1/*
2 * Arm "Angel" semihosting syscalls
3 *
4 * Copyright (c) 2005, 2007 CodeSourcery.
5 * Copyright (c) 2019 Linaro
6 * Written by Paul Brook.
7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, see <http://www.gnu.org/licenses/>.
20 *
21 * ARM Semihosting is documented in:
22 * Semihosting for AArch32 and AArch64 Release 2.0
23 * https://static.docs.arm.com/100863/0200/semihosting.pdf
24 */
25
26#include "qemu/osdep.h"
27
28#include "cpu.h"
29#include "hw/semihosting/semihost.h"
30#include "hw/semihosting/console.h"
31#include "qemu/log.h"
32#ifdef CONFIG_USER_ONLY
33#include "qemu.h"
34
35#define ARM_ANGEL_HEAP_SIZE (128 * 1024 * 1024)
36#else
37#include "exec/gdbstub.h"
38#include "qemu/cutils.h"
39#endif
40
41#define TARGET_SYS_OPEN 0x01
42#define TARGET_SYS_CLOSE 0x02
43#define TARGET_SYS_WRITEC 0x03
44#define TARGET_SYS_WRITE0 0x04
45#define TARGET_SYS_WRITE 0x05
46#define TARGET_SYS_READ 0x06
47#define TARGET_SYS_READC 0x07
48#define TARGET_SYS_ISTTY 0x09
49#define TARGET_SYS_SEEK 0x0a
50#define TARGET_SYS_FLEN 0x0c
51#define TARGET_SYS_TMPNAM 0x0d
52#define TARGET_SYS_REMOVE 0x0e
53#define TARGET_SYS_RENAME 0x0f
54#define TARGET_SYS_CLOCK 0x10
55#define TARGET_SYS_TIME 0x11
56#define TARGET_SYS_SYSTEM 0x12
57#define TARGET_SYS_ERRNO 0x13
58#define TARGET_SYS_GET_CMDLINE 0x15
59#define TARGET_SYS_HEAPINFO 0x16
60#define TARGET_SYS_EXIT 0x18
61#define TARGET_SYS_SYNCCACHE 0x19
62
63/* ADP_Stopped_ApplicationExit is used for exit(0),
64 * anything else is implemented as exit(1) */
65#define ADP_Stopped_ApplicationExit (0x20026)
66
67#ifndef O_BINARY
68#define O_BINARY 0
69#endif
70
71#define GDB_O_RDONLY 0x000
72#define GDB_O_WRONLY 0x001
73#define GDB_O_RDWR 0x002
74#define GDB_O_APPEND 0x008
75#define GDB_O_CREAT 0x200
76#define GDB_O_TRUNC 0x400
77#define GDB_O_BINARY 0
78
79static int gdb_open_modeflags[12] = {
80 GDB_O_RDONLY,
81 GDB_O_RDONLY | GDB_O_BINARY,
82 GDB_O_RDWR,
83 GDB_O_RDWR | GDB_O_BINARY,
84 GDB_O_WRONLY | GDB_O_CREAT | GDB_O_TRUNC,
85 GDB_O_WRONLY | GDB_O_CREAT | GDB_O_TRUNC | GDB_O_BINARY,
86 GDB_O_RDWR | GDB_O_CREAT | GDB_O_TRUNC,
87 GDB_O_RDWR | GDB_O_CREAT | GDB_O_TRUNC | GDB_O_BINARY,
88 GDB_O_WRONLY | GDB_O_CREAT | GDB_O_APPEND,
89 GDB_O_WRONLY | GDB_O_CREAT | GDB_O_APPEND | GDB_O_BINARY,
90 GDB_O_RDWR | GDB_O_CREAT | GDB_O_APPEND,
91 GDB_O_RDWR | GDB_O_CREAT | GDB_O_APPEND | GDB_O_BINARY
92};
93
94static int open_modeflags[12] = {
95 O_RDONLY,
96 O_RDONLY | O_BINARY,
97 O_RDWR,
98 O_RDWR | O_BINARY,
99 O_WRONLY | O_CREAT | O_TRUNC,
100 O_WRONLY | O_CREAT | O_TRUNC | O_BINARY,
101 O_RDWR | O_CREAT | O_TRUNC,
102 O_RDWR | O_CREAT | O_TRUNC | O_BINARY,
103 O_WRONLY | O_CREAT | O_APPEND,
