2 * Arm "Angel" semihosting syscalls
4 * Copyright (c) 2005, 2007 CodeSourcery.
5 * Copyright (c) 2019 Linaro
6 * Written by Paul Brook.
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, see <http://www.gnu.org/licenses/>.
21 * ARM Semihosting is documented in:
22 * Semihosting for AArch32 and AArch64 Release 2.0
23 * https://static.docs.arm.com/100863/0200/semihosting.pdf
26 #include "qemu/osdep.h"
29 #include "hw/semihosting/semihost.h"
30 #include "hw/semihosting/console.h"
32 #ifdef CONFIG_USER_ONLY
35 #define ARM_ANGEL_HEAP_SIZE (128 * 1024 * 1024)
37 #include "exec/gdbstub.h"
38 #include "qemu/cutils.h"
41 #define TARGET_SYS_OPEN 0x01
42 #define TARGET_SYS_CLOSE 0x02
43 #define TARGET_SYS_WRITEC 0x03
44 #define TARGET_SYS_WRITE0 0x04
45 #define TARGET_SYS_WRITE 0x05
46 #define TARGET_SYS_READ 0x06
47 #define TARGET_SYS_READC 0x07
48 #define TARGET_SYS_ISTTY 0x09
49 #define TARGET_SYS_SEEK 0x0a
50 #define TARGET_SYS_FLEN 0x0c
51 #define TARGET_SYS_TMPNAM 0x0d
52 #define TARGET_SYS_REMOVE 0x0e
53 #define TARGET_SYS_RENAME 0x0f
54 #define TARGET_SYS_CLOCK 0x10
55 #define TARGET_SYS_TIME 0x11
56 #define TARGET_SYS_SYSTEM 0x12
57 #define TARGET_SYS_ERRNO 0x13
58 #define TARGET_SYS_GET_CMDLINE 0x15
59 #define TARGET_SYS_HEAPINFO 0x16
60 #define TARGET_SYS_EXIT 0x18
61 #define TARGET_SYS_SYNCCACHE 0x19
63 /* ADP_Stopped_ApplicationExit is used for exit(0),
64 * anything else is implemented as exit(1) */
65 #define ADP_Stopped_ApplicationExit (0x20026)
71 #define GDB_O_RDONLY 0x000
72 #define GDB_O_WRONLY 0x001
73 #define GDB_O_RDWR 0x002
74 #define GDB_O_APPEND 0x008
75 #define GDB_O_CREAT 0x200
76 #define GDB_O_TRUNC 0x400
77 #define GDB_O_BINARY 0
79 static int gdb_open_modeflags
[12] = {
81 GDB_O_RDONLY
| GDB_O_BINARY
,
83 GDB_O_RDWR
| GDB_O_BINARY
,
84 GDB_O_WRONLY
| GDB_O_CREAT
| GDB_O_TRUNC
,
85 GDB_O_WRONLY
| GDB_O_CREAT
| GDB_O_TRUNC
| GDB_O_BINARY
,
86 GDB_O_RDWR
| GDB_O_CREAT
| GDB_O_TRUNC
,
87 GDB_O_RDWR
| GDB_O_CREAT
| GDB_O_TRUNC
| GDB_O_BINARY
,
88 GDB_O_WRONLY
| GDB_O_CREAT
| GDB_O_APPEND
,
89 GDB_O_WRONLY
| GDB_O_CREAT
| GDB_O_APPEND
| GDB_O_BINARY
,
90 GDB_O_RDWR
| GDB_O_CREAT
| GDB_O_APPEND
,
91 GDB_O_RDWR
| GDB_O_CREAT
| GDB_O_APPEND
| GDB_O_BINARY
94 static int open_modeflags
[12] = {
99 O_WRONLY
| O_CREAT
| O_TRUNC
,
100 O_WRONLY
| O_CREAT
| O_TRUNC
| O_BINARY
,
101 O_RDWR
| O_CREAT
| O_TRUNC
,
102 O_RDWR
| O_CREAT
| O_TRUNC
| O_BINARY
,
103 O_WRONLY
| O_CREAT
| O_APPEND
,
104 O_WRONLY
| O_CREAT
| O_APPEND
| O_BINARY
,
105 O_RDWR
| O_CREAT
| O_APPEND
,
106 O_RDWR
| O_CREAT
| O_APPEND
| O_BINARY
109 #ifdef CONFIG_USER_ONLY
110 static inline uint32_t set_swi_errno(TaskState
*ts
, uint32_t code
)
112 if (code
== (uint32_t)-1)
113 ts
->swi_errno
= errno
;
117 static inline uint32_t set_swi_errno(CPUARMState
*env
, uint32_t code
)
122 #include "exec/softmmu-semi.h"
125 static target_ulong arm_semi_syscall_len
;
127 #if !defined(CONFIG_USER_ONLY)
128 static target_ulong syscall_err
;
131 static void arm_semi_cb(CPUState
*cs
, target_ulong ret
, target_ulong err
)
133 ARMCPU
*cpu
= ARM_CPU(cs
);
134 CPUARMState
*env
= &cpu
->env
;
135 #ifdef CONFIG_USER_ONLY
136 TaskState
*ts
= cs
->opaque
;
138 target_ulong reg0
= is_a64(env
) ? env
->xregs
[0] : env
->regs
[0];
140 if (ret
== (target_ulong
)-1) {
141 #ifdef CONFIG_USER_ONLY
148 /* Fixup syscalls that use nonstardard return conventions. */
150 case TARGET_SYS_WRITE
:
151 case TARGET_SYS_READ
:
152 reg0
= arm_semi_syscall_len
- ret
;
154 case TARGET_SYS_SEEK
:
163 env
->xregs
[0] = reg0
;
169 static target_ulong
arm_flen_buf(ARMCPU
*cpu
)
171 /* Return an address in target memory of 64 bytes where the remote
172 * gdb should write its stat struct. (The format of this structure
173 * is defined by GDB's remote protocol and is not target-specific.)
