xref: /openbmc/qemu/linux-user/elfload.c (revision 4f9205be)
1 /* This is the Linux kernel elf-loading code, ported into user space */
2 #include "qemu/osdep.h"
3 #include <sys/param.h>
4 
5 #include <sys/resource.h>
6 #include <sys/shm.h>
7 
8 #include "qemu.h"
9 #include "disas/disas.h"
10 #include "qemu/bitops.h"
11 #include "qemu/path.h"
12 #include "qemu/queue.h"
13 #include "qemu/guest-random.h"
14 #include "qemu/units.h"
15 #include "qemu/selfmap.h"
16 #include "qapi/error.h"
17 
18 #ifdef _ARCH_PPC64
19 #undef ARCH_DLINFO
20 #undef ELF_PLATFORM
21 #undef ELF_HWCAP
22 #undef ELF_HWCAP2
23 #undef ELF_CLASS
24 #undef ELF_DATA
25 #undef ELF_ARCH
26 #endif
27 
28 #define ELF_OSABI   ELFOSABI_SYSV
29 
30 /* from personality.h */
31 
32 /*
33  * Flags for bug emulation.
34  *
35  * These occupy the top three bytes.
36  */
37 enum {
38     ADDR_NO_RANDOMIZE = 0x0040000,      /* disable randomization of VA space */
39     FDPIC_FUNCPTRS =    0x0080000,      /* userspace function ptrs point to
40                                            descriptors (signal handling) */
41     MMAP_PAGE_ZERO =    0x0100000,
42     ADDR_COMPAT_LAYOUT = 0x0200000,
43     READ_IMPLIES_EXEC = 0x0400000,
44     ADDR_LIMIT_32BIT =  0x0800000,
45     SHORT_INODE =       0x1000000,
46     WHOLE_SECONDS =     0x2000000,
47     STICKY_TIMEOUTS =   0x4000000,
48     ADDR_LIMIT_3GB =    0x8000000,
49 };
50 
51 /*
52  * Personality types.
53  *
54  * These go in the low byte.  Avoid using the top bit, it will
55  * conflict with error returns.
56  */
57 enum {
58     PER_LINUX =         0x0000,
59     PER_LINUX_32BIT =   0x0000 | ADDR_LIMIT_32BIT,
60     PER_LINUX_FDPIC =   0x0000 | FDPIC_FUNCPTRS,
61     PER_SVR4 =          0x0001 | STICKY_TIMEOUTS | MMAP_PAGE_ZERO,
62     PER_SVR3 =          0x0002 | STICKY_TIMEOUTS | SHORT_INODE,
63     PER_SCOSVR3 =       0x0003 | STICKY_TIMEOUTS | WHOLE_SECONDS | SHORT_INODE,
64     PER_OSR5 =          0x0003 | STICKY_TIMEOUTS | WHOLE_SECONDS,
65     PER_WYSEV386 =      0x0004 | STICKY_TIMEOUTS | SHORT_INODE,
66     PER_ISCR4 =         0x0005 | STICKY_TIMEOUTS,
67     PER_BSD =           0x0006,
68     PER_SUNOS =         0x0006 | STICKY_TIMEOUTS,
69     PER_XENIX =         0x0007 | STICKY_TIMEOUTS | SHORT_INODE,
70     PER_LINUX32 =       0x0008,
71     PER_LINUX32_3GB =   0x0008 | ADDR_LIMIT_3GB,
72     PER_IRIX32 =        0x0009 | STICKY_TIMEOUTS,/* IRIX5 32-bit */
73     PER_IRIXN32 =       0x000a | STICKY_TIMEOUTS,/* IRIX6 new 32-bit */
74     PER_IRIX64 =        0x000b | STICKY_TIMEOUTS,/* IRIX6 64-bit */
75     PER_RISCOS =        0x000c,
76     PER_SOLARIS =       0x000d | STICKY_TIMEOUTS,
77     PER_UW7 =           0x000e | STICKY_TIMEOUTS | MMAP_PAGE_ZERO,
78     PER_OSF4 =          0x000f,                  /* OSF/1 v4 */
79     PER_HPUX =          0x0010,
80     PER_MASK =          0x00ff,
81 };
82 
83 /*
84  * Return the base personality without flags.
85  */
86 #define personality(pers)       (pers & PER_MASK)
87 
88 int info_is_fdpic(struct image_info *info)
89 {
90     return info->personality == PER_LINUX_FDPIC;
91 }
92 
93 /* this flag is uneffective under linux too, should be deleted */
94 #ifndef MAP_DENYWRITE
95 #define MAP_DENYWRITE 0
96 #endif
97 
98 /* should probably go in elf.h */
99 #ifndef ELIBBAD
100 #define ELIBBAD 80
101 #endif
102 
103 #ifdef TARGET_WORDS_BIGENDIAN
104 #define ELF_DATA        ELFDATA2MSB
105 #else
106 #define ELF_DATA        ELFDATA2LSB
107 #endif
108 
109 #ifdef TARGET_ABI_MIPSN32
110 typedef abi_ullong      target_elf_greg_t;
111 #define tswapreg(ptr)   tswap64(ptr)
112 #else
113 typedef abi_ulong       target_elf_greg_t;
114 #define tswapreg(ptr)   tswapal(ptr)
115 #endif
116 
117 #ifdef USE_UID16
118 typedef abi_ushort      target_uid_t;
119 typedef abi_ushort      target_gid_t;
120 #else
121 typedef abi_uint        target_uid_t;
122 typedef abi_uint        target_gid_t;
123 #endif
124 typedef abi_int         target_pid_t;
125 
126 #ifdef TARGET_I386
127 
128 #define ELF_PLATFORM get_elf_platform()
129 
130 static const char *get_elf_platform(void)
131 {
132     static char elf_platform[] = "i386";
133     int family = object_property_get_int(OBJECT(thread_cpu), "family", NULL);
134     if (family > 6)
135         family = 6;
136     if (family >= 3)
137         elf_platform[1] = '0' + family;
138     return elf_platform;
139 }
140 
141 #define ELF_HWCAP get_elf_hwcap()
142 
143 static uint32_t get_elf_hwcap(void)
144 {
145     X86CPU *cpu = X86_CPU(thread_cpu);
146 
147     return cpu->env.features[FEAT_1_EDX];
148 }
149 
150 #ifdef TARGET_X86_64
151 #define ELF_START_MMAP 0x2aaaaab000ULL
152 
153 #define ELF_CLASS      ELFCLASS64
154 #define ELF_ARCH       EM_X86_64
155 
156 static inline void init_thread(struct target_pt_regs *regs, struct image_info *infop)
157 {
158     regs->rax = 0;
159     regs->rsp = infop->start_stack;
160     regs->rip = infop->entry;
161 }
162 
163 #define ELF_NREG    27
164 typedef target_elf_greg_t  target_elf_gregset_t[ELF_NREG];
165 
166 /*
167  * Note that ELF_NREG should be 29 as there should be place for
168  * TRAPNO and ERR "registers" as well but linux doesn't dump
169  * those.
170  *
171  * See linux kernel: arch/x86/include/asm/elf.h
172  */
173 static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUX86State *env)
174 {
175     (*regs)[0] = tswapreg(env->regs[15]);
176     (*regs)[1] = tswapreg(env->regs[14]);
177     (*regs)[2] = tswapreg(env->regs[13]);
178     (*regs)[3] = tswapreg(env->regs[12]);
179     (*regs)[4] = tswapreg(env->regs[R_EBP]);
180     (*regs)[5] = tswapreg(env->regs[R_EBX]);
181     (*regs)[6] = tswapreg(env->regs[11]);
182     (*regs)[7] = tswapreg(env->regs[10]);
183     (*regs)[8] = tswapreg(env->regs[9]);
184     (*regs)[9] = tswapreg(env->regs[8]);
185     (*regs)[10] = tswapreg(env->regs[R_EAX]);
186     (*regs)[11] = tswapreg(env->regs[R_ECX]);
187     (*regs)[12] = tswapreg(env->regs[R_EDX]);
188     (*regs)[13] = tswapreg(env->regs[R_ESI]);
189     (*regs)[14] = tswapreg(env->regs[R_EDI]);
190     (*regs)[15] = tswapreg(env->regs[R_EAX]); /* XXX */
191     (*regs)[16] = tswapreg(env->eip);
192     (*regs)[17] = tswapreg(env->segs[R_CS].selector & 0xffff);
193     (*regs)[18] = tswapreg(env->eflags);
194     (*regs)[19] = tswapreg(env->regs[R_ESP]);
195     (*regs)[20] = tswapreg(env->segs[R_SS].selector & 0xffff);
196     (*regs)[21] = tswapreg(env->segs[R_FS].selector & 0xffff);
197     (*regs)[22] = tswapreg(env->segs[R_GS].selector & 0xffff);
198     (*regs)[23] = tswapreg(env->segs[R_DS].selector & 0xffff);
199     (*regs)[24] = tswapreg(env->segs[R_ES].selector & 0xffff);
200     (*regs)[25] = tswapreg(env->segs[R_FS].selector & 0xffff);
201     (*regs)[26] = tswapreg(env->segs[R_GS].selector & 0xffff);
202 }
203 
204 #else
205 
206 #define ELF_START_MMAP 0x80000000
207 
208 /*
209  * This is used to ensure we don't load something for the wrong architecture.
210  */
211 #define elf_check_arch(x) ( ((x) == EM_386) || ((x) == EM_486) )
212 
213 /*
214  * These are used to set parameters in the core dumps.
215  */
216 #define ELF_CLASS       ELFCLASS32
217 #define ELF_ARCH        EM_386
218 
219 static inline void init_thread(struct target_pt_regs *regs,
220                                struct image_info *infop)
221 {
222     regs->esp = infop->start_stack;
223     regs->eip = infop->entry;
224 
225     /* SVR4/i386 ABI (pages 3-31, 3-32) says that when the program
226        starts %edx contains a pointer to a function which might be
227        registered using `atexit'.  This provides a mean for the
228        dynamic linker to call DT_FINI functions for shared libraries
229        that have been loaded before the code runs.
230 
231        A value of 0 tells we have no such handler.  */
232     regs->edx = 0;
233 }
234 
235 #define ELF_NREG    17
236 typedef target_elf_greg_t  target_elf_gregset_t[ELF_NREG];
237 
238 /*
239  * Note that ELF_NREG should be 19 as there should be place for
240  * TRAPNO and ERR "registers" as well but linux doesn't dump
241  * those.
242  *
243  * See linux kernel: arch/x86/include/asm/elf.h
244  */
245 static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUX86State *env)
246 {
247     (*regs)[0] = tswapreg(env->regs[R_EBX]);
248     (*regs)[1] = tswapreg(env->regs[R_ECX]);
249     (*regs)[2] = tswapreg(env->regs[R_EDX]);
250     (*regs)[3] = tswapreg(env->regs[R_ESI]);
251     (*regs)[4] = tswapreg(env->regs[R_EDI]);
252     (*regs)[5] = tswapreg(env->regs[R_EBP]);
253     (*regs)[6] = tswapreg(env->regs[R_EAX]);
254     (*regs)[7] = tswapreg(env->segs[R_DS].selector & 0xffff);
255     (*regs)[8] = tswapreg(env->segs[R_ES].selector & 0xffff);
256     (*regs)[9] = tswapreg(env->segs[R_FS].selector & 0xffff);
257     (*regs)[10] = tswapreg(env->segs[R_GS].selector & 0xffff);
258     (*regs)[11] = tswapreg(env->regs[R_EAX]); /* XXX */
259     (*regs)[12] = tswapreg(env->eip);
260     (*regs)[13] = tswapreg(env->segs[R_CS].selector & 0xffff);
261     (*regs)[14] = tswapreg(env->eflags);
262     (*regs)[15] = tswapreg(env->regs[R_ESP]);
263     (*regs)[16] = tswapreg(env->segs[R_SS].selector & 0xffff);
264 }
265 #endif
266 
267 #define USE_ELF_CORE_DUMP
268 #define ELF_EXEC_PAGESIZE       4096
269 
270 #endif
271 
272 #ifdef TARGET_ARM
273 
274 #ifndef TARGET_AARCH64
275 /* 32 bit ARM definitions */
276 
277 #define ELF_START_MMAP 0x80000000
278 
279 #define ELF_ARCH        EM_ARM
280 #define ELF_CLASS       ELFCLASS32
281 
282 static inline void init_thread(struct target_pt_regs *regs,
283                                struct image_info *infop)
284 {
285     abi_long stack = infop->start_stack;
286     memset(regs, 0, sizeof(*regs));
287 
288     regs->uregs[16] = ARM_CPU_MODE_USR;
289     if (infop->entry & 1) {
290         regs->uregs[16] |= CPSR_T;
291     }
292     regs->uregs[15] = infop->entry & 0xfffffffe;
293     regs->uregs[13] = infop->start_stack;
294     /* FIXME - what to for failure of get_user()? */
295     get_user_ual(regs->uregs[2], stack + 8); /* envp */
296     get_user_ual(regs->uregs[1], stack + 4); /* envp */
297     /* XXX: it seems that r0 is zeroed after ! */
298     regs->uregs[0] = 0;
299     /* For uClinux PIC binaries.  */
300     /* XXX: Linux does this only on ARM with no MMU (do we care ?) */
301     regs->uregs[10] = infop->start_data;
302 
303     /* Support ARM FDPIC.  */
304     if (info_is_fdpic(infop)) {
305         /* As described in the ABI document, r7 points to the loadmap info
306          * prepared by the kernel. If an interpreter is needed, r8 points
307          * to the interpreter loadmap and r9 points to the interpreter
308          * PT_DYNAMIC info. If no interpreter is needed, r8 is zero, and
309          * r9 points to the main program PT_DYNAMIC info.
310          */
311         regs->uregs[7] = infop->loadmap_addr;
312         if (infop->interpreter_loadmap_addr) {
313             /* Executable is dynamically loaded.  */
314             regs->uregs[8] = infop->interpreter_loadmap_addr;
315             regs->uregs[9] = infop->interpreter_pt_dynamic_addr;
316         } else {
317             regs->uregs[8] = 0;
318             regs->uregs[9] = infop->pt_dynamic_addr;
319         }
320     }
321 }
322 
323 #define ELF_NREG    18
324 typedef target_elf_greg_t  target_elf_gregset_t[ELF_NREG];
325 
326 static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUARMState *env)
327 {
328     (*regs)[0] = tswapreg(env->regs[0]);
329     (*regs)[1] = tswapreg(env->regs[1]);
330     (*regs)[2] = tswapreg(env->regs[2]);
331     (*regs)[3] = tswapreg(env->regs[3]);
332     (*regs)[4] = tswapreg(env->regs[4]);
333     (*regs)[5] = tswapreg(env->regs[5]);
334     (*regs)[6] = tswapreg(env->regs[6]);
335     (*regs)[7] = tswapreg(env->regs[7]);
336     (*regs)[8] = tswapreg(env->regs[8]);
337     (*regs)[9] = tswapreg(env->regs[9]);
338     (*regs)[10] = tswapreg(env->regs[10]);
339     (*regs)[11] = tswapreg(env->regs[11]);
340     (*regs)[12] = tswapreg(env->regs[12]);
341     (*regs)[13] = tswapreg(env->regs[13]);
342     (*regs)[14] = tswapreg(env->regs[14]);
343     (*regs)[15] = tswapreg(env->regs[15]);
344 
345     (*regs)[16] = tswapreg(cpsr_read((CPUARMState *)env));
346     (*regs)[17] = tswapreg(env->regs[0]); /* XXX */
347 }
348 
349 #define USE_ELF_CORE_DUMP
350 #define ELF_EXEC_PAGESIZE       4096
351 
352 enum
353 {
354     ARM_HWCAP_ARM_SWP       = 1 << 0,
355     ARM_HWCAP_ARM_HALF      = 1 << 1,
356     ARM_HWCAP_ARM_THUMB     = 1 << 2,
357     ARM_HWCAP_ARM_26BIT     = 1 << 3,
358     ARM_HWCAP_ARM_FAST_MULT = 1 << 4,
359     ARM_HWCAP_ARM_FPA       = 1 << 5,
360     ARM_HWCAP_ARM_VFP       = 1 << 6,
361     ARM_HWCAP_ARM_EDSP      = 1 << 7,
362     ARM_HWCAP_ARM_JAVA      = 1 << 8,
363     ARM_HWCAP_ARM_IWMMXT    = 1 << 9,
364     ARM_HWCAP_ARM_CRUNCH    = 1 << 10,
365     ARM_HWCAP_ARM_THUMBEE   = 1 << 11,
366     ARM_HWCAP_ARM_NEON      = 1 << 12,
367     ARM_HWCAP_ARM_VFPv3     = 1 << 13,
368     ARM_HWCAP_ARM_VFPv3D16  = 1 << 14,
369     ARM_HWCAP_ARM_TLS       = 1 << 15,
370     ARM_HWCAP_ARM_VFPv4     = 1 << 16,
371     ARM_HWCAP_ARM_IDIVA     = 1 << 17,
372     ARM_HWCAP_ARM_IDIVT     = 1 << 18,
373     ARM_HWCAP_ARM_VFPD32    = 1 << 19,
374     ARM_HWCAP_ARM_LPAE      = 1 << 20,
375     ARM_HWCAP_ARM_EVTSTRM   = 1 << 21,
376 };
377 
378 enum {
379     ARM_HWCAP2_ARM_AES      = 1 << 0,
380     ARM_HWCAP2_ARM_PMULL    = 1 << 1,
381     ARM_HWCAP2_ARM_SHA1     = 1 << 2,
382     ARM_HWCAP2_ARM_SHA2     = 1 << 3,
383     ARM_HWCAP2_ARM_CRC32    = 1 << 4,
384 };
385 
386 /* The commpage only exists for 32 bit kernels */
387 
388 #define ARM_COMMPAGE (intptr_t)0xffff0f00u
389 
390 static bool init_guest_commpage(void)
391 {
392     void *want = g2h_untagged(ARM_COMMPAGE & -qemu_host_page_size);
393     void *addr = mmap(want, qemu_host_page_size, PROT_READ | PROT_WRITE,
394                       MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED, -1, 0);
395 
396     if (addr == MAP_FAILED) {
397         perror("Allocating guest commpage");
398         exit(EXIT_FAILURE);
399     }
400     if (addr != want) {
401         return false;
402     }
403 
404     /* Set kernel helper versions; rest of page is 0.  */
405     __put_user(5, (uint32_t *)g2h_untagged(0xffff0ffcu));
406 
407     if (mprotect(addr, qemu_host_page_size, PROT_READ)) {
408         perror("Protecting guest commpage");
409         exit(EXIT_FAILURE);
410     }
411     return true;
412 }
413 
414 #define ELF_HWCAP get_elf_hwcap()
415 #define ELF_HWCAP2 get_elf_hwcap2()
416 
417 static uint32_t get_elf_hwcap(void)
418 {
419     ARMCPU *cpu = ARM_CPU(thread_cpu);
420     uint32_t hwcaps = 0;
421 
422     hwcaps |= ARM_HWCAP_ARM_SWP;
423     hwcaps |= ARM_HWCAP_ARM_HALF;
424     hwcaps |= ARM_HWCAP_ARM_THUMB;
425     hwcaps |= ARM_HWCAP_ARM_FAST_MULT;
426 
427     /* probe for the extra features */
428 #define GET_FEATURE(feat, hwcap) \
429     do { if (arm_feature(&cpu->env, feat)) { hwcaps |= hwcap; } } while (0)
430 
431 #define GET_FEATURE_ID(feat, hwcap) \
432     do { if (cpu_isar_feature(feat, cpu)) { hwcaps |= hwcap; } } while (0)
433 
434     /* EDSP is in v5TE and above, but all our v5 CPUs are v5TE */
435     GET_FEATURE(ARM_FEATURE_V5, ARM_HWCAP_ARM_EDSP);
436     GET_FEATURE(ARM_FEATURE_IWMMXT, ARM_HWCAP_ARM_IWMMXT);
437     GET_FEATURE(ARM_FEATURE_THUMB2EE, ARM_HWCAP_ARM_THUMBEE);
438     GET_FEATURE(ARM_FEATURE_NEON, ARM_HWCAP_ARM_NEON);
439     GET_FEATURE(ARM_FEATURE_V6K, ARM_HWCAP_ARM_TLS);
440     GET_FEATURE(ARM_FEATURE_LPAE, ARM_HWCAP_ARM_LPAE);
441     GET_FEATURE_ID(aa32_arm_div, ARM_HWCAP_ARM_IDIVA);
442     GET_FEATURE_ID(aa32_thumb_div, ARM_HWCAP_ARM_IDIVT);