104 O_WRONLY | O_CREAT | O_APPEND | O_BINARY,
105 O_RDWR | O_CREAT | O_APPEND,
106 O_RDWR | O_CREAT | O_APPEND | O_BINARY
107};
108
109#ifdef CONFIG_USER_ONLY
110static inline uint32_t set_swi_errno(TaskState *ts, uint32_t code)
111{
112 if (code == (uint32_t)-1)
113 ts->swi_errno = errno;
114 return code;
115}
116#else
117static inline uint32_t set_swi_errno(CPUARMState *env, uint32_t code)
118{
119 return code;
120}
121
122#include "exec/softmmu-semi.h"
123#endif
124
125static target_ulong arm_semi_syscall_len;
126
127#if !defined(CONFIG_USER_ONLY)
128static target_ulong syscall_err;
129#endif
130
131static void arm_semi_cb(CPUState *cs, target_ulong ret, target_ulong err)
132{
133 ARMCPU *cpu = ARM_CPU(cs);
134 CPUARMState *env = &cpu->env;
135#ifdef CONFIG_USER_ONLY
136 TaskState *ts = cs->opaque;
137#endif
138 target_ulong reg0 = is_a64(env) ? env->xregs[0] : env->regs[0];
139
140 if (ret == (target_ulong)-1) {
141#ifdef CONFIG_USER_ONLY
142 ts->swi_errno = err;
143#else
144 syscall_err = err;
145#endif
146 reg0 = ret;
147 } else {
148 /* Fixup syscalls that use nonstardard return conventions. */
149 switch (reg0) {
150 case TARGET_SYS_WRITE:
151 case TARGET_SYS_READ:
152 reg0 = arm_semi_syscall_len - ret;
153 break;
154 case TARGET_SYS_SEEK:
155 reg0 = 0;
156 break;
157 default:
158 reg0 = ret;
159 break;
160 }
161 }
162 if (is_a64(env)) {
163 env->xregs[0] = reg0;
164 } else {
165 env->regs[0] = reg0;
166 }
167}
168
169static target_ulong arm_flen_buf(ARMCPU *cpu)
170{
171 /* Return an address in target memory of 64 bytes where the remote
172 * gdb should write its stat struct. (The format of this structure
173 * is defined by GDB's remote protocol and is not target-specific.)
174 * We put this on the guest's stack just below SP.
175 */
176 CPUARMState *env = &cpu->env;
177 target_ulong sp;
178
179 if (is_a64(env)) {
180 sp = env->xregs[31];
181 } else {
182 sp = env->regs[13];
183 }
184
185 return sp - 64;
186}
187
188static void arm_semi_flen_cb(CPUState *cs, target_ulong ret, target_ulong err)
189{
190 ARMCPU *cpu = ARM_CPU(cs);
191 CPUARMState *env = &cpu->env;
192 /* The size is always stored in big-endian order, extract
193 the value. We assume the size always fit in 32 bits. */
194 uint32_t size;
195 cpu_memory_rw_debug(cs, arm_flen_buf(cpu) + 32, (uint8_t *)&size, 4, 0);
196 size = be32_to_cpu(size);
197 if (is_a64(env)) {
198 env->xregs[0] = size;
199 } else {
200 env->regs[0] = size;
201 }
202#ifdef CONFIG_USER_ONLY
203 ((TaskState *)cs->opaque)->swi_errno = err;
204#else
205 syscall_err = err;
206#endif
207}
208
209static target_ulong arm_gdb_syscall(ARMCPU *cpu, gdb_syscall_complete_cb cb,
210 const char *fmt, ...)
