From 6991f00fbb5a1da0f1c38c048865fb9f4734b602 Mon Sep 17 00:00:00 2001
From: Amos Kong <akong@redhat.com>
Date: Tue, 10 Sep 2013 06:08:08 +0200
Subject: [PATCH 26/39] virtio: virtqueue_get_avail_bytes: fix desc_pa when loop over the indirect descriptor table

RH-Author: Amos Kong <akong@redhat.com>
Message-id: <1378793288-3371-27-git-send-email-akong@redhat.com>
Patchwork-id: 54261
O-Subject: [RHEL-6.5 qemu-kvm PATCH v3 26/26] virtio: virtqueue_get_avail_bytes: fix desc_pa when loop over the indirect descriptor table
Bugzilla: 786407
RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
RH-Acked-by: Amit Shah <amit.shah@redhat.com>
RH-Acked-by: Laszlo Ersek <lersek@redhat.com>

From: yinyin <yin.yin@cs2c.com.cn>

virtqueue_get_avail_bytes: when found a indirect desc, we need loop over it.
           /* loop over the indirect descriptor table */
           indirect = 1;
           max = vring_desc_len(desc_pa, i) / sizeof(VRingDesc);
           num_bufs = i = 0;
           desc_pa = vring_desc_addr(desc_pa, i);
But, It init i to 0, then use i to update desc_pa. so we will always get:
desc_pa = vring_desc_addr(desc_pa, 0);
the last two line should swap.

Cc: qemu-stable@nongnu.org
Signed-off-by: Yin Yin <yin.yin@cs2c.com.cn>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
(backported from commit 1ae2757c6c4525c9b42f408c86818f843bad7418)
---
 hw/virtio.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
---
 hw/virtio.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/hw/virtio.c b/hw/virtio.c
index e5eeabd..d1fa010 100644
--- a/hw/virtio.c
+++ b/hw/virtio.c
@@ -374,8 +374,8 @@ void virtqueue_get_avail_bytes(VirtQueue *vq, unsigned int *in_bytes,
             /* loop over the indirect descriptor table */
             indirect = 1;
             max = vring_desc_len(desc_pa, i) / sizeof(VRingDesc);
-            num_bufs = i = 0;
             desc_pa = vring_desc_addr(desc_pa, i);
+            num_bufs = i = 0;
         }
 
         do {
-- 
1.7.1

