[v2,6/8] qom: introduce qdev_new_dynamic()

Commit Message

Daniel P. Berrangé Nov. 11, 2024, 3:55 p.m. UTC

qdev_new() has a failure scenario where it will assert() if given
an abstract type. Callers which are creating qdevs based on user
input, or unknown/untrusted type names, must manually check the
result of qdev_class_is_abstract() before calling qdev_new()
to propagate an Error, instead of asserting.

Introduce a qdev_new_dynamic() method which is a counterpart to
qdev_new() that directly returns an Error, instead of asserting.
This new method is to be used where the typename is specified
dynamically by code separate from the immediate caller.

Do likewise with qdev_try_new_dynamic() as a counterpart to
qdev_try_new().

Signed-off-by: Daniel P. Berrangé <[e-mail]>
---
 hw/core/qdev.c         | 14 +++++++++++
 include/hw/qdev-core.h | 54 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 68 insertions(+)

Comments

Peter Xu Nov. 14, 2024, 8:47 p.m. UTC | #1

On Mon, Nov 11, 2024 at 03:55:53PM +0000, Daniel P. Berrangé wrote:
> qdev_new() has a failure scenario where it will assert() if given
> an abstract type. Callers which are creating qdevs based on user
> input, or unknown/untrusted type names, must manually check the
> result of qdev_class_is_abstract() before calling qdev_new()
> to propagate an Error, instead of asserting.
> 
> Introduce a qdev_new_dynamic() method which is a counterpart to
> qdev_new() that directly returns an Error, instead of asserting.
> This new method is to be used where the typename is specified
> dynamically by code separate from the immediate caller.
> 
> Do likewise with qdev_try_new_dynamic() as a counterpart to
> qdev_try_new().

Since at it, would it make sense to simply replace qdev_try_new() with
qdev_new_dynamic(), assuming it plays similar role of "it can fail" version
of qdev_new()?

Then instead of four helpers, we stick with two helpers, one that asserts
the qdev new will succeed (qdev_new()), the other one that allows any kind
of errors (qdev_new_dynamic()).  Then we can drop qdev_try_new()
altogether, and avoid adding one more for it too.

The qdev_try_new() four call sites can still pass in errp==NULL, which
should be the old behavior, so we don't need to touch isa/usb callers.

PS: looks like usb_try_new() only has one caller.. so maybe prone to be
dropped altogether..

Patch

diff --git a/hw/core/qdev.c b/hw/core/qdev.c
index b32db8618e..10a7b87c3d 100644
--- a/hw/core/qdev.c
+++ b/hw/core/qdev.c
@@ -149,6 +149,11 @@  DeviceState *qdev_new(const char *name)
     return DEVICE(object_new_dynamic(name, &error_abort));
 }
 
+DeviceState *qdev_new_dynamic(const char *name, Error **errp)
+{
+    return DEVICE(object_new_dynamic(name, errp));
+}
+
 DeviceState *qdev_try_new(const char *name)
 {
     ObjectClass *oc = module_object_class_by_name(name);
@@ -158,6 +163,15 @@  DeviceState *qdev_try_new(const char *name)
     return DEVICE(object_new_with_class(oc, &error_abort));
 }
 
+DeviceState *qdev_try_new_dynamic(const char *name, Error **errp)
+{
+    ObjectClass *oc = module_object_class_by_name(name);
+    if (!oc) {
+        return NULL;
+    }
+    return DEVICE(object_new_with_class(oc, errp));
+}
+
 static QTAILQ_HEAD(, DeviceListener) device_listeners
     = QTAILQ_HEAD_INITIALIZER(device_listeners);
 
diff --git a/include/hw/qdev-core.h b/include/hw/qdev-core.h
index 5be9844412..68ebaec058 100644
--- a/include/hw/qdev-core.h
+++ b/include/hw/qdev-core.h
@@ -435,26 +435,80 @@  compat_props_add(GPtrArray *arr,
  * qdev_new: Create a device on the heap
  * @name: device type to create (we assert() that this type exists)
  *
+ * This method should be used where @name is statically specified
+ * from a const string at build time, where the caller does not expect
+ * failure to be possible.
+ *
  * This only allocates the memory and initializes the device state
  * structure, ready for the caller to set properties if they wish.
  * The device still needs to be realized.
  *
+ * If an instance of @name is not permitted to be instantiated, an
+ * assert will be raised. This can happen if @name is abstract.
+ *
  * Return: a derived DeviceState object with a reference count of 1.
  */
 DeviceState *qdev_new(const char *name);
 
+/**
+ * qdev_new_dynamic: Create a device on the heap
+ * @name: device type to create (we assert() that this type exists)
+ * @errp: pointer to be filled with error details on failure
+ *
+ * This method must be used where @name is dynamically chosen
+ * at runtime, which has the possibility of unexpected choices leading
+ * to failures.
+ *
+ * This only allocates the memory and initializes the device state
+ * structure, ready for the caller to set properties if they wish.
+ * The device still needs to be realized.
+ *
+ * If an instance of @name is not permitted to be instantiated, an
+ * error will be reported. This can happen if @name is abstract.
+ *
+ * Return: a derived DeviceState object with a reference count of 1.
+ */
+DeviceState *qdev_new_dynamic(const char *name, Error **errp);
+
 /**
  * qdev_try_new: Try to create a device on the heap
  * @name: device type to create
  *
+ * This method should be used where @name is statically specified
+ * from a const string at build time, where the caller does not expect
+ * failure to be possible.
+ *
  * This is like qdev_new(), except it returns %NULL when type @name
  * does not exist, rather than asserting.
  *
+ * If an instance of @name is not permitted to be instantiated, an
+ * assert will be raised. This can happen if @name is abstract.
+ *
  * Return: a derived DeviceState object with a reference count of 1 or
  * NULL if type @name does not exist.
  */
 DeviceState *qdev_try_new(const char *name);
 
+/**
+ * qdev_try_new_dynamic: Try to create a device on the heap
+ * @name: device type to create
+ * @errp: pointer to be filled with error details on failure
+ *
+ * This method must be used where @name is dynamically chosen
+ * at runtime, which has the possibility of unexpected choices leading
+ * to failures.
+ *
+ * This is like qdev_new_dynamic(), except it returns %NULL when type @name
+ * does not exist, rather than asserting.
+ *
+ * If an instance of @name is not permitted to be instantiated, an
+ * error will be reported. This can happen if @name is abstract.
+ *
+ * Return: a derived DeviceState object with a reference count of 1 or
+ * NULL if type @name does not exist.
+ */
+DeviceState *qdev_try_new_dynamic(const char *name, Error **errp);
+
 /**
  * qdev_is_realized() - check if device is realized
  * @dev: The device to check.