@samitouri / QOSamiQemu / commits / 69c8f5e694

9pfs/xen: implement response_buffer_size callback

Add and implement the response_buffer_size callback for the Xen transport. Returns the size of the response buffer from the rings in_sg, as limit for 9p server while generating a response for supplied PDU. We use a local iovec array variable in_sg[2] instead of ring->sg, as ring->sg is only allocated by init_in_iov_from_pdu() and init_out_iov_from_pdu() during request / response processing. response_buffer_size() however may be called before those allocators, which would dereference ring->sg as NULL pointer. The local array avoids this. Reviewed-by: Stefano Stabellini <sstabellini@kernel.org> Link: https://lore.kernel.org/qemu-devel/3b139769eb1d3f9d91ee5281228e6467f9a08b99.1781287774.git.qemu_oss@crudebyte.com Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>

Christian Schoenebeck committed Jun 12, 2026 at 20:22 UTC 69c8f5e6946f76a70b141a340c7aeb9d6a8e3c27

1 file changed +12

hw/9pfs/xen-9p-backend.c

+12

@@ -268,6 +268,17 @@ static size_t xen_9p_msize_limit(V9fsState *s)

268 return limit;

269 }

270

271 +static size_t xen_9pfs_response_buffer_size(V9fsPDU *pdu)

272 +{

273 + Xen9pfsDev *priv = container_of(pdu->s, Xen9pfsDev, state);

274 + Xen9pfsRing *ring = &priv->rings[pdu->tag % priv->num_rings];

275 + struct iovec in_sg[2];

276 + int num;

277 +

278 + xen_9pfs_in_sg(ring, in_sg, &num, pdu->idx, 0);

279 + return iov_size(in_sg, num);

280 +}

281 +

282 static const V9fsTransport xen_9p_transport = {

283 .pdu_vmarshal = xen_9pfs_pdu_vmarshal,

284 .pdu_vunmarshal = xen_9pfs_pdu_vunmarshal,

@@ -275,6 +286,7 @@ static const V9fsTransport xen_9p_transport = {

286 .init_out_iov_from_pdu = xen_9pfs_init_out_iov_from_pdu,

287 .push_and_notify = xen_9pfs_push_and_notify,

288 .msize_limit = xen_9p_msize_limit,

289 + .response_buffer_size = xen_9pfs_response_buffer_size,

290 };

291

292 static int xen_9pfs_init(struct XenLegacyDevice *xendev)