174 * We put this on the guest's stack just below SP.
176 CPUARMState
*env
= &cpu
->env
;
188 static void arm_semi_flen_cb(CPUState
*cs
, target_ulong ret
, target_ulong err
)
190 ARMCPU
*cpu
= ARM_CPU(cs
);
191 CPUARMState
*env
= &cpu
->env
;
192 /* The size is always stored in big-endian order, extract
193 the value. We assume the size always fit in 32 bits. */
195 cpu_memory_rw_debug(cs
, arm_flen_buf(cpu
) + 32, (uint8_t *)&size
, 4, 0);
196 size
= be32_to_cpu(size
);
198 env
->xregs
[0] = size
;
202 #ifdef CONFIG_USER_ONLY
203 ((TaskState
*)cs
->opaque
)->swi_errno
= err
;
209 static target_ulong
arm_gdb_syscall(ARMCPU
*cpu
, gdb_syscall_complete_cb cb
,
210 const char *fmt
, ...)
213 CPUARMState
*env
= &cpu
->env
;
216 gdb_do_syscallv(cb
, fmt
, va
);
219 /* FIXME: we are implicitly relying on the syscall completing
220 * before this point, which is not guaranteed. We should
221 * put in an explicit synchronization between this and
222 * the callback function.
225 return is_a64(env
) ? env
->xregs
[0] : env
->regs
[0];
228 /* Read the input value from the argument block; fail the semihosting
229 * call if the memory read fails.
231 #define GET_ARG(n) do { \
233 if (get_user_u64(arg ## n, args + (n) * 8)) { \
237 if (get_user_u32(arg ## n, args + (n) * 4)) { \
243 #define SET_ARG(n, val) \
245 put_user_u64(val, args + (n) * 8) : \
246 put_user_u32(val, args + (n) * 4))
249 * Do a semihosting call.
251 * The specification always says that the "return register" either
252 * returns a specific value or is corrupted, so we don't need to
253 * report to our caller whether we are returning a value or trying to
254 * leave the register unchanged. We use 0xdeadbeef as the return value
255 * when there isn't a defined return value for the call.
