Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

virtio,pc,acpi: fixes, tests

Fixes and tests all over the place.
Batch iommu updates for vdpa.
Removal of deprecated cpu hotplug commands.
SMBIOS OEM string support.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

# gpg: Signature made Tue 29 Sep 2020 08:09:21 BST
# gpg:                using RSA key 5D09FD0871C8F85B94CA8A0D281F0DB8D28D5469
# gpg:                issuer "mst@redhat.com"
# gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" [full]
# gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>" [full]
# Primary key fingerprint: 0270 606B 6F3C DF3D 0B17  0970 C350 3912 AFBE 8E67
#      Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA  8A0D 281F 0DB8 D28D 5469

* remotes/mst/tags/for_upstream: (48 commits)
  libvhost-user: return on error in vu_log_queue_fill()
  libvhost-user: return early on virtqueue errors
  hw: virtio-pmem: detach the element fromt the virtqueue when error occurs
  tests/acpi: update golden master DSDT binary table blobs for q35
  piix4: don't reserve hw resources when hotplug is off globally
  Add ACPI DSDT tables for q35 that are being updated by the next patch
  tests/acpi: add newly added acpi DSDT table blob for pci bridge hotplug flag
  tests/acpi: unit test for 'acpi-pci-hotplug-with-bridge-support' bridge flag
  tests/acpi: list added acpi table binary file for pci bridge hotplug test
  i440fx/acpi: do not add hotplug related amls for cold plugged bridges
  Fix a gap where acpi_pcihp_find_hotplug_bus() returns a non-hotpluggable bus
  tests/acpi: add a new ACPI table in order to test root pci hotplug on/off
  tests/acpi: add new unit test to test hotplug off/on feature on the root pci bus
  tests/acpi: mark addition of table DSDT.roothp for unit testing root pci hotplug
  vhost-user: save features of multiqueues if chardev is closed
  qemu-options: document SMBIOS type 11 settings
  hw/smbios: report error if table size is too large
  hw/smbios: support loading OEM strings values from a file
  tests: acpi: update acpi blobs with new AML
  x68: acpi: trigger SMI before sending hotplug Notify event to OSPM
  ...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

1 files changed, 18 insertions, 8 deletions

diff --git a/contrib/libvhost-user/libvhost-user.c b/contrib/libvhost-user/libvhost-user.c
index 70055c98b7..9f1285b8a1 100644
--- a/contrib/libvhost-user/libvhost-user.c
+++ b/contrib/libvhost-user/libvhost-user.c
@@ -2416,7 +2416,7 @@ vu_queue_set_notification(VuDev *dev, VuVirtq *vq, int enable)
     }
 }
 
-static void
+static bool
 virtqueue_map_desc(VuDev *dev,
                    unsigned int *p_num_sg, struct iovec *iov,
                    unsigned int max_num_sg, bool is_write,
@@ -2428,7 +2428,7 @@ virtqueue_map_desc(VuDev *dev,
 
     if (!sz) {
         vu_panic(dev, "virtio: zero sized buffers are not allowed");
-        return;
+        return false;
     }
 
     while (sz) {
@@ -2436,13 +2436,13 @@ virtqueue_map_desc(VuDev *dev,
 
         if (num_sg == max_num_sg) {
             vu_panic(dev, "virtio: too many descriptors in indirect table");
-            return;
+            return false;
         }
 
         iov[num_sg].iov_base = vu_gpa_to_va(dev, &len, pa);
         if (iov[num_sg].iov_base == NULL) {
             vu_panic(dev, "virtio: invalid address for buffers");
-            return;
+            return false;
         }
         iov[num_sg].iov_len = len;
         num_sg++;
@@ -2451,6 +2451,7 @@ virtqueue_map_desc(VuDev *dev,
     }
 
     *p_num_sg = num_sg;
+    return true;
 }
 
 static void *
@@ -2488,6 +2489,7 @@ vu_queue_map_desc(VuDev *dev, VuVirtq *vq, unsigned int idx, size_t sz)
     if (lduw_le_p(&desc[i].flags) & VRING_DESC_F_INDIRECT) {
         if (ldl_le_p(&desc[i].len) % sizeof(struct vring_desc)) {
             vu_panic(dev, "Invalid size for indirect buffer table");
+            return NULL;
         }
 
         /* loop over the indirect descriptor table */
@@ -2515,22 +2517,29 @@ vu_queue_map_desc(VuDev *dev, VuVirtq *vq, unsigned int idx, size_t sz)
     /* Collect all the descriptors */
     do {
         if (lduw_le_p(&desc[i].flags) & VRING_DESC_F_WRITE) {
-            virtqueue_map_desc(dev, &in_num, iov + out_num,
+            if (!virtqueue_map_desc(dev, &in_num, iov + out_num,
                                VIRTQUEUE_MAX_SIZE - out_num, true,
-                               ldq_le_p(&desc[i].addr), ldl_le_p(&desc[i].len));
+                               ldq_le_p(&desc[i].addr),
+                               ldl_le_p(&desc[i].len))) {
+                return NULL;
+            }
         } else {
             if (in_num) {
                 vu_panic(dev, "Incorrect order for descriptors");
                 return NULL;
             }
-            virtqueue_map_desc(dev, &out_num, iov,
+            if (!virtqueue_map_desc(dev, &out_num, iov,
                                VIRTQUEUE_MAX_SIZE, false,
-                               ldq_le_p(&desc[i].addr), ldl_le_p(&desc[i].len));
+                               ldq_le_p(&desc[i].addr),
+                               ldl_le_p(&desc[i].len))) {
+                return NULL;
+            }
         }
 
         /* If we've got too many, that implies a descriptor loop. */
         if ((in_num + out_num) > max) {
             vu_panic(dev, "Looped descriptor");
+            return NULL;
         }
         rc = virtqueue_read_next_desc(dev, desc, i, max, &i);
     } while (rc == VIRTQUEUE_READ_DESC_MORE);
@@ -2724,6 +2733,7 @@ vu_log_queue_fill(VuDev *dev, VuVirtq *vq,
     if (lduw_le_p(&desc[i].flags) & VRING_DESC_F_INDIRECT) {
         if (ldl_le_p(&desc[i].len) % sizeof(struct vring_desc)) {
             vu_panic(dev, "Invalid size for indirect buffer table");
+            return;
         }
 
         /* loop over the indirect descriptor table */