[Qemu-devel] [PATCH] virtio: fix up VQ checks

[Michael S. Tsirkin]

When migration triggers before a VQ is initialized,
base pa is 0 and last_used_index must be 0 too:
we don't have a ring to compare to.

This fixes a bug introduced in
258dc7c96bb4b7ca71d5bee811e73933310e168c.

Reporrted-by: Juan Quintela <address@hidden>
Signed-off-by: Michael S. Tsirkin <address@hidden>
---

Compile-tested only.
Juan, could you tell me whether this fixes the bug
you see please?

 hw/virtio.c |   23 ++++++++++++++---------
 1 files changed, 14 insertions(+), 9 deletions(-)

diff --git a/hw/virtio.c b/hw/virtio.c
index a2a657e..1df3578 100644
--- a/hw/virtio.c
+++ b/hw/virtio.c
@@ -681,7 +681,6 @@ int virtio_load(VirtIODevice *vdev, QEMUFile *f)
     uint32_t features;
     uint32_t supported_features =
         vdev->binding->get_features(vdev->binding_opaque);
-    uint16_t num_heads;
 
     if (vdev->binding->load_config) {
         ret = vdev->binding->load_config(vdev->binding_opaque, f);
@@ -712,17 +711,23 @@ int virtio_load(VirtIODevice *vdev, QEMUFile *f)
         qemu_get_be16s(f, &vdev->vq[i].last_avail_idx);
 
         if (vdev->vq[i].pa) {
+            uint16_t nheads;
             virtqueue_init(&vdev->vq[i]);
-        }
-       num_heads = vring_avail_idx(&vdev->vq[i]) - vdev->vq[i].last_avail_idx;
-       /* Check it isn't doing very strange things with descriptor numbers. */
-       if (num_heads > vdev->vq[i].vring.num) {
-               fprintf(stderr, "VQ %d size 0x%x Guest index 0x%x "
+            nheads = vring_avail_idx(&vdev->vq[i]) - 
vdev->vq[i].last_avail_idx;
+            /* Check it isn't doing very strange things with descriptor 
numbers. */
+            if (nheads > vdev->vq[i].vring.num) {
+                fprintf(stderr, "VQ %d size 0x%x Guest index 0x%x "
                         "inconsistent with Host index 0x%x: delta 0x%x\n",
-                       i, vdev->vq[i].vring.num,
+                        i, vdev->vq[i].vring.num,
                         vring_avail_idx(&vdev->vq[i]),
-                        vdev->vq[i].last_avail_idx, num_heads);
-               return -1;
+                        vdev->vq[i].last_avail_idx, nheads);
+                return -1;
+            }
+        } else if (vdev->vq[i].last_avail_idx) {
+                fprintf(stderr, "VQ %d address 0x0 "
+                        "inconsistent with Host index 0x%x\n",
+                        i, vdev->vq[i].last_avail_idx);
+                return -1;
        }
         if (vdev->binding->load_queue) {
             ret = vdev->binding->load_queue(vdev->binding_opaque, i, f);
-- 
1.7.3.2.91.g446ac