257 target_ulong
do_arm_semihosting(CPUARMState
*env
)
259 ARMCPU
*cpu
= env_archcpu(env
);
260 CPUState
*cs
= env_cpu(env
);
262 target_ulong arg0
, arg1
, arg2
, arg3
;
267 #ifdef CONFIG_USER_ONLY
268 TaskState
*ts
= cs
->opaque
;
270 CPUARMState
*ts
= env
;
274 /* Note that the syscall number is in W0, not X0 */
275 nr
= env
->xregs
[0] & 0xffffffffU
;
276 args
= env
->xregs
[1];
283 case TARGET_SYS_OPEN
:
287 s
= lock_user_string(arg0
);
289 /* FIXME - should this error code be -TARGET_EFAULT ? */
293 unlock_user(s
, arg0
, 0);
296 if (strcmp(s
, ":tt") == 0) {
297 int result_fileno
= arg1
< 4 ? STDIN_FILENO
: STDOUT_FILENO
;
298 unlock_user(s
, arg0
, 0);
299 return result_fileno
;
301 if (use_gdb_syscalls()) {
302 ret
= arm_gdb_syscall(cpu
, arm_semi_cb
, "open,%s,%x,1a4", arg0
,
303 (int)arg2
+1, gdb_open_modeflags
[arg1
]);
305 ret
= set_swi_errno(ts
, open(s
, open_modeflags
[arg1
], 0644));
307 unlock_user(s
, arg0
, 0);
309 case TARGET_SYS_CLOSE
:
311 if (use_gdb_syscalls()) {
312 return arm_gdb_syscall(cpu
, arm_semi_cb
, "close,%x", arg0
);
314 return set_swi_errno(ts
, close(arg0
));
316 case TARGET_SYS_WRITEC
:
317 qemu_semihosting_console_outc(env
, args
);
319 case TARGET_SYS_WRITE0
:
320 return qemu_semihosting_console_outs(env
, args
);
321 case TARGET_SYS_WRITE
:
326 if (use_gdb_syscalls()) {
327 arm_semi_syscall_len
= len
;
328 return arm_gdb_syscall(cpu
, arm_semi_cb
, "write,%x,%x,%x",
331 s
= lock_user(VERIFY_READ
, arg1
, len
, 1);
333 /* Return bytes not written on error */
336 ret
= set_swi_errno(ts
, write(arg0
, s
, len
));
337 unlock_user(s
, arg1
, 0);
338 if (ret
== (uint32_t)-1) {
341 /* Return bytes not written */
344 case TARGET_SYS_READ
:
349 if (use_gdb_syscalls()) {
350 arm_semi_syscall_len
= len
;
351 return arm_gdb_syscall(cpu
, arm_semi_cb
, "read,%x,%x,%x",
354 s
= lock_user(VERIFY_WRITE
, arg1
, len
, 0);
356 /* return bytes not read */
360 ret
= set_swi_errno(ts
, read(arg0
, s
, len
));
361 } while (ret
== -1 && errno
== EINTR
);
362 unlock_user(s
, arg1
, len
);
363 if (ret
== (uint32_t)-1) {
366 /* Return bytes not read */
369 case TARGET_SYS_READC
:
370 qemu_log_mask(LOG_UNIMP
, "%s: SYS_READC not implemented", __func__
);
372 case TARGET_SYS_ISTTY
:
374 if (use_gdb_syscalls()) {
375 return arm_gdb_syscall(cpu
, arm_semi_cb
, "isatty,%x", arg0
);
379 case TARGET_SYS_SEEK
:
382 if (use_gdb_syscalls()) {
383 return arm_gdb_syscall(cpu
, arm_semi_cb
, "lseek,%x,%x,0",
386 ret
= set_swi_errno(ts
, lseek(arg0
, arg1
, SEEK_SET
));
387 if (ret
== (uint32_t)-1)
391 case TARGET_SYS_FLEN
:
393 if (use_gdb_syscalls()) {
394 return arm_gdb_syscall(cpu
, arm_semi_flen_cb
, "fstat,%x,%x",
395 arg0
, arm_flen_buf(cpu
));
398 ret
= set_swi_errno(ts
, fstat(arg0
, &buf
));
399 if (ret
== (uint32_t)-1)
403 case TARGET_SYS_TMPNAM
:
404 qemu_log_mask(LOG_UNIMP
, "%s: SYS_TMPNAM not implemented", __func__
);
406 case TARGET_SYS_REMOVE
:
409 if (use_gdb_syscalls()) {
410 ret
= arm_gdb_syscall(cpu
, arm_semi_cb
, "unlink,%s",
413 s
= lock_user_string(arg0
);
415 /* FIXME - should this error code be -TARGET_EFAULT ? */
418 ret
= set_swi_errno(ts
, remove(s
));
419 unlock_user(s
, arg0
, 0);
422 case TARGET_SYS_RENAME
:
427 if (use_gdb_syscalls()) {
428 return arm_gdb_syscall(cpu
, arm_semi_cb
, "rename,%s,%s",
429 arg0
, (int)arg1
+1, arg2
, (int)arg3
+1);
432 s
= lock_user_string(arg0
);
433 s2
= lock_user_string(arg2
);
435 /* FIXME - should this error code be -TARGET_EFAULT ? */
438 ret
= set_swi_errno(ts
, rename(s
, s2
));
440 unlock_user(s2
, arg2
, 0);
442 unlock_user(s
, arg0
, 0);
445 case TARGET_SYS_CLOCK
:
446 return clock() / (CLOCKS_PER_SEC
/ 100);
447 case TARGET_SYS_TIME
:
448 return set_swi_errno(ts
, time(NULL
));
449 case TARGET_SYS_SYSTEM
:
452 if (use_gdb_syscalls()) {
453 return arm_gdb_syscall(cpu
, arm_semi_cb
, "system,%s",
456 s
= lock_user_string(arg0
);
458 /* FIXME - should this error code be -TARGET_EFAULT ? */
461 ret
= set_swi_errno(ts
, system(s
));
462 unlock_user(s
, arg0
, 0);
465 case TARGET_SYS_ERRNO
:
466 #ifdef CONFIG_USER_ONLY
467 return ts
->swi_errno
;
471 case TARGET_SYS_GET_CMDLINE
:
473 /* Build a command-line from the original argv.
