Revision cd92f4cc
| b/hw/virtio.c | ||
|---|---|---|
| 14 | 14 |
#include <inttypes.h> |
| 15 | 15 |
|
| 16 | 16 |
#include "trace.h" |
| 17 |
#include "qemu-error.h" |
|
| 17 | 18 |
#include "virtio.h" |
| 18 | 19 |
#include "sysemu.h" |
| 19 | 20 |
|
| ... | ... | |
| 253 | 254 |
|
| 254 | 255 |
/* Check it isn't doing very strange things with descriptor numbers. */ |
| 255 | 256 |
if (num_heads > vq->vring.num) {
|
| 256 |
fprintf(stderr, "Guest moved used index from %u to %u",
|
|
| 257 |
idx, vring_avail_idx(vq)); |
|
| 257 |
error_report("Guest moved used index from %u to %u",
|
|
| 258 |
idx, vring_avail_idx(vq));
|
|
| 258 | 259 |
exit(1); |
| 259 | 260 |
} |
| 260 | 261 |
|
| ... | ... | |
| 271 | 272 |
|
| 272 | 273 |
/* If their number is silly, that's a fatal mistake. */ |
| 273 | 274 |
if (head >= vq->vring.num) {
|
| 274 |
fprintf(stderr, "Guest says index %u is available", head);
|
|
| 275 |
error_report("Guest says index %u is available", head);
|
|
| 275 | 276 |
exit(1); |
| 276 | 277 |
} |
| 277 | 278 |
|
| ... | ... | |
| 293 | 294 |
wmb(); |
| 294 | 295 |
|
| 295 | 296 |
if (next >= max) {
|
| 296 |
fprintf(stderr, "Desc next is %u", next);
|
|
| 297 |
error_report("Desc next is %u", next);
|
|
| 297 | 298 |
exit(1); |
| 298 | 299 |
} |
| 299 | 300 |
|
| ... | ... | |
| 320 | 321 |
|
| 321 | 322 |
if (vring_desc_flags(desc_pa, i) & VRING_DESC_F_INDIRECT) {
|
| 322 | 323 |
if (vring_desc_len(desc_pa, i) % sizeof(VRingDesc)) {
|
| 323 |
fprintf(stderr, "Invalid size for indirect buffer table\n");
|
|
| 324 |
error_report("Invalid size for indirect buffer table");
|
|
| 324 | 325 |
exit(1); |
| 325 | 326 |
} |
| 326 | 327 |
|
| 327 | 328 |
/* If we've got too many, that implies a descriptor loop. */ |
| 328 | 329 |
if (num_bufs >= max) {
|
| 329 |
fprintf(stderr, "Looped descriptor");
|
|
| 330 |
error_report("Looped descriptor");
|
|
| 330 | 331 |
exit(1); |
| 331 | 332 |
} |
| 332 | 333 |
|
| ... | ... | |
| 340 | 341 |
do {
|
| 341 | 342 |
/* If we've got too many, that implies a descriptor loop. */ |
| 342 | 343 |
if (++num_bufs > max) {
|
| 343 |
fprintf(stderr, "Looped descriptor");
|
|
| 344 |
error_report("Looped descriptor");
|
|
| 344 | 345 |
exit(1); |
| 345 | 346 |
} |
| 346 | 347 |
|
| ... | ... | |
| 374 | 375 |
len = sg[i].iov_len; |
| 375 | 376 |
sg[i].iov_base = cpu_physical_memory_map(addr[i], &len, is_write); |
| 376 | 377 |
if (sg[i].iov_base == NULL || len != sg[i].iov_len) {
|
| 377 |
fprintf(stderr, "virtio: trying to map MMIO memory\n");
|
|
| 378 |
error_report("virtio: trying to map MMIO memory");
|
|
| 378 | 379 |
exit(1); |
| 379 | 380 |
} |
| 380 | 381 |
} |
| ... | ... | |
| 397 | 398 |
|
| 398 | 399 |
if (vring_desc_flags(desc_pa, i) & VRING_DESC_F_INDIRECT) {
|
| 399 | 400 |
if (vring_desc_len(desc_pa, i) % sizeof(VRingDesc)) {
|
| 400 |
fprintf(stderr, "Invalid size for indirect buffer table\n");
|
|
| 401 |
error_report("Invalid size for indirect buffer table");
|
|
| 401 | 402 |
exit(1); |
| 402 | 403 |
} |
| 403 | 404 |
|
| ... | ... | |
| 423 | 424 |
|
| 424 | 425 |
/* If we've got too many, that implies a descriptor loop. */ |
| 425 | 426 |
if ((elem->in_num + elem->out_num) > max) {
|
| 426 |
fprintf(stderr, "Looped descriptor");
|
|
| 427 |
error_report("Looped descriptor");
|
|
| 427 | 428 |
exit(1); |
| 428 | 429 |
} |
| 429 | 430 |
} while ((i = virtqueue_next_desc(desc_pa, i, max)) != max); |
| ... | ... | |
| 694 | 695 |
qemu_get_be16s(f, &vdev->queue_sel); |
| 695 | 696 |
qemu_get_be32s(f, &features); |
| 696 | 697 |
if (features & ~supported_features) {
|
| 697 |
fprintf(stderr, "Features 0x%x unsupported. Allowed features: 0x%x\n",
|
|
| 698 |
features, supported_features); |
|
| 698 |
error_report("Features 0x%x unsupported. Allowed features: 0x%x",
|
|
| 699 |
features, supported_features);
|
|
| 699 | 700 |
return -1; |
| 700 | 701 |
} |
| 701 | 702 |
if (vdev->set_features) |
| ... | ... | |
| 717 | 718 |
num_heads = vring_avail_idx(&vdev->vq[i]) - vdev->vq[i].last_avail_idx; |
| 718 | 719 |
/* Check it isn't doing very strange things with descriptor numbers. */ |
| 719 | 720 |
if (num_heads > vdev->vq[i].vring.num) {
|
| 720 |
fprintf(stderr, "VQ %d size 0x%x Guest index 0x%x "
|
|
| 721 |
"inconsistent with Host index 0x%x: delta 0x%x\n",
|
|
| 722 |
i, vdev->vq[i].vring.num,
|
|
| 723 |
vring_avail_idx(&vdev->vq[i]),
|
|
| 724 |
vdev->vq[i].last_avail_idx, num_heads);
|
|
| 721 |
error_report("VQ %d size 0x%x Guest index 0x%x "
|
|
| 722 |
"inconsistent with Host index 0x%x: delta 0x%x",
|
|
| 723 |
i, vdev->vq[i].vring.num,
|
|
| 724 |
vring_avail_idx(&vdev->vq[i]),
|
|
| 725 |
vdev->vq[i].last_avail_idx, num_heads);
|
|
| 725 | 726 |
return -1; |
| 726 | 727 |
} |
| 727 | 728 |
if (vdev->binding->load_queue) {
|
Also available in: Unified diff