xref: /openbmc/qemu/linux-user/syscall.c (revision 0fbc0f8d)
1 /*
2  *  Linux syscalls
3  *
4  *  Copyright (c) 2003 Fabrice Bellard
5  *
6  *  This program is free software; you can redistribute it and/or modify
7  *  it under the terms of the GNU General Public License as published by
8  *  the Free Software Foundation; either version 2 of the License, or
9  *  (at your option) any later version.
10  *
11  *  This program is distributed in the hope that it will be useful,
12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14  *  GNU General Public License for more details.
15  *
16  *  You should have received a copy of the GNU General Public License
17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
18  */
19 #define _ATFILE_SOURCE
20 #include "qemu/osdep.h"
21 #include "qemu/cutils.h"
22 #include "qemu/path.h"
23 #include "qemu/memfd.h"
24 #include "qemu/queue.h"
25 #include <elf.h>
26 #include <endian.h>
27 #include <grp.h>
28 #include <sys/ipc.h>
29 #include <sys/msg.h>
30 #include <sys/wait.h>
31 #include <sys/mount.h>
32 #include <sys/file.h>
33 #include <sys/fsuid.h>
34 #include <sys/personality.h>
35 #include <sys/prctl.h>
36 #include <sys/resource.h>
37 #include <sys/swap.h>
38 #include <linux/capability.h>
39 #include <sched.h>
40 #include <sys/timex.h>
41 #include <sys/socket.h>
42 #include <linux/sockios.h>
43 #include <sys/un.h>
44 #include <sys/uio.h>
45 #include <poll.h>
46 #include <sys/times.h>
47 #include <sys/shm.h>
48 #include <sys/sem.h>
49 #include <sys/statfs.h>
50 #include <utime.h>
51 #include <sys/sysinfo.h>
52 #include <sys/signalfd.h>
53 //#include <sys/user.h>
54 #include <netinet/in.h>
55 #include <netinet/ip.h>
56 #include <netinet/tcp.h>
57 #include <netinet/udp.h>
58 #include <linux/wireless.h>
59 #include <linux/icmp.h>
60 #include <linux/icmpv6.h>
61 #include <linux/if_tun.h>
62 #include <linux/in6.h>
63 #include <linux/errqueue.h>
64 #include <linux/random.h>
65 #ifdef CONFIG_TIMERFD
66 #include <sys/timerfd.h>
67 #endif
68 #ifdef CONFIG_EVENTFD
69 #include <sys/eventfd.h>
70 #endif
71 #ifdef CONFIG_EPOLL
72 #include <sys/epoll.h>
73 #endif
74 #ifdef CONFIG_ATTR
75 #include "qemu/xattr.h"
76 #endif
77 #ifdef CONFIG_SENDFILE
78 #include <sys/sendfile.h>
79 #endif
80 #ifdef HAVE_SYS_KCOV_H
81 #include <sys/kcov.h>
82 #endif
83 
84 #define termios host_termios
85 #define winsize host_winsize
86 #define termio host_termio
87 #define sgttyb host_sgttyb /* same as target */
88 #define tchars host_tchars /* same as target */
89 #define ltchars host_ltchars /* same as target */
90 
91 #include <linux/termios.h>
92 #include <linux/unistd.h>
93 #include <linux/cdrom.h>
94 #include <linux/hdreg.h>
95 #include <linux/soundcard.h>
96 #include <linux/kd.h>
97 #include <linux/mtio.h>
98 
99 #ifdef HAVE_SYS_MOUNT_FSCONFIG
100 /*
101  * glibc >= 2.36 linux/mount.h conflicts with sys/mount.h,
102  * which in turn prevents use of linux/fs.h. So we have to
103  * define the constants ourselves for now.
