[Qemu-devel] [PATCH v2] qtest: virtio: zeroed last vring_desc after allocate

[Qemu-devel] [PATCH v2] qtest: virtio: zeroed last vring_desc after allocate

[Longpeng(Mike)]

As qvring_indirect_desc_setup() wouldn't initialize last vring_desc,
so it's filled with dirty data, this might cause virtio backend broken.

For example, the last bit of this vring_desc's flags might be 1, so
virtqueue_read_next_desc() would report "Desc next is ***".

Signed-off-by: Longpeng(Mike) <longpeng2@huawei.com>

---
Changes since v1:
    - use writel() for @len as it's 32 bits long. [Stefan]

---
 tests/libqos/virtio.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/tests/libqos/virtio.c b/tests/libqos/virtio.c
index ec30cb9..02e6a43 100644
--- a/tests/libqos/virtio.c
+++ b/tests/libqos/virtio.c
@@ -171,12 +171,20 @@ QVRingIndirectDesc *qvring_indirect_desc_setup(QVirtioDevice *d,
     for (i = 0; i < elem - 1; ++i) {
         /* indirect->desc[i].addr */
         writeq(indirect->desc + (16 * i), 0);
+        /* indirect->desc[i].len */
+        writel(indirect->desc + (16 * i) + 8, 0);
         /* indirect->desc[i].flags */
         writew(indirect->desc + (16 * i) + 12, VRING_DESC_F_NEXT);
         /* indirect->desc[i].next */
         writew(indirect->desc + (16 * i) + 14, i + 1);
     }
 
+    /* zeroed last element */
+    writeq(indirect->desc + (16 * i), 0); /* addr */
+    writel(indirect->desc + (16 * i) + 8, 0); /* len */
+    writew(indirect->desc + (16 * i) + 12, 0); /* flags */
+    writew(indirect->desc + (16 * i) + 14, 0); /* next */
+
     return indirect;
 }
 
-- 
1.8.3.1

Re: [Qemu-devel] [PATCH v2] qtest: virtio: zeroed last vring_desc after allocate

[Stefan Hajnoczi]

[-- Attachment #1: Type: text/plain, Size: 695 bytes --]

On Tue, Jan 17, 2017 at 10:59:24AM +0800, Longpeng(Mike) wrote:
> As qvring_indirect_desc_setup() wouldn't initialize last vring_desc,
> so it's filled with dirty data, this might cause virtio backend broken.
> 
> For example, the last bit of this vring_desc's flags might be 1, so
> virtqueue_read_next_desc() would report "Desc next is ***".
> 
> Signed-off-by: Longpeng(Mike) <longpeng2@huawei.com>
> 
> ---
> Changes since v1:
>     - use writel() for @len as it's 32 bits long. [Stefan]
> 
> ---
>  tests/libqos/virtio.c | 8 ++++++++
>  1 file changed, 8 insertions(+)

Thanks, applied to my block-next tree:
https://github.com/stefanha/qemu/commits/block-next

Stefan

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 455 bytes --]