Bug Summary

File:hw/usb/core.c
Location:line 807, column 5
Description:Access to field 'tqh_first' results in a dereference of a null pointer

Annotated Source Code

1/*
2 * QEMU USB emulation
3 *
4 * Copyright (c) 2005 Fabrice Bellard
5 *
6 * 2008 Generic packet handler rewrite by Max Krasnyansky
7 *
8 * Permission is hereby granted, free of charge, to any person obtaining a copy
9 * of this software and associated documentation files (the "Software"), to deal
10 * in the Software without restriction, including without limitation the rights
11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12 * copies of the Software, and to permit persons to whom the Software is
13 * furnished to do so, subject to the following conditions:
14 *
15 * The above copyright notice and this permission notice shall be included in
16 * all copies or substantial portions of the Software.
17 *
18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
21 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
24 * THE SOFTWARE.
25 */
26#include "qemu-common.h"
27#include "hw/usb.h"
28#include "qemu/iov.h"
29#include "trace.h"
30
31void usb_attach(USBPort *port)
32{
33 USBDevice *dev = port->dev;
34
35 assert(dev != NULL)((dev != ((void*)0)) ? (void) (0) : __assert_fail ("dev != ((void*)0)"
, "/home/stefan/src/qemu/qemu.org/qemu/hw/usb/core.c", 35, __PRETTY_FUNCTION__
));
36 assert(dev->attached)((dev->attached) ? (void) (0) : __assert_fail ("dev->attached"
, "/home/stefan/src/qemu/qemu.org/qemu/hw/usb/core.c", 36, __PRETTY_FUNCTION__
));
37 assert(dev->state == USB_STATE_NOTATTACHED)((dev->state == 0) ? (void) (0) : __assert_fail ("dev->state == 0"
, "/home/stefan/src/qemu/qemu.org/qemu/hw/usb/core.c", 37, __PRETTY_FUNCTION__
));
38 port->ops->attach(port);
39 dev->state = USB_STATE_ATTACHED1;
40 usb_device_handle_attach(dev);
41}
42
43void usb_detach(USBPort *port)
44{
45 USBDevice *dev = port->dev;
46
47 assert(dev != NULL)((dev != ((void*)0)) ? (void) (0) : __assert_fail ("dev != ((void*)0)"
, "/home/stefan/src/qemu/qemu.org/qemu/hw/usb/core.c", 47, __PRETTY_FUNCTION__
));
48 assert(dev->state != USB_STATE_NOTATTACHED)((dev->state != 0) ? (void) (0) : __assert_fail ("dev->state != 0"
, "/home/stefan/src/qemu/qemu.org/qemu/hw/usb/core.c", 48, __PRETTY_FUNCTION__
));
49 port->ops->detach(port);
50 dev->state = USB_STATE_NOTATTACHED0;
51}
52
53void usb_port_reset(USBPort *port)
54{
55 USBDevice *dev = port->dev;
56
57 assert(dev != NULL)((dev != ((void*)0)) ? (void) (0) : __assert_fail ("dev != ((void*)0)"
, "/home/stefan/src/qemu/qemu.org/qemu/hw/usb/core.c", 57, __PRETTY_FUNCTION__
));
58 usb_detach(port);
59 usb_attach(port);
60 usb_device_reset(dev);
61}
62
63void usb_device_reset(USBDevice *dev)
64{
65 if (dev == NULL((void*)0) || !dev->attached) {
66 return;
67 }
68 dev->remote_wakeup = 0;
69 dev->addr = 0;
70 dev->state = USB_STATE_DEFAULT3;
71 usb_device_handle_reset(dev);
72}
73
74void usb_wakeup(USBEndpoint *ep, unsigned int stream)
75{
76 USBDevice *dev = ep->dev;
77 USBBus *bus = usb_bus_from_device(dev);
78
79 if (dev->remote_wakeup && dev->port && dev->port->ops->wakeup) {
80 dev->port->ops->wakeup(dev->port);
81 }
82 if (bus->ops->wakeup_endpoint) {
83 bus->ops->wakeup_endpoint(bus, ep, stream);
84 }
85}
86
87/**********************/
88
89/* generic USB device helpers (you are not forced to use them when
90 writing your USB device driver, but they help handling the
91 protocol)
92*/
93
94#define SETUP_STATE_IDLE0 0
