4 * Copyright (c) 2003 Fabrice Bellard
5 * Copyright (c) 2006 Pierre d'Herbemont
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 2 of the License, or
10 * (at your option) any later version.
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, write to the Free Software
19 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
28 #include <sys/syscall.h>
33 #define DEBUG_LOGFILE "/tmp/qemu.log"
36 #include <crt_externs.h>
37 # define environ (*_NSGetEnviron())
40 #include <mach/mach_init.h>
41 #include <mach/vm_map.h>
43 const char *interp_prefix = "";
45 asm(".zerofill __STD_PROG_ZONE, __STD_PROG_ZONE, __std_prog_zone, 0x0dfff000");
47 /* XXX: on x86 MAP_GROWSDOWN only works if ESP <= address + 32, so
48 we allocate a bigger stack. Need a better solution, for example
49 by remapping the process stack directly at the right place */
50 unsigned long stack_size = 512 * 1024;
52 void qerror(const char *fmt, ...)
57 vfprintf(stderr, fmt, ap);
59 fprintf(stderr, "\n");
63 void gemu_log(const char *fmt, ...)
68 vfprintf(stderr, fmt, ap);
72 void cpu_outb(CPUState *env, int addr, int val)
74 fprintf(stderr, "outb: port=0x%04x, data=%02x\n", addr, val);
77 void cpu_outw(CPUState *env, int addr, int val)
79 fprintf(stderr, "outw: port=0x%04x, data=%04x\n", addr, val);
82 void cpu_outl(CPUState *env, int addr, int val)
84 fprintf(stderr, "outl: port=0x%04x, data=%08x\n", addr, val);
87 int cpu_inb(CPUState *env, int addr)
89 fprintf(stderr, "inb: port=0x%04x\n", addr);
93 int cpu_inw(CPUState *env, int addr)
95 fprintf(stderr, "inw: port=0x%04x\n", addr);
99 int cpu_inl(CPUState *env, int addr)
101 fprintf(stderr, "inl: port=0x%04x\n", addr);
105 int cpu_get_pic_interrupt(CPUState *env)
111 static inline uint64_t cpu_ppc_get_tb (CPUState *env)
117 uint32_t cpu_ppc_load_tbl (CPUState *env)
119 return cpu_ppc_get_tb(env) & 0xFFFFFFFF;
122 uint32_t cpu_ppc_load_tbu (CPUState *env)
124 return cpu_ppc_get_tb(env) >> 32;
127 static void cpu_ppc_store_tb (CPUState *env, uint64_t value)
132 void cpu_ppc_store_tbu (CPUState *env, uint32_t value)
134 cpu_ppc_store_tb(env, ((uint64_t)value << 32) | cpu_ppc_load_tbl(env));
137 void cpu_ppc_store_tbl (CPUState *env, uint32_t value)
139 cpu_ppc_store_tb(env, ((uint64_t)cpu_ppc_load_tbl(env) << 32) | value);
142 uint32_t cpu_ppc_load_decr (CPUState *env)
148 void cpu_ppc_store_decr (CPUState *env, uint32_t value)
153 void cpu_loop(CPUPPCState *env)
157 target_siginfo_t info;
160 trapnr = cpu_ppc_exec(env);
161 if (trapnr != EXCP_SYSCALL_USER && trapnr != EXCP_BRANCH &&
162 trapnr != EXCP_TRACE) {
164 cpu_dump_state(env, logfile, fprintf, 0);
170 case EXCP_SYSCALL_USER:
172 if(((int)env->gpr[0]) <= SYS_MAXSYSCALL && ((int)env->gpr[0])>0)
173 ret = do_unix_syscall(env, env->gpr[0]/*, env->gpr[3], env->gpr[4],
174 env->gpr[5], env->gpr[6], env->gpr[7],
175 env->gpr[8], env->gpr[9], env->gpr[10]*/);
176 else if(((int)env->gpr[0])<0)
177 ret = do_mach_syscall(env, env->gpr[0], env->gpr[3], env->gpr[4],
178 env->gpr[5], env->gpr[6], env->gpr[7],
