xref: /openbmc/qemu/linux-user/elfload.c (revision a00e37a4)
1 /* This is the Linux kernel elf-loading code, ported into user space */
2 #include "qemu/osdep.h"
3 #include <sys/param.h>
4 
5 #include <sys/resource.h>
6 #include <sys/shm.h>
7 
8 #include "qemu.h"
9 #include "user-internals.h"
10 #include "signal-common.h"
11 #include "loader.h"
12 #include "user-mmap.h"
13 #include "disas/disas.h"
14 #include "qemu/bitops.h"
15 #include "qemu/path.h"
16 #include "qemu/queue.h"
17 #include "qemu/guest-random.h"
18 #include "qemu/units.h"
19 #include "qemu/selfmap.h"
20 #include "qapi/error.h"
21 #include "target_signal.h"
22 
23 #ifdef _ARCH_PPC64
24 #undef ARCH_DLINFO
25 #undef ELF_PLATFORM
26 #undef ELF_HWCAP
27 #undef ELF_HWCAP2
28 #undef ELF_CLASS
29 #undef ELF_DATA
30 #undef ELF_ARCH
31 #endif
32 
33 #define ELF_OSABI   ELFOSABI_SYSV
34 
35 /* from personality.h */
36 
37 /*
38  * Flags for bug emulation.
39  *
40  * These occupy the top three bytes.
41  */
42 enum {
43     ADDR_NO_RANDOMIZE = 0x0040000,      /* disable randomization of VA space */
44     FDPIC_FUNCPTRS =    0x0080000,      /* userspace function ptrs point to
45                                            descriptors (signal handling) */
46     MMAP_PAGE_ZERO =    0x0100000,
47     ADDR_COMPAT_LAYOUT = 0x0200000,
48     READ_IMPLIES_EXEC = 0x0400000,
49     ADDR_LIMIT_32BIT =  0x0800000,
50     SHORT_INODE =       0x1000000,
51     WHOLE_SECONDS =     0x2000000,
52     STICKY_TIMEOUTS =   0x4000000,
53     ADDR_LIMIT_3GB =    0x8000000,
54 };
55 
56 /*
57  * Personality types.
58  *
59  * These go in the low byte.  Avoid using the top bit, it will
60  * conflict with error returns.
61  */
62 enum {
63     PER_LINUX =         0x0000,
64     PER_LINUX_32BIT =   0x0000 | ADDR_LIMIT_32BIT,
65     PER_LINUX_FDPIC =   0x0000 | FDPIC_FUNCPTRS,
66     PER_SVR4 =          0x0001 | STICKY_TIMEOUTS | MMAP_PAGE_ZERO,
67     PER_SVR3 =          0x0002 | STICKY_TIMEOUTS | SHORT_INODE,
68     PER_SCOSVR3 =       0x0003 | STICKY_TIMEOUTS | WHOLE_SECONDS | SHORT_INODE,
69     PER_OSR5 =          0x0003 | STICKY_TIMEOUTS | WHOLE_SECONDS,
70     PER_WYSEV386 =      0x0004 | STICKY_TIMEOUTS | SHORT_INODE,
71     PER_ISCR4 =         0x0005 | STICKY_TIMEOUTS,
72     PER_BSD =           0x0006,
73     PER_SUNOS =         0x0006 | STICKY_TIMEOUTS,
74     PER_XENIX =         0x0007 | STICKY_TIMEOUTS | SHORT_INODE,
75     PER_LINUX32 =       0x0008,
76     PER_LINUX32_3GB =   0x0008 | ADDR_LIMIT_3GB,
77     PER_IRIX32 =        0x0009 | STICKY_TIMEOUTS,/* IRIX5 32-bit */
78     PER_IRIXN32 =       0x000a | STICKY_TIMEOUTS,/* IRIX6 new 32-bit */
79     PER_IRIX64 =        0x000b | STICKY_TIMEOUTS,/* IRIX6 64-bit */
80     PER_RISCOS =        0x000c,
81     PER_SOLARIS =       0x000d | STICKY_TIMEOUTS,
82     PER_UW7 =           0x000e | STICKY_TIMEOUTS | MMAP_PAGE_ZERO,
83     PER_OSF4 =          0x000f,                  /* OSF/1 v4 */
84     PER_HPUX =          0x0010,
85     PER_MASK =          0x00ff,
86 };
87 
88 /*
89  * Return the base personality without flags.
90  */
91 #define personality(pers)       (pers & PER_MASK)
92 
93 int info_is_fdpic(struct image_info *info)
94 {
95     return info->personality == PER_LINUX_FDPIC;
96 }
97 
98 /* this flag is uneffective under linux too, should be deleted */
99 #ifndef MAP_DENYWRITE
100 #define MAP_DENYWRITE 0
101 #endif
102 
103 /* should probably go in elf.h */
104 #ifndef ELIBBAD
105 #define ELIBBAD 80
106 #endif
107 
108 #ifdef TARGET_WORDS_BIGENDIAN
109 #define ELF_DATA        ELFDATA2MSB
110 #else
111 #define ELF_DATA        ELFDATA2LSB
112 #endif
113 
114 #ifdef TARGET_ABI_MIPSN32
115 typedef abi_ullong      target_elf_greg_t;
116 #define tswapreg(ptr)   tswap64(ptr)
117 #else
118 typedef abi_ulong       target_elf_greg_t;
119 #define tswapreg(ptr)   tswapal(ptr)
120 #endif
121 
122 #ifdef USE_UID16
123 typedef abi_ushort      target_uid_t;
124 typedef abi_ushort      target_gid_t;
125 #else
126 typedef abi_uint        target_uid_t;
127 typedef abi_uint        target_gid_t;
128 #endif
129 typedef abi_int         target_pid_t;
130 
131 #ifdef TARGET_I386
132 
133 #define ELF_PLATFORM get_elf_platform()
134 
135 static const char *get_elf_platform(void)
136 {
137     static char elf_platform[] = "i386";
138     int family = object_property_get_int(OBJECT(thread_cpu), "family", NULL);
139     if (family > 6)
140         family = 6;
141     if (family >= 3)
142         elf_platform[1] = '0' + family;
143     return elf_platform;
144 }
145 
146 #define ELF_HWCAP get_elf_hwcap()
147 
148 static uint32_t get_elf_hwcap(void)
149 {
150     X86CPU *cpu = X86_CPU(thread_cpu);
151 
152     return cpu->env.features[FEAT_1_EDX];
153 }
154 
155 #ifdef TARGET_X86_64
156 #define ELF_START_MMAP 0x2aaaaab000ULL
157 
158 #define ELF_CLASS      ELFCLASS64
159 #define ELF_ARCH       EM_X86_64
160 
161 static inline void init_thread(struct target_pt_regs *regs, struct image_info *infop)
162 {
163     regs->rax = 0;
164     regs->rsp = infop->start_stack;
165     regs->rip = infop->entry;
166 }
167 
168 #define ELF_NREG    27
169 typedef target_elf_greg_t  target_elf_gregset_t[ELF_NREG];
170 
171 /*
172  * Note that ELF_NREG should be 29 as there should be place for
173  * TRAPNO and ERR "registers" as well but linux doesn't dump
174  * those.
175  *
176  * See linux kernel: arch/x86/include/asm/elf.h
177  */
178 static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUX86State *env)
179 {
180     (*regs)[0] = tswapreg(env->regs[15]);
181     (*regs)[1] = tswapreg(env->regs[14]);
182     (*regs)[2] = tswapreg(env->regs[13]);
183     (*regs)[3] = tswapreg(env->regs[12]);
184     (*regs)[4] = tswapreg(env->regs[R_EBP]);
185     (*regs)[5] = tswapreg(env->regs[R_EBX]);
186     (*regs)[6] = tswapreg(env->regs[11]);
187     (*regs)[7] = tswapreg(env->regs[10]);
188     (*regs)[8] = tswapreg(env->regs[9]);
189     (*regs)[9] = tswapreg(env->regs[8]);
190     (*regs)[10] = tswapreg(env->regs[R_EAX]);
191     (*regs)[11] = tswapreg(env->regs[R_ECX]);
192     (*regs)[12] = tswapreg(env->regs[R_EDX]);
193     (*regs)[13] = tswapreg(env->regs[R_ESI]);
194     (*regs)[14] = tswapreg(env->regs[R_EDI]);
195     (*regs)[15] = tswapreg(env->regs[R_EAX]); /* XXX */
196     (*regs)[16] = tswapreg(env->eip);
197     (*regs)[17] = tswapreg(env->segs[R_CS].selector & 0xffff);
198     (*regs)[18] = tswapreg(env->eflags);
199     (*regs)[19] = tswapreg(env->regs[R_ESP]);
200     (*regs)[20] = tswapreg(env->segs[R_SS].selector & 0xffff);
201     (*regs)[21] = tswapreg(env->segs[R_FS].selector & 0xffff);
202     (*regs)[22] = tswapreg(env->segs[R_GS].selector & 0xffff);
203     (*regs)[23] = tswapreg(env->segs[R_DS].selector & 0xffff);
204     (*regs)[24] = tswapreg(env->segs[R_ES].selector & 0xffff);
205     (*regs)[25] = tswapreg(env->segs[R_FS].selector & 0xffff);
206     (*regs)[26] = tswapreg(env->segs[R_GS].selector & 0xffff);
207 }
208 
209 #else
210 
211 #define ELF_START_MMAP 0x80000000
212 
213 /*
214  * This is used to ensure we don't load something for the wrong architecture.
215  */
216 #define elf_check_arch(x) ( ((x) == EM_386) || ((x) == EM_486) )
217 
218 /*
219  * These are used to set parameters in the core dumps.
220  */
221 #define ELF_CLASS       ELFCLASS32
222 #define ELF_ARCH        EM_386
223 
224 static inline void init_thread(struct target_pt_regs *regs,
225                                struct image_info *infop)
226 {
227     regs->esp = infop->start_stack;
228     regs->eip = infop->entry;
229 
230     /* SVR4/i386 ABI (pages 3-31, 3-32) says that when the program
231        starts %edx contains a pointer to a function which might be
232        registered using `atexit'.  This provides a mean for the
233        dynamic linker to call DT_FINI functions for shared libraries
234        that have been loaded before the code runs.
235 
236        A value of 0 tells we have no such handler.  */
237     regs->edx = 0;
238 }
239 
240 #define ELF_NREG    17
241 typedef target_elf_greg_t  target_elf_gregset_t[ELF_NREG];
242 
243 /*
244  * Note that ELF_NREG should be 19 as there should be place for
245  * TRAPNO and ERR "registers" as well but linux doesn't dump
246  * those.
247  *
248  * See linux kernel: arch/x86/include/asm/elf.h
249  */
250 static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUX86State *env)
251 {
252     (*regs)[0] = tswapreg(env->regs[R_EBX]);
253     (*regs)[1] = tswapreg(env->regs[R_ECX]);
254     (*regs)[2] = tswapreg(env->regs[R_EDX]);
255     (*regs)[3] = tswapreg(env->regs[R_ESI]);
256     (*regs)[4] = tswapreg(env->regs[R_EDI]);
257     (*regs)[5] = tswapreg(env->regs[R_EBP]);
258     (*regs)[6] = tswapreg(env->regs[R_EAX]);
259     (*regs)[7] = tswapreg(env->segs[R_DS].selector & 0xffff);
260     (*regs)[8] = tswapreg(env->segs[R_ES].selector & 0xffff);
261     (*regs)[9] = tswapreg(env->segs[R_FS].selector & 0xffff);
262     (*regs)[10] = tswapreg(env->segs[R_GS].selector & 0xffff);
263     (*regs)[11] = tswapreg(env->regs[R_EAX]); /* XXX */
264     (*regs)[12] = tswapreg(env->eip);
265     (*regs)[13] = tswapreg(env->segs[R_CS].selector & 0xffff);
266     (*regs)[14] = tswapreg(env->eflags);
267     (*regs)[15] = tswapreg(env->regs[R_ESP]);
268     (*regs)[16] = tswapreg(env->segs[R_SS].selector & 0xffff);
269 }
270 #endif
271 
272 #define USE_ELF_CORE_DUMP
273 #define ELF_EXEC_PAGESIZE       4096
274 
275 #endif
276 
277 #ifdef TARGET_ARM
278 
279 #ifndef TARGET_AARCH64
280 /* 32 bit ARM definitions */
281 
282 #define ELF_START_MMAP 0x80000000
283 
284 #define ELF_ARCH        EM_ARM
285 #define ELF_CLASS       ELFCLASS32
286 
287 static inline void init_thread(struct target_pt_regs *regs,
288                                struct image_info *infop)
289 {
290     abi_long stack = infop->start_stack;
291     memset(regs, 0, sizeof(*regs));
292 
293     regs->uregs[16] = ARM_CPU_MODE_USR;
294     if (infop->entry & 1) {
295         regs->uregs[16] |= CPSR_T;
296     }
297     regs->uregs[15] = infop->entry & 0xfffffffe;
298     regs->uregs[13] = infop->start_stack;
299     /* FIXME - what to for failure of get_user()? */
300     get_user_ual(regs->uregs[2], stack + 8); /* envp */
301     get_user_ual(regs->uregs[1], stack + 4); /* envp */
302     /* XXX: it seems that r0 is zeroed after ! */
303     regs->uregs[0] = 0;
304     /* For uClinux PIC binaries.  */
305     /* XXX: Linux does this only on ARM with no MMU (do we care ?) */
306     regs->uregs[10] = infop->start_data;
307 
308     /* Support ARM FDPIC.  */
309     if (info_is_fdpic(infop)) {
310         /* As described in the ABI document, r7 points to the loadmap info
311          * prepared by the kernel. If an interpreter is needed, r8 points
312          * to the interpreter loadmap and r9 points to the interpreter
313          * PT_DYNAMIC info. If no interpreter is needed, r8 is zero, and
314          * r9 points to the main program PT_DYNAMIC info.
315          */
316         regs->uregs[7] = infop->loadmap_addr;
317         if (infop->interpreter_loadmap_addr) {
318             /* Executable is dynamically loaded.  */
319             regs->uregs[8] = infop->interpreter_loadmap_addr;
320             regs->uregs[9] = infop->interpreter_pt_dynamic_addr;
321         } else {
322             regs->uregs[8] = 0;
323             regs->uregs[9] = infop->pt_dynamic_addr;
324         }
325     }
326 }
327 
328 #define ELF_NREG    18
329 typedef target_elf_greg_t  target_elf_gregset_t[ELF_NREG];
330 
331 static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUARMState *env)
332 {
333     (*regs)[0] = tswapreg(env->regs[0]);
334     (*regs)[1] = tswapreg(env->regs[1]);
335     (*regs)[2] = tswapreg(env->regs[2]);
336     (*regs)[3] = tswapreg(env->regs[3]);
337     (*regs)[4] = tswapreg(env->regs[4]);
338     (*regs)[5] = tswapreg(env->regs[5]);
339     (*regs)[6] = tswapreg(env->regs[6]);
340     (*regs)[7] = tswapreg(env->regs[7]);
341     (*regs)[8] = tswapreg(env->regs[8]);
342     (*regs)[9] = tswapreg(env->regs[9]);
343     (*regs)[10] = tswapreg(env->regs[10]);
344     (*regs)[11] = tswapreg(env->regs[11]);
345     (*regs)[12] = tswapreg(env->regs[12]);
346     (*regs)[13] = tswapreg(env->regs[13]);
347     (*regs)[14] = tswapreg(env->regs[14]);
348     (*regs)[15] = tswapreg(env->regs[15]);
349 
350     (*regs)[16] = tswapreg(cpsr_read((CPUARMState *)env));
351     (*regs)[17] = tswapreg(env->regs[0]); /* XXX */
352 }
353 
354 #define USE_ELF_CORE_DUMP
355 #define ELF_EXEC_PAGESIZE       4096
356 
357 enum
358 {
359     ARM_HWCAP_ARM_SWP       = 1 << 0,
360     ARM_HWCAP_ARM_HALF      = 1 << 1,
361     ARM_HWCAP_ARM_THUMB     = 1 << 2,
362     ARM_HWCAP_ARM_26BIT     = 1 << 3,
363     ARM_HWCAP_ARM_FAST_MULT = 1 << 4,
364     ARM_HWCAP_ARM_FPA       = 1 << 5,
365     ARM_HWCAP_ARM_VFP       = 1 << 6,
366     ARM_HWCAP_ARM_EDSP      = 1 << 7,
367     ARM_HWCAP_ARM_JAVA      = 1 << 8,
368     ARM_HWCAP_ARM_IWMMXT    = 1 << 9,
369     ARM_HWCAP_ARM_CRUNCH    = 1 << 10,
370     ARM_HWCAP_ARM_THUMBEE   = 1 << 11,
371     ARM_HWCAP_ARM_NEON      = 1 << 12,
372     ARM_HWCAP_ARM_VFPv3     = 1 << 13,
373     ARM_HWCAP_ARM_VFPv3D16  = 1 << 14,
374     ARM_HWCAP_ARM_TLS       = 1 << 15,
375     ARM_HWCAP_ARM_VFPv4     = 1 << 16,
376     ARM_HWCAP_ARM_IDIVA     = 1 << 17,
377     ARM_HWCAP_ARM_IDIVT     = 1 << 18,
378     ARM_HWCAP_ARM_VFPD32    = 1 << 19,
379     ARM_HWCAP_ARM_LPAE      = 1 << 20,
380     ARM_HWCAP_ARM_EVTSTRM   = 1 << 21,
381 };
382 
383 enum {
384     ARM_HWCAP2_ARM_AES      = 1 << 0,
385     ARM_HWCAP2_ARM_PMULL    = 1 << 1,
386     ARM_HWCAP2_ARM_SHA1     = 1 << 2,
387     ARM_HWCAP2_ARM_SHA2     = 1 << 3,
388     ARM_HWCAP2_ARM_CRC32    = 1 << 4,
389 };
390 
391 /* The commpage only exists for 32 bit kernels */
392 
393 #define ARM_COMMPAGE (intptr_t)0xffff0f00u
394 
395 static bool init_guest_commpage(void)
396 {
397     void *want = g2h_untagged(ARM_COMMPAGE & -qemu_host_page_size);
398     void *addr = mmap(want, qemu_host_page_size, PROT_READ | PROT_WRITE,
399                       MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED, -1, 0);
400 
401     if (addr == MAP_FAILED) {
402         perror("Allocating guest commpage");
403         exit(EXIT_FAILURE);
404     }
405     if (addr != want) {
406         return false;
407     }
408 
409     /* Set kernel helper versions; rest of page is 0.  */
410     __put_user(5, (uint32_t *)g2h_untagged(0xffff0ffcu));
411 
412     if (mprotect(addr, qemu_host_page_size, PROT_READ)) {
413         perror("Protecting guest commpage");
414         exit(EXIT_FAILURE);
415     }
416     return true;
417 }
418 
419 #define ELF_HWCAP get_elf_hwcap()
420 #define ELF_HWCAP2 get_elf_hwcap2()
421 
422 static uint32_t get_elf_hwcap(void)
423 {
424     ARMCPU *cpu = ARM_CPU(thread_cpu);
425     uint32_t hwcaps = 0;
426 
427     hwcaps |= ARM_HWCAP_ARM_SWP;
428     hwcaps |= ARM_HWCAP_ARM_HALF;
429     hwcaps |= ARM_HWCAP_ARM_THUMB;
430     hwcaps |= ARM_HWCAP_ARM_FAST_MULT;
431 
432     /* probe for the extra features */
433 #define GET_FEATURE(feat, hwcap) \
434     do { if (arm_feature(&cpu->env, feat)) { hwcaps |= hwcap; } } while (0)
435 
436 #define GET_FEATURE_ID(feat, hwcap) \
437     do { if (cpu_isar_feature(feat, cpu)) { hwcaps |= hwcap; } } while (0)
438 
439     /* EDSP is in v5TE and above, but all our v5 CPUs are v5TE */
440     GET_FEATURE(ARM_FEATURE_V5, ARM_HWCAP_ARM_EDSP);
441     GET_FEATURE(ARM_FEATURE_IWMMXT, ARM_HWCAP_ARM_IWMMXT);
442     GET_FEATURE(ARM_FEATURE_THUMB2EE, ARM_HWCAP_ARM_THUMBEE);
443     GET_FEATURE(ARM_FEATURE_NEON, ARM_HWCAP_ARM_NEON);
444     GET_FEATURE(ARM_FEATURE_V6K, ARM_HWCAP_ARM_TLS);
445     GET_FEATURE(ARM_FEATURE_LPAE, ARM_HWCAP_ARM_LPAE);
446     GET_FEATURE_ID(aa32_arm_div, ARM_HWCAP_ARM_IDIVA);