95#define SETUP_STATE_SETUP1 1
96#define SETUP_STATE_DATA2 2
97#define SETUP_STATE_ACK3 3
98#define SETUP_STATE_PARAM4 4
99
100static void do_token_setup(USBDevice *s, USBPacket *p)
101{
102 int request, value, index;
103
104 if (p->iov.size != 8) {
105 p->status = USB_RET_STALL(-3);
106 return;
107 }
108
109 usb_packet_copy(p, s->setup_buf, p->iov.size);
110 p->actual_length = 0;
111 s->setup_len = (s->setup_buf[7] << 8) | s->setup_buf[6];
112 s->setup_index = 0;
113
114 request = (s->setup_buf[0] << 8) | s->setup_buf[1];
115 value = (s->setup_buf[3] << 8) | s->setup_buf[2];
116 index = (s->setup_buf[5] << 8) | s->setup_buf[4];
117
118 if (s->setup_buf[0] & USB_DIR_IN0x80) {
119 usb_device_handle_control(s, p, request, value, index,
120 s->setup_len, s->data_buf);
121 if (p->status == USB_RET_ASYNC(-6)) {
122 s->setup_state = SETUP_STATE_SETUP1;
123 }
124 if (p->status != USB_RET_SUCCESS(0)) {
125 return;
126 }
127
128 if (p->actual_length < s->setup_len) {
129 s->setup_len = p->actual_length;
130 }
131 s->setup_state = SETUP_STATE_DATA2;
132 } else {
133 if (s->setup_len > sizeof(s->data_buf)) {
134 fprintf(stderrstderr,
135 "usb_generic_handle_packet: ctrl buffer too small (%d > %zu)\n",
136 s->setup_len, sizeof(s->data_buf));
137 p->status = USB_RET_STALL(-3);
138 return;
139 }
140 if (s->setup_len == 0)
141 s->setup_state = SETUP_STATE_ACK3;
142 else
143 s->setup_state = SETUP_STATE_DATA2;
144 }
145
146 p->actual_length = 8;
147}
148
149static void do_token_in(USBDevice *s, USBPacket *p)
150{
151 int request, value, index;
152
153 assert(p->ep->nr == 0)((p->ep->nr == 0) ? (void) (0) : __assert_fail ("p->ep->nr == 0"
, "/home/stefan/src/qemu/qemu.org/qemu/hw/usb/core.c", 153, __PRETTY_FUNCTION__
));
154
155 request = (s->setup_buf[0] << 8) | s->setup_buf[1];
156 value = (s->setup_buf[3] << 8) | s->setup_buf[2];
157 index = (s->setup_buf[5] << 8) | s->setup_buf[4];
158
159 switch(s->setup_state) {
160 case SETUP_STATE_ACK3:
161 if (!(s->setup_buf[0] & USB_DIR_IN0x80)) {
162 usb_device_handle_control(s, p, request, value, index,
163 s->setup_len, s->data_buf);
164 if (p->status == USB_RET_ASYNC(-6)) {
165 return;
166 }
167 s->setup_state = SETUP_STATE_IDLE0;
168 p->actual_length = 0;
169 }
170 break;
171
172 case SETUP_STATE_DATA2:
173 if (s->setup_buf[0] & USB_DIR_IN0x80) {
174 int len = s->setup_len - s->setup_index;
175 if (len > p->iov.size) {
176 len = p->iov.size;
177 }
178 usb_packet_copy(p, s->data_buf + s->setup_index, len);
179 s->setup_index += len;
180 if (s->setup_index >= s->setup_len) {
181 s->setup_state = SETUP_STATE_ACK3;
182 }
183 return;
184 }
185 s->setup_state = SETUP_STATE_IDLE0;
186 p->status = USB_RET_STALL(-3);
187 break;
188
189 default:
190 p->status = USB_RET_STALL(-3);
191 }
192}
193
194static void do_token_out(USBDevice *s, USBPacket *p)
195{
196 assert(p->ep->nr == 0)((p->ep->nr == 0) ? (void) (0) : __assert_fail ("p->ep->nr == 0"
, "/home/stefan/src/qemu/qemu.org/qemu/hw/usb/core.c", 196, __PRETTY_FUNCTION__
));
197
198 switch(s->setup_state) {
199 case SETUP_STATE_ACK3:
200 if (s->setup_buf[0] & USB_DIR_IN0x80) {
201 s->setup_state = SETUP_STATE_IDLE0;
202 /* transfer OK */
203 } else {
204 /* ignore additional output */
205 }
206 break;
207
208 case SETUP_STATE_DATA2:
209 if (!(s->setup_buf[0] & USB_DIR_IN0x80)) {
210 int len = s->setup_len - s->setup_index;
211 if (len > p->iov.size) {
212 len = p->iov.size;
213 }
214 usb_packet_copy(p, s->data_buf + s->setup_index, len);
