semihosting/arm-compat-semi.c

   1 /*
   2  *  Semihosting support for systems modeled on the Arm "Angel"
   3  *  semihosting syscalls design. This includes Arm and RISC-V processors
   4  *
   5  *  Copyright (c) 2005, 2007 CodeSourcery.
   6  *  Copyright (c) 2019 Linaro
   7  *  Written by Paul Brook.
   8  *
   9  *  Copyright © 2020 by Keith Packard <keithp@keithp.com>
  10  *  Adapted for systems other than ARM, including RISC-V, by Keith Packard
  11  *
  12  *  This program is free software; you can redistribute it and/or modify
  13  *  it under the terms of the GNU General Public License as published by
  14  *  the Free Software Foundation; either version 2 of the License, or
  15  *  (at your option) any later version.
  16  *
  17  *  This program is distributed in the hope that it will be useful,
  18  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  *  GNU General Public License for more details.
  21  *
  22  *  You should have received a copy of the GNU General Public License
  23  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  24  *
  25  *  ARM Semihosting is documented in:
  26  *     Semihosting for AArch32 and AArch64 Release 2.0
  27  *     https://static.docs.arm.com/100863/0200/semihosting.pdf
  28  *
  29  *  RISC-V Semihosting is documented in:
  30  *     RISC-V Semihosting
  31  *     https://github.com/riscv/riscv-semihosting-spec/blob/main/riscv-semihosting-spec.adoc
  32  */
  33
  34 #include "qemu/osdep.h"
  35 #include "qemu/timer.h"
  36 #include "exec/gdbstub.h"
  37 #include "semihosting/semihost.h"
  38 #include "semihosting/console.h"
  39 #include "semihosting/common-semi.h"
  40 #include "semihosting/guestfd.h"
  41 #include "semihosting/syscalls.h"
  42
  43 #ifdef CONFIG_USER_ONLY
  44 #include "qemu.h"
  45
  46 #define COMMON_SEMI_HEAP_SIZE (128 * 1024 * 1024)
  47 #else
  48 #include "qemu/cutils.h"
  49 #include "hw/loader.h"
  50 #include "hw/boards.h"
  51 #endif
  52
  53 #define TARGET_SYS_OPEN        0x01
  54 #define TARGET_SYS_CLOSE       0x02
  55 #define TARGET_SYS_WRITEC      0x03
  56 #define TARGET_SYS_WRITE0      0x04
  57 #define TARGET_SYS_WRITE       0x05
  58 #define TARGET_SYS_READ        0x06
  59 #define TARGET_SYS_READC       0x07
  60 #define TARGET_SYS_ISERROR     0x08
  61 #define TARGET_SYS_ISTTY       0x09
  62 #define TARGET_SYS_SEEK        0x0a
  63 #define TARGET_SYS_FLEN        0x0c
  64 #define TARGET_SYS_TMPNAM      0x0d
  65 #define TARGET_SYS_REMOVE      0x0e
  66 #define TARGET_SYS_RENAME      0x0f
  67 #define TARGET_SYS_CLOCK       0x10
  68 #define TARGET_SYS_TIME        0x11
  69 #define TARGET_SYS_SYSTEM      0x12
  70 #define TARGET_SYS_ERRNO       0x13
  71 #define TARGET_SYS_GET_CMDLINE 0x15
  72 #define TARGET_SYS_HEAPINFO    0x16
  73 #define TARGET_SYS_EXIT        0x18
  74 #define TARGET_SYS_SYNCCACHE   0x19
  75 #define TARGET_SYS_EXIT_EXTENDED 0x20
  76 #define TARGET_SYS_ELAPSED     0x30
  77 #define TARGET_SYS_TICKFREQ    0x31
  78
  79 /* ADP_Stopped_ApplicationExit is used for exit(0),
  80  * anything else is implemented as exit(1) */
  81 #define ADP_Stopped_ApplicationExit     (0x20026)
  82
  83 #ifndef O_BINARY
  84 #define O_BINARY 0
  85 #endif
  86
  87 static int gdb_open_modeflags[12] = {
  88     GDB_O_RDONLY,
  89     GDB_O_RDONLY,
  90     GDB_O_RDWR,
  91     GDB_O_RDWR,
  92     GDB_O_WRONLY | GDB_O_CREAT | GDB_O_TRUNC,
  93     GDB_O_WRONLY | GDB_O_CREAT | GDB_O_TRUNC,
  94     GDB_O_RDWR | GDB_O_CREAT | GDB_O_TRUNC,
  95     GDB_O_RDWR | GDB_O_CREAT | GDB_O_TRUNC,
  96     GDB_O_WRONLY | GDB_O_CREAT | GDB_O_APPEND,
  97     GDB_O_WRONLY | GDB_O_CREAT | GDB_O_APPEND,
  98     GDB_O_RDWR | GDB_O_CREAT | GDB_O_APPEND,
  99     GDB_O_RDWR | GDB_O_CREAT | GDB_O_APPEND,
 100 };
 101
 102 #ifndef CONFIG_USER_ONLY
 103
 104 /**
 105  * common_semi_find_bases: find information about ram and heap base
 106  *
 107  * This function attempts to provide meaningful numbers for RAM and
 108  * HEAP base addresses. The rambase is simply the lowest addressable
 109  * RAM position. For the heapbase we ask the loader to scan the
 110  * address space and the largest available gap by querying the "ROM"
 111  * regions.