447     GET_FEATURE_ID(aa32_thumb_div, ARM_HWCAP_ARM_IDIVT);
448     GET_FEATURE_ID(aa32_vfp, ARM_HWCAP_ARM_VFP);
449 
450     if (cpu_isar_feature(aa32_fpsp_v3, cpu) ||
451         cpu_isar_feature(aa32_fpdp_v3, cpu)) {
452         hwcaps |= ARM_HWCAP_ARM_VFPv3;
453         if (cpu_isar_feature(aa32_simd_r32, cpu)) {
454             hwcaps |= ARM_HWCAP_ARM_VFPD32;
455         } else {
456             hwcaps |= ARM_HWCAP_ARM_VFPv3D16;
457         }
458     }
459     GET_FEATURE_ID(aa32_simdfmac, ARM_HWCAP_ARM_VFPv4);
460 
461     return hwcaps;
462 }
463 
464 static uint32_t get_elf_hwcap2(void)
465 {
466     ARMCPU *cpu = ARM_CPU(thread_cpu);
467     uint32_t hwcaps = 0;
468 
469     GET_FEATURE_ID(aa32_aes, ARM_HWCAP2_ARM_AES);
470     GET_FEATURE_ID(aa32_pmull, ARM_HWCAP2_ARM_PMULL);
471     GET_FEATURE_ID(aa32_sha1, ARM_HWCAP2_ARM_SHA1);
472     GET_FEATURE_ID(aa32_sha2, ARM_HWCAP2_ARM_SHA2);
473     GET_FEATURE_ID(aa32_crc32, ARM_HWCAP2_ARM_CRC32);
474     return hwcaps;
475 }
476 
477 #undef GET_FEATURE
478 #undef GET_FEATURE_ID
479 
480 #define ELF_PLATFORM get_elf_platform()
481 
482 static const char *get_elf_platform(void)
483 {
484     CPUARMState *env = thread_cpu->env_ptr;
485 
486 #ifdef TARGET_WORDS_BIGENDIAN
487 # define END  "b"
488 #else
489 # define END  "l"
490 #endif
491 
492     if (arm_feature(env, ARM_FEATURE_V8)) {
493         return "v8" END;
494     } else if (arm_feature(env, ARM_FEATURE_V7)) {
495         if (arm_feature(env, ARM_FEATURE_M)) {
496             return "v7m" END;
497         } else {
498             return "v7" END;
499         }
500     } else if (arm_feature(env, ARM_FEATURE_V6)) {
501         return "v6" END;
502     } else if (arm_feature(env, ARM_FEATURE_V5)) {
503         return "v5" END;
504     } else {
505         return "v4" END;
506     }
507 
508 #undef END
509 }
510 
511 #else
512 /* 64 bit ARM definitions */
513 #define ELF_START_MMAP 0x80000000
514 
515 #define ELF_ARCH        EM_AARCH64
516 #define ELF_CLASS       ELFCLASS64
517 #ifdef TARGET_WORDS_BIGENDIAN
518 # define ELF_PLATFORM    "aarch64_be"
519 #else
520 # define ELF_PLATFORM    "aarch64"
521 #endif
522 
523 static inline void init_thread(struct target_pt_regs *regs,
524                                struct image_info *infop)
525 {
526     abi_long stack = infop->start_stack;
527     memset(regs, 0, sizeof(*regs));
528 
529     regs->pc = infop->entry & ~0x3ULL;
530     regs->sp = stack;
531 }
532 
533 #define ELF_NREG    34
534 typedef target_elf_greg_t  target_elf_gregset_t[ELF_NREG];
535 
536 static void elf_core_copy_regs(target_elf_gregset_t *regs,
537                                const CPUARMState *env)
538 {
539     int i;
540 
541     for (i = 0; i < 32; i++) {
542         (*regs)[i] = tswapreg(env->xregs[i]);
543     }
544     (*regs)[32] = tswapreg(env->pc);
545     (*regs)[33] = tswapreg(pstate_read((CPUARMState *)env));
546 }
547 
548 #define USE_ELF_CORE_DUMP
549 #define ELF_EXEC_PAGESIZE       4096
550 
551 enum {
552     ARM_HWCAP_A64_FP            = 1 << 0,
553     ARM_HWCAP_A64_ASIMD         = 1 << 1,
554     ARM_HWCAP_A64_EVTSTRM       = 1 << 2,
555     ARM_HWCAP_A64_AES           = 1 << 3,
556     ARM_HWCAP_A64_PMULL         = 1 << 4,
557     ARM_HWCAP_A64_SHA1          = 1 << 5,
558     ARM_HWCAP_A64_SHA2          = 1 << 6,
559     ARM_HWCAP_A64_CRC32         = 1 << 7,
560     ARM_HWCAP_A64_ATOMICS       = 1 << 8,
561     ARM_HWCAP_A64_FPHP          = 1 << 9,
562     ARM_HWCAP_A64_ASIMDHP       = 1 << 10,
563     ARM_HWCAP_A64_CPUID         = 1 << 11,
564     ARM_HWCAP_A64_ASIMDRDM      = 1 << 12,
565     ARM_HWCAP_A64_JSCVT         = 1 << 13,
566     ARM_HWCAP_A64_FCMA          = 1 << 14,
567     ARM_HWCAP_A64_LRCPC         = 1 << 15,
568     ARM_HWCAP_A64_DCPOP         = 1 << 16,
569     ARM_HWCAP_A64_SHA3          = 1 << 17,
570     ARM_HWCAP_A64_SM3           = 1 << 18,
571     ARM_HWCAP_A64_SM4           = 1 << 19,
572     ARM_HWCAP_A64_ASIMDDP       = 1 << 20,
573     ARM_HWCAP_A64_SHA512        = 1 << 21,
574     ARM_HWCAP_A64_SVE           = 1 << 22,
575     ARM_HWCAP_A64_ASIMDFHM      = 1 << 23,
576     ARM_HWCAP_A64_DIT           = 1 << 24,
577     ARM_HWCAP_A64_USCAT         = 1 << 25,
578     ARM_HWCAP_A64_ILRCPC        = 1 << 26,
579     ARM_HWCAP_A64_FLAGM         = 1 << 27,
580     ARM_HWCAP_A64_SSBS          = 1 << 28,
581     ARM_HWCAP_A64_SB            = 1 << 29,
582     ARM_HWCAP_A64_PACA          = 1 << 30,
583     ARM_HWCAP_A64_PACG          = 1UL << 31,
584 
585     ARM_HWCAP2_A64_DCPODP       = 1 << 0,
586     ARM_HWCAP2_A64_SVE2         = 1 << 1,
587     ARM_HWCAP2_A64_SVEAES       = 1 << 2,
588     ARM_HWCAP2_A64_SVEPMULL     = 1 << 3,
589     ARM_HWCAP2_A64_SVEBITPERM   = 1 << 4,
590     ARM_HWCAP2_A64_SVESHA3      = 1 << 5,
591     ARM_HWCAP2_A64_SVESM4       = 1 << 6,
592     ARM_HWCAP2_A64_FLAGM2       = 1 << 7,
593     ARM_HWCAP2_A64_FRINT        = 1 << 8,
594     ARM_HWCAP2_A64_SVEI8MM      = 1 << 9,
595     ARM_HWCAP2_A64_SVEF32MM     = 1 << 10,
596     ARM_HWCAP2_A64_SVEF64MM     = 1 << 11,
597     ARM_HWCAP2_A64_SVEBF16      = 1 << 12,
598     ARM_HWCAP2_A64_I8MM         = 1 << 13,
599     ARM_HWCAP2_A64_BF16         = 1 << 14,
600     ARM_HWCAP2_A64_DGH          = 1 << 15,
601     ARM_HWCAP2_A64_RNG          = 1 << 16,
602     ARM_HWCAP2_A64_BTI          = 1 << 17,
603     ARM_HWCAP2_A64_MTE          = 1 << 18,
604 };
605 
606 #define ELF_HWCAP   get_elf_hwcap()
607 #define ELF_HWCAP2  get_elf_hwcap2()
608 
609 #define GET_FEATURE_ID(feat, hwcap) \
610     do { if (cpu_isar_feature(feat, cpu)) { hwcaps |= hwcap; } } while (0)
611 
612 static uint32_t get_elf_hwcap(void)
613 {
614     ARMCPU *cpu = ARM_CPU(thread_cpu);
615     uint32_t hwcaps = 0;
616 
617     hwcaps |= ARM_HWCAP_A64_FP;
618     hwcaps |= ARM_HWCAP_A64_ASIMD;
619     hwcaps |= ARM_HWCAP_A64_CPUID;
620 
621     /* probe for the extra features */
622 
623     GET_FEATURE_ID(aa64_aes, ARM_HWCAP_A64_AES);
624     GET_FEATURE_ID(aa64_pmull, ARM_HWCAP_A64_PMULL);
625     GET_FEATURE_ID(aa64_sha1, ARM_HWCAP_A64_SHA1);
626     GET_FEATURE_ID(aa64_sha256, ARM_HWCAP_A64_SHA2);
627     GET_FEATURE_ID(aa64_sha512, ARM_HWCAP_A64_SHA512);
628     GET_FEATURE_ID(aa64_crc32, ARM_HWCAP_A64_CRC32);
629     GET_FEATURE_ID(aa64_sha3, ARM_HWCAP_A64_SHA3);
630     GET_FEATURE_ID(aa64_sm3, ARM_HWCAP_A64_SM3);
631     GET_FEATURE_ID(aa64_sm4, ARM_HWCAP_A64_SM4);
632     GET_FEATURE_ID(aa64_fp16, ARM_HWCAP_A64_FPHP | ARM_HWCAP_A64_ASIMDHP);
633     GET_FEATURE_ID(aa64_atomics, ARM_HWCAP_A64_ATOMICS);
634     GET_FEATURE_ID(aa64_rdm, ARM_HWCAP_A64_ASIMDRDM);
635     GET_FEATURE_ID(aa64_dp, ARM_HWCAP_A64_ASIMDDP);
636     GET_FEATURE_ID(aa64_fcma, ARM_HWCAP_A64_FCMA);
637     GET_FEATURE_ID(aa64_sve, ARM_HWCAP_A64_SVE);
638     GET_FEATURE_ID(aa64_pauth, ARM_HWCAP_A64_PACA | ARM_HWCAP_A64_PACG);
639     GET_FEATURE_ID(aa64_fhm, ARM_HWCAP_A64_ASIMDFHM);
640     GET_FEATURE_ID(aa64_jscvt, ARM_HWCAP_A64_JSCVT);
641     GET_FEATURE_ID(aa64_sb, ARM_HWCAP_A64_SB);
642     GET_FEATURE_ID(aa64_condm_4, ARM_HWCAP_A64_FLAGM);
643     GET_FEATURE_ID(aa64_dcpop, ARM_HWCAP_A64_DCPOP);
644     GET_FEATURE_ID(aa64_rcpc_8_3, ARM_HWCAP_A64_LRCPC);
645     GET_FEATURE_ID(aa64_rcpc_8_4, ARM_HWCAP_A64_ILRCPC);
646 
647     return hwcaps;
648 }
649 
650 static uint32_t get_elf_hwcap2(void)
651 {
652     ARMCPU *cpu = ARM_CPU(thread_cpu);
653     uint32_t hwcaps = 0;
654 
655     GET_FEATURE_ID(aa64_dcpodp, ARM_HWCAP2_A64_DCPODP);
656     GET_FEATURE_ID(aa64_sve2, ARM_HWCAP2_A64_SVE2);
657     GET_FEATURE_ID(aa64_sve2_aes, ARM_HWCAP2_A64_SVEAES);
658     GET_FEATURE_ID(aa64_sve2_pmull128, ARM_HWCAP2_A64_SVEPMULL);
659     GET_FEATURE_ID(aa64_sve2_bitperm, ARM_HWCAP2_A64_SVEBITPERM);
660     GET_FEATURE_ID(aa64_sve2_sha3, ARM_HWCAP2_A64_SVESHA3);
661     GET_FEATURE_ID(aa64_sve2_sm4, ARM_HWCAP2_A64_SVESM4);
662     GET_FEATURE_ID(aa64_condm_5, ARM_HWCAP2_A64_FLAGM2);
663     GET_FEATURE_ID(aa64_frint, ARM_HWCAP2_A64_FRINT);
664     GET_FEATURE_ID(aa64_sve_i8mm, ARM_HWCAP2_A64_SVEI8MM);
665     GET_FEATURE_ID(aa64_sve_f32mm, ARM_HWCAP2_A64_SVEF32MM);
666     GET_FEATURE_ID(aa64_sve_f64mm, ARM_HWCAP2_A64_SVEF64MM);
667     GET_FEATURE_ID(aa64_sve_bf16, ARM_HWCAP2_A64_SVEBF16);
668     GET_FEATURE_ID(aa64_i8mm, ARM_HWCAP2_A64_I8MM);
669     GET_FEATURE_ID(aa64_bf16, ARM_HWCAP2_A64_BF16);
670     GET_FEATURE_ID(aa64_rndr, ARM_HWCAP2_A64_RNG);
671     GET_FEATURE_ID(aa64_bti, ARM_HWCAP2_A64_BTI);
672     GET_FEATURE_ID(aa64_mte, ARM_HWCAP2_A64_MTE);
673 
674     return hwcaps;
675 }
676 
677 #undef GET_FEATURE_ID
678 
679 #endif /* not TARGET_AARCH64 */
680 #endif /* TARGET_ARM */
681 
682 #ifdef TARGET_SPARC
683 #ifdef TARGET_SPARC64
684 
685 #define ELF_START_MMAP 0x80000000
686 #define ELF_HWCAP  (HWCAP_SPARC_FLUSH | HWCAP_SPARC_STBAR | HWCAP_SPARC_SWAP \
687                     | HWCAP_SPARC_MULDIV | HWCAP_SPARC_V9)
688 #ifndef TARGET_ABI32
689 #define elf_check_arch(x) ( (x) == EM_SPARCV9 || (x) == EM_SPARC32PLUS )
690 #else
691 #define elf_check_arch(x) ( (x) == EM_SPARC32PLUS || (x) == EM_SPARC )
692 #endif
693 
694 #define ELF_CLASS   ELFCLASS64
695 #define ELF_ARCH    EM_SPARCV9
696 #else
697 #define ELF_START_MMAP 0x80000000
698 #define ELF_HWCAP  (HWCAP_SPARC_FLUSH | HWCAP_SPARC_STBAR | HWCAP_SPARC_SWAP \
699                     | HWCAP_SPARC_MULDIV)
700 #define ELF_CLASS   ELFCLASS32
701 #define ELF_ARCH    EM_SPARC
702 #endif /* TARGET_SPARC64 */
703 
704 static inline void init_thread(struct target_pt_regs *regs,
705                                struct image_info *infop)
706 {
707     /* Note that target_cpu_copy_regs does not read psr/tstate. */
708     regs->pc = infop->entry;
709     regs->npc = regs->pc + 4;
710     regs->y = 0;
711     regs->u_regs[14] = (infop->start_stack - 16 * sizeof(abi_ulong)
712                         - TARGET_STACK_BIAS);
713 }
714 #endif /* TARGET_SPARC */
715 
716 #ifdef TARGET_PPC
717 
718 #define ELF_MACHINE    PPC_ELF_MACHINE
719 #define ELF_START_MMAP 0x80000000
720 
721 #if defined(TARGET_PPC64) && !defined(TARGET_ABI32)
722 
723 #define elf_check_arch(x) ( (x) == EM_PPC64 )
724 
725 #define ELF_CLASS       ELFCLASS64
726 
727 #else
728 
729 #define ELF_CLASS       ELFCLASS32
730 
731 #endif
732 
733 #define ELF_ARCH        EM_PPC
734 
735 /* Feature masks for the Aux Vector Hardware Capabilities (AT_HWCAP).
736    See arch/powerpc/include/asm/cputable.h.  */
737 enum {
738     QEMU_PPC_FEATURE_32 = 0x80000000,
739     QEMU_PPC_FEATURE_64 = 0x40000000,
740     QEMU_PPC_FEATURE_601_INSTR = 0x20000000,
741     QEMU_PPC_FEATURE_HAS_ALTIVEC = 0x10000000,
742     QEMU_PPC_FEATURE_HAS_FPU = 0x08000000,
743     QEMU_PPC_FEATURE_HAS_MMU = 0x04000000,
744     QEMU_PPC_FEATURE_HAS_4xxMAC = 0x02000000,
745     QEMU_PPC_FEATURE_UNIFIED_CACHE = 0x01000000,
746     QEMU_PPC_FEATURE_HAS_SPE = 0x00800000,
747     QEMU_PPC_FEATURE_HAS_EFP_SINGLE = 0x00400000,
748     QEMU_PPC_FEATURE_HAS_EFP_DOUBLE = 0x00200000,
749     QEMU_PPC_FEATURE_NO_TB = 0x00100000,
750     QEMU_PPC_FEATURE_POWER4 = 0x00080000,
751     QEMU_PPC_FEATURE_POWER5 = 0x00040000,
752     QEMU_PPC_FEATURE_POWER5_PLUS = 0x00020000,
753     QEMU_PPC_FEATURE_CELL = 0x00010000,
754     QEMU_PPC_FEATURE_BOOKE = 0x00008000,
755     QEMU_PPC_FEATURE_SMT = 0x00004000,
756     QEMU_PPC_FEATURE_ICACHE_SNOOP = 0x00002000,
757     QEMU_PPC_FEATURE_ARCH_2_05 = 0x00001000,
758     QEMU_PPC_FEATURE_PA6T = 0x00000800,
759     QEMU_PPC_FEATURE_HAS_DFP = 0x00000400,
760     QEMU_PPC_FEATURE_POWER6_EXT = 0x00000200,
761     QEMU_PPC_FEATURE_ARCH_2_06 = 0x00000100,
762     QEMU_PPC_FEATURE_HAS_VSX = 0x00000080,
763     QEMU_PPC_FEATURE_PSERIES_PERFMON_COMPAT = 0x00000040,
764 
765     QEMU_PPC_FEATURE_TRUE_LE = 0x00000002,
766     QEMU_PPC_FEATURE_PPC_LE = 0x00000001,
767 
768     /* Feature definitions in AT_HWCAP2.  */
769     QEMU_PPC_FEATURE2_ARCH_2_07 = 0x80000000, /* ISA 2.07 */
770     QEMU_PPC_FEATURE2_HAS_HTM = 0x40000000, /* Hardware Transactional Memory */
771     QEMU_PPC_FEATURE2_HAS_DSCR = 0x20000000, /* Data Stream Control Register */
772     QEMU_PPC_FEATURE2_HAS_EBB = 0x10000000, /* Event Base Branching */
773     QEMU_PPC_FEATURE2_HAS_ISEL = 0x08000000, /* Integer Select */
774     QEMU_PPC_FEATURE2_HAS_TAR = 0x04000000, /* Target Address Register */
775     QEMU_PPC_FEATURE2_VEC_CRYPTO = 0x02000000,
776     QEMU_PPC_FEATURE2_HTM_NOSC = 0x01000000,
777     QEMU_PPC_FEATURE2_ARCH_3_00 = 0x00800000, /* ISA 3.00 */
778     QEMU_PPC_FEATURE2_HAS_IEEE128 = 0x00400000, /* VSX IEEE Bin Float 128-bit */
779     QEMU_PPC_FEATURE2_DARN = 0x00200000, /* darn random number insn */
780     QEMU_PPC_FEATURE2_SCV = 0x00100000, /* scv syscall */
781     QEMU_PPC_FEATURE2_HTM_NO_SUSPEND = 0x00080000, /* TM w/o suspended state */
782 };
783 
784 #define ELF_HWCAP get_elf_hwcap()
785 
786 static uint32_t get_elf_hwcap(void)
787 {
788     PowerPCCPU *cpu = POWERPC_CPU(thread_cpu);
789     uint32_t features = 0;
790 
791     /* We don't have to be terribly complete here; the high points are
792        Altivec/FP/SPE support.  Anything else is just a bonus.  */
793 #define GET_FEATURE(flag, feature)                                      \
794     do { if (cpu->env.insns_flags & flag) { features |= feature; } } while (0)
795 #define GET_FEATURE2(flags, feature) \
796     do { \
797         if ((cpu->env.insns_flags2 & flags) == flags) { \
798             features |= feature; \
799         } \
800     } while (0)
801     GET_FEATURE(PPC_64B, QEMU_PPC_FEATURE_64);
802     GET_FEATURE(PPC_FLOAT, QEMU_PPC_FEATURE_HAS_FPU);
803     GET_FEATURE(PPC_ALTIVEC, QEMU_PPC_FEATURE_HAS_ALTIVEC);
804     GET_FEATURE(PPC_SPE, QEMU_PPC_FEATURE_HAS_SPE);
805     GET_FEATURE(PPC_SPE_SINGLE, QEMU_PPC_FEATURE_HAS_EFP_SINGLE);
806     GET_FEATURE(PPC_SPE_DOUBLE, QEMU_PPC_FEATURE_HAS_EFP_DOUBLE);
807     GET_FEATURE(PPC_BOOKE, QEMU_PPC_FEATURE_BOOKE);
808     GET_FEATURE(PPC_405_MAC, QEMU_PPC_FEATURE_HAS_4xxMAC);
809     GET_FEATURE2(PPC2_DFP, QEMU_PPC_FEATURE_HAS_DFP);
810     GET_FEATURE2(PPC2_VSX, QEMU_PPC_FEATURE_HAS_VSX);
811     GET_FEATURE2((PPC2_PERM_ISA206 | PPC2_DIVE_ISA206 | PPC2_ATOMIC_ISA206 |
812                   PPC2_FP_CVT_ISA206 | PPC2_FP_TST_ISA206),
813                   QEMU_PPC_FEATURE_ARCH_2_06);
814 #undef GET_FEATURE
815 #undef GET_FEATURE2
816 
817     return features;
818 }
819 
820 #define ELF_HWCAP2 get_elf_hwcap2()
821 
822 static uint32_t get_elf_hwcap2(void)
823 {
824     PowerPCCPU *cpu = POWERPC_CPU(thread_cpu);
825     uint32_t features = 0;
826 
827 #define GET_FEATURE(flag, feature)                                      \
828     do { if (cpu->env.insns_flags & flag) { features |= feature; } } while (0)
829 #define GET_FEATURE2(flag, feature)                                      \
830     do { if (cpu->env.insns_flags2 & flag) { features |= feature; } } while (0)
831 
832     GET_FEATURE(PPC_ISEL, QEMU_PPC_FEATURE2_HAS_ISEL);
833     GET_FEATURE2(PPC2_BCTAR_ISA207, QEMU_PPC_FEATURE2_HAS_TAR);
834     GET_FEATURE2((PPC2_BCTAR_ISA207 | PPC2_LSQ_ISA207 | PPC2_ALTIVEC_207 |
835                   PPC2_ISA207S), QEMU_PPC_FEATURE2_ARCH_2_07 |
836                   QEMU_PPC_FEATURE2_VEC_CRYPTO);
837     GET_FEATURE2(PPC2_ISA300, QEMU_PPC_FEATURE2_ARCH_3_00 |
838                  QEMU_PPC_FEATURE2_DARN | QEMU_PPC_FEATURE2_HAS_IEEE128);
839 
840 #undef GET_FEATURE
841 #undef GET_FEATURE2
842 
843     return features;
844 }
845 
846 /*
847  * The requirements here are:
848  * - keep the final alignment of sp (sp & 0xf)
849  * - make sure the 32-bit value at the first 16 byte aligned position of
850  *   AUXV is greater than 16 for glibc compatibility.
851  *   AT_IGNOREPPC is used for that.
852  * - for compatibility with glibc ARCH_DLINFO must always be defined on PPC,
853  *   even if DLINFO_ARCH_ITEMS goes to zero or is undefined.
