diff options
| author | Michael S. Tsirkin | 2010-11-23 20:55:39 +0100 |
|---|---|---|
| committer | Michael S. Tsirkin | 2010-11-24 16:25:44 +0100 |
| commit | 1abeb5a65d515f8a8a9cfc4a82342f731bd9321f (patch) | |
| tree | 8af38bcbf8192f7ef000e58ef1162308b658faf0 /hw/virtio.c | |
| parent | virtio: Convert fprintf() to error_report() (diff) | |
| download | qemu-1abeb5a65d515f8a8a9cfc4a82342f731bd9321f.tar.gz qemu-1abeb5a65d515f8a8a9cfc4a82342f731bd9321f.tar.xz qemu-1abeb5a65d515f8a8a9cfc4a82342f731bd9321f.zip | |
virtio: fix up VQ checks
When migration triggers before a VQ is initialized,
base pa is 0 and last_used_index must be 0 too:
we don't have a ring to compare to.
Reported-by: Juan Quintela <quintela@redhat.com>
Tested-by: Juan Quintela <quintela@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Diffstat (limited to 'hw/virtio.c')
| -rw-r--r-- | hw/virtio.c | 27 |
1 files changed, 16 insertions, 11 deletions
diff --git a/hw/virtio.c b/hw/virtio.c index 849a60faaa..07dbf868fd 100644 --- a/hw/virtio.c +++ b/hw/virtio.c @@ -682,7 +682,6 @@ int virtio_load(VirtIODevice *vdev, QEMUFile *f) uint32_t features; uint32_t supported_features = vdev->binding->get_features(vdev->binding_opaque); - uint16_t num_heads; if (vdev->binding->load_config) { ret = vdev->binding->load_config(vdev->binding_opaque, f); @@ -713,17 +712,23 @@ int virtio_load(VirtIODevice *vdev, QEMUFile *f) qemu_get_be16s(f, &vdev->vq[i].last_avail_idx); if (vdev->vq[i].pa) { + uint16_t nheads; virtqueue_init(&vdev->vq[i]); - } - num_heads = vring_avail_idx(&vdev->vq[i]) - vdev->vq[i].last_avail_idx; - /* Check it isn't doing very strange things with descriptor numbers. */ - if (num_heads > vdev->vq[i].vring.num) { - error_report("VQ %d size 0x%x Guest index 0x%x " - "inconsistent with Host index 0x%x: delta 0x%x", - i, vdev->vq[i].vring.num, - vring_avail_idx(&vdev->vq[i]), - vdev->vq[i].last_avail_idx, num_heads); - return -1; + nheads = vring_avail_idx(&vdev->vq[i]) - vdev->vq[i].last_avail_idx; + /* Check it isn't doing very strange things with descriptor numbers. */ + if (nheads > vdev->vq[i].vring.num) { + error_report("VQ %d size 0x%x Guest index 0x%x " + "inconsistent with Host index 0x%x: delta 0x%x\n", + i, vdev->vq[i].vring.num, + vring_avail_idx(&vdev->vq[i]), + vdev->vq[i].last_avail_idx, nheads); + return -1; + } + } else if (vdev->vq[i].last_avail_idx) { + error_report("VQ %d address 0x0 " + "inconsistent with Host index 0x%x\n", + i, vdev->vq[i].last_avail_idx); + return -1; } if (vdev->binding->load_queue) { ret = vdev->binding->load_queue(vdev->binding_opaque, i, f); |