summary refs log tree commit diff stats
path: root/docs/devel/secure-coding-practices.rst (unfollow)
Commit message (Collapse)AuthorFilesLines
2023-12-31meson: remove CONFIG_ALLPaolo Bonzini14-65/+7
CONFIG_ALL is tricky to use and was ported over to Meson from the recursive processing of Makefile variables. Meson sourcesets however have all_sources() and all_dependencies() methods that remove the need for it. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-12-31meson: remove config_targetosPaolo Bonzini7-21/+17
config_targetos is now empty and can be removed; its use in sourcesets that do not involve target-specific files can be replaced with an empty dictionary. In fact, at this point *all* sourcesets that do not involve target-specific files are just glorified mutable arrays. Enforce that they never test for symbols in "when:" by computing the set of files without "strict: false". Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-12-31meson: remove CONFIG_POSIX and CONFIG_WIN32 from config_targetosPaolo Bonzini8-60/+79
For consistency with other OSes, use if...endif for rules that are target-independent. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-12-31meson: remove OS definitions from config_targetosPaolo Bonzini15-42/+57
CONFIG_DARWIN, CONFIG_LINUX and CONFIG_BSD are used in some rules, but only CONFIG_LINUX has substantial use. Convert them all to if...endif. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-12-31meson: always probe u2f and canokey if the option is enabledPaolo Bonzini1-2/+2
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-12-31meson: move subdirs to "Collect sources" sectionPaolo Bonzini1-33/+33
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-12-31meson: move config-host.h definitions togetherPaolo Bonzini1-13/+14
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-12-31meson: move CFI detection code with other compiler flagsPaolo Bonzini1-40/+40
Keep it together with the other compiler modes, and before dependencies. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-12-31meson: keep subprojects togetherPaolo Bonzini1-36/+36
And move away dependencies that are not subprojects anymore. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-12-31meson: move accelerator dependency checks togetherPaolo Bonzini1-84/+91
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-12-31meson: move option validation togetherPaolo Bonzini1-69/+68
Check options before compiler flags, because some compiler flags are incompatible with modules. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-12-31meson: move program checks togetherPaolo Bonzini1-51/+56
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-12-31meson: add more sections to main meson.buildPaolo Bonzini1-6/+18
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-12-31configure: unify again the case arms in probe_target_compilerPaolo Bonzini1-59/+28
Remove assignments that match the default, and group the targets for debian-legacy-test-cross and debian-all-test-cross into a single arm. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-12-31configure: remove unnecessary subshellPaolo Bonzini1-5/+3
Do not use a subshell to hide the shadowing of $config_host_mak. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-12-31Makefile: clean qemu-iotests outputPaolo Bonzini2-1/+2
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-12-31meson: use version_compare() to compare versionPaolo Bonzini1-1/+1
While a simple lexicographic comparison usually works, it is less robust than a more specific algorithm designed to compare versions. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-12-31meson: remove unused variablePaolo Bonzini1-3/+3
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-12-31meson: fix type of "relocatable" optionPaolo Bonzini1-1/+1
Since the option is of boolean type, the default value should be a boolean rather than a string. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-12-31esp: check for NULL result from scsi_device_find()Alexandra Diupina1-0/+9
Add a 'current_lun' check for a null value to avoid null pointer dereferencing and recover host if NULL return Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 4eb8606560 (esp: store lun coming from the MESSAGE OUT phase) Signed-off-by: Alexandra Diupina <adiupina@astralinux.ru> Message-ID: <20231229152647.19699-1-adiupina@astralinux.ru> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-12-31target/i386: the sgx_epc_get_section stub is reachablePaolo Bonzini1-1/+1