476 * * arg0, pointer to a buffer of at least the size
478 * * arg1, size of the buffer pointed to by arg0 in
482 * * arg0, pointer to null-terminated string of the
484 * * arg1, length of the string pointed to by arg0.
491 #if !defined(CONFIG_USER_ONLY)
497 /* Compute the size of the output string. */
498 #if !defined(CONFIG_USER_ONLY)
499 cmdline
= semihosting_get_cmdline();
500 if (cmdline
== NULL
) {
501 cmdline
= ""; /* Default to an empty line. */
503 output_size
= strlen(cmdline
) + 1; /* Count terminating 0. */
507 output_size
= ts
->info
->arg_end
- ts
->info
->arg_start
;
510 * We special-case the "empty command line" case (argc==0).
511 * Just provide the terminating 0.
517 if (output_size
> input_size
) {
518 /* Not enough space to store command-line arguments. */
522 /* Adjust the command-line length. */
523 if (SET_ARG(1, output_size
- 1)) {
524 /* Couldn't write back to argument block */
528 /* Lock the buffer on the ARM side. */
529 output_buffer
= lock_user(VERIFY_WRITE
, arg0
, output_size
, 0);
530 if (!output_buffer
) {
534 /* Copy the command-line arguments. */
535 #if !defined(CONFIG_USER_ONLY)
536 pstrcpy(output_buffer
, output_size
, cmdline
);
538 if (output_size
== 1) {
539 /* Empty command-line. */
540 output_buffer
[0] = '\0';
544 if (copy_from_user(output_buffer
, ts
->info
->arg_start
,
550 /* Separate arguments by white spaces. */
551 for (i
= 0; i
< output_size
- 1; i
++) {
552 if (output_buffer
[i
] == 0) {
553 output_buffer
[i
] = ' ';
558 /* Unlock the buffer on the ARM side. */
559 unlock_user(output_buffer
, arg0
, output_size
);
563 case TARGET_SYS_HEAPINFO
:
565 target_ulong retvals
[4];
571 #ifdef CONFIG_USER_ONLY
573 * Some C libraries assume the heap immediately follows .bss, so
574 * allocate it using sbrk.
576 if (!ts
->heap_limit
) {
579 ts
->heap_base
= do_brk(0);
580 limit
= ts
->heap_base
+ ARM_ANGEL_HEAP_SIZE
;
581 /* Try a big heap, and reduce the size if that fails. */
587 limit
= (ts
->heap_base
>> 1) + (limit
>> 1);
589 ts
->heap_limit
= limit
;
592 retvals
[0] = ts
->heap_base
;
593 retvals
[1] = ts
->heap_limit
;
594 retvals
[2] = ts
->stack_base
;
595 retvals
[3] = 0; /* Stack limit. */
598 /* TODO: Make this use the limit of the loaded application. */
599 retvals
[0] = limit
/ 2;
601 retvals
[2] = limit
; /* Stack base */
602 retvals
[3] = 0; /* Stack limit. */
605 for (i
= 0; i
< ARRAY_SIZE(retvals
); i
++) {
609 fail
= put_user_u64(retvals
[i
], arg0
+ i
* 8);
611 fail
= put_user_u32(retvals
[i
], arg0
+ i
* 4);
615 /* Couldn't write back to argument block */
621 case TARGET_SYS_EXIT
:
624 * The A64 version of this call takes a parameter block,
625 * so the application-exit type can return a subcode which
626 * is the exit status code from the application.
631 if (arg0
== ADP_Stopped_ApplicationExit
) {
638 * ARM specifies only Stopped_ApplicationExit as normal
639 * exit, everything else is considered an error
641 ret
= (args
== ADP_Stopped_ApplicationExit
) ? 0 : 1;
645 case TARGET_SYS_SYNCCACHE
:
647 * Clean the D-cache and invalidate the I-cache for the specified
648 * virtual address range. This is a nop for us since we don't
649 * implement caches. This is only present on A64.
654 /* fall through -- invalid for A32/T32 */
656 fprintf(stderr
, "qemu: Unsupported SemiHosting SWI 0x%02x\n", nr
);
657 cpu_dump_state(cs
, stderr
, 0);