443     GET_FEATURE_ID(aa32_vfp, ARM_HWCAP_ARM_VFP);
444 
445     if (cpu_isar_feature(aa32_fpsp_v3, cpu) ||
446         cpu_isar_feature(aa32_fpdp_v3, cpu)) {
447         hwcaps |= ARM_HWCAP_ARM_VFPv3;
448         if (cpu_isar_feature(aa32_simd_r32, cpu)) {
449             hwcaps |= ARM_HWCAP_ARM_VFPD32;
450         } else {
451             hwcaps |= ARM_HWCAP_ARM_VFPv3D16;
452         }
453     }
454     GET_FEATURE_ID(aa32_simdfmac, ARM_HWCAP_ARM_VFPv4);
455 
456     return hwcaps;
457 }
458 
459 static uint32_t get_elf_hwcap2(void)
460 {
461     ARMCPU *cpu = ARM_CPU(thread_cpu);
462     uint32_t hwcaps = 0;
463 
464     GET_FEATURE_ID(aa32_aes, ARM_HWCAP2_ARM_AES);
465     GET_FEATURE_ID(aa32_pmull, ARM_HWCAP2_ARM_PMULL);
466     GET_FEATURE_ID(aa32_sha1, ARM_HWCAP2_ARM_SHA1);
467     GET_FEATURE_ID(aa32_sha2, ARM_HWCAP2_ARM_SHA2);
468     GET_FEATURE_ID(aa32_crc32, ARM_HWCAP2_ARM_CRC32);
469     return hwcaps;
470 }
471 
472 #undef GET_FEATURE
473 #undef GET_FEATURE_ID
474 
475 #define ELF_PLATFORM get_elf_platform()
476 
477 static const char *get_elf_platform(void)
478 {
479     CPUARMState *env = thread_cpu->env_ptr;
480 
481 #ifdef TARGET_WORDS_BIGENDIAN
482 # define END  "b"
483 #else
484 # define END  "l"
485 #endif
486 
487     if (arm_feature(env, ARM_FEATURE_V8)) {
488         return "v8" END;
489     } else if (arm_feature(env, ARM_FEATURE_V7)) {
490         if (arm_feature(env, ARM_FEATURE_M)) {
491             return "v7m" END;
492         } else {
493             return "v7" END;
494         }
495     } else if (arm_feature(env, ARM_FEATURE_V6)) {
496         return "v6" END;
497     } else if (arm_feature(env, ARM_FEATURE_V5)) {
498         return "v5" END;
499     } else {
500         return "v4" END;
501     }
502 
503 #undef END
504 }
505 
506 #else
507 /* 64 bit ARM definitions */
508 #define ELF_START_MMAP 0x80000000
509 
510 #define ELF_ARCH        EM_AARCH64
511 #define ELF_CLASS       ELFCLASS64
512 #ifdef TARGET_WORDS_BIGENDIAN
513 # define ELF_PLATFORM    "aarch64_be"
514 #else
515 # define ELF_PLATFORM    "aarch64"
516 #endif
517 
518 static inline void init_thread(struct target_pt_regs *regs,
519                                struct image_info *infop)
520 {
521     abi_long stack = infop->start_stack;
522     memset(regs, 0, sizeof(*regs));
523 
524     regs->pc = infop->entry & ~0x3ULL;
525     regs->sp = stack;
526 }
527 
528 #define ELF_NREG    34
529 typedef target_elf_greg_t  target_elf_gregset_t[ELF_NREG];
530 
531 static void elf_core_copy_regs(target_elf_gregset_t *regs,
532                                const CPUARMState *env)
533 {
534     int i;
535 
536     for (i = 0; i < 32; i++) {
537         (*regs)[i] = tswapreg(env->xregs[i]);
538     }
539     (*regs)[32] = tswapreg(env->pc);
540     (*regs)[33] = tswapreg(pstate_read((CPUARMState *)env));
541 }
542 
543 #define USE_ELF_CORE_DUMP
544 #define ELF_EXEC_PAGESIZE       4096
545 
546 enum {
547     ARM_HWCAP_A64_FP            = 1 << 0,
548     ARM_HWCAP_A64_ASIMD         = 1 << 1,
549     ARM_HWCAP_A64_EVTSTRM       = 1 << 2,
550     ARM_HWCAP_A64_AES           = 1 << 3,
551     ARM_HWCAP_A64_PMULL         = 1 << 4,
552     ARM_HWCAP_A64_SHA1          = 1 << 5,
553     ARM_HWCAP_A64_SHA2          = 1 << 6,
554     ARM_HWCAP_A64_CRC32         = 1 << 7,
555     ARM_HWCAP_A64_ATOMICS       = 1 << 8,
556     ARM_HWCAP_A64_FPHP          = 1 << 9,
557     ARM_HWCAP_A64_ASIMDHP       = 1 << 10,
558     ARM_HWCAP_A64_CPUID         = 1 << 11,
559     ARM_HWCAP_A64_ASIMDRDM      = 1 << 12,
560     ARM_HWCAP_A64_JSCVT         = 1 << 13,
561     ARM_HWCAP_A64_FCMA          = 1 << 14,
562     ARM_HWCAP_A64_LRCPC         = 1 << 15,
563     ARM_HWCAP_A64_DCPOP         = 1 << 16,
564     ARM_HWCAP_A64_SHA3          = 1 << 17,
565     ARM_HWCAP_A64_SM3           = 1 << 18,
566     ARM_HWCAP_A64_SM4           = 1 << 19,
567     ARM_HWCAP_A64_ASIMDDP       = 1 << 20,
568     ARM_HWCAP_A64_SHA512        = 1 << 21,
569     ARM_HWCAP_A64_SVE           = 1 << 22,
570     ARM_HWCAP_A64_ASIMDFHM      = 1 << 23,
571     ARM_HWCAP_A64_DIT           = 1 << 24,
572     ARM_HWCAP_A64_USCAT         = 1 << 25,
573     ARM_HWCAP_A64_ILRCPC        = 1 << 26,
574     ARM_HWCAP_A64_FLAGM         = 1 << 27,
575     ARM_HWCAP_A64_SSBS          = 1 << 28,
576     ARM_HWCAP_A64_SB            = 1 << 29,
577     ARM_HWCAP_A64_PACA          = 1 << 30,
578     ARM_HWCAP_A64_PACG          = 1UL << 31,
579 
580     ARM_HWCAP2_A64_DCPODP       = 1 << 0,
581     ARM_HWCAP2_A64_SVE2         = 1 << 1,
582     ARM_HWCAP2_A64_SVEAES       = 1 << 2,
583     ARM_HWCAP2_A64_SVEPMULL     = 1 << 3,
584     ARM_HWCAP2_A64_SVEBITPERM   = 1 << 4,
585     ARM_HWCAP2_A64_SVESHA3      = 1 << 5,
586     ARM_HWCAP2_A64_SVESM4       = 1 << 6,
587     ARM_HWCAP2_A64_FLAGM2       = 1 << 7,
588     ARM_HWCAP2_A64_FRINT        = 1 << 8,
589     ARM_HWCAP2_A64_SVEI8MM      = 1 << 9,
590     ARM_HWCAP2_A64_SVEF32MM     = 1 << 10,
591     ARM_HWCAP2_A64_SVEF64MM     = 1 << 11,
592     ARM_HWCAP2_A64_SVEBF16      = 1 << 12,
593     ARM_HWCAP2_A64_I8MM         = 1 << 13,
594     ARM_HWCAP2_A64_BF16         = 1 << 14,
595     ARM_HWCAP2_A64_DGH          = 1 << 15,
596     ARM_HWCAP2_A64_RNG          = 1 << 16,
597     ARM_HWCAP2_A64_BTI          = 1 << 17,
598     ARM_HWCAP2_A64_MTE          = 1 << 18,
599 };
600 
601 #define ELF_HWCAP   get_elf_hwcap()
602 #define ELF_HWCAP2  get_elf_hwcap2()
603 
604 #define GET_FEATURE_ID(feat, hwcap) \
605     do { if (cpu_isar_feature(feat, cpu)) { hwcaps |= hwcap; } } while (0)
606 
607 static uint32_t get_elf_hwcap(void)
608 {
609     ARMCPU *cpu = ARM_CPU(thread_cpu);
610     uint32_t hwcaps = 0;
611 
612     hwcaps |= ARM_HWCAP_A64_FP;
613     hwcaps |= ARM_HWCAP_A64_ASIMD;
614     hwcaps |= ARM_HWCAP_A64_CPUID;
615 
616     /* probe for the extra features */
617 
618     GET_FEATURE_ID(aa64_aes, ARM_HWCAP_A64_AES);
619     GET_FEATURE_ID(aa64_pmull, ARM_HWCAP_A64_PMULL);
620     GET_FEATURE_ID(aa64_sha1, ARM_HWCAP_A64_SHA1);
621     GET_FEATURE_ID(aa64_sha256, ARM_HWCAP_A64_SHA2);
622     GET_FEATURE_ID(aa64_sha512, ARM_HWCAP_A64_SHA512);
623     GET_FEATURE_ID(aa64_crc32, ARM_HWCAP_A64_CRC32);
624     GET_FEATURE_ID(aa64_sha3, ARM_HWCAP_A64_SHA3);
625     GET_FEATURE_ID(aa64_sm3, ARM_HWCAP_A64_SM3);
626     GET_FEATURE_ID(aa64_sm4, ARM_HWCAP_A64_SM4);
627     GET_FEATURE_ID(aa64_fp16, ARM_HWCAP_A64_FPHP | ARM_HWCAP_A64_ASIMDHP);
628     GET_FEATURE_ID(aa64_atomics, ARM_HWCAP_A64_ATOMICS);
629     GET_FEATURE_ID(aa64_rdm, ARM_HWCAP_A64_ASIMDRDM);
630     GET_FEATURE_ID(aa64_dp, ARM_HWCAP_A64_ASIMDDP);
631     GET_FEATURE_ID(aa64_fcma, ARM_HWCAP_A64_FCMA);
632     GET_FEATURE_ID(aa64_sve, ARM_HWCAP_A64_SVE);
633     GET_FEATURE_ID(aa64_pauth, ARM_HWCAP_A64_PACA | ARM_HWCAP_A64_PACG);
634     GET_FEATURE_ID(aa64_fhm, ARM_HWCAP_A64_ASIMDFHM);
635     GET_FEATURE_ID(aa64_jscvt, ARM_HWCAP_A64_JSCVT);
636     GET_FEATURE_ID(aa64_sb, ARM_HWCAP_A64_SB);
637     GET_FEATURE_ID(aa64_condm_4, ARM_HWCAP_A64_FLAGM);
638     GET_FEATURE_ID(aa64_dcpop, ARM_HWCAP_A64_DCPOP);
639     GET_FEATURE_ID(aa64_rcpc_8_3, ARM_HWCAP_A64_LRCPC);
640     GET_FEATURE_ID(aa64_rcpc_8_4, ARM_HWCAP_A64_ILRCPC);
641 
642     return hwcaps;
643 }
644 
645 static uint32_t get_elf_hwcap2(void)
646 {
647     ARMCPU *cpu = ARM_CPU(thread_cpu);
648     uint32_t hwcaps = 0;
649 
650     GET_FEATURE_ID(aa64_dcpodp, ARM_HWCAP2_A64_DCPODP);
651     GET_FEATURE_ID(aa64_sve2, ARM_HWCAP2_A64_SVE2);
652     GET_FEATURE_ID(aa64_sve2_aes, ARM_HWCAP2_A64_SVEAES);
653     GET_FEATURE_ID(aa64_sve2_pmull128, ARM_HWCAP2_A64_SVEPMULL);
654     GET_FEATURE_ID(aa64_sve2_bitperm, ARM_HWCAP2_A64_SVEBITPERM);
655     GET_FEATURE_ID(aa64_sve2_sha3, ARM_HWCAP2_A64_SVESHA3);
656     GET_FEATURE_ID(aa64_sve2_sm4, ARM_HWCAP2_A64_SVESM4);
657     GET_FEATURE_ID(aa64_condm_5, ARM_HWCAP2_A64_FLAGM2);
658     GET_FEATURE_ID(aa64_frint, ARM_HWCAP2_A64_FRINT);
659     GET_FEATURE_ID(aa64_sve_i8mm, ARM_HWCAP2_A64_SVEI8MM);
660     GET_FEATURE_ID(aa64_sve_f32mm, ARM_HWCAP2_A64_SVEF32MM);
661     GET_FEATURE_ID(aa64_sve_f64mm, ARM_HWCAP2_A64_SVEF64MM);
662     GET_FEATURE_ID(aa64_sve_bf16, ARM_HWCAP2_A64_SVEBF16);
663     GET_FEATURE_ID(aa64_i8mm, ARM_HWCAP2_A64_I8MM);
664     GET_FEATURE_ID(aa64_bf16, ARM_HWCAP2_A64_BF16);
665     GET_FEATURE_ID(aa64_rndr, ARM_HWCAP2_A64_RNG);
666     GET_FEATURE_ID(aa64_bti, ARM_HWCAP2_A64_BTI);
667     GET_FEATURE_ID(aa64_mte, ARM_HWCAP2_A64_MTE);
668 
669     return hwcaps;
670 }
671 
672 #undef GET_FEATURE_ID
673 
674 #endif /* not TARGET_AARCH64 */
675 #endif /* TARGET_ARM */
676 
677 #ifdef TARGET_SPARC
678 #ifdef TARGET_SPARC64
679 
680 #define ELF_START_MMAP 0x80000000
681 #define ELF_HWCAP  (HWCAP_SPARC_FLUSH | HWCAP_SPARC_STBAR | HWCAP_SPARC_SWAP \
682                     | HWCAP_SPARC_MULDIV | HWCAP_SPARC_V9)
683 #ifndef TARGET_ABI32
684 #define elf_check_arch(x) ( (x) == EM_SPARCV9 || (x) == EM_SPARC32PLUS )
685 #else
686 #define elf_check_arch(x) ( (x) == EM_SPARC32PLUS || (x) == EM_SPARC )
687 #endif
688 
689 #define ELF_CLASS   ELFCLASS64
690 #define ELF_ARCH    EM_SPARCV9
691 #else
692 #define ELF_START_MMAP 0x80000000
693 #define ELF_HWCAP  (HWCAP_SPARC_FLUSH | HWCAP_SPARC_STBAR | HWCAP_SPARC_SWAP \
694                     | HWCAP_SPARC_MULDIV)
695 #define ELF_CLASS   ELFCLASS32
696 #define ELF_ARCH    EM_SPARC
697 #endif /* TARGET_SPARC64 */
698 
699 static inline void init_thread(struct target_pt_regs *regs,
700                                struct image_info *infop)
701 {
702     /* Note that target_cpu_copy_regs does not read psr/tstate. */
703     regs->pc = infop->entry;
704     regs->npc = regs->pc + 4;
705     regs->y = 0;
706     regs->u_regs[14] = (infop->start_stack - 16 * sizeof(abi_ulong)
707                         - TARGET_STACK_BIAS);
708 }
709 #endif /* TARGET_SPARC */
710 
711 #ifdef TARGET_PPC
712 
713 #define ELF_MACHINE    PPC_ELF_MACHINE
714 #define ELF_START_MMAP 0x80000000
715 
716 #if defined(TARGET_PPC64) && !defined(TARGET_ABI32)
717 
718 #define elf_check_arch(x) ( (x) == EM_PPC64 )
719 
720 #define ELF_CLASS       ELFCLASS64
721 
722 #else
723 
724 #define ELF_CLASS       ELFCLASS32
725 
726 #endif
727 
728 #define ELF_ARCH        EM_PPC
729 
730 /* Feature masks for the Aux Vector Hardware Capabilities (AT_HWCAP).
731    See arch/powerpc/include/asm/cputable.h.  */
732 enum {
733     QEMU_PPC_FEATURE_32 = 0x80000000,
734     QEMU_PPC_FEATURE_64 = 0x40000000,
735     QEMU_PPC_FEATURE_601_INSTR = 0x20000000,
736     QEMU_PPC_FEATURE_HAS_ALTIVEC = 0x10000000,
737     QEMU_PPC_FEATURE_HAS_FPU = 0x08000000,
738     QEMU_PPC_FEATURE_HAS_MMU = 0x04000000,
739     QEMU_PPC_FEATURE_HAS_4xxMAC = 0x02000000,
740     QEMU_PPC_FEATURE_UNIFIED_CACHE = 0x01000000,
741     QEMU_PPC_FEATURE_HAS_SPE = 0x00800000,
742     QEMU_PPC_FEATURE_HAS_EFP_SINGLE = 0x00400000,
743     QEMU_PPC_FEATURE_HAS_EFP_DOUBLE = 0x00200000,
744     QEMU_PPC_FEATURE_NO_TB = 0x00100000,
745     QEMU_PPC_FEATURE_POWER4 = 0x00080000,
746     QEMU_PPC_FEATURE_POWER5 = 0x00040000,
747     QEMU_PPC_FEATURE_POWER5_PLUS = 0x00020000,
748     QEMU_PPC_FEATURE_CELL = 0x00010000,
749     QEMU_PPC_FEATURE_BOOKE = 0x00008000,
750     QEMU_PPC_FEATURE_SMT = 0x00004000,
751     QEMU_PPC_FEATURE_ICACHE_SNOOP = 0x00002000,
752     QEMU_PPC_FEATURE_ARCH_2_05 = 0x00001000,
753     QEMU_PPC_FEATURE_PA6T = 0x00000800,
754     QEMU_PPC_FEATURE_HAS_DFP = 0x00000400,
755     QEMU_PPC_FEATURE_POWER6_EXT = 0x00000200,
756     QEMU_PPC_FEATURE_ARCH_2_06 = 0x00000100,
757     QEMU_PPC_FEATURE_HAS_VSX = 0x00000080,
758     QEMU_PPC_FEATURE_PSERIES_PERFMON_COMPAT = 0x00000040,
759 
760     QEMU_PPC_FEATURE_TRUE_LE = 0x00000002,
761     QEMU_PPC_FEATURE_PPC_LE = 0x00000001,
762 
763     /* Feature definitions in AT_HWCAP2.  */
764     QEMU_PPC_FEATURE2_ARCH_2_07 = 0x80000000, /* ISA 2.07 */
765     QEMU_PPC_FEATURE2_HAS_HTM = 0x40000000, /* Hardware Transactional Memory */
766     QEMU_PPC_FEATURE2_HAS_DSCR = 0x20000000, /* Data Stream Control Register */
767     QEMU_PPC_FEATURE2_HAS_EBB = 0x10000000, /* Event Base Branching */
768     QEMU_PPC_FEATURE2_HAS_ISEL = 0x08000000, /* Integer Select */
769     QEMU_PPC_FEATURE2_HAS_TAR = 0x04000000, /* Target Address Register */
770     QEMU_PPC_FEATURE2_VEC_CRYPTO = 0x02000000,
771     QEMU_PPC_FEATURE2_HTM_NOSC = 0x01000000,
772     QEMU_PPC_FEATURE2_ARCH_3_00 = 0x00800000, /* ISA 3.00 */
773     QEMU_PPC_FEATURE2_HAS_IEEE128 = 0x00400000, /* VSX IEEE Bin Float 128-bit */
774     QEMU_PPC_FEATURE2_DARN = 0x00200000, /* darn random number insn */
775     QEMU_PPC_FEATURE2_SCV = 0x00100000, /* scv syscall */
776     QEMU_PPC_FEATURE2_HTM_NO_SUSPEND = 0x00080000, /* TM w/o suspended state */
777 };
778 
779 #define ELF_HWCAP get_elf_hwcap()
780 
781 static uint32_t get_elf_hwcap(void)
782 {
783     PowerPCCPU *cpu = POWERPC_CPU(thread_cpu);
784     uint32_t features = 0;
785 
786     /* We don't have to be terribly complete here; the high points are
787        Altivec/FP/SPE support.  Anything else is just a bonus.  */
788 #define GET_FEATURE(flag, feature)                                      \
789     do { if (cpu->env.insns_flags & flag) { features |= feature; } } while (0)
790 #define GET_FEATURE2(flags, feature) \
791     do { \
792         if ((cpu->env.insns_flags2 & flags) == flags) { \
793             features |= feature; \
794         } \
795     } while (0)
796     GET_FEATURE(PPC_64B, QEMU_PPC_FEATURE_64);
797     GET_FEATURE(PPC_FLOAT, QEMU_PPC_FEATURE_HAS_FPU);
798     GET_FEATURE(PPC_ALTIVEC, QEMU_PPC_FEATURE_HAS_ALTIVEC);
799     GET_FEATURE(PPC_SPE, QEMU_PPC_FEATURE_HAS_SPE);
800     GET_FEATURE(PPC_SPE_SINGLE, QEMU_PPC_FEATURE_HAS_EFP_SINGLE);
801     GET_FEATURE(PPC_SPE_DOUBLE, QEMU_PPC_FEATURE_HAS_EFP_DOUBLE);
802     GET_FEATURE(PPC_BOOKE, QEMU_PPC_FEATURE_BOOKE);
803     GET_FEATURE(PPC_405_MAC, QEMU_PPC_FEATURE_HAS_4xxMAC);
804     GET_FEATURE2(PPC2_DFP, QEMU_PPC_FEATURE_HAS_DFP);
805     GET_FEATURE2(PPC2_VSX, QEMU_PPC_FEATURE_HAS_VSX);
806     GET_FEATURE2((PPC2_PERM_ISA206 | PPC2_DIVE_ISA206 | PPC2_ATOMIC_ISA206 |
807                   PPC2_FP_CVT_ISA206 | PPC2_FP_TST_ISA206),
808                   QEMU_PPC_FEATURE_ARCH_2_06);
809 #undef GET_FEATURE
810 #undef GET_FEATURE2
811 
812     return features;
813 }
814 
815 #define ELF_HWCAP2 get_elf_hwcap2()
816 
817 static uint32_t get_elf_hwcap2(void)
818 {
819     PowerPCCPU *cpu = POWERPC_CPU(thread_cpu);
820     uint32_t features = 0;
821 
822 #define GET_FEATURE(flag, feature)                                      \
823     do { if (cpu->env.insns_flags & flag) { features |= feature; } } while (0)
824 #define GET_FEATURE2(flag, feature)                                      \
825     do { if (cpu->env.insns_flags2 & flag) { features |= feature; } } while (0)
826 
827     GET_FEATURE(PPC_ISEL, QEMU_PPC_FEATURE2_HAS_ISEL);
828     GET_FEATURE2(PPC2_BCTAR_ISA207, QEMU_PPC_FEATURE2_HAS_TAR);
829     GET_FEATURE2((PPC2_BCTAR_ISA207 | PPC2_LSQ_ISA207 | PPC2_ALTIVEC_207 |
830                   PPC2_ISA207S), QEMU_PPC_FEATURE2_ARCH_2_07 |
831                   QEMU_PPC_FEATURE2_VEC_CRYPTO);
832     GET_FEATURE2(PPC2_ISA300, QEMU_PPC_FEATURE2_ARCH_3_00 |
833                  QEMU_PPC_FEATURE2_DARN | QEMU_PPC_FEATURE2_HAS_IEEE128);
834 
835 #undef GET_FEATURE
836 #undef GET_FEATURE2
837 
838     return features;
839 }
840 
841 /*
842  * The requirements here are:
843  * - keep the final alignment of sp (sp & 0xf)
844  * - make sure the 32-bit value at the first 16 byte aligned position of
845  *   AUXV is greater than 16 for glibc compatibility.
846  *   AT_IGNOREPPC is used for that.
847  * - for compatibility with glibc ARCH_DLINFO must always be defined on PPC,
848  *   even if DLINFO_ARCH_ITEMS goes to zero or is undefined.