 112  *
 113  * Returns: a structure with the numbers we need.
 114  */
 115
 116 typedef struct LayoutInfo {
 117     target_ulong rambase;
 118     size_t ramsize;
 119     hwaddr heapbase;
 120     hwaddr heaplimit;
 121 } LayoutInfo;
 122
 123 static bool find_ram_cb(Int128 start, Int128 len, const MemoryRegion *mr,
 124                         hwaddr offset_in_region, void *opaque)
 125 {
 126     LayoutInfo *info = (LayoutInfo *) opaque;
 127     uint64_t size = int128_get64(len);
 128
 129     if (!mr->ram || mr->readonly) {
 130         return false;
 131     }
 132
 133     if (size > info->ramsize) {
 134         info->rambase = int128_get64(start);
 135         info->ramsize = size;
 136     }
 137
 138     /* search exhaustively for largest RAM */
 139     return false;
 140 }
 141
 142 static LayoutInfo common_semi_find_bases(CPUState *cs)
 143 {
 144     FlatView *fv;
 145     LayoutInfo info = { 0, 0, 0, 0 };
 146
 147     RCU_READ_LOCK_GUARD();
 148
 149     fv = address_space_to_flatview(cs->as);
 150     flatview_for_each_range(fv, find_ram_cb, &info);
 151
 152     /*
 153      * If we have found the RAM lets iterate through the ROM blobs to
 154      * work out the best place for the remainder of RAM and split it
 155      * equally between stack and heap.
 156      */
 157     if (info.rambase || info.ramsize > 0) {
 158         RomGap gap = rom_find_largest_gap_between(info.rambase, info.ramsize);
 159         info.heapbase = gap.base;
 160         info.heaplimit = gap.base + gap.size;
 161     }
 162
 163     return info;
 164 }
 165
 166 #endif
 167
 168 #include "common-semi-target.h"
 169
 170 /*
 171  * Read the input value from the argument block; fail the semihosting
 172  * call if the memory read fails. Eventually we could use a generic
 173  * CPUState helper function here.
 174  */
 175
 176 #define GET_ARG(n) do {                                 \
 177     if (is_64bit_semihosting(env)) {                    \
 178         if (get_user_u64(arg ## n, args + (n) * 8)) {   \
 179             goto do_fault;                              \
 180         }                                               \
 181     } else {                                            \
 182         if (get_user_u32(arg ## n, args + (n) * 4)) {   \
 183             goto do_fault;                              \
 184         }                                               \
 185     }                                                   \
 186 } while (0)
 187
 188 #define SET_ARG(n, val)                                 \
 189     (is_64bit_semihosting(env) ?                        \
 190      put_user_u64(val, args + (n) * 8) :                \
 191      put_user_u32(val, args + (n) * 4))
 192
 193
 194 /*
 195  * The semihosting API has no concept of its errno being thread-safe,
 196  * as the API design predates SMP CPUs and was intended as a simple
 197  * real-hardware set of debug functionality. For QEMU, we make the
 198  * errno be per-thread in linux-user mode; in softmmu it is a simple
 199  * global, and we assume that the guest takes care of avoiding any races.