104  */
105 #define FS_IOC_GETFLAGS                _IOR('f', 1, long)
106 #define FS_IOC_SETFLAGS                _IOW('f', 2, long)
107 #define FS_IOC_GETVERSION              _IOR('v', 1, long)
108 #define FS_IOC_SETVERSION              _IOW('v', 2, long)
109 #define FS_IOC_FIEMAP                  _IOWR('f', 11, struct fiemap)
110 #define FS_IOC32_GETFLAGS              _IOR('f', 1, int)
111 #define FS_IOC32_SETFLAGS              _IOW('f', 2, int)
112 #define FS_IOC32_GETVERSION            _IOR('v', 1, int)
113 #define FS_IOC32_SETVERSION            _IOW('v', 2, int)
114 #else
115 #include <linux/fs.h>
116 #endif
117 #include <linux/fd.h>
118 #if defined(CONFIG_FIEMAP)
119 #include <linux/fiemap.h>
120 #endif
121 #include <linux/fb.h>
122 #if defined(CONFIG_USBFS)
123 #include <linux/usbdevice_fs.h>
124 #include <linux/usb/ch9.h>
125 #endif
126 #include <linux/vt.h>
127 #include <linux/dm-ioctl.h>
128 #include <linux/reboot.h>
129 #include <linux/route.h>
130 #include <linux/filter.h>
131 #include <linux/blkpg.h>
132 #include <netpacket/packet.h>
133 #include <linux/netlink.h>
134 #include <linux/if_alg.h>
135 #include <linux/rtc.h>
136 #include <sound/asound.h>
137 #ifdef HAVE_BTRFS_H
138 #include <linux/btrfs.h>
139 #endif
140 #ifdef HAVE_DRM_H
141 #include <libdrm/drm.h>
142 #include <libdrm/i915_drm.h>
143 #endif
144 #include "linux_loop.h"
145 #include "uname.h"
146 
147 #include "qemu.h"
148 #include "user-internals.h"
149 #include "strace.h"
150 #include "signal-common.h"
151 #include "loader.h"
152 #include "user-mmap.h"
153 #include "user/safe-syscall.h"
154 #include "qemu/guest-random.h"
155 #include "qemu/selfmap.h"
156 #include "user/syscall-trace.h"
157 #include "special-errno.h"
158 #include "qapi/error.h"
159 #include "fd-trans.h"
160 #include "tcg/tcg.h"
161 
162 #ifndef CLONE_IO
163 #define CLONE_IO                0x80000000      /* Clone io context */
164 #endif
165 
166 /* We can't directly call the host clone syscall, because this will
167  * badly confuse libc (breaking mutexes, for example). So we must
168  * divide clone flags into:
169  *  * flag combinations that look like pthread_create()
170  *  * flag combinations that look like fork()
171  *  * flags we can implement within QEMU itself
172  *  * flags we can't support and will return an error for
173  */
174 /* For thread creation, all these flags must be present; for
175  * fork, none must be present.
176  */
177 #define CLONE_THREAD_FLAGS                              \
178     (CLONE_VM | CLONE_FS | CLONE_FILES |                \
179      CLONE_SIGHAND | CLONE_THREAD | CLONE_SYSVSEM)
180 
181 /* These flags are ignored:
182  * CLONE_DETACHED is now ignored by the kernel;
183  * CLONE_IO is just an optimisation hint to the I/O scheduler
184  */
185 #define CLONE_IGNORED_FLAGS                     \
186     (CLONE_DETACHED | CLONE_IO)
187 
188 /* Flags for fork which we can implement within QEMU itself */
189 #define CLONE_OPTIONAL_FORK_FLAGS               \
190     (CLONE_SETTLS | CLONE_PARENT_SETTID |       \
191      CLONE_CHILD_CLEARTID | CLONE_CHILD_SETTID)
192 
193 /* Flags for thread creation which we can implement within QEMU itself */
194 #define CLONE_OPTIONAL_THREAD_FLAGS                             \
195     (CLONE_SETTLS | CLONE_PARENT_SETTID |                       \
196      CLONE_CHILD_CLEARTID | CLONE_CHILD_SETTID | CLONE_PARENT)
197 
198 #define CLONE_INVALID_FORK_FLAGS                                        \
199     (~(CSIGNAL | CLONE_OPTIONAL_FORK_FLAGS | CLONE_IGNORED_FLAGS))
200 
201 #define CLONE_INVALID_THREAD_FLAGS                                      \
202     (~(CSIGNAL | CLONE_THREAD_FLAGS | CLONE_OPTIONAL_THREAD_FLAGS |     \
203        CLONE_IGNORED_FLAGS))
204 
205 /* CLONE_VFORK is special cased early in do_fork(). The other flag bits
206  * have almost all been allocated. We cannot support any of
207  * CLONE_NEWNS, CLONE_NEWCGROUP, CLONE_NEWUTS, CLONE_NEWIPC,
208  * CLONE_NEWUSER, CLONE_NEWPID, CLONE_NEWNET, CLONE_PTRACE, CLONE_UNTRACED.
209  * The checks against the invalid thread masks above will catch these.
210  * (The one remaining unallocated bit is 0x1000 which used to be CLONE_PID.)
211  */
212 
213 /* Define DEBUG_ERESTARTSYS to force every syscall to be restarted
214  * once. This exercises the codepaths for restart.