211{
212 va_list va;
213 CPUARMState *env = &cpu->env;
214
215 va_start(va, fmt);
216 gdb_do_syscallv(cb, fmt, va);
217 va_end(va);
218
219 /* FIXME: we are implicitly relying on the syscall completing
220 * before this point, which is not guaranteed. We should
221 * put in an explicit synchronization between this and
222 * the callback function.
223 */
224
225 return is_a64(env) ? env->xregs[0] : env->regs[0];
226}
227
228/* Read the input value from the argument block; fail the semihosting
229 * call if the memory read fails.
230 */
231#define GET_ARG(n) do { \
232 if (is_a64(env)) { \
233 if (get_user_u64(arg ## n, args + (n) * 8)) { \
234 return -1; \
235 } \
236 } else { \
237 if (get_user_u32(arg ## n, args + (n) * 4)) { \
238 return -1; \
239 } \
240 } \
241} while (0)
242
243#define SET_ARG(n, val) \
244 (is_a64(env) ? \
245 put_user_u64(val, args + (n) * 8) : \
246 put_user_u32(val, args + (n) * 4))
247
248/*
249 * Do a semihosting call.
250 *
251 * The specification always says that the "return register" either
252 * returns a specific value or is corrupted, so we don't need to
253 * report to our caller whether we are returning a value or trying to
254 * leave the register unchanged. We use 0xdeadbeef as the return value
255 * when there isn't a defined return value for the call.
256 */
257target_ulong do_arm_semihosting(CPUARMState *env)
258{
259 ARMCPU *cpu = env_archcpu(env);
260 CPUState *cs = env_cpu(env);
261 target_ulong args;
262 target_ulong arg0, arg1, arg2, arg3;
263 char * s;
264 int nr;
265 uint32_t ret;
266 uint32_t len;
267#ifdef CONFIG_USER_ONLY
268 TaskState *ts = cs->opaque;
269#else
270 CPUARMState *ts = env;
271#endif
272
273 if (is_a64(env)) {
274 /* Note that the syscall number is in W0, not X0 */
275 nr = env->xregs[0] & 0xffffffffU;
276 args = env->xregs[1];
277 } else {
278 nr = env->regs[0];
279 args = env->regs[1];
280 }
281
282 switch (nr) {
283 case TARGET_SYS_OPEN:
284 GET_ARG(0);
285 GET_ARG(1);
286 GET_ARG(2);
287 s = lock_user_string(arg0);
288 if (!s) {
289 /* FIXME - should this error code be -TARGET_EFAULT ? */
290 return (uint32_t)-1;
291 }
292 if (arg1 >= 12) {
293 unlock_user(s, arg0, 0);
294 return (uint32_t)-1;
295 }
296 if (strcmp(s, ":tt") == 0) {
297 int result_fileno = arg1 < 4 ? STDIN_FILENO : STDOUT_FILENO;
298 unlock_user(s, arg0, 0);
299 return result_fileno;
300 }
301 if (use_gdb_syscalls()) {
302 ret = arm_gdb_syscall(cpu, arm_semi_cb, "open,%s,%x,1a4", arg0,
303 (int)arg2+1, gdb_open_modeflags[arg1]);
304 } else {
305 ret = set_swi_errno(ts, open(s, open_modeflags[arg1], 0644));
306 }
307 unlock_user(s, arg0, 0);
308 return ret;
309 case TARGET_SYS_CLOSE:
310 GET_ARG(0);