 200  */
 201 #ifndef CONFIG_USER_ONLY
 202 static target_ulong syscall_err;
 203
 204 #include "semihosting/softmmu-uaccess.h"
 205 #endif
 206
 207 static inline uint32_t get_swi_errno(CPUState *cs)
 208 {
 209 #ifdef CONFIG_USER_ONLY
 210     TaskState *ts = cs->opaque;
 211
 212     return ts->swi_errno;
 213 #else
 214     return syscall_err;
 215 #endif
 216 }
 217
 218 static void common_semi_cb(CPUState *cs, uint64_t ret, int err)
 219 {
 220     if (err) {
 221 #ifdef CONFIG_USER_ONLY
 222         TaskState *ts = cs->opaque;
 223         ts->swi_errno = err;
 224 #else
 225         syscall_err = err;
 226 #endif
 227     }
 228     common_semi_set_ret(cs, ret);
 229 }
 230
 231 /*
 232  * Use 0xdeadbeef as the return value when there isn't a defined
 233  * return value for the call.
 234  */
 235 static void common_semi_dead_cb(CPUState *cs, uint64_t ret, int err)
 236 {
 237     common_semi_set_ret(cs, 0xdeadbeef);
 238 }
 239
 240 /*
 241  * SYS_READ and SYS_WRITE always return the number of bytes not read/written.
 242  * There is no error condition, other than returning the original length.
 243  */
 244 static void common_semi_rw_cb(CPUState *cs, uint64_t ret, int err)
 245 {
 246     /* Recover the original length from the third argument. */
 247     CPUArchState *env G_GNUC_UNUSED = cs->env_ptr;
 248     target_ulong args = common_semi_arg(cs, 1);
 249     target_ulong arg2;
 250     GET_ARG(2);
 251
 252     if (err) {
 253  do_fault:
 254         ret = 0; /* error: no bytes transmitted */
 255     }
 256     common_semi_set_ret(cs, arg2 - ret);
 257 }
 258
 259 /*
 260  * Convert from Posix ret+errno to Arm SYS_ISTTY return values.
 261  * With gdbstub, err is only ever set for protocol errors to EIO.
 262  */
 263 static void common_semi_istty_cb(CPUState *cs, uint64_t ret, int err)
 264 {
 265     if (err) {
 266         ret = (err == ENOTTY ? 0 : -1);
 267     }
 268     common_semi_cb(cs, ret, err);
 269 }
 270
 271 /*
 272  * SYS_SEEK returns 0 on success, not the resulting offset.
 273  */
 274 static void common_semi_seek_cb(CPUState *cs, uint64_t ret, int err)
 275 {
 276     if (!err) {
 277         ret = 0;
 278     }
 279     common_semi_cb(cs, ret, err);
 280 }
 281
 282 /*
 283  * Return an address in target memory of 64 bytes where the remote
 284  * gdb should write its stat struct. (The format of this structure
 285  * is defined by GDB's remote protocol and is not target-specific.)
 286  * We put this on the guest's stack just below SP.