215  */
216 //#define DEBUG_ERESTARTSYS
217 
218 //#include <linux/msdos_fs.h>
219 #define VFAT_IOCTL_READDIR_BOTH \
220     _IOC(_IOC_READ, 'r', 1, (sizeof(struct linux_dirent) + 256) * 2)
221 #define VFAT_IOCTL_READDIR_SHORT \
222     _IOC(_IOC_READ, 'r', 2, (sizeof(struct linux_dirent) + 256) * 2)
223 
224 #undef _syscall0
225 #undef _syscall1
226 #undef _syscall2
227 #undef _syscall3
228 #undef _syscall4
229 #undef _syscall5
230 #undef _syscall6
231 
232 #define _syscall0(type,name)		\
233 static type name (void)			\
234 {					\
235 	return syscall(__NR_##name);	\
236 }
237 
238 #define _syscall1(type,name,type1,arg1)		\
239 static type name (type1 arg1)			\
240 {						\
241 	return syscall(__NR_##name, arg1);	\
242 }
243 
244 #define _syscall2(type,name,type1,arg1,type2,arg2)	\
245 static type name (type1 arg1,type2 arg2)		\
246 {							\
247 	return syscall(__NR_##name, arg1, arg2);	\
248 }
249 
250 #define _syscall3(type,name,type1,arg1,type2,arg2,type3,arg3)	\
251 static type name (type1 arg1,type2 arg2,type3 arg3)		\
252 {								\
253 	return syscall(__NR_##name, arg1, arg2, arg3);		\
254 }
255 
256 #define _syscall4(type,name,type1,arg1,type2,arg2,type3,arg3,type4,arg4)	\
257 static type name (type1 arg1,type2 arg2,type3 arg3,type4 arg4)			\
258 {										\
259 	return syscall(__NR_##name, arg1, arg2, arg3, arg4);			\
260 }
261 
262 #define _syscall5(type,name,type1,arg1,type2,arg2,type3,arg3,type4,arg4,	\
263 		  type5,arg5)							\
264 static type name (type1 arg1,type2 arg2,type3 arg3,type4 arg4,type5 arg5)	\
265 {										\
266 	return syscall(__NR_##name, arg1, arg2, arg3, arg4, arg5);		\
267 }
268 
269 
270 #define _syscall6(type,name,type1,arg1,type2,arg2,type3,arg3,type4,arg4,	\
271 		  type5,arg5,type6,arg6)					\
272 static type name (type1 arg1,type2 arg2,type3 arg3,type4 arg4,type5 arg5,	\
273                   type6 arg6)							\
274 {										\
275 	return syscall(__NR_##name, arg1, arg2, arg3, arg4, arg5, arg6);	\
276 }
277 
278 
279 #define __NR_sys_uname __NR_uname
280 #define __NR_sys_getcwd1 __NR_getcwd
281 #define __NR_sys_getdents __NR_getdents
282 #define __NR_sys_getdents64 __NR_getdents64
283 #define __NR_sys_getpriority __NR_getpriority
284 #define __NR_sys_rt_sigqueueinfo __NR_rt_sigqueueinfo
285 #define __NR_sys_rt_tgsigqueueinfo __NR_rt_tgsigqueueinfo
286 #define __NR_sys_syslog __NR_syslog
287 #if defined(__NR_futex)
288 # define __NR_sys_futex __NR_futex
289 #endif
290 #if defined(__NR_futex_time64)
291 # define __NR_sys_futex_time64 __NR_futex_time64
292 #endif
293 #define __NR_sys_statx __NR_statx
294 
295 #if defined(__alpha__) || defined(__x86_64__) || defined(__s390x__)
296 #define __NR__llseek __NR_lseek
297 #endif
298 
299 /* Newer kernel ports have llseek() instead of _llseek() */
300 #if defined(TARGET_NR_llseek) && !defined(TARGET_NR__llseek)
301 #define TARGET_NR__llseek TARGET_NR_llseek
302 #endif
303 
304 /* some platforms need to mask more bits than just TARGET_O_NONBLOCK */
305 #ifndef TARGET_O_NONBLOCK_MASK
306 #define TARGET_O_NONBLOCK_MASK TARGET_O_NONBLOCK
307 #endif
308 
309 #define __NR_sys_gettid __NR_gettid
310 _syscall0(int, sys_gettid)
311 
312 /* For the 64-bit guest on 32-bit host case we must emulate
313  * getdents using getdents64, because otherwise the host
314  * might hand us back more dirent records than we can fit
315  * into the guest buffer after structure format conversion.
316  * Otherwise we emulate getdents with getdents if the host has it.