179 env->gpr[8], env->gpr[9], env->gpr[10]);
181 ret = do_thread_syscall(env, env->gpr[0], env->gpr[3], env->gpr[4],
182 env->gpr[5], env->gpr[6], env->gpr[7],
183 env->gpr[8], env->gpr[9], env->gpr[10]);
185 /* Unix syscall error signaling */
186 if(((int)env->gpr[0]) <= SYS_MAXSYSCALL && ((int)env->gpr[0])>0)
198 /* Should not happen ! */
199 fprintf(stderr, "RESET asked... Stop emulation\n");
201 fprintf(logfile, "RESET asked... Stop emulation\n");
203 case EXCP_MACHINE_CHECK:
204 fprintf(stderr, "Machine check exeption... Stop emulation\n");
206 fprintf(logfile, "RESET asked... Stop emulation\n");
207 info.si_signo = SIGBUS;
209 info.si_code = BUS_OBJERR;
210 info.si_addr = (void*)(env->nip - 4);
211 queue_signal(info.si_signo, &info);
214 /* To deal with multiple qemu header version as host for the darwin-user code */
217 fprintf(stderr, "Invalid data memory access: 0x%08x\n", env->spr[DAR]);
219 fprintf(logfile, "Invalid data memory access: 0x%08x\n",
222 /* Handle this via the gdb */
223 gdb_handlesig (env, SIGSEGV);
225 info.si_addr = (void*)env->nip;
226 queue_signal(info.si_signo, &info);
229 fprintf(stderr, "Invalid instruction fetch\n");
231 fprintf(logfile, "Invalid instruction fetch\n");
232 /* Handle this via the gdb */
233 gdb_handlesig (env, SIGSEGV);
235 info.si_addr = (void*)(env->nip - 4);
236 queue_signal(info.si_signo, &info);
239 /* Should not happen ! */
240 fprintf(stderr, "External interruption... Stop emulation\n");
242 fprintf(logfile, "External interruption... Stop emulation\n");
245 fprintf(stderr, "Invalid unaligned memory access\n");
247 fprintf(logfile, "Invalid unaligned memory access\n");
248 info.si_signo = SIGBUS;
250 info.si_code = BUS_ADRALN;
251 info.si_addr = (void*)(env->nip - 4);
252 queue_signal(info.si_signo, &info);
255 switch (env->error_code & ~0xF) {
257 fprintf(stderr, "Program exception\n");
259 fprintf(logfile, "Program exception\n");
261 env->fpscr[7] |= 0x8;
262 /* Finally, update FEX */
263 if ((((env->fpscr[7] & 0x3) << 3) | (env->fpscr[6] >> 1)) &
264 ((env->fpscr[1] << 1) | (env->fpscr[0] >> 3)))
265 env->fpscr[7] |= 0x4;
266 info.si_signo = SIGFPE;
268 switch (env->error_code & 0xF) {
270 info.si_code = FPE_FLTOVF;
273 info.si_code = FPE_FLTUND;
277 info.si_code = FPE_FLTDIV;
280 info.si_code = FPE_FLTRES;
283 info.si_code = FPE_FLTINV;
292 info.si_code = FPE_FLTSUB;
295 fprintf(stderr, "Unknown floating point exception "
296 "(%02x)\n", env->error_code);
298 fprintf(logfile, "Unknown floating point exception "
299 "(%02x)\n", env->error_code & 0xF);
304 fprintf(stderr, "Invalid instruction\n");
306 fprintf(logfile, "Invalid instruction\n");
307 info.si_signo = SIGILL;
309 switch (env->error_code & 0xF) {
310 case EXCP_INVAL_INVAL:
311 info.si_code = ILL_ILLOPC;
313 case EXCP_INVAL_LSWX:
314 info.si_code = ILL_ILLOPN;
317 info.si_code = ILL_PRVREG;
320 info.si_code = ILL_COPROC;
323 fprintf(stderr, "Unknown invalid operation (%02x)\n",
324 env->error_code & 0xF);
326 fprintf(logfile, "Unknown invalid operation (%02x)\n",
