From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:42303) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YVZq9-0000KQ-PP for qemu-devel@nongnu.org; Wed, 11 Mar 2015 02:09:58 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1YVZq4-0001pa-Dr for qemu-devel@nongnu.org; Wed, 11 Mar 2015 02:09:57 -0400 Received: from ozlabs.org ([103.22.144.67]:35004) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YVZq4-0001oy-3D for qemu-devel@nongnu.org; Wed, 11 Mar 2015 02:09:52 -0400 From: Rusty Russell Date: Wed, 11 Mar 2015 16:29:31 +1030 Message-Id: <1426053572-21326-2-git-send-email-rusty@rustcorp.com.au> In-Reply-To: <1426053572-21326-1-git-send-email-rusty@rustcorp.com.au> References: <1426053572-21326-1-git-send-email-rusty@rustcorp.com.au> Subject: [Qemu-devel] [PATCH 1/2] virtio: make it clear that "len" for a used descriptor is len written. List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: QEMU Developers , "Michael S. Tsirkin" Cc: Rusty Russell And enforce this with a check that it's <= the writable length. Signed-off-by: Rusty Russell --- hw/virtio/virtio.c | 19 ++++++++++++------- include/hw/virtio/virtio.h | 4 ++-- 2 files changed, 14 insertions(+), 9 deletions(-) diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c index 882a31b..c944113 100644 --- a/hw/virtio/virtio.c +++ b/hw/virtio/virtio.c @@ -243,16 +243,21 @@ int virtio_queue_empty(VirtQueue *vq) } void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem, - unsigned int len, unsigned int idx) + unsigned int len_written, unsigned int idx) { - unsigned int offset; + unsigned int offset, tot_wlen; int i; - trace_virtqueue_fill(vq, elem, len, idx); + trace_virtqueue_fill(vq, elem, len_written, idx); + + for (tot_wlen = i = 0; i < elem->in_num; i++) { + tot_wlen += elem->in_sg[i].iov_len; + } + assert(len_written <= tot_wlen); offset = 0; for (i = 0; i < elem->in_num; i++) { - size_t size = MIN(len - offset, elem->in_sg[i].iov_len); + size_t size = MIN(len_written - offset, elem->in_sg[i].iov_len); cpu_physical_memory_unmap(elem->in_sg[i].iov_base, elem->in_sg[i].iov_len, @@ -270,7 +275,7 @@ void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem, /* Get a pointer to the next entry in the used ring. */ vring_used_ring_id(vq, idx, elem->index); - vring_used_ring_len(vq, idx, len); + vring_used_ring_len(vq, idx, len_written); } void virtqueue_flush(VirtQueue *vq, unsigned int count) @@ -288,9 +293,9 @@ void virtqueue_flush(VirtQueue *vq, unsigned int count) } void virtqueue_push(VirtQueue *vq, const VirtQueueElement *elem, - unsigned int len) + unsigned int len_written) { - virtqueue_fill(vq, elem, len, 0); + virtqueue_fill(vq, elem, len_written, 0); virtqueue_flush(vq, 1); } diff --git a/include/hw/virtio/virtio.h b/include/hw/virtio/virtio.h index df09993..153374f 100644 --- a/include/hw/virtio/virtio.h +++ b/include/hw/virtio/virtio.h @@ -191,10 +191,10 @@ VirtQueue *virtio_add_queue(VirtIODevice *vdev, int queue_size, void virtio_del_queue(VirtIODevice *vdev, int n); void virtqueue_push(VirtQueue *vq, const VirtQueueElement *elem, - unsigned int len); + unsigned int len_written); void virtqueue_flush(VirtQueue *vq, unsigned int count); void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem, - unsigned int len, unsigned int idx); + unsigned int len_written, unsigned int idx); void virtqueue_map_sg(struct iovec *sg, hwaddr *addr, size_t num_sg, int is_write); -- 2.1.0