854  */
855 #define DLINFO_ARCH_ITEMS       5
856 #define ARCH_DLINFO                                     \
857     do {                                                \
858         PowerPCCPU *cpu = POWERPC_CPU(thread_cpu);              \
859         /*                                              \
860          * Handle glibc compatibility: these magic entries must \
861          * be at the lowest addresses in the final auxv.        \
862          */                                             \
863         NEW_AUX_ENT(AT_IGNOREPPC, AT_IGNOREPPC);        \
864         NEW_AUX_ENT(AT_IGNOREPPC, AT_IGNOREPPC);        \
865         NEW_AUX_ENT(AT_DCACHEBSIZE, cpu->env.dcache_line_size); \
866         NEW_AUX_ENT(AT_ICACHEBSIZE, cpu->env.icache_line_size); \
867         NEW_AUX_ENT(AT_UCACHEBSIZE, 0);                 \
868     } while (0)
869 
870 static inline void init_thread(struct target_pt_regs *_regs, struct image_info *infop)
871 {
872     _regs->gpr[1] = infop->start_stack;
873 #if defined(TARGET_PPC64) && !defined(TARGET_ABI32)
874     if (get_ppc64_abi(infop) < 2) {
875         uint64_t val;
876         get_user_u64(val, infop->entry + 8);
877         _regs->gpr[2] = val + infop->load_bias;
878         get_user_u64(val, infop->entry);
879         infop->entry = val + infop->load_bias;
880     } else {
881         _regs->gpr[12] = infop->entry;  /* r12 set to global entry address */
882     }
883 #endif
884     _regs->nip = infop->entry;
885 }
886 
887 /* See linux kernel: arch/powerpc/include/asm/elf.h.  */
888 #define ELF_NREG 48
889 typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG];
890 
891 static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUPPCState *env)
892 {
893     int i;
894     target_ulong ccr = 0;
895 
896     for (i = 0; i < ARRAY_SIZE(env->gpr); i++) {
897         (*regs)[i] = tswapreg(env->gpr[i]);
898     }
899 
900     (*regs)[32] = tswapreg(env->nip);
901     (*regs)[33] = tswapreg(env->msr);
902     (*regs)[35] = tswapreg(env->ctr);
903     (*regs)[36] = tswapreg(env->lr);
904     (*regs)[37] = tswapreg(cpu_read_xer(env));
905 
906     for (i = 0; i < ARRAY_SIZE(env->crf); i++) {
907         ccr |= env->crf[i] << (32 - ((i + 1) * 4));
908     }
909     (*regs)[38] = tswapreg(ccr);
910 }
911 
912 #define USE_ELF_CORE_DUMP
913 #define ELF_EXEC_PAGESIZE       4096
914 
915 #endif
916 
917 #ifdef TARGET_MIPS
918 
919 #define ELF_START_MMAP 0x80000000
920 
921 #ifdef TARGET_MIPS64
922 #define ELF_CLASS   ELFCLASS64
923 #else
924 #define ELF_CLASS   ELFCLASS32
925 #endif
926 #define ELF_ARCH    EM_MIPS
927 
928 #ifdef TARGET_ABI_MIPSN32
929 #define elf_check_abi(x) ((x) & EF_MIPS_ABI2)
930 #else
931 #define elf_check_abi(x) (!((x) & EF_MIPS_ABI2))
932 #endif
933 
934 static inline void init_thread(struct target_pt_regs *regs,
935                                struct image_info *infop)
936 {
937     regs->cp0_status = 2 << CP0St_KSU;
938     regs->cp0_epc = infop->entry;
939     regs->regs[29] = infop->start_stack;
940 }
941 
942 /* See linux kernel: arch/mips/include/asm/elf.h.  */
943 #define ELF_NREG 45
944 typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG];
945 
946 /* See linux kernel: arch/mips/include/asm/reg.h.  */
947 enum {
948 #ifdef TARGET_MIPS64
949     TARGET_EF_R0 = 0,
950 #else
951     TARGET_EF_R0 = 6,
952 #endif
953     TARGET_EF_R26 = TARGET_EF_R0 + 26,
954     TARGET_EF_R27 = TARGET_EF_R0 + 27,
955     TARGET_EF_LO = TARGET_EF_R0 + 32,
956     TARGET_EF_HI = TARGET_EF_R0 + 33,
957     TARGET_EF_CP0_EPC = TARGET_EF_R0 + 34,
958     TARGET_EF_CP0_BADVADDR = TARGET_EF_R0 + 35,
959     TARGET_EF_CP0_STATUS = TARGET_EF_R0 + 36,
960     TARGET_EF_CP0_CAUSE = TARGET_EF_R0 + 37
961 };
962 
963 /* See linux kernel: arch/mips/kernel/process.c:elf_dump_regs.  */
964 static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUMIPSState *env)
965 {
966     int i;
967 
968     for (i = 0; i < TARGET_EF_R0; i++) {
969         (*regs)[i] = 0;
970     }
971     (*regs)[TARGET_EF_R0] = 0;
972 
973     for (i = 1; i < ARRAY_SIZE(env->active_tc.gpr); i++) {
974         (*regs)[TARGET_EF_R0 + i] = tswapreg(env->active_tc.gpr[i]);
975     }
976 
977     (*regs)[TARGET_EF_R26] = 0;
978     (*regs)[TARGET_EF_R27] = 0;
979     (*regs)[TARGET_EF_LO] = tswapreg(env->active_tc.LO[0]);
980     (*regs)[TARGET_EF_HI] = tswapreg(env->active_tc.HI[0]);
981     (*regs)[TARGET_EF_CP0_EPC] = tswapreg(env->active_tc.PC);
982     (*regs)[TARGET_EF_CP0_BADVADDR] = tswapreg(env->CP0_BadVAddr);
983     (*regs)[TARGET_EF_CP0_STATUS] = tswapreg(env->CP0_Status);
984     (*regs)[TARGET_EF_CP0_CAUSE] = tswapreg(env->CP0_Cause);
985 }
986 
987 #define USE_ELF_CORE_DUMP
988 #define ELF_EXEC_PAGESIZE        4096
989 
990 /* See arch/mips/include/uapi/asm/hwcap.h.  */
991 enum {
992     HWCAP_MIPS_R6           = (1 << 0),
993     HWCAP_MIPS_MSA          = (1 << 1),
994     HWCAP_MIPS_CRC32        = (1 << 2),
995     HWCAP_MIPS_MIPS16       = (1 << 3),
996     HWCAP_MIPS_MDMX         = (1 << 4),
997     HWCAP_MIPS_MIPS3D       = (1 << 5),
998     HWCAP_MIPS_SMARTMIPS    = (1 << 6),
999     HWCAP_MIPS_DSP          = (1 << 7),
1000     HWCAP_MIPS_DSP2         = (1 << 8),
1001     HWCAP_MIPS_DSP3         = (1 << 9),
1002     HWCAP_MIPS_MIPS16E2     = (1 << 10),
1003     HWCAP_LOONGSON_MMI      = (1 << 11),
1004     HWCAP_LOONGSON_EXT      = (1 << 12),
1005     HWCAP_LOONGSON_EXT2     = (1 << 13),
1006     HWCAP_LOONGSON_CPUCFG   = (1 << 14),
1007 };
1008 
1009 #define ELF_HWCAP get_elf_hwcap()
1010 
1011 #define GET_FEATURE_INSN(_flag, _hwcap) \
1012     do { if (cpu->env.insn_flags & (_flag)) { hwcaps |= _hwcap; } } while (0)
1013 
1014 #define GET_FEATURE_REG_SET(_reg, _mask, _hwcap) \
1015     do { if (cpu->env._reg & (_mask)) { hwcaps |= _hwcap; } } while (0)
1016 
1017 #define GET_FEATURE_REG_EQU(_reg, _start, _length, _val, _hwcap) \
1018     do { \
1019         if (extract32(cpu->env._reg, (_start), (_length)) == (_val)) { \
1020             hwcaps |= _hwcap; \
1021         } \
1022     } while (0)
1023 
1024 static uint32_t get_elf_hwcap(void)
1025 {
1026     MIPSCPU *cpu = MIPS_CPU(thread_cpu);
1027     uint32_t hwcaps = 0;
1028 
1029     GET_FEATURE_REG_EQU(CP0_Config0, CP0C0_AR, CP0C0_AR_LENGTH,
1030                         2, HWCAP_MIPS_R6);
1031     GET_FEATURE_REG_SET(CP0_Config3, 1 << CP0C3_MSAP, HWCAP_MIPS_MSA);
1032     GET_FEATURE_INSN(ASE_LMMI, HWCAP_LOONGSON_MMI);
1033     GET_FEATURE_INSN(ASE_LEXT, HWCAP_LOONGSON_EXT);
1034 
1035     return hwcaps;
1036 }
1037 
1038 #undef GET_FEATURE_REG_EQU
1039 #undef GET_FEATURE_REG_SET
1040 #undef GET_FEATURE_INSN
1041 
1042 #endif /* TARGET_MIPS */
1043 
1044 #ifdef TARGET_MICROBLAZE
1045 
1046 #define ELF_START_MMAP 0x80000000
1047 
1048 #define elf_check_arch(x) ( (x) == EM_MICROBLAZE || (x) == EM_MICROBLAZE_OLD)
1049 
1050 #define ELF_CLASS   ELFCLASS32
1051 #define ELF_ARCH    EM_MICROBLAZE
1052 
1053 static inline void init_thread(struct target_pt_regs *regs,
1054                                struct image_info *infop)
1055 {
1056     regs->pc = infop->entry;
1057     regs->r1 = infop->start_stack;
1058 
1059 }
1060 
1061 #define ELF_EXEC_PAGESIZE        4096
1062 
1063 #define USE_ELF_CORE_DUMP
1064 #define ELF_NREG 38
1065 typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG];
1066 
1067 /* See linux kernel: arch/mips/kernel/process.c:elf_dump_regs.  */
1068 static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUMBState *env)
1069 {
1070     int i, pos = 0;
1071 
1072     for (i = 0; i < 32; i++) {
1073         (*regs)[pos++] = tswapreg(env->regs[i]);
1074     }
1075 
1076     (*regs)[pos++] = tswapreg(env->pc);
1077     (*regs)[pos++] = tswapreg(mb_cpu_read_msr(env));
1078     (*regs)[pos++] = 0;
1079     (*regs)[pos++] = tswapreg(env->ear);
1080     (*regs)[pos++] = 0;
1081     (*regs)[pos++] = tswapreg(env->esr);
1082 }
1083 
1084 #endif /* TARGET_MICROBLAZE */
1085 
1086 #ifdef TARGET_NIOS2
1087 
1088 #define ELF_START_MMAP 0x80000000
1089 
1090 #define elf_check_arch(x) ((x) == EM_ALTERA_NIOS2)
1091 
1092 #define ELF_CLASS   ELFCLASS32
1093 #define ELF_ARCH    EM_ALTERA_NIOS2
1094 
1095 static void init_thread(struct target_pt_regs *regs, struct image_info *infop)
1096 {
1097     regs->ea = infop->entry;
1098     regs->sp = infop->start_stack;
1099     regs->estatus = 0x3;
1100 }
1101 
1102 #define ELF_EXEC_PAGESIZE        4096
1103 
1104 #define USE_ELF_CORE_DUMP
1105 #define ELF_NREG 49
1106 typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG];
1107 
1108 /* See linux kernel: arch/mips/kernel/process.c:elf_dump_regs.  */
1109 static void elf_core_copy_regs(target_elf_gregset_t *regs,
1110                                const CPUNios2State *env)
1111 {
1112     int i;
1113 
1114     (*regs)[0] = -1;
1115     for (i = 1; i < 8; i++)    /* r0-r7 */
1116         (*regs)[i] = tswapreg(env->regs[i + 7]);
1117 
1118     for (i = 8; i < 16; i++)   /* r8-r15 */
1119         (*regs)[i] = tswapreg(env->regs[i - 8]);
1120 
1121     for (i = 16; i < 24; i++)  /* r16-r23 */
1122         (*regs)[i] = tswapreg(env->regs[i + 7]);
1123     (*regs)[24] = -1;    /* R_ET */
1124     (*regs)[25] = -1;    /* R_BT */
1125     (*regs)[26] = tswapreg(env->regs[R_GP]);
1126     (*regs)[27] = tswapreg(env->regs[R_SP]);
1127     (*regs)[28] = tswapreg(env->regs[R_FP]);
1128     (*regs)[29] = tswapreg(env->regs[R_EA]);
1129     (*regs)[30] = -1;    /* R_SSTATUS */
1130     (*regs)[31] = tswapreg(env->regs[R_RA]);
1131 
1132     (*regs)[32] = tswapreg(env->regs[R_PC]);
1133 
1134     (*regs)[33] = -1; /* R_STATUS */
1135     (*regs)[34] = tswapreg(env->regs[CR_ESTATUS]);
1136 
1137     for (i = 35; i < 49; i++)    /* ... */
1138         (*regs)[i] = -1;
1139 }
1140 
1141 #endif /* TARGET_NIOS2 */
1142 
1143 #ifdef TARGET_OPENRISC
1144 
1145 #define ELF_START_MMAP 0x08000000
1146 
1147 #define ELF_ARCH EM_OPENRISC
1148 #define ELF_CLASS ELFCLASS32
1149 #define ELF_DATA  ELFDATA2MSB
1150 
1151 static inline void init_thread(struct target_pt_regs *regs,
1152                                struct image_info *infop)
1153 {
1154     regs->pc = infop->entry;
1155     regs->gpr[1] = infop->start_stack;
1156 }
1157 
1158 #define USE_ELF_CORE_DUMP
1159 #define ELF_EXEC_PAGESIZE 8192
1160 
1161 /* See linux kernel arch/openrisc/include/asm/elf.h.  */
1162 #define ELF_NREG 34 /* gprs and pc, sr */
1163 typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG];
1164 
1165 static void elf_core_copy_regs(target_elf_gregset_t *regs,
1166                                const CPUOpenRISCState *env)
1167 {
1168     int i;
1169 
1170     for (i = 0; i < 32; i++) {
1171         (*regs)[i] = tswapreg(cpu_get_gpr(env, i));
1172     }
1173     (*regs)[32] = tswapreg(env->pc);
1174     (*regs)[33] = tswapreg(cpu_get_sr(env));
1175 }
1176 #define ELF_HWCAP 0
1177 #define ELF_PLATFORM NULL
1178 
1179 #endif /* TARGET_OPENRISC */
1180 
1181 #ifdef TARGET_SH4
1182 
1183 #define ELF_START_MMAP 0x80000000
1184 
1185 #define ELF_CLASS ELFCLASS32
1186 #define ELF_ARCH  EM_SH
1187 
1188 static inline void init_thread(struct target_pt_regs *regs,
1189                                struct image_info *infop)
1190 {
1191     /* Check other registers XXXXX */
1192     regs->pc = infop->entry;
1193     regs->regs[15] = infop->start_stack;
1194 }
1195 
1196 /* See linux kernel: arch/sh/include/asm/elf.h.  */
1197 #define ELF_NREG 23
1198 typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG];
1199 
1200 /* See linux kernel: arch/sh/include/asm/ptrace.h.  */
1201 enum {
1202     TARGET_REG_PC = 16,
1203     TARGET_REG_PR = 17,
1204     TARGET_REG_SR = 18,
1205     TARGET_REG_GBR = 19,
1206     TARGET_REG_MACH = 20,
1207     TARGET_REG_MACL = 21,
1208     TARGET_REG_SYSCALL = 22
1209 };
1210 
1211 static inline void elf_core_copy_regs(target_elf_gregset_t *regs,
1212                                       const CPUSH4State *env)
1213 {
1214     int i;
1215 
1216     for (i = 0; i < 16; i++) {
1217         (*regs)[i] = tswapreg(env->gregs[i]);
1218     }
1219 
1220     (*regs)[TARGET_REG_PC] = tswapreg(env->pc);
1221     (*regs)[TARGET_REG_PR] = tswapreg(env->pr);
1222     (*regs)[TARGET_REG_SR] = tswapreg(env->sr);
1223     (*regs)[TARGET_REG_GBR] = tswapreg(env->gbr);
1224     (*regs)[TARGET_REG_MACH] = tswapreg(env->mach);
1225     (*regs)[TARGET_REG_MACL] = tswapreg(env->macl);
1226     (*regs)[TARGET_REG_SYSCALL] = 0; /* FIXME */
1227 }
1228 
1229 #define USE_ELF_CORE_DUMP
1230 #define ELF_EXEC_PAGESIZE        4096
1231 
1232 enum {
1233     SH_CPU_HAS_FPU            = 0x0001, /* Hardware FPU support */
1234     SH_CPU_HAS_P2_FLUSH_BUG   = 0x0002, /* Need to flush the cache in P2 area */
1235     SH_CPU_HAS_MMU_PAGE_ASSOC = 0x0004, /* SH3: TLB way selection bit support */
1236     SH_CPU_HAS_DSP            = 0x0008, /* SH-DSP: DSP support */
1237     SH_CPU_HAS_PERF_COUNTER   = 0x0010, /* Hardware performance counters */
1238     SH_CPU_HAS_PTEA           = 0x0020, /* PTEA register */
1239     SH_CPU_HAS_LLSC           = 0x0040, /* movli.l/movco.l */
1240     SH_CPU_HAS_L2_CACHE       = 0x0080, /* Secondary cache / URAM */
1241     SH_CPU_HAS_OP32           = 0x0100, /* 32-bit instruction support */
1242     SH_CPU_HAS_PTEAEX         = 0x0200, /* PTE ASID Extension support */
1243 };
1244 
1245 #define ELF_HWCAP get_elf_hwcap()
1246 
1247 static uint32_t get_elf_hwcap(void)
1248 {
1249     SuperHCPU *cpu = SUPERH_CPU(thread_cpu);
1250     uint32_t hwcap = 0;
1251 
1252     hwcap |= SH_CPU_HAS_FPU;
1253 
1254     if (cpu->env.features & SH_FEATURE_SH4A) {
1255         hwcap |= SH_CPU_HAS_LLSC;
1256     }
1257 
1258     return hwcap;
1259 }
1260 
1261 #endif
1262 
1263 #ifdef TARGET_CRIS
1264 
1265 #define ELF_START_MMAP 0x80000000
1266 
1267 #define ELF_CLASS ELFCLASS32
1268 #define ELF_ARCH  EM_CRIS
1269 
1270 static inline void init_thread(struct target_pt_regs *regs,
1271                                struct image_info *infop)
1272 {
1273     regs->erp = infop->entry;
1274 }
1275 
1276 #define ELF_EXEC_PAGESIZE        8192
1277 
1278 #endif
1279 
1280 #ifdef TARGET_M68K
1281 
1282 #define ELF_START_MMAP 0x80000000
1283 
1284 #define ELF_CLASS       ELFCLASS32
1285 #define ELF_ARCH        EM_68K
1286 
1287 /* ??? Does this need to do anything?
1288    #define ELF_PLAT_INIT(_r) */
1289 
1290 static inline void init_thread(struct target_pt_regs *regs,
1291                                struct image_info *infop)
1292 {
1293     regs->usp = infop->start_stack;
1294     regs->sr = 0;
1295     regs->pc = infop->entry;
1296 }
1297 
1298 /* See linux kernel: arch/m68k/include/asm/elf.h.  */
1299 #define ELF_NREG 20
1300 typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG];
1301 
1302 static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUM68KState *env)
1303 {
1304     (*regs)[0] = tswapreg(env->dregs[1]);
1305     (*regs)[1] = tswapreg(env->dregs[2]);
1306     (*regs)[2] = tswapreg(env->dregs[3]);
1307     (*regs)[3] = tswapreg(env->dregs[4]);
1308     (*regs)[4] = tswapreg(env->dregs[5]);
1309     (*regs)[5] = tswapreg(env->dregs[6]);
1310     (*regs)[6] = tswapreg(env->dregs[7]);
1311     (*regs)[7] = tswapreg(env->aregs[0]);
1312     (*regs)[8] = tswapreg(env->aregs[1]);
1313     (*regs)[9] = tswapreg(env->aregs[2]);
1314     (*regs)[10] = tswapreg(env->aregs[3]);
1315     (*regs)[11] = tswapreg(env->aregs[4]);
1316     (*regs)[12] = tswapreg(env->aregs[5]);
1317     (*regs)[13] = tswapreg(env->aregs[6]);
1318     (*regs)[14] = tswapreg(env->dregs[0]);
1319     (*regs)[15] = tswapreg(env->aregs[7]);
1320     (*regs)[16] = tswapreg(env->dregs[0]); /* FIXME: orig_d0 */
1321     (*regs)[17] = tswapreg(env->sr);
1322     (*regs)[18] = tswapreg(env->pc);
1323     (*regs)[19] = 0;  /* FIXME: regs->format | regs->vector */
1324 }
1325 
1326 #define USE_ELF_CORE_DUMP
1327 #define ELF_EXEC_PAGESIZE       8192
1328 
1329 #endif
1330 
1331 #ifdef TARGET_ALPHA
1332 
1333 #define ELF_START_MMAP (0x30000000000ULL)
1334 
1335 #define ELF_CLASS      ELFCLASS64
1336 #define ELF_ARCH       EM_ALPHA
1337 
1338 static inline void init_thread(struct target_pt_regs *regs,
1339                                struct image_info *infop)
1340 {
1341     regs->pc = infop->entry;
1342     regs->ps = 8;
1343     regs->usp = infop->start_stack;
1344 }
1345 
1346 #define ELF_EXEC_PAGESIZE        8192
1347 
1348 #endif /* TARGET_ALPHA */
1349 
1350 #ifdef TARGET_S390X
1351 
1352 #define ELF_START_MMAP (0x20000000000ULL)
1353 
1354 #define ELF_CLASS	ELFCLASS64
1355 #define ELF_DATA	ELFDATA2MSB
1356 #define ELF_ARCH	EM_S390
1357 
1358 #include "elf.h"
1359 
1360 #define ELF_HWCAP get_elf_hwcap()
1361 
1362 #define GET_FEATURE(_feat, _hwcap) \
1363     do { if (s390_has_feat(_feat)) { hwcap |= _hwcap; } } while (0)
1364 
1365 static uint32_t get_elf_hwcap(void)
1366 {
1367     /*
1368      * Let's assume we always have esan3 and zarch.
1369      * 31-bit processes can use 64-bit registers (high gprs).