The sgx_epc_get_section stub is reachable from cpu_x86_cpuid. It should not assert, instead it should just return true just like the "real" sgx_epc_get_section does when SGX is disabled. Reported-by: Vladimír Beneš <vbenes@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Message-ID: <20220201190941.106001-1-pbonzini@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-12-29target/i386: implement CMPccXADDPaolo Bonzini5-1/+133
The main difficulty here is that a page fault when writing to the destination must not overwrite the flags. Therefore, the flags computation must be inlined instead of using gen_jcc1*. For simplicity, I am using an unconditional cmpxchg operation, that becomes a NOP if the comparison fails. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-12-29target/i386: introduce flags writeback mechanismPaolo Bonzini6-13/+101
ALU instructions can write to both memory and flags. If the CC_SRC* and CC_DST locations have been written already when a memory access causes a fault, the value in CC_SRC* and CC_DST might be interpreted with the wrong CC_OP (the one that is in effect before the instruction. Besides just using the wrong result for the flags, something like subtracting -1 can have disastrous effects if the current CC_OP is CC_OP_EFLAGS: this is because QEMU does not expect bits outside the ALU flags to be set in CC_SRC, and env->eflags can end up set to all-ones. In the case of the attached testcase, this sets IOPL to 3 and would cause an assertion failure if SUB is moved to the new decoder. This mechanism is not really needed for BMI instructions, which can only write to a register, but put it to use anyway for cleanliness. In the case of BZHI, the code has to be modified slightly to ensure that decode->cc_src is written, otherwise the new assertions trigger. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-12-29target/i386: adjust decoding of J operandPaolo Bonzini1-10/+0
gen_jcc() has been changed to accept a relative offset since the new decoder was written. Adjust the J operand, which is meant to be used with jump instructions such as gen_jcc(), to not include the program counter and to not truncate the result, as both operations are now performed by common code. The result is that J is now the same as the I operand. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-12-29target/i386: move operand load and writeback out of gen_cmovcc1Paolo Bonzini1-10/+6
Similar to gen_setcc1, make gen_cmovcc1 receive TCGv. This is more friendly to simultaneous implementation in the old and the new decoder. A small wart is that s->T0 of CMOV is currently the *second* argument (which would ordinarily be in T1). Therefore, the condition has to be inverted in order to overwrite s->T0 with cpu_regs[reg] if the MOV is not performed. This only applies to the old decoder, and this code will go away soon. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-12-29target/i386: prepare for implementation of STOS/SCAS in new decoderPaolo Bonzini1-2/+7
Do not use gen_op, and pull the load from the accumulator into disas_insn. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-12-29target/i386: do not use s->tmp0 for jumps on ECX ==/!= 0Paolo Bonzini1-3/+6
Create a new temporary, to ease the register allocator's work. Creation of the temporary is pushed into gen_ext_tl, which also allows NULL as the first parameter now. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-12-29target/i386: do not use s->tmp4 for pushPaolo Bonzini1-1/+1
Just create a temporary for the occasion. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-12-29target/i386: split eflags computation out of gen_compute_eflagsPaolo Bonzini1-9/+19
The new x86 decoder wants the gen_* functions to compute EFLAGS before writeback, which can be an issue for instructions with a memory destination such as ARPL or shifts. Extract code to compute the EFLAGS without clobbering CC_SRC, in case the memory write causes a fault. The flags writeback mechanism will take care of copying the result to CC_SRC. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-12-29target/i386: do not clobber T0 on string operationsPaolo Bonzini1-21/+24
The new decoder would rather have the operand in T0 when expanding SCAS, rather than use R_EAX directly as gen_scas currently does. This makes SCAS more similar to CMP and SUB, in that CC_DST = T0 - T1. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-12-29target/i386: do not clobber A0 in POP translationPaolo Bonzini1-14/+20
The new decoder likes to compute the address in A0 very early, so the gen_lea_v_seg in gen_pop_T0 would clobber the address of the memory operand. Instead use T0 since it is already available and will be overwritten immediately after. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-12-29target/i386: do not decode string source/destination into decode->memPaolo Bonzini1-18/+2