327 env->error_code & 0xF);
329 info.si_code = ILL_ILLADR;
332 /* Handle this via the gdb */
333 gdb_handlesig (env, SIGSEGV);
336 fprintf(stderr, "Privilege violation\n");
338 fprintf(logfile, "Privilege violation\n");
339 info.si_signo = SIGILL;
341 switch (env->error_code & 0xF) {
343 info.si_code = ILL_PRVOPC;
346 info.si_code = ILL_PRVREG;
349 fprintf(stderr, "Unknown privilege violation (%02x)\n",
350 env->error_code & 0xF);
351 info.si_code = ILL_PRVOPC;
356 fprintf(stderr, "Tried to call a TRAP\n");
358 fprintf(logfile, "Tried to call a TRAP\n");
361 /* Should not happen ! */
362 fprintf(stderr, "Unknown program exception (%02x)\n",
365 fprintf(logfile, "Unknwon program exception (%02x)\n",
370 info.si_addr = (void*)(env->nip - 4);
371 queue_signal(info.si_signo, &info);
374 fprintf(stderr, "No floating point allowed\n");
376 fprintf(logfile, "No floating point allowed\n");
377 info.si_signo = SIGILL;
379 info.si_code = ILL_COPROC;
380 info.si_addr = (void*)(env->nip - 4);
381 queue_signal(info.si_signo, &info);
384 /* Should not happen ! */
385 fprintf(stderr, "Decrementer exception\n");
387 fprintf(logfile, "Decrementer exception\n");
390 /* Pass to gdb: we use this to trace execution */
391 gdb_handlesig (env, SIGTRAP);
394 /* Should not happen ! */
395 fprintf(stderr, "Floating point assist exception\n");
397 fprintf(logfile, "Floating point assist exception\n");
400 /* We reloaded the msr, just go on */
402 fprintf(stderr, "Tried to go into supervisor mode !\n");
404 fprintf(logfile, "Tried to go into supervisor mode !\n");
409 /* We stopped because of a jump... */
412 /* Don't know why this should ever happen... */
413 fprintf(stderr, "EXCP_INTERRUPT\n");
416 gdb_handlesig (env, SIGTRAP);
419 fprintf(stderr, "qemu: unhandled CPU exception 0x%x - aborting\n",
422 fprintf(logfile, "qemu: unhandled CPU exception 0x%02x - "
423 "0x%02x - aborting\n", trapnr, env->error_code);
427 process_pending_signals(env);
435 /***********************************************************/
436 /* CPUX86 core interface */
438 uint64_t cpu_get_tsc(CPUX86State *env)
440 return cpu_get_real_ticks();
444 write_dt(void *ptr, unsigned long addr, unsigned long limit,
448 e1 = (addr << 16) | (limit & 0xffff);
449 e2 = ((addr >> 16) & 0xff) | (addr & 0xff000000) | (limit & 0x000f0000);
451 stl((uint8_t *)ptr, e1);
452 stl((uint8_t *)ptr + 4, e2);
455 static void set_gate(void *ptr, unsigned int type, unsigned int dpl,
456 unsigned long addr, unsigned int sel)
459 e1 = (addr & 0xffff) | (sel << 16);
460 e2 = (addr & 0xffff0000) | 0x8000 | (dpl << 13) | (type << 8);
461 stl((uint8_t *)ptr, e1);
462 stl((uint8_t *)ptr + 4, e2);
465 #define GDT_TABLE_SIZE 14
466 #define LDT_TABLE_SIZE 15
467 #define IDT_TABLE_SIZE 256
469 uint64_t gdt_table[GDT_TABLE_SIZE];
470 uint64_t ldt_table[LDT_TABLE_SIZE];
471 uint64_t idt_table[IDT_TABLE_SIZE];
472 uint32_t tss[TSS_SIZE];
474 /* only dpl matters as we do only user space emulation */
475 static void set_idt(int n, unsigned int dpl)