215 s->setup_index += len;
216 if (s->setup_index >= s->setup_len) {
217 s->setup_state = SETUP_STATE_ACK3;
218 }
219 return;
220 }
221 s->setup_state = SETUP_STATE_IDLE0;
222 p->status = USB_RET_STALL(-3);
223 break;
224
225 default:
226 p->status = USB_RET_STALL(-3);
227 }
228}
229
230static void do_parameter(USBDevice *s, USBPacket *p)
231{
232 int i, request, value, index;
233
234 for (i = 0; i < 8; i++) {
235 s->setup_buf[i] = p->parameter >> (i*8);
236 }
237
238 s->setup_state = SETUP_STATE_PARAM4;
239 s->setup_len = (s->setup_buf[7] << 8) | s->setup_buf[6];
240 s->setup_index = 0;
241
242 request = (s->setup_buf[0] << 8) | s->setup_buf[1];
243 value = (s->setup_buf[3] << 8) | s->setup_buf[2];
244 index = (s->setup_buf[5] << 8) | s->setup_buf[4];
245
246 if (s->setup_len > sizeof(s->data_buf)) {
247 fprintf(stderrstderr,
248 "usb_generic_handle_packet: ctrl buffer too small (%d > %zu)\n",
249 s->setup_len, sizeof(s->data_buf));
250 p->status = USB_RET_STALL(-3);
251 return;
252 }
253
254 if (p->pid == USB_TOKEN_OUT0xe1) {
255 usb_packet_copy(p, s->data_buf, s->setup_len);
256 }
257
258 usb_device_handle_control(s, p, request, value, index,
259 s->setup_len, s->data_buf);
260 if (p->status == USB_RET_ASYNC(-6)) {
261 return;
262 }
263
264 if (p->actual_length < s->setup_len) {
265 s->setup_len = p->actual_length;
266 }
267 if (p->pid == USB_TOKEN_IN0x69) {
268 p->actual_length = 0;
269 usb_packet_copy(p, s->data_buf, s->setup_len);
270 }
271}
272
273/* ctrl complete function for devices which use usb_generic_handle_packet and
274 may return USB_RET_ASYNC from their handle_control callback. Device code
275 which does this *must* call this function instead of the normal
276 usb_packet_complete to complete their async control packets. */
277void usb_generic_async_ctrl_complete(USBDevice *s, USBPacket *p)
278{
279 if (p->status < 0) {
280 s->setup_state = SETUP_STATE_IDLE0;
281 }
282
283 switch (s->setup_state) {
284 case SETUP_STATE_SETUP1:
285 if (p->actual_length < s->setup_len) {
286 s->setup_len = p->actual_length;
287 }
288 s->setup_state = SETUP_STATE_DATA2;
289 p->actual_length = 8;
290 break;
291
292 case SETUP_STATE_ACK3:
293 s->setup_state = SETUP_STATE_IDLE0;
294 p->actual_length = 0;
295 break;
296
297 case SETUP_STATE_PARAM4:
298 if (p->actual_length < s->setup_len) {
299 s->setup_len = p->actual_length;
300 }
301 if (p->pid == USB_TOKEN_IN0x69) {
302 p->actual_length = 0;
303 usb_packet_copy(p, s->data_buf, s->setup_len);
304 }
305 break;
306
307 default:
308 break;
309 }
310 usb_packet_complete(s, p);
311}
312
313/* XXX: fix overflow */
314int set_usb_string(uint8_t *buf, const char *str)
315{
316 int len, i;
317 uint8_t *q;
318
319 q = buf;
320 len = strlen(str);
321 *q++ = 2 * len + 2;
322 *q++ = 3;
323 for(i = 0; i < len; i++) {
324 *q++ = str[i];
325 *q++ = 0;
326 }
327 return q - buf;
328}
329
330USBDevice *usb_find_device(USBPort *port, uint8_t addr)
331{
332 USBDevice *dev = port->dev;
333
334 if (dev == NULL((void*)0) || !dev->attached || dev->state != USB_STATE_DEFAULT3) {
335 return NULL((void*)0);
336 }
337 if (dev->addr == addr) {
338 return dev;
339 }
340 return usb_device_find_device(dev, addr);
341}
342
343static void usb_process_one(USBPacket *p)
344{
345 USBDevice *dev = p->ep->dev;
346
347 /*
348 * Handlers expect status to be initialized to USB_RET_SUCCESS, but it
349 * can be USB_RET_NAK here from a previous usb_process_one() call,
350 * or USB_RET_ASYNC from going through usb_queue_one().