311 if (use_gdb_syscalls()) {
312 return arm_gdb_syscall(cpu, arm_semi_cb, "close,%x", arg0);
313 } else {
314 return set_swi_errno(ts, close(arg0));
315 }
316 case TARGET_SYS_WRITEC:
317 qemu_semihosting_console_outc(env, args);
318 return 0xdeadbeef;
319 case TARGET_SYS_WRITE0:
320 return qemu_semihosting_console_outs(env, args);
321 case TARGET_SYS_WRITE:
322 GET_ARG(0);
323 GET_ARG(1);
324 GET_ARG(2);
325 len = arg2;
326 if (use_gdb_syscalls()) {
327 arm_semi_syscall_len = len;
328 return arm_gdb_syscall(cpu, arm_semi_cb, "write,%x,%x,%x",
329 arg0, arg1, len);
330 } else {
331 s = lock_user(VERIFY_READ, arg1, len, 1);
332 if (!s) {
333 /* Return bytes not written on error */
334 return len;
335 }
336 ret = set_swi_errno(ts, write(arg0, s, len));
337 unlock_user(s, arg1, 0);
338 if (ret == (uint32_t)-1) {
339 ret = 0;
340 }
341 /* Return bytes not written */
342 return len - ret;
343 }
344 case TARGET_SYS_READ:
345 GET_ARG(0);
346 GET_ARG(1);
347 GET_ARG(2);
348 len = arg2;
349 if (use_gdb_syscalls()) {
350 arm_semi_syscall_len = len;
351 return arm_gdb_syscall(cpu, arm_semi_cb, "read,%x,%x,%x",
352 arg0, arg1, len);
353 } else {
354 s = lock_user(VERIFY_WRITE, arg1, len, 0);
355 if (!s) {
356 /* return bytes not read */
357 return len;
358 }
359 do {
360 ret = set_swi_errno(ts, read(arg0, s, len));
361 } while (ret == -1 && errno == EINTR);
362 unlock_user(s, arg1, len);
363 if (ret == (uint32_t)-1) {
364 ret = 0;
365 }
366 /* Return bytes not read */
367 return len - ret;
368 }
369 case TARGET_SYS_READC:
370 qemu_log_mask(LOG_UNIMP, "%s: SYS_READC not implemented", __func__);
371 return 0;
372 case TARGET_SYS_ISTTY:
373 GET_ARG(0);
374 if (use_gdb_syscalls()) {
375 return arm_gdb_syscall(cpu, arm_semi_cb, "isatty,%x", arg0);
376 } else {
377 return isatty(arg0);
378 }
379 case TARGET_SYS_SEEK:
380 GET_ARG(0);
381 GET_ARG(1);
382 if (use_gdb_syscalls()) {
383 return arm_gdb_syscall(cpu, arm_semi_cb, "lseek,%x,%x,0",
384 arg0, arg1);
385 } else {
386 ret = set_swi_errno(ts, lseek(arg0, arg1, SEEK_SET));
387 if (ret == (uint32_t)-1)
388 return -1;
389 return 0;
390 }
391 case TARGET_SYS_FLEN:
392 GET_ARG(0);
393 if (use_gdb_syscalls()) {
394 return arm_gdb_syscall(cpu, arm_semi_flen_cb, "fstat,%x,%x",
395 arg0, arm_flen_buf(cpu));
396 } else {
397 struct stat buf;
398 ret = set_swi_errno(ts, fstat(arg0, &buf));
399 if (ret == (uint32_t)-1)
400 return -1;
401 return buf.st_size;
402 }
403 case TARGET_SYS_TMPNAM:
404 qemu_log_mask(LOG_UNIMP, "%s: SYS_TMPNAM not implemented", __func__);
405 return -1;
406 case TARGET_SYS_REMOVE:
407 GET_ARG(0);
408 GET_ARG(1);
409 if (use_gdb_syscalls()) {
410 ret = arm_gdb_syscall(cpu, arm_semi_cb, "unlink,%s",
