2 * Semihosting support for systems modeled on the Arm "Angel"
3 * semihosting syscalls design. This includes Arm and RISC-V processors
5 * Copyright (c) 2005, 2007 CodeSourcery.
6 * Copyright (c) 2019 Linaro
7 * Written by Paul Brook.
9 * Copyright © 2020 by Keith Packard <keithp@keithp.com>
10 * Adapted for systems other than ARM, including RISC-V, by Keith Packard
12 * This program is free software; you can redistribute it and/or modify
13 * it under the terms of the GNU General Public License as published by
14 * the Free Software Foundation; either version 2 of the License, or
15 * (at your option) any later version.
17 * This program is distributed in the hope that it will be useful,
18 * but WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 * GNU General Public License for more details.
22 * You should have received a copy of the GNU General Public License
23 * along with this program; if not, see <http://www.gnu.org/licenses/>.
25 * ARM Semihosting is documented in:
26 * Semihosting for AArch32 and AArch64 Release 2.0
27 * https://static.docs.arm.com/100863/0200/semihosting.pdf
29 * RISC-V Semihosting is documented in:
31 * https://github.com/riscv/riscv-semihosting-spec/blob/main/riscv-semihosting-spec.adoc
34 #include "qemu/osdep.h"
35 #include "qemu/timer.h"
36 #include "exec/gdbstub.h"
37 #include "semihosting/semihost.h"
38 #include "semihosting/console.h"
39 #include "semihosting/common-semi.h"
40 #include "semihosting/guestfd.h"
41 #include "semihosting/syscalls.h"
43 #ifdef CONFIG_USER_ONLY
46 #define COMMON_SEMI_HEAP_SIZE (128 * 1024 * 1024)
48 #include "qemu/cutils.h"
49 #include "hw/loader.h"
50 #include "hw/boards.h"
53 #define TARGET_SYS_OPEN 0x01
54 #define TARGET_SYS_CLOSE 0x02
55 #define TARGET_SYS_WRITEC 0x03
56 #define TARGET_SYS_WRITE0 0x04
57 #define TARGET_SYS_WRITE 0x05
58 #define TARGET_SYS_READ 0x06
59 #define TARGET_SYS_READC 0x07
60 #define TARGET_SYS_ISERROR 0x08
61 #define TARGET_SYS_ISTTY 0x09
62 #define TARGET_SYS_SEEK 0x0a
63 #define TARGET_SYS_FLEN 0x0c
64 #define TARGET_SYS_TMPNAM 0x0d
65 #define TARGET_SYS_REMOVE 0x0e
66 #define TARGET_SYS_RENAME 0x0f
67 #define TARGET_SYS_CLOCK 0x10
68 #define TARGET_SYS_TIME 0x11
69 #define TARGET_SYS_SYSTEM 0x12
70 #define TARGET_SYS_ERRNO 0x13
71 #define TARGET_SYS_GET_CMDLINE 0x15
72 #define TARGET_SYS_HEAPINFO 0x16
73 #define TARGET_SYS_EXIT 0x18
74 #define TARGET_SYS_SYNCCACHE 0x19
75 #define TARGET_SYS_EXIT_EXTENDED 0x20
76 #define TARGET_SYS_ELAPSED 0x30
77 #define TARGET_SYS_TICKFREQ 0x31
79 /* ADP_Stopped_ApplicationExit is used for exit(0),
80 * anything else is implemented as exit(1) */
81 #define ADP_Stopped_ApplicationExit (0x20026)
87 static int gdb_open_modeflags
[12] = {
92 GDB_O_WRONLY
| GDB_O_CREAT
| GDB_O_TRUNC
,
93 GDB_O_WRONLY
| GDB_O_CREAT
| GDB_O_TRUNC
,
94 GDB_O_RDWR
| GDB_O_CREAT
| GDB_O_TRUNC
,
95 GDB_O_RDWR
| GDB_O_CREAT
| GDB_O_TRUNC
,
96 GDB_O_WRONLY
| GDB_O_CREAT
| GDB_O_APPEND
,
97 GDB_O_WRONLY
| GDB_O_CREAT
| GDB_O_APPEND
,
98 GDB_O_RDWR
| GDB_O_CREAT
| GDB_O_APPEND
,
99 GDB_O_RDWR
| GDB_O_CREAT
| GDB_O_APPEND
,
102 #ifndef CONFIG_USER_ONLY
105 * common_semi_find_bases: find information about ram and heap base
107 * This function attempts to provide meaningful numbers for RAM and
108 * HEAP base addresses. The rambase is simply the lowest addressable
109 * RAM position. For the heapbase we ask the loader to scan the
110 * address space and the largest available gap by querying the "ROM"
113 * Returns: a structure with the numbers we need.