351 */
352 p->status = USB_RET_SUCCESS(0);
353
354 if (p->ep->nr == 0) {
355 /* control pipe */
356 if (p->parameter) {
357 do_parameter(dev, p);
358 return;
359 }
360 switch (p->pid) {
361 case USB_TOKEN_SETUP0x2d:
362 do_token_setup(dev, p);
363 break;
364 case USB_TOKEN_IN0x69:
365 do_token_in(dev, p);
366 break;
367 case USB_TOKEN_OUT0xe1:
368 do_token_out(dev, p);
369 break;
370 default:
371 p->status = USB_RET_STALL(-3);
372 }
373 } else {
374 /* data pipe */
375 usb_device_handle_data(dev, p);
376 }
377}
378
379static void usb_queue_one(USBPacket *p)
380{
381 usb_packet_set_state(p, USB_PACKET_QUEUED);
382 QTAILQ_INSERT_TAIL(&p->ep->queue, p, queue)do { (p)->queue.tqe_next = ((void*)0); (p)->queue.tqe_prev
= (&p->ep->queue)->tqh_last; *(&p->ep->
queue)->tqh_last = (p); (&p->ep->queue)->tqh_last
= &(p)->queue.tqe_next; } while ( 0);
383 p->status = USB_RET_ASYNC(-6);
384}
385
386/* Hand over a packet to a device for processing. p->status ==
387 USB_RET_ASYNC indicates the processing isn't finished yet, the
388 driver will call usb_packet_complete() when done processing it. */
389void usb_handle_packet(USBDevice *dev, USBPacket *p)
390{
391 if (dev == NULL((void*)0)) {
392 p->status = USB_RET_NODEV(-1);
393 return;
394 }
395 assert(dev == p->ep->dev)((dev == p->ep->dev) ? (void) (0) : __assert_fail ("dev == p->ep->dev"
, "/home/stefan/src/qemu/qemu.org/qemu/hw/usb/core.c", 395, __PRETTY_FUNCTION__
));
396 assert(dev->state == USB_STATE_DEFAULT)((dev->state == 3) ? (void) (0) : __assert_fail ("dev->state == 3"
, "/home/stefan/src/qemu/qemu.org/qemu/hw/usb/core.c", 396, __PRETTY_FUNCTION__
));
397 usb_packet_check_state(p, USB_PACKET_SETUP);
398 assert(p->ep != NULL)((p->ep != ((void*)0)) ? (void) (0) : __assert_fail ("p->ep != ((void*)0)"
, "/home/stefan/src/qemu/qemu.org/qemu/hw/usb/core.c", 398, __PRETTY_FUNCTION__
));
399
400 /* Submitting a new packet clears halt */
401 if (p->ep->halted) {
402 assert(QTAILQ_EMPTY(&p->ep->queue))((((&p->ep->queue)->tqh_first == ((void*)0))) ? (
void) (0) : __assert_fail ("((&p->ep->queue)->tqh_first == ((void*)0))"
, "/home/stefan/src/qemu/qemu.org/qemu/hw/usb/core.c", 402, __PRETTY_FUNCTION__
));
403 p->ep->halted = false0;
404 }
405
406 if (QTAILQ_EMPTY(&p->ep->queue)((&p->ep->queue)->tqh_first == ((void*)0)) || p->ep->pipeline || p->stream) {
407 usb_process_one(p);
408 if (p->status == USB_RET_ASYNC(-6)) {
409 /* hcd drivers cannot handle async for isoc */
410 assert(p->ep->type != USB_ENDPOINT_XFER_ISOC)((p->ep->type != 1) ? (void) (0) : __assert_fail ("p->ep->type != 1"
, "/home/stefan/src/qemu/qemu.org/qemu/hw/usb/core.c", 410, __PRETTY_FUNCTION__
));
411 /* using async for interrupt packets breaks migration */
412 assert(p->ep->type != USB_ENDPOINT_XFER_INT ||((p->ep->type != 3 || (dev->flags & (1 << USB_DEV_FLAG_IS_HOST
))) ? (void) (0) : __assert_fail ("p->ep->type != 3 || (dev->flags & (1 << USB_DEV_FLAG_IS_HOST))"
, "/home/stefan/src/qemu/qemu.org/qemu/hw/usb/core.c", 413, __PRETTY_FUNCTION__
))
413 (dev->flags & (1 << USB_DEV_FLAG_IS_HOST)))((p->ep->type != 3 || (dev->flags & (1 << USB_DEV_FLAG_IS_HOST
))) ? (void) (0) : __assert_fail ("p->ep->type != 3 || (dev->flags & (1 << USB_DEV_FLAG_IS_HOST))"
, "/home/stefan/src/qemu/qemu.org/qemu/hw/usb/core.c", 413, __PRETTY_FUNCTION__
));
414 usb_packet_set_state(p, USB_PACKET_ASYNC);
415 QTAILQ_INSERT_TAIL(&p->ep->queue, p, queue)do { (p)->queue.tqe_next = ((void*)0); (p)->queue.tqe_prev
= (&p->ep->queue)->tqh_last; *(&p->ep->
queue)->tqh_last = (p); (&p->ep->queue)->tqh_last
= &(p)->queue.tqe_next; } while ( 0);
416 } else if (p->status == USB_RET_ADD_TO_QUEUE(-7)) {
417 usb_queue_one(p);
418 } else {
419 /*
420 * When pipelining is enabled usb-devices must always return async,
421 * otherwise packets can complete out of order!
422 */
423 assert(p->stream || !p->ep->pipeline ||((p->stream || !p->ep->pipeline || ((&p->ep->
queue)->tqh_first == ((void*)0))) ? (void) (0) : __assert_fail
("p->stream || !p->ep->pipeline || ((&p->ep->queue)->tqh_first == ((void*)0))"
, "/home/stefan/src/qemu/qemu.org/qemu/hw/usb/core.c", 424, __PRETTY_FUNCTION__
))
424 QTAILQ_EMPTY(&p->ep->queue))((p->stream || !p->ep->pipeline || ((&p->ep->
queue)->tqh_first == ((void*)0))) ? (void) (0) : __assert_fail
("p->stream || !p->ep->pipeline || ((&p->ep->queue)->tqh_first == ((void*)0))"
, "/home/stefan/src/qemu/qemu.org/qemu/hw/usb/core.c", 424, __PRETTY_FUNCTION__
));
425 if (p->status != USB_RET_NAK(-2)) {
426 usb_packet_set_state(p, USB_PACKET_COMPLETE);
427 }
428 }
429 } else {
430 usb_queue_one(p);
431 }
432}
433
434void usb_packet_complete_one(USBDevice *dev, USBPacket *p)
435{
436 USBEndpoint *ep = p->ep;
437
438 assert(p->stream || QTAILQ_FIRST(&ep->queue) == p)((p->stream || ((&ep->queue)->tqh_first) == p) ?
