Bug Summary

File:hw/xtensa/xtensa_sim.c
Location:line 100, column 21
Description:Access to field 'pc' results in a dereference of a null pointer (loaded from variable 'env')

Annotated Source Code

1/*
2 * Copyright (c) 2011, Max Filippov, Open Source and Linux Lab.
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions are met:
7 * * Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer.
9 * * Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the
11 * documentation and/or other materials provided with the distribution.
12 * * Neither the name of the Open Source and Linux Lab nor the
13 * names of its contributors may be used to endorse or promote products
14 * derived from this software without specific prior written permission.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
17 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
20 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
21 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
22 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
23 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
24 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
25 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26 */
27
28#include "sysemu/sysemu.h"
29#include "hw/boards.h"
30#include "hw/loader.h"
31#include "elf.h"
32#include "exec/memory.h"
33#include "exec/address-spaces.h"
34
35static uint64_t translate_phys_addr(void *opaque, uint64_t addr)
36{
37 XtensaCPU *cpu = opaque;
38
39 return cpu_get_phys_page_debug(CPU(cpu)((CPUState *)object_dynamic_cast_assert(((Object *)((cpu))), (
"cpu"), "/home/stefan/src/qemu/qemu.org/qemu/hw/xtensa/xtensa_sim.c"
, 39, __func__)), addr);
40}
41
42static void sim_reset(void *opaque)
43{
44 XtensaCPU *cpu = opaque;
45
46 cpu_reset(CPU(cpu)((CPUState *)object_dynamic_cast_assert(((Object *)((cpu))), (
"cpu"), "/home/stefan/src/qemu/qemu.org/qemu/hw/xtensa/xtensa_sim.c"
, 46, __func__)));
47}
48
49static void xtensa_sim_init(QEMUMachineInitArgs *args)
50{
51 XtensaCPU *cpu = NULL((void*)0);
52 CPUXtensaState *env = NULL((void*)0);
1
'env' initialized to a null pointer value
→
53 MemoryRegion *ram, *rom;
54 ram_addr_t ram_size = args->ram_size;
55 const char *cpu_model = args->cpu_model;
56 const char *kernel_filename = args->kernel_filename;
57 int n;
58
59 if (!cpu_model) {
2
←
Assuming 'cpu_model' is non-null
→
3
←
Taking false branch
→
60 cpu_model = XTENSA_DEFAULT_CPU_MODEL"fsf";
61 }
62
63 for (n = 0; n < smp_cpus; n++) {
4
←
Assuming 'n' is >= 'smp_cpus'
→
5
←
Loop condition is false. Execution continues on line 79
→
64 cpu = cpu_xtensa_init(cpu_model);
65 if (cpu == NULL((void*)0)) {
66 fprintf(stderrstderr, "Unable to find CPU definition\n");
67 exit(1);
68 }
69 env = &cpu->env;
70
71 env->sregs[PRID] = n;
72 qemu_register_reset(sim_reset, cpu);
73 /* Need MMU initialized prior to ELF loading,
74 * so that ELF gets loaded into virtual addresses
75 */
76 sim_reset(cpu);
77 }
78
79 ram = g_malloc(sizeof(*ram));
80 memory_region_init_ram(ram, NULL((void*)0), "xtensa.sram", ram_size);
81 vmstate_register_ram_global(ram);
82 memory_region_add_subregion(get_system_memory(), 0, ram);
83
84 rom = g_malloc(sizeof(*rom));
85 memory_region_init_ram(rom, NULL((void*)0), "xtensa.rom", 0x1000);
86 vmstate_register_ram_global(rom);
87 memory_region_add_subregion(get_system_memory(), 0xfe000000, rom);
88
89 if (kernel_filename) {
6
←
Assuming 'kernel_filename' is non-null
→
7
←
Taking true branch
→
90 uint64_t elf_entry;
91 uint64_t elf_lowaddr;
92#ifdef TARGET_WORDS_BIGENDIAN1
93 int success = load_elf(kernel_filename, translate_phys_addr, cpu,
94 &elf_entry, &elf_lowaddr, NULL((void*)0), 1, ELF_MACHINE94, 0);
95#else
96 int success = load_elf(kernel_filename, translate_phys_addr, cpu,
97 &elf_entry, &elf_lowaddr, NULL((void*)0), 0, ELF_MACHINE94, 0);
98#endif
99 if (success > 0) {
8
←
Assuming 'success' is > 0
→
9
←
Taking true branch
→
100 env->pc = elf_entry;
10
←
Access to field 'pc' results in a dereference of a null pointer (loaded from variable 'env')
101 }
102 }
103}
104
105static QEMUMachine xtensa_sim_machine = {
106 .name = "sim",
107 .desc = "sim machine (" XTENSA_DEFAULT_CPU_MODEL"fsf" ")",
108 .is_default = true1,
109 .init = xtensa_sim_init,
110 .max_cpus = 4,
111};
112
113static void xtensa_sim_machine_init(void)
114{
115 qemu_register_machine(&xtensa_sim_machine);
116}
117
118machine_init(xtensa_sim_machine_init)static void __attribute__((constructor)) do_qemu_init_xtensa_sim_machine_init
(void) { register_module_init(xtensa_sim_machine_init, MODULE_INIT_MACHINE
); };