411 arg0, (int)arg1+1);
412 } else {
413 s = lock_user_string(arg0);
414 if (!s) {
415 /* FIXME - should this error code be -TARGET_EFAULT ? */
416 return (uint32_t)-1;
417 }
418 ret = set_swi_errno(ts, remove(s));
419 unlock_user(s, arg0, 0);
420 }
421 return ret;
422 case TARGET_SYS_RENAME:
423 GET_ARG(0);
424 GET_ARG(1);
425 GET_ARG(2);
426 GET_ARG(3);
427 if (use_gdb_syscalls()) {
428 return arm_gdb_syscall(cpu, arm_semi_cb, "rename,%s,%s",
429 arg0, (int)arg1+1, arg2, (int)arg3+1);
430 } else {
431 char *s2;
432 s = lock_user_string(arg0);
433 s2 = lock_user_string(arg2);
434 if (!s || !s2)
435 /* FIXME - should this error code be -TARGET_EFAULT ? */
436 ret = (uint32_t)-1;
437 else
438 ret = set_swi_errno(ts, rename(s, s2));
439 if (s2)
440 unlock_user(s2, arg2, 0);
441 if (s)
442 unlock_user(s, arg0, 0);
443 return ret;
444 }
445 case TARGET_SYS_CLOCK:
446 return clock() / (CLOCKS_PER_SEC / 100);
447 case TARGET_SYS_TIME:
448 return set_swi_errno(ts, time(NULL));
449 case TARGET_SYS_SYSTEM:
450 GET_ARG(0);
451 GET_ARG(1);
452 if (use_gdb_syscalls()) {
453 return arm_gdb_syscall(cpu, arm_semi_cb, "system,%s",
454 arg0, (int)arg1+1);
455 } else {
456 s = lock_user_string(arg0);
457 if (!s) {
458 /* FIXME - should this error code be -TARGET_EFAULT ? */
459 return (uint32_t)-1;
460 }
461 ret = set_swi_errno(ts, system(s));
462 unlock_user(s, arg0, 0);
463 return ret;
464 }
465 case TARGET_SYS_ERRNO:
466#ifdef CONFIG_USER_ONLY
467 return ts->swi_errno;
468#else
469 return syscall_err;
470#endif
471 case TARGET_SYS_GET_CMDLINE:
472 {
473 /* Build a command-line from the original argv.
474 *
475 * The inputs are:
476 * * arg0, pointer to a buffer of at least the size
477 * specified in arg1.
478 * * arg1, size of the buffer pointed to by arg0 in
479 * bytes.
480 *
481 * The outputs are:
482 * * arg0, pointer to null-terminated string of the
483 * command line.
484 * * arg1, length of the string pointed to by arg0.
485 */
486
487 char *output_buffer;
488 size_t input_size;
489 size_t output_size;
490 int status = 0;
491#if !defined(CONFIG_USER_ONLY)
492 const char *cmdline;
493#endif
494 GET_ARG(0);
495 GET_ARG(1);
496 input_size = arg1;
497 /* Compute the size of the output string. */
498#if !defined(CONFIG_USER_ONLY)
499 cmdline = semihosting_get_cmdline();
500 if (cmdline == NULL) {
501 cmdline = ""; /* Default to an empty line. */
502 }
503 output_size = strlen(cmdline) + 1; /* Count terminating 0. */
504#else
505 unsigned int i;
506
507 output_size = ts->info->arg_end - ts->info->arg_start;
508 if (!output_size) {
509 /*
510 * We special-case the "empty command line" case (argc==0).
511 * Just provide the terminating 0.