(void) (0) : __assert_fail ("p->stream || ((&ep->queue)->tqh_first) == p"
, "/home/stefan/src/qemu/qemu.org/qemu/hw/usb/core.c", 438, __PRETTY_FUNCTION__
));
439 assert(p->status != USB_RET_ASYNC && p->status != USB_RET_NAK)((p->status != (-6) && p->status != (-2)) ? (void
) (0) : __assert_fail ("p->status != (-6) && p->status != (-2)"
, "/home/stefan/src/qemu/qemu.org/qemu/hw/usb/core.c", 439, __PRETTY_FUNCTION__
));
440
441 if (p->status != USB_RET_SUCCESS(0) ||
442 (p->short_not_ok && (p->actual_length < p->iov.size))) {
443 ep->halted = true1;
444 }
445 usb_packet_set_state(p, USB_PACKET_COMPLETE);
446 QTAILQ_REMOVE(&ep->queue, p, queue)do { if (((p)->queue.tqe_next) != ((void*)0)) (p)->queue
.tqe_next->queue.tqe_prev = (p)->queue.tqe_prev; else (
&ep->queue)->tqh_last = (p)->queue.tqe_prev; *(p
)->queue.tqe_prev = (p)->queue.tqe_next; } while ( 0);
447 dev->port->ops->complete(dev->port, p);
448}
449
450/* Notify the controller that an async packet is complete. This should only
451 be called for packets previously deferred by returning USB_RET_ASYNC from
452 handle_packet. */
453void usb_packet_complete(USBDevice *dev, USBPacket *p)
454{
455 USBEndpoint *ep = p->ep;
456
457 usb_packet_check_state(p, USB_PACKET_ASYNC);
458 usb_packet_complete_one(dev, p);
459
460 while (!QTAILQ_EMPTY(&ep->queue)((&ep->queue)->tqh_first == ((void*)0))) {
461 p = QTAILQ_FIRST(&ep->queue)((&ep->queue)->tqh_first);
462 if (ep->halted) {
463 /* Empty the queue on a halt */
464 p->status = USB_RET_REMOVE_FROM_QUEUE(-8);
465 dev->port->ops->complete(dev->port, p);
466 continue;
467 }
468 if (p->state == USB_PACKET_ASYNC) {
469 break;
470 }
471 usb_packet_check_state(p, USB_PACKET_QUEUED);
472 usb_process_one(p);
473 if (p->status == USB_RET_ASYNC(-6)) {
474 usb_packet_set_state(p, USB_PACKET_ASYNC);
475 break;
476 }
477 usb_packet_complete_one(ep->dev, p);
478 }
479}
480
481/* Cancel an active packet. The packed must have been deferred by
482 returning USB_RET_ASYNC from handle_packet, and not yet
483 completed. */
484void usb_cancel_packet(USBPacket * p)
485{
486 bool_Bool callback = (p->state == USB_PACKET_ASYNC);
487 assert(usb_packet_is_inflight(p))((usb_packet_is_inflight(p)) ? (void) (0) : __assert_fail ("usb_packet_is_inflight(p)"
, "/home/stefan/src/qemu/qemu.org/qemu/hw/usb/core.c", 487, __PRETTY_FUNCTION__
));
488 usb_packet_set_state(p, USB_PACKET_CANCELED);
489 QTAILQ_REMOVE(&p->ep->queue, p, queue)do { if (((p)->queue.tqe_next) != ((void*)0)) (p)->queue
.tqe_next->queue.tqe_prev = (p)->queue.tqe_prev; else (
&p->ep->queue)->tqh_last = (p)->queue.tqe_prev
; *(p)->queue.tqe_prev = (p)->queue.tqe_next; } while (
0);
490 if (callback) {
491 usb_device_cancel_packet(p->ep->dev, p);
492 }
493}
494
495
496void usb_packet_init(USBPacket *p)
497{
498 qemu_iovec_init(&p->iov, 1);
499}
500
501static const char *usb_packet_state_name(USBPacketState state)
502{
503 static const char *name[] = {
504 [USB_PACKET_UNDEFINED] = "undef",
505 [USB_PACKET_SETUP] = "setup",
506 [USB_PACKET_QUEUED] = "queued",
507 [USB_PACKET_ASYNC] = "async",
508 [USB_PACKET_COMPLETE] = "complete",
509 [USB_PACKET_CANCELED] = "canceled",
510 };
511 if (state < ARRAY_SIZE(name)(sizeof(name) / sizeof((name)[0]))) {
512 return name[state];
513 }
514 return "INVALID";
515}
516
517void usb_packet_check_state(USBPacket *p, USBPacketState expected)
518{
519 USBDevice *dev;
520 USBBus *bus;
521
522 if (p->state == expected) {
523 return;
524 }