1370      */
1371     uint32_t hwcap = HWCAP_S390_ESAN3 | HWCAP_S390_ZARCH | HWCAP_S390_HIGH_GPRS;
1372 
1373     GET_FEATURE(S390_FEAT_STFLE, HWCAP_S390_STFLE);
1374     GET_FEATURE(S390_FEAT_MSA, HWCAP_S390_MSA);
1375     GET_FEATURE(S390_FEAT_LONG_DISPLACEMENT, HWCAP_S390_LDISP);
1376     GET_FEATURE(S390_FEAT_EXTENDED_IMMEDIATE, HWCAP_S390_EIMM);
1377     if (s390_has_feat(S390_FEAT_EXTENDED_TRANSLATION_3) &&
1378         s390_has_feat(S390_FEAT_ETF3_ENH)) {
1379         hwcap |= HWCAP_S390_ETF3EH;
1380     }
1381     GET_FEATURE(S390_FEAT_VECTOR, HWCAP_S390_VXRS);
1382     GET_FEATURE(S390_FEAT_VECTOR_ENH, HWCAP_S390_VXRS_EXT);
1383 
1384     return hwcap;
1385 }
1386 
1387 static inline void init_thread(struct target_pt_regs *regs, struct image_info *infop)
1388 {
1389     regs->psw.addr = infop->entry;
1390     regs->psw.mask = PSW_MASK_64 | PSW_MASK_32;
1391     regs->gprs[15] = infop->start_stack;
1392 }
1393 
1394 /* See linux kernel: arch/s390/include/uapi/asm/ptrace.h (s390_regs).  */
1395 #define ELF_NREG 27
1396 typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG];
1397 
1398 enum {
1399     TARGET_REG_PSWM = 0,
1400     TARGET_REG_PSWA = 1,
1401     TARGET_REG_GPRS = 2,
1402     TARGET_REG_ARS = 18,
1403     TARGET_REG_ORIG_R2 = 26,
1404 };
1405 
1406 static void elf_core_copy_regs(target_elf_gregset_t *regs,
1407                                const CPUS390XState *env)
1408 {
1409     int i;
1410     uint32_t *aregs;
1411 
1412     (*regs)[TARGET_REG_PSWM] = tswapreg(env->psw.mask);
1413     (*regs)[TARGET_REG_PSWA] = tswapreg(env->psw.addr);
1414     for (i = 0; i < 16; i++) {
1415         (*regs)[TARGET_REG_GPRS + i] = tswapreg(env->regs[i]);
1416     }
1417     aregs = (uint32_t *)&((*regs)[TARGET_REG_ARS]);
1418     for (i = 0; i < 16; i++) {
1419         aregs[i] = tswap32(env->aregs[i]);
1420     }
1421     (*regs)[TARGET_REG_ORIG_R2] = 0;
1422 }
1423 
1424 #define USE_ELF_CORE_DUMP
1425 #define ELF_EXEC_PAGESIZE 4096
1426 
1427 #endif /* TARGET_S390X */
1428 
1429 #ifdef TARGET_RISCV
1430 
1431 #define ELF_START_MMAP 0x80000000
1432 #define ELF_ARCH  EM_RISCV
1433 
1434 #ifdef TARGET_RISCV32
1435 #define ELF_CLASS ELFCLASS32
1436 #else
1437 #define ELF_CLASS ELFCLASS64
1438 #endif
1439 
1440 #define ELF_HWCAP get_elf_hwcap()
1441 
1442 static uint32_t get_elf_hwcap(void)
1443 {
1444 #define MISA_BIT(EXT) (1 << (EXT - 'A'))
1445     RISCVCPU *cpu = RISCV_CPU(thread_cpu);
1446     uint32_t mask = MISA_BIT('I') | MISA_BIT('M') | MISA_BIT('A')
1447                     | MISA_BIT('F') | MISA_BIT('D') | MISA_BIT('C');
1448 
1449     return cpu->env.misa_ext & mask;
1450 #undef MISA_BIT
1451 }
1452 
1453 static inline void init_thread(struct target_pt_regs *regs,
1454                                struct image_info *infop)
1455 {
1456     regs->sepc = infop->entry;
1457     regs->sp = infop->start_stack;
1458 }
1459 
1460 #define ELF_EXEC_PAGESIZE 4096
1461 
1462 #endif /* TARGET_RISCV */
1463 
1464 #ifdef TARGET_HPPA
1465 
1466 #define ELF_START_MMAP  0x80000000
1467 #define ELF_CLASS       ELFCLASS32
1468 #define ELF_ARCH        EM_PARISC
1469 #define ELF_PLATFORM    "PARISC"
1470 #define STACK_GROWS_DOWN 0
1471 #define STACK_ALIGNMENT  64
1472 
1473 static inline void init_thread(struct target_pt_regs *regs,
1474                                struct image_info *infop)
1475 {
1476     regs->iaoq[0] = infop->entry;
1477     regs->iaoq[1] = infop->entry + 4;
1478     regs->gr[23] = 0;
1479     regs->gr[24] = infop->arg_start;
1480     regs->gr[25] = (infop->arg_end - infop->arg_start) / sizeof(abi_ulong);
1481     /* The top-of-stack contains a linkage buffer.  */
1482     regs->gr[30] = infop->start_stack + 64;
1483     regs->gr[31] = infop->entry;
1484 }
1485 
1486 #endif /* TARGET_HPPA */
1487 
1488 #ifdef TARGET_XTENSA
1489 
1490 #define ELF_START_MMAP 0x20000000
1491 
1492 #define ELF_CLASS       ELFCLASS32
1493 #define ELF_ARCH        EM_XTENSA
1494 
1495 static inline void init_thread(struct target_pt_regs *regs,
1496                                struct image_info *infop)
1497 {
1498     regs->windowbase = 0;
1499     regs->windowstart = 1;
1500     regs->areg[1] = infop->start_stack;
1501     regs->pc = infop->entry;
1502 }
1503 
1504 /* See linux kernel: arch/xtensa/include/asm/elf.h.  */
1505 #define ELF_NREG 128
1506 typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG];
1507 
1508 enum {
1509     TARGET_REG_PC,
1510     TARGET_REG_PS,
1511     TARGET_REG_LBEG,
1512     TARGET_REG_LEND,
1513     TARGET_REG_LCOUNT,
1514     TARGET_REG_SAR,
1515     TARGET_REG_WINDOWSTART,
1516     TARGET_REG_WINDOWBASE,
1517     TARGET_REG_THREADPTR,
1518     TARGET_REG_AR0 = 64,
1519 };
1520 
1521 static void elf_core_copy_regs(target_elf_gregset_t *regs,
1522                                const CPUXtensaState *env)
1523 {
1524     unsigned i;
1525 
1526     (*regs)[TARGET_REG_PC] = tswapreg(env->pc);
1527     (*regs)[TARGET_REG_PS] = tswapreg(env->sregs[PS] & ~PS_EXCM);
1528     (*regs)[TARGET_REG_LBEG] = tswapreg(env->sregs[LBEG]);
1529     (*regs)[TARGET_REG_LEND] = tswapreg(env->sregs[LEND]);
1530     (*regs)[TARGET_REG_LCOUNT] = tswapreg(env->sregs[LCOUNT]);
1531     (*regs)[TARGET_REG_SAR] = tswapreg(env->sregs[SAR]);
1532     (*regs)[TARGET_REG_WINDOWSTART] = tswapreg(env->sregs[WINDOW_START]);
1533     (*regs)[TARGET_REG_WINDOWBASE] = tswapreg(env->sregs[WINDOW_BASE]);
1534     (*regs)[TARGET_REG_THREADPTR] = tswapreg(env->uregs[THREADPTR]);
1535     xtensa_sync_phys_from_window((CPUXtensaState *)env);
1536     for (i = 0; i < env->config->nareg; ++i) {
1537         (*regs)[TARGET_REG_AR0 + i] = tswapreg(env->phys_regs[i]);
1538     }
1539 }
1540 
1541 #define USE_ELF_CORE_DUMP
1542 #define ELF_EXEC_PAGESIZE       4096
1543 
1544 #endif /* TARGET_XTENSA */
1545 
1546 #ifdef TARGET_HEXAGON
1547 
1548 #define ELF_START_MMAP 0x20000000
1549 
1550 #define ELF_CLASS       ELFCLASS32
1551 #define ELF_ARCH        EM_HEXAGON
1552 
1553 static inline void init_thread(struct target_pt_regs *regs,
1554                                struct image_info *infop)
1555 {
1556     regs->sepc = infop->entry;
1557     regs->sp = infop->start_stack;
1558 }
1559 
1560 #endif /* TARGET_HEXAGON */
1561 
1562 #ifndef ELF_PLATFORM
1563 #define ELF_PLATFORM (NULL)
1564 #endif
1565 
1566 #ifndef ELF_MACHINE
1567 #define ELF_MACHINE ELF_ARCH
1568 #endif
1569 
1570 #ifndef elf_check_arch
1571 #define elf_check_arch(x) ((x) == ELF_ARCH)
1572 #endif
1573 
1574 #ifndef elf_check_abi
1575 #define elf_check_abi(x) (1)
1576 #endif
1577 
1578 #ifndef ELF_HWCAP
1579 #define ELF_HWCAP 0
1580 #endif
1581 
1582 #ifndef STACK_GROWS_DOWN
1583 #define STACK_GROWS_DOWN 1
1584 #endif
1585 
1586 #ifndef STACK_ALIGNMENT
1587 #define STACK_ALIGNMENT 16
1588 #endif
1589 
1590 #ifdef TARGET_ABI32
1591 #undef ELF_CLASS
1592 #define ELF_CLASS ELFCLASS32
1593 #undef bswaptls
1594 #define bswaptls(ptr) bswap32s(ptr)
1595 #endif
1596 
1597 #include "elf.h"
1598 
1599 /* We must delay the following stanzas until after "elf.h". */
1600 #if defined(TARGET_AARCH64)
1601 
1602 static bool arch_parse_elf_property(uint32_t pr_type, uint32_t pr_datasz,
1603                                     const uint32_t *data,
1604                                     struct image_info *info,
1605                                     Error **errp)
1606 {
1607     if (pr_type == GNU_PROPERTY_AARCH64_FEATURE_1_AND) {
1608         if (pr_datasz != sizeof(uint32_t)) {
1609             error_setg(errp, "Ill-formed GNU_PROPERTY_AARCH64_FEATURE_1_AND");
1610             return false;
1611         }
1612         /* We will extract GNU_PROPERTY_AARCH64_FEATURE_1_BTI later. */
1613         info->note_flags = *data;
1614     }
1615     return true;
1616 }
1617 #define ARCH_USE_GNU_PROPERTY 1
1618 
1619 #else
1620 
1621 static bool arch_parse_elf_property(uint32_t pr_type, uint32_t pr_datasz,
1622                                     const uint32_t *data,
1623                                     struct image_info *info,
1624                                     Error **errp)
1625 {
1626     g_assert_not_reached();
1627 }
1628 #define ARCH_USE_GNU_PROPERTY 0
1629 
1630 #endif
1631 
1632 struct exec
1633 {
1634     unsigned int a_info;   /* Use macros N_MAGIC, etc for access */
1635     unsigned int a_text;   /* length of text, in bytes */
1636     unsigned int a_data;   /* length of data, in bytes */
1637     unsigned int a_bss;    /* length of uninitialized data area, in bytes */
1638     unsigned int a_syms;   /* length of symbol table data in file, in bytes */
1639     unsigned int a_entry;  /* start address */
1640     unsigned int a_trsize; /* length of relocation info for text, in bytes */
1641     unsigned int a_drsize; /* length of relocation info for data, in bytes */
1642 };
1643 
1644 
1645 #define N_MAGIC(exec) ((exec).a_info & 0xffff)
1646 #define OMAGIC 0407
1647 #define NMAGIC 0410
1648 #define ZMAGIC 0413
1649 #define QMAGIC 0314
1650 
1651 /* Necessary parameters */
1652 #define TARGET_ELF_EXEC_PAGESIZE \
1653         (((eppnt->p_align & ~qemu_host_page_mask) != 0) ? \
1654          TARGET_PAGE_SIZE : MAX(qemu_host_page_size, TARGET_PAGE_SIZE))
1655 #define TARGET_ELF_PAGELENGTH(_v) ROUND_UP((_v), TARGET_ELF_EXEC_PAGESIZE)
1656 #define TARGET_ELF_PAGESTART(_v) ((_v) & \
1657                                  ~(abi_ulong)(TARGET_ELF_EXEC_PAGESIZE-1))
1658 #define TARGET_ELF_PAGEOFFSET(_v) ((_v) & (TARGET_ELF_EXEC_PAGESIZE-1))
1659 
1660 #define DLINFO_ITEMS 16
1661 
1662 static inline void memcpy_fromfs(void * to, const void * from, unsigned long n)
1663 {
1664     memcpy(to, from, n);
1665 }
1666 
1667 #ifdef BSWAP_NEEDED
1668 static void bswap_ehdr(struct elfhdr *ehdr)
1669 {
1670     bswap16s(&ehdr->e_type);            /* Object file type */
1671     bswap16s(&ehdr->e_machine);         /* Architecture */
1672     bswap32s(&ehdr->e_version);         /* Object file version */
1673     bswaptls(&ehdr->e_entry);           /* Entry point virtual address */
1674     bswaptls(&ehdr->e_phoff);           /* Program header table file offset */
1675     bswaptls(&ehdr->e_shoff);           /* Section header table file offset */
1676     bswap32s(&ehdr->e_flags);           /* Processor-specific flags */
1677     bswap16s(&ehdr->e_ehsize);          /* ELF header size in bytes */
1678     bswap16s(&ehdr->e_phentsize);       /* Program header table entry size */
1679     bswap16s(&ehdr->e_phnum);           /* Program header table entry count */
1680     bswap16s(&ehdr->e_shentsize);       /* Section header table entry size */
1681     bswap16s(&ehdr->e_shnum);           /* Section header table entry count */
1682     bswap16s(&ehdr->e_shstrndx);        /* Section header string table index */
1683 }
1684 
1685 static void bswap_phdr(struct elf_phdr *phdr, int phnum)
1686 {
1687     int i;
1688     for (i = 0; i < phnum; ++i, ++phdr) {
1689         bswap32s(&phdr->p_type);        /* Segment type */
1690         bswap32s(&phdr->p_flags);       /* Segment flags */
1691         bswaptls(&phdr->p_offset);      /* Segment file offset */
1692         bswaptls(&phdr->p_vaddr);       /* Segment virtual address */
1693         bswaptls(&phdr->p_paddr);       /* Segment physical address */
1694         bswaptls(&phdr->p_filesz);      /* Segment size in file */
1695         bswaptls(&phdr->p_memsz);       /* Segment size in memory */
1696         bswaptls(&phdr->p_align);       /* Segment alignment */
1697     }
1698 }
1699 
1700 static void bswap_shdr(struct elf_shdr *shdr, int shnum)
1701 {
1702     int i;
1703     for (i = 0; i < shnum; ++i, ++shdr) {
1704         bswap32s(&shdr->sh_name);
1705         bswap32s(&shdr->sh_type);
1706         bswaptls(&shdr->sh_flags);
1707         bswaptls(&shdr->sh_addr);
1708         bswaptls(&shdr->sh_offset);
1709         bswaptls(&shdr->sh_size);
1710         bswap32s(&shdr->sh_link);
1711         bswap32s(&shdr->sh_info);
1712         bswaptls(&shdr->sh_addralign);
1713         bswaptls(&shdr->sh_entsize);
1714     }
1715 }
1716 
1717 static void bswap_sym(struct elf_sym *sym)
1718 {
1719     bswap32s(&sym->st_name);
1720     bswaptls(&sym->st_value);
1721     bswaptls(&sym->st_size);
1722     bswap16s(&sym->st_shndx);
1723 }
1724 
1725 #ifdef TARGET_MIPS
1726 static void bswap_mips_abiflags(Mips_elf_abiflags_v0 *abiflags)
1727 {
1728     bswap16s(&abiflags->version);
1729     bswap32s(&abiflags->ases);
1730     bswap32s(&abiflags->isa_ext);
1731     bswap32s(&abiflags->flags1);
1732     bswap32s(&abiflags->flags2);
1733 }
1734 #endif
1735 #else
1736 static inline void bswap_ehdr(struct elfhdr *ehdr) { }
1737 static inline void bswap_phdr(struct elf_phdr *phdr, int phnum) { }
1738 static inline void bswap_shdr(struct elf_shdr *shdr, int shnum) { }
1739 static inline void bswap_sym(struct elf_sym *sym) { }
1740 #ifdef TARGET_MIPS
1741 static inline void bswap_mips_abiflags(Mips_elf_abiflags_v0 *abiflags) { }
1742 #endif
1743 #endif
1744 
1745 #ifdef USE_ELF_CORE_DUMP
1746 static int elf_core_dump(int, const CPUArchState *);
1747 #endif /* USE_ELF_CORE_DUMP */
1748 static void load_symbols(struct elfhdr *hdr, int fd, abi_ulong load_bias);
1749 
1750 /* Verify the portions of EHDR within E_IDENT for the target.
1751    This can be performed before bswapping the entire header.  */
1752 static bool elf_check_ident(struct elfhdr *ehdr)
1753 {
1754     return (ehdr->e_ident[EI_MAG0] == ELFMAG0
1755             && ehdr->e_ident[EI_MAG1] == ELFMAG1
1756             && ehdr->e_ident[EI_MAG2] == ELFMAG2
1757             && ehdr->e_ident[EI_MAG3] == ELFMAG3
1758             && ehdr->e_ident[EI_CLASS] == ELF_CLASS
1759             && ehdr->e_ident[EI_DATA] == ELF_DATA
1760             && ehdr->e_ident[EI_VERSION] == EV_CURRENT);
1761 }
1762 
1763 /* Verify the portions of EHDR outside of E_IDENT for the target.
1764    This has to wait until after bswapping the header.  */
1765 static bool elf_check_ehdr(struct elfhdr *ehdr)
1766 {
1767     return (elf_check_arch(ehdr->e_machine)
1768             && elf_check_abi(ehdr->e_flags)
1769             && ehdr->e_ehsize == sizeof(struct elfhdr)
1770             && ehdr->e_phentsize == sizeof(struct elf_phdr)
1771             && (ehdr->e_type == ET_EXEC || ehdr->e_type == ET_DYN));
1772 }
1773 
1774 /*
1775  * 'copy_elf_strings()' copies argument/envelope strings from user
1776  * memory to free pages in kernel mem. These are in a format ready
1777  * to be put directly into the top of new user memory.
1778  *
1779  */
1780 static abi_ulong copy_elf_strings(int argc, char **argv, char *scratch,
1781                                   abi_ulong p, abi_ulong stack_limit)
1782 {
1783     char *tmp;
1784     int len, i;
1785     abi_ulong top = p;
1786 
1787     if (!p) {
1788         return 0;       /* bullet-proofing */
1789     }
1790 
1791     if (STACK_GROWS_DOWN) {
1792         int offset = ((p - 1) % TARGET_PAGE_SIZE) + 1;
1793         for (i = argc - 1; i >= 0; --i) {
1794             tmp = argv[i];
1795             if (!tmp) {
1796                 fprintf(stderr, "VFS: argc is wrong");
1797                 exit(-1);
1798             }
1799             len = strlen(tmp) + 1;
1800             tmp += len;
1801 
1802             if (len > (p - stack_limit)) {
1803                 return 0;
1804             }
1805             while (len) {
1806                 int bytes_to_copy = (len > offset) ? offset : len;
1807                 tmp -= bytes_to_copy;
1808                 p -= bytes_to_copy;
1809                 offset -= bytes_to_copy;
1810                 len -= bytes_to_copy;
1811 
1812                 memcpy_fromfs(scratch + offset, tmp, bytes_to_copy);
1813 
1814                 if (offset == 0) {
1815                     memcpy_to_target(p, scratch, top - p);
1816                     top = p;
1817                     offset = TARGET_PAGE_SIZE;
1818                 }
1819             }
1820         }
1821         if (p != top) {
1822             memcpy_to_target(p, scratch + offset, top - p);
1823         }
1824     } else {
1825         int remaining = TARGET_PAGE_SIZE - (p % TARGET_PAGE_SIZE);
1826         for (i = 0; i < argc; ++i) {
1827             tmp = argv[i];
1828             if (!tmp) {
1829                 fprintf(stderr, "VFS: argc is wrong");
1830                 exit(-1);
1831             }
1832             len = strlen(tmp) + 1;
1833             if (len > (stack_limit - p)) {
1834                 return 0;
1835             }
1836             while (len) {
1837                 int bytes_to_copy = (len > remaining) ? remaining : len;
1838 
1839                 memcpy_fromfs(scratch + (p - top), tmp, bytes_to_copy);
1840 
1841                 tmp += bytes_to_copy;
1842                 remaining -= bytes_to_copy;
1843                 p += bytes_to_copy;
1844                 len -= bytes_to_copy;
1845 
1846                 if (remaining == 0) {
1847                     memcpy_to_target(top, scratch, p - top);
1848                     top = p;
1849                     remaining = TARGET_PAGE_SIZE;
1850                 }
1851             }
1852         }
1853         if (p != top) {
1854             memcpy_to_target(top, scratch, p - top);
1855         }
1856     }
1857 
1858     return p;
1859 }
1860 
1861 /* Older linux kernels provide up to MAX_ARG_PAGES (default: 32) of
1862  * argument/environment space. Newer kernels (>2.6.33) allow more,
1863  * dependent on stack size, but guarantee at least 32 pages for
1864  * backwards compatibility.