849  */
850 #define DLINFO_ARCH_ITEMS       5
851 #define ARCH_DLINFO                                     \
852     do {                                                \
853         PowerPCCPU *cpu = POWERPC_CPU(thread_cpu);              \
854         /*                                              \
855          * Handle glibc compatibility: these magic entries must \
856          * be at the lowest addresses in the final auxv.        \
857          */                                             \
858         NEW_AUX_ENT(AT_IGNOREPPC, AT_IGNOREPPC);        \
859         NEW_AUX_ENT(AT_IGNOREPPC, AT_IGNOREPPC);        \
860         NEW_AUX_ENT(AT_DCACHEBSIZE, cpu->env.dcache_line_size); \
861         NEW_AUX_ENT(AT_ICACHEBSIZE, cpu->env.icache_line_size); \
862         NEW_AUX_ENT(AT_UCACHEBSIZE, 0);                 \
863     } while (0)
864 
865 static inline void init_thread(struct target_pt_regs *_regs, struct image_info *infop)
866 {
867     _regs->gpr[1] = infop->start_stack;
868 #if defined(TARGET_PPC64) && !defined(TARGET_ABI32)
869     if (get_ppc64_abi(infop) < 2) {
870         uint64_t val;
871         get_user_u64(val, infop->entry + 8);
872         _regs->gpr[2] = val + infop->load_bias;
873         get_user_u64(val, infop->entry);
874         infop->entry = val + infop->load_bias;
875     } else {
876         _regs->gpr[12] = infop->entry;  /* r12 set to global entry address */
877     }
878 #endif
879     _regs->nip = infop->entry;
880 }
881 
882 /* See linux kernel: arch/powerpc/include/asm/elf.h.  */
883 #define ELF_NREG 48
884 typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG];
885 
886 static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUPPCState *env)
887 {
888     int i;
889     target_ulong ccr = 0;
890 
891     for (i = 0; i < ARRAY_SIZE(env->gpr); i++) {
892         (*regs)[i] = tswapreg(env->gpr[i]);
893     }
894 
895     (*regs)[32] = tswapreg(env->nip);
896     (*regs)[33] = tswapreg(env->msr);
897     (*regs)[35] = tswapreg(env->ctr);
898     (*regs)[36] = tswapreg(env->lr);
899     (*regs)[37] = tswapreg(env->xer);
900 
901     for (i = 0; i < ARRAY_SIZE(env->crf); i++) {
902         ccr |= env->crf[i] << (32 - ((i + 1) * 4));
903     }
904     (*regs)[38] = tswapreg(ccr);
905 }
906 
907 #define USE_ELF_CORE_DUMP
908 #define ELF_EXEC_PAGESIZE       4096
909 
910 #endif
911 
912 #ifdef TARGET_MIPS
913 
914 #define ELF_START_MMAP 0x80000000
915 
916 #ifdef TARGET_MIPS64
917 #define ELF_CLASS   ELFCLASS64
918 #else
919 #define ELF_CLASS   ELFCLASS32
920 #endif
921 #define ELF_ARCH    EM_MIPS
922 
923 #define elf_check_arch(x) ((x) == EM_MIPS || (x) == EM_NANOMIPS)
924 
925 #ifdef TARGET_ABI_MIPSN32
926 #define elf_check_abi(x) ((x) & EF_MIPS_ABI2)
927 #else
928 #define elf_check_abi(x) (!((x) & EF_MIPS_ABI2))
929 #endif
930 
931 static inline void init_thread(struct target_pt_regs *regs,
932                                struct image_info *infop)
933 {
934     regs->cp0_status = 2 << CP0St_KSU;
935     regs->cp0_epc = infop->entry;
936     regs->regs[29] = infop->start_stack;
937 }
938 
939 /* See linux kernel: arch/mips/include/asm/elf.h.  */
940 #define ELF_NREG 45
941 typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG];
942 
943 /* See linux kernel: arch/mips/include/asm/reg.h.  */
944 enum {
945 #ifdef TARGET_MIPS64
946     TARGET_EF_R0 = 0,
947 #else
948     TARGET_EF_R0 = 6,
949 #endif
950     TARGET_EF_R26 = TARGET_EF_R0 + 26,
951     TARGET_EF_R27 = TARGET_EF_R0 + 27,
952     TARGET_EF_LO = TARGET_EF_R0 + 32,
953     TARGET_EF_HI = TARGET_EF_R0 + 33,
954     TARGET_EF_CP0_EPC = TARGET_EF_R0 + 34,
955     TARGET_EF_CP0_BADVADDR = TARGET_EF_R0 + 35,
956     TARGET_EF_CP0_STATUS = TARGET_EF_R0 + 36,
957     TARGET_EF_CP0_CAUSE = TARGET_EF_R0 + 37
958 };
959 
960 /* See linux kernel: arch/mips/kernel/process.c:elf_dump_regs.  */
961 static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUMIPSState *env)
962 {
963     int i;
964 
965     for (i = 0; i < TARGET_EF_R0; i++) {
966         (*regs)[i] = 0;
967     }
968     (*regs)[TARGET_EF_R0] = 0;
969 
970     for (i = 1; i < ARRAY_SIZE(env->active_tc.gpr); i++) {
971         (*regs)[TARGET_EF_R0 + i] = tswapreg(env->active_tc.gpr[i]);
972     }
973 
974     (*regs)[TARGET_EF_R26] = 0;
975     (*regs)[TARGET_EF_R27] = 0;
976     (*regs)[TARGET_EF_LO] = tswapreg(env->active_tc.LO[0]);
977     (*regs)[TARGET_EF_HI] = tswapreg(env->active_tc.HI[0]);
978     (*regs)[TARGET_EF_CP0_EPC] = tswapreg(env->active_tc.PC);
979     (*regs)[TARGET_EF_CP0_BADVADDR] = tswapreg(env->CP0_BadVAddr);
980     (*regs)[TARGET_EF_CP0_STATUS] = tswapreg(env->CP0_Status);
981     (*regs)[TARGET_EF_CP0_CAUSE] = tswapreg(env->CP0_Cause);
982 }
983 
984 #define USE_ELF_CORE_DUMP
985 #define ELF_EXEC_PAGESIZE        4096
986 
987 /* See arch/mips/include/uapi/asm/hwcap.h.  */
988 enum {
989     HWCAP_MIPS_R6           = (1 << 0),
990     HWCAP_MIPS_MSA          = (1 << 1),
991     HWCAP_MIPS_CRC32        = (1 << 2),
992     HWCAP_MIPS_MIPS16       = (1 << 3),
993     HWCAP_MIPS_MDMX         = (1 << 4),
994     HWCAP_MIPS_MIPS3D       = (1 << 5),
995     HWCAP_MIPS_SMARTMIPS    = (1 << 6),
996     HWCAP_MIPS_DSP          = (1 << 7),
997     HWCAP_MIPS_DSP2         = (1 << 8),
998     HWCAP_MIPS_DSP3         = (1 << 9),
999     HWCAP_MIPS_MIPS16E2     = (1 << 10),
1000     HWCAP_LOONGSON_MMI      = (1 << 11),
1001     HWCAP_LOONGSON_EXT      = (1 << 12),
1002     HWCAP_LOONGSON_EXT2     = (1 << 13),
1003     HWCAP_LOONGSON_CPUCFG   = (1 << 14),
1004 };
1005 
1006 #define ELF_HWCAP get_elf_hwcap()
1007 
1008 #define GET_FEATURE_INSN(_flag, _hwcap) \
1009     do { if (cpu->env.insn_flags & (_flag)) { hwcaps |= _hwcap; } } while (0)
1010 
1011 #define GET_FEATURE_REG_SET(_reg, _mask, _hwcap) \
1012     do { if (cpu->env._reg & (_mask)) { hwcaps |= _hwcap; } } while (0)
1013 
1014 #define GET_FEATURE_REG_EQU(_reg, _start, _length, _val, _hwcap) \
1015     do { \
1016         if (extract32(cpu->env._reg, (_start), (_length)) == (_val)) { \
1017             hwcaps |= _hwcap; \
1018         } \
1019     } while (0)
1020 
1021 static uint32_t get_elf_hwcap(void)
1022 {
1023     MIPSCPU *cpu = MIPS_CPU(thread_cpu);
1024     uint32_t hwcaps = 0;
1025 
1026     GET_FEATURE_REG_EQU(CP0_Config0, CP0C0_AR, CP0C0_AR_LENGTH,
1027                         2, HWCAP_MIPS_R6);
1028     GET_FEATURE_REG_SET(CP0_Config3, 1 << CP0C3_MSAP, HWCAP_MIPS_MSA);
1029     GET_FEATURE_INSN(ASE_LMMI, HWCAP_LOONGSON_MMI);
1030     GET_FEATURE_INSN(ASE_LEXT, HWCAP_LOONGSON_EXT);
1031 
1032     return hwcaps;
1033 }
1034 
1035 #undef GET_FEATURE_REG_EQU
1036 #undef GET_FEATURE_REG_SET
1037 #undef GET_FEATURE_INSN
1038 
1039 #endif /* TARGET_MIPS */
1040 
1041 #ifdef TARGET_MICROBLAZE
1042 
1043 #define ELF_START_MMAP 0x80000000
1044 
1045 #define elf_check_arch(x) ( (x) == EM_MICROBLAZE || (x) == EM_MICROBLAZE_OLD)
1046 
1047 #define ELF_CLASS   ELFCLASS32
1048 #define ELF_ARCH    EM_MICROBLAZE
1049 
1050 static inline void init_thread(struct target_pt_regs *regs,
1051                                struct image_info *infop)
1052 {
1053     regs->pc = infop->entry;
1054     regs->r1 = infop->start_stack;
1055 
1056 }
1057 
1058 #define ELF_EXEC_PAGESIZE        4096
1059 
1060 #define USE_ELF_CORE_DUMP
1061 #define ELF_NREG 38
1062 typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG];
1063 
1064 /* See linux kernel: arch/mips/kernel/process.c:elf_dump_regs.  */
1065 static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUMBState *env)
1066 {
1067     int i, pos = 0;
1068 
1069     for (i = 0; i < 32; i++) {
1070         (*regs)[pos++] = tswapreg(env->regs[i]);
1071     }
1072 
1073     (*regs)[pos++] = tswapreg(env->pc);
1074     (*regs)[pos++] = tswapreg(mb_cpu_read_msr(env));
1075     (*regs)[pos++] = 0;
1076     (*regs)[pos++] = tswapreg(env->ear);
1077     (*regs)[pos++] = 0;
1078     (*regs)[pos++] = tswapreg(env->esr);
1079 }
1080 
1081 #endif /* TARGET_MICROBLAZE */
1082 
1083 #ifdef TARGET_NIOS2
1084 
1085 #define ELF_START_MMAP 0x80000000
1086 
1087 #define elf_check_arch(x) ((x) == EM_ALTERA_NIOS2)
1088 
1089 #define ELF_CLASS   ELFCLASS32
1090 #define ELF_ARCH    EM_ALTERA_NIOS2
1091 
1092 static void init_thread(struct target_pt_regs *regs, struct image_info *infop)
1093 {
1094     regs->ea = infop->entry;
1095     regs->sp = infop->start_stack;
1096     regs->estatus = 0x3;
1097 }
1098 
1099 #define ELF_EXEC_PAGESIZE        4096
1100 
1101 #define USE_ELF_CORE_DUMP
1102 #define ELF_NREG 49
1103 typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG];
1104 
1105 /* See linux kernel: arch/mips/kernel/process.c:elf_dump_regs.  */
1106 static void elf_core_copy_regs(target_elf_gregset_t *regs,
1107                                const CPUNios2State *env)
1108 {
1109     int i;
1110 
1111     (*regs)[0] = -1;
1112     for (i = 1; i < 8; i++)    /* r0-r7 */
1113         (*regs)[i] = tswapreg(env->regs[i + 7]);
1114 
1115     for (i = 8; i < 16; i++)   /* r8-r15 */
1116         (*regs)[i] = tswapreg(env->regs[i - 8]);
1117 
1118     for (i = 16; i < 24; i++)  /* r16-r23 */
1119         (*regs)[i] = tswapreg(env->regs[i + 7]);
1120     (*regs)[24] = -1;    /* R_ET */
1121     (*regs)[25] = -1;    /* R_BT */
1122     (*regs)[26] = tswapreg(env->regs[R_GP]);
1123     (*regs)[27] = tswapreg(env->regs[R_SP]);
1124     (*regs)[28] = tswapreg(env->regs[R_FP]);
1125     (*regs)[29] = tswapreg(env->regs[R_EA]);
1126     (*regs)[30] = -1;    /* R_SSTATUS */
1127     (*regs)[31] = tswapreg(env->regs[R_RA]);
1128 
1129     (*regs)[32] = tswapreg(env->regs[R_PC]);
1130 
1131     (*regs)[33] = -1; /* R_STATUS */
1132     (*regs)[34] = tswapreg(env->regs[CR_ESTATUS]);
1133 
1134     for (i = 35; i < 49; i++)    /* ... */
1135         (*regs)[i] = -1;
1136 }
1137 
1138 #endif /* TARGET_NIOS2 */
1139 
1140 #ifdef TARGET_OPENRISC
1141 
1142 #define ELF_START_MMAP 0x08000000
1143 
1144 #define ELF_ARCH EM_OPENRISC
1145 #define ELF_CLASS ELFCLASS32
1146 #define ELF_DATA  ELFDATA2MSB
1147 
1148 static inline void init_thread(struct target_pt_regs *regs,
1149                                struct image_info *infop)
1150 {
1151     regs->pc = infop->entry;
1152     regs->gpr[1] = infop->start_stack;
1153 }
1154 
1155 #define USE_ELF_CORE_DUMP
1156 #define ELF_EXEC_PAGESIZE 8192
1157 
1158 /* See linux kernel arch/openrisc/include/asm/elf.h.  */
1159 #define ELF_NREG 34 /* gprs and pc, sr */
1160 typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG];
1161 
1162 static void elf_core_copy_regs(target_elf_gregset_t *regs,
1163                                const CPUOpenRISCState *env)
1164 {
1165     int i;
1166 
1167     for (i = 0; i < 32; i++) {
1168         (*regs)[i] = tswapreg(cpu_get_gpr(env, i));
1169     }
1170     (*regs)[32] = tswapreg(env->pc);
1171     (*regs)[33] = tswapreg(cpu_get_sr(env));
1172 }
1173 #define ELF_HWCAP 0
1174 #define ELF_PLATFORM NULL
1175 
1176 #endif /* TARGET_OPENRISC */
1177 
1178 #ifdef TARGET_SH4
1179 
1180 #define ELF_START_MMAP 0x80000000
1181 
1182 #define ELF_CLASS ELFCLASS32
1183 #define ELF_ARCH  EM_SH
1184 
1185 static inline void init_thread(struct target_pt_regs *regs,
1186                                struct image_info *infop)
1187 {
1188     /* Check other registers XXXXX */
1189     regs->pc = infop->entry;
1190     regs->regs[15] = infop->start_stack;
1191 }
1192 
1193 /* See linux kernel: arch/sh/include/asm/elf.h.  */
1194 #define ELF_NREG 23
1195 typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG];
1196 
1197 /* See linux kernel: arch/sh/include/asm/ptrace.h.  */
1198 enum {
1199     TARGET_REG_PC = 16,
1200     TARGET_REG_PR = 17,
1201     TARGET_REG_SR = 18,
1202     TARGET_REG_GBR = 19,
1203     TARGET_REG_MACH = 20,
1204     TARGET_REG_MACL = 21,
1205     TARGET_REG_SYSCALL = 22
1206 };
1207 
1208 static inline void elf_core_copy_regs(target_elf_gregset_t *regs,
1209                                       const CPUSH4State *env)
1210 {
1211     int i;
1212 
1213     for (i = 0; i < 16; i++) {
1214         (*regs)[i] = tswapreg(env->gregs[i]);
1215     }
1216 
1217     (*regs)[TARGET_REG_PC] = tswapreg(env->pc);
1218     (*regs)[TARGET_REG_PR] = tswapreg(env->pr);
1219     (*regs)[TARGET_REG_SR] = tswapreg(env->sr);
1220     (*regs)[TARGET_REG_GBR] = tswapreg(env->gbr);
1221     (*regs)[TARGET_REG_MACH] = tswapreg(env->mach);
1222     (*regs)[TARGET_REG_MACL] = tswapreg(env->macl);
1223     (*regs)[TARGET_REG_SYSCALL] = 0; /* FIXME */
1224 }
1225 
1226 #define USE_ELF_CORE_DUMP
1227 #define ELF_EXEC_PAGESIZE        4096
1228 
1229 enum {
1230     SH_CPU_HAS_FPU            = 0x0001, /* Hardware FPU support */
1231     SH_CPU_HAS_P2_FLUSH_BUG   = 0x0002, /* Need to flush the cache in P2 area */
1232     SH_CPU_HAS_MMU_PAGE_ASSOC = 0x0004, /* SH3: TLB way selection bit support */
1233     SH_CPU_HAS_DSP            = 0x0008, /* SH-DSP: DSP support */
1234     SH_CPU_HAS_PERF_COUNTER   = 0x0010, /* Hardware performance counters */
1235     SH_CPU_HAS_PTEA           = 0x0020, /* PTEA register */
1236     SH_CPU_HAS_LLSC           = 0x0040, /* movli.l/movco.l */
1237     SH_CPU_HAS_L2_CACHE       = 0x0080, /* Secondary cache / URAM */
1238     SH_CPU_HAS_OP32           = 0x0100, /* 32-bit instruction support */
1239     SH_CPU_HAS_PTEAEX         = 0x0200, /* PTE ASID Extension support */
1240 };
1241 
1242 #define ELF_HWCAP get_elf_hwcap()
1243 
1244 static uint32_t get_elf_hwcap(void)
1245 {
1246     SuperHCPU *cpu = SUPERH_CPU(thread_cpu);
1247     uint32_t hwcap = 0;
1248 
1249     hwcap |= SH_CPU_HAS_FPU;
1250 
1251     if (cpu->env.features & SH_FEATURE_SH4A) {
1252         hwcap |= SH_CPU_HAS_LLSC;
1253     }
1254 
1255     return hwcap;
1256 }
1257 
1258 #endif
1259 
1260 #ifdef TARGET_CRIS
1261 
1262 #define ELF_START_MMAP 0x80000000
1263 
1264 #define ELF_CLASS ELFCLASS32
1265 #define ELF_ARCH  EM_CRIS
1266 
1267 static inline void init_thread(struct target_pt_regs *regs,
1268                                struct image_info *infop)
1269 {
1270     regs->erp = infop->entry;
1271 }
1272 
1273 #define ELF_EXEC_PAGESIZE        8192
1274 
1275 #endif
1276 
1277 #ifdef TARGET_M68K
1278 
1279 #define ELF_START_MMAP 0x80000000
1280 
1281 #define ELF_CLASS       ELFCLASS32
1282 #define ELF_ARCH        EM_68K
1283 
1284 /* ??? Does this need to do anything?
1285    #define ELF_PLAT_INIT(_r) */
1286 
1287 static inline void init_thread(struct target_pt_regs *regs,
1288                                struct image_info *infop)
1289 {
1290     regs->usp = infop->start_stack;
1291     regs->sr = 0;
1292     regs->pc = infop->entry;
1293 }
1294 
1295 /* See linux kernel: arch/m68k/include/asm/elf.h.  */
1296 #define ELF_NREG 20
1297 typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG];
1298 
1299 static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUM68KState *env)
1300 {
1301     (*regs)[0] = tswapreg(env->dregs[1]);
1302     (*regs)[1] = tswapreg(env->dregs[2]);
1303     (*regs)[2] = tswapreg(env->dregs[3]);
1304     (*regs)[3] = tswapreg(env->dregs[4]);
1305     (*regs)[4] = tswapreg(env->dregs[5]);
1306     (*regs)[5] = tswapreg(env->dregs[6]);
1307     (*regs)[6] = tswapreg(env->dregs[7]);
1308     (*regs)[7] = tswapreg(env->aregs[0]);
1309     (*regs)[8] = tswapreg(env->aregs[1]);
1310     (*regs)[9] = tswapreg(env->aregs[2]);
1311     (*regs)[10] = tswapreg(env->aregs[3]);
1312     (*regs)[11] = tswapreg(env->aregs[4]);
1313     (*regs)[12] = tswapreg(env->aregs[5]);
1314     (*regs)[13] = tswapreg(env->aregs[6]);
1315     (*regs)[14] = tswapreg(env->dregs[0]);
1316     (*regs)[15] = tswapreg(env->aregs[7]);
1317     (*regs)[16] = tswapreg(env->dregs[0]); /* FIXME: orig_d0 */
1318     (*regs)[17] = tswapreg(env->sr);
1319     (*regs)[18] = tswapreg(env->pc);
1320     (*regs)[19] = 0;  /* FIXME: regs->format | regs->vector */
1321 }
1322 
1323 #define USE_ELF_CORE_DUMP
1324 #define ELF_EXEC_PAGESIZE       8192
1325 
1326 #endif
1327 
1328 #ifdef TARGET_ALPHA
1329 
1330 #define ELF_START_MMAP (0x30000000000ULL)
1331 
1332 #define ELF_CLASS      ELFCLASS64
1333 #define ELF_ARCH       EM_ALPHA
1334 
1335 static inline void init_thread(struct target_pt_regs *regs,
1336                                struct image_info *infop)
1337 {
1338     regs->pc = infop->entry;
1339     regs->ps = 8;
1340     regs->usp = infop->start_stack;
1341 }
1342 
1343 #define ELF_EXEC_PAGESIZE        8192
1344 
1345 #endif /* TARGET_ALPHA */
1346 
1347 #ifdef TARGET_S390X
1348 
1349 #define ELF_START_MMAP (0x20000000000ULL)
1350 
1351 #define ELF_CLASS	ELFCLASS64
1352 #define ELF_DATA	ELFDATA2MSB
1353 #define ELF_ARCH	EM_S390
1354 
1355 #include "elf.h"
1356 
1357 #define ELF_HWCAP get_elf_hwcap()
1358 
1359 #define GET_FEATURE(_feat, _hwcap) \
1360     do { if (s390_has_feat(_feat)) { hwcap |= _hwcap; } } while (0)
1361 
1362 static uint32_t get_elf_hwcap(void)
1363 {
1364     /*
1365      * Let's assume we always have esan3 and zarch.
1366      * 31-bit processes can use 64-bit registers (high gprs).