525 dev = p->ep->dev;
526 bus = usb_bus_from_device(dev);
527 trace_usb_packet_state_fault(bus->busnr, dev->port->path, p->ep->nr, p,
528 usb_packet_state_name(p->state),
529 usb_packet_state_name(expected));
530 assert(!"usb packet state check failed")((!"usb packet state check failed") ? (void) (0) : __assert_fail
("!\"usb packet state check failed\"", "/home/stefan/src/qemu/qemu.org/qemu/hw/usb/core.c"
, 530, __PRETTY_FUNCTION__));
531}
532
533void usb_packet_set_state(USBPacket *p, USBPacketState state)
534{
535 if (p->ep) {
536 USBDevice *dev = p->ep->dev;
537 USBBus *bus = usb_bus_from_device(dev);
538 trace_usb_packet_state_change(bus->busnr, dev->port->path, p->ep->nr, p,
539 usb_packet_state_name(p->state),
540 usb_packet_state_name(state));
541 } else {
542 trace_usb_packet_state_change(-1, "", -1, p,
543 usb_packet_state_name(p->state),
544 usb_packet_state_name(state));
545 }
546 p->state = state;
547}
548
549void usb_packet_setup(USBPacket *p, int pid,
550 USBEndpoint *ep, unsigned int stream,
551 uint64_t id, bool_Bool short_not_ok, bool_Bool int_req)
552{
553 assert(!usb_packet_is_inflight(p))((!usb_packet_is_inflight(p)) ? (void) (0) : __assert_fail ("!usb_packet_is_inflight(p)"
, "/home/stefan/src/qemu/qemu.org/qemu/hw/usb/core.c", 553, __PRETTY_FUNCTION__
));
554 assert(p->iov.iov != NULL)((p->iov.iov != ((void*)0)) ? (void) (0) : __assert_fail (
"p->iov.iov != ((void*)0)", "/home/stefan/src/qemu/qemu.org/qemu/hw/usb/core.c"
, 554, __PRETTY_FUNCTION__));
555 p->id = id;
556 p->pid = pid;
557 p->ep = ep;
558 p->stream = stream;
559 p->status = USB_RET_SUCCESS(0);
560 p->actual_length = 0;
561 p->parameter = 0;
562 p->short_not_ok = short_not_ok;
563 p->int_req = int_req;
564 p->combined = NULL((void*)0);
565 qemu_iovec_reset(&p->iov);
566 usb_packet_set_state(p, USB_PACKET_SETUP);
567}
568
569void usb_packet_addbuf(USBPacket *p, void *ptr, size_t len)
570{
571 qemu_iovec_add(&p->iov, ptr, len);
572}
573
574void usb_packet_copy(USBPacket *p, void *ptr, size_t bytes)
575{
576 QEMUIOVector *iov = p->combined ? &p->combined->iov : &p->iov;
577
578 assert(p->actual_length >= 0)((p->actual_length >= 0) ? (void) (0) : __assert_fail (
"p->actual_length >= 0", "/home/stefan/src/qemu/qemu.org/qemu/hw/usb/core.c"
, 578, __PRETTY_FUNCTION__));
579 assert(p->actual_length + bytes <= iov->size)((p->actual_length + bytes <= iov->size) ? (void) (0
) : __assert_fail ("p->actual_length + bytes <= iov->size"
, "/home/stefan/src/qemu/qemu.org/qemu/hw/usb/core.c", 579, __PRETTY_FUNCTION__
));
580 switch (p->pid) {
581 case USB_TOKEN_SETUP0x2d:
582 case USB_TOKEN_OUT0xe1:
583 iov_to_buf(iov->iov, iov->niov, p->actual_length, ptr, bytes);
584 break;
585 case USB_TOKEN_IN0x69:
586 iov_from_buf(iov->iov, iov->niov, p->actual_length, ptr, bytes);
587 break;
588 default:
589 fprintf(stderrstderr, "%s: invalid pid: %x\n", __func__, p->pid);
590 abort();
591 }
592 p->actual_length += bytes;
593}
594
595void usb_packet_skip(USBPacket *p, size_t bytes)
596{
597 QEMUIOVector *iov = p->combined ? &p->combined->iov : &p->iov;
598
599 assert(p->actual_length >= 0)((p->actual_length >= 0) ? (void) (0) : __assert_fail (
"p->actual_length >= 0", "/home/stefan/src/qemu/qemu.org/qemu/hw/usb/core.c"
, 599, __PRETTY_FUNCTION__));
600 assert(p->actual_length + bytes <= iov->size)((p->actual_length + bytes <= iov->size) ? (void) (0
) : __assert_fail ("p->actual_length + bytes <= iov->size"