1865  */
1866 #define STACK_LOWER_LIMIT (32 * TARGET_PAGE_SIZE)
1867 
1868 static abi_ulong setup_arg_pages(struct linux_binprm *bprm,
1869                                  struct image_info *info)
1870 {
1871     abi_ulong size, error, guard;
1872 
1873     size = guest_stack_size;
1874     if (size < STACK_LOWER_LIMIT) {
1875         size = STACK_LOWER_LIMIT;
1876     }
1877     guard = TARGET_PAGE_SIZE;
1878     if (guard < qemu_real_host_page_size) {
1879         guard = qemu_real_host_page_size;
1880     }
1881 
1882     error = target_mmap(0, size + guard, PROT_READ | PROT_WRITE,
1883                         MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
1884     if (error == -1) {
1885         perror("mmap stack");
1886         exit(-1);
1887     }
1888 
1889     /* We reserve one extra page at the top of the stack as guard.  */
1890     if (STACK_GROWS_DOWN) {
1891         target_mprotect(error, guard, PROT_NONE);
1892         info->stack_limit = error + guard;
1893         return info->stack_limit + size - sizeof(void *);
1894     } else {
1895         target_mprotect(error + size, guard, PROT_NONE);
1896         info->stack_limit = error + size;
1897         return error;
1898     }
1899 }
1900 
1901 /* Map and zero the bss.  We need to explicitly zero any fractional pages
1902    after the data section (i.e. bss).  */
1903 static void zero_bss(abi_ulong elf_bss, abi_ulong last_bss, int prot)
1904 {
1905     uintptr_t host_start, host_map_start, host_end;
1906 
1907     last_bss = TARGET_PAGE_ALIGN(last_bss);
1908 
1909     /* ??? There is confusion between qemu_real_host_page_size and
1910        qemu_host_page_size here and elsewhere in target_mmap, which
1911        may lead to the end of the data section mapping from the file
1912        not being mapped.  At least there was an explicit test and
1913        comment for that here, suggesting that "the file size must
1914        be known".  The comment probably pre-dates the introduction
1915        of the fstat system call in target_mmap which does in fact
1916        find out the size.  What isn't clear is if the workaround
1917        here is still actually needed.  For now, continue with it,
1918        but merge it with the "normal" mmap that would allocate the bss.  */
1919 
1920     host_start = (uintptr_t) g2h_untagged(elf_bss);
1921     host_end = (uintptr_t) g2h_untagged(last_bss);
1922     host_map_start = REAL_HOST_PAGE_ALIGN(host_start);
1923 
1924     if (host_map_start < host_end) {
1925         void *p = mmap((void *)host_map_start, host_end - host_map_start,
1926                        prot, MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
1927         if (p == MAP_FAILED) {
1928             perror("cannot mmap brk");
1929             exit(-1);
1930         }
1931     }
1932 
1933     /* Ensure that the bss page(s) are valid */
1934     if ((page_get_flags(last_bss-1) & prot) != prot) {
1935         page_set_flags(elf_bss & TARGET_PAGE_MASK, last_bss, prot | PAGE_VALID);
1936     }
1937 
1938     if (host_start < host_map_start) {
1939         memset((void *)host_start, 0, host_map_start - host_start);
1940     }
1941 }
1942 
1943 #ifdef TARGET_ARM
1944 static int elf_is_fdpic(struct elfhdr *exec)
1945 {
1946     return exec->e_ident[EI_OSABI] == ELFOSABI_ARM_FDPIC;
1947 }
1948 #else
1949 /* Default implementation, always false.  */
1950 static int elf_is_fdpic(struct elfhdr *exec)
1951 {
1952     return 0;
1953 }
1954 #endif
1955 
1956 static abi_ulong loader_build_fdpic_loadmap(struct image_info *info, abi_ulong sp)
1957 {
1958     uint16_t n;
1959     struct elf32_fdpic_loadseg *loadsegs = info->loadsegs;
1960 
1961     /* elf32_fdpic_loadseg */
1962     n = info->nsegs;
1963     while (n--) {
1964         sp -= 12;
1965         put_user_u32(loadsegs[n].addr, sp+0);
1966         put_user_u32(loadsegs[n].p_vaddr, sp+4);
1967         put_user_u32(loadsegs[n].p_memsz, sp+8);
1968     }
1969 
1970     /* elf32_fdpic_loadmap */
1971     sp -= 4;
1972     put_user_u16(0, sp+0); /* version */
1973     put_user_u16(info->nsegs, sp+2); /* nsegs */
1974 
1975     info->personality = PER_LINUX_FDPIC;
1976     info->loadmap_addr = sp;
1977 
1978     return sp;
1979 }
1980 
1981 static abi_ulong create_elf_tables(abi_ulong p, int argc, int envc,
1982                                    struct elfhdr *exec,
1983                                    struct image_info *info,
1984                                    struct image_info *interp_info)
1985 {
1986     abi_ulong sp;
1987     abi_ulong u_argc, u_argv, u_envp, u_auxv;
1988     int size;
1989     int i;
1990     abi_ulong u_rand_bytes;
1991     uint8_t k_rand_bytes[16];
1992     abi_ulong u_platform;
1993     const char *k_platform;
1994     const int n = sizeof(elf_addr_t);
1995 
1996     sp = p;
1997 
1998     /* Needs to be before we load the env/argc/... */
1999     if (elf_is_fdpic(exec)) {
2000         /* Need 4 byte alignment for these structs */
2001         sp &= ~3;
2002         sp = loader_build_fdpic_loadmap(info, sp);
2003         info->other_info = interp_info;
2004         if (interp_info) {
2005             interp_info->other_info = info;
2006             sp = loader_build_fdpic_loadmap(interp_info, sp);
2007             info->interpreter_loadmap_addr = interp_info->loadmap_addr;
2008             info->interpreter_pt_dynamic_addr = interp_info->pt_dynamic_addr;
2009         } else {
2010             info->interpreter_loadmap_addr = 0;
2011             info->interpreter_pt_dynamic_addr = 0;
2012         }
2013     }
2014 
2015     u_platform = 0;
2016     k_platform = ELF_PLATFORM;
2017     if (k_platform) {
2018         size_t len = strlen(k_platform) + 1;
2019         if (STACK_GROWS_DOWN) {
2020             sp -= (len + n - 1) & ~(n - 1);
2021             u_platform = sp;
2022             /* FIXME - check return value of memcpy_to_target() for failure */
2023             memcpy_to_target(sp, k_platform, len);
2024         } else {
2025             memcpy_to_target(sp, k_platform, len);
2026             u_platform = sp;
2027             sp += len + 1;
2028         }
2029     }
2030 
2031     /* Provide 16 byte alignment for the PRNG, and basic alignment for
2032      * the argv and envp pointers.
2033      */
2034     if (STACK_GROWS_DOWN) {
2035         sp = QEMU_ALIGN_DOWN(sp, 16);
2036     } else {
2037         sp = QEMU_ALIGN_UP(sp, 16);
2038     }
2039 
2040     /*
2041      * Generate 16 random bytes for userspace PRNG seeding.
2042      */
2043     qemu_guest_getrandom_nofail(k_rand_bytes, sizeof(k_rand_bytes));
2044     if (STACK_GROWS_DOWN) {
2045         sp -= 16;
2046         u_rand_bytes = sp;
2047         /* FIXME - check return value of memcpy_to_target() for failure */
2048         memcpy_to_target(sp, k_rand_bytes, 16);
2049     } else {
2050         memcpy_to_target(sp, k_rand_bytes, 16);
2051         u_rand_bytes = sp;
2052         sp += 16;
2053     }
2054 
2055     size = (DLINFO_ITEMS + 1) * 2;
2056     if (k_platform)
2057         size += 2;
2058 #ifdef DLINFO_ARCH_ITEMS
2059     size += DLINFO_ARCH_ITEMS * 2;
2060 #endif
2061 #ifdef ELF_HWCAP2
2062     size += 2;
2063 #endif
2064     info->auxv_len = size * n;
2065 
2066     size += envc + argc + 2;
2067     size += 1;  /* argc itself */
2068     size *= n;
2069 
2070     /* Allocate space and finalize stack alignment for entry now.  */
2071     if (STACK_GROWS_DOWN) {
2072         u_argc = QEMU_ALIGN_DOWN(sp - size, STACK_ALIGNMENT);
2073         sp = u_argc;
2074     } else {
2075         u_argc = sp;
2076         sp = QEMU_ALIGN_UP(sp + size, STACK_ALIGNMENT);
2077     }
2078 
2079     u_argv = u_argc + n;
2080     u_envp = u_argv + (argc + 1) * n;
2081     u_auxv = u_envp + (envc + 1) * n;
2082     info->saved_auxv = u_auxv;
2083     info->arg_start = u_argv;
2084     info->arg_end = u_argv + argc * n;
2085 
2086     /* This is correct because Linux defines
2087      * elf_addr_t as Elf32_Off / Elf64_Off
2088      */
2089 #define NEW_AUX_ENT(id, val) do {               \
2090         put_user_ual(id, u_auxv);  u_auxv += n; \
2091         put_user_ual(val, u_auxv); u_auxv += n; \
2092     } while(0)
2093 
2094 #ifdef ARCH_DLINFO
2095     /*
2096      * ARCH_DLINFO must come first so platform specific code can enforce
2097      * special alignment requirements on the AUXV if necessary (eg. PPC).
2098      */
2099     ARCH_DLINFO;
2100 #endif
2101     /* There must be exactly DLINFO_ITEMS entries here, or the assert
2102      * on info->auxv_len will trigger.
2103      */
2104     NEW_AUX_ENT(AT_PHDR, (abi_ulong)(info->load_addr + exec->e_phoff));
2105     NEW_AUX_ENT(AT_PHENT, (abi_ulong)(sizeof (struct elf_phdr)));
2106     NEW_AUX_ENT(AT_PHNUM, (abi_ulong)(exec->e_phnum));
2107     if ((info->alignment & ~qemu_host_page_mask) != 0) {
2108         /* Target doesn't support host page size alignment */
2109         NEW_AUX_ENT(AT_PAGESZ, (abi_ulong)(TARGET_PAGE_SIZE));
2110     } else {
2111         NEW_AUX_ENT(AT_PAGESZ, (abi_ulong)(MAX(TARGET_PAGE_SIZE,
2112                                                qemu_host_page_size)));
2113     }
2114     NEW_AUX_ENT(AT_BASE, (abi_ulong)(interp_info ? interp_info->load_addr : 0));
2115     NEW_AUX_ENT(AT_FLAGS, (abi_ulong)0);
2116     NEW_AUX_ENT(AT_ENTRY, info->entry);
2117     NEW_AUX_ENT(AT_UID, (abi_ulong) getuid());
2118     NEW_AUX_ENT(AT_EUID, (abi_ulong) geteuid());
2119     NEW_AUX_ENT(AT_GID, (abi_ulong) getgid());
2120     NEW_AUX_ENT(AT_EGID, (abi_ulong) getegid());
2121     NEW_AUX_ENT(AT_HWCAP, (abi_ulong) ELF_HWCAP);
2122     NEW_AUX_ENT(AT_CLKTCK, (abi_ulong) sysconf(_SC_CLK_TCK));
2123     NEW_AUX_ENT(AT_RANDOM, (abi_ulong) u_rand_bytes);
2124     NEW_AUX_ENT(AT_SECURE, (abi_ulong) qemu_getauxval(AT_SECURE));
2125     NEW_AUX_ENT(AT_EXECFN, info->file_string);
2126 
2127 #ifdef ELF_HWCAP2
2128     NEW_AUX_ENT(AT_HWCAP2, (abi_ulong) ELF_HWCAP2);
2129 #endif
2130 
2131     if (u_platform) {
2132         NEW_AUX_ENT(AT_PLATFORM, u_platform);
2133     }
2134     NEW_AUX_ENT (AT_NULL, 0);
2135 #undef NEW_AUX_ENT
2136 
2137     /* Check that our initial calculation of the auxv length matches how much
2138      * we actually put into it.
2139      */
2140     assert(info->auxv_len == u_auxv - info->saved_auxv);
2141 
2142     put_user_ual(argc, u_argc);
2143 
2144     p = info->arg_strings;
2145     for (i = 0; i < argc; ++i) {
2146         put_user_ual(p, u_argv);
2147         u_argv += n;
2148         p += target_strlen(p) + 1;
2149     }
2150     put_user_ual(0, u_argv);
2151 
2152     p = info->env_strings;
2153     for (i = 0; i < envc; ++i) {
2154         put_user_ual(p, u_envp);
2155         u_envp += n;
2156         p += target_strlen(p) + 1;
2157     }
2158     put_user_ual(0, u_envp);
2159 
2160     return sp;
2161 }
2162 
2163 #ifndef ARM_COMMPAGE
2164 #define ARM_COMMPAGE 0
2165 #define init_guest_commpage() true
2166 #endif
2167 
2168 static void pgb_fail_in_use(const char *image_name)
2169 {
2170     error_report("%s: requires virtual address space that is in use "
2171                  "(omit the -B option or choose a different value)",
2172                  image_name);
2173     exit(EXIT_FAILURE);
2174 }
2175 
2176 static void pgb_have_guest_base(const char *image_name, abi_ulong guest_loaddr,
2177                                 abi_ulong guest_hiaddr, long align)
2178 {
2179     const int flags = MAP_ANONYMOUS | MAP_PRIVATE | MAP_NORESERVE;
2180     void *addr, *test;
2181 
2182     if (!QEMU_IS_ALIGNED(guest_base, align)) {
2183         fprintf(stderr, "Requested guest base %p does not satisfy "
2184                 "host minimum alignment (0x%lx)\n",
2185                 (void *)guest_base, align);
2186         exit(EXIT_FAILURE);
2187     }
2188 
2189     /* Sanity check the guest binary. */
2190     if (reserved_va) {
2191         if (guest_hiaddr > reserved_va) {
2192             error_report("%s: requires more than reserved virtual "
2193                          "address space (0x%" PRIx64 " > 0x%lx)",
2194                          image_name, (uint64_t)guest_hiaddr, reserved_va);
2195             exit(EXIT_FAILURE);
2196         }
2197     } else {
2198 #if HOST_LONG_BITS < TARGET_ABI_BITS
2199         if ((guest_hiaddr - guest_base) > ~(uintptr_t)0) {
2200             error_report("%s: requires more virtual address space "
2201                          "than the host can provide (0x%" PRIx64 ")",
2202                          image_name, (uint64_t)guest_hiaddr - guest_base);
2203             exit(EXIT_FAILURE);
2204         }
2205 #endif
2206     }
2207 
2208     /*
2209      * Expand the allocation to the entire reserved_va.
2210      * Exclude the mmap_min_addr hole.
2211      */
2212     if (reserved_va) {
2213         guest_loaddr = (guest_base >= mmap_min_addr ? 0
2214                         : mmap_min_addr - guest_base);
2215         guest_hiaddr = reserved_va;
2216     }
2217 
2218     /* Reserve the address space for the binary, or reserved_va. */
2219     test = g2h_untagged(guest_loaddr);
2220     addr = mmap(test, guest_hiaddr - guest_loaddr, PROT_NONE, flags, -1, 0);
2221     if (test != addr) {
2222         pgb_fail_in_use(image_name);
2223     }
2224 }
2225 
2226 /**
2227  * pgd_find_hole_fallback: potential mmap address
2228  * @guest_size: size of available space
2229  * @brk: location of break
2230  * @align: memory alignment
2231  *
2232  * This is a fallback method for finding a hole in the host address
2233  * space if we don't have the benefit of being able to access
2234  * /proc/self/map. It can potentially take a very long time as we can
2235  * only dumbly iterate up the host address space seeing if the
2236  * allocation would work.
2237  */
2238 static uintptr_t pgd_find_hole_fallback(uintptr_t guest_size, uintptr_t brk,
2239                                         long align, uintptr_t offset)
2240 {
2241     uintptr_t base;
2242 
2243     /* Start (aligned) at the bottom and work our way up */
2244     base = ROUND_UP(mmap_min_addr, align);
2245 
2246     while (true) {
2247         uintptr_t align_start, end;
2248         align_start = ROUND_UP(base, align);
2249         end = align_start + guest_size + offset;
2250 
2251         /* if brk is anywhere in the range give ourselves some room to grow. */
2252         if (align_start <= brk && brk < end) {
2253             base = brk + (16 * MiB);
2254             continue;
2255         } else if (align_start + guest_size < align_start) {
2256             /* we have run out of space */
2257             return -1;
2258         } else {
2259             int flags = MAP_ANONYMOUS | MAP_PRIVATE | MAP_NORESERVE |
2260                 MAP_FIXED_NOREPLACE;
2261             void * mmap_start = mmap((void *) align_start, guest_size,
2262                                      PROT_NONE, flags, -1, 0);
2263             if (mmap_start != MAP_FAILED) {
2264                 munmap(mmap_start, guest_size);
2265                 if (mmap_start == (void *) align_start) {
2266                     return (uintptr_t) mmap_start + offset;
2267                 }
2268             }
2269             base += qemu_host_page_size;
2270         }
2271     }
2272 }
2273 
2274 /* Return value for guest_base, or -1 if no hole found. */
2275 static uintptr_t pgb_find_hole(uintptr_t guest_loaddr, uintptr_t guest_size,
2276                                long align, uintptr_t offset)
2277 {
2278     GSList *maps, *iter;
2279     uintptr_t this_start, this_end, next_start, brk;
2280     intptr_t ret = -1;
2281 
2282     assert(QEMU_IS_ALIGNED(guest_loaddr, align));
2283 
2284     maps = read_self_maps();
2285 
2286     /* Read brk after we've read the maps, which will malloc. */
2287     brk = (uintptr_t)sbrk(0);
2288 
2289     if (!maps) {
2290         ret = pgd_find_hole_fallback(guest_size, brk, align, offset);
2291         return ret == -1 ? -1 : ret - guest_loaddr;
2292     }
2293 
2294     /* The first hole is before the first map entry. */
2295     this_start = mmap_min_addr;
2296 
2297     for (iter = maps; iter;
2298          this_start = next_start, iter = g_slist_next(iter)) {
2299         uintptr_t align_start, hole_size;
2300 
2301         this_end = ((MapInfo *)iter->data)->start;
2302         next_start = ((MapInfo *)iter->data)->end;
2303         align_start = ROUND_UP(this_start + offset, align);
2304 
2305         /* Skip holes that are too small. */
2306         if (align_start >= this_end) {
2307             continue;
2308         }
2309         hole_size = this_end - align_start;
2310         if (hole_size < guest_size) {
2311             continue;
2312         }
2313 
2314         /* If this hole contains brk, give ourselves some room to grow. */
2315         if (this_start <= brk && brk < this_end) {
2316             hole_size -= guest_size;
2317             if (sizeof(uintptr_t) == 8 && hole_size >= 1 * GiB) {
2318                 align_start += 1 * GiB;
2319             } else if (hole_size >= 16 * MiB) {
2320                 align_start += 16 * MiB;
2321             } else {
2322                 align_start = (this_end - guest_size) & -align;
2323                 if (align_start < this_start) {
2324                     continue;
2325                 }
2326             }
2327         }
2328 
2329         /* Record the lowest successful match. */
2330         if (ret < 0) {
2331             ret = align_start - guest_loaddr;
2332         }
2333         /* If this hole contains the identity map, select it. */
2334         if (align_start <= guest_loaddr &&
2335             guest_loaddr + guest_size <= this_end) {
2336             ret = 0;
2337         }
2338         /* If this hole ends above the identity map, stop looking. */
2339         if (this_end >= guest_loaddr) {
2340             break;
2341         }
2342     }
2343     free_self_maps(maps);
2344 
2345     return ret;
2346 }
2347 
2348 static void pgb_static(const char *image_name, abi_ulong orig_loaddr,
2349                        abi_ulong orig_hiaddr, long align)
2350 {
2351     uintptr_t loaddr = orig_loaddr;
2352     uintptr_t hiaddr = orig_hiaddr;
2353     uintptr_t offset = 0;
2354     uintptr_t addr;
2355 
2356     if (hiaddr != orig_hiaddr) {
2357         error_report("%s: requires virtual address space that the "
2358                      "host cannot provide (0x%" PRIx64 ")",
2359                      image_name, (uint64_t)orig_hiaddr);
2360         exit(EXIT_FAILURE);
2361     }
2362 
2363     loaddr &= -align;
2364     if (ARM_COMMPAGE) {
2365         /*
2366          * Extend the allocation to include the commpage.
2367          * For a 64-bit host, this is just 4GiB; for a 32-bit host we
2368          * need to ensure there is space bellow the guest_base so we
2369          * can map the commpage in the place needed when the address
2370          * arithmetic wraps around.
2371          */
2372         if (sizeof(uintptr_t) == 8 || loaddr >= 0x80000000u) {
2373             hiaddr = (uintptr_t) 4 << 30;
2374         } else {
2375             offset = -(ARM_COMMPAGE & -align);
2376         }
2377     }
2378 
2379     addr = pgb_find_hole(loaddr, hiaddr - loaddr, align, offset);
2380     if (addr == -1) {
2381         /*
2382          * If ARM_COMMPAGE, there *might* be a non-consecutive allocation
2383          * that can satisfy both.  But as the normal arm32 link base address
2384          * is ~32k, and we extend down to include the commpage, making the
2385          * overhead only ~96k, this is unlikely.
2386          */
2387         error_report("%s: Unable to allocate %#zx bytes of "
2388                      "virtual address space", image_name,
2389                      (size_t)(hiaddr - loaddr));
2390         exit(EXIT_FAILURE);
2391     }
2392 
2393     guest_base = addr;
2394 }
2395 
2396 static void pgb_dynamic(const char *image_name, long align)
2397 {
2398     /*
2399      * The executable is dynamic and does not require a fixed address.
2400      * All we need is a commpage that satisfies align.
2401      * If we do not need a commpage, leave guest_base == 0.
2402      */
2403     if (ARM_COMMPAGE) {
2404         uintptr_t addr, commpage;
2405 
2406         /* 64-bit hosts should have used reserved_va. */
2407         assert(sizeof(uintptr_t) == 4);
2408 
2409         /*
2410          * By putting the commpage at the first hole, that puts guest_base
2411          * just above that, and maximises the positive guest addresses.