1367      */
1368     uint32_t hwcap = HWCAP_S390_ESAN3 | HWCAP_S390_ZARCH | HWCAP_S390_HIGH_GPRS;
1369 
1370     GET_FEATURE(S390_FEAT_STFLE, HWCAP_S390_STFLE);
1371     GET_FEATURE(S390_FEAT_MSA, HWCAP_S390_MSA);
1372     GET_FEATURE(S390_FEAT_LONG_DISPLACEMENT, HWCAP_S390_LDISP);
1373     GET_FEATURE(S390_FEAT_EXTENDED_IMMEDIATE, HWCAP_S390_EIMM);
1374     if (s390_has_feat(S390_FEAT_EXTENDED_TRANSLATION_3) &&
1375         s390_has_feat(S390_FEAT_ETF3_ENH)) {
1376         hwcap |= HWCAP_S390_ETF3EH;
1377     }
1378     GET_FEATURE(S390_FEAT_VECTOR, HWCAP_S390_VXRS);
1379     GET_FEATURE(S390_FEAT_VECTOR_ENH, HWCAP_S390_VXRS_EXT);
1380 
1381     return hwcap;
1382 }
1383 
1384 static inline void init_thread(struct target_pt_regs *regs, struct image_info *infop)
1385 {
1386     regs->psw.addr = infop->entry;
1387     regs->psw.mask = PSW_MASK_64 | PSW_MASK_32;
1388     regs->gprs[15] = infop->start_stack;
1389 }
1390 
1391 /* See linux kernel: arch/s390/include/uapi/asm/ptrace.h (s390_regs).  */
1392 #define ELF_NREG 27
1393 typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG];
1394 
1395 enum {
1396     TARGET_REG_PSWM = 0,
1397     TARGET_REG_PSWA = 1,
1398     TARGET_REG_GPRS = 2,
1399     TARGET_REG_ARS = 18,
1400     TARGET_REG_ORIG_R2 = 26,
1401 };
1402 
1403 static void elf_core_copy_regs(target_elf_gregset_t *regs,
1404                                const CPUS390XState *env)
1405 {
1406     int i;
1407     uint32_t *aregs;
1408 
1409     (*regs)[TARGET_REG_PSWM] = tswapreg(env->psw.mask);
1410     (*regs)[TARGET_REG_PSWA] = tswapreg(env->psw.addr);
1411     for (i = 0; i < 16; i++) {
1412         (*regs)[TARGET_REG_GPRS + i] = tswapreg(env->regs[i]);
1413     }
1414     aregs = (uint32_t *)&((*regs)[TARGET_REG_ARS]);
1415     for (i = 0; i < 16; i++) {
1416         aregs[i] = tswap32(env->aregs[i]);
1417     }
1418     (*regs)[TARGET_REG_ORIG_R2] = 0;
1419 }
1420 
1421 #define USE_ELF_CORE_DUMP
1422 #define ELF_EXEC_PAGESIZE 4096
1423 
1424 #endif /* TARGET_S390X */
1425 
1426 #ifdef TARGET_RISCV
1427 
1428 #define ELF_START_MMAP 0x80000000
1429 #define ELF_ARCH  EM_RISCV
1430 
1431 #ifdef TARGET_RISCV32
1432 #define ELF_CLASS ELFCLASS32
1433 #else
1434 #define ELF_CLASS ELFCLASS64
1435 #endif
1436 
1437 #define ELF_HWCAP get_elf_hwcap()
1438 
1439 static uint32_t get_elf_hwcap(void)
1440 {
1441 #define MISA_BIT(EXT) (1 << (EXT - 'A'))
1442     RISCVCPU *cpu = RISCV_CPU(thread_cpu);
1443     uint32_t mask = MISA_BIT('I') | MISA_BIT('M') | MISA_BIT('A')
1444                     | MISA_BIT('F') | MISA_BIT('D') | MISA_BIT('C');
1445 
1446     return cpu->env.misa & mask;
1447 #undef MISA_BIT
1448 }
1449 
1450 static inline void init_thread(struct target_pt_regs *regs,
1451                                struct image_info *infop)
1452 {
1453     regs->sepc = infop->entry;
1454     regs->sp = infop->start_stack;
1455 }
1456 
1457 #define ELF_EXEC_PAGESIZE 4096
1458 
1459 #endif /* TARGET_RISCV */
1460 
1461 #ifdef TARGET_HPPA
1462 
1463 #define ELF_START_MMAP  0x80000000
1464 #define ELF_CLASS       ELFCLASS32
1465 #define ELF_ARCH        EM_PARISC
1466 #define ELF_PLATFORM    "PARISC"
1467 #define STACK_GROWS_DOWN 0
1468 #define STACK_ALIGNMENT  64
1469 
1470 static inline void init_thread(struct target_pt_regs *regs,
1471                                struct image_info *infop)
1472 {
1473     regs->iaoq[0] = infop->entry;
1474     regs->iaoq[1] = infop->entry + 4;
1475     regs->gr[23] = 0;
1476     regs->gr[24] = infop->arg_start;
1477     regs->gr[25] = (infop->arg_end - infop->arg_start) / sizeof(abi_ulong);
1478     /* The top-of-stack contains a linkage buffer.  */
1479     regs->gr[30] = infop->start_stack + 64;
1480     regs->gr[31] = infop->entry;
1481 }
1482 
1483 #endif /* TARGET_HPPA */
1484 
1485 #ifdef TARGET_XTENSA
1486 
1487 #define ELF_START_MMAP 0x20000000
1488 
1489 #define ELF_CLASS       ELFCLASS32
1490 #define ELF_ARCH        EM_XTENSA
1491 
1492 static inline void init_thread(struct target_pt_regs *regs,
1493                                struct image_info *infop)
1494 {
1495     regs->windowbase = 0;
1496     regs->windowstart = 1;
1497     regs->areg[1] = infop->start_stack;
1498     regs->pc = infop->entry;
1499 }
1500 
1501 /* See linux kernel: arch/xtensa/include/asm/elf.h.  */
1502 #define ELF_NREG 128
1503 typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG];
1504 
1505 enum {
1506     TARGET_REG_PC,
1507     TARGET_REG_PS,
1508     TARGET_REG_LBEG,
1509     TARGET_REG_LEND,
1510     TARGET_REG_LCOUNT,
1511     TARGET_REG_SAR,
1512     TARGET_REG_WINDOWSTART,
1513     TARGET_REG_WINDOWBASE,
1514     TARGET_REG_THREADPTR,
1515     TARGET_REG_AR0 = 64,
1516 };
1517 
1518 static void elf_core_copy_regs(target_elf_gregset_t *regs,
1519                                const CPUXtensaState *env)
1520 {
1521     unsigned i;
1522 
1523     (*regs)[TARGET_REG_PC] = tswapreg(env->pc);
1524     (*regs)[TARGET_REG_PS] = tswapreg(env->sregs[PS] & ~PS_EXCM);
1525     (*regs)[TARGET_REG_LBEG] = tswapreg(env->sregs[LBEG]);
1526     (*regs)[TARGET_REG_LEND] = tswapreg(env->sregs[LEND]);
1527     (*regs)[TARGET_REG_LCOUNT] = tswapreg(env->sregs[LCOUNT]);
1528     (*regs)[TARGET_REG_SAR] = tswapreg(env->sregs[SAR]);
1529     (*regs)[TARGET_REG_WINDOWSTART] = tswapreg(env->sregs[WINDOW_START]);
1530     (*regs)[TARGET_REG_WINDOWBASE] = tswapreg(env->sregs[WINDOW_BASE]);
1531     (*regs)[TARGET_REG_THREADPTR] = tswapreg(env->uregs[THREADPTR]);
1532     xtensa_sync_phys_from_window((CPUXtensaState *)env);
1533     for (i = 0; i < env->config->nareg; ++i) {
1534         (*regs)[TARGET_REG_AR0 + i] = tswapreg(env->phys_regs[i]);
1535     }
1536 }
1537 
1538 #define USE_ELF_CORE_DUMP
1539 #define ELF_EXEC_PAGESIZE       4096
1540 
1541 #endif /* TARGET_XTENSA */
1542 
1543 #ifdef TARGET_HEXAGON
1544 
1545 #define ELF_START_MMAP 0x20000000
1546 
1547 #define ELF_CLASS       ELFCLASS32
1548 #define ELF_ARCH        EM_HEXAGON
1549 
1550 static inline void init_thread(struct target_pt_regs *regs,
1551                                struct image_info *infop)
1552 {
1553     regs->sepc = infop->entry;
1554     regs->sp = infop->start_stack;
1555 }
1556 
1557 #endif /* TARGET_HEXAGON */
1558 
1559 #ifndef ELF_PLATFORM
1560 #define ELF_PLATFORM (NULL)
1561 #endif
1562 
1563 #ifndef ELF_MACHINE
1564 #define ELF_MACHINE ELF_ARCH
1565 #endif
1566 
1567 #ifndef elf_check_arch
1568 #define elf_check_arch(x) ((x) == ELF_ARCH)
1569 #endif
1570 
1571 #ifndef elf_check_abi
1572 #define elf_check_abi(x) (1)
1573 #endif
1574 
1575 #ifndef ELF_HWCAP
1576 #define ELF_HWCAP 0
1577 #endif
1578 
1579 #ifndef STACK_GROWS_DOWN
1580 #define STACK_GROWS_DOWN 1
1581 #endif
1582 
1583 #ifndef STACK_ALIGNMENT
1584 #define STACK_ALIGNMENT 16
1585 #endif
1586 
1587 #ifdef TARGET_ABI32
1588 #undef ELF_CLASS
1589 #define ELF_CLASS ELFCLASS32
1590 #undef bswaptls
1591 #define bswaptls(ptr) bswap32s(ptr)
1592 #endif
1593 
1594 #include "elf.h"
1595 
1596 /* We must delay the following stanzas until after "elf.h". */
1597 #if defined(TARGET_AARCH64)
1598 
1599 static bool arch_parse_elf_property(uint32_t pr_type, uint32_t pr_datasz,
1600                                     const uint32_t *data,
1601                                     struct image_info *info,
1602                                     Error **errp)
1603 {
1604     if (pr_type == GNU_PROPERTY_AARCH64_FEATURE_1_AND) {
1605         if (pr_datasz != sizeof(uint32_t)) {
1606             error_setg(errp, "Ill-formed GNU_PROPERTY_AARCH64_FEATURE_1_AND");
1607             return false;
1608         }
1609         /* We will extract GNU_PROPERTY_AARCH64_FEATURE_1_BTI later. */
1610         info->note_flags = *data;
1611     }
1612     return true;
1613 }
1614 #define ARCH_USE_GNU_PROPERTY 1
1615 
1616 #else
1617 
1618 static bool arch_parse_elf_property(uint32_t pr_type, uint32_t pr_datasz,
1619                                     const uint32_t *data,
1620                                     struct image_info *info,
1621                                     Error **errp)
1622 {
1623     g_assert_not_reached();
1624 }
1625 #define ARCH_USE_GNU_PROPERTY 0
1626 
1627 #endif
1628 
1629 struct exec
1630 {
1631     unsigned int a_info;   /* Use macros N_MAGIC, etc for access */
1632     unsigned int a_text;   /* length of text, in bytes */
1633     unsigned int a_data;   /* length of data, in bytes */
1634     unsigned int a_bss;    /* length of uninitialized data area, in bytes */
1635     unsigned int a_syms;   /* length of symbol table data in file, in bytes */
1636     unsigned int a_entry;  /* start address */
1637     unsigned int a_trsize; /* length of relocation info for text, in bytes */
1638     unsigned int a_drsize; /* length of relocation info for data, in bytes */
1639 };
1640 
1641 
1642 #define N_MAGIC(exec) ((exec).a_info & 0xffff)
1643 #define OMAGIC 0407
1644 #define NMAGIC 0410
1645 #define ZMAGIC 0413
1646 #define QMAGIC 0314
1647 
1648 /* Necessary parameters */
1649 #define TARGET_ELF_EXEC_PAGESIZE \
1650         (((eppnt->p_align & ~qemu_host_page_mask) != 0) ? \
1651          TARGET_PAGE_SIZE : MAX(qemu_host_page_size, TARGET_PAGE_SIZE))
1652 #define TARGET_ELF_PAGELENGTH(_v) ROUND_UP((_v), TARGET_ELF_EXEC_PAGESIZE)
1653 #define TARGET_ELF_PAGESTART(_v) ((_v) & \
1654                                  ~(abi_ulong)(TARGET_ELF_EXEC_PAGESIZE-1))
1655 #define TARGET_ELF_PAGEOFFSET(_v) ((_v) & (TARGET_ELF_EXEC_PAGESIZE-1))
1656 
1657 #define DLINFO_ITEMS 16
1658 
1659 static inline void memcpy_fromfs(void * to, const void * from, unsigned long n)
1660 {
1661     memcpy(to, from, n);
1662 }
1663 
1664 #ifdef BSWAP_NEEDED
1665 static void bswap_ehdr(struct elfhdr *ehdr)
1666 {
1667     bswap16s(&ehdr->e_type);            /* Object file type */
1668     bswap16s(&ehdr->e_machine);         /* Architecture */
1669     bswap32s(&ehdr->e_version);         /* Object file version */
1670     bswaptls(&ehdr->e_entry);           /* Entry point virtual address */
1671     bswaptls(&ehdr->e_phoff);           /* Program header table file offset */
1672     bswaptls(&ehdr->e_shoff);           /* Section header table file offset */
1673     bswap32s(&ehdr->e_flags);           /* Processor-specific flags */
1674     bswap16s(&ehdr->e_ehsize);          /* ELF header size in bytes */
1675     bswap16s(&ehdr->e_phentsize);       /* Program header table entry size */
1676     bswap16s(&ehdr->e_phnum);           /* Program header table entry count */
1677     bswap16s(&ehdr->e_shentsize);       /* Section header table entry size */
1678     bswap16s(&ehdr->e_shnum);           /* Section header table entry count */
1679     bswap16s(&ehdr->e_shstrndx);        /* Section header string table index */
1680 }
1681 
1682 static void bswap_phdr(struct elf_phdr *phdr, int phnum)
1683 {
1684     int i;
1685     for (i = 0; i < phnum; ++i, ++phdr) {
1686         bswap32s(&phdr->p_type);        /* Segment type */
1687         bswap32s(&phdr->p_flags);       /* Segment flags */
1688         bswaptls(&phdr->p_offset);      /* Segment file offset */
1689         bswaptls(&phdr->p_vaddr);       /* Segment virtual address */
1690         bswaptls(&phdr->p_paddr);       /* Segment physical address */
1691         bswaptls(&phdr->p_filesz);      /* Segment size in file */
1692         bswaptls(&phdr->p_memsz);       /* Segment size in memory */
1693         bswaptls(&phdr->p_align);       /* Segment alignment */
1694     }
1695 }
1696 
1697 static void bswap_shdr(struct elf_shdr *shdr, int shnum)
1698 {
1699     int i;
1700     for (i = 0; i < shnum; ++i, ++shdr) {
1701         bswap32s(&shdr->sh_name);
1702         bswap32s(&shdr->sh_type);
1703         bswaptls(&shdr->sh_flags);
1704         bswaptls(&shdr->sh_addr);
1705         bswaptls(&shdr->sh_offset);
1706         bswaptls(&shdr->sh_size);
1707         bswap32s(&shdr->sh_link);
1708         bswap32s(&shdr->sh_info);
1709         bswaptls(&shdr->sh_addralign);
1710         bswaptls(&shdr->sh_entsize);
1711     }
1712 }
1713 
1714 static void bswap_sym(struct elf_sym *sym)
1715 {
1716     bswap32s(&sym->st_name);
1717     bswaptls(&sym->st_value);
1718     bswaptls(&sym->st_size);
1719     bswap16s(&sym->st_shndx);
1720 }
1721 
1722 #ifdef TARGET_MIPS
1723 static void bswap_mips_abiflags(Mips_elf_abiflags_v0 *abiflags)
1724 {
1725     bswap16s(&abiflags->version);
1726     bswap32s(&abiflags->ases);
1727     bswap32s(&abiflags->isa_ext);
1728     bswap32s(&abiflags->flags1);
1729     bswap32s(&abiflags->flags2);
1730 }
1731 #endif
1732 #else
1733 static inline void bswap_ehdr(struct elfhdr *ehdr) { }
1734 static inline void bswap_phdr(struct elf_phdr *phdr, int phnum) { }
1735 static inline void bswap_shdr(struct elf_shdr *shdr, int shnum) { }
1736 static inline void bswap_sym(struct elf_sym *sym) { }
1737 #ifdef TARGET_MIPS
1738 static inline void bswap_mips_abiflags(Mips_elf_abiflags_v0 *abiflags) { }
1739 #endif
1740 #endif
1741 
1742 #ifdef USE_ELF_CORE_DUMP
1743 static int elf_core_dump(int, const CPUArchState *);
1744 #endif /* USE_ELF_CORE_DUMP */
1745 static void load_symbols(struct elfhdr *hdr, int fd, abi_ulong load_bias);
1746 
1747 /* Verify the portions of EHDR within E_IDENT for the target.
1748    This can be performed before bswapping the entire header.  */
1749 static bool elf_check_ident(struct elfhdr *ehdr)
1750 {
1751     return (ehdr->e_ident[EI_MAG0] == ELFMAG0
1752             && ehdr->e_ident[EI_MAG1] == ELFMAG1
1753             && ehdr->e_ident[EI_MAG2] == ELFMAG2
1754             && ehdr->e_ident[EI_MAG3] == ELFMAG3
1755             && ehdr->e_ident[EI_CLASS] == ELF_CLASS
1756             && ehdr->e_ident[EI_DATA] == ELF_DATA
1757             && ehdr->e_ident[EI_VERSION] == EV_CURRENT);
1758 }
1759 
1760 /* Verify the portions of EHDR outside of E_IDENT for the target.
1761    This has to wait until after bswapping the header.  */
1762 static bool elf_check_ehdr(struct elfhdr *ehdr)
1763 {
1764     return (elf_check_arch(ehdr->e_machine)
1765             && elf_check_abi(ehdr->e_flags)
1766             && ehdr->e_ehsize == sizeof(struct elfhdr)
1767             && ehdr->e_phentsize == sizeof(struct elf_phdr)
1768             && (ehdr->e_type == ET_EXEC || ehdr->e_type == ET_DYN));
1769 }
1770 
1771 /*
1772  * 'copy_elf_strings()' copies argument/envelope strings from user
1773  * memory to free pages in kernel mem. These are in a format ready
1774  * to be put directly into the top of new user memory.
1775  *
1776  */
1777 static abi_ulong copy_elf_strings(int argc, char **argv, char *scratch,
1778                                   abi_ulong p, abi_ulong stack_limit)
1779 {
1780     char *tmp;
1781     int len, i;
1782     abi_ulong top = p;
1783 
1784     if (!p) {
1785         return 0;       /* bullet-proofing */
1786     }
1787 
1788     if (STACK_GROWS_DOWN) {
1789         int offset = ((p - 1) % TARGET_PAGE_SIZE) + 1;
1790         for (i = argc - 1; i >= 0; --i) {
1791             tmp = argv[i];
1792             if (!tmp) {
1793                 fprintf(stderr, "VFS: argc is wrong");
1794                 exit(-1);
1795             }
1796             len = strlen(tmp) + 1;
1797             tmp += len;
1798 
1799             if (len > (p - stack_limit)) {
1800                 return 0;
1801             }
1802             while (len) {
1803                 int bytes_to_copy = (len > offset) ? offset : len;
1804                 tmp -= bytes_to_copy;
1805                 p -= bytes_to_copy;
1806                 offset -= bytes_to_copy;
1807                 len -= bytes_to_copy;
1808 
1809                 memcpy_fromfs(scratch + offset, tmp, bytes_to_copy);
1810 
1811                 if (offset == 0) {
1812                     memcpy_to_target(p, scratch, top - p);
1813                     top = p;
1814                     offset = TARGET_PAGE_SIZE;
1815                 }
1816             }
1817         }
1818         if (p != top) {
1819             memcpy_to_target(p, scratch + offset, top - p);
1820         }
1821     } else {
1822         int remaining = TARGET_PAGE_SIZE - (p % TARGET_PAGE_SIZE);
1823         for (i = 0; i < argc; ++i) {
1824             tmp = argv[i];
1825             if (!tmp) {
1826                 fprintf(stderr, "VFS: argc is wrong");
1827                 exit(-1);
1828             }
1829             len = strlen(tmp) + 1;
1830             if (len > (stack_limit - p)) {
1831                 return 0;
1832             }
1833             while (len) {
1834                 int bytes_to_copy = (len > remaining) ? remaining : len;
1835 
1836                 memcpy_fromfs(scratch + (p - top), tmp, bytes_to_copy);
1837 
1838                 tmp += bytes_to_copy;
1839                 remaining -= bytes_to_copy;
1840                 p += bytes_to_copy;
1841                 len -= bytes_to_copy;
1842 
1843                 if (remaining == 0) {
1844                     memcpy_to_target(top, scratch, p - top);
1845                     top = p;
1846                     remaining = TARGET_PAGE_SIZE;
1847                 }
1848             }
1849         }
1850         if (p != top) {
1851             memcpy_to_target(top, scratch, p - top);
1852         }
1853     }
1854 
1855     return p;
1856 }
1857 
1858 /* Older linux kernels provide up to MAX_ARG_PAGES (default: 32) of
1859  * argument/environment space. Newer kernels (>2.6.33) allow more,
1860  * dependent on stack size, but guarantee at least 32 pages for
1861  * backwards compatibility.