 287  */
 288 static target_ulong common_semi_flen_buf(CPUState *cs)
 289 {
 290     target_ulong sp = common_semi_stack_bottom(cs);
 291     return sp - 64;
 292 }
 293
 294 static void
 295 common_semi_flen_fstat_cb(CPUState *cs, uint64_t ret, int err)
 296 {
 297     if (!err) {
 298         /* The size is always stored in big-endian order, extract the value. */
 299         uint64_t size;
 300         if (cpu_memory_rw_debug(cs, common_semi_flen_buf(cs) +
 301                                 offsetof(struct gdb_stat, gdb_st_size),
 302                                 &size, 8, 0)) {
 303             ret = -1, err = EFAULT;
 304         } else {
 305             size = be64_to_cpu(size);
 306             if (ret != size) {
 307                 ret = -1, err = EOVERFLOW;
 308             }
 309         }
 310     }
 311     common_semi_cb(cs, ret, err);
 312 }
 313
 314 static void
 315 common_semi_readc_cb(CPUState *cs, uint64_t ret, int err)
 316 {
 317     if (!err) {
 318         CPUArchState *env G_GNUC_UNUSED = cs->env_ptr;
 319         uint8_t ch;
 320
 321         if (get_user_u8(ch, common_semi_stack_bottom(cs) - 1)) {
 322             ret = -1, err = EFAULT;
 323         } else {
 324             ret = ch;
 325         }
 326     }
 327     common_semi_cb(cs, ret, err);
 328 }
 329
 330 #define SHFB_MAGIC_0 0x53
 331 #define SHFB_MAGIC_1 0x48
 332 #define SHFB_MAGIC_2 0x46
 333 #define SHFB_MAGIC_3 0x42
 334
 335 /* Feature bits reportable in feature byte 0 */
 336 #define SH_EXT_EXIT_EXTENDED (1 << 0)
 337 #define SH_EXT_STDOUT_STDERR (1 << 1)
 338
 339 static const uint8_t featurefile_data[] = {
 340     SHFB_MAGIC_0,
 341     SHFB_MAGIC_1,
 342     SHFB_MAGIC_2,
 343     SHFB_MAGIC_3,
 344     SH_EXT_EXIT_EXTENDED | SH_EXT_STDOUT_STDERR, /* Feature byte 0 */
 345 };
 346
 347 /*
 348  * Do a semihosting call.
 349  *
 350  * The specification always says that the "return register" either
 351  * returns a specific value or is corrupted, so we don't need to
 352  * report to our caller whether we are returning a value or trying to
 353  * leave the register unchanged.
 354  */
 355 void do_common_semihosting(CPUState *cs)
 356 {
 357     CPUArchState *env = cs->env_ptr;
 358     target_ulong args;
 359     target_ulong arg0, arg1, arg2, arg3;
 360     target_ulong ul_ret;
 361     char * s;
 362     int nr;
 363     uint32_t ret;
 364     int64_t elapsed;
 365
 366     nr = common_semi_arg(cs, 0) & 0xffffffffU;
 367     args = common_semi_arg(cs, 1);
 368
 369     switch (nr) {
 370     case TARGET_SYS_OPEN:
 371     {
 372         int ret, err = 0;
 373         int hostfd;
 374
 375         GET_ARG(0);
 376         GET_ARG(1);
 377         GET_ARG(2);
 378         s = lock_user_string(arg0);
 379         if (!s) {
 380             goto do_fault;
 381         }
 382         if (arg1 >= 12) {
 383             unlock_user(s, arg0, 0);
 384             common_semi_cb(cs, -1, EINVAL);
 385             break;
 386         }
 387
 388         if (strcmp(s, ":tt") == 0) {
 389             /*
 390              * We implement SH_EXT_STDOUT_STDERR, so:
 391              *  open for read == stdin
 392              *  open for write == stdout
 393              *  open for append == stderr
 394              */
 395             if (arg1 < 4) {
 396                 hostfd = STDIN_FILENO;
 397             } else if (arg1 < 8) {
 398                 hostfd = STDOUT_FILENO;
 399             } else {
 400                 hostfd = STDERR_FILENO;
 401             }
 402             ret = alloc_guestfd();
 403             associate_guestfd(ret, hostfd);
 404         } else if (strcmp(s, ":semihosting-features") == 0) {
 405             /* We must fail opens for modes other than 0 ('r') or 1 ('rb') */
 406             if (arg1 != 0 && arg1 != 1) {
 407                 ret = -1;
 408                 err = EACCES;
 409             } else {
 410                 ret = alloc_guestfd();
 411                 staticfile_guestfd(ret, featurefile_data,
 412                                    sizeof(featurefile_data));
 413             }
 414         } else {
 415             unlock_user(s, arg0, 0);
 416             semihost_sys_open(cs, common_semi_cb, arg0, arg2 + 1,
 417                               gdb_open_modeflags[arg1], 0644);
 418             break;
 419         }
 420         unlock_user(s, arg0, 0);
 421         common_semi_cb(cs, ret, err);
 422         break;
 423     }
 424
 425     case TARGET_SYS_CLOSE:
 426         GET_ARG(0);
 427         semihost_sys_close(cs, common_semi_cb, arg0);
 428         break;
 429
 430     case TARGET_SYS_WRITEC:
 431         /*
 432          * FIXME: the byte to be written is in a target_ulong slot,
 433          * which means this is wrong for a big-endian guest.