decode->mem is only used if one operand has has_ea == true. String operations will not use decode->mem and will load A0 on their own, because they are the only case of two memory operands in a single instruction. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-12-29target/i386: add X86_SPECIALs for MOVSX and MOVZXPaolo Bonzini3-24/+40
Usually the registers are just moved into s->T0 without much care for their operand size. However, in some cases we can get more efficient code if the operand fetching logic syncs with the emission function on what is nicer. All the current uses are mostly demonstrative and only reduce the code in the emission functions, because the instructions do not support memory operands. However the logic is generic and applies to several more instructions such as MOVSXD (aka movslq), one-byte shift instructions, multiplications, XLAT, and indirect calls/jumps. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-12-29target/i386: rename zext0/zext2 and make them closer to the manualPaolo Bonzini2-12/+21
X86_SPECIAL_ZExtOp0 and X86_SPECIAL_ZExtOp2 are poorly named; they are a hack that is needed by scalar insertion and extraction instructions, and not really related to zero extension: for PEXTR the zero extension is done by the generation functions, for PINSR the high bits are not used at all and in fact are *not* filled with zeroes when loaded into s->T1. Rename the values to match the effect described in the manual, and explain better in the comments. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-12-29target/i386: avoid trunc and ext for MULX and RORXPaolo Bonzini1-10/+23
Use _tl operations for 32-bit operands on 32-bit targets, and only go through trunc and extu ops for 64-bit targets. While the trunc/ext ops should be pretty much free after optimization, the optimizer also does not like having the same temporary used in multiple EBBs. Therefore it is nicer to not use tmpN* unless necessary. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-12-29target/i386: reimplement check for validity of LOCK prefixPaolo Bonzini3-12/+13
The previous check erroneously allowed CMP to be modified with LOCK. Instead, tag explicitly the instructions that do support LOCK. Acked-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-12-29target/i386: document more deviations from the manualPaolo Bonzini1-0/+12
Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-12-29target/i386: clean up cpu_cc_compute_allPaolo Bonzini6-20/+18
cpu_cc_compute_all() has an argument that is always equal to CC_OP for historical reasons (dating back to commit a7812ae4123, "TCG variable type checking.", 2008-11-17, which added the argument to helper_cc_compute_all). It does not make sense for the argument to have any other value, so remove it and clean up some lines that are not too long anymore. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-12-29target/i386: remove unnecessary truncationsPaolo Bonzini2-5/+1
gen_lea_v_seg (called by gen_add_A0_ds_seg) already zeroes any bits of s->A0 beyond s->aflag. It does so before summing the segment base and, if not in 64-bit mode, also after summing it. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-12-29target/i386: remove unnecessary arguments from raise_interruptPaolo Bonzini3-7/+5
is_int is always 1, and error_code is always zero. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-12-29target/i386: speedup JO/SETO after MUL or IMULPaolo Bonzini1-0/+3
OF is equal to the carry flag, so use the same CCPrepare. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-12-29target/i386: optimize computation of JL and JLE from flagsPaolo Bonzini1-6/+4
Take advantage of the fact that there can be no 1 bits between SF and OF. If they were adjacent, you could sum SF and get a carry only if SF was already set. Then the value of OF in the sum is the XOR of OF itself, the carry (which is SF) and 0 (the value of the OF bit in the addend): this is OF^SF exactly. Because OF and SF are not adjacent, just place more 1 bits to the left so that the carry propagates, which means summing CC_O - CC_S. Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-12-22configure: use a native non-cross compiler for linux-userPaolo Bonzini1-2/+2
Commit c2118e9e1ab ("configure: don't try a "native" cross for linux-user", 2023-11-23) sought to avoid issues with using the native compiler with a cross-endian or cross-bitness setup. However, in doing so it ended up requiring a cross compiler setup (and most likely a slow compiler setup) even when building TCG tests that are native to the host architecture. Always allow the host compiler in that case. Cc: qemu-stable@nongnu.org Fixes: c2118e9e1ab ("configure: don't try a "native" cross for linux-user", 2023-11-23) Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-12-20tests/unit/test-qmp-event: Replace fixture by global variablesMarkus Armbruster1-61/+30
