Bug Summary

File:hw/openrisc/openrisc_sim.c
Location:line 89, column 21
Description:Dereference of null pointer

Annotated Source Code

1/*
2 * OpenRISC simulator for use as an IIS.
3 *
4 * Copyright (c) 2011-2012 Jia Liu <proljc@gmail.com>
5 * Feng Gao <gf91597@gmail.com>
6 *
7 * This library is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU Lesser General Public
9 * License as published by the Free Software Foundation; either
10 * version 2 of the License, or (at your option) any later version.
11 *
12 * This library is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * Lesser General Public License for more details.
16 *
17 * You should have received a copy of the GNU Lesser General Public
18 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
19 */
20
21#include "hw/hw.h"
22#include "hw/boards.h"
23#include "elf.h"
24#include "hw/char/serial.h"
25#include "net/net.h"
26#include "hw/loader.h"
27#include "exec/address-spaces.h"
28#include "sysemu/sysemu.h"
29#include "hw/sysbus.h"
30#include "sysemu/qtest.h"
31
32#define KERNEL_LOAD_ADDR0x100 0x100
33
34static void main_cpu_reset(void *opaque)
35{
36 OpenRISCCPU *cpu = opaque;
37
38 cpu_reset(CPU(cpu)((CPUState *)object_dynamic_cast_assert(((Object *)((cpu))), (
"cpu"), "/home/stefan/src/qemu/qemu.org/qemu/hw/openrisc/openrisc_sim.c"
, 38, __func__)));
39}
40
41static void openrisc_sim_net_init(MemoryRegion *address_space,
42 hwaddr base,
43 hwaddr descriptors,
44 qemu_irq irq, NICInfo *nd)
45{
46 DeviceState *dev;
47 SysBusDevice *s;
48
49 dev = qdev_create(NULL((void*)0), "open_eth");
50 qdev_set_nic_properties(dev, nd);
51 qdev_init_nofail(dev);
52
53 s = SYS_BUS_DEVICE(dev)((SysBusDevice *)object_dynamic_cast_assert(((Object *)((dev)
)), ("sys-bus-device"), "/home/stefan/src/qemu/qemu.org/qemu/hw/openrisc/openrisc_sim.c"
, 53, __func__));
54 sysbus_connect_irq(s, 0, irq);
55 memory_region_add_subregion(address_space, base,
56 sysbus_mmio_get_region(s, 0));
57 memory_region_add_subregion(address_space, descriptors,
58 sysbus_mmio_get_region(s, 1));
59}
60
61static void cpu_openrisc_load_kernel(ram_addr_t ram_size,
62 const char *kernel_filename,
63 OpenRISCCPU *cpu)
64{
65 long kernel_size;
66 uint64_t elf_entry;
67 hwaddr entry;
68
69 if (kernel_filename && !qtest_enabled()) {
9
←
Taking true branch
→
70 kernel_size = load_elf(kernel_filename, NULL((void*)0), NULL((void*)0),
71 &elf_entry, NULL((void*)0), NULL((void*)0), 1, ELF_MACHINE92, 1);
72 entry = elf_entry;
73 if (kernel_size < 0) {
10
←
Assuming 'kernel_size' is >= 0
→
11
←
Taking false branch
→
74 kernel_size = load_uimage(kernel_filename,
75 &entry, NULL((void*)0), NULL((void*)0));
76 }
77 if (kernel_size < 0) {
12
←
Taking false branch
→
78 kernel_size = load_image_targphys(kernel_filename,
79 KERNEL_LOAD_ADDR0x100,
80 ram_size - KERNEL_LOAD_ADDR0x100);
81 entry = KERNEL_LOAD_ADDR0x100;
82 }
83
84 if (kernel_size < 0) {
13
←
Taking false branch
→
85 fprintf(stderrstderr, "QEMU: couldn't load the kernel '%s'\n",
86 kernel_filename);
87 exit(1);
88 }
89 cpu->env.pc = entry;
14
←
Dereference of null pointer
90 }
91}
92
93static void openrisc_sim_init(QEMUMachineInitArgs *args)
94{
95 ram_addr_t ram_size = args->ram_size;
96 const char *cpu_model = args->cpu_model;
97 const char *kernel_filename = args->kernel_filename;
98 OpenRISCCPU *cpu = NULL((void*)0);
1
'cpu' initialized to a null pointer value
→
99 MemoryRegion *ram;
100 int n;
101
102 if (!cpu_model) {
2
←
Assuming 'cpu_model' is non-null
→
3
←
Taking false branch
→
103 cpu_model = "or1200";
104 }
105
106 for (n = 0; n < smp_cpus; n++) {
4
←
Assuming 'n' is >= 'smp_cpus'
→
5
←
Loop condition is false. Execution continues on line 116
→
107 cpu = cpu_openrisc_init(cpu_model);
108 if (cpu == NULL((void*)0)) {
109 fprintf(stderrstderr, "Unable to find CPU definition!\n");
110 exit(1);
111 }
112 qemu_register_reset(main_cpu_reset, cpu);
113 main_cpu_reset(cpu);
114 }
115
116 ram = g_malloc(sizeof(*ram));
117 memory_region_init_ram(ram, NULL((void*)0), "openrisc.ram", ram_size);
118 vmstate_register_ram_global(ram);
119 memory_region_add_subregion(get_system_memory(), 0, ram);
120
121 cpu_openrisc_pic_init(cpu);
122 cpu_openrisc_clock_init(cpu);
123
124 serial_mm_init(get_system_memory(), 0x90000000, 0, cpu->env.irq[2],
125 115200, serial_hds[0], DEVICE_NATIVE_ENDIAN);
126
127 if (nd_table[0].used) {
6
←
Taking false branch
→
128 openrisc_sim_net_init(get_system_memory(), 0x92000000,
129 0x92000400, cpu->env.irq[4], nd_table);
130 }
131
132 cpu_openrisc_load_kernel(ram_size, kernel_filename, cpu);
7
←
Passing null pointer value via 3rd parameter 'cpu'
→
8
←
Calling 'cpu_openrisc_load_kernel'
→
133}
134
135static QEMUMachine openrisc_sim_machine = {
136 .name = "or32-sim",
137 .desc = "or32 simulation",
138 .init = openrisc_sim_init,
139 .max_cpus = 1,
140 .is_default = 1,
141};
142
143static void openrisc_sim_machine_init(void)
144{
145 qemu_register_machine(&openrisc_sim_machine);
146}
147
148machine_init(openrisc_sim_machine_init)static void __attribute__((constructor)) do_qemu_init_openrisc_sim_machine_init
(void) { register_module_init(openrisc_sim_machine_init, MODULE_INIT_MACHINE
); };