1862  */
1863 #define STACK_LOWER_LIMIT (32 * TARGET_PAGE_SIZE)
1864 
1865 static abi_ulong setup_arg_pages(struct linux_binprm *bprm,
1866                                  struct image_info *info)
1867 {
1868     abi_ulong size, error, guard;
1869 
1870     size = guest_stack_size;
1871     if (size < STACK_LOWER_LIMIT) {
1872         size = STACK_LOWER_LIMIT;
1873     }
1874     guard = TARGET_PAGE_SIZE;
1875     if (guard < qemu_real_host_page_size) {
1876         guard = qemu_real_host_page_size;
1877     }
1878 
1879     error = target_mmap(0, size + guard, PROT_READ | PROT_WRITE,
1880                         MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
1881     if (error == -1) {
1882         perror("mmap stack");
1883         exit(-1);
1884     }
1885 
1886     /* We reserve one extra page at the top of the stack as guard.  */
1887     if (STACK_GROWS_DOWN) {
1888         target_mprotect(error, guard, PROT_NONE);
1889         info->stack_limit = error + guard;
1890         return info->stack_limit + size - sizeof(void *);
1891     } else {
1892         target_mprotect(error + size, guard, PROT_NONE);
1893         info->stack_limit = error + size;
1894         return error;
1895     }
1896 }
1897 
1898 /* Map and zero the bss.  We need to explicitly zero any fractional pages
1899    after the data section (i.e. bss).  */
1900 static void zero_bss(abi_ulong elf_bss, abi_ulong last_bss, int prot)
1901 {
1902     uintptr_t host_start, host_map_start, host_end;
1903 
1904     last_bss = TARGET_PAGE_ALIGN(last_bss);
1905 
1906     /* ??? There is confusion between qemu_real_host_page_size and
1907        qemu_host_page_size here and elsewhere in target_mmap, which
1908        may lead to the end of the data section mapping from the file
1909        not being mapped.  At least there was an explicit test and
1910        comment for that here, suggesting that "the file size must
1911        be known".  The comment probably pre-dates the introduction
1912        of the fstat system call in target_mmap which does in fact
1913        find out the size.  What isn't clear is if the workaround
1914        here is still actually needed.  For now, continue with it,
1915        but merge it with the "normal" mmap that would allocate the bss.  */
1916 
1917     host_start = (uintptr_t) g2h_untagged(elf_bss);
1918     host_end = (uintptr_t) g2h_untagged(last_bss);
1919     host_map_start = REAL_HOST_PAGE_ALIGN(host_start);
1920 
1921     if (host_map_start < host_end) {
1922         void *p = mmap((void *)host_map_start, host_end - host_map_start,
1923                        prot, MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
1924         if (p == MAP_FAILED) {
1925             perror("cannot mmap brk");
1926             exit(-1);
1927         }
1928     }
1929 
1930     /* Ensure that the bss page(s) are valid */
1931     if ((page_get_flags(last_bss-1) & prot) != prot) {
1932         page_set_flags(elf_bss & TARGET_PAGE_MASK, last_bss, prot | PAGE_VALID);
1933     }
1934 
1935     if (host_start < host_map_start) {
1936         memset((void *)host_start, 0, host_map_start - host_start);
1937     }
1938 }
1939 
1940 #ifdef TARGET_ARM
1941 static int elf_is_fdpic(struct elfhdr *exec)
1942 {
1943     return exec->e_ident[EI_OSABI] == ELFOSABI_ARM_FDPIC;
1944 }
1945 #else
1946 /* Default implementation, always false.  */
1947 static int elf_is_fdpic(struct elfhdr *exec)
1948 {
1949     return 0;
1950 }
1951 #endif
1952 
1953 static abi_ulong loader_build_fdpic_loadmap(struct image_info *info, abi_ulong sp)
1954 {
1955     uint16_t n;
1956     struct elf32_fdpic_loadseg *loadsegs = info->loadsegs;
1957 
1958     /* elf32_fdpic_loadseg */
1959     n = info->nsegs;
1960     while (n--) {
1961         sp -= 12;
1962         put_user_u32(loadsegs[n].addr, sp+0);
1963         put_user_u32(loadsegs[n].p_vaddr, sp+4);
1964         put_user_u32(loadsegs[n].p_memsz, sp+8);
1965     }
1966 
1967     /* elf32_fdpic_loadmap */
1968     sp -= 4;
1969     put_user_u16(0, sp+0); /* version */
1970     put_user_u16(info->nsegs, sp+2); /* nsegs */
1971 
1972     info->personality = PER_LINUX_FDPIC;
1973     info->loadmap_addr = sp;
1974 
1975     return sp;
1976 }
1977 
1978 static abi_ulong create_elf_tables(abi_ulong p, int argc, int envc,
1979                                    struct elfhdr *exec,
1980                                    struct image_info *info,
1981                                    struct image_info *interp_info)
1982 {
1983     abi_ulong sp;
1984     abi_ulong u_argc, u_argv, u_envp, u_auxv;
1985     int size;
1986     int i;
1987     abi_ulong u_rand_bytes;
1988     uint8_t k_rand_bytes[16];
1989     abi_ulong u_platform;
1990     const char *k_platform;
1991     const int n = sizeof(elf_addr_t);
1992 
1993     sp = p;
1994 
1995     /* Needs to be before we load the env/argc/... */
1996     if (elf_is_fdpic(exec)) {
1997         /* Need 4 byte alignment for these structs */
1998         sp &= ~3;
1999         sp = loader_build_fdpic_loadmap(info, sp);
2000         info->other_info = interp_info;
2001         if (interp_info) {
2002             interp_info->other_info = info;
2003             sp = loader_build_fdpic_loadmap(interp_info, sp);
2004             info->interpreter_loadmap_addr = interp_info->loadmap_addr;
2005             info->interpreter_pt_dynamic_addr = interp_info->pt_dynamic_addr;
2006         } else {
2007             info->interpreter_loadmap_addr = 0;
2008             info->interpreter_pt_dynamic_addr = 0;
2009         }
2010     }
2011 
2012     u_platform = 0;
2013     k_platform = ELF_PLATFORM;
2014     if (k_platform) {
2015         size_t len = strlen(k_platform) + 1;
2016         if (STACK_GROWS_DOWN) {
2017             sp -= (len + n - 1) & ~(n - 1);
2018             u_platform = sp;
2019             /* FIXME - check return value of memcpy_to_target() for failure */
2020             memcpy_to_target(sp, k_platform, len);
2021         } else {
2022             memcpy_to_target(sp, k_platform, len);
2023             u_platform = sp;
2024             sp += len + 1;
2025         }
2026     }
2027 
2028     /* Provide 16 byte alignment for the PRNG, and basic alignment for
2029      * the argv and envp pointers.
2030      */
2031     if (STACK_GROWS_DOWN) {
2032         sp = QEMU_ALIGN_DOWN(sp, 16);
2033     } else {
2034         sp = QEMU_ALIGN_UP(sp, 16);
2035     }
2036 
2037     /*
2038      * Generate 16 random bytes for userspace PRNG seeding.
2039      */
2040     qemu_guest_getrandom_nofail(k_rand_bytes, sizeof(k_rand_bytes));
2041     if (STACK_GROWS_DOWN) {
2042         sp -= 16;
2043         u_rand_bytes = sp;
2044         /* FIXME - check return value of memcpy_to_target() for failure */
2045         memcpy_to_target(sp, k_rand_bytes, 16);
2046     } else {
2047         memcpy_to_target(sp, k_rand_bytes, 16);
2048         u_rand_bytes = sp;
2049         sp += 16;
2050     }
2051 
2052     size = (DLINFO_ITEMS + 1) * 2;
2053     if (k_platform)
2054         size += 2;
2055 #ifdef DLINFO_ARCH_ITEMS
2056     size += DLINFO_ARCH_ITEMS * 2;
2057 #endif
2058 #ifdef ELF_HWCAP2
2059     size += 2;
2060 #endif
2061     info->auxv_len = size * n;
2062 
2063     size += envc + argc + 2;
2064     size += 1;  /* argc itself */
2065     size *= n;
2066 
2067     /* Allocate space and finalize stack alignment for entry now.  */
2068     if (STACK_GROWS_DOWN) {
2069         u_argc = QEMU_ALIGN_DOWN(sp - size, STACK_ALIGNMENT);
2070         sp = u_argc;
2071     } else {
2072         u_argc = sp;
2073         sp = QEMU_ALIGN_UP(sp + size, STACK_ALIGNMENT);
2074     }
2075 
2076     u_argv = u_argc + n;
2077     u_envp = u_argv + (argc + 1) * n;
2078     u_auxv = u_envp + (envc + 1) * n;
2079     info->saved_auxv = u_auxv;
2080     info->arg_start = u_argv;
2081     info->arg_end = u_argv + argc * n;
2082 
2083     /* This is correct because Linux defines
2084      * elf_addr_t as Elf32_Off / Elf64_Off
2085      */
2086 #define NEW_AUX_ENT(id, val) do {               \
2087         put_user_ual(id, u_auxv);  u_auxv += n; \
2088         put_user_ual(val, u_auxv); u_auxv += n; \
2089     } while(0)
2090 
2091 #ifdef ARCH_DLINFO
2092     /*
2093      * ARCH_DLINFO must come first so platform specific code can enforce
2094      * special alignment requirements on the AUXV if necessary (eg. PPC).
2095      */
2096     ARCH_DLINFO;
2097 #endif
2098     /* There must be exactly DLINFO_ITEMS entries here, or the assert
2099      * on info->auxv_len will trigger.
2100      */
2101     NEW_AUX_ENT(AT_PHDR, (abi_ulong)(info->load_addr + exec->e_phoff));
2102     NEW_AUX_ENT(AT_PHENT, (abi_ulong)(sizeof (struct elf_phdr)));
2103     NEW_AUX_ENT(AT_PHNUM, (abi_ulong)(exec->e_phnum));
2104     if ((info->alignment & ~qemu_host_page_mask) != 0) {
2105         /* Target doesn't support host page size alignment */
2106         NEW_AUX_ENT(AT_PAGESZ, (abi_ulong)(TARGET_PAGE_SIZE));
2107     } else {
2108         NEW_AUX_ENT(AT_PAGESZ, (abi_ulong)(MAX(TARGET_PAGE_SIZE,
2109                                                qemu_host_page_size)));
2110     }
2111     NEW_AUX_ENT(AT_BASE, (abi_ulong)(interp_info ? interp_info->load_addr : 0));
2112     NEW_AUX_ENT(AT_FLAGS, (abi_ulong)0);
2113     NEW_AUX_ENT(AT_ENTRY, info->entry);
2114     NEW_AUX_ENT(AT_UID, (abi_ulong) getuid());
2115     NEW_AUX_ENT(AT_EUID, (abi_ulong) geteuid());
2116     NEW_AUX_ENT(AT_GID, (abi_ulong) getgid());
2117     NEW_AUX_ENT(AT_EGID, (abi_ulong) getegid());
2118     NEW_AUX_ENT(AT_HWCAP, (abi_ulong) ELF_HWCAP);
2119     NEW_AUX_ENT(AT_CLKTCK, (abi_ulong) sysconf(_SC_CLK_TCK));
2120     NEW_AUX_ENT(AT_RANDOM, (abi_ulong) u_rand_bytes);
2121     NEW_AUX_ENT(AT_SECURE, (abi_ulong) qemu_getauxval(AT_SECURE));
2122     NEW_AUX_ENT(AT_EXECFN, info->file_string);
2123 
2124 #ifdef ELF_HWCAP2
2125     NEW_AUX_ENT(AT_HWCAP2, (abi_ulong) ELF_HWCAP2);
2126 #endif
2127 
2128     if (u_platform) {
2129         NEW_AUX_ENT(AT_PLATFORM, u_platform);
2130     }
2131     NEW_AUX_ENT (AT_NULL, 0);
2132 #undef NEW_AUX_ENT
2133 
2134     /* Check that our initial calculation of the auxv length matches how much
2135      * we actually put into it.
2136      */
2137     assert(info->auxv_len == u_auxv - info->saved_auxv);
2138 
2139     put_user_ual(argc, u_argc);
2140 
2141     p = info->arg_strings;
2142     for (i = 0; i < argc; ++i) {
2143         put_user_ual(p, u_argv);
2144         u_argv += n;
2145         p += target_strlen(p) + 1;
2146     }
2147     put_user_ual(0, u_argv);
2148 
2149     p = info->env_strings;
2150     for (i = 0; i < envc; ++i) {
2151         put_user_ual(p, u_envp);
2152         u_envp += n;
2153         p += target_strlen(p) + 1;
2154     }
2155     put_user_ual(0, u_envp);
2156 
2157     return sp;
2158 }
2159 
2160 #ifndef ARM_COMMPAGE
2161 #define ARM_COMMPAGE 0
2162 #define init_guest_commpage() true
2163 #endif
2164 
2165 static void pgb_fail_in_use(const char *image_name)
2166 {
2167     error_report("%s: requires virtual address space that is in use "
2168                  "(omit the -B option or choose a different value)",
2169                  image_name);
2170     exit(EXIT_FAILURE);
2171 }
2172 
2173 static void pgb_have_guest_base(const char *image_name, abi_ulong guest_loaddr,
2174                                 abi_ulong guest_hiaddr, long align)
2175 {
2176     const int flags = MAP_ANONYMOUS | MAP_PRIVATE | MAP_NORESERVE;
2177     void *addr, *test;
2178 
2179     if (!QEMU_IS_ALIGNED(guest_base, align)) {
2180         fprintf(stderr, "Requested guest base %p does not satisfy "
2181                 "host minimum alignment (0x%lx)\n",
2182                 (void *)guest_base, align);
2183         exit(EXIT_FAILURE);
2184     }
2185 
2186     /* Sanity check the guest binary. */
2187     if (reserved_va) {
2188         if (guest_hiaddr > reserved_va) {
2189             error_report("%s: requires more than reserved virtual "
2190                          "address space (0x%" PRIx64 " > 0x%lx)",
2191                          image_name, (uint64_t)guest_hiaddr, reserved_va);
2192             exit(EXIT_FAILURE);
2193         }
2194     } else {
2195 #if HOST_LONG_BITS < TARGET_ABI_BITS
2196         if ((guest_hiaddr - guest_base) > ~(uintptr_t)0) {
2197             error_report("%s: requires more virtual address space "
2198                          "than the host can provide (0x%" PRIx64 ")",
2199                          image_name, (uint64_t)guest_hiaddr - guest_base);
2200             exit(EXIT_FAILURE);
2201         }
2202 #endif
2203     }
2204 
2205     /*
2206      * Expand the allocation to the entire reserved_va.
2207      * Exclude the mmap_min_addr hole.
2208      */
2209     if (reserved_va) {
2210         guest_loaddr = (guest_base >= mmap_min_addr ? 0
2211                         : mmap_min_addr - guest_base);
2212         guest_hiaddr = reserved_va;
2213     }
2214 
2215     /* Reserve the address space for the binary, or reserved_va. */
2216     test = g2h_untagged(guest_loaddr);
2217     addr = mmap(test, guest_hiaddr - guest_loaddr, PROT_NONE, flags, -1, 0);
2218     if (test != addr) {
2219         pgb_fail_in_use(image_name);
2220     }
2221 }
2222 
2223 /**
2224  * pgd_find_hole_fallback: potential mmap address
2225  * @guest_size: size of available space
2226  * @brk: location of break
2227  * @align: memory alignment
2228  *
2229  * This is a fallback method for finding a hole in the host address
2230  * space if we don't have the benefit of being able to access
2231  * /proc/self/map. It can potentially take a very long time as we can
2232  * only dumbly iterate up the host address space seeing if the
2233  * allocation would work.
2234  */
2235 static uintptr_t pgd_find_hole_fallback(uintptr_t guest_size, uintptr_t brk,
2236                                         long align, uintptr_t offset)
2237 {
2238     uintptr_t base;
2239 
2240     /* Start (aligned) at the bottom and work our way up */
2241     base = ROUND_UP(mmap_min_addr, align);
2242 
2243     while (true) {
2244         uintptr_t align_start, end;
2245         align_start = ROUND_UP(base, align);
2246         end = align_start + guest_size + offset;
2247 
2248         /* if brk is anywhere in the range give ourselves some room to grow. */
2249         if (align_start <= brk && brk < end) {
2250             base = brk + (16 * MiB);
2251             continue;
2252         } else if (align_start + guest_size < align_start) {
2253             /* we have run out of space */
2254             return -1;
2255         } else {
2256             int flags = MAP_ANONYMOUS | MAP_PRIVATE | MAP_NORESERVE |
2257                 MAP_FIXED_NOREPLACE;
2258             void * mmap_start = mmap((void *) align_start, guest_size,
2259                                      PROT_NONE, flags, -1, 0);
2260             if (mmap_start != MAP_FAILED) {
2261                 munmap(mmap_start, guest_size);
2262                 if (mmap_start == (void *) align_start) {
2263                     return (uintptr_t) mmap_start + offset;
2264                 }
2265             }
2266             base += qemu_host_page_size;
2267         }
2268     }
2269 }
2270 
2271 /* Return value for guest_base, or -1 if no hole found. */
2272 static uintptr_t pgb_find_hole(uintptr_t guest_loaddr, uintptr_t guest_size,
2273                                long align, uintptr_t offset)
2274 {
2275     GSList *maps, *iter;
2276     uintptr_t this_start, this_end, next_start, brk;
2277     intptr_t ret = -1;
2278 
2279     assert(QEMU_IS_ALIGNED(guest_loaddr, align));
2280 
2281     maps = read_self_maps();
2282 
2283     /* Read brk after we've read the maps, which will malloc. */
2284     brk = (uintptr_t)sbrk(0);
2285 
2286     if (!maps) {
2287         ret = pgd_find_hole_fallback(guest_size, brk, align, offset);
2288         return ret == -1 ? -1 : ret - guest_loaddr;
2289     }
2290 
2291     /* The first hole is before the first map entry. */
2292     this_start = mmap_min_addr;
2293 
2294     for (iter = maps; iter;
2295          this_start = next_start, iter = g_slist_next(iter)) {
2296         uintptr_t align_start, hole_size;
2297 
2298         this_end = ((MapInfo *)iter->data)->start;
2299         next_start = ((MapInfo *)iter->data)->end;
2300         align_start = ROUND_UP(this_start + offset, align);
2301 
2302         /* Skip holes that are too small. */
2303         if (align_start >= this_end) {
2304             continue;
2305         }
2306         hole_size = this_end - align_start;
2307         if (hole_size < guest_size) {
2308             continue;
2309         }
2310 
2311         /* If this hole contains brk, give ourselves some room to grow. */
2312         if (this_start <= brk && brk < this_end) {
2313             hole_size -= guest_size;
2314             if (sizeof(uintptr_t) == 8 && hole_size >= 1 * GiB) {
2315                 align_start += 1 * GiB;
2316             } else if (hole_size >= 16 * MiB) {
2317                 align_start += 16 * MiB;
2318             } else {
2319                 align_start = (this_end - guest_size) & -align;
2320                 if (align_start < this_start) {
2321                     continue;
2322                 }
2323             }
2324         }
2325 
2326         /* Record the lowest successful match. */
2327         if (ret < 0) {
2328             ret = align_start - guest_loaddr;
2329         }
2330         /* If this hole contains the identity map, select it. */
2331         if (align_start <= guest_loaddr &&
2332             guest_loaddr + guest_size <= this_end) {
2333             ret = 0;
2334         }
2335         /* If this hole ends above the identity map, stop looking. */
2336         if (this_end >= guest_loaddr) {
2337             break;
2338         }
2339     }
2340     free_self_maps(maps);
2341 
2342     return ret;
2343 }
2344 
2345 static void pgb_static(const char *image_name, abi_ulong orig_loaddr,
2346                        abi_ulong orig_hiaddr, long align)
2347 {
2348     uintptr_t loaddr = orig_loaddr;
2349     uintptr_t hiaddr = orig_hiaddr;
2350     uintptr_t offset = 0;
2351     uintptr_t addr;
2352 
2353     if (hiaddr != orig_hiaddr) {
2354         error_report("%s: requires virtual address space that the "
2355                      "host cannot provide (0x%" PRIx64 ")",
2356                      image_name, (uint64_t)orig_hiaddr);
2357         exit(EXIT_FAILURE);
2358     }
2359 
2360     loaddr &= -align;
2361     if (ARM_COMMPAGE) {
2362         /*
2363          * Extend the allocation to include the commpage.
2364          * For a 64-bit host, this is just 4GiB; for a 32-bit host we
2365          * need to ensure there is space bellow the guest_base so we
2366          * can map the commpage in the place needed when the address
2367          * arithmetic wraps around.
2368          */
2369         if (sizeof(uintptr_t) == 8 || loaddr >= 0x80000000u) {
2370             hiaddr = (uintptr_t) 4 << 30;
2371         } else {
2372             offset = -(ARM_COMMPAGE & -align);
2373         }
2374     }
2375 
2376     addr = pgb_find_hole(loaddr, hiaddr - loaddr, align, offset);
2377     if (addr == -1) {
2378         /*
2379          * If ARM_COMMPAGE, there *might* be a non-consecutive allocation
2380          * that can satisfy both.  But as the normal arm32 link base address
2381          * is ~32k, and we extend down to include the commpage, making the
2382          * overhead only ~96k, this is unlikely.
2383          */
2384         error_report("%s: Unable to allocate %#zx bytes of "
2385                      "virtual address space", image_name,
2386                      (size_t)(hiaddr - loaddr));
2387         exit(EXIT_FAILURE);
2388     }
2389 
2390     guest_base = addr;
2391 }
2392 
2393 static void pgb_dynamic(const char *image_name, long align)
2394 {
2395     /*
2396      * The executable is dynamic and does not require a fixed address.
2397      * All we need is a commpage that satisfies align.
2398      * If we do not need a commpage, leave guest_base == 0.
2399      */
2400     if (ARM_COMMPAGE) {
2401         uintptr_t addr, commpage;
2402 
2403         /* 64-bit hosts should have used reserved_va. */
2404         assert(sizeof(uintptr_t) == 4);
2405 
2406         /*
2407          * By putting the commpage at the first hole, that puts guest_base
2408          * just above that, and maximises the positive guest addresses.