2412          */
2413         commpage = ARM_COMMPAGE & -align;
2414         addr = pgb_find_hole(commpage, -commpage, align, 0);
2415         assert(addr != -1);
2416         guest_base = addr;
2417     }
2418 }
2419 
2420 static void pgb_reserved_va(const char *image_name, abi_ulong guest_loaddr,
2421                             abi_ulong guest_hiaddr, long align)
2422 {
2423     int flags = MAP_ANONYMOUS | MAP_PRIVATE | MAP_NORESERVE;
2424     void *addr, *test;
2425 
2426     if (guest_hiaddr > reserved_va) {
2427         error_report("%s: requires more than reserved virtual "
2428                      "address space (0x%" PRIx64 " > 0x%lx)",
2429                      image_name, (uint64_t)guest_hiaddr, reserved_va);
2430         exit(EXIT_FAILURE);
2431     }
2432 
2433     /* Widen the "image" to the entire reserved address space. */
2434     pgb_static(image_name, 0, reserved_va, align);
2435 
2436     /* osdep.h defines this as 0 if it's missing */
2437     flags |= MAP_FIXED_NOREPLACE;
2438 
2439     /* Reserve the memory on the host. */
2440     assert(guest_base != 0);
2441     test = g2h_untagged(0);
2442     addr = mmap(test, reserved_va, PROT_NONE, flags, -1, 0);
2443     if (addr == MAP_FAILED || addr != test) {
2444         error_report("Unable to reserve 0x%lx bytes of virtual address "
2445                      "space at %p (%s) for use as guest address space (check your"
2446                      "virtual memory ulimit setting, min_mmap_addr or reserve less "
2447                      "using -R option)", reserved_va, test, strerror(errno));
2448         exit(EXIT_FAILURE);
2449     }
2450 }
2451 
2452 void probe_guest_base(const char *image_name, abi_ulong guest_loaddr,
2453                       abi_ulong guest_hiaddr)
2454 {
2455     /* In order to use host shmat, we must be able to honor SHMLBA.  */
2456     uintptr_t align = MAX(SHMLBA, qemu_host_page_size);
2457 
2458     if (have_guest_base) {
2459         pgb_have_guest_base(image_name, guest_loaddr, guest_hiaddr, align);
2460     } else if (reserved_va) {
2461         pgb_reserved_va(image_name, guest_loaddr, guest_hiaddr, align);
2462     } else if (guest_loaddr) {
2463         pgb_static(image_name, guest_loaddr, guest_hiaddr, align);
2464     } else {
2465         pgb_dynamic(image_name, align);
2466     }
2467 
2468     /* Reserve and initialize the commpage. */
2469     if (!init_guest_commpage()) {
2470         /*
2471          * With have_guest_base, the user has selected the address and
2472          * we are trying to work with that.  Otherwise, we have selected
2473          * free space and init_guest_commpage must succeeded.
2474          */
2475         assert(have_guest_base);
2476         pgb_fail_in_use(image_name);
2477     }
2478 
2479     assert(QEMU_IS_ALIGNED(guest_base, align));
2480     qemu_log_mask(CPU_LOG_PAGE, "Locating guest address space "
2481                   "@ 0x%" PRIx64 "\n", (uint64_t)guest_base);
2482 }
2483 
2484 enum {
2485     /* The string "GNU\0" as a magic number. */
2486     GNU0_MAGIC = const_le32('G' | 'N' << 8 | 'U' << 16),
2487     NOTE_DATA_SZ = 1 * KiB,
2488     NOTE_NAME_SZ = 4,
2489     ELF_GNU_PROPERTY_ALIGN = ELF_CLASS == ELFCLASS32 ? 4 : 8,
2490 };
2491 
2492 /*
2493  * Process a single gnu_property entry.
2494  * Return false for error.
2495  */
2496 static bool parse_elf_property(const uint32_t *data, int *off, int datasz,
2497                                struct image_info *info, bool have_prev_type,
2498                                uint32_t *prev_type, Error **errp)
2499 {
2500     uint32_t pr_type, pr_datasz, step;
2501 
2502     if (*off > datasz || !QEMU_IS_ALIGNED(*off, ELF_GNU_PROPERTY_ALIGN)) {
2503         goto error_data;
2504     }
2505     datasz -= *off;
2506     data += *off / sizeof(uint32_t);
2507 
2508     if (datasz < 2 * sizeof(uint32_t)) {
2509         goto error_data;
2510     }
2511     pr_type = data[0];
2512     pr_datasz = data[1];
2513     data += 2;
2514     datasz -= 2 * sizeof(uint32_t);
2515     step = ROUND_UP(pr_datasz, ELF_GNU_PROPERTY_ALIGN);
2516     if (step > datasz) {
2517         goto error_data;
2518     }
2519 
2520     /* Properties are supposed to be unique and sorted on pr_type. */
2521     if (have_prev_type && pr_type <= *prev_type) {
2522         if (pr_type == *prev_type) {
2523             error_setg(errp, "Duplicate property in PT_GNU_PROPERTY");
2524         } else {
2525             error_setg(errp, "Unsorted property in PT_GNU_PROPERTY");
2526         }
2527         return false;
2528     }
2529     *prev_type = pr_type;
2530 
2531     if (!arch_parse_elf_property(pr_type, pr_datasz, data, info, errp)) {
2532         return false;
2533     }
2534 
2535     *off += 2 * sizeof(uint32_t) + step;
2536     return true;
2537 
2538  error_data:
2539     error_setg(errp, "Ill-formed property in PT_GNU_PROPERTY");
2540     return false;
2541 }
2542 
2543 /* Process NT_GNU_PROPERTY_TYPE_0. */
2544 static bool parse_elf_properties(int image_fd,
2545                                  struct image_info *info,
2546                                  const struct elf_phdr *phdr,
2547                                  char bprm_buf[BPRM_BUF_SIZE],
2548                                  Error **errp)
2549 {
2550     union {
2551         struct elf_note nhdr;
2552         uint32_t data[NOTE_DATA_SZ / sizeof(uint32_t)];
2553     } note;
2554 
2555     int n, off, datasz;
2556     bool have_prev_type;
2557     uint32_t prev_type;
2558 
2559     /* Unless the arch requires properties, ignore them. */
2560     if (!ARCH_USE_GNU_PROPERTY) {
2561         return true;
2562     }
2563 
2564     /* If the properties are crazy large, that's too bad. */
2565     n = phdr->p_filesz;
2566     if (n > sizeof(note)) {
2567         error_setg(errp, "PT_GNU_PROPERTY too large");
2568         return false;
2569     }
2570     if (n < sizeof(note.nhdr)) {
2571         error_setg(errp, "PT_GNU_PROPERTY too small");
2572         return false;
2573     }
2574 
2575     if (phdr->p_offset + n <= BPRM_BUF_SIZE) {
2576         memcpy(&note, bprm_buf + phdr->p_offset, n);
2577     } else {
2578         ssize_t len = pread(image_fd, &note, n, phdr->p_offset);
2579         if (len != n) {
2580             error_setg_errno(errp, errno, "Error reading file header");
2581             return false;
2582         }
2583     }
2584 
2585     /*
2586      * The contents of a valid PT_GNU_PROPERTY is a sequence
2587      * of uint32_t -- swap them all now.
2588      */
2589 #ifdef BSWAP_NEEDED
2590     for (int i = 0; i < n / 4; i++) {
2591         bswap32s(note.data + i);
2592     }
2593 #endif
2594 
2595     /*
2596      * Note that nhdr is 3 words, and that the "name" described by namesz
2597      * immediately follows nhdr and is thus at the 4th word.  Further, all
2598      * of the inputs to the kernel's round_up are multiples of 4.
2599      */
2600     if (note.nhdr.n_type != NT_GNU_PROPERTY_TYPE_0 ||
2601         note.nhdr.n_namesz != NOTE_NAME_SZ ||
2602         note.data[3] != GNU0_MAGIC) {
2603         error_setg(errp, "Invalid note in PT_GNU_PROPERTY");
2604         return false;
2605     }
2606     off = sizeof(note.nhdr) + NOTE_NAME_SZ;
2607 
2608     datasz = note.nhdr.n_descsz + off;
2609     if (datasz > n) {
2610         error_setg(errp, "Invalid note size in PT_GNU_PROPERTY");
2611         return false;
2612     }
2613 
2614     have_prev_type = false;
2615     prev_type = 0;
2616     while (1) {
2617         if (off == datasz) {
2618             return true;  /* end, exit ok */
2619         }
2620         if (!parse_elf_property(note.data, &off, datasz, info,
2621                                 have_prev_type, &prev_type, errp)) {
2622             return false;
2623         }
2624         have_prev_type = true;
2625     }
2626 }
2627 
2628 /* Load an ELF image into the address space.
2629 
2630    IMAGE_NAME is the filename of the image, to use in error messages.
2631    IMAGE_FD is the open file descriptor for the image.
2632 
2633    BPRM_BUF is a copy of the beginning of the file; this of course
2634    contains the elf file header at offset 0.  It is assumed that this
2635    buffer is sufficiently aligned to present no problems to the host
2636    in accessing data at aligned offsets within the buffer.
2637 
2638    On return: INFO values will be filled in, as necessary or available.  */
2639 
2640 static void load_elf_image(const char *image_name, int image_fd,
2641                            struct image_info *info, char **pinterp_name,
2642                            char bprm_buf[BPRM_BUF_SIZE])
2643 {
2644     struct elfhdr *ehdr = (struct elfhdr *)bprm_buf;
2645     struct elf_phdr *phdr;
2646     abi_ulong load_addr, load_bias, loaddr, hiaddr, error;
2647     int i, retval, prot_exec;
2648     Error *err = NULL;
2649 
2650     /* First of all, some simple consistency checks */
2651     if (!elf_check_ident(ehdr)) {
2652         error_setg(&err, "Invalid ELF image for this architecture");
2653         goto exit_errmsg;
2654     }
2655     bswap_ehdr(ehdr);
2656     if (!elf_check_ehdr(ehdr)) {
2657         error_setg(&err, "Invalid ELF image for this architecture");
2658         goto exit_errmsg;
2659     }
2660 
2661     i = ehdr->e_phnum * sizeof(struct elf_phdr);
2662     if (ehdr->e_phoff + i <= BPRM_BUF_SIZE) {
2663         phdr = (struct elf_phdr *)(bprm_buf + ehdr->e_phoff);
2664     } else {
2665         phdr = (struct elf_phdr *) alloca(i);
2666         retval = pread(image_fd, phdr, i, ehdr->e_phoff);
2667         if (retval != i) {
2668             goto exit_read;
2669         }
2670     }
2671     bswap_phdr(phdr, ehdr->e_phnum);
2672 
2673     info->nsegs = 0;
2674     info->pt_dynamic_addr = 0;
2675 
2676     mmap_lock();
2677 
2678     /*
2679      * Find the maximum size of the image and allocate an appropriate
2680      * amount of memory to handle that.  Locate the interpreter, if any.
2681      */
2682     loaddr = -1, hiaddr = 0;
2683     info->alignment = 0;
2684     for (i = 0; i < ehdr->e_phnum; ++i) {
2685         struct elf_phdr *eppnt = phdr + i;
2686         if (eppnt->p_type == PT_LOAD) {
2687             abi_ulong a = eppnt->p_vaddr - eppnt->p_offset;
2688             if (a < loaddr) {
2689                 loaddr = a;
2690             }
2691             a = eppnt->p_vaddr + eppnt->p_memsz;
2692             if (a > hiaddr) {
2693                 hiaddr = a;
2694             }
2695             ++info->nsegs;
2696             info->alignment |= eppnt->p_align;
2697         } else if (eppnt->p_type == PT_INTERP && pinterp_name) {
2698             g_autofree char *interp_name = NULL;
2699 
2700             if (*pinterp_name) {
2701                 error_setg(&err, "Multiple PT_INTERP entries");
2702                 goto exit_errmsg;
2703             }
2704 
2705             interp_name = g_malloc(eppnt->p_filesz);
2706 
2707             if (eppnt->p_offset + eppnt->p_filesz <= BPRM_BUF_SIZE) {
2708                 memcpy(interp_name, bprm_buf + eppnt->p_offset,
2709                        eppnt->p_filesz);
2710             } else {
2711                 retval = pread(image_fd, interp_name, eppnt->p_filesz,
2712                                eppnt->p_offset);
2713                 if (retval != eppnt->p_filesz) {
2714                     goto exit_read;
2715                 }
2716             }
2717             if (interp_name[eppnt->p_filesz - 1] != 0) {
2718                 error_setg(&err, "Invalid PT_INTERP entry");
2719                 goto exit_errmsg;
2720             }
2721             *pinterp_name = g_steal_pointer(&interp_name);
2722         } else if (eppnt->p_type == PT_GNU_PROPERTY) {
2723             if (!parse_elf_properties(image_fd, info, eppnt, bprm_buf, &err)) {
2724                 goto exit_errmsg;
2725             }
2726         }
2727     }
2728 
2729     if (pinterp_name != NULL) {
2730         /*
2731          * This is the main executable.
2732          *
2733          * Reserve extra space for brk.
2734          * We hold on to this space while placing the interpreter
2735          * and the stack, lest they be placed immediately after
2736          * the data segment and block allocation from the brk.
2737          *
2738          * 16MB is chosen as "large enough" without being so large
2739          * as to allow the result to not fit with a 32-bit guest on
2740          * a 32-bit host.
2741          */
2742         info->reserve_brk = 16 * MiB;
2743         hiaddr += info->reserve_brk;
2744 
2745         if (ehdr->e_type == ET_EXEC) {
2746             /*
2747              * Make sure that the low address does not conflict with
2748              * MMAP_MIN_ADDR or the QEMU application itself.
2749              */
2750             probe_guest_base(image_name, loaddr, hiaddr);
2751         } else {
2752             /*
2753              * The binary is dynamic, but we still need to
2754              * select guest_base.  In this case we pass a size.
2755              */
2756             probe_guest_base(image_name, 0, hiaddr - loaddr);
2757         }
2758     }
2759 
2760     /*
2761      * Reserve address space for all of this.
2762      *
2763      * In the case of ET_EXEC, we supply MAP_FIXED so that we get
2764      * exactly the address range that is required.
2765      *
2766      * Otherwise this is ET_DYN, and we are searching for a location
2767      * that can hold the memory space required.  If the image is
2768      * pre-linked, LOADDR will be non-zero, and the kernel should
2769      * honor that address if it happens to be free.
2770      *
2771      * In both cases, we will overwrite pages in this range with mappings
2772      * from the executable.
2773      */
2774     load_addr = target_mmap(loaddr, hiaddr - loaddr, PROT_NONE,
2775                             MAP_PRIVATE | MAP_ANON | MAP_NORESERVE |
2776                             (ehdr->e_type == ET_EXEC ? MAP_FIXED : 0),
2777                             -1, 0);
2778     if (load_addr == -1) {
2779         goto exit_mmap;
2780     }
2781     load_bias = load_addr - loaddr;
2782 
2783     if (elf_is_fdpic(ehdr)) {
2784         struct elf32_fdpic_loadseg *loadsegs = info->loadsegs =
2785             g_malloc(sizeof(*loadsegs) * info->nsegs);
2786 
2787         for (i = 0; i < ehdr->e_phnum; ++i) {
2788             switch (phdr[i].p_type) {
2789             case PT_DYNAMIC:
2790                 info->pt_dynamic_addr = phdr[i].p_vaddr + load_bias;
2791                 break;
2792             case PT_LOAD:
2793                 loadsegs->addr = phdr[i].p_vaddr + load_bias;
2794                 loadsegs->p_vaddr = phdr[i].p_vaddr;
2795                 loadsegs->p_memsz = phdr[i].p_memsz;
2796                 ++loadsegs;
2797                 break;
2798             }
2799         }
2800     }
2801 
2802     info->load_bias = load_bias;
2803     info->code_offset = load_bias;
2804     info->data_offset = load_bias;
2805     info->load_addr = load_addr;
2806     info->entry = ehdr->e_entry + load_bias;
2807     info->start_code = -1;
2808     info->end_code = 0;
2809     info->start_data = -1;
2810     info->end_data = 0;
2811     info->brk = 0;
2812     info->elf_flags = ehdr->e_flags;
2813 
2814     prot_exec = PROT_EXEC;
2815 #ifdef TARGET_AARCH64
2816     /*
2817      * If the BTI feature is present, this indicates that the executable
2818      * pages of the startup binary should be mapped with PROT_BTI, so that
2819      * branch targets are enforced.
2820      *
2821      * The startup binary is either the interpreter or the static executable.
2822      * The interpreter is responsible for all pages of a dynamic executable.
2823      *
2824      * Elf notes are backward compatible to older cpus.
2825      * Do not enable BTI unless it is supported.
2826      */
2827     if ((info->note_flags & GNU_PROPERTY_AARCH64_FEATURE_1_BTI)
2828         && (pinterp_name == NULL || *pinterp_name == 0)
2829         && cpu_isar_feature(aa64_bti, ARM_CPU(thread_cpu))) {
2830         prot_exec |= TARGET_PROT_BTI;
2831     }
2832 #endif
2833 
2834     for (i = 0; i < ehdr->e_phnum; i++) {
2835         struct elf_phdr *eppnt = phdr + i;
2836         if (eppnt->p_type == PT_LOAD) {
2837             abi_ulong vaddr, vaddr_po, vaddr_ps, vaddr_ef, vaddr_em, vaddr_len;
2838             int elf_prot = 0;
2839 
2840             if (eppnt->p_flags & PF_R) {
2841                 elf_prot |= PROT_READ;
2842             }
2843             if (eppnt->p_flags & PF_W) {
2844                 elf_prot |= PROT_WRITE;
2845             }
2846             if (eppnt->p_flags & PF_X) {
2847                 elf_prot |= prot_exec;
2848             }
2849 
2850             vaddr = load_bias + eppnt->p_vaddr;
2851             vaddr_po = TARGET_ELF_PAGEOFFSET(vaddr);
2852             vaddr_ps = TARGET_ELF_PAGESTART(vaddr);
2853 
2854             vaddr_ef = vaddr + eppnt->p_filesz;
2855             vaddr_em = vaddr + eppnt->p_memsz;
2856 
2857             /*
2858              * Some segments may be completely empty, with a non-zero p_memsz
2859              * but no backing file segment.
2860              */
2861             if (eppnt->p_filesz != 0) {
2862                 vaddr_len = TARGET_ELF_PAGELENGTH(eppnt->p_filesz + vaddr_po);
2863                 error = target_mmap(vaddr_ps, vaddr_len, elf_prot,
2864                                     MAP_PRIVATE | MAP_FIXED,
2865                                     image_fd, eppnt->p_offset - vaddr_po);
2866 
2867                 if (error == -1) {
2868                     goto exit_mmap;
2869                 }
2870 
2871                 /*
2872                  * If the load segment requests extra zeros (e.g. bss), map it.