512 */
513 output_size = 1;
514 }
515#endif
516
517 if (output_size > input_size) {
518 /* Not enough space to store command-line arguments. */
519 return -1;
520 }
521
522 /* Adjust the command-line length. */
523 if (SET_ARG(1, output_size - 1)) {
524 /* Couldn't write back to argument block */
525 return -1;
526 }
527
528 /* Lock the buffer on the ARM side. */
529 output_buffer = lock_user(VERIFY_WRITE, arg0, output_size, 0);
530 if (!output_buffer) {
531 return -1;
532 }
533
534 /* Copy the command-line arguments. */
535#if !defined(CONFIG_USER_ONLY)
536 pstrcpy(output_buffer, output_size, cmdline);
537#else
538 if (output_size == 1) {
539 /* Empty command-line. */
540 output_buffer[0] = '\0';
541 goto out;
542 }
543
544 if (copy_from_user(output_buffer, ts->info->arg_start,
545 output_size)) {
546 status = -1;
547 goto out;
548 }
549
550 /* Separate arguments by white spaces. */
551 for (i = 0; i < output_size - 1; i++) {
552 if (output_buffer[i] == 0) {
553 output_buffer[i] = ' ';
554 }
555 }
556 out:
557#endif
558 /* Unlock the buffer on the ARM side. */
559 unlock_user(output_buffer, arg0, output_size);
560
561 return status;
562 }
563 case TARGET_SYS_HEAPINFO:
564 {
565 target_ulong retvals[4];
566 target_ulong limit;
567 int i;
568
569 GET_ARG(0);
570
571#ifdef CONFIG_USER_ONLY
572 /*
573 * Some C libraries assume the heap immediately follows .bss, so
574 * allocate it using sbrk.
575 */
576 if (!ts->heap_limit) {
577 abi_ulong ret;
578
579 ts->heap_base = do_brk(0);
580 limit = ts->heap_base + ARM_ANGEL_HEAP_SIZE;
581 /* Try a big heap, and reduce the size if that fails. */
582 for (;;) {
583 ret = do_brk(limit);
584 if (ret >= limit) {
585 break;
586 }
587 limit = (ts->heap_base >> 1) + (limit >> 1);
588 }
589 ts->heap_limit = limit;
590 }
591
592 retvals[0] = ts->heap_base;
593 retvals[1] = ts->heap_limit;
594 retvals[2] = ts->stack_base;
595 retvals[3] = 0; /* Stack limit. */
596#else
597 limit = ram_size;
598 /* TODO: Make this use the limit of the loaded application. */
599 retvals[0] = limit / 2;
600 retvals[1] = limit;
601 retvals[2] = limit; /* Stack base */
602 retvals[3] = 0; /* Stack limit. */
603#endif
604
605 for (i = 0; i < ARRAY_SIZE(retvals); i++) {
606 bool fail;
607
608 if (is_a64(env)) {
609 fail = put_user_u64(retvals[i], arg0 + i * 8);
610 } else {
611 fail = put_user_u32(retvals[i], arg0 + i * 4);
612 }
613
614 if (fail) {
615 /* Couldn't write back to argument block */
616 return -1;
617 }
618 }
619 return 0;
620 }
621 case TARGET_SYS_EXIT:
622 if (is_a64(env)) {
623 /*
624 * The A64 version of this call takes a parameter block,
625 * so the application-exit type can return a subcode which
626 * is the exit status code from the application.
627 */
628 GET_ARG(0);
629 GET_ARG(1);
630
631 if (arg0 == ADP_Stopped_ApplicationExit) {
632 ret = arg1;
633 } else {
634 ret = 1;
635 }
636 } else {
637 /*
638 * ARM specifies only Stopped_ApplicationExit as normal
639 * exit, everything else is considered an error
640 */
641 ret = (args == ADP_Stopped_ApplicationExit) ? 0 : 1;
642 }
643 gdb_exit(env, ret);
644 exit(ret);
645 case TARGET_SYS_SYNCCACHE:
646 /*
647 * Clean the D-cache and invalidate the I-cache for the specified
648 * virtual address range. This is a nop for us since we don't
649 * implement caches. This is only present on A64.
650 */
651 if (is_a64(env)) {
652 return 0;
653 }
654 /* fall through -- invalid for A32/T32 */
655 default:
656 fprintf(stderr, "qemu: Unsupported SemiHosting SWI 0x%02x\n", nr);
657 cpu_dump_state(cs, stderr, 0);
658 abort();
659 }
660}
661