2409          */
2410         commpage = ARM_COMMPAGE & -align;
2411         addr = pgb_find_hole(commpage, -commpage, align, 0);
2412         assert(addr != -1);
2413         guest_base = addr;
2414     }
2415 }
2416 
2417 static void pgb_reserved_va(const char *image_name, abi_ulong guest_loaddr,
2418                             abi_ulong guest_hiaddr, long align)
2419 {
2420     int flags = MAP_ANONYMOUS | MAP_PRIVATE | MAP_NORESERVE;
2421     void *addr, *test;
2422 
2423     if (guest_hiaddr > reserved_va) {
2424         error_report("%s: requires more than reserved virtual "
2425                      "address space (0x%" PRIx64 " > 0x%lx)",
2426                      image_name, (uint64_t)guest_hiaddr, reserved_va);
2427         exit(EXIT_FAILURE);
2428     }
2429 
2430     /* Widen the "image" to the entire reserved address space. */
2431     pgb_static(image_name, 0, reserved_va, align);
2432 
2433     /* osdep.h defines this as 0 if it's missing */
2434     flags |= MAP_FIXED_NOREPLACE;
2435 
2436     /* Reserve the memory on the host. */
2437     assert(guest_base != 0);
2438     test = g2h_untagged(0);
2439     addr = mmap(test, reserved_va, PROT_NONE, flags, -1, 0);
2440     if (addr == MAP_FAILED || addr != test) {
2441         error_report("Unable to reserve 0x%lx bytes of virtual address "
2442                      "space at %p (%s) for use as guest address space (check your"
2443                      "virtual memory ulimit setting, min_mmap_addr or reserve less "
2444                      "using -R option)", reserved_va, test, strerror(errno));
2445         exit(EXIT_FAILURE);
2446     }
2447 }
2448 
2449 void probe_guest_base(const char *image_name, abi_ulong guest_loaddr,
2450                       abi_ulong guest_hiaddr)
2451 {
2452     /* In order to use host shmat, we must be able to honor SHMLBA.  */
2453     uintptr_t align = MAX(SHMLBA, qemu_host_page_size);
2454 
2455     if (have_guest_base) {
2456         pgb_have_guest_base(image_name, guest_loaddr, guest_hiaddr, align);
2457     } else if (reserved_va) {
2458         pgb_reserved_va(image_name, guest_loaddr, guest_hiaddr, align);
2459     } else if (guest_loaddr) {
2460         pgb_static(image_name, guest_loaddr, guest_hiaddr, align);
2461     } else {
2462         pgb_dynamic(image_name, align);
2463     }
2464 
2465     /* Reserve and initialize the commpage. */
2466     if (!init_guest_commpage()) {
2467         /*
2468          * With have_guest_base, the user has selected the address and
2469          * we are trying to work with that.  Otherwise, we have selected
2470          * free space and init_guest_commpage must succeeded.
2471          */
2472         assert(have_guest_base);
2473         pgb_fail_in_use(image_name);
2474     }
2475 
2476     assert(QEMU_IS_ALIGNED(guest_base, align));
2477     qemu_log_mask(CPU_LOG_PAGE, "Locating guest address space "
2478                   "@ 0x%" PRIx64 "\n", (uint64_t)guest_base);
2479 }
2480 
2481 enum {
2482     /* The string "GNU\0" as a magic number. */
2483     GNU0_MAGIC = const_le32('G' | 'N' << 8 | 'U' << 16),
2484     NOTE_DATA_SZ = 1 * KiB,
2485     NOTE_NAME_SZ = 4,
2486     ELF_GNU_PROPERTY_ALIGN = ELF_CLASS == ELFCLASS32 ? 4 : 8,
2487 };
2488 
2489 /*
2490  * Process a single gnu_property entry.
2491  * Return false for error.
2492  */
2493 static bool parse_elf_property(const uint32_t *data, int *off, int datasz,
2494                                struct image_info *info, bool have_prev_type,
2495                                uint32_t *prev_type, Error **errp)
2496 {
2497     uint32_t pr_type, pr_datasz, step;
2498 
2499     if (*off > datasz || !QEMU_IS_ALIGNED(*off, ELF_GNU_PROPERTY_ALIGN)) {
2500         goto error_data;
2501     }
2502     datasz -= *off;
2503     data += *off / sizeof(uint32_t);
2504 
2505     if (datasz < 2 * sizeof(uint32_t)) {
2506         goto error_data;
2507     }
2508     pr_type = data[0];
2509     pr_datasz = data[1];
2510     data += 2;
2511     datasz -= 2 * sizeof(uint32_t);
2512     step = ROUND_UP(pr_datasz, ELF_GNU_PROPERTY_ALIGN);
2513     if (step > datasz) {
2514         goto error_data;
2515     }
2516 
2517     /* Properties are supposed to be unique and sorted on pr_type. */
2518     if (have_prev_type && pr_type <= *prev_type) {
2519         if (pr_type == *prev_type) {
2520             error_setg(errp, "Duplicate property in PT_GNU_PROPERTY");
2521         } else {
2522             error_setg(errp, "Unsorted property in PT_GNU_PROPERTY");
2523         }
2524         return false;
2525     }
2526     *prev_type = pr_type;
2527 
2528     if (!arch_parse_elf_property(pr_type, pr_datasz, data, info, errp)) {
2529         return false;
2530     }
2531 
2532     *off += 2 * sizeof(uint32_t) + step;
2533     return true;
2534 
2535  error_data:
2536     error_setg(errp, "Ill-formed property in PT_GNU_PROPERTY");
2537     return false;
2538 }
2539 
2540 /* Process NT_GNU_PROPERTY_TYPE_0. */
2541 static bool parse_elf_properties(int image_fd,
2542                                  struct image_info *info,
2543                                  const struct elf_phdr *phdr,
2544                                  char bprm_buf[BPRM_BUF_SIZE],
2545                                  Error **errp)
2546 {
2547     union {
2548         struct elf_note nhdr;
2549         uint32_t data[NOTE_DATA_SZ / sizeof(uint32_t)];
2550     } note;
2551 
2552     int n, off, datasz;
2553     bool have_prev_type;
2554     uint32_t prev_type;
2555 
2556     /* Unless the arch requires properties, ignore them. */
2557     if (!ARCH_USE_GNU_PROPERTY) {
2558         return true;
2559     }
2560 
2561     /* If the properties are crazy large, that's too bad. */
2562     n = phdr->p_filesz;
2563     if (n > sizeof(note)) {
2564         error_setg(errp, "PT_GNU_PROPERTY too large");
2565         return false;
2566     }
2567     if (n < sizeof(note.nhdr)) {
2568         error_setg(errp, "PT_GNU_PROPERTY too small");
2569         return false;
2570     }
2571 
2572     if (phdr->p_offset + n <= BPRM_BUF_SIZE) {
2573         memcpy(&note, bprm_buf + phdr->p_offset, n);
2574     } else {
2575         ssize_t len = pread(image_fd, &note, n, phdr->p_offset);
2576         if (len != n) {
2577             error_setg_errno(errp, errno, "Error reading file header");
2578             return false;
2579         }
2580     }
2581 
2582     /*
2583      * The contents of a valid PT_GNU_PROPERTY is a sequence
2584      * of uint32_t -- swap them all now.
2585      */
2586 #ifdef BSWAP_NEEDED
2587     for (int i = 0; i < n / 4; i++) {
2588         bswap32s(note.data + i);
2589     }
2590 #endif
2591 
2592     /*
2593      * Note that nhdr is 3 words, and that the "name" described by namesz
2594      * immediately follows nhdr and is thus at the 4th word.  Further, all
2595      * of the inputs to the kernel's round_up are multiples of 4.
2596      */
2597     if (note.nhdr.n_type != NT_GNU_PROPERTY_TYPE_0 ||
2598         note.nhdr.n_namesz != NOTE_NAME_SZ ||
2599         note.data[3] != GNU0_MAGIC) {
2600         error_setg(errp, "Invalid note in PT_GNU_PROPERTY");
2601         return false;
2602     }
2603     off = sizeof(note.nhdr) + NOTE_NAME_SZ;
2604 
2605     datasz = note.nhdr.n_descsz + off;
2606     if (datasz > n) {
2607         error_setg(errp, "Invalid note size in PT_GNU_PROPERTY");
2608         return false;
2609     }
2610 
2611     have_prev_type = false;
2612     prev_type = 0;
2613     while (1) {
2614         if (off == datasz) {
2615             return true;  /* end, exit ok */
2616         }
2617         if (!parse_elf_property(note.data, &off, datasz, info,
2618                                 have_prev_type, &prev_type, errp)) {
2619             return false;
2620         }
2621         have_prev_type = true;
2622     }
2623 }
2624 
2625 /* Load an ELF image into the address space.
2626 
2627    IMAGE_NAME is the filename of the image, to use in error messages.
2628    IMAGE_FD is the open file descriptor for the image.
2629 
2630    BPRM_BUF is a copy of the beginning of the file; this of course
2631    contains the elf file header at offset 0.  It is assumed that this
2632    buffer is sufficiently aligned to present no problems to the host
2633    in accessing data at aligned offsets within the buffer.
2634 
2635    On return: INFO values will be filled in, as necessary or available.  */
2636 
2637 static void load_elf_image(const char *image_name, int image_fd,
2638                            struct image_info *info, char **pinterp_name,
2639                            char bprm_buf[BPRM_BUF_SIZE])
2640 {
2641     struct elfhdr *ehdr = (struct elfhdr *)bprm_buf;
2642     struct elf_phdr *phdr;
2643     abi_ulong load_addr, load_bias, loaddr, hiaddr, error;
2644     int i, retval, prot_exec;
2645     Error *err = NULL;
2646 
2647     /* First of all, some simple consistency checks */
2648     if (!elf_check_ident(ehdr)) {
2649         error_setg(&err, "Invalid ELF image for this architecture");
2650         goto exit_errmsg;
2651     }
2652     bswap_ehdr(ehdr);
2653     if (!elf_check_ehdr(ehdr)) {
2654         error_setg(&err, "Invalid ELF image for this architecture");
2655         goto exit_errmsg;
2656     }
2657 
2658     i = ehdr->e_phnum * sizeof(struct elf_phdr);
2659     if (ehdr->e_phoff + i <= BPRM_BUF_SIZE) {
2660         phdr = (struct elf_phdr *)(bprm_buf + ehdr->e_phoff);
2661     } else {
2662         phdr = (struct elf_phdr *) alloca(i);
2663         retval = pread(image_fd, phdr, i, ehdr->e_phoff);
2664         if (retval != i) {
2665             goto exit_read;
2666         }
2667     }
2668     bswap_phdr(phdr, ehdr->e_phnum);
2669 
2670     info->nsegs = 0;
2671     info->pt_dynamic_addr = 0;
2672 
2673     mmap_lock();
2674 
2675     /*
2676      * Find the maximum size of the image and allocate an appropriate
2677      * amount of memory to handle that.  Locate the interpreter, if any.
2678      */
2679     loaddr = -1, hiaddr = 0;
2680     info->alignment = 0;
2681     for (i = 0; i < ehdr->e_phnum; ++i) {
2682         struct elf_phdr *eppnt = phdr + i;
2683         if (eppnt->p_type == PT_LOAD) {
2684             abi_ulong a = eppnt->p_vaddr - eppnt->p_offset;
2685             if (a < loaddr) {
2686                 loaddr = a;
2687             }
2688             a = eppnt->p_vaddr + eppnt->p_memsz;
2689             if (a > hiaddr) {
2690                 hiaddr = a;
2691             }
2692             ++info->nsegs;
2693             info->alignment |= eppnt->p_align;
2694         } else if (eppnt->p_type == PT_INTERP && pinterp_name) {
2695             g_autofree char *interp_name = NULL;
2696 
2697             if (*pinterp_name) {
2698                 error_setg(&err, "Multiple PT_INTERP entries");
2699                 goto exit_errmsg;
2700             }
2701 
2702             interp_name = g_malloc(eppnt->p_filesz);
2703 
2704             if (eppnt->p_offset + eppnt->p_filesz <= BPRM_BUF_SIZE) {
2705                 memcpy(interp_name, bprm_buf + eppnt->p_offset,
2706                        eppnt->p_filesz);
2707             } else {
2708                 retval = pread(image_fd, interp_name, eppnt->p_filesz,
2709                                eppnt->p_offset);
2710                 if (retval != eppnt->p_filesz) {
2711                     goto exit_read;
2712                 }
2713             }
2714             if (interp_name[eppnt->p_filesz - 1] != 0) {
2715                 error_setg(&err, "Invalid PT_INTERP entry");
2716                 goto exit_errmsg;
2717             }
2718             *pinterp_name = g_steal_pointer(&interp_name);
2719         } else if (eppnt->p_type == PT_GNU_PROPERTY) {
2720             if (!parse_elf_properties(image_fd, info, eppnt, bprm_buf, &err)) {
2721                 goto exit_errmsg;
2722             }
2723         }
2724     }
2725 
2726     if (pinterp_name != NULL) {
2727         /*
2728          * This is the main executable.
2729          *
2730          * Reserve extra space for brk.
2731          * We hold on to this space while placing the interpreter
2732          * and the stack, lest they be placed immediately after
2733          * the data segment and block allocation from the brk.
2734          *
2735          * 16MB is chosen as "large enough" without being so large
2736          * as to allow the result to not fit with a 32-bit guest on
2737          * a 32-bit host.
2738          */
2739         info->reserve_brk = 16 * MiB;
2740         hiaddr += info->reserve_brk;
2741 
2742         if (ehdr->e_type == ET_EXEC) {
2743             /*
2744              * Make sure that the low address does not conflict with
2745              * MMAP_MIN_ADDR or the QEMU application itself.
2746              */
2747             probe_guest_base(image_name, loaddr, hiaddr);
2748         } else {
2749             /*
2750              * The binary is dynamic, but we still need to
2751              * select guest_base.  In this case we pass a size.
2752              */
2753             probe_guest_base(image_name, 0, hiaddr - loaddr);
2754         }
2755     }
2756 
2757     /*
2758      * Reserve address space for all of this.
2759      *
2760      * In the case of ET_EXEC, we supply MAP_FIXED so that we get
2761      * exactly the address range that is required.
2762      *
2763      * Otherwise this is ET_DYN, and we are searching for a location
2764      * that can hold the memory space required.  If the image is
2765      * pre-linked, LOADDR will be non-zero, and the kernel should
2766      * honor that address if it happens to be free.
2767      *
2768      * In both cases, we will overwrite pages in this range with mappings
2769      * from the executable.
2770      */
2771     load_addr = target_mmap(loaddr, hiaddr - loaddr, PROT_NONE,
2772                             MAP_PRIVATE | MAP_ANON | MAP_NORESERVE |
2773                             (ehdr->e_type == ET_EXEC ? MAP_FIXED : 0),
2774                             -1, 0);
2775     if (load_addr == -1) {
2776         goto exit_mmap;
2777     }
2778     load_bias = load_addr - loaddr;
2779 
2780     if (elf_is_fdpic(ehdr)) {
2781         struct elf32_fdpic_loadseg *loadsegs = info->loadsegs =
2782             g_malloc(sizeof(*loadsegs) * info->nsegs);
2783 
2784         for (i = 0; i < ehdr->e_phnum; ++i) {
2785             switch (phdr[i].p_type) {
2786             case PT_DYNAMIC:
2787                 info->pt_dynamic_addr = phdr[i].p_vaddr + load_bias;
2788                 break;
2789             case PT_LOAD:
2790                 loadsegs->addr = phdr[i].p_vaddr + load_bias;
2791                 loadsegs->p_vaddr = phdr[i].p_vaddr;
2792                 loadsegs->p_memsz = phdr[i].p_memsz;
2793                 ++loadsegs;
2794                 break;
2795             }
2796         }
2797     }
2798 
2799     info->load_bias = load_bias;
2800     info->code_offset = load_bias;
2801     info->data_offset = load_bias;
2802     info->load_addr = load_addr;
2803     info->entry = ehdr->e_entry + load_bias;
2804     info->start_code = -1;
2805     info->end_code = 0;
2806     info->start_data = -1;
2807     info->end_data = 0;
2808     info->brk = 0;
2809     info->elf_flags = ehdr->e_flags;
2810 
2811     prot_exec = PROT_EXEC;
2812 #ifdef TARGET_AARCH64
2813     /*
2814      * If the BTI feature is present, this indicates that the executable
2815      * pages of the startup binary should be mapped with PROT_BTI, so that
2816      * branch targets are enforced.
2817      *
2818      * The startup binary is either the interpreter or the static executable.
2819      * The interpreter is responsible for all pages of a dynamic executable.
2820      *
2821      * Elf notes are backward compatible to older cpus.
2822      * Do not enable BTI unless it is supported.
2823      */
2824     if ((info->note_flags & GNU_PROPERTY_AARCH64_FEATURE_1_BTI)
2825         && (pinterp_name == NULL || *pinterp_name == 0)
2826         && cpu_isar_feature(aa64_bti, ARM_CPU(thread_cpu))) {
2827         prot_exec |= TARGET_PROT_BTI;
2828     }
2829 #endif
2830 
2831     for (i = 0; i < ehdr->e_phnum; i++) {
2832         struct elf_phdr *eppnt = phdr + i;
2833         if (eppnt->p_type == PT_LOAD) {
2834             abi_ulong vaddr, vaddr_po, vaddr_ps, vaddr_ef, vaddr_em, vaddr_len;
2835             int elf_prot = 0;
2836 
2837             if (eppnt->p_flags & PF_R) {
2838                 elf_prot |= PROT_READ;
2839             }
2840             if (eppnt->p_flags & PF_W) {
2841                 elf_prot |= PROT_WRITE;
2842             }
2843             if (eppnt->p_flags & PF_X) {
2844                 elf_prot |= prot_exec;
2845             }
2846 
2847             vaddr = load_bias + eppnt->p_vaddr;
2848             vaddr_po = TARGET_ELF_PAGEOFFSET(vaddr);
2849             vaddr_ps = TARGET_ELF_PAGESTART(vaddr);
2850 
2851             vaddr_ef = vaddr + eppnt->p_filesz;
2852             vaddr_em = vaddr + eppnt->p_memsz;
2853 
2854             /*
2855              * Some segments may be completely empty, with a non-zero p_memsz
2856              * but no backing file segment.
2857              */
2858             if (eppnt->p_filesz != 0) {
2859                 vaddr_len = TARGET_ELF_PAGELENGTH(eppnt->p_filesz + vaddr_po);
2860                 error = target_mmap(vaddr_ps, vaddr_len, elf_prot,
2861                                     MAP_PRIVATE | MAP_FIXED,
2862                                     image_fd, eppnt->p_offset - vaddr_po);
2863 
2864                 if (error == -1) {
2865                     goto exit_mmap;
2866                 }
2867 
2868                 /*
2869                  * If the load segment requests extra zeros (e.g. bss), map it.
