Re: [PATCH 1/3] target/hexagon: Fix semihosting OPEN filename handling

[Brian Cain]

On 9/8/2026 12:40 PM, Peter Maydell wrote:
On Sun, 6 Sept 2026 at 23:25, Brian Cain <brian.c...@oss.qualcomm.com> wrote:
HEX_SYS_OPEN copied guest bytes into a fixed-size buffer until it found a NUL.
A missing terminator could overrun that buffer, so use lock_user_string() 
instead.
Do you have a link to the specification for these hexagon semihosting
calls? Looking at this patch I'm wondering if maybe I steered you
a bit wrong with suggesting lock_user_string():


Here's the link - 
https://docs.qualcomm.com/doc/80-N2040-101/topic/semihosting-specification.html 



@@ -461,31 +462,14 @@ static void sim_handle_trap0(CPUHexagonState *env)

      case HEX_SYS_OPEN:
      {
-        char filename[BUFSIZ];
+        char *filename;
          target_ulong physical_filename_addr;
          unsigned int filemode;
-        int length;
          int real_openmode;
          int ret, err = 0;
-        int i = 0;

          hexagon_read_memory(env, swi_info, 4, &physical_filename_addr, 
retaddr);
          hexagon_read_memory(env, swi_info + 4, 4, &filemode, retaddr);
-        hexagon_read_memory(env, swi_info + 8, 4, &length, retaddr);
We no longer do anything with the length argument, which seems
like it might not be right.

If we know the (max) length of the string, then perhaps
lock_user() (which takes a length argument) would fit better.

Ok, I'll re-evaluate it with lock_user().


thanks
-- PMM