 434          */
 435         semihost_sys_write_gf(cs, common_semi_dead_cb,
 436                               &console_out_gf, args, 1);
 437         break;
 438
 439     case TARGET_SYS_WRITE0:
 440         {
 441             ssize_t len = target_strlen(args);
 442             if (len < 0) {
 443                 common_semi_dead_cb(cs, -1, EFAULT);
 444             } else {
 445                 semihost_sys_write_gf(cs, common_semi_dead_cb,
 446                                       &console_out_gf, args, len);
 447             }
 448         }
 449         break;
 450
 451     case TARGET_SYS_WRITE:
 452         GET_ARG(0);
 453         GET_ARG(1);
 454         GET_ARG(2);
 455         semihost_sys_write(cs, common_semi_rw_cb, arg0, arg1, arg2);
 456         break;
 457
 458     case TARGET_SYS_READ:
 459         GET_ARG(0);
 460         GET_ARG(1);
 461         GET_ARG(2);
 462         semihost_sys_read(cs, common_semi_rw_cb, arg0, arg1, arg2);
 463         break;
 464
 465     case TARGET_SYS_READC:
 466         semihost_sys_read_gf(cs, common_semi_readc_cb, &console_in_gf,
 467                              common_semi_stack_bottom(cs) - 1, 1);
 468         break;
 469
 470     case TARGET_SYS_ISERROR:
 471         GET_ARG(0);
 472         common_semi_set_ret(cs, (target_long)arg0 < 0);
 473         break;
 474
 475     case TARGET_SYS_ISTTY:
 476         GET_ARG(0);
 477         semihost_sys_isatty(cs, common_semi_istty_cb, arg0);
 478         break;
 479
 480     case TARGET_SYS_SEEK:
 481         GET_ARG(0);
 482         GET_ARG(1);
 483         semihost_sys_lseek(cs, common_semi_seek_cb, arg0, arg1, GDB_SEEK_SET);
 484         break;
 485
 486     case TARGET_SYS_FLEN:
 487         GET_ARG(0);
 488         semihost_sys_flen(cs, common_semi_flen_fstat_cb, common_semi_cb,
 489                           arg0, common_semi_flen_buf(cs));
 490         break;
 491
 492     case TARGET_SYS_TMPNAM:
 493     {
 494         int len;
 495         char *p;
 496
 497         GET_ARG(0);
 498         GET_ARG(1);
 499         GET_ARG(2);
 500         len = asprintf(&s, "/tmp/qemu-%x%02x", getpid(), (int)arg1 & 0xff);
 501         /* Make sure there's enough space in the buffer */
 502         if (len < 0 || len >= arg2) {
 503             common_semi_set_ret(cs, -1);
 504             break;
 505         }
 506         p = lock_user(VERIFY_WRITE, arg0, len, 0);
 507         if (!p) {
 508             goto do_fault;
 509         }
 510         memcpy(p, s, len + 1);
 511         unlock_user(p, arg0, len);
 512         free(s);
 513         common_semi_set_ret(cs, 0);
 514         break;
 515     }
 516
 517     case TARGET_SYS_REMOVE:
 518         GET_ARG(0);
 519         GET_ARG(1);
 520         semihost_sys_remove(cs, common_semi_cb, arg0, arg1 + 1);
 521         break;
 522
 523     case TARGET_SYS_RENAME:
 524         GET_ARG(0);
 525         GET_ARG(1);
 526         GET_ARG(2);
 527         GET_ARG(3);
 528         semihost_sys_rename(cs, common_semi_cb, arg0, arg1 + 1, arg2, arg3 + 1);
 529         break;
 530
 531     case TARGET_SYS_CLOCK:
 532         common_semi_set_ret(cs, clock() / (CLOCKS_PER_SEC / 100));
 533         break;
 534
 535     case TARGET_SYS_TIME:
 536         ul_ret = time(NULL);
 537         common_semi_cb(cs, ul_ret, ul_ret == -1 ? errno : 0);
 538         break;
 539
 540     case TARGET_SYS_SYSTEM:
 541         GET_ARG(0);
 542         GET_ARG(1);
 543         semihost_sys_system(cs, common_semi_cb, arg0, arg1 + 1);
 544         break;
 545
 546     case TARGET_SYS_ERRNO:
 547         common_semi_set_ret(cs, get_swi_errno(cs));
 548         break;
 549
 550     case TARGET_SYS_GET_CMDLINE:
 551         {
 552             /* Build a command-line from the original argv.
