I'm looking at some RDMA security tickets recently, and I stumbled on top
of this chunk size problem. Since this is very recently touched, I figured
maybe I should ask here,
On Mon, Mar 30, 2026 at 02:47:58PM +0800, Samuel Zhang wrote:
> @@ -2176,7 +2178,7 @@ static int qemu_rdma_write(RDMAContext *rdma,
> rdma->current_length += len;
>
> /* flush it if buffer is too large */
> - if (rdma->current_length >= RDMA_MERGE_MAX) {
> + if (rdma->current_length >= rdma_merge_max()) {
[1]
What is this rdma_merge_max()? Why it's twice the chunk size, and even if
I believe when reaching here the current_length should have been throttled
by chunk size too?
> return qemu_rdma_write_flush(rdma, errp);
> }
I mean, in qemu_rdma_buffer_mergeable():
...
chunk_end = ram_chunk_end(block, rdma->current_chunk);
...
if ((host_addr + len) > chunk_end) {
return false;
}
I believe it means when len will go beyond chunk size, it'll force a flush
already.
With that, when reaching [1] above, we either should have just flushed, or
we're under chunk size (which further guarantees smaller than
2*chunk_size).
What did I miss? Or, is this line [1] dead code?
Thanks,
--
Peter Xu