116 typedef struct LayoutInfo
{
117 target_ulong rambase
;
123 static bool find_ram_cb(Int128 start
, Int128 len
, const MemoryRegion
*mr
,
124 hwaddr offset_in_region
, void *opaque
)
126 LayoutInfo
*info
= (LayoutInfo
*) opaque
;
127 uint64_t size
= int128_get64(len
);
129 if (!mr
->ram
|| mr
->readonly
) {
133 if (size
> info
->ramsize
) {
134 info
->rambase
= int128_get64(start
);
135 info
->ramsize
= size
;
138 /* search exhaustively for largest RAM */
142 static LayoutInfo
common_semi_find_bases(CPUState
*cs
)
145 LayoutInfo info
= { 0, 0, 0, 0 };
147 RCU_READ_LOCK_GUARD();
149 fv
= address_space_to_flatview(cs
->as
);
150 flatview_for_each_range(fv
, find_ram_cb
, &info
);
153 * If we have found the RAM lets iterate through the ROM blobs to
154 * work out the best place for the remainder of RAM and split it
155 * equally between stack and heap.
157 if (info
.rambase
|| info
.ramsize
> 0) {
158 RomGap gap
= rom_find_largest_gap_between(info
.rambase
, info
.ramsize
);
159 info
.heapbase
= gap
.base
;
160 info
.heaplimit
= gap
.base
+ gap
.size
;
168 #include "common-semi-target.h"
171 * Read the input value from the argument block; fail the semihosting
172 * call if the memory read fails. Eventually we could use a generic
173 * CPUState helper function here.
176 #define GET_ARG(n) do { \
177 if (is_64bit_semihosting(env)) { \
178 if (get_user_u64(arg ## n, args + (n) * 8)) { \
182 if (get_user_u32(arg ## n, args + (n) * 4)) { \
188 #define SET_ARG(n, val) \
189 (is_64bit_semihosting(env) ? \
190 put_user_u64(val, args + (n) * 8) : \
191 put_user_u32(val, args + (n) * 4))
195 * The semihosting API has no concept of its errno being thread-safe,
196 * as the API design predates SMP CPUs and was intended as a simple
197 * real-hardware set of debug functionality. For QEMU, we make the
198 * errno be per-thread in linux-user mode; in softmmu it is a simple
199 * global, and we assume that the guest takes care of avoiding any races.
201 #ifndef CONFIG_USER_ONLY
202 static target_ulong syscall_err
;
204 #include "semihosting/softmmu-uaccess.h"
207 static inline uint32_t get_swi_errno(CPUState
*cs
)
209 #ifdef CONFIG_USER_ONLY
210 TaskState
*ts
= cs
->opaque
;
212 return ts
->swi_errno
;
218 static void common_semi_cb(CPUState
*cs
, uint64_t ret
, int err
)
221 #ifdef CONFIG_USER_ONLY
222 TaskState
*ts
= cs
->opaque
;
228 common_semi_set_ret(cs
, ret
);
232 * Use 0xdeadbeef as the return value when there isn't a defined
233 * return value for the call.
235 static void common_semi_dead_cb(CPUState
*cs
, uint64_t ret
, int err
)
237 common_semi_set_ret(cs
, 0xdeadbeef);
241 * SYS_READ and SYS_WRITE always return the number of bytes not read/written.
242 * There is no error condition, other than returning the original length.
244 static void common_semi_rw_cb(CPUState
*cs
, uint64_t ret
, int err
)
246 /* Recover the original length from the third argument. */
247 CPUArchState
*env G_GNUC_UNUSED
= cs
->env_ptr
;
248 target_ulong args
= common_semi_arg(cs
, 1);
254 ret
= 0; /* error: no bytes transmitted */
256 common_semi_set_ret(cs
, arg2
- ret
);
260 * Convert from Posix ret+errno to Arm SYS_ISTTY return values.
261 * With gdbstub, err is only ever set for protocol errors to EIO.
263 static void common_semi_istty_cb(CPUState
*cs
, uint64_t ret
, int err
)
266 ret
= (err
== ENOTTY
? 0 : -1);
268 common_semi_cb(cs
, ret
, err
);
272 * SYS_SEEK returns 0 on success, not the resulting offset.
