From c8fa37e075cf59e8b21af9211f6a6348c92ed098 Mon Sep 17 00:00:00 2001

From: Alon Levy <alevy@redhat.com>

Date: Mon, 12 Jul 2010 22:48:59 +0300

Subject: [PATCH 25/39] spice-vmc: two bugfixes in vmc_read

 * throttling with no discard means possible recursion, make

  vmc_read handle that.

 * zero datapos when data is done (from rhel6 version)

---

 hw/spice-vmc.c |   13 ++++++++-----

 1 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/hw/spice-vmc.c b/hw/spice-vmc.c

index 3f6a2bb..06e30e6 100644

--- a/hw/spice-vmc.c

+++ b/hw/spice-vmc.c

@@ -45,7 +45,7 @@ static int vmc_write(SpiceVDIPortInstance *sin, const uint8_t *buf, int len)

     ssize_t out;

     out = virtio_serial_write(&svc->port, buf, len);

-    dprintf(svc, 2, "%s: %lu/%d\n", __func__, out, len);

+    dprintf(svc, 3, "%s: %lu/%d\n", __func__, out, len);

     return out;

 }

@@ -54,13 +54,16 @@ static int vmc_read(SpiceVDIPortInstance *sin, uint8_t *buf, int len)

     SpiceVirtualChannel *svc = container_of(sin, SpiceVirtualChannel, sin);

     int bytes = MIN(len, svc->datalen);

-    dprintf(svc, 2, "%s: %d/%zd\n", __func__, bytes, svc->datalen);

-    if (bytes) {

+    dprintf(svc, 2, "%s: %p %d/%d/%zd\n", __func__, svc->datapos, len, bytes, svc->datalen);

+    if (bytes > 0) {

         memcpy(buf, svc->datapos, bytes);

         svc->datapos += bytes;

         svc->datalen -= bytes;

-        if (0 == svc->datalen) {

+        assert(svc->datalen >= 0);

+        if (svc->datalen == 0) {

+            svc->datapos = 0;

             virtio_serial_throttle_port(&svc->port, false);

+            // ^^^ !!! may call vmc_have_data, so don't touch svc after it!

         }

     }

     return bytes;

@@ -140,7 +143,7 @@ static void vmc_have_data(VirtIOSerialPort *port, const uint8_t *buf, size_t len

     SpiceVirtualChannel *svc = DO_UPCAST(SpiceVirtualChannel, port, port);

     dprintf(svc, 2, "%s: %zd\n", __func__, len);

-    assert(svc->datapos == 0);

+    assert(svc->datalen == 0);

     if (svc->bufsize < len) {

         svc->bufsize = len;

         svc->buffer = qemu_realloc(svc->buffer, svc->bufsize);

-- 

1.7.2.3