 553              *
 554              * The inputs are:
 555              *     * arg0, pointer to a buffer of at least the size
 556              *               specified in arg1.
 557              *     * arg1, size of the buffer pointed to by arg0 in
 558              *               bytes.
 559              *
 560              * The outputs are:
 561              *     * arg0, pointer to null-terminated string of the
 562              *               command line.
 563              *     * arg1, length of the string pointed to by arg0.
 564              */
 565
 566             char *output_buffer;
 567             size_t input_size;
 568             size_t output_size;
 569             int status = 0;
 570 #if !defined(CONFIG_USER_ONLY)
 571             const char *cmdline;
 572 #else
 573             TaskState *ts = cs->opaque;
 574 #endif
 575             GET_ARG(0);
 576             GET_ARG(1);
 577             input_size = arg1;
 578             /* Compute the size of the output string.  */
 579 #if !defined(CONFIG_USER_ONLY)
 580             cmdline = semihosting_get_cmdline();
 581             if (cmdline == NULL) {
 582                 cmdline = ""; /* Default to an empty line. */
 583             }
 584             output_size = strlen(cmdline) + 1; /* Count terminating 0. */
 585 #else
 586             unsigned int i;
 587
 588             output_size = ts->info->env_strings - ts->info->arg_strings;
 589             if (!output_size) {
 590                 /*
 591                  * We special-case the "empty command line" case (argc==0).
 592                  * Just provide the terminating 0.
 593                  */
 594                 output_size = 1;
 595             }
 596 #endif
 597
 598             if (output_size > input_size) {
 599                 /* Not enough space to store command-line arguments.  */
 600                 common_semi_cb(cs, -1, E2BIG);
 601                 break;
 602             }
 603
 604             /* Adjust the command-line length.  */
 605             if (SET_ARG(1, output_size - 1)) {
 606                 /* Couldn't write back to argument block */
 607                 goto do_fault;
 608             }
 609
 610             /* Lock the buffer on the ARM side.  */
 611             output_buffer = lock_user(VERIFY_WRITE, arg0, output_size, 0);
 612             if (!output_buffer) {
 613                 goto do_fault;
 614             }
 615
 616             /* Copy the command-line arguments.  */
 617 #if !defined(CONFIG_USER_ONLY)
 618             pstrcpy(output_buffer, output_size, cmdline);
 619 #else
 620             if (output_size == 1) {
 621                 /* Empty command-line.  */
 622                 output_buffer[0] = '\0';
 623                 goto out;
 624             }
 625
 626             if (copy_from_user(output_buffer, ts->info->arg_strings,
 627                                output_size)) {
 628                 unlock_user(output_buffer, arg0, 0);
 629                 goto do_fault;
 630             }
 631
 632             /* Separate arguments by white spaces.  */
 633             for (i = 0; i < output_size - 1; i++) {
 634                 if (output_buffer[i] == 0) {
 635                     output_buffer[i] = ' ';
 636                 }
 637             }
 638         out:
 639 #endif
 640             /* Unlock the buffer on the ARM side.  */
 641             unlock_user(output_buffer, arg0, output_size);
 642             common_semi_cb(cs, status, 0);
 643         }
 644         break;
 645
 646     case TARGET_SYS_HEAPINFO:
 647         {
 648             target_ulong retvals[4];
 649             int i;
 650 #ifdef CONFIG_USER_ONLY
 651             TaskState *ts = cs->opaque;
 652             target_ulong limit;
 653 #else
 654             LayoutInfo info = common_semi_find_bases(cs);
 655 #endif
 656
 657             GET_ARG(0);
 658
 659 #ifdef CONFIG_USER_ONLY
 660             /*
 661              * Some C libraries assume the heap immediately follows .bss, so
 662              * allocate it using sbrk.