, "/home/stefan/src/qemu/qemu.org/qemu/hw/usb/core.c", 600, __PRETTY_FUNCTION__
));
601 if (p->pid == USB_TOKEN_IN0x69) {
602 iov_memset(iov->iov, iov->niov, p->actual_length, 0, bytes);
603 }
604 p->actual_length += bytes;
605}
606
607size_t usb_packet_size(USBPacket *p)
608{
609 return p->combined ? p->combined->iov.size : p->iov.size;
610}
611
612void usb_packet_cleanup(USBPacket *p)
613{
614 assert(!usb_packet_is_inflight(p))((!usb_packet_is_inflight(p)) ? (void) (0) : __assert_fail ("!usb_packet_is_inflight(p)"
, "/home/stefan/src/qemu/qemu.org/qemu/hw/usb/core.c", 614, __PRETTY_FUNCTION__
));
615 qemu_iovec_destroy(&p->iov);
616}
617
618void usb_ep_reset(USBDevice *dev)
619{
620 int ep;
621
622 dev->ep_ctl.nr = 0;
623 dev->ep_ctl.type = USB_ENDPOINT_XFER_CONTROL0;
624 dev->ep_ctl.ifnum = 0;
625 dev->ep_ctl.max_packet_size = 64;
626 dev->ep_ctl.max_streams = 0;
627 dev->ep_ctl.dev = dev;
628 dev->ep_ctl.pipeline = false0;
629 for (ep = 0; ep < USB_MAX_ENDPOINTS15; ep++) {
630 dev->ep_in[ep].nr = ep + 1;
631 dev->ep_out[ep].nr = ep + 1;
632 dev->ep_in[ep].pid = USB_TOKEN_IN0x69;
633 dev->ep_out[ep].pid = USB_TOKEN_OUT0xe1;
634 dev->ep_in[ep].type = USB_ENDPOINT_XFER_INVALID255;
635 dev->ep_out[ep].type = USB_ENDPOINT_XFER_INVALID255;
636 dev->ep_in[ep].ifnum = USB_INTERFACE_INVALID255;
637 dev->ep_out[ep].ifnum = USB_INTERFACE_INVALID255;
638 dev->ep_in[ep].max_packet_size = 0;
639 dev->ep_out[ep].max_packet_size = 0;
640 dev->ep_in[ep].max_streams = 0;
641 dev->ep_out[ep].max_streams = 0;
642 dev->ep_in[ep].dev = dev;
643 dev->ep_out[ep].dev = dev;
644 dev->ep_in[ep].pipeline = false0;
645 dev->ep_out[ep].pipeline = false0;
646 }
647}
648
649void usb_ep_init(USBDevice *dev)
650{
651 int ep;
652
653 usb_ep_reset(dev);
654 QTAILQ_INIT(&dev->ep_ctl.queue)do { (&dev->ep_ctl.queue)->tqh_first = ((void*)0); (
&dev->ep_ctl.queue)->tqh_last = &(&dev->
ep_ctl.queue)->tqh_first; } while ( 0);
655 for (ep = 0; ep < USB_MAX_ENDPOINTS15; ep++) {
656 QTAILQ_INIT(&dev->ep_in[ep].queue)do { (&dev->ep_in[ep].queue)->tqh_first = ((void*)0
); (&dev->ep_in[ep].queue)->tqh_last = &(&dev
->ep_in[ep].queue)->tqh_first; } while ( 0);
657 QTAILQ_INIT(&dev->ep_out[ep].queue)do { (&dev->ep_out[ep].queue)->tqh_first = ((void*)
0); (&dev->ep_out[ep].queue)->tqh_last = &(&
dev->ep_out[ep].queue)->tqh_first; } while ( 0);
658 }
659}
660
661void usb_ep_dump(USBDevice *dev)
662{
663 static const char *tname[] = {
664 [USB_ENDPOINT_XFER_CONTROL0] = "control",
665 [USB_ENDPOINT_XFER_ISOC1] = "isoc",
666 [USB_ENDPOINT_XFER_BULK2] = "bulk",
667 [USB_ENDPOINT_XFER_INT3] = "int",
668 };
669 int ifnum, ep, first;
670
671 fprintf(stderrstderr, "Device \"%s\", config %d\n",
672 dev->product_desc, dev->configuration);
673 for (ifnum = 0; ifnum < 16; ifnum++) {
674 first = 1;
675 for (ep = 0; ep < USB_MAX_ENDPOINTS15; ep++) {
676 if (dev->ep_in[ep].type != USB_ENDPOINT_XFER_INVALID255 &&
677 dev->ep_in[ep].ifnum == ifnum) {
678 if (first) {
679 first = 0;
680 fprintf(stderrstderr, " Interface %d, alternative %d\n",
681 ifnum, dev->altsetting[ifnum]);
682 }
683 fprintf(stderrstderr, " Endpoint %d, IN, %s, %d max\n", ep,
684 tname[dev->ep_in[ep].type],
685 dev->ep_in[ep].max_packet_size);
686 }
687 if (dev->ep_out[ep].type != USB_ENDPOINT_XFER_INVALID255 &&
688 dev->ep_out[ep].ifnum == ifnum) {
689 if (first) {
690 first = 0;
691 fprintf(stderrstderr, " Interface %d, alternative %d\n",
692 ifnum, dev->altsetting[ifnum]);
693 }
694 fprintf(stderrstderr, " Endpoint %d, OUT, %s, %d max\n", ep,
