@@ -681,7 +681,6 @@ int virtio_load(VirtIODevice *vdev, QEMUFile *f)
uint32_t features;
uint32_t supported_features =
vdev->binding->get_features(vdev->binding_opaque);
- uint16_t num_heads;
if (vdev->binding->load_config) {
ret = vdev->binding->load_config(vdev->binding_opaque, f);
@@ -712,17 +711,23 @@ int virtio_load(VirtIODevice *vdev, QEMUFile *f)
qemu_get_be16s(f, &vdev->vq[i].last_avail_idx);
if (vdev->vq[i].pa) {
+ uint16_t nheads;
virtqueue_init(&vdev->vq[i]);
- }
- num_heads = vring_avail_idx(&vdev->vq[i]) - vdev->vq[i].last_avail_idx;
- /* Check it isn't doing very strange things with descriptor numbers. */
- if (num_heads > vdev->vq[i].vring.num) {
- fprintf(stderr, "VQ %d size 0x%x Guest index 0x%x "
+ nheads = vring_avail_idx(&vdev->vq[i]) - vdev->vq[i].last_avail_idx;
+ /* Check it isn't doing very strange things with descriptor numbers. */
+ if (nheads > vdev->vq[i].vring.num) {
+ fprintf(stderr, "VQ %d size 0x%x Guest index 0x%x "
"inconsistent with Host index 0x%x: delta 0x%x\n",
- i, vdev->vq[i].vring.num,
+ i, vdev->vq[i].vring.num,
vring_avail_idx(&vdev->vq[i]),
- vdev->vq[i].last_avail_idx, num_heads);
- return -1;
+ vdev->vq[i].last_avail_idx, nheads);
+ return -1;
+ }
+ } else if (vdev->vq[i].last_avail_idx) {
+ fprintf(stderr, "VQ %d address 0x0 "
+ "inconsistent with Host index 0x%x\n",
+ i, vdev->vq[i].last_avail_idx);
+ return -1;
}
if (vdev->binding->load_queue) {
ret = vdev->binding->load_queue(vdev->binding_opaque, i, f);
When migration triggers before a VQ is initialized, base pa is 0 and last_used_index must be 0 too: we don't have a ring to compare to. This fixes a bug introduced in 258dc7c96bb4b7ca71d5bee811e73933310e168c. Reporrted-by: Juan Quintela <quintela@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> --- Compile-tested only. Juan, could you tell me whether this fixes the bug you see please? hw/virtio.c | 23 ++++++++++++++--------- 1 files changed, 14 insertions(+), 9 deletions(-)