2873                  */
2874                 if (eppnt->p_filesz < eppnt->p_memsz) {
2875                     zero_bss(vaddr_ef, vaddr_em, elf_prot);
2876                 }
2877             } else if (eppnt->p_memsz != 0) {
2878                 vaddr_len = TARGET_ELF_PAGELENGTH(eppnt->p_memsz + vaddr_po);
2879                 error = target_mmap(vaddr_ps, vaddr_len, elf_prot,
2880                                     MAP_PRIVATE | MAP_FIXED | MAP_ANONYMOUS,
2881                                     -1, 0);
2882 
2883                 if (error == -1) {
2884                     goto exit_mmap;
2885                 }
2886             }
2887 
2888             /* Find the full program boundaries.  */
2889             if (elf_prot & PROT_EXEC) {
2890                 if (vaddr < info->start_code) {
2891                     info->start_code = vaddr;
2892                 }
2893                 if (vaddr_ef > info->end_code) {
2894                     info->end_code = vaddr_ef;
2895                 }
2896             }
2897             if (elf_prot & PROT_WRITE) {
2898                 if (vaddr < info->start_data) {
2899                     info->start_data = vaddr;
2900                 }
2901                 if (vaddr_ef > info->end_data) {
2902                     info->end_data = vaddr_ef;
2903                 }
2904             }
2905             if (vaddr_em > info->brk) {
2906                 info->brk = vaddr_em;
2907             }
2908 #ifdef TARGET_MIPS
2909         } else if (eppnt->p_type == PT_MIPS_ABIFLAGS) {
2910             Mips_elf_abiflags_v0 abiflags;
2911             if (eppnt->p_filesz < sizeof(Mips_elf_abiflags_v0)) {
2912                 error_setg(&err, "Invalid PT_MIPS_ABIFLAGS entry");
2913                 goto exit_errmsg;
2914             }
2915             if (eppnt->p_offset + eppnt->p_filesz <= BPRM_BUF_SIZE) {
2916                 memcpy(&abiflags, bprm_buf + eppnt->p_offset,
2917                        sizeof(Mips_elf_abiflags_v0));
2918             } else {
2919                 retval = pread(image_fd, &abiflags, sizeof(Mips_elf_abiflags_v0),
2920                                eppnt->p_offset);
2921                 if (retval != sizeof(Mips_elf_abiflags_v0)) {
2922                     goto exit_read;
2923                 }
2924             }
2925             bswap_mips_abiflags(&abiflags);
2926             info->fp_abi = abiflags.fp_abi;
2927 #endif
2928         }
2929     }
2930 
2931     if (info->end_data == 0) {
2932         info->start_data = info->end_code;
2933         info->end_data = info->end_code;
2934     }
2935 
2936     if (qemu_log_enabled()) {
2937         load_symbols(ehdr, image_fd, load_bias);
2938     }
2939 
2940     mmap_unlock();
2941 
2942     close(image_fd);
2943     return;
2944 
2945  exit_read:
2946     if (retval >= 0) {
2947         error_setg(&err, "Incomplete read of file header");
2948     } else {
2949         error_setg_errno(&err, errno, "Error reading file header");
2950     }
2951     goto exit_errmsg;
2952  exit_mmap:
2953     error_setg_errno(&err, errno, "Error mapping file");
2954     goto exit_errmsg;
2955  exit_errmsg:
2956     error_reportf_err(err, "%s: ", image_name);
2957     exit(-1);
2958 }
2959 
2960 static void load_elf_interp(const char *filename, struct image_info *info,
2961                             char bprm_buf[BPRM_BUF_SIZE])
2962 {
2963     int fd, retval;
2964     Error *err = NULL;
2965 
2966     fd = open(path(filename), O_RDONLY);
2967     if (fd < 0) {
2968         error_setg_file_open(&err, errno, filename);
2969         error_report_err(err);
2970         exit(-1);
2971     }
2972 
2973     retval = read(fd, bprm_buf, BPRM_BUF_SIZE);
2974     if (retval < 0) {
2975         error_setg_errno(&err, errno, "Error reading file header");
2976         error_reportf_err(err, "%s: ", filename);
2977         exit(-1);
2978     }
2979 
2980     if (retval < BPRM_BUF_SIZE) {
2981         memset(bprm_buf + retval, 0, BPRM_BUF_SIZE - retval);
2982     }
2983 
2984     load_elf_image(filename, fd, info, NULL, bprm_buf);
2985 }
2986 
2987 static int symfind(const void *s0, const void *s1)
2988 {
2989     target_ulong addr = *(target_ulong *)s0;
2990     struct elf_sym *sym = (struct elf_sym *)s1;
2991     int result = 0;
2992     if (addr < sym->st_value) {
2993         result = -1;
2994     } else if (addr >= sym->st_value + sym->st_size) {
2995         result = 1;
2996     }
2997     return result;
2998 }
2999 
3000 static const char *lookup_symbolxx(struct syminfo *s, target_ulong orig_addr)
3001 {
3002 #if ELF_CLASS == ELFCLASS32
3003     struct elf_sym *syms = s->disas_symtab.elf32;
3004 #else
3005     struct elf_sym *syms = s->disas_symtab.elf64;
3006 #endif
3007 
3008     // binary search
3009     struct elf_sym *sym;
3010 
3011     sym = bsearch(&orig_addr, syms, s->disas_num_syms, sizeof(*syms), symfind);
3012     if (sym != NULL) {
3013         return s->disas_strtab + sym->st_name;
3014     }
3015 
3016     return "";
3017 }
3018 
3019 /* FIXME: This should use elf_ops.h  */
3020 static int symcmp(const void *s0, const void *s1)
3021 {
3022     struct elf_sym *sym0 = (struct elf_sym *)s0;
3023     struct elf_sym *sym1 = (struct elf_sym *)s1;
3024     return (sym0->st_value < sym1->st_value)
3025         ? -1
3026         : ((sym0->st_value > sym1->st_value) ? 1 : 0);
3027 }
3028 
3029 /* Best attempt to load symbols from this ELF object. */
3030 static void load_symbols(struct elfhdr *hdr, int fd, abi_ulong load_bias)
3031 {
3032     int i, shnum, nsyms, sym_idx = 0, str_idx = 0;
3033     uint64_t segsz;
3034     struct elf_shdr *shdr;
3035     char *strings = NULL;
3036     struct syminfo *s = NULL;
3037     struct elf_sym *new_syms, *syms = NULL;
3038 
3039     shnum = hdr->e_shnum;
3040     i = shnum * sizeof(struct elf_shdr);
3041     shdr = (struct elf_shdr *)alloca(i);
3042     if (pread(fd, shdr, i, hdr->e_shoff) != i) {
3043         return;
3044     }
3045 
3046     bswap_shdr(shdr, shnum);
3047     for (i = 0; i < shnum; ++i) {
3048         if (shdr[i].sh_type == SHT_SYMTAB) {
3049             sym_idx = i;
3050             str_idx = shdr[i].sh_link;
3051             goto found;
3052         }
3053     }
3054 
3055     /* There will be no symbol table if the file was stripped.  */
3056     return;
3057 
3058  found:
3059     /* Now know where the strtab and symtab are.  Snarf them.  */
3060     s = g_try_new(struct syminfo, 1);
3061     if (!s) {
3062         goto give_up;
3063     }
3064 
3065     segsz = shdr[str_idx].sh_size;
3066     s->disas_strtab = strings = g_try_malloc(segsz);
3067     if (!strings ||
3068         pread(fd, strings, segsz, shdr[str_idx].sh_offset) != segsz) {
3069         goto give_up;
3070     }
3071 
3072     segsz = shdr[sym_idx].sh_size;
3073     syms = g_try_malloc(segsz);
3074     if (!syms || pread(fd, syms, segsz, shdr[sym_idx].sh_offset) != segsz) {
3075         goto give_up;
3076     }
3077 
3078     if (segsz / sizeof(struct elf_sym) > INT_MAX) {
3079         /* Implausibly large symbol table: give up rather than ploughing
3080          * on with the number of symbols calculation overflowing
3081          */
3082         goto give_up;
3083     }
3084     nsyms = segsz / sizeof(struct elf_sym);
3085     for (i = 0; i < nsyms; ) {
3086         bswap_sym(syms + i);
3087         /* Throw away entries which we do not need.  */
3088         if (syms[i].st_shndx == SHN_UNDEF
3089             || syms[i].st_shndx >= SHN_LORESERVE
3090             || ELF_ST_TYPE(syms[i].st_info) != STT_FUNC) {
3091             if (i < --nsyms) {
3092                 syms[i] = syms[nsyms];
3093             }
3094         } else {
3095 #if defined(TARGET_ARM) || defined (TARGET_MIPS)
3096             /* The bottom address bit marks a Thumb or MIPS16 symbol.  */
3097             syms[i].st_value &= ~(target_ulong)1;
3098 #endif
3099             syms[i].st_value += load_bias;
3100             i++;
3101         }
3102     }
3103 
3104     /* No "useful" symbol.  */
3105     if (nsyms == 0) {
3106         goto give_up;
3107     }
3108 
3109     /* Attempt to free the storage associated with the local symbols
3110        that we threw away.  Whether or not this has any effect on the
3111        memory allocation depends on the malloc implementation and how
3112        many symbols we managed to discard.  */
3113     new_syms = g_try_renew(struct elf_sym, syms, nsyms);
3114     if (new_syms == NULL) {
3115         goto give_up;
3116     }
3117     syms = new_syms;
3118 
3119     qsort(syms, nsyms, sizeof(*syms), symcmp);
3120 
3121     s->disas_num_syms = nsyms;
3122 #if ELF_CLASS == ELFCLASS32
3123     s->disas_symtab.elf32 = syms;
3124 #else
3125     s->disas_symtab.elf64 = syms;
3126 #endif
3127     s->lookup_symbol = lookup_symbolxx;
3128     s->next = syminfos;
3129     syminfos = s;
3130 
3131     return;
3132 
3133 give_up:
3134     g_free(s);
3135     g_free(strings);
3136     g_free(syms);
3137 }
3138 
3139 uint32_t get_elf_eflags(int fd)
3140 {
3141     struct elfhdr ehdr;
3142     off_t offset;
3143     int ret;
3144 
3145     /* Read ELF header */
3146     offset = lseek(fd, 0, SEEK_SET);
3147     if (offset == (off_t) -1) {
3148         return 0;
3149     }
3150     ret = read(fd, &ehdr, sizeof(ehdr));
3151     if (ret < sizeof(ehdr)) {
3152         return 0;
3153     }
3154     offset = lseek(fd, offset, SEEK_SET);
3155     if (offset == (off_t) -1) {
3156         return 0;
3157     }
3158 
3159     /* Check ELF signature */
3160     if (!elf_check_ident(&ehdr)) {
3161         return 0;
3162     }
3163 
3164     /* check header */
3165     bswap_ehdr(&ehdr);
3166     if (!elf_check_ehdr(&ehdr)) {
3167         return 0;
3168     }
3169 
3170     /* return architecture id */
3171     return ehdr.e_flags;
3172 }
3173 
3174 int load_elf_binary(struct linux_binprm *bprm, struct image_info *info)
3175 {
3176     struct image_info interp_info;
3177     struct elfhdr elf_ex;
3178     char *elf_interpreter = NULL;
3179     char *scratch;
3180 
3181     memset(&interp_info, 0, sizeof(interp_info));
3182 #ifdef TARGET_MIPS
3183     interp_info.fp_abi = MIPS_ABI_FP_UNKNOWN;
3184 #endif
3185 
3186     info->start_mmap = (abi_ulong)ELF_START_MMAP;
3187 
3188     load_elf_image(bprm->filename, bprm->fd, info,
3189                    &elf_interpreter, bprm->buf);
3190 
3191     /* ??? We need a copy of the elf header for passing to create_elf_tables.
3192        If we do nothing, we'll have overwritten this when we re-use bprm->buf
3193        when we load the interpreter.  */
3194     elf_ex = *(struct elfhdr *)bprm->buf;
3195 
3196     /* Do this so that we can load the interpreter, if need be.  We will
3197        change some of these later */
3198     bprm->p = setup_arg_pages(bprm, info);
3199 
3200     scratch = g_new0(char, TARGET_PAGE_SIZE);
3201     if (STACK_GROWS_DOWN) {
3202         bprm->p = copy_elf_strings(1, &bprm->filename, scratch,
3203                                    bprm->p, info->stack_limit);
3204         info->file_string = bprm->p;
3205         bprm->p = copy_elf_strings(bprm->envc, bprm->envp, scratch,
3206                                    bprm->p, info->stack_limit);
3207         info->env_strings = bprm->p;
3208         bprm->p = copy_elf_strings(bprm->argc, bprm->argv, scratch,
3209                                    bprm->p, info->stack_limit);
3210         info->arg_strings = bprm->p;
3211     } else {
3212         info->arg_strings = bprm->p;
3213         bprm->p = copy_elf_strings(bprm->argc, bprm->argv, scratch,
3214                                    bprm->p, info->stack_limit);
3215         info->env_strings = bprm->p;
3216         bprm->p = copy_elf_strings(bprm->envc, bprm->envp, scratch,
3217                                    bprm->p, info->stack_limit);
3218         info->file_string = bprm->p;
3219         bprm->p = copy_elf_strings(1, &bprm->filename, scratch,
3220                                    bprm->p, info->stack_limit);
3221     }
3222 
3223     g_free(scratch);
3224 
3225     if (!bprm->p) {
3226         fprintf(stderr, "%s: %s\n", bprm->filename, strerror(E2BIG));
3227         exit(-1);
3228     }
3229 
3230     if (elf_interpreter) {
3231         load_elf_interp(elf_interpreter, &interp_info, bprm->buf);
3232 
3233         /* If the program interpreter is one of these two, then assume
3234            an iBCS2 image.  Otherwise assume a native linux image.  */
3235 
3236         if (strcmp(elf_interpreter, "/usr/lib/libc.so.1") == 0
3237             || strcmp(elf_interpreter, "/usr/lib/ld.so.1") == 0) {
3238             info->personality = PER_SVR4;
3239 
3240             /* Why this, you ask???  Well SVr4 maps page 0 as read-only,
3241                and some applications "depend" upon this behavior.  Since
3242                we do not have the power to recompile these, we emulate
3243                the SVr4 behavior.  Sigh.  */
3244             target_mmap(0, qemu_host_page_size, PROT_READ | PROT_EXEC,
3245                         MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
3246         }
3247 #ifdef TARGET_MIPS
3248         info->interp_fp_abi = interp_info.fp_abi;
3249 #endif
3250     }
3251 
3252     /*
3253      * TODO: load a vdso, which would also contain the signal trampolines.
3254      * Otherwise, allocate a private page to hold them.
3255      */
3256     if (TARGET_ARCH_HAS_SIGTRAMP_PAGE) {
3257         abi_ulong tramp_page = target_mmap(0, TARGET_PAGE_SIZE,
3258                                            PROT_READ | PROT_WRITE,
3259                                            MAP_PRIVATE | MAP_ANON, -1, 0);
3260         setup_sigtramp(tramp_page);
3261         target_mprotect(tramp_page, TARGET_PAGE_SIZE, PROT_READ | PROT_EXEC);
3262     }
3263 
3264     bprm->p = create_elf_tables(bprm->p, bprm->argc, bprm->envc, &elf_ex,
3265                                 info, (elf_interpreter ? &interp_info : NULL));
3266     info->start_stack = bprm->p;
3267 
3268     /* If we have an interpreter, set that as the program's entry point.
3269        Copy the load_bias as well, to help PPC64 interpret the entry
3270        point as a function descriptor.  Do this after creating elf tables
3271        so that we copy the original program entry point into the AUXV.  */
3272     if (elf_interpreter) {
3273         info->load_bias = interp_info.load_bias;
3274         info->entry = interp_info.entry;
3275         g_free(elf_interpreter);
3276     }
3277 
3278 #ifdef USE_ELF_CORE_DUMP
3279     bprm->core_dump = &elf_core_dump;
3280 #endif
3281 
3282     /*
3283      * If we reserved extra space for brk, release it now.
3284      * The implementation of do_brk in syscalls.c expects to be able
3285      * to mmap pages in this space.
3286      */
3287     if (info->reserve_brk) {
3288         abi_ulong start_brk = HOST_PAGE_ALIGN(info->brk);
3289         abi_ulong end_brk = HOST_PAGE_ALIGN(info->brk + info->reserve_brk);
3290         target_munmap(start_brk, end_brk - start_brk);
3291     }
3292 
3293     return 0;
3294 }
3295 
3296 #ifdef USE_ELF_CORE_DUMP
3297 /*
3298  * Definitions to generate Intel SVR4-like core files.
3299  * These mostly have the same names as the SVR4 types with "target_elf_"
3300  * tacked on the front to prevent clashes with linux definitions,
3301  * and the typedef forms have been avoided.  This is mostly like
3302  * the SVR4 structure, but more Linuxy, with things that Linux does
3303  * not support and which gdb doesn't really use excluded.
3304  *
3305  * Fields we don't dump (their contents is zero) in linux-user qemu
3306  * are marked with XXX.
3307  *
3308  * Core dump code is copied from linux kernel (fs/binfmt_elf.c).
3309  *
3310  * Porting ELF coredump for target is (quite) simple process.  First you
3311  * define USE_ELF_CORE_DUMP in target ELF code (where init_thread() for
3312  * the target resides):
3313  *
3314  * #define USE_ELF_CORE_DUMP
3315  *
3316  * Next you define type of register set used for dumping.  ELF specification
3317  * says that it needs to be array of elf_greg_t that has size of ELF_NREG.
3318  *
3319  * typedef <target_regtype> target_elf_greg_t;
3320  * #define ELF_NREG <number of registers>
3321  * typedef taret_elf_greg_t target_elf_gregset_t[ELF_NREG];
3322  *
3323  * Last step is to implement target specific function that copies registers
3324  * from given cpu into just specified register set.  Prototype is:
3325  *
3326  * static void elf_core_copy_regs(taret_elf_gregset_t *regs,
3327  *                                const CPUArchState *env);
3328  *
3329  * Parameters:
3330  *     regs - copy register values into here (allocated and zeroed by caller)
3331  *     env - copy registers from here
3332  *
3333  * Example for ARM target is provided in this file.
3334  */
3335 
3336 /* An ELF note in memory */
3337 struct memelfnote {
3338     const char *name;
3339     size_t     namesz;
3340     size_t     namesz_rounded;
3341     int        type;
3342     size_t     datasz;
3343     size_t     datasz_rounded;
3344     void       *data;
3345     size_t     notesz;
3346 };
3347 
3348 struct target_elf_siginfo {
3349     abi_int    si_signo; /* signal number */
3350     abi_int    si_code;  /* extra code */
3351     abi_int    si_errno; /* errno */
3352 };
3353 
3354 struct target_elf_prstatus {
3355     struct target_elf_siginfo pr_info;      /* Info associated with signal */
3356     abi_short          pr_cursig;    /* Current signal */
3357     abi_ulong          pr_sigpend;   /* XXX */
3358     abi_ulong          pr_sighold;   /* XXX */
3359     target_pid_t       pr_pid;
3360     target_pid_t       pr_ppid;
3361     target_pid_t       pr_pgrp;
3362     target_pid_t       pr_sid;
3363     struct target_timeval pr_utime;  /* XXX User time */
3364     struct target_timeval pr_stime;  /* XXX System time */
3365     struct target_timeval pr_cutime; /* XXX Cumulative user time */
3366     struct target_timeval pr_cstime; /* XXX Cumulative system time */
3367     target_elf_gregset_t      pr_reg;       /* GP registers */
3368     abi_int            pr_fpvalid;   /* XXX */
3369 };
3370 
3371 #define ELF_PRARGSZ     (80) /* Number of chars for args */
3372 
3373 struct target_elf_prpsinfo {
3374     char         pr_state;       /* numeric process state */
3375     char         pr_sname;       /* char for pr_state */
3376     char         pr_zomb;        /* zombie */
3377     char         pr_nice;        /* nice val */
3378     abi_ulong    pr_flag;        /* flags */
3379     target_uid_t pr_uid;
3380     target_gid_t pr_gid;
3381     target_pid_t pr_pid, pr_ppid, pr_pgrp, pr_sid;
3382     /* Lots missing */
3383     char    pr_fname[16] QEMU_NONSTRING; /* filename of executable */
3384     char    pr_psargs[ELF_PRARGSZ]; /* initial part of arg list */
3385 };
3386 
3387 /* Here is the structure in which status of each thread is captured. */
3388 struct elf_thread_status {
3389     QTAILQ_ENTRY(elf_thread_status)  ets_link;
3390     struct target_elf_prstatus prstatus;   /* NT_PRSTATUS */
3391 #if 0
3392     elf_fpregset_t fpu;             /* NT_PRFPREG */
3393     struct task_struct *thread;
3394     elf_fpxregset_t xfpu;           /* ELF_CORE_XFPREG_TYPE */
3395 #endif
3396     struct memelfnote notes[1];
3397     int num_notes;
3398 };
3399 
3400 struct elf_note_info {
3401     struct memelfnote   *notes;
3402     struct target_elf_prstatus *prstatus;  /* NT_PRSTATUS */
3403     struct target_elf_prpsinfo *psinfo;    /* NT_PRPSINFO */
3404 
3405     QTAILQ_HEAD(, elf_thread_status) thread_list;
3406 #if 0
3407     /*
3408      * Current version of ELF coredump doesn't support
3409      * dumping fp regs etc.
3410      */
3411     elf_fpregset_t *fpu;
3412     elf_fpxregset_t *xfpu;
3413     int thread_status_size;
3414 #endif
3415     int notes_size;
3416     int numnote;
3417 };
3418 
3419 struct vm_area_struct {
3420     target_ulong   vma_start;  /* start vaddr of memory region */
3421     target_ulong   vma_end;    /* end vaddr of memory region */
3422     abi_ulong      vma_flags;  /* protection etc. flags for the region */
3423     QTAILQ_ENTRY(vm_area_struct) vma_link;
3424 };
3425 
3426 struct mm_struct {
3427     QTAILQ_HEAD(, vm_area_struct) mm_mmap;
3428     int mm_count;           /* number of mappings */
3429 };
3430 
3431 static struct mm_struct *vma_init(void);
3432 static void vma_delete(struct mm_struct *);
3433 static int vma_add_mapping(struct mm_struct *, target_ulong,
3434                            target_ulong, abi_ulong);
3435 static int vma_get_mapping_count(const struct mm_struct *);
3436 static struct vm_area_struct *vma_first(const struct mm_struct *);
3437 static struct vm_area_struct *vma_next(struct vm_area_struct *);
3438 static abi_ulong vma_dump_size(const struct vm_area_struct *);
3439 static int vma_walker(void *priv, target_ulong start, target_ulong end,
3440                       unsigned long flags);
3441 
3442 static void fill_elf_header(struct elfhdr *, int, uint16_t, uint32_t);
3443 static void fill_note(struct memelfnote *, const char *, int,
3444                       unsigned int, void *);
3445 static void fill_prstatus(struct target_elf_prstatus *, const TaskState *, int);
3446 static int fill_psinfo(struct target_elf_prpsinfo *, const TaskState *);
3447 static void fill_auxv_note(struct memelfnote *, const TaskState *);
3448 static void fill_elf_note_phdr(struct elf_phdr *, int, off_t);
3449 static size_t note_size(const struct memelfnote *);
3450 static void free_note_info(struct elf_note_info *);
3451 static int fill_note_info(struct elf_note_info *, long, const CPUArchState *);
3452 static void fill_thread_info(struct elf_note_info *, const CPUArchState *);
3453 
3454 static int dump_write(int, const void *, size_t);
3455 static int write_note(struct memelfnote *, int);
3456 static int write_note_info(struct elf_note_info *, int);
3457 
3458 #ifdef BSWAP_NEEDED
3459 static void bswap_prstatus(struct target_elf_prstatus *prstatus)
3460 {
3461     prstatus->pr_info.si_signo = tswap32(prstatus->pr_info.si_signo);
3462     prstatus->pr_info.si_code = tswap32(prstatus->pr_info.si_code);
3463     prstatus->pr_info.si_errno = tswap32(prstatus->pr_info.si_errno);
3464     prstatus->pr_cursig = tswap16(prstatus->pr_cursig);
3465     prstatus->pr_sigpend = tswapal(prstatus->pr_sigpend);
3466     prstatus->pr_sighold = tswapal(prstatus->pr_sighold);
3467     prstatus->pr_pid = tswap32(prstatus->pr_pid);
3468     prstatus->pr_ppid = tswap32(prstatus->pr_ppid);
3469     prstatus->pr_pgrp = tswap32(prstatus->pr_pgrp);
3470     prstatus->pr_sid = tswap32(prstatus->pr_sid);
3471     /* cpu times are not filled, so we skip them */
3472     /* regs should be in correct format already */
3473     prstatus->pr_fpvalid = tswap32(prstatus->pr_fpvalid);
3474 }
3475 
3476 static void bswap_psinfo(struct target_elf_prpsinfo *psinfo)
3477 {
3478     psinfo->pr_flag = tswapal(psinfo->pr_flag);
3479     psinfo->pr_uid = tswap16(psinfo->pr_uid);
3480     psinfo->pr_gid = tswap16(psinfo->pr_gid);
3481     psinfo->pr_pid = tswap32(psinfo->pr_pid);
3482     psinfo->pr_ppid = tswap32(psinfo->pr_ppid);
3483     psinfo->pr_pgrp = tswap32(psinfo->pr_pgrp);
3484     psinfo->pr_sid = tswap32(psinfo->pr_sid);
3485 }
3486 
3487 static void bswap_note(struct elf_note *en)
3488 {
3489     bswap32s(&en->n_namesz);
3490     bswap32s(&en->n_descsz);
3491     bswap32s(&en->n_type);
3492 }
3493 #else
3494 static inline void bswap_prstatus(struct target_elf_prstatus *p) { }
3495 static inline void bswap_psinfo(struct target_elf_prpsinfo *p) {}
3496 static inline void bswap_note(struct elf_note *en) { }
3497 #endif /* BSWAP_NEEDED */
3498 
3499 /*
3500  * Minimal support for linux memory regions.  These are needed
3501  * when we are finding out what memory exactly belongs to
3502  * emulated process.  No locks needed here, as long as
3503  * thread that received the signal is stopped.
3504  */
3505 
3506 static struct mm_struct *vma_init(void)
3507 {
3508     struct mm_struct *mm;
3509 
3510     if ((mm = g_malloc(sizeof (*mm))) == NULL)
3511         return (NULL);
3512 
3513     mm->mm_count = 0;
3514     QTAILQ_INIT(&mm->mm_mmap);
3515 
3516     return (mm);
3517 }
3518 
3519 static void vma_delete(struct mm_struct *mm)
3520 {
3521     struct vm_area_struct *vma;
3522 
3523     while ((vma = vma_first(mm)) != NULL) {
3524         QTAILQ_REMOVE(&mm->mm_mmap, vma, vma_link);
3525         g_free(vma);
3526     }
3527     g_free(mm);
3528 }
3529 
3530 static int vma_add_mapping(struct mm_struct *mm, target_ulong start,
3531                            target_ulong end, abi_ulong flags)
3532 {
3533     struct vm_area_struct *vma;
3534 
3535     if ((vma = g_malloc0(sizeof (*vma))) == NULL)
3536         return (-1);
3537 
3538     vma->vma_start = start;
3539     vma->vma_end = end;
3540     vma->vma_flags = flags;
3541 
3542     QTAILQ_INSERT_TAIL(&mm->mm_mmap, vma, vma_link);
3543     mm->mm_count++;
3544 
3545     return (0);
3546 }
3547 
3548 static struct vm_area_struct *vma_first(const struct mm_struct *mm)
3549 {
3550     return (QTAILQ_FIRST(&mm->mm_mmap));
3551 }
3552 
3553 static struct vm_area_struct *vma_next(struct vm_area_struct *vma)
3554 {
3555     return (QTAILQ_NEXT(vma, vma_link));
3556 }
3557 
3558 static int vma_get_mapping_count(const struct mm_struct *mm)
3559 {
3560     return (mm->mm_count);
3561 }
3562 
3563 /*
3564  * Calculate file (dump) size of given memory region.
