falso
/
qemu-irix
mirror of https://github.com/n64decomp/qemu-irix.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

virtio: fix descriptor counting in virtqueue_pop 

While changing the s/g list allocation, commit 3b3b0628
also changed the descriptor counting to count iovec entries
as split by cpu_physical_memory_map(). Previously only the
actual descriptor entries were counted and the split into
the iovec happened afterwards in virtqueue_map().
Count the entries again instead to avoid erroneous
"Looped descriptor" errors.

Reported-by: Hans Middelhoek <h.middelhoek@ospito.nl>
Link: https://forum.proxmox.com/threads/vm-crash-with-memory-hotplug.35904/
Fixes: 3b3b062821 ("virtio: slim down allocation of VirtQueueElements")
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
This commit is contained in:
Wolfgang Bumiller 2017-09-20 08:09:33 +02:00 committed by Michael S. Tsirkin
parent 8e36c336d9
commit 37ef70be6a
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
hw/virtio/virtio.c
View File

@ -834,7 +834,7 @@ void *virtqueue_pop(VirtQueue *vq, size_t sz)
int64_t len; int64_t len;
VirtIODevice *vdev = vq->vdev; VirtIODevice *vdev = vq->vdev;
VirtQueueElement *elem = NULL; VirtQueueElement *elem = NULL;
unsigned out_num, in_num; unsigned out_num, in_num, elem_entries;
hwaddr addr[VIRTQUEUE_MAX_SIZE]; hwaddr addr[VIRTQUEUE_MAX_SIZE];
struct iovec iov[VIRTQUEUE_MAX_SIZE]; struct iovec iov[VIRTQUEUE_MAX_SIZE];
VRingDesc desc; VRingDesc desc;
@ -852,7 +852,7 @@ void *virtqueue_pop(VirtQueue *vq, size_t sz)
smp_rmb(); smp_rmb();
/* When we start there are none of either input nor output. */ /* When we start there are none of either input nor output. */
out_num = in_num = 0; out_num = in_num = elem_entries = 0;
max = vq->vring.num; max = vq->vring.num;
@ -922,7 +922,7 @@ void *virtqueue_pop(VirtQueue *vq, size_t sz)
} }
/* If we've got too many, that implies a descriptor loop. */ /* If we've got too many, that implies a descriptor loop. */
if ((in_num + out_num) > max) { if (++elem_entries > max) {
virtio_error(vdev, "Looped descriptor"); virtio_error(vdev, "Looped descriptor");
goto err_undo_map; goto err_undo_map;
} }