477 set_gate(idt_table + n, 0, dpl, 0, 0);
480 /* ABI convention: after a syscall if there was an error the CF flag is set */
481 static inline set_error(CPUX86State *env, int ret)
484 env->eflags = env->eflags | 0x1;
487 env->regs[R_EAX] = ret;
490 void cpu_loop(CPUX86State *env)
495 target_siginfo_t info;
498 trapnr = cpu_x86_exec(env);
499 uint32_t *params = (uint32_t *)env->regs[R_ESP];
501 case 0x79: /* Our commpage hack back door exit is here */
502 do_commpage(env, env->eip, *(params + 1), *(params + 2),
503 *(params + 3), *(params + 4),
504 *(params + 5), *(params + 6),
505 *(params + 7), *(params + 8));
507 case 0x81: /* mach syscall */
509 ret = do_mach_syscall(env, env->regs[R_EAX],
510 *(params + 1), *(params + 2),
511 *(params + 3), *(params + 4),
512 *(params + 5), *(params + 6),
513 *(params + 7), *(params + 8));
517 case 0x90: /* unix backdoor */
519 /* after sysenter, stack is in R_ECX, new eip in R_EDX (sysexit will flip them back)*/
520 int saved_stack = env->regs[R_ESP];
521 env->regs[R_ESP] = env->regs[R_ECX];
523 ret = do_unix_syscall(env, env->regs[R_EAX]);
525 env->regs[R_ECX] = env->regs[R_ESP];
526 env->regs[R_ESP] = saved_stack;
531 case 0x80: /* unix syscall */
533 ret = do_unix_syscall(env, env->regs[R_EAX]/*,
534 *(params + 1), *(params + 2),
535 *(params + 3), *(params + 4),
536 *(params + 5), *(params + 6),
537 *(params + 7), *(params + 8)*/);
541 case 0x82: /* thread syscall */
543 ret = do_thread_syscall(env, env->regs[R_EAX],
544 *(params + 1), *(params + 2),
545 *(params + 3), *(params + 4),
546 *(params + 5), *(params + 6),
547 *(params + 7), *(params + 8));
553 info.si_signo = SIGBUS;
555 info.si_code = BUS_NOOP;
557 gdb_handlesig (env, SIGBUS);
558 queue_signal(info.si_signo, &info);
561 info.si_signo = SIGSEGV;
563 info.si_code = SEGV_NOOP;
565 gdb_handlesig (env, SIGSEGV);
566 queue_signal(info.si_signo, &info);
569 info.si_signo = SIGSEGV;
571 if (!(env->error_code & 1))
572 info.si_code = SEGV_MAPERR;
574 info.si_code = SEGV_ACCERR;
575 info.si_addr = (void*)env->cr[2];
576 gdb_handlesig (env, SIGSEGV);
577 queue_signal(info.si_signo, &info);
580 /* division by zero */
581 info.si_signo = SIGFPE;
583 info.si_code = FPE_INTDIV;
584 info.si_addr = (void*)env->eip;
585 gdb_handlesig (env, SIGFPE);
586 queue_signal(info.si_signo, &info);
590 info.si_signo = SIGTRAP;
592 info.si_code = TRAP_BRKPT;
593 info.si_addr = (void*)env->eip;
594 gdb_handlesig (env, SIGTRAP);
595 queue_signal(info.si_signo, &info);
599 info.si_signo = SIGSEGV;
601 info.si_code = SEGV_NOOP;
603 gdb_handlesig (env, SIGSEGV);
604 queue_signal(info.si_signo, &info);
607 info.si_signo = SIGILL;
609 info.si_code = ILL_ILLOPN;
610 info.si_addr = (void*)env->eip;
611 gdb_handlesig (env, SIGILL);
612 queue_signal(info.si_signo, &info);
615 /* just indicate that signals should be handled asap */
621 sig = gdb_handlesig (env, SIGTRAP);
626 info.si_code = TRAP_BRKPT;
627 queue_signal(info.si_signo, &info);
632 pc = (void*)(env->segs[R_CS].base + env->eip);
