API conversion
- Look for uses of malloc, and convert them to either g_malloc, g_new (more rarely g_try_malloc or g_try_new if a lot of memory is being allocated). Likewise, convert calloc to either g_new0 or g_try_new0. Drop return value checks unless using g_try_new/g_try_new0.
- Associate external libraries with the object files that actually use them
For all "QEMUTimer*" variables that are initialized with timer_new, change them to "QEMUTimer" and initialize them with timer_init. Drop any timer_free calls (there aren't many, so this patch would fix small memory leaks too). (not quite bite-sized).- Replace function named cpu_physical_memory_* with address_space_*.
- Change net/socket.c to use the functions in include/qemu/sockets.h instead of parse_host_port/bind/connect/listen.
- Change QemuMutex and QemuCond to CompatGMutex and CompatGCond (these are the same as GMutex and GCond, just with a different type).
Error checking
- Add checks for NULL return value to uses of load_image_targphys, qemu_find_file.
- Add checks for negative return value to uses of get_image_size, event_notifier_init.
- Introduce wrappers for strtol/strtoul/strtoll/strtoull, ensuring that errno is checked and, if NULL is passed as the second argument, that the whole string is a number. Example:
int qemu_strtol(const char *name, const char **next, int base, long *result)
{
char *p;
errno = 0;
*result = strtol(name, &p, base);
if (!next && *p) {
return -EINVAL;
}
if (next) {
*next = p;
}
return -errno;
}
Device lifecycle
- IDE uses qemu_add_vm_change_state_handler() without a corresponding qemu_del_vm_change_state_handler(). This means hot unplugging an AHCI PCI adapter results in a dangling change state handler and could lead to a crash.
Dead code removal
- hw/display contains files named *_template.h. These are included many times with different values of the DEPTH macro. However, only the DEPTH == 32 case is used. Remove support for DEPTH != 32 in the template headers and in the file that include them.
- Look for functions that are named *_exit or *_exitfn in hw/ and that return int. They should all return zero. Make them return void, and remove the checks for the callers.
- Once the above change is done, remove the "Error **" argument from functions named *_unrealize in hw/
Tracing
- Add tracepoints. All functions that are named something_helper, and all functions mentioned in MemoryRegionOps are good candidates.