2870                  */
2871                 if (eppnt->p_filesz < eppnt->p_memsz) {
2872                     zero_bss(vaddr_ef, vaddr_em, elf_prot);
2873                 }
2874             } else if (eppnt->p_memsz != 0) {
2875                 vaddr_len = TARGET_ELF_PAGELENGTH(eppnt->p_memsz + vaddr_po);
2876                 error = target_mmap(vaddr_ps, vaddr_len, elf_prot,
2877                                     MAP_PRIVATE | MAP_FIXED | MAP_ANONYMOUS,
2878                                     -1, 0);
2879 
2880                 if (error == -1) {
2881                     goto exit_mmap;
2882                 }
2883             }
2884 
2885             /* Find the full program boundaries.  */
2886             if (elf_prot & PROT_EXEC) {
2887                 if (vaddr < info->start_code) {
2888                     info->start_code = vaddr;
2889                 }
2890                 if (vaddr_ef > info->end_code) {
2891                     info->end_code = vaddr_ef;
2892                 }
2893             }
2894             if (elf_prot & PROT_WRITE) {
2895                 if (vaddr < info->start_data) {
2896                     info->start_data = vaddr;
2897                 }
2898                 if (vaddr_ef > info->end_data) {
2899                     info->end_data = vaddr_ef;
2900                 }
2901             }
2902             if (vaddr_em > info->brk) {
2903                 info->brk = vaddr_em;
2904             }
2905 #ifdef TARGET_MIPS
2906         } else if (eppnt->p_type == PT_MIPS_ABIFLAGS) {
2907             Mips_elf_abiflags_v0 abiflags;
2908             if (eppnt->p_filesz < sizeof(Mips_elf_abiflags_v0)) {
2909                 error_setg(&err, "Invalid PT_MIPS_ABIFLAGS entry");
2910                 goto exit_errmsg;
2911             }
2912             if (eppnt->p_offset + eppnt->p_filesz <= BPRM_BUF_SIZE) {
2913                 memcpy(&abiflags, bprm_buf + eppnt->p_offset,
2914                        sizeof(Mips_elf_abiflags_v0));
2915             } else {
2916                 retval = pread(image_fd, &abiflags, sizeof(Mips_elf_abiflags_v0),
2917                                eppnt->p_offset);
2918                 if (retval != sizeof(Mips_elf_abiflags_v0)) {
2919                     goto exit_read;
2920                 }
2921             }
2922             bswap_mips_abiflags(&abiflags);
2923             info->fp_abi = abiflags.fp_abi;
2924 #endif
2925         }
2926     }
2927 
2928     if (info->end_data == 0) {
2929         info->start_data = info->end_code;
2930         info->end_data = info->end_code;
2931     }
2932 
2933     if (qemu_log_enabled()) {
2934         load_symbols(ehdr, image_fd, load_bias);
2935     }
2936 
2937     mmap_unlock();
2938 
2939     close(image_fd);
2940     return;
2941 
2942  exit_read:
2943     if (retval >= 0) {
2944         error_setg(&err, "Incomplete read of file header");
2945     } else {
2946         error_setg_errno(&err, errno, "Error reading file header");
2947     }
2948     goto exit_errmsg;
2949  exit_mmap:
2950     error_setg_errno(&err, errno, "Error mapping file");
2951     goto exit_errmsg;
2952  exit_errmsg:
2953     error_reportf_err(err, "%s: ", image_name);
2954     exit(-1);
2955 }
2956 
2957 static void load_elf_interp(const char *filename, struct image_info *info,
2958                             char bprm_buf[BPRM_BUF_SIZE])
2959 {
2960     int fd, retval;
2961     Error *err = NULL;
2962 
2963     fd = open(path(filename), O_RDONLY);
2964     if (fd < 0) {
2965         error_setg_file_open(&err, errno, filename);
2966         error_report_err(err);
2967         exit(-1);
2968     }
2969 
2970     retval = read(fd, bprm_buf, BPRM_BUF_SIZE);
2971     if (retval < 0) {
2972         error_setg_errno(&err, errno, "Error reading file header");
2973         error_reportf_err(err, "%s: ", filename);
2974         exit(-1);
2975     }
2976 
2977     if (retval < BPRM_BUF_SIZE) {
2978         memset(bprm_buf + retval, 0, BPRM_BUF_SIZE - retval);
2979     }
2980 
2981     load_elf_image(filename, fd, info, NULL, bprm_buf);
2982 }
2983 
2984 static int symfind(const void *s0, const void *s1)
2985 {
2986     target_ulong addr = *(target_ulong *)s0;
2987     struct elf_sym *sym = (struct elf_sym *)s1;
2988     int result = 0;
2989     if (addr < sym->st_value) {
2990         result = -1;
2991     } else if (addr >= sym->st_value + sym->st_size) {
2992         result = 1;
2993     }
2994     return result;
2995 }
2996 
2997 static const char *lookup_symbolxx(struct syminfo *s, target_ulong orig_addr)
2998 {
2999 #if ELF_CLASS == ELFCLASS32
3000     struct elf_sym *syms = s->disas_symtab.elf32;
3001 #else
3002     struct elf_sym *syms = s->disas_symtab.elf64;
3003 #endif
3004 
3005     // binary search
3006     struct elf_sym *sym;
3007 
3008     sym = bsearch(&orig_addr, syms, s->disas_num_syms, sizeof(*syms), symfind);
3009     if (sym != NULL) {
3010         return s->disas_strtab + sym->st_name;
3011     }
3012 
3013     return "";
3014 }
3015 
3016 /* FIXME: This should use elf_ops.h  */
3017 static int symcmp(const void *s0, const void *s1)
3018 {
3019     struct elf_sym *sym0 = (struct elf_sym *)s0;
3020     struct elf_sym *sym1 = (struct elf_sym *)s1;
3021     return (sym0->st_value < sym1->st_value)
3022         ? -1
3023         : ((sym0->st_value > sym1->st_value) ? 1 : 0);
3024 }
3025 
3026 /* Best attempt to load symbols from this ELF object. */
3027 static void load_symbols(struct elfhdr *hdr, int fd, abi_ulong load_bias)
3028 {
3029     int i, shnum, nsyms, sym_idx = 0, str_idx = 0;
3030     uint64_t segsz;
3031     struct elf_shdr *shdr;
3032     char *strings = NULL;
3033     struct syminfo *s = NULL;
3034     struct elf_sym *new_syms, *syms = NULL;
3035 
3036     shnum = hdr->e_shnum;
3037     i = shnum * sizeof(struct elf_shdr);
3038     shdr = (struct elf_shdr *)alloca(i);
3039     if (pread(fd, shdr, i, hdr->e_shoff) != i) {
3040         return;
3041     }
3042 
3043     bswap_shdr(shdr, shnum);
3044     for (i = 0; i < shnum; ++i) {
3045         if (shdr[i].sh_type == SHT_SYMTAB) {
3046             sym_idx = i;
3047             str_idx = shdr[i].sh_link;
3048             goto found;
3049         }
3050     }
3051 
3052     /* There will be no symbol table if the file was stripped.  */
3053     return;
3054 
3055  found:
3056     /* Now know where the strtab and symtab are.  Snarf them.  */
3057     s = g_try_new(struct syminfo, 1);
3058     if (!s) {
3059         goto give_up;
3060     }
3061 
3062     segsz = shdr[str_idx].sh_size;
3063     s->disas_strtab = strings = g_try_malloc(segsz);
3064     if (!strings ||
3065         pread(fd, strings, segsz, shdr[str_idx].sh_offset) != segsz) {
3066         goto give_up;
3067     }
3068 
3069     segsz = shdr[sym_idx].sh_size;
3070     syms = g_try_malloc(segsz);
3071     if (!syms || pread(fd, syms, segsz, shdr[sym_idx].sh_offset) != segsz) {
3072         goto give_up;
3073     }
3074 
3075     if (segsz / sizeof(struct elf_sym) > INT_MAX) {
3076         /* Implausibly large symbol table: give up rather than ploughing
3077          * on with the number of symbols calculation overflowing
3078          */
3079         goto give_up;
3080     }
3081     nsyms = segsz / sizeof(struct elf_sym);
3082     for (i = 0; i < nsyms; ) {
3083         bswap_sym(syms + i);
3084         /* Throw away entries which we do not need.  */
3085         if (syms[i].st_shndx == SHN_UNDEF
3086             || syms[i].st_shndx >= SHN_LORESERVE
3087             || ELF_ST_TYPE(syms[i].st_info) != STT_FUNC) {
3088             if (i < --nsyms) {
3089                 syms[i] = syms[nsyms];
3090             }
3091         } else {
3092 #if defined(TARGET_ARM) || defined (TARGET_MIPS)
3093             /* The bottom address bit marks a Thumb or MIPS16 symbol.  */
3094             syms[i].st_value &= ~(target_ulong)1;
3095 #endif
3096             syms[i].st_value += load_bias;
3097             i++;
3098         }
3099     }
3100 
3101     /* No "useful" symbol.  */
3102     if (nsyms == 0) {
3103         goto give_up;
3104     }
3105 
3106     /* Attempt to free the storage associated with the local symbols
3107        that we threw away.  Whether or not this has any effect on the
3108        memory allocation depends on the malloc implementation and how
3109        many symbols we managed to discard.  */
3110     new_syms = g_try_renew(struct elf_sym, syms, nsyms);
3111     if (new_syms == NULL) {
3112         goto give_up;
3113     }
3114     syms = new_syms;
3115 
3116     qsort(syms, nsyms, sizeof(*syms), symcmp);
3117 
3118     s->disas_num_syms = nsyms;
3119 #if ELF_CLASS == ELFCLASS32
3120     s->disas_symtab.elf32 = syms;
3121 #else
3122     s->disas_symtab.elf64 = syms;
3123 #endif
3124     s->lookup_symbol = lookup_symbolxx;
3125     s->next = syminfos;
3126     syminfos = s;
3127 
3128     return;
3129 
3130 give_up:
3131     g_free(s);
3132     g_free(strings);
3133     g_free(syms);
3134 }
3135 
3136 uint32_t get_elf_eflags(int fd)
3137 {
3138     struct elfhdr ehdr;
3139     off_t offset;
3140     int ret;
3141 
3142     /* Read ELF header */
3143     offset = lseek(fd, 0, SEEK_SET);
3144     if (offset == (off_t) -1) {
3145         return 0;
3146     }
3147     ret = read(fd, &ehdr, sizeof(ehdr));
3148     if (ret < sizeof(ehdr)) {
3149         return 0;
3150     }
3151     offset = lseek(fd, offset, SEEK_SET);
3152     if (offset == (off_t) -1) {
3153         return 0;
3154     }
3155 
3156     /* Check ELF signature */
3157     if (!elf_check_ident(&ehdr)) {
3158         return 0;
3159     }
3160 
3161     /* check header */
3162     bswap_ehdr(&ehdr);
3163     if (!elf_check_ehdr(&ehdr)) {
3164         return 0;
3165     }
3166 
3167     /* return architecture id */
3168     return ehdr.e_flags;
3169 }
3170 
3171 int load_elf_binary(struct linux_binprm *bprm, struct image_info *info)
3172 {
3173     struct image_info interp_info;
3174     struct elfhdr elf_ex;
3175     char *elf_interpreter = NULL;
3176     char *scratch;
3177 
3178     memset(&interp_info, 0, sizeof(interp_info));
3179 #ifdef TARGET_MIPS
3180     interp_info.fp_abi = MIPS_ABI_FP_UNKNOWN;
3181 #endif
3182 
3183     info->start_mmap = (abi_ulong)ELF_START_MMAP;
3184 
3185     load_elf_image(bprm->filename, bprm->fd, info,
3186                    &elf_interpreter, bprm->buf);
3187 
3188     /* ??? We need a copy of the elf header for passing to create_elf_tables.
3189        If we do nothing, we'll have overwritten this when we re-use bprm->buf
3190        when we load the interpreter.  */
3191     elf_ex = *(struct elfhdr *)bprm->buf;
3192 
3193     /* Do this so that we can load the interpreter, if need be.  We will
3194        change some of these later */
3195     bprm->p = setup_arg_pages(bprm, info);
3196 
3197     scratch = g_new0(char, TARGET_PAGE_SIZE);
3198     if (STACK_GROWS_DOWN) {
3199         bprm->p = copy_elf_strings(1, &bprm->filename, scratch,
3200                                    bprm->p, info->stack_limit);
3201         info->file_string = bprm->p;
3202         bprm->p = copy_elf_strings(bprm->envc, bprm->envp, scratch,
3203                                    bprm->p, info->stack_limit);
3204         info->env_strings = bprm->p;
3205         bprm->p = copy_elf_strings(bprm->argc, bprm->argv, scratch,
3206                                    bprm->p, info->stack_limit);
3207         info->arg_strings = bprm->p;
3208     } else {
3209         info->arg_strings = bprm->p;
3210         bprm->p = copy_elf_strings(bprm->argc, bprm->argv, scratch,
3211                                    bprm->p, info->stack_limit);
3212         info->env_strings = bprm->p;
3213         bprm->p = copy_elf_strings(bprm->envc, bprm->envp, scratch,
3214                                    bprm->p, info->stack_limit);
3215         info->file_string = bprm->p;
3216         bprm->p = copy_elf_strings(1, &bprm->filename, scratch,
3217                                    bprm->p, info->stack_limit);
3218     }
3219 
3220     g_free(scratch);
3221 
3222     if (!bprm->p) {
3223         fprintf(stderr, "%s: %s\n", bprm->filename, strerror(E2BIG));
3224         exit(-1);
3225     }
3226 
3227     if (elf_interpreter) {
3228         load_elf_interp(elf_interpreter, &interp_info, bprm->buf);
3229 
3230         /* If the program interpreter is one of these two, then assume
3231            an iBCS2 image.  Otherwise assume a native linux image.  */
3232 
3233         if (strcmp(elf_interpreter, "/usr/lib/libc.so.1") == 0
3234             || strcmp(elf_interpreter, "/usr/lib/ld.so.1") == 0) {
3235             info->personality = PER_SVR4;
3236 
3237             /* Why this, you ask???  Well SVr4 maps page 0 as read-only,
3238                and some applications "depend" upon this behavior.  Since
3239                we do not have the power to recompile these, we emulate
3240                the SVr4 behavior.  Sigh.  */
3241             target_mmap(0, qemu_host_page_size, PROT_READ | PROT_EXEC,
3242                         MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
3243         }
3244 #ifdef TARGET_MIPS
3245         info->interp_fp_abi = interp_info.fp_abi;
3246 #endif
3247     }
3248 
3249     bprm->p = create_elf_tables(bprm->p, bprm->argc, bprm->envc, &elf_ex,
3250                                 info, (elf_interpreter ? &interp_info : NULL));
3251     info->start_stack = bprm->p;
3252 
3253     /* If we have an interpreter, set that as the program's entry point.
3254        Copy the load_bias as well, to help PPC64 interpret the entry
3255        point as a function descriptor.  Do this after creating elf tables
3256        so that we copy the original program entry point into the AUXV.  */
3257     if (elf_interpreter) {
3258         info->load_bias = interp_info.load_bias;
3259         info->entry = interp_info.entry;
3260         g_free(elf_interpreter);
3261     }
3262 
3263 #ifdef USE_ELF_CORE_DUMP
3264     bprm->core_dump = &elf_core_dump;
3265 #endif
3266 
3267     /*
3268      * If we reserved extra space for brk, release it now.
3269      * The implementation of do_brk in syscalls.c expects to be able
3270      * to mmap pages in this space.
3271      */
3272     if (info->reserve_brk) {
3273         abi_ulong start_brk = HOST_PAGE_ALIGN(info->brk);
3274         abi_ulong end_brk = HOST_PAGE_ALIGN(info->brk + info->reserve_brk);
3275         target_munmap(start_brk, end_brk - start_brk);
3276     }
3277 
3278     return 0;
3279 }
3280 
3281 #ifdef USE_ELF_CORE_DUMP
3282 /*
3283  * Definitions to generate Intel SVR4-like core files.
3284  * These mostly have the same names as the SVR4 types with "target_elf_"
3285  * tacked on the front to prevent clashes with linux definitions,
3286  * and the typedef forms have been avoided.  This is mostly like
3287  * the SVR4 structure, but more Linuxy, with things that Linux does
3288  * not support and which gdb doesn't really use excluded.
3289  *
3290  * Fields we don't dump (their contents is zero) in linux-user qemu
3291  * are marked with XXX.
3292  *
3293  * Core dump code is copied from linux kernel (fs/binfmt_elf.c).
3294  *
3295  * Porting ELF coredump for target is (quite) simple process.  First you
3296  * define USE_ELF_CORE_DUMP in target ELF code (where init_thread() for
3297  * the target resides):
3298  *
3299  * #define USE_ELF_CORE_DUMP
3300  *
3301  * Next you define type of register set used for dumping.  ELF specification
3302  * says that it needs to be array of elf_greg_t that has size of ELF_NREG.
3303  *
3304  * typedef <target_regtype> target_elf_greg_t;
3305  * #define ELF_NREG <number of registers>
3306  * typedef taret_elf_greg_t target_elf_gregset_t[ELF_NREG];
3307  *
3308  * Last step is to implement target specific function that copies registers
3309  * from given cpu into just specified register set.  Prototype is:
3310  *
3311  * static void elf_core_copy_regs(taret_elf_gregset_t *regs,
3312  *                                const CPUArchState *env);
3313  *
3314  * Parameters:
3315  *     regs - copy register values into here (allocated and zeroed by caller)
3316  *     env - copy registers from here
3317  *
3318  * Example for ARM target is provided in this file.
3319  */
3320 
3321 /* An ELF note in memory */
3322 struct memelfnote {
3323     const char *name;
3324     size_t     namesz;
3325     size_t     namesz_rounded;
3326     int        type;
3327     size_t     datasz;
3328     size_t     datasz_rounded;
3329     void       *data;
3330     size_t     notesz;
3331 };
3332 
3333 struct target_elf_siginfo {
3334     abi_int    si_signo; /* signal number */
3335     abi_int    si_code;  /* extra code */
3336     abi_int    si_errno; /* errno */
3337 };
3338 
3339 struct target_elf_prstatus {
3340     struct target_elf_siginfo pr_info;      /* Info associated with signal */
3341     abi_short          pr_cursig;    /* Current signal */
3342     abi_ulong          pr_sigpend;   /* XXX */
3343     abi_ulong          pr_sighold;   /* XXX */
3344     target_pid_t       pr_pid;
3345     target_pid_t       pr_ppid;
3346     target_pid_t       pr_pgrp;
3347     target_pid_t       pr_sid;
3348     struct target_timeval pr_utime;  /* XXX User time */
3349     struct target_timeval pr_stime;  /* XXX System time */
3350     struct target_timeval pr_cutime; /* XXX Cumulative user time */
3351     struct target_timeval pr_cstime; /* XXX Cumulative system time */
3352     target_elf_gregset_t      pr_reg;       /* GP registers */
3353     abi_int            pr_fpvalid;   /* XXX */
3354 };
3355 
3356 #define ELF_PRARGSZ     (80) /* Number of chars for args */
3357 
3358 struct target_elf_prpsinfo {
3359     char         pr_state;       /* numeric process state */
3360     char         pr_sname;       /* char for pr_state */
3361     char         pr_zomb;        /* zombie */
3362     char         pr_nice;        /* nice val */
3363     abi_ulong    pr_flag;        /* flags */
3364     target_uid_t pr_uid;
3365     target_gid_t pr_gid;
3366     target_pid_t pr_pid, pr_ppid, pr_pgrp, pr_sid;
3367     /* Lots missing */
3368     char    pr_fname[16] QEMU_NONSTRING; /* filename of executable */
3369     char    pr_psargs[ELF_PRARGSZ]; /* initial part of arg list */
3370 };
3371 
3372 /* Here is the structure in which status of each thread is captured. */
3373 struct elf_thread_status {
3374     QTAILQ_ENTRY(elf_thread_status)  ets_link;
3375     struct target_elf_prstatus prstatus;   /* NT_PRSTATUS */
3376 #if 0
3377     elf_fpregset_t fpu;             /* NT_PRFPREG */
3378     struct task_struct *thread;
3379     elf_fpxregset_t xfpu;           /* ELF_CORE_XFPREG_TYPE */
3380 #endif
3381     struct memelfnote notes[1];
3382     int num_notes;
3383 };
3384 
3385 struct elf_note_info {
3386     struct memelfnote   *notes;
3387     struct target_elf_prstatus *prstatus;  /* NT_PRSTATUS */
3388     struct target_elf_prpsinfo *psinfo;    /* NT_PRPSINFO */
3389 
3390     QTAILQ_HEAD(, elf_thread_status) thread_list;
3391 #if 0
3392     /*
3393      * Current version of ELF coredump doesn't support
3394      * dumping fp regs etc.
3395      */
3396     elf_fpregset_t *fpu;
3397     elf_fpxregset_t *xfpu;
3398     int thread_status_size;
3399 #endif
3400     int notes_size;
3401     int numnote;
3402 };
3403 
3404 struct vm_area_struct {
3405     target_ulong   vma_start;  /* start vaddr of memory region */
3406     target_ulong   vma_end;    /* end vaddr of memory region */
3407     abi_ulong      vma_flags;  /* protection etc. flags for the region */
3408     QTAILQ_ENTRY(vm_area_struct) vma_link;
3409 };
3410 
3411 struct mm_struct {
3412     QTAILQ_HEAD(, vm_area_struct) mm_mmap;
3413     int mm_count;           /* number of mappings */
3414 };
3415 
3416 static struct mm_struct *vma_init(void);
3417 static void vma_delete(struct mm_struct *);
3418 static int vma_add_mapping(struct mm_struct *, target_ulong,
3419                            target_ulong, abi_ulong);
3420 static int vma_get_mapping_count(const struct mm_struct *);
3421 static struct vm_area_struct *vma_first(const struct mm_struct *);
3422 static struct vm_area_struct *vma_next(struct vm_area_struct *);
3423 static abi_ulong vma_dump_size(const struct vm_area_struct *);
3424 static int vma_walker(void *priv, target_ulong start, target_ulong end,
3425                       unsigned long flags);
3426 
3427 static void fill_elf_header(struct elfhdr *, int, uint16_t, uint32_t);
3428 static void fill_note(struct memelfnote *, const char *, int,
3429                       unsigned int, void *);
3430 static void fill_prstatus(struct target_elf_prstatus *, const TaskState *, int);
3431 static int fill_psinfo(struct target_elf_prpsinfo *, const TaskState *);
3432 static void fill_auxv_note(struct memelfnote *, const TaskState *);
3433 static void fill_elf_note_phdr(struct elf_phdr *, int, off_t);
3434 static size_t note_size(const struct memelfnote *);
3435 static void free_note_info(struct elf_note_info *);
3436 static int fill_note_info(struct elf_note_info *, long, const CPUArchState *);
3437 static void fill_thread_info(struct elf_note_info *, const CPUArchState *);
3438 
3439 static int dump_write(int, const void *, size_t);
3440 static int write_note(struct memelfnote *, int);
3441 static int write_note_info(struct elf_note_info *, int);
3442 
3443 #ifdef BSWAP_NEEDED
3444 static void bswap_prstatus(struct target_elf_prstatus *prstatus)
3445 {
3446     prstatus->pr_info.si_signo = tswap32(prstatus->pr_info.si_signo);
3447     prstatus->pr_info.si_code = tswap32(prstatus->pr_info.si_code);
3448     prstatus->pr_info.si_errno = tswap32(prstatus->pr_info.si_errno);
3449     prstatus->pr_cursig = tswap16(prstatus->pr_cursig);
3450     prstatus->pr_sigpend = tswapal(prstatus->pr_sigpend);
3451     prstatus->pr_sighold = tswapal(prstatus->pr_sighold);
3452     prstatus->pr_pid = tswap32(prstatus->pr_pid);
3453     prstatus->pr_ppid = tswap32(prstatus->pr_ppid);
3454     prstatus->pr_pgrp = tswap32(prstatus->pr_pgrp);
3455     prstatus->pr_sid = tswap32(prstatus->pr_sid);
3456     /* cpu times are not filled, so we skip them */
3457     /* regs should be in correct format already */
3458     prstatus->pr_fpvalid = tswap32(prstatus->pr_fpvalid);
3459 }
3460 
3461 static void bswap_psinfo(struct target_elf_prpsinfo *psinfo)
3462 {
3463     psinfo->pr_flag = tswapal(psinfo->pr_flag);
3464     psinfo->pr_uid = tswap16(psinfo->pr_uid);
3465     psinfo->pr_gid = tswap16(psinfo->pr_gid);
3466     psinfo->pr_pid = tswap32(psinfo->pr_pid);
3467     psinfo->pr_ppid = tswap32(psinfo->pr_ppid);
3468     psinfo->pr_pgrp = tswap32(psinfo->pr_pgrp);
3469     psinfo->pr_sid = tswap32(psinfo->pr_sid);
3470 }
3471 
3472 static void bswap_note(struct elf_note *en)
3473 {
3474     bswap32s(&en->n_namesz);
3475     bswap32s(&en->n_descsz);
3476     bswap32s(&en->n_type);
3477 }
3478 #else
3479 static inline void bswap_prstatus(struct target_elf_prstatus *p) { }
3480 static inline void bswap_psinfo(struct target_elf_prpsinfo *p) {}
3481 static inline void bswap_note(struct elf_note *en) { }
3482 #endif /* BSWAP_NEEDED */
3483 
3484 /*
3485  * Minimal support for linux memory regions.  These are needed
3486  * when we are finding out what memory exactly belongs to
3487  * emulated process.  No locks needed here, as long as
3488  * thread that received the signal is stopped.
3489  */
3490 
3491 static struct mm_struct *vma_init(void)
3492 {
3493     struct mm_struct *mm;
3494 
3495     if ((mm = g_malloc(sizeof (*mm))) == NULL)
3496         return (NULL);
3497 
3498     mm->mm_count = 0;
3499     QTAILQ_INIT(&mm->mm_mmap);
3500 
3501     return (mm);
3502 }
3503 
3504 static void vma_delete(struct mm_struct *mm)
3505 {
3506     struct vm_area_struct *vma;
3507 
3508     while ((vma = vma_first(mm)) != NULL) {
3509         QTAILQ_REMOVE(&mm->mm_mmap, vma, vma_link);
3510         g_free(vma);
3511     }
3512     g_free(mm);
3513 }
3514 
3515 static int vma_add_mapping(struct mm_struct *mm, target_ulong start,
3516                            target_ulong end, abi_ulong flags)
3517 {
3518     struct vm_area_struct *vma;
3519 
3520     if ((vma = g_malloc0(sizeof (*vma))) == NULL)
3521         return (-1);
3522 
3523     vma->vma_start = start;
3524     vma->vma_end = end;
3525     vma->vma_flags = flags;
3526 
3527     QTAILQ_INSERT_TAIL(&mm->mm_mmap, vma, vma_link);
3528     mm->mm_count++;
3529 
3530     return (0);
3531 }
3532 
3533 static struct vm_area_struct *vma_first(const struct mm_struct *mm)
3534 {
3535     return (QTAILQ_FIRST(&mm->mm_mmap));
3536 }
3537 
3538 static struct vm_area_struct *vma_next(struct vm_area_struct *vma)
3539 {
3540     return (QTAILQ_NEXT(vma, vma_link));
3541 }
3542 
3543 static int vma_get_mapping_count(const struct mm_struct *mm)
3544 {
3545     return (mm->mm_count);
3546 }
3547 
3548 /*
3549  * Calculate file (dump) size of given memory region.