633 fprintf(stderr, "qemu: 0x%08lx: unhandled CPU exception 0x%x - aborting\n",
637 process_pending_signals(env);
644 printf("qemu-" TARGET_ARCH " version " QEMU_VERSION ", Copyright (c) 2003-2004 Fabrice Bellard\n"
645 "usage: qemu-" TARGET_ARCH " [-h] [-d opts] [-L path] [-s size] program [arguments...]\n"
646 "Darwin CPU emulator (compiled for %s emulation)\n"
648 "-h print this help\n"
649 "-L path set the elf interpreter prefix (default=%s)\n"
650 "-s size set the stack size in bytes (default=%ld)\n"
654 "-no-code-copy disable code copy acceleration\n"
656 "-d options activate log (logfile=%s)\n"
657 "-g wait for gdb on port 1234\n"
658 "-p pagesize set the host page size to 'pagesize'\n",
666 /* XXX: currently only used for async signals (see signal.c) */
667 CPUState *global_env;
668 /* used only if single thread */
669 CPUState *cpu_single_env = NULL;
671 /* used to free thread contexts */
672 TaskState *first_task_state;
674 int main(int argc, char **argv)
676 const char *filename;
677 struct target_pt_regs regs1, *regs = ®s1;
678 TaskState ts1, *ts = &ts1;
681 short use_gdbstub = 0;
688 cpu_set_log_filename(DEBUG_LOGFILE);
699 if (!strcmp(r, "-")) {
701 } else if (!strcmp(r, "d")) {
709 mask = cpu_str_to_log_mask(r);
711 printf("Log items (comma separated):\n");
712 for(item = cpu_log_items; item->mask != 0; item++) {
713 printf("%-10s %s\n", item->name, item->help);
718 } else if (!strcmp(r, "s")) {
720 stack_size = strtol(r, (char **)&r, 0);
724 stack_size *= 1024 * 1024;
725 else if (*r == 'k' || *r == 'K')
727 } else if (!strcmp(r, "L")) {
728 interp_prefix = argv[optind++];
729 } else if (!strcmp(r, "p")) {
730 qemu_host_page_size = atoi(argv[optind++]);
731 if (qemu_host_page_size == 0 ||
732 (qemu_host_page_size & (qemu_host_page_size - 1)) != 0) {
733 fprintf(stderr, "page size must be a power of two\n");
737 if (!strcmp(r, "g")) {
741 if (!strcmp(r, "no-code-copy")) {
742 code_copy_enabled = 0;
751 filename = argv[optind];
754 memset(regs, 0, sizeof(struct target_pt_regs));
757 /* Scan interp_prefix dir for replacement files. */
758 init_paths(interp_prefix);
761 /* NOTE: we need to init the CPU at this stage to get
762 qemu_host_page_size */
765 printf("Starting %s with qemu\n----------------\n", filename);
769 if (mach_exec(filename, argv+optind, environ, regs) != 0) {
770 printf("Error loading %s\n", filename);
778 /* build Task State */
779 memset(ts, 0, sizeof(TaskState));
782 env->user_mode_only = 1;
784 #if defined(TARGET_I386)
785 cpu_x86_set_cpl(env, 3);
787 env->cr[0] = CR0_PG_MASK | CR0_WP_MASK | CR0_PE_MASK;
788 env->hflags |= HF_PE_MASK;
790 if (env->cpuid_features & CPUID_SSE) {
791 env->cr[4] |= CR4_OSFXSR_MASK;
792 env->hflags |= HF_OSFXSR_MASK;
795 /* flags setup : we activate the IRQs by default as in user mode */
796 env->eflags |= IF_MASK;
798 /* darwin register setup */
799 env->regs[R_EAX] = regs->eax;
800 env->regs[R_EBX] = regs->ebx;
801 env->regs[R_ECX] = regs->ecx;
802 env->regs[R_EDX] = regs->edx;
803 env->regs[R_ESI] = regs->esi;