317  */
318 #if defined(__NR_getdents) && HOST_LONG_BITS >= TARGET_ABI_BITS
319 #define EMULATE_GETDENTS_WITH_GETDENTS
320 #endif
321 
322 #if defined(TARGET_NR_getdents) && defined(EMULATE_GETDENTS_WITH_GETDENTS)
323 _syscall3(int, sys_getdents, uint, fd, struct linux_dirent *, dirp, uint, count);
324 #endif
325 #if (defined(TARGET_NR_getdents) && \
326       !defined(EMULATE_GETDENTS_WITH_GETDENTS)) || \
327     (defined(TARGET_NR_getdents64) && defined(__NR_getdents64))
328 _syscall3(int, sys_getdents64, uint, fd, struct linux_dirent64 *, dirp, uint, count);
329 #endif
330 #if defined(TARGET_NR__llseek) && defined(__NR_llseek)
331 _syscall5(int, _llseek,  uint,  fd, ulong, hi, ulong, lo,
332           loff_t *, res, uint, wh);
333 #endif
334 _syscall3(int, sys_rt_sigqueueinfo, pid_t, pid, int, sig, siginfo_t *, uinfo)
335 _syscall4(int, sys_rt_tgsigqueueinfo, pid_t, pid, pid_t, tid, int, sig,
336           siginfo_t *, uinfo)
337 _syscall3(int,sys_syslog,int,type,char*,bufp,int,len)
338 #ifdef __NR_exit_group
339 _syscall1(int,exit_group,int,error_code)
340 #endif
341 #if defined(__NR_futex)
342 _syscall6(int,sys_futex,int *,uaddr,int,op,int,val,
343           const struct timespec *,timeout,int *,uaddr2,int,val3)
344 #endif
345 #if defined(__NR_futex_time64)
346 _syscall6(int,sys_futex_time64,int *,uaddr,int,op,int,val,
347           const struct timespec *,timeout,int *,uaddr2,int,val3)
348 #endif
349 #if defined(__NR_pidfd_open) && defined(TARGET_NR_pidfd_open)
350 _syscall2(int, pidfd_open, pid_t, pid, unsigned int, flags);
351 #endif
352 #if defined(__NR_pidfd_send_signal) && defined(TARGET_NR_pidfd_send_signal)
353 _syscall4(int, pidfd_send_signal, int, pidfd, int, sig, siginfo_t *, info,
354                              unsigned int, flags);
355 #endif
356 #if defined(__NR_pidfd_getfd) && defined(TARGET_NR_pidfd_getfd)
357 _syscall3(int, pidfd_getfd, int, pidfd, int, targetfd, unsigned int, flags);
358 #endif
359 #define __NR_sys_sched_getaffinity __NR_sched_getaffinity
360 _syscall3(int, sys_sched_getaffinity, pid_t, pid, unsigned int, len,
361           unsigned long *, user_mask_ptr);
362 #define __NR_sys_sched_setaffinity __NR_sched_setaffinity
363 _syscall3(int, sys_sched_setaffinity, pid_t, pid, unsigned int, len,
364           unsigned long *, user_mask_ptr);
365 /* sched_attr is not defined in glibc */
366 struct sched_attr {
367     uint32_t size;
368     uint32_t sched_policy;
369     uint64_t sched_flags;
370     int32_t sched_nice;
371     uint32_t sched_priority;
372     uint64_t sched_runtime;
373     uint64_t sched_deadline;
374     uint64_t sched_period;
375     uint32_t sched_util_min;
376     uint32_t sched_util_max;
377 };
378 #define __NR_sys_sched_getattr __NR_sched_getattr
379 _syscall4(int, sys_sched_getattr, pid_t, pid, struct sched_attr *, attr,
380           unsigned int, size, unsigned int, flags);
381 #define __NR_sys_sched_setattr __NR_sched_setattr
382 _syscall3(int, sys_sched_setattr, pid_t, pid, struct sched_attr *, attr,
383           unsigned int, flags);
384 #define __NR_sys_sched_getscheduler __NR_sched_getscheduler
385 _syscall1(int, sys_sched_getscheduler, pid_t, pid);
386 #define __NR_sys_sched_setscheduler __NR_sched_setscheduler
387 _syscall3(int, sys_sched_setscheduler, pid_t, pid, int, policy,
388           const struct sched_param *, param);
389 #define __NR_sys_sched_getparam __NR_sched_getparam
390 _syscall2(int, sys_sched_getparam, pid_t, pid,
391           struct sched_param *, param);
392 #define __NR_sys_sched_setparam __NR_sched_setparam
393 _syscall2(int, sys_sched_setparam, pid_t, pid,