3550  */
3551 static abi_ulong vma_dump_size(const struct vm_area_struct *vma)
3552 {
3553     /* if we cannot even read the first page, skip it */
3554     if (!access_ok_untagged(VERIFY_READ, vma->vma_start, TARGET_PAGE_SIZE))
3555         return (0);
3556 
3557     /*
3558      * Usually we don't dump executable pages as they contain
3559      * non-writable code that debugger can read directly from
3560      * target library etc.  However, thread stacks are marked
3561      * also executable so we read in first page of given region
3562      * and check whether it contains elf header.  If there is
3563      * no elf header, we dump it.
3564      */
3565     if (vma->vma_flags & PROT_EXEC) {
3566         char page[TARGET_PAGE_SIZE];
3567 
3568         if (copy_from_user(page, vma->vma_start, sizeof (page))) {
3569             return 0;
3570         }
3571         if ((page[EI_MAG0] == ELFMAG0) &&
3572             (page[EI_MAG1] == ELFMAG1) &&
3573             (page[EI_MAG2] == ELFMAG2) &&
3574             (page[EI_MAG3] == ELFMAG3)) {
3575             /*
3576              * Mappings are possibly from ELF binary.  Don't dump
3577              * them.
3578              */
3579             return (0);
3580         }
3581     }
3582 
3583     return (vma->vma_end - vma->vma_start);
3584 }
3585 
3586 static int vma_walker(void *priv, target_ulong start, target_ulong end,
3587                       unsigned long flags)
3588 {
3589     struct mm_struct *mm = (struct mm_struct *)priv;
3590 
3591     vma_add_mapping(mm, start, end, flags);
3592     return (0);
3593 }
3594 
3595 static void fill_note(struct memelfnote *note, const char *name, int type,
3596                       unsigned int sz, void *data)
3597 {
3598     unsigned int namesz;
3599 
3600     namesz = strlen(name) + 1;
3601     note->name = name;
3602     note->namesz = namesz;
3603     note->namesz_rounded = roundup(namesz, sizeof (int32_t));
3604     note->type = type;
3605     note->datasz = sz;
3606     note->datasz_rounded = roundup(sz, sizeof (int32_t));
3607 
3608     note->data = data;
3609 
3610     /*
3611      * We calculate rounded up note size here as specified by
3612      * ELF document.
3613      */
3614     note->notesz = sizeof (struct elf_note) +
3615         note->namesz_rounded + note->datasz_rounded;
3616 }
3617 
3618 static void fill_elf_header(struct elfhdr *elf, int segs, uint16_t machine,
3619                             uint32_t flags)
3620 {
3621     (void) memset(elf, 0, sizeof(*elf));
3622 
3623     (void) memcpy(elf->e_ident, ELFMAG, SELFMAG);
3624     elf->e_ident[EI_CLASS] = ELF_CLASS;
3625     elf->e_ident[EI_DATA] = ELF_DATA;
3626     elf->e_ident[EI_VERSION] = EV_CURRENT;
3627     elf->e_ident[EI_OSABI] = ELF_OSABI;
3628 
3629     elf->e_type = ET_CORE;
3630     elf->e_machine = machine;
3631     elf->e_version = EV_CURRENT;
3632     elf->e_phoff = sizeof(struct elfhdr);
3633     elf->e_flags = flags;
3634     elf->e_ehsize = sizeof(struct elfhdr);
3635     elf->e_phentsize = sizeof(struct elf_phdr);
3636     elf->e_phnum = segs;
3637 
3638     bswap_ehdr(elf);
3639 }
3640 
3641 static void fill_elf_note_phdr(struct elf_phdr *phdr, int sz, off_t offset)
3642 {
3643     phdr->p_type = PT_NOTE;
3644     phdr->p_offset = offset;
3645     phdr->p_vaddr = 0;
3646     phdr->p_paddr = 0;
3647     phdr->p_filesz = sz;
3648     phdr->p_memsz = 0;
3649     phdr->p_flags = 0;
3650     phdr->p_align = 0;
3651 
3652     bswap_phdr(phdr, 1);
3653 }
3654 
3655 static size_t note_size(const struct memelfnote *note)
3656 {
3657     return (note->notesz);
3658 }
3659 
3660 static void fill_prstatus(struct target_elf_prstatus *prstatus,
3661                           const TaskState *ts, int signr)
3662 {
3663     (void) memset(prstatus, 0, sizeof (*prstatus));
3664     prstatus->pr_info.si_signo = prstatus->pr_cursig = signr;
3665     prstatus->pr_pid = ts->ts_tid;
3666     prstatus->pr_ppid = getppid();
3667     prstatus->pr_pgrp = getpgrp();
3668     prstatus->pr_sid = getsid(0);
3669 
3670     bswap_prstatus(prstatus);
3671 }
3672 
3673 static int fill_psinfo(struct target_elf_prpsinfo *psinfo, const TaskState *ts)
3674 {
3675     char *base_filename;
3676     unsigned int i, len;
3677 
3678     (void) memset(psinfo, 0, sizeof (*psinfo));
3679 
3680     len = ts->info->env_strings - ts->info->arg_strings;
3681     if (len >= ELF_PRARGSZ)
3682         len = ELF_PRARGSZ - 1;
3683     if (copy_from_user(&psinfo->pr_psargs, ts->info->arg_strings, len)) {
3684         return -EFAULT;
3685     }
3686     for (i = 0; i < len; i++)
3687         if (psinfo->pr_psargs[i] == 0)
3688             psinfo->pr_psargs[i] = ' ';
3689     psinfo->pr_psargs[len] = 0;
3690 
3691     psinfo->pr_pid = getpid();
3692     psinfo->pr_ppid = getppid();
3693     psinfo->pr_pgrp = getpgrp();
3694     psinfo->pr_sid = getsid(0);
3695     psinfo->pr_uid = getuid();
3696     psinfo->pr_gid = getgid();
3697 
3698     base_filename = g_path_get_basename(ts->bprm->filename);
3699     /*
3700      * Using strncpy here is fine: at max-length,
3701      * this field is not NUL-terminated.
3702      */
3703     (void) strncpy(psinfo->pr_fname, base_filename,
3704                    sizeof(psinfo->pr_fname));
3705 
3706     g_free(base_filename);
3707     bswap_psinfo(psinfo);
3708     return (0);
3709 }
3710 
3711 static void fill_auxv_note(struct memelfnote *note, const TaskState *ts)
3712 {
3713     elf_addr_t auxv = (elf_addr_t)ts->info->saved_auxv;
3714     elf_addr_t orig_auxv = auxv;
3715     void *ptr;
3716     int len = ts->info->auxv_len;
3717 
3718     /*
3719      * Auxiliary vector is stored in target process stack.  It contains
3720      * {type, value} pairs that we need to dump into note.  This is not
3721      * strictly necessary but we do it here for sake of completeness.
3722      */
3723 
3724     /* read in whole auxv vector and copy it to memelfnote */
3725     ptr = lock_user(VERIFY_READ, orig_auxv, len, 0);
3726     if (ptr != NULL) {
3727         fill_note(note, "CORE", NT_AUXV, len, ptr);
3728         unlock_user(ptr, auxv, len);
3729     }
3730 }
3731 
3732 /*
3733  * Constructs name of coredump file.  We have following convention
3734  * for the name:
3735  *     qemu_<basename-of-target-binary>_<date>-<time>_<pid>.core
3736  *
3737  * Returns the filename
3738  */
3739 static char *core_dump_filename(const TaskState *ts)
3740 {
3741     g_autoptr(GDateTime) now = g_date_time_new_now_local();
3742     g_autofree char *nowstr = g_date_time_format(now, "%Y%m%d-%H%M%S");
3743     g_autofree char *base_filename = g_path_get_basename(ts->bprm->filename);
3744 
3745     return g_strdup_printf("qemu_%s_%s_%d.core",
3746                            base_filename, nowstr, (int)getpid());
3747 }
3748 
3749 static int dump_write(int fd, const void *ptr, size_t size)
3750 {
3751     const char *bufp = (const char *)ptr;
3752     ssize_t bytes_written, bytes_left;
3753     struct rlimit dumpsize;
3754     off_t pos;
3755 
3756     bytes_written = 0;
3757     getrlimit(RLIMIT_CORE, &dumpsize);
3758     if ((pos = lseek(fd, 0, SEEK_CUR))==-1) {
3759         if (errno == ESPIPE) { /* not a seekable stream */
3760             bytes_left = size;
3761         } else {
3762             return pos;
3763         }
3764     } else {
3765         if (dumpsize.rlim_cur <= pos) {
3766             return -1;
3767         } else if (dumpsize.rlim_cur == RLIM_INFINITY) {
3768             bytes_left = size;
3769         } else {
3770             size_t limit_left=dumpsize.rlim_cur - pos;
3771             bytes_left = limit_left >= size ? size : limit_left ;
3772         }
3773     }
3774 
3775     /*
3776      * In normal conditions, single write(2) should do but
3777      * in case of socket etc. this mechanism is more portable.
3778      */
3779     do {
3780         bytes_written = write(fd, bufp, bytes_left);
3781         if (bytes_written < 0) {
3782             if (errno == EINTR)
3783                 continue;
3784             return (-1);
3785         } else if (bytes_written == 0) { /* eof */
3786             return (-1);
3787         }
3788         bufp += bytes_written;
3789         bytes_left -= bytes_written;
3790     } while (bytes_left > 0);
3791 
3792     return (0);
3793 }
3794 
3795 static int write_note(struct memelfnote *men, int fd)
3796 {
3797     struct elf_note en;
3798 
3799     en.n_namesz = men->namesz;
3800     en.n_type = men->type;
3801     en.n_descsz = men->datasz;
3802 
3803     bswap_note(&en);
3804 
3805     if (dump_write(fd, &en, sizeof(en)) != 0)
3806         return (-1);
3807     if (dump_write(fd, men->name, men->namesz_rounded) != 0)
3808         return (-1);
3809     if (dump_write(fd, men->data, men->datasz_rounded) != 0)
3810         return (-1);
3811 
3812     return (0);
3813 }
3814 
3815 static void fill_thread_info(struct elf_note_info *info, const CPUArchState *env)
3816 {
3817     CPUState *cpu = env_cpu((CPUArchState *)env);
3818     TaskState *ts = (TaskState *)cpu->opaque;
3819     struct elf_thread_status *ets;
3820 
3821     ets = g_malloc0(sizeof (*ets));
3822     ets->num_notes = 1; /* only prstatus is dumped */
3823     fill_prstatus(&ets->prstatus, ts, 0);
3824     elf_core_copy_regs(&ets->prstatus.pr_reg, env);
3825     fill_note(&ets->notes[0], "CORE", NT_PRSTATUS, sizeof (ets->prstatus),
3826               &ets->prstatus);
3827 
3828     QTAILQ_INSERT_TAIL(&info->thread_list, ets, ets_link);
3829 
3830     info->notes_size += note_size(&ets->notes[0]);
3831 }
3832 
3833 static void init_note_info(struct elf_note_info *info)
3834 {
3835     /* Initialize the elf_note_info structure so that it is at
3836      * least safe to call free_note_info() on it. Must be
3837      * called before calling fill_note_info().
3838      */
3839     memset(info, 0, sizeof (*info));
3840     QTAILQ_INIT(&info->thread_list);
3841 }
3842 
3843 static int fill_note_info(struct elf_note_info *info,
3844                           long signr, const CPUArchState *env)
3845 {
3846 #define NUMNOTES 3
3847     CPUState *cpu = env_cpu((CPUArchState *)env);
3848     TaskState *ts = (TaskState *)cpu->opaque;
3849     int i;
3850 
3851     info->notes = g_new0(struct memelfnote, NUMNOTES);
3852     if (info->notes == NULL)
3853         return (-ENOMEM);
3854     info->prstatus = g_malloc0(sizeof (*info->prstatus));
3855     if (info->prstatus == NULL)
3856         return (-ENOMEM);
3857     info->psinfo = g_malloc0(sizeof (*info->psinfo));
3858     if (info->prstatus == NULL)
3859         return (-ENOMEM);
3860 
3861     /*
3862      * First fill in status (and registers) of current thread
3863      * including process info & aux vector.
3864      */
3865     fill_prstatus(info->prstatus, ts, signr);
3866     elf_core_copy_regs(&info->prstatus->pr_reg, env);
3867     fill_note(&info->notes[0], "CORE", NT_PRSTATUS,
3868               sizeof (*info->prstatus), info->prstatus);
3869     fill_psinfo(info->psinfo, ts);
3870     fill_note(&info->notes[1], "CORE", NT_PRPSINFO,
3871               sizeof (*info->psinfo), info->psinfo);
3872     fill_auxv_note(&info->notes[2], ts);
3873     info->numnote = 3;
3874 
3875     info->notes_size = 0;
3876     for (i = 0; i < info->numnote; i++)
3877         info->notes_size += note_size(&info->notes[i]);
3878 
3879     /* read and fill status of all threads */
3880     cpu_list_lock();
3881     CPU_FOREACH(cpu) {
3882         if (cpu == thread_cpu) {
3883             continue;
3884         }
3885         fill_thread_info(info, (CPUArchState *)cpu->env_ptr);
3886     }
3887     cpu_list_unlock();
3888 
3889     return (0);
3890 }
3891 
3892 static void free_note_info(struct elf_note_info *info)
3893 {
3894     struct elf_thread_status *ets;
3895 
3896     while (!QTAILQ_EMPTY(&info->thread_list)) {
3897         ets = QTAILQ_FIRST(&info->thread_list);
3898         QTAILQ_REMOVE(&info->thread_list, ets, ets_link);
3899         g_free(ets);
3900     }
3901 
3902     g_free(info->prstatus);
3903     g_free(info->psinfo);
3904     g_free(info->notes);
3905 }
3906 
3907 static int write_note_info(struct elf_note_info *info, int fd)
3908 {
3909     struct elf_thread_status *ets;
3910     int i, error = 0;
3911 
3912     /* write prstatus, psinfo and auxv for current thread */
3913     for (i = 0; i < info->numnote; i++)
3914         if ((error = write_note(&info->notes[i], fd)) != 0)
3915             return (error);
3916 
3917     /* write prstatus for each thread */
3918     QTAILQ_FOREACH(ets, &info->thread_list, ets_link) {
3919         if ((error = write_note(&ets->notes[0], fd)) != 0)
3920             return (error);
3921     }
3922 
3923     return (0);
3924 }
3925 
3926 /*
3927  * Write out ELF coredump.
3928  *
3929  * See documentation of ELF object file format in:
3930  * http://www.caldera.com/developers/devspecs/gabi41.pdf
3931  *
3932  * Coredump format in linux is following:
3933  *
3934  * 0   +----------------------+         \
3935  *     | ELF header           | ET_CORE  |
3936  *     +----------------------+          |
3937  *     | ELF program headers  |          |--- headers
3938  *     | - NOTE section       |          |
3939  *     | - PT_LOAD sections   |          |
3940  *     +----------------------+         /
3941  *     | NOTEs:               |
3942  *     | - NT_PRSTATUS        |
3943  *     | - NT_PRSINFO         |
3944  *     | - NT_AUXV            |
3945  *     +----------------------+ <-- aligned to target page
3946  *     | Process memory dump  |
3947  *     :                      :
3948  *     .                      .
3949  *     :                      :
3950  *     |                      |
3951  *     +----------------------+
3952  *
3953  * NT_PRSTATUS -> struct elf_prstatus (per thread)
3954  * NT_PRSINFO  -> struct elf_prpsinfo
3955  * NT_AUXV is array of { type, value } pairs (see fill_auxv_note()).
3956  *
3957  * Format follows System V format as close as possible.  Current
3958  * version limitations are as follows:
3959  *     - no floating point registers are dumped
3960  *
3961  * Function returns 0 in case of success, negative errno otherwise.
3962  *
3963  * TODO: make this work also during runtime: it should be
3964  * possible to force coredump from running process and then
3965  * continue processing.  For example qemu could set up SIGUSR2
3966  * handler (provided that target process haven't registered
3967  * handler for that) that does the dump when signal is received.
3968  */
3969 static int elf_core_dump(int signr, const CPUArchState *env)
3970 {
3971     const CPUState *cpu = env_cpu((CPUArchState *)env);
3972     const TaskState *ts = (const TaskState *)cpu->opaque;
3973     struct vm_area_struct *vma = NULL;
3974     g_autofree char *corefile = NULL;
3975     struct elf_note_info info;
3976     struct elfhdr elf;
3977     struct elf_phdr phdr;
3978     struct rlimit dumpsize;
3979     struct mm_struct *mm = NULL;
3980     off_t offset = 0, data_offset = 0;
3981     int segs = 0;
3982     int fd = -1;
3983 
3984     init_note_info(&info);
3985 
3986     errno = 0;
3987     getrlimit(RLIMIT_CORE, &dumpsize);
3988     if (dumpsize.rlim_cur == 0)
3989         return 0;
3990 
3991     corefile = core_dump_filename(ts);
3992 
3993     if ((fd = open(corefile, O_WRONLY | O_CREAT,
3994                    S_IRUSR|S_IWUSR|S_IRGRP|S_IROTH)) < 0)
3995         return (-errno);
3996 
3997     /*
3998      * Walk through target process memory mappings and
3999      * set up structure containing this information.  After
4000      * this point vma_xxx functions can be used.
4001      */
4002     if ((mm = vma_init()) == NULL)
4003         goto out;
4004 
4005     walk_memory_regions(mm, vma_walker);
4006     segs = vma_get_mapping_count(mm);
4007 
4008     /*
4009      * Construct valid coredump ELF header.  We also
4010      * add one more segment for notes.
4011      */
4012     fill_elf_header(&elf, segs + 1, ELF_MACHINE, 0);
4013     if (dump_write(fd, &elf, sizeof (elf)) != 0)
4014         goto out;
4015 
4016     /* fill in the in-memory version of notes */
4017     if (fill_note_info(&info, signr, env) < 0)
4018         goto out;
4019 
4020     offset += sizeof (elf);                             /* elf header */
4021     offset += (segs + 1) * sizeof (struct elf_phdr);    /* program headers */
4022 
4023     /* write out notes program header */
4024     fill_elf_note_phdr(&phdr, info.notes_size, offset);
4025 
4026     offset += info.notes_size;
4027     if (dump_write(fd, &phdr, sizeof (phdr)) != 0)
4028         goto out;
4029 
4030     /*
4031      * ELF specification wants data to start at page boundary so
4032      * we align it here.
4033      */
4034     data_offset = offset = roundup(offset, ELF_EXEC_PAGESIZE);
4035 
4036     /*
4037      * Write program headers for memory regions mapped in
4038      * the target process.
4039      */
4040     for (vma = vma_first(mm); vma != NULL; vma = vma_next(vma)) {
4041         (void) memset(&phdr, 0, sizeof (phdr));
4042 
4043         phdr.p_type = PT_LOAD;
4044         phdr.p_offset = offset;
4045         phdr.p_vaddr = vma->vma_start;
4046         phdr.p_paddr = 0;
4047         phdr.p_filesz = vma_dump_size(vma);
4048         offset += phdr.p_filesz;
4049         phdr.p_memsz = vma->vma_end - vma->vma_start;
4050         phdr.p_flags = vma->vma_flags & PROT_READ ? PF_R : 0;
4051         if (vma->vma_flags & PROT_WRITE)
4052             phdr.p_flags |= PF_W;
4053         if (vma->vma_flags & PROT_EXEC)
4054             phdr.p_flags |= PF_X;
4055         phdr.p_align = ELF_EXEC_PAGESIZE;
4056 
4057         bswap_phdr(&phdr, 1);
4058         if (dump_write(fd, &phdr, sizeof(phdr)) != 0) {
4059             goto out;
4060         }
4061     }
4062 
4063     /*
4064      * Next we write notes just after program headers.  No
4065      * alignment needed here.
4066      */
4067     if (write_note_info(&info, fd) < 0)
4068         goto out;
4069 
4070     /* align data to page boundary */
4071     if (lseek(fd, data_offset, SEEK_SET) != data_offset)
4072         goto out;
4073 
4074     /*
4075      * Finally we can dump process memory into corefile as well.
4076      */
4077     for (vma = vma_first(mm); vma != NULL; vma = vma_next(vma)) {
4078         abi_ulong addr;
4079         abi_ulong end;
4080 
4081         end = vma->vma_start + vma_dump_size(vma);
4082 
4083         for (addr = vma->vma_start; addr < end;
4084              addr += TARGET_PAGE_SIZE) {
4085             char page[TARGET_PAGE_SIZE];
4086             int error;
4087 
4088             /*
4089              *  Read in page from target process memory and
4090              *  write it to coredump file.
4091              */
4092             error = copy_from_user(page, addr, sizeof (page));
4093             if (error != 0) {
4094                 (void) fprintf(stderr, "unable to dump " TARGET_ABI_FMT_lx "\n",
4095                                addr);
4096                 errno = -error;
4097                 goto out;
4098             }
4099             if (dump_write(fd, page, TARGET_PAGE_SIZE) < 0)
4100                 goto out;
4101         }
4102     }
4103 
4104  out:
4105     free_note_info(&info);
4106     if (mm != NULL)
4107         vma_delete(mm);
4108     (void) close(fd);
4109 
4110     if (errno != 0)
4111         return (-errno);
4112     return (0);
4113 }
4114 #endif /* USE_ELF_CORE_DUMP */
4115 
4116 void do_init_thread(struct target_pt_regs *regs, struct image_info *infop)
4117 {
4118     init_thread(regs, infop);
4119 }
4120