 663              */
 664             if (!ts->heap_limit) {
 665                 abi_ulong ret;
 666
 667                 ts->heap_base = do_brk(0);
 668                 limit = ts->heap_base + COMMON_SEMI_HEAP_SIZE;
 669                 /* Try a big heap, and reduce the size if that fails.  */
 670                 for (;;) {
 671                     ret = do_brk(limit);
 672                     if (ret >= limit) {
 673                         break;
 674                     }
 675                     limit = (ts->heap_base >> 1) + (limit >> 1);
 676                 }
 677                 ts->heap_limit = limit;
 678             }
 679
 680             retvals[0] = ts->heap_base;
 681             retvals[1] = ts->heap_limit;
 682             retvals[2] = ts->stack_base;
 683             retvals[3] = 0; /* Stack limit.  */
 684 #else
 685             retvals[0] = info.heapbase;  /* Heap Base */
 686             retvals[1] = info.heaplimit; /* Heap Limit */
 687             retvals[2] = info.heaplimit; /* Stack base */
 688             retvals[3] = info.heapbase;  /* Stack limit.  */
 689 #endif
 690
 691             for (i = 0; i < ARRAY_SIZE(retvals); i++) {
 692                 bool fail;
 693
 694                 if (is_64bit_semihosting(env)) {
 695                     fail = put_user_u64(retvals[i], arg0 + i * 8);
 696                 } else {
 697                     fail = put_user_u32(retvals[i], arg0 + i * 4);
 698                 }
 699
 700                 if (fail) {
 701                     /* Couldn't write back to argument block */
 702                     goto do_fault;
 703                 }
 704             }
 705             common_semi_set_ret(cs, 0);
 706         }
 707         break;
 708
 709     case TARGET_SYS_EXIT:
 710     case TARGET_SYS_EXIT_EXTENDED:
 711         if (common_semi_sys_exit_extended(cs, nr)) {
 712             /*
 713              * The A64 version of SYS_EXIT takes a parameter block,
 714              * so the application-exit type can return a subcode which
 715              * is the exit status code from the application.
 716              * SYS_EXIT_EXTENDED is an a new-in-v2.0 optional function
 717              * which allows A32/T32 guests to also provide a status code.
 718              */
 719             GET_ARG(0);
 720             GET_ARG(1);
 721
 722             if (arg0 == ADP_Stopped_ApplicationExit) {
 723                 ret = arg1;
 724             } else {
 725                 ret = 1;
 726             }
 727         } else {
 728             /*
 729              * The A32/T32 version of SYS_EXIT specifies only
 730              * Stopped_ApplicationExit as normal exit, but does not
 731              * allow the guest to specify the exit status code.
 732              * Everything else is considered an error.
 733              */
 734             ret = (args == ADP_Stopped_ApplicationExit) ? 0 : 1;
 735         }
 736         gdb_exit(ret);
 737         exit(ret);
 738
 739     case TARGET_SYS_ELAPSED:
 740         elapsed = get_clock() - clock_start;
 741         if (sizeof(target_ulong) == 8) {
 742             SET_ARG(0, elapsed);
 743         } else {
 744             SET_ARG(0, (uint32_t) elapsed);
 745             SET_ARG(1, (uint32_t) (elapsed >> 32));
 746         }
 747         common_semi_set_ret(cs, 0);
 748         break;
 749
 750     case TARGET_SYS_TICKFREQ:
 751         /* qemu always uses nsec */
 752         common_semi_set_ret(cs, 1000000000);
 753         break;
 754
 755     case TARGET_SYS_SYNCCACHE:
 756         /*
 757          * Clean the D-cache and invalidate the I-cache for the specified
 758          * virtual address range. This is a nop for us since we don't
 759          * implement caches. This is only present on A64.
 760          */
 761         if (common_semi_has_synccache(env)) {
 762             common_semi_set_ret(cs, 0);
 763             break;
 764         }
 765         /* fall through */
 766     default:
 767         fprintf(stderr, "qemu: Unsupported SemiHosting SWI 0x%02x\n", nr);
 768         cpu_dump_state(cs, stderr, 0);
 769         abort();
 770
 771     do_fault:
 772         common_semi_cb(cs, -1, EFAULT);
 773         break;
 774     }
 775 }