394           const struct sched_param *, param);
395 #define __NR_sys_getcpu __NR_getcpu
396 _syscall3(int, sys_getcpu, unsigned *, cpu, unsigned *, node, void *, tcache);
397 _syscall4(int, reboot, int, magic1, int, magic2, unsigned int, cmd,
398           void *, arg);
399 _syscall2(int, capget, struct __user_cap_header_struct *, header,
400           struct __user_cap_data_struct *, data);
401 _syscall2(int, capset, struct __user_cap_header_struct *, header,
402           struct __user_cap_data_struct *, data);
403 #if defined(TARGET_NR_ioprio_get) && defined(__NR_ioprio_get)
404 _syscall2(int, ioprio_get, int, which, int, who)
405 #endif
406 #if defined(TARGET_NR_ioprio_set) && defined(__NR_ioprio_set)
407 _syscall3(int, ioprio_set, int, which, int, who, int, ioprio)
408 #endif
409 #if defined(TARGET_NR_getrandom) && defined(__NR_getrandom)
410 _syscall3(int, getrandom, void *, buf, size_t, buflen, unsigned int, flags)
411 #endif
412 
413 #if defined(TARGET_NR_kcmp) && defined(__NR_kcmp)
414 _syscall5(int, kcmp, pid_t, pid1, pid_t, pid2, int, type,
415           unsigned long, idx1, unsigned long, idx2)
416 #endif
417 
418 /*
419  * It is assumed that struct statx is architecture independent.
420  */
421 #if defined(TARGET_NR_statx) && defined(__NR_statx)
422 _syscall5(int, sys_statx, int, dirfd, const char *, pathname, int, flags,
423           unsigned int, mask, struct target_statx *, statxbuf)
424 #endif
425 #if defined(TARGET_NR_membarrier) && defined(__NR_membarrier)
426 _syscall2(int, membarrier, int, cmd, int, flags)
427 #endif
428 
429 static const bitmask_transtbl fcntl_flags_tbl[] = {
430   { TARGET_O_ACCMODE,   TARGET_O_WRONLY,    O_ACCMODE,   O_WRONLY,    },
431   { TARGET_O_ACCMODE,   TARGET_O_RDWR,      O_ACCMODE,   O_RDWR,      },
432   { TARGET_O_CREAT,     TARGET_O_CREAT,     O_CREAT,     O_CREAT,     },
433   { TARGET_O_EXCL,      TARGET_O_EXCL,      O_EXCL,      O_EXCL,      },
434   { TARGET_O_NOCTTY,    TARGET_O_NOCTTY,    O_NOCTTY,    O_NOCTTY,    },
435   { TARGET_O_TRUNC,     TARGET_O_TRUNC,     O_TRUNC,     O_TRUNC,     },
436   { TARGET_O_APPEND,    TARGET_O_APPEND,    O_APPEND,    O_APPEND,    },
437   { TARGET_O_NONBLOCK,  TARGET_O_NONBLOCK,  O_NONBLOCK,  O_NONBLOCK,  },
438   { TARGET_O_SYNC,      TARGET_O_DSYNC,     O_SYNC,      O_DSYNC,     },
439   { TARGET_O_SYNC,      TARGET_O_SYNC,      O_SYNC,      O_SYNC,      },
440   { TARGET_FASYNC,      TARGET_FASYNC,      FASYNC,      FASYNC,      },
441   { TARGET_O_DIRECTORY, TARGET_O_DIRECTORY, O_DIRECTORY, O_DIRECTORY, },
442   { TARGET_O_NOFOLLOW,  TARGET_O_NOFOLLOW,  O_NOFOLLOW,  O_NOFOLLOW,  },
443 #if defined(O_DIRECT)
444   { TARGET_O_DIRECT,    TARGET_O_DIRECT,    O_DIRECT,    O_DIRECT,    },
445 #endif
446 #if defined(O_NOATIME)
447   { TARGET_O_NOATIME,   TARGET_O_NOATIME,   O_NOATIME,   O_NOATIME    },
448 #endif
449 #if defined(O_CLOEXEC)
450   { TARGET_O_CLOEXEC,   TARGET_O_CLOEXEC,   O_CLOEXEC,   O_CLOEXEC    },
451 #endif
452 #if defined(O_PATH)
453   { TARGET_O_PATH,      TARGET_O_PATH,      O_PATH,      O_PATH       },
454 #endif
455 #if defined(O_TMPFILE)
456   { TARGET_O_TMPFILE,   TARGET_O_TMPFILE,   O_TMPFILE,   O_TMPFILE    },
457 #endif
458   /* Don't terminate the list prematurely on 64-bit host+guest.  */
459 #if TARGET_O_LARGEFILE != 0 || O_LARGEFILE != 0
460   { TARGET_O_LARGEFILE, TARGET_O_LARGEFILE, O_LARGEFILE, O_LARGEFILE, },
461 #endif
462   { 0, 0, 0, 0 }
463 };
464 
465 _syscall2(int, sys_getcwd1, char *, buf, size_t, size)
466 
467 #if defined(TARGET_NR_utimensat) || defined(TARGET_NR_utimensat_time64)
468 #if defined(__NR_utimensat)