274 static void common_semi_seek_cb(CPUState
*cs
, uint64_t ret
, int err
)
279 common_semi_cb(cs
, ret
, err
);
283 * Return an address in target memory of 64 bytes where the remote
284 * gdb should write its stat struct. (The format of this structure
285 * is defined by GDB's remote protocol and is not target-specific.)
286 * We put this on the guest's stack just below SP.
288 static target_ulong
common_semi_flen_buf(CPUState
*cs
)
290 target_ulong sp
= common_semi_stack_bottom(cs
);
295 common_semi_flen_fstat_cb(CPUState
*cs
, uint64_t ret
, int err
)
298 /* The size is always stored in big-endian order, extract the value. */
300 if (cpu_memory_rw_debug(cs
, common_semi_flen_buf(cs
) +
301 offsetof(struct gdb_stat
, gdb_st_size
),
303 ret
= -1, err
= EFAULT
;
305 size
= be64_to_cpu(size
);
307 ret
= -1, err
= EOVERFLOW
;
311 common_semi_cb(cs
, ret
, err
);
315 common_semi_readc_cb(CPUState
*cs
, uint64_t ret
, int err
)
318 CPUArchState
*env G_GNUC_UNUSED
= cs
->env_ptr
;
321 if (get_user_u8(ch
, common_semi_stack_bottom(cs
) - 1)) {
322 ret
= -1, err
= EFAULT
;
327 common_semi_cb(cs
, ret
, err
);
330 #define SHFB_MAGIC_0 0x53
331 #define SHFB_MAGIC_1 0x48
332 #define SHFB_MAGIC_2 0x46
333 #define SHFB_MAGIC_3 0x42
335 /* Feature bits reportable in feature byte 0 */
336 #define SH_EXT_EXIT_EXTENDED (1 << 0)
337 #define SH_EXT_STDOUT_STDERR (1 << 1)
339 static const uint8_t featurefile_data
[] = {
344 SH_EXT_EXIT_EXTENDED
| SH_EXT_STDOUT_STDERR
, /* Feature byte 0 */
348 * Do a semihosting call.
350 * The specification always says that the "return register" either
351 * returns a specific value or is corrupted, so we don't need to
352 * report to our caller whether we are returning a value or trying to
353 * leave the register unchanged.
355 void do_common_semihosting(CPUState
*cs
)
357 CPUArchState
*env
= cs
->env_ptr
;
359 target_ulong arg0
, arg1
, arg2
, arg3
;
366 nr
= common_semi_arg(cs
, 0) & 0xffffffffU
;
367 args
= common_semi_arg(cs
, 1);
370 case TARGET_SYS_OPEN
:
378 s
= lock_user_string(arg0
);
383 unlock_user(s
, arg0
, 0);
384 common_semi_cb(cs
, -1, EINVAL
);
388 if (strcmp(s
, ":tt") == 0) {
390 * We implement SH_EXT_STDOUT_STDERR, so:
391 * open for read == stdin
392 * open for write == stdout
393 * open for append == stderr
396 hostfd
= STDIN_FILENO
;
397 } else if (arg1
< 8) {
398 hostfd
= STDOUT_FILENO
;
400 hostfd
= STDERR_FILENO
;
402 ret
= alloc_guestfd();
403 associate_guestfd(ret
, hostfd
);
404 } else if (strcmp(s
, ":semihosting-features") == 0) {
405 /* We must fail opens for modes other than 0 ('r') or 1 ('rb') */
406 if (arg1
!= 0 && arg1
!= 1) {
410 ret
= alloc_guestfd();
411 staticfile_guestfd(ret
, featurefile_data
,
412 sizeof(featurefile_data
));
415 unlock_user(s
, arg0
, 0);
416 semihost_sys_open(cs
, common_semi_cb
, arg0
, arg2
+ 1,
417 gdb_open_modeflags
[arg1
], 0644);
420 unlock_user(s
, arg0
, 0);
421 common_semi_cb(cs
, ret
, err
);
425 case TARGET_SYS_CLOSE
:
427 semihost_sys_close(cs
, common_semi_cb
, arg0
);
430 case TARGET_SYS_WRITEC
:
432 * FIXME: the byte to be written is in a target_ulong slot,
433 * which means this is wrong for a big-endian guest.