695 tname[dev->ep_out[ep].type],
696 dev->ep_out[ep].max_packet_size);
697 }
698 }
699 }
700 fprintf(stderrstderr, "--\n");
701}
702
703struct USBEndpoint *usb_ep_get(USBDevice *dev, int pid, int ep)
704{
705 struct USBEndpoint *eps;
706
707 if (dev == NULL((void*)0)) {
708 return NULL((void*)0);
709 }
710 eps = (pid == USB_TOKEN_IN0x69) ? dev->ep_in : dev->ep_out;
711 if (ep == 0) {
712 return &dev->ep_ctl;
713 }
714 assert(pid == USB_TOKEN_IN || pid == USB_TOKEN_OUT)((pid == 0x69 || pid == 0xe1) ? (void) (0) : __assert_fail ("pid == 0x69 || pid == 0xe1"
, "/home/stefan/src/qemu/qemu.org/qemu/hw/usb/core.c", 714, __PRETTY_FUNCTION__
));
715 assert(ep > 0 && ep <= USB_MAX_ENDPOINTS)((ep > 0 && ep <= 15) ? (void) (0) : __assert_fail
("ep > 0 && ep <= 15", "/home/stefan/src/qemu/qemu.org/qemu/hw/usb/core.c"
, 715, __PRETTY_FUNCTION__));
716 return eps + ep - 1;
717}
718
719uint8_t usb_ep_get_type(USBDevice *dev, int pid, int ep)
720{
721 struct USBEndpoint *uep = usb_ep_get(dev, pid, ep);
722 return uep->type;
723}
724
725void usb_ep_set_type(USBDevice *dev, int pid, int ep, uint8_t type)
726{
727 struct USBEndpoint *uep = usb_ep_get(dev, pid, ep);
728 uep->type = type;
729}
730
731uint8_t usb_ep_get_ifnum(USBDevice *dev, int pid, int ep)
732{
733 struct USBEndpoint *uep = usb_ep_get(dev, pid, ep);
734 return uep->ifnum;
735}
736
737void usb_ep_set_ifnum(USBDevice *dev, int pid, int ep, uint8_t ifnum)
738{
739 struct USBEndpoint *uep = usb_ep_get(dev, pid, ep);
740 uep->ifnum = ifnum;
741}
742
743void usb_ep_set_max_packet_size(USBDevice *dev, int pid, int ep,
744 uint16_t raw)
745{
746 struct USBEndpoint *uep = usb_ep_get(dev, pid, ep);
747 int size, microframes;
748
749 size = raw & 0x7ff;
750 switch ((raw >> 11) & 3) {
751 case 1:
752 microframes = 2;
753 break;
754 case 2:
755 microframes = 3;
756 break;
757 default:
758 microframes = 1;
759 break;
760 }
761 uep->max_packet_size = size * microframes;
762}
763
764int usb_ep_get_max_packet_size(USBDevice *dev, int pid, int ep)
765{
766 struct USBEndpoint *uep = usb_ep_get(dev, pid, ep);
767 return uep->max_packet_size;
768}
769
770void usb_ep_set_max_streams(USBDevice *dev, int pid, int ep, uint8_t raw)
771{
772 struct USBEndpoint *uep = usb_ep_get(dev, pid, ep);
773 int MaxStreams;
774
775 MaxStreams = raw & 0x1f;
776 if (MaxStreams) {
777 uep->max_streams = 1 << MaxStreams;
778 } else {
779 uep->max_streams = 0;
780 }
781}
782
783int usb_ep_get_max_streams(USBDevice *dev, int pid, int ep)
784{
785 struct USBEndpoint *uep = usb_ep_get(dev, pid, ep);
786 return uep->max_streams;
787}
788
789void usb_ep_set_pipeline(USBDevice *dev, int pid, int ep, bool_Bool enabled)
790{
791 struct USBEndpoint *uep = usb_ep_get(dev, pid, ep);
792 uep->pipeline = enabled;
793}
794
795void usb_ep_set_halted(USBDevice *dev, int pid, int ep, bool_Bool halted)
796{
797 struct USBEndpoint *uep = usb_ep_get(dev, pid, ep);
798 uep->halted = halted;
799}
800
801USBPacket *usb_ep_find_packet_by_id(USBDevice *dev, int pid, int ep,
802 uint64_t id)
803{
804 struct USBEndpoint *uep = usb_ep_get(dev, pid, ep);
805 USBPacket *p;
806
807 QTAILQ_FOREACH(p, &uep->queue, queue)for ((p) = ((&uep->queue)->tqh_first); (p); (p) = (
(p)->queue.tqe_next)) {
Within the expansion of the macro 'QTAILQ_FOREACH':
a
Access to field 'tqh_first' results in a dereference of a null pointer
808 if (p->id == id) {
809 return p;
810 }
811 }
812
813 return NULL((void*)0);
814}