The fixture buys us exactly nothing, as we need a global variable anyway, for test_qapi_event_emit(). Drop it. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-ID: <20231122072456.2518816-4-armbru@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-12-20tests/unit/test-qmp-event: Simplify event emission checkMarkus Armbruster1-20/+10
The generated qapi_event_send_FOO() call an event emitter function. It's test_qapi_event_emit() in this test. It compares the actual event to the expected event, and sets a flag to record it was called. The test functions set expected data and clear the flag before calling qapi_event_send_FOO(), and check the flag afterwards. Make test_qapi_event_emit() consume expected data, and the test functions check it was consumed. Delete the flag. This is simpler. It also catches extraneous calls of test_qapi_event_emit(). Catching that is not worthwhile, but since the cost is negative... Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-ID: <20231122072456.2518816-3-armbru@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-12-20tests/unit/test-qmp-event: Drop superfluous mutexMarkus Armbruster1-5/+0
Mutex @test_event_lock is held from fixture setup to teardown, protecting global variable @test_event_data. But tests always run one after the other, so this is superfluous. It also confuses Coverity. Drop the mutex. Fixes: CID 1527425 Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-ID: <20231122072456.2518816-2-armbru@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-12-20tests/qtest/npcm7xx_pwm-test: Only do full testing in slow modeThomas Huth1-3/+10
The npcm7xx_pwm-test can take quite a while when running with --enable-debug on a loaded system. The tests here are quite repetitive - by default it should be fine if we only execute some of them and only execute all when running in slow testing mode. Message-ID: <20231215143524.49241-1-thuth@redhat.com> Reviewed-by: "Daniel P. Berrangé" <berrange@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-12-20qemu-options: Clarify handling of commas in options parametersYihuan Pan3-0/+14
Provide explicit guidance on dealing with option parameters as arbitrary strings containing commas, such as in "file=my,file" and "string=a,b". The updated documentation emphasizes the need to double commas when they appear within such parameters. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1839 Signed-off-by: Yihuan Pan <xun794@gmail.com> Message-ID: <20231213141706.629833-2-xun794@gmail.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-12-20tests/qtest/migration-test: Fix analyze-migration.py for s390xThomas Huth2-5/+34
The migration stream on s390x contains data for the storage_attributes which the analyze-migration.py cannot handle yet. Add the basic code for handling this, so we can re-enable the check in the migration-test. Message-ID: <20231120113951.162090-1-thuth@redhat.com> Reviewed-by: Fabiano Rosas <farosas@suse.de> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-12-20qom/object: Limit type names to alphanumerical and some few special charactersThomas Huth1-0/+41
QOM names currently don't have any enforced naming rules. This can be problematic, e.g. when they are used on the command line for the "-device" option (where the comma is used to separate properties). To avoid that such problematic type names come in again, let's restrict the set of acceptable characters during the type registration. Ideally, we'd apply here the same rules as for QAPI, i.e. all type names should begin with a letter, and contain only ASCII letters, digits, hyphen, and underscore. However, we already have so many pre-existing types like: 486-x86_64-cpu cfi.pflash01 power5+_v2.1-spapr-cpu-core virt-2.6-machine pc-i440fx-3.0-machine ... so that we have to allow "." and "+" for now, too. While the dot is used in a lot of places, the "+" can fortunately be limited to two classes of legacy names ("power" and "Sun-UltraSparc" CPUs). We also cannot enforce the rule that names must start with a letter yet, since there are lot of types that start with a digit. Still, at least limiting the first characters to the alphanumerical range should be way better than nothing. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-ID: <20231117114457.177308-6-thuth@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Thomas Huth <thuth@redhat.com>