435 semihost_sys_write_gf(cs
, common_semi_dead_cb
,
436 &console_out_gf
, args
, 1);
439 case TARGET_SYS_WRITE0
:
440 ret
= qemu_semihosting_console_outs(env
, args
);
441 common_semi_set_ret(cs
, ret
);
444 case TARGET_SYS_WRITE
:
448 semihost_sys_write(cs
, common_semi_rw_cb
, arg0
, arg1
, arg2
);
451 case TARGET_SYS_READ
:
455 semihost_sys_read(cs
, common_semi_rw_cb
, arg0
, arg1
, arg2
);
458 case TARGET_SYS_READC
:
459 semihost_sys_read_gf(cs
, common_semi_readc_cb
, &console_in_gf
,
460 common_semi_stack_bottom(cs
) - 1, 1);
463 case TARGET_SYS_ISERROR
:
465 common_semi_set_ret(cs
, (target_long
)arg0
< 0);
468 case TARGET_SYS_ISTTY
:
470 semihost_sys_isatty(cs
, common_semi_istty_cb
, arg0
);
473 case TARGET_SYS_SEEK
:
476 semihost_sys_lseek(cs
, common_semi_seek_cb
, arg0
, arg1
, GDB_SEEK_SET
);
479 case TARGET_SYS_FLEN
:
481 semihost_sys_flen(cs
, common_semi_flen_fstat_cb
, common_semi_cb
,
482 arg0
, common_semi_flen_buf(cs
));
485 case TARGET_SYS_TMPNAM
:
493 len
= asprintf(&s
, "/tmp/qemu-%x%02x", getpid(), (int)arg1
& 0xff);
494 /* Make sure there's enough space in the buffer */
495 if (len
< 0 || len
>= arg2
) {
496 common_semi_set_ret(cs
, -1);
499 p
= lock_user(VERIFY_WRITE
, arg0
, len
, 0);
503 memcpy(p
, s
, len
+ 1);
504 unlock_user(p
, arg0
, len
);
506 common_semi_set_ret(cs
, 0);
510 case TARGET_SYS_REMOVE
:
513 semihost_sys_remove(cs
, common_semi_cb
, arg0
, arg1
+ 1);
516 case TARGET_SYS_RENAME
:
521 semihost_sys_rename(cs
, common_semi_cb
, arg0
, arg1
+ 1, arg2
, arg3
+ 1);
524 case TARGET_SYS_CLOCK
:
525 common_semi_set_ret(cs
, clock() / (CLOCKS_PER_SEC
/ 100));
528 case TARGET_SYS_TIME
:
530 common_semi_cb(cs
, ul_ret
, ul_ret
== -1 ? errno
: 0);
533 case TARGET_SYS_SYSTEM
:
536 semihost_sys_system(cs
, common_semi_cb
, arg0
, arg1
+ 1);
539 case TARGET_SYS_ERRNO
:
540 common_semi_set_ret(cs
, get_swi_errno(cs
));
543 case TARGET_SYS_GET_CMDLINE
:
545 /* Build a command-line from the original argv.
548 * * arg0, pointer to a buffer of at least the size
550 * * arg1, size of the buffer pointed to by arg0 in
554 * * arg0, pointer to null-terminated string of the
556 * * arg1, length of the string pointed to by arg0.
563 #if !defined(CONFIG_USER_ONLY)
566 TaskState
*ts
= cs
->opaque
;
571 /* Compute the size of the output string. */
572 #if !defined(CONFIG_USER_ONLY)
573 cmdline
= semihosting_get_cmdline();
574 if (cmdline
== NULL
) {
575 cmdline
= ""; /* Default to an empty line. */
577 output_size
= strlen(cmdline
) + 1; /* Count terminating 0. */
581 output_size
= ts
->info
->env_strings
- ts
->info
->arg_strings
;
584 * We special-case the "empty command line" case (argc==0).
585 * Just provide the terminating 0.
