Merge commit 'c9159fe9aa9abe24115ea4d16127179e9cb07e22' into upstream-merge

* commit 'c9159fe9aa9abe24115ea4d16127179e9cb07e22': (83 commits)
  Remove libhw
  rtc: implement century byte
  rtc: map CMOS index 0x37 to 0x32 on read and writes
  rtc: fix overflow in mktimegm
  qtest: implement QTEST_STOP
  qemu-barrier: Fix compiler version check for future gcc versions
  doc: update HACKING wrt strncpy/pstrcpy
  hw/r2d: add comment: this strncpy use is ok
  qcow2: mark this file's sole strncpy use as justified
  acpi: remove strzcpy (strncpy-identical) function; just use strncpy
  libcacard/vcard_emul_nss: use pstrcpy in place of strncpy
  qemu-ga: prefer pstrcpy: consistently NUL-terminate ifreq.ifr_name
  vscsi: avoid unwarranted strncpy
  virtio-9p: avoid unwarranted uses of strncpy
  bt: replace fragile snprintf use and unwarranted strncpy
  ui/vnc: simplify and avoid strncpy
  linux-user: remove two unchecked uses of strdup
  ppc: avoid buffer overrun: use pstrcpy, not strncpy
  os-posix: avoid buffer overrun
  lm32: avoid buffer overrun
  ...

Conflicts:
	hw/Makefile.objs

Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>

1 files changed, 23 insertions, 9 deletions

diff --git a/hw/virtio.c b/hw/virtio.c
index 209c76375..6821092df 100644
--- a/hw/virtio.c
+++ b/hw/virtio.c
@@ -241,7 +241,7 @@ void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem,
                                   elem->in_sg[i].iov_len,
                                   1, size);
 
-        offset += elem->in_sg[i].iov_len;
+        offset += size;
     }
 
     for (i = 0; i < elem->out_num; i++)
@@ -335,10 +335,11 @@ static unsigned virtqueue_next_desc(target_phys_addr_t desc_pa,
     return next;
 }
 
-int virtqueue_avail_bytes(VirtQueue *vq, int in_bytes, int out_bytes)
+void virtqueue_get_avail_bytes(VirtQueue *vq, unsigned int *in_bytes,
+                               unsigned int *out_bytes)
 {
     unsigned int idx;
-    int total_bufs, in_total, out_total;
+    unsigned int total_bufs, in_total, out_total;
 
     idx = vq->last_avail_idx;
 
@@ -380,13 +381,9 @@ int virtqueue_avail_bytes(VirtQueue *vq, int in_bytes, int out_bytes)
             }
 
             if (vring_desc_flags(desc_pa, i) & VRING_DESC_F_WRITE) {
-                if (in_bytes > 0 &&
-                    (in_total += vring_desc_len(desc_pa, i)) >= in_bytes)
-                    return 1;
+                in_total += vring_desc_len(desc_pa, i);
             } else {
-                if (out_bytes > 0 &&
-                    (out_total += vring_desc_len(desc_pa, i)) >= out_bytes)
-                    return 1;
+                out_total += vring_desc_len(desc_pa, i);
             }
         } while ((i = virtqueue_next_desc(desc_pa, i, max)) != max);
 
@@ -395,7 +392,24 @@ int virtqueue_avail_bytes(VirtQueue *vq, int in_bytes, int out_bytes)
         else
             total_bufs++;
     }
+    if (in_bytes) {
+        *in_bytes = in_total;
+    }
+    if (out_bytes) {
+        *out_bytes = out_total;
+    }
+}
 
+int virtqueue_avail_bytes(VirtQueue *vq, unsigned int in_bytes,
+                          unsigned int out_bytes)
+{
+    unsigned int in_total, out_total;
+
+    virtqueue_get_avail_bytes(vq, &in_total, &out_total);
+    if ((in_bytes && in_bytes < in_total)
+        || (out_bytes && out_bytes < out_total)) {
+        return 1;
+    }
     return 0;
 }