The structure of probe request doesn't include the tail, this lead to a few field is missed to be copied. Currently this isn't an issue as those missed field belong to reserved field, just in case reserved field will be used in the future.
By this chance, also remove a few useless code. Signed-off-by: Zhenzhong Duan <zhenzhong.d...@intel.com> --- hw/virtio/virtio-iommu.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/hw/virtio/virtio-iommu.c b/hw/virtio/virtio-iommu.c index 7c122ab95780..bc96caf37c0c 100644 --- a/hw/virtio/virtio-iommu.c +++ b/hw/virtio/virtio-iommu.c @@ -656,19 +656,16 @@ static int virtio_iommu_probe(VirtIOIOMMU *s, uint8_t *buf) { uint32_t ep_id = le32_to_cpu(req->endpoint); - size_t free = VIOMMU_PROBE_SIZE; ssize_t count; if (!virtio_iommu_mr(s, ep_id)) { return VIRTIO_IOMMU_S_NOENT; } - count = virtio_iommu_fill_resv_mem_prop(s, ep_id, buf, free); + count = virtio_iommu_fill_resv_mem_prop(s, ep_id, buf, VIOMMU_PROBE_SIZE); if (count < 0) { return VIRTIO_IOMMU_S_INVAL; } - buf += count; - free -= count; return VIRTIO_IOMMU_S_OK; } @@ -708,7 +705,8 @@ static int virtio_iommu_handle_probe(VirtIOIOMMU *s, uint8_t *buf) { struct virtio_iommu_req_probe req; - int ret = virtio_iommu_iov_to_req(iov, iov_cnt, &req, sizeof(req)); + int ret = virtio_iommu_iov_to_req(iov, iov_cnt, &req, + sizeof(req) + sizeof(struct virtio_iommu_req_tail)); return ret ? ret : virtio_iommu_probe(s, &req, buf); } -- 2.25.1