804 env->regs[R_EDI] = regs->edi;
805 env->regs[R_EBP] = regs->ebp;
806 env->regs[R_ESP] = regs->esp;
807 env->eip = regs->eip;
809 /* Darwin LDT setup */
810 /* 2 - User code segment
811 3 - User data segment
813 bzero(ldt_table, LDT_TABLE_SIZE * sizeof(ldt_table[0]));
814 env->ldt.base = (uint32_t) ldt_table;
815 env->ldt.limit = sizeof(ldt_table) - 1;
817 write_dt(ldt_table + 2, 0, 0xfffff,
818 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | DESC_S_MASK |
819 (3 << DESC_DPL_SHIFT) | (0xa << DESC_TYPE_SHIFT));
820 write_dt(ldt_table + 3, 0, 0xfffff,
821 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | DESC_S_MASK |
822 (3 << DESC_DPL_SHIFT) | (0x2 << DESC_TYPE_SHIFT));
823 write_dt(ldt_table + 4, 0, 0xfffff,
824 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | DESC_S_MASK |
825 (3 << DESC_DPL_SHIFT) | (0x2 << DESC_TYPE_SHIFT));
828 * has changed a lot between old Darwin/x86 (pre-Mac Intel) and Mac OS X/x86,
829 now everything is done via int 0x81(mach) int 0x82 (thread) and sysenter/sysexit(unix) */
830 bzero(gdt_table, sizeof(gdt_table));
831 env->gdt.base = (uint32_t)gdt_table;
832 env->gdt.limit = sizeof(gdt_table) - 1;
834 /* Set up a back door to handle sysenter syscalls (unix) */
835 char * syscallbackdoor = malloc(64);
836 page_set_flags((int)syscallbackdoor, (int)syscallbackdoor + 64, PROT_EXEC | PROT_READ | PAGE_VALID);
839 syscallbackdoor[i++] = 0xcd;
840 syscallbackdoor[i++] = 0x90; /* int 0x90 */
841 syscallbackdoor[i++] = 0x0F;
842 syscallbackdoor[i++] = 0x35; /* sysexit */
844 /* Darwin sysenter/sysexit setup */
845 env->sysenter_cs = 0x1; //XXX
846 env->sysenter_eip = (int)syscallbackdoor;
847 env->sysenter_esp = (int)malloc(64);
850 This must match up with GDT[4] */
851 env->tr.base = (uint32_t) tss;
852 env->tr.limit = sizeof(tss) - 1;
853 env->tr.flags = DESC_P_MASK | (0x9 << DESC_TYPE_SHIFT);
854 stw(tss + 2, 0x10); // ss0 = 0x10 = GDT[2] = Kernel Data Segment
856 /* Darwin interrupt setup */
857 bzero(idt_table, sizeof(idt_table));
858 env->idt.base = (uint32_t) idt_table;
859 env->idt.limit = sizeof(idt_table) - 1;
880 /* Syscalls are done via
881 int 0x80 (unix) (rarely used)
884 int 0x83 (diag) (not handled here)
885 sysenter/sysexit (unix) -> we redirect that to int 0x90 */
886 set_idt(0x79, 3); /* Commpage hack, here is our backdoor interrupt */
887 set_idt(0x80, 3); /* Unix Syscall */
888 set_idt(0x81, 3); /* Mach Syscalls */
889 set_idt(0x82, 3); /* thread Syscalls */
891 set_idt(0x90, 3); /* Unix Syscall backdoor */
894 cpu_x86_load_seg(env, R_CS, __USER_CS);
895 cpu_x86_load_seg(env, R_DS, __USER_DS);
896 cpu_x86_load_seg(env, R_ES, __USER_DS);
897 cpu_x86_load_seg(env, R_SS, __USER_DS);
898 cpu_x86_load_seg(env, R_FS, __USER_DS);
899 cpu_x86_load_seg(env, R_GS, __USER_DS);
901 #elif defined(TARGET_PPC)
904 env->nip = regs->nip;
905 for(i = 0; i < 32; i++) {
906 env->gpr[i] = regs->gpr[i];
910 #error unsupported target CPU
914 printf("Waiting for gdb Connection on port 1234...\n");
915 gdbserver_start (1234);
916 gdb_handlesig(env, 0);