3565  */
3566 static abi_ulong vma_dump_size(const struct vm_area_struct *vma)
3567 {
3568     /* if we cannot even read the first page, skip it */
3569     if (!access_ok_untagged(VERIFY_READ, vma->vma_start, TARGET_PAGE_SIZE))
3570         return (0);
3571 
3572     /*
3573      * Usually we don't dump executable pages as they contain
3574      * non-writable code that debugger can read directly from
3575      * target library etc.  However, thread stacks are marked
3576      * also executable so we read in first page of given region
3577      * and check whether it contains elf header.  If there is
3578      * no elf header, we dump it.
3579      */
3580     if (vma->vma_flags & PROT_EXEC) {
3581         char page[TARGET_PAGE_SIZE];
3582 
3583         if (copy_from_user(page, vma->vma_start, sizeof (page))) {
3584             return 0;
3585         }
3586         if ((page[EI_MAG0] == ELFMAG0) &&
3587             (page[EI_MAG1] == ELFMAG1) &&
3588             (page[EI_MAG2] == ELFMAG2) &&
3589             (page[EI_MAG3] == ELFMAG3)) {
3590             /*
3591              * Mappings are possibly from ELF binary.  Don't dump
3592              * them.
3593              */
3594             return (0);
3595         }
3596     }
3597 
3598     return (vma->vma_end - vma->vma_start);
3599 }
3600 
3601 static int vma_walker(void *priv, target_ulong start, target_ulong end,
3602                       unsigned long flags)
3603 {
3604     struct mm_struct *mm = (struct mm_struct *)priv;
3605 
3606     vma_add_mapping(mm, start, end, flags);
3607     return (0);
3608 }
3609 
3610 static void fill_note(struct memelfnote *note, const char *name, int type,
3611                       unsigned int sz, void *data)
3612 {
3613     unsigned int namesz;
3614 
3615     namesz = strlen(name) + 1;
3616     note->name = name;
3617     note->namesz = namesz;
3618     note->namesz_rounded = roundup(namesz, sizeof (int32_t));
3619     note->type = type;
3620     note->datasz = sz;
3621     note->datasz_rounded = roundup(sz, sizeof (int32_t));
3622 
3623     note->data = data;
3624 
3625     /*
3626      * We calculate rounded up note size here as specified by
3627      * ELF document.
3628      */
3629     note->notesz = sizeof (struct elf_note) +
3630         note->namesz_rounded + note->datasz_rounded;
3631 }
3632 
3633 static void fill_elf_header(struct elfhdr *elf, int segs, uint16_t machine,
3634                             uint32_t flags)
3635 {
3636     (void) memset(elf, 0, sizeof(*elf));
3637 
3638     (void) memcpy(elf->e_ident, ELFMAG, SELFMAG);
3639     elf->e_ident[EI_CLASS] = ELF_CLASS;
3640     elf->e_ident[EI_DATA] = ELF_DATA;
3641     elf->e_ident[EI_VERSION] = EV_CURRENT;
3642     elf->e_ident[EI_OSABI] = ELF_OSABI;
3643 
3644     elf->e_type = ET_CORE;
3645     elf->e_machine = machine;
3646     elf->e_version = EV_CURRENT;
3647     elf->e_phoff = sizeof(struct elfhdr);
3648     elf->e_flags = flags;
3649     elf->e_ehsize = sizeof(struct elfhdr);
3650     elf->e_phentsize = sizeof(struct elf_phdr);
3651     elf->e_phnum = segs;
3652 
3653     bswap_ehdr(elf);
3654 }
3655 
3656 static void fill_elf_note_phdr(struct elf_phdr *phdr, int sz, off_t offset)
3657 {
3658     phdr->p_type = PT_NOTE;
3659     phdr->p_offset = offset;
3660     phdr->p_vaddr = 0;
3661     phdr->p_paddr = 0;
3662     phdr->p_filesz = sz;
3663     phdr->p_memsz = 0;
3664     phdr->p_flags = 0;
3665     phdr->p_align = 0;
3666 
3667     bswap_phdr(phdr, 1);
3668 }
3669 
3670 static size_t note_size(const struct memelfnote *note)
3671 {
3672     return (note->notesz);
3673 }
3674 
3675 static void fill_prstatus(struct target_elf_prstatus *prstatus,
3676                           const TaskState *ts, int signr)
3677 {
3678     (void) memset(prstatus, 0, sizeof (*prstatus));
3679     prstatus->pr_info.si_signo = prstatus->pr_cursig = signr;
3680     prstatus->pr_pid = ts->ts_tid;
3681     prstatus->pr_ppid = getppid();
3682     prstatus->pr_pgrp = getpgrp();
3683     prstatus->pr_sid = getsid(0);
3684 
3685     bswap_prstatus(prstatus);
3686 }
3687 
3688 static int fill_psinfo(struct target_elf_prpsinfo *psinfo, const TaskState *ts)
3689 {
3690     char *base_filename;
3691     unsigned int i, len;
3692 
3693     (void) memset(psinfo, 0, sizeof (*psinfo));
3694 
3695     len = ts->info->env_strings - ts->info->arg_strings;
3696     if (len >= ELF_PRARGSZ)
3697         len = ELF_PRARGSZ - 1;
3698     if (copy_from_user(&psinfo->pr_psargs, ts->info->arg_strings, len)) {
3699         return -EFAULT;
3700     }
3701     for (i = 0; i < len; i++)
3702         if (psinfo->pr_psargs[i] == 0)
3703             psinfo->pr_psargs[i] = ' ';
3704     psinfo->pr_psargs[len] = 0;
3705 
3706     psinfo->pr_pid = getpid();
3707     psinfo->pr_ppid = getppid();
3708     psinfo->pr_pgrp = getpgrp();
3709     psinfo->pr_sid = getsid(0);
3710     psinfo->pr_uid = getuid();
3711     psinfo->pr_gid = getgid();
3712 
3713     base_filename = g_path_get_basename(ts->bprm->filename);
3714     /*
3715      * Using strncpy here is fine: at max-length,
3716      * this field is not NUL-terminated.
3717      */
3718     (void) strncpy(psinfo->pr_fname, base_filename,
3719                    sizeof(psinfo->pr_fname));
3720 
3721     g_free(base_filename);
3722     bswap_psinfo(psinfo);
3723     return (0);
3724 }
3725 
3726 static void fill_auxv_note(struct memelfnote *note, const TaskState *ts)
3727 {
3728     elf_addr_t auxv = (elf_addr_t)ts->info->saved_auxv;
3729     elf_addr_t orig_auxv = auxv;
3730     void *ptr;
3731     int len = ts->info->auxv_len;
3732 
3733     /*
3734      * Auxiliary vector is stored in target process stack.  It contains
3735      * {type, value} pairs that we need to dump into note.  This is not
3736      * strictly necessary but we do it here for sake of completeness.
3737      */
3738 
3739     /* read in whole auxv vector and copy it to memelfnote */
3740     ptr = lock_user(VERIFY_READ, orig_auxv, len, 0);
3741     if (ptr != NULL) {
3742         fill_note(note, "CORE", NT_AUXV, len, ptr);
3743         unlock_user(ptr, auxv, len);
3744     }
3745 }
3746 
3747 /*
3748  * Constructs name of coredump file.  We have following convention
3749  * for the name:
3750  *     qemu_<basename-of-target-binary>_<date>-<time>_<pid>.core
3751  *
3752  * Returns the filename
3753  */
3754 static char *core_dump_filename(const TaskState *ts)
3755 {
3756     g_autoptr(GDateTime) now = g_date_time_new_now_local();
3757     g_autofree char *nowstr = g_date_time_format(now, "%Y%m%d-%H%M%S");
3758     g_autofree char *base_filename = g_path_get_basename(ts->bprm->filename);
3759 
3760     return g_strdup_printf("qemu_%s_%s_%d.core",
3761                            base_filename, nowstr, (int)getpid());
3762 }
3763 
3764 static int dump_write(int fd, const void *ptr, size_t size)
3765 {
3766     const char *bufp = (const char *)ptr;
3767     ssize_t bytes_written, bytes_left;
3768     struct rlimit dumpsize;
3769     off_t pos;
3770 
3771     bytes_written = 0;
3772     getrlimit(RLIMIT_CORE, &dumpsize);
3773     if ((pos = lseek(fd, 0, SEEK_CUR))==-1) {
3774         if (errno == ESPIPE) { /* not a seekable stream */
3775             bytes_left = size;
3776         } else {
3777             return pos;
3778         }
3779     } else {
3780         if (dumpsize.rlim_cur <= pos) {
3781             return -1;
3782         } else if (dumpsize.rlim_cur == RLIM_INFINITY) {
3783             bytes_left = size;
3784         } else {
3785             size_t limit_left=dumpsize.rlim_cur - pos;
3786             bytes_left = limit_left >= size ? size : limit_left ;
3787         }
3788     }
3789 
3790     /*
3791      * In normal conditions, single write(2) should do but
3792      * in case of socket etc. this mechanism is more portable.
3793      */
3794     do {
3795         bytes_written = write(fd, bufp, bytes_left);
3796         if (bytes_written < 0) {
3797             if (errno == EINTR)
3798                 continue;
3799             return (-1);
3800         } else if (bytes_written == 0) { /* eof */
3801             return (-1);
3802         }
3803         bufp += bytes_written;
3804         bytes_left -= bytes_written;
3805     } while (bytes_left > 0);
3806 
3807     return (0);
3808 }
3809 
3810 static int write_note(struct memelfnote *men, int fd)
3811 {
3812     struct elf_note en;
3813 
3814     en.n_namesz = men->namesz;
3815     en.n_type = men->type;
3816     en.n_descsz = men->datasz;
3817 
3818     bswap_note(&en);
3819 
3820     if (dump_write(fd, &en, sizeof(en)) != 0)
3821         return (-1);
3822     if (dump_write(fd, men->name, men->namesz_rounded) != 0)
3823         return (-1);
3824     if (dump_write(fd, men->data, men->datasz_rounded) != 0)
3825         return (-1);
3826 
3827     return (0);
3828 }
3829 
3830 static void fill_thread_info(struct elf_note_info *info, const CPUArchState *env)
3831 {
3832     CPUState *cpu = env_cpu((CPUArchState *)env);
3833     TaskState *ts = (TaskState *)cpu->opaque;
3834     struct elf_thread_status *ets;
3835 
3836     ets = g_malloc0(sizeof (*ets));
3837     ets->num_notes = 1; /* only prstatus is dumped */
3838     fill_prstatus(&ets->prstatus, ts, 0);
3839     elf_core_copy_regs(&ets->prstatus.pr_reg, env);
3840     fill_note(&ets->notes[0], "CORE", NT_PRSTATUS, sizeof (ets->prstatus),
3841               &ets->prstatus);
3842 
3843     QTAILQ_INSERT_TAIL(&info->thread_list, ets, ets_link);
3844 
3845     info->notes_size += note_size(&ets->notes[0]);
3846 }
3847 
3848 static void init_note_info(struct elf_note_info *info)
3849 {
3850     /* Initialize the elf_note_info structure so that it is at
3851      * least safe to call free_note_info() on it. Must be
3852      * called before calling fill_note_info().
3853      */
3854     memset(info, 0, sizeof (*info));
3855     QTAILQ_INIT(&info->thread_list);
3856 }
3857 
3858 static int fill_note_info(struct elf_note_info *info,
3859                           long signr, const CPUArchState *env)
3860 {
3861 #define NUMNOTES 3
3862     CPUState *cpu = env_cpu((CPUArchState *)env);
3863     TaskState *ts = (TaskState *)cpu->opaque;
3864     int i;
3865 
3866     info->notes = g_new0(struct memelfnote, NUMNOTES);
3867     if (info->notes == NULL)
3868         return (-ENOMEM);
3869     info->prstatus = g_malloc0(sizeof (*info->prstatus));
3870     if (info->prstatus == NULL)
3871         return (-ENOMEM);
3872     info->psinfo = g_malloc0(sizeof (*info->psinfo));
3873     if (info->prstatus == NULL)
3874         return (-ENOMEM);
3875 
3876     /*
3877      * First fill in status (and registers) of current thread
3878      * including process info & aux vector.
3879      */
3880     fill_prstatus(info->prstatus, ts, signr);
3881     elf_core_copy_regs(&info->prstatus->pr_reg, env);
3882     fill_note(&info->notes[0], "CORE", NT_PRSTATUS,
3883               sizeof (*info->prstatus), info->prstatus);
3884     fill_psinfo(info->psinfo, ts);
3885     fill_note(&info->notes[1], "CORE", NT_PRPSINFO,
3886               sizeof (*info->psinfo), info->psinfo);
3887     fill_auxv_note(&info->notes[2], ts);
3888     info->numnote = 3;
3889 
3890     info->notes_size = 0;
3891     for (i = 0; i < info->numnote; i++)
3892         info->notes_size += note_size(&info->notes[i]);
3893 
3894     /* read and fill status of all threads */
3895     cpu_list_lock();
3896     CPU_FOREACH(cpu) {
3897         if (cpu == thread_cpu) {
3898             continue;
3899         }
3900         fill_thread_info(info, (CPUArchState *)cpu->env_ptr);
3901     }
3902     cpu_list_unlock();
3903 
3904     return (0);
3905 }
3906 
3907 static void free_note_info(struct elf_note_info *info)
3908 {
3909     struct elf_thread_status *ets;
3910 
3911     while (!QTAILQ_EMPTY(&info->thread_list)) {
3912         ets = QTAILQ_FIRST(&info->thread_list);
3913         QTAILQ_REMOVE(&info->thread_list, ets, ets_link);
3914         g_free(ets);
3915     }
3916 
3917     g_free(info->prstatus);
3918     g_free(info->psinfo);
3919     g_free(info->notes);
3920 }
3921 
3922 static int write_note_info(struct elf_note_info *info, int fd)
3923 {
3924     struct elf_thread_status *ets;
3925     int i, error = 0;
3926 
3927     /* write prstatus, psinfo and auxv for current thread */
3928     for (i = 0; i < info->numnote; i++)
3929         if ((error = write_note(&info->notes[i], fd)) != 0)
3930             return (error);
3931 
3932     /* write prstatus for each thread */
3933     QTAILQ_FOREACH(ets, &info->thread_list, ets_link) {
3934         if ((error = write_note(&ets->notes[0], fd)) != 0)
3935             return (error);
3936     }
3937 
3938     return (0);
3939 }
3940 
3941 /*
3942  * Write out ELF coredump.
3943  *
3944  * See documentation of ELF object file format in:
3945  * http://www.caldera.com/developers/devspecs/gabi41.pdf
3946  *
3947  * Coredump format in linux is following:
3948  *
3949  * 0   +----------------------+         \
3950  *     | ELF header           | ET_CORE  |
3951  *     +----------------------+          |
3952  *     | ELF program headers  |          |--- headers
3953  *     | - NOTE section       |          |
3954  *     | - PT_LOAD sections   |          |
3955  *     +----------------------+         /
3956  *     | NOTEs:               |
3957  *     | - NT_PRSTATUS        |
3958  *     | - NT_PRSINFO         |
3959  *     | - NT_AUXV            |
3960  *     +----------------------+ <-- aligned to target page
3961  *     | Process memory dump  |
3962  *     :                      :
3963  *     .                      .
3964  *     :                      :
3965  *     |                      |
3966  *     +----------------------+
3967  *
3968  * NT_PRSTATUS -> struct elf_prstatus (per thread)
3969  * NT_PRSINFO  -> struct elf_prpsinfo
3970  * NT_AUXV is array of { type, value } pairs (see fill_auxv_note()).
3971  *
3972  * Format follows System V format as close as possible.  Current
3973  * version limitations are as follows:
3974  *     - no floating point registers are dumped
3975  *
3976  * Function returns 0 in case of success, negative errno otherwise.
3977  *
3978  * TODO: make this work also during runtime: it should be
3979  * possible to force coredump from running process and then
3980  * continue processing.  For example qemu could set up SIGUSR2
3981  * handler (provided that target process haven't registered
3982  * handler for that) that does the dump when signal is received.
3983  */
3984 static int elf_core_dump(int signr, const CPUArchState *env)
3985 {
3986     const CPUState *cpu = env_cpu((CPUArchState *)env);
3987     const TaskState *ts = (const TaskState *)cpu->opaque;
3988     struct vm_area_struct *vma = NULL;
3989     g_autofree char *corefile = NULL;
3990     struct elf_note_info info;
3991     struct elfhdr elf;
3992     struct elf_phdr phdr;
3993     struct rlimit dumpsize;
3994     struct mm_struct *mm = NULL;
3995     off_t offset = 0, data_offset = 0;
3996     int segs = 0;
3997     int fd = -1;
3998 
3999     init_note_info(&info);
4000 
4001     errno = 0;
4002     getrlimit(RLIMIT_CORE, &dumpsize);
4003     if (dumpsize.rlim_cur == 0)
4004         return 0;
4005 
4006     corefile = core_dump_filename(ts);
4007 
4008     if ((fd = open(corefile, O_WRONLY | O_CREAT,
4009                    S_IRUSR|S_IWUSR|S_IRGRP|S_IROTH)) < 0)
4010         return (-errno);
4011 
4012     /*
4013      * Walk through target process memory mappings and
4014      * set up structure containing this information.  After
4015      * this point vma_xxx functions can be used.
4016      */
4017     if ((mm = vma_init()) == NULL)
4018         goto out;
4019 
4020     walk_memory_regions(mm, vma_walker);
4021     segs = vma_get_mapping_count(mm);
4022 
4023     /*
4024      * Construct valid coredump ELF header.  We also
4025      * add one more segment for notes.
4026      */
4027     fill_elf_header(&elf, segs + 1, ELF_MACHINE, 0);
4028     if (dump_write(fd, &elf, sizeof (elf)) != 0)
4029         goto out;
4030 
4031     /* fill in the in-memory version of notes */
4032     if (fill_note_info(&info, signr, env) < 0)
4033         goto out;
4034 
4035     offset += sizeof (elf);                             /* elf header */
4036     offset += (segs + 1) * sizeof (struct elf_phdr);    /* program headers */
4037 
4038     /* write out notes program header */
4039     fill_elf_note_phdr(&phdr, info.notes_size, offset);
4040 
4041     offset += info.notes_size;
4042     if (dump_write(fd, &phdr, sizeof (phdr)) != 0)
4043         goto out;
4044 
4045     /*
4046      * ELF specification wants data to start at page boundary so
4047      * we align it here.
4048      */
4049     data_offset = offset = roundup(offset, ELF_EXEC_PAGESIZE);
4050 
4051     /*
4052      * Write program headers for memory regions mapped in
4053      * the target process.
4054      */
4055     for (vma = vma_first(mm); vma != NULL; vma = vma_next(vma)) {
4056         (void) memset(&phdr, 0, sizeof (phdr));
4057 
4058         phdr.p_type = PT_LOAD;
4059         phdr.p_offset = offset;
4060         phdr.p_vaddr = vma->vma_start;
4061         phdr.p_paddr = 0;
4062         phdr.p_filesz = vma_dump_size(vma);
4063         offset += phdr.p_filesz;
4064         phdr.p_memsz = vma->vma_end - vma->vma_start;
4065         phdr.p_flags = vma->vma_flags & PROT_READ ? PF_R : 0;
4066         if (vma->vma_flags & PROT_WRITE)
4067             phdr.p_flags |= PF_W;
4068         if (vma->vma_flags & PROT_EXEC)
4069             phdr.p_flags |= PF_X;
4070         phdr.p_align = ELF_EXEC_PAGESIZE;
4071 
4072         bswap_phdr(&phdr, 1);
4073         if (dump_write(fd, &phdr, sizeof(phdr)) != 0) {
4074             goto out;
4075         }
4076     }
4077 
4078     /*
4079      * Next we write notes just after program headers.  No
4080      * alignment needed here.
4081      */
4082     if (write_note_info(&info, fd) < 0)
4083         goto out;
4084 
4085     /* align data to page boundary */
4086     if (lseek(fd, data_offset, SEEK_SET) != data_offset)
4087         goto out;
4088 
4089     /*
4090      * Finally we can dump process memory into corefile as well.
4091      */
4092     for (vma = vma_first(mm); vma != NULL; vma = vma_next(vma)) {
4093         abi_ulong addr;
4094         abi_ulong end;
4095 
4096         end = vma->vma_start + vma_dump_size(vma);
4097 
4098         for (addr = vma->vma_start; addr < end;
4099              addr += TARGET_PAGE_SIZE) {
4100             char page[TARGET_PAGE_SIZE];
4101             int error;
4102 
4103             /*
4104              *  Read in page from target process memory and
4105              *  write it to coredump file.
4106              */
4107             error = copy_from_user(page, addr, sizeof (page));
4108             if (error != 0) {
4109                 (void) fprintf(stderr, "unable to dump " TARGET_ABI_FMT_lx "\n",
4110                                addr);
4111                 errno = -error;
4112                 goto out;
4113             }
4114             if (dump_write(fd, page, TARGET_PAGE_SIZE) < 0)
4115                 goto out;
4116         }
4117     }
4118 
4119  out:
4120     free_note_info(&info);
4121     if (mm != NULL)
4122         vma_delete(mm);
4123     (void) close(fd);
4124 
4125     if (errno != 0)
4126         return (-errno);
4127     return (0);
4128 }
4129 #endif /* USE_ELF_CORE_DUMP */
4130 
4131 void do_init_thread(struct target_pt_regs *regs, struct image_info *infop)
4132 {
4133     init_thread(regs, infop);
4134 }
4135