469 #define __NR_sys_utimensat __NR_utimensat
470 _syscall4(int,sys_utimensat,int,dirfd,const char *,pathname,
471           const struct timespec *,tsp,int,flags)
472 #else
473 static int sys_utimensat(int dirfd, const char *pathname,
474                          const struct timespec times[2], int flags)
475 {
476     errno = ENOSYS;
477     return -1;
478 }
479 #endif
480 #endif /* TARGET_NR_utimensat */
481 
482 #ifdef TARGET_NR_renameat2
483 #if defined(__NR_renameat2)
484 #define __NR_sys_renameat2 __NR_renameat2
485 _syscall5(int, sys_renameat2, int, oldfd, const char *, old, int, newfd,
486           const char *, new, unsigned int, flags)
487 #else
488 static int sys_renameat2(int oldfd, const char *old,
489                          int newfd, const char *new, int flags)
490 {
491     if (flags == 0) {
492         return renameat(oldfd, old, newfd, new);
493     }
494     errno = ENOSYS;
495     return -1;
496 }
497 #endif
498 #endif /* TARGET_NR_renameat2 */
499 
500 #ifdef CONFIG_INOTIFY
501 #include <sys/inotify.h>
502 #else
503 /* Userspace can usually survive runtime without inotify */
504 #undef TARGET_NR_inotify_init
505 #undef TARGET_NR_inotify_init1
506 #undef TARGET_NR_inotify_add_watch
507 #undef TARGET_NR_inotify_rm_watch
508 #endif /* CONFIG_INOTIFY  */
509 
510 #if defined(TARGET_NR_prlimit64)
511 #ifndef __NR_prlimit64
512 # define __NR_prlimit64 -1
513 #endif
514 #define __NR_sys_prlimit64 __NR_prlimit64
515 /* The glibc rlimit structure may not be that used by the underlying syscall */
516 struct host_rlimit64 {
517     uint64_t rlim_cur;
518     uint64_t rlim_max;
519 };
520 _syscall4(int, sys_prlimit64, pid_t, pid, int, resource,
521           const struct host_rlimit64 *, new_limit,
522           struct host_rlimit64 *, old_limit)
523 #endif
524 
525 
526 #if defined(TARGET_NR_timer_create)
527 /* Maximum of 32 active POSIX timers allowed at any one time. */
528 #define GUEST_TIMER_MAX 32
529 static timer_t g_posix_timers[GUEST_TIMER_MAX];
530 static int g_posix_timer_allocated[GUEST_TIMER_MAX];
531 
532 static inline int next_free_host_timer(void)
533 {
534     int k;
535     for (k = 0; k < ARRAY_SIZE(g_posix_timer_allocated); k++) {
536         if (qatomic_xchg(g_posix_timer_allocated + k, 1) == 0) {
537             return k;
538         }
539     }
540     return -1;
541 }
542 
543 static inline void free_host_timer_slot(int id)
544 {
545     qatomic_store_release(g_posix_timer_allocated + id, 0);
546 }
547 #endif
548 
549 static inline int host_to_target_errno(int host_errno)
550 {
551     switch (host_errno) {
552 #define E(X)  case X: return TARGET_##X;
553 #include "errnos.c.inc"
554 #undef E
555     default:
556         return host_errno;
557     }
558 }
559 
560 static inline int target_to_host_errno(int target_errno)
561 {
562     switch (target_errno) {
563 #define E(X)  case TARGET_##X: return X;
564 #include "errnos.c.inc"
565 #undef E
566     default:
567         return target_errno;
568     }
569 }
570 
571 abi_long get_errno(abi_long ret)
572 {
573     if (ret == -1)
574         return -host_to_target_errno(errno);
575     else
576         return ret;
577 }
578 
579 const char *target_strerror(int err)
580 {
581     if (err == QEMU_ERESTARTSYS) {
582         return "To be restarted";
583     }
584     if (err == QEMU_ESIGRETURN) {
585         return "Successful exit from sigreturn";
586     }
587 
588     return strerror(target_to_host_errno(err));
589 }
590 
591 static int check_zeroed_user(abi_long addr, size_t ksize, size_t usize)
592 {
593     int i;
594     uint8_t b;
595     if (usize <= ksize) {
596         return 1;