591 if (output_size
> input_size
) {
592 /* Not enough space to store command-line arguments. */
593 common_semi_cb(cs
, -1, E2BIG
);
597 /* Adjust the command-line length. */
598 if (SET_ARG(1, output_size
- 1)) {
599 /* Couldn't write back to argument block */
603 /* Lock the buffer on the ARM side. */
604 output_buffer
= lock_user(VERIFY_WRITE
, arg0
, output_size
, 0);
605 if (!output_buffer
) {
609 /* Copy the command-line arguments. */
610 #if !defined(CONFIG_USER_ONLY)
611 pstrcpy(output_buffer
, output_size
, cmdline
);
613 if (output_size
== 1) {
614 /* Empty command-line. */
615 output_buffer
[0] = '\0';
619 if (copy_from_user(output_buffer
, ts
->info
->arg_strings
,
621 unlock_user(output_buffer
, arg0
, 0);
625 /* Separate arguments by white spaces. */
626 for (i
= 0; i
< output_size
- 1; i
++) {
627 if (output_buffer
[i
] == 0) {
628 output_buffer
[i
] = ' ';
633 /* Unlock the buffer on the ARM side. */
634 unlock_user(output_buffer
, arg0
, output_size
);
635 common_semi_cb(cs
, status
, 0);
639 case TARGET_SYS_HEAPINFO
:
641 target_ulong retvals
[4];
643 #ifdef CONFIG_USER_ONLY
644 TaskState
*ts
= cs
->opaque
;
647 LayoutInfo info
= common_semi_find_bases(cs
);
652 #ifdef CONFIG_USER_ONLY
654 * Some C libraries assume the heap immediately follows .bss, so
655 * allocate it using sbrk.
657 if (!ts
->heap_limit
) {
660 ts
->heap_base
= do_brk(0);
661 limit
= ts
->heap_base
+ COMMON_SEMI_HEAP_SIZE
;
662 /* Try a big heap, and reduce the size if that fails. */
668 limit
= (ts
->heap_base
>> 1) + (limit
>> 1);
670 ts
->heap_limit
= limit
;
673 retvals
[0] = ts
->heap_base
;
674 retvals
[1] = ts
->heap_limit
;
675 retvals
[2] = ts
->stack_base
;
676 retvals
[3] = 0; /* Stack limit. */
678 retvals
[0] = info
.heapbase
; /* Heap Base */
679 retvals
[1] = info
.heaplimit
; /* Heap Limit */
680 retvals
[2] = info
.heaplimit
; /* Stack base */
681 retvals
[3] = info
.heapbase
; /* Stack limit. */
684 for (i
= 0; i
< ARRAY_SIZE(retvals
); i
++) {
687 if (is_64bit_semihosting(env
)) {
688 fail
= put_user_u64(retvals
[i
], arg0
+ i
* 8);
690 fail
= put_user_u32(retvals
[i
], arg0
+ i
* 4);
694 /* Couldn't write back to argument block */
698 common_semi_set_ret(cs
, 0);
702 case TARGET_SYS_EXIT
:
703 case TARGET_SYS_EXIT_EXTENDED
:
704 if (common_semi_sys_exit_extended(cs
, nr
)) {
706 * The A64 version of SYS_EXIT takes a parameter block,
707 * so the application-exit type can return a subcode which
708 * is the exit status code from the application.
709 * SYS_EXIT_EXTENDED is an a new-in-v2.0 optional function
710 * which allows A32/T32 guests to also provide a status code.
715 if (arg0
== ADP_Stopped_ApplicationExit
) {
722 * The A32/T32 version of SYS_EXIT specifies only
723 * Stopped_ApplicationExit as normal exit, but does not
724 * allow the guest to specify the exit status code.
725 * Everything else is considered an error.
727 ret
= (args
== ADP_Stopped_ApplicationExit
) ? 0 : 1;
732 case TARGET_SYS_ELAPSED
:
733 elapsed
= get_clock() - clock_start
;
734 if (sizeof(target_ulong
) == 8) {
737 SET_ARG(0, (uint32_t) elapsed
);
738 SET_ARG(1, (uint32_t) (elapsed
>> 32));
740 common_semi_set_ret(cs
, 0);
743 case TARGET_SYS_TICKFREQ
:
744 /* qemu always uses nsec */
745 common_semi_set_ret(cs
, 1000000000);
748 case TARGET_SYS_SYNCCACHE
:
750 * Clean the D-cache and invalidate the I-cache for the specified
751 * virtual address range. This is a nop for us since we don't
752 * implement caches. This is only present on A64.
754 if (common_semi_has_synccache(env
)) {
755 common_semi_set_ret(cs
, 0);
760 fprintf(stderr
, "qemu: Unsupported SemiHosting SWI 0x%02x\n", nr
);
761 cpu_dump_state(cs
, stderr
, 0);
765 common_semi_cb(cs
, -1, EFAULT
);