Revision bb6834cf hw/virtio.c
| b/hw/virtio.c | ||
|---|---|---|
| 12 | 12 |
*/ |
| 13 | 13 |
|
| 14 | 14 |
#include <inttypes.h> |
| 15 |
#include <err.h> |
|
| 16 | 15 |
|
| 17 | 16 |
#include "virtio.h" |
| 18 | 17 |
#include "sysemu.h" |
| ... | ... | |
| 331 | 330 |
uint16_t num_heads = vring_avail_idx(vq) - idx; |
| 332 | 331 |
|
| 333 | 332 |
/* Check it isn't doing very strange things with descriptor numbers. */ |
| 334 |
if (num_heads > vq->vring.num) |
|
| 335 |
errx(1, "Guest moved used index from %u to %u", |
|
| 336 |
idx, vring_avail_idx(vq)); |
|
| 333 |
if (num_heads > vq->vring.num) {
|
|
| 334 |
fprintf(stderr, "Guest moved used index from %u to %u", |
|
| 335 |
idx, vring_avail_idx(vq)); |
|
| 336 |
exit(1); |
|
| 337 |
} |
|
| 337 | 338 |
|
| 338 | 339 |
return num_heads; |
| 339 | 340 |
} |
| ... | ... | |
| 347 | 348 |
head = vring_avail_ring(vq, idx % vq->vring.num); |
| 348 | 349 |
|
| 349 | 350 |
/* If their number is silly, that's a fatal mistake. */ |
| 350 |
if (head >= vq->vring.num) |
|
| 351 |
errx(1, "Guest says index %u is available", head); |
|
| 351 |
if (head >= vq->vring.num) {
|
|
| 352 |
fprintf(stderr, "Guest says index %u is available", head); |
|
| 353 |
exit(1); |
|
| 354 |
} |
|
| 352 | 355 |
|
| 353 | 356 |
return head; |
| 354 | 357 |
} |
| ... | ... | |
| 366 | 369 |
/* Make sure compiler knows to grab that: we don't want it changing! */ |
| 367 | 370 |
wmb(); |
| 368 | 371 |
|
| 369 |
if (next >= vq->vring.num) |
|
| 370 |
errx(1, "Desc next is %u", next); |
|
| 372 |
if (next >= vq->vring.num) {
|
|
| 373 |
fprintf(stderr, "Desc next is %u", next); |
|
| 374 |
exit(1); |
|
| 375 |
} |
|
| 371 | 376 |
|
| 372 | 377 |
return next; |
| 373 | 378 |
} |
| ... | ... | |
| 386 | 391 |
i = virtqueue_get_head(vq, idx++); |
| 387 | 392 |
do {
|
| 388 | 393 |
/* If we've got too many, that implies a descriptor loop. */ |
| 389 |
if (++num_bufs > vq->vring.num) |
|
| 390 |
errx(1, "Looped descriptor"); |
|
| 394 |
if (++num_bufs > vq->vring.num) {
|
|
| 395 |
fprintf(stderr, "Looped descriptor"); |
|
| 396 |
exit(1); |
|
| 397 |
} |
|
| 391 | 398 |
|
| 392 | 399 |
if (vring_desc_flags(vq, i) & VRING_DESC_F_WRITE) {
|
| 393 | 400 |
if (in_bytes > 0 && |
| ... | ... | |
| 447 | 454 |
sg->iov_len); |
| 448 | 455 |
} |
| 449 | 456 |
#endif |
| 450 |
if (sg->iov_base == NULL) |
|
| 451 |
errx(1, "Invalid mapping\n"); |
|
| 457 |
if (sg->iov_base == NULL) {
|
|
| 458 |
fprintf(stderr, "Invalid mapping\n"); |
|
| 459 |
exit(1); |
|
| 460 |
} |
|
| 452 | 461 |
|
| 453 | 462 |
/* If we've got too many, that implies a descriptor loop. */ |
| 454 |
if ((elem->in_num + elem->out_num) > vq->vring.num) |
|
| 455 |
errx(1, "Looped descriptor"); |
|
| 463 |
if ((elem->in_num + elem->out_num) > vq->vring.num) {
|
|
| 464 |
fprintf(stderr, "Looped descriptor"); |
|
| 465 |
exit(1); |
|
| 466 |
} |
|
| 456 | 467 |
} while ((i = virtqueue_next_desc(vq, i)) != vq->vring.num); |
| 457 | 468 |
|
| 458 | 469 |
elem->index = head; |
Also available in: Unified diff