
and huge page is a limited resource.

Fixes: 530af95a7849 ("bus/vmbus: avoid signalling host on read")
Signed-off-by: Stephen Hemminger <sthemmin@microsoft.com>
---
 drivers/net/netvsc/hn_rxtx.c | 50 ++++++++++++++++++++++++++----------
 drivers/net/netvsc/hn_var.h  |  2 +-
 2 files changed, 37 insertions(+), 15 deletions(-)

diff --git a/drivers/net/netvsc/hn_rxtx.c b/drivers/net/netvsc/hn_rxtx.c
index 3e52a328b152..79bb4d587783 100644
--- a/drivers/net/netvsc/hn_rxtx.c
+++ b/drivers/net/netvsc/hn_rxtx.c
@@ -10,6 +10,7 @@
 #include <errno.h>
 #include <unistd.h>
 #include <strings.h>
+#include <malloc.h>
 
 #include <rte_ethdev.h>
 #include <rte_memcpy.h>
@@ -718,16 +719,22 @@ struct hn_rx_queue *hn_rx_queue_alloc(struct hn_data *hv,
 {
 	struct hn_rx_queue *rxq;
 
-	rxq = rte_zmalloc_socket("HN_RXQ",
-				 sizeof(*rxq) + HN_RXQ_EVENT_DEFAULT,
+	rxq = rte_zmalloc_socket("HN_RXQ", sizeof(*rxq),
 				 RTE_CACHE_LINE_SIZE, socket_id);
-	if (rxq) {
-		rxq->hv = hv;
-		rxq->chan = hv->channels[queue_id];
-		rte_spinlock_init(&rxq->ring_lock);
-		rxq->port_id = hv->port_id;
-		rxq->queue_id = queue_id;
+	if (!rxq)
+		return NULL;
+
+	rxq->hv = hv;
+	rxq->chan = hv->channels[queue_id];
+	rte_spinlock_init(&rxq->ring_lock);
+	rxq->port_id = hv->port_id;
+	rxq->queue_id = queue_id;
+	rxq->event_buf = malloc(HN_RXQ_EVENT_DEFAULT);
+	if (!rxq->event_buf) {
+		free(rxq);
+		return NULL;
 	}
+
 	return rxq;
 }
 
@@ -776,6 +783,7 @@ hn_dev_rx_queue_setup(struct rte_eth_dev *dev,
 
 fail:
 	rte_ring_free(rxq->rx_ring);
+	free(rxq->event_buf);
 	rte_free(rxq);
 	return -ENOMEM;
 }
@@ -794,8 +802,10 @@ hn_dev_rx_queue_release(void *arg)
 	rxq->rx_ring = NULL;
 	rxq->mb_pool = NULL;
 
-	if (rxq != rxq->hv->primary)
+	if (rxq != rxq->hv->primary) {
+		free(rxq->event_buf);
 		rte_free(rxq);
+	}
 }
 
 void
@@ -850,19 +860,31 @@ void hn_process_events(struct hn_data *hv, uint16_t queue_id)
 
 	for (;;) {
 		const struct vmbus_chanpkt_hdr *pkt;
-		uint32_t len = HN_RXQ_EVENT_DEFAULT;
+		uint32_t len = malloc_usable_size(rxq->event_buf);
 		const void *data;
 
+retry:
 		ret = rte_vmbus_chan_recv_raw(rxq->chan, rxq->event_buf, &len);
 		if (ret == -EAGAIN)
 			break;	/* ring is empty */
 
-		else if (ret == -ENOBUFS)
-			rte_exit(EXIT_FAILURE, "event buffer not big enough (%u < %u)",
-				 HN_RXQ_EVENT_DEFAULT, len);
-		else if (ret <= 0)
+		if (unlikely(ret == -ENOBUFS)) {
+			/* event buffer not large enough to read ring */
+
+			PMD_DRV_LOG(DEBUG,
+				    "event buffer expansion (need %u)", len);
+			rxq->event_buf = realloc(rxq->event_buf, len);
+			if (rxq->event_buf)
+				goto retry;
+			/* out of memory, no more events now */
+			break;
+		}
+
+		if (unlikely(ret <= 0)) {
+			/* This indicates a failure to communicate (or worse) */
 			rte_exit(EXIT_FAILURE,
 				 "vmbus ring buffer error: %d", ret);
+		}
 
 		bytes_read += ret;
 		pkt = (const struct vmbus_chanpkt_hdr *)rxq->event_buf;
diff --git a/drivers/net/netvsc/hn_var.h b/drivers/net/netvsc/hn_var.h
index f7ff8585bc1c..0430f450cf37 100644
--- a/drivers/net/netvsc/hn_var.h
+++ b/drivers/net/netvsc/hn_var.h
@@ -77,7 +77,7 @@ struct hn_rx_queue {
 	struct hn_stats stats;
 	uint64_t ring_full;
 
-	uint8_t	event_buf[];
+	void *event_buf;
 };
 
 
-- 
2.18.0

Re: [dpdk-dev] [PATCH v2 2/2] netvsc: resize event buffer as needed

[Stephen Hemminger]

On Mon, 13 Aug 2018 08:51:08 -0700
Stephen Hemminger <stephen@networkplumber.org> wrote:

> The event buffer was changed to be a fixed size value, but it
> is not large enough for a forwarding stress test.
> 
> This version of event buffer code uses malloc/realloc to size
> the event buffer as needed. Malloc is preferred over rte_malloc
> because the event buffer does not need to be used for DMA
> and huge page is a limited resource.
> 
> Fixes: 530af95a7849 ("bus/vmbus: avoid signalling host on read")
> Signed-off-by: Stephen Hemminger <sthemmin@microsoft.com>

Self NAK. This won't work when secondary process needs the buffer.