597     }
598     for (i = ksize; i < usize; i++) {
599         if (get_user_u8(b, addr + i)) {
600             return -TARGET_EFAULT;
601         }
602         if (b != 0) {
603             return 0;
604         }
605     }
606     return 1;
607 }
608 
609 #define safe_syscall0(type, name) \
610 static type safe_##name(void) \
611 { \
612     return safe_syscall(__NR_##name); \
613 }
614 
615 #define safe_syscall1(type, name, type1, arg1) \
616 static type safe_##name(type1 arg1) \
617 { \
618     return safe_syscall(__NR_##name, arg1); \
619 }
620 
621 #define safe_syscall2(type, name, type1, arg1, type2, arg2) \
622 static type safe_##name(type1 arg1, type2 arg2) \
623 { \
624     return safe_syscall(__NR_##name, arg1, arg2); \
625 }
626 
627 #define safe_syscall3(type, name, type1, arg1, type2, arg2, type3, arg3) \
628 static type safe_##name(type1 arg1, type2 arg2, type3 arg3) \
629 { \
630     return safe_syscall(__NR_##name, arg1, arg2, arg3); \
631 }
632 
633 #define safe_syscall4(type, name, type1, arg1, type2, arg2, type3, arg3, \
634     type4, arg4) \
635 static type safe_##name(type1 arg1, type2 arg2, type3 arg3, type4 arg4) \
636 { \
637     return safe_syscall(__NR_##name, arg1, arg2, arg3, arg4); \
638 }
639 
640 #define safe_syscall5(type, name, type1, arg1, type2, arg2, type3, arg3, \
641     type4, arg4, type5, arg5) \
642 static type safe_##name(type1 arg1, type2 arg2, type3 arg3, type4 arg4, \
643     type5 arg5) \
644 { \
645     return safe_syscall(__NR_##name, arg1, arg2, arg3, arg4, arg5); \
646 }
647 
648 #define safe_syscall6(type, name, type1, arg1, type2, arg2, type3, arg3, \
649     type4, arg4, type5, arg5, type6, arg6) \
650 static type safe_##name(type1 arg1, type2 arg2, type3 arg3, type4 arg4, \
651     type5 arg5, type6 arg6) \
652 { \
653     return safe_syscall(__NR_##name, arg1, arg2, arg3, arg4, arg5, arg6); \
654 }
655 
656 safe_syscall3(ssize_t, read, int, fd, void *, buff, size_t, count)
657 safe_syscall3(ssize_t, write, int, fd, const void *, buff, size_t, count)
658 safe_syscall4(int, openat, int, dirfd, const char *, pathname, \
659               int, flags, mode_t, mode)
660 #if defined(TARGET_NR_wait4) || defined(TARGET_NR_waitpid)
661 safe_syscall4(pid_t, wait4, pid_t, pid, int *, status, int, options, \
662               struct rusage *, rusage)
663 #endif
664 safe_syscall5(int, waitid, idtype_t, idtype, id_t, id, siginfo_t *, infop, \
665               int, options, struct rusage *, rusage)
666 safe_syscall3(int, execve, const char *, filename, char **, argv, char **, envp)
667 #if defined(TARGET_NR_select) || defined(TARGET_NR__newselect) || \
668     defined(TARGET_NR_pselect6) || defined(TARGET_NR_pselect6_time64)
669 safe_syscall6(int, pselect6, int, nfds, fd_set *, readfds, fd_set *, writefds, \
670               fd_set *, exceptfds, struct timespec *, timeout, void *, sig)
671 #endif
672 #if defined(TARGET_NR_ppoll) || defined(TARGET_NR_ppoll_time64)
673 safe_syscall5(int, ppoll, struct pollfd *, ufds, unsigned int, nfds,
674               struct timespec *, tsp, const sigset_t *, sigmask,
675               size_t, sigsetsize)
676 #endif
677 safe_syscall6(int, epoll_pwait, int, epfd, struct epoll_event *, events,
678               int, maxevents, int, timeout, const sigset_t *, sigmask,
679               size_t, sigsetsize)
680 #if defined(__NR_futex)
681 safe_syscall6(int,futex,int *,uaddr,int,op,int,val, \
682               const struct timespec *,timeout,int *,uaddr2,int,val3)
683 #endif
684 #if defined(__NR_futex_time64)
685 safe_syscall6(int,futex_time64,int *,uaddr,int,op,int,val, \
686               const struct timespec *,timeout,int *,uaddr2,int,val3)
687 #endif
688 safe_syscall2(int, rt_sigsuspend, sigset_t *, newset, size_t, sigsetsize)
689 safe_syscall2(int, kill, pid_t, pid, int, sig)
690 safe_syscall2(int, tkill, int, tid, int, sig)
691 safe_syscall3(int, tgkill, int, tgid, int, pid, int, sig)
692 safe_syscall3(ssize_t, readv, int, fd, const struct iovec *, iov, int, iovcnt)
693 safe_syscall3(ssize_t, writev, int, fd, const struct iovec *, iov, int, iovcnt)
694 safe_syscall5(ssize_t, preadv, int, fd, const struct iovec *, iov, int, iovcnt,
695               unsigned long, pos_l, unsigned long, pos_h)
696 safe_syscall5(ssize_t, pwritev, int, fd, const struct iovec *, iov, int, iovcnt,
697               unsigned long, pos_l, unsigned long, pos_h)
698 safe_syscall3(int, connect, int, fd, const struct sockaddr *, addr,
699               socklen_t, addrlen)
700 safe_syscall6(ssize_t, sendto, int, fd, const void *, buf, size_t, len,
701               int, flags, const struct sockaddr *, addr, socklen_t, addrlen)
702 safe_syscall6(ssize_t, recvfrom, int, fd, void *, buf, size_t, len,
703               int, flags, struct sockaddr *, addr, socklen_t *, addrlen)
704 safe_syscall3(ssize_t, sendmsg, int, fd, const struct msghdr *, msg, int, flags)
705 safe_syscall3(ssize_t, recvmsg, int, fd, struct msghdr *, msg, int, flags)
706 safe_syscall2(int, flock, int, fd, int, operation)
707 #if defined(TARGET_NR_rt_sigtimedwait) || defined(TARGET_NR_rt_sigtimedwait_time64)
708 safe_syscall4(int, rt_sigtimedwait, const sigset_t *, these, siginfo_t *, uinfo,
709               const struct timespec *, uts, size_t, sigsetsize)
710 #endif
711 safe_syscall4(int, accept4, int, fd, struct sockaddr *, addr, socklen_t *, len,
712               int, flags)
713 #if defined(TARGET_NR_nanosleep)
714 safe_syscall2(int, nanosleep, const struct timespec *, req,
715               struct timespec *, rem)
716 #endif
717 #if defined(TARGET_NR_clock_nanosleep) || \
718     defined(TARGET_NR_clock_nanosleep_time64)
719 safe_syscall4(int, clock_nanosleep, const clockid_t, clock, int, flags,
720               const struct timespec *, req, struct timespec *, rem)
721 #endif
722 #ifdef __NR_ipc
723 #ifdef __s390x__
724 safe_syscall5(int, ipc, int, call, long, first, long, second, long, third,
725               void *, ptr)
726 #else
727 safe_syscall6(int, ipc, int, call, long, first, long, second, long, third,
728               void *, ptr, long, fifth)
729 #endif
730 #endif
731 #ifdef __NR_msgsnd
732 safe_syscall4(int, msgsnd, int, msgid, const void *, msgp, size_t, sz,
733               int, flags)
734 #endif
735 #ifdef __NR_msgrcv
736 safe_syscall5(int, msgrcv, int, msgid, void *, msgp, size_t, sz,
737               long, msgtype, int, flags)
738 #endif
739 #ifdef __NR_semtimedop
740 safe_syscall4(int, semtimedop, int, semid, struct sembuf *, tsops,
741               unsigned, nsops, const struct timespec *, timeout)
742 #endif
743 #if defined(TARGET_NR_mq_timedsend) || \
744     defined(TARGET_NR_mq_timedsend_time64)
745 safe_syscall5(int, mq_timedsend, int, mqdes, const char *, msg_ptr,
746               size_t, len, unsigned, prio, const struct timespec *, timeout)
747 #endif
748 #if defined(TARGET_NR_mq_timedreceive) || \
749     defined(TARGET_NR_mq_timedreceive_time64)
750 safe_syscall5(int, mq_timedreceive, int, mqdes, char *, msg_ptr,
751               size_t, len, unsigned *, prio, const struct timespec *, timeout)
752 #endif
753 #if defined(TARGET_NR_copy_file_range) && defined(__NR_copy_file_range)
754 safe_syscall6(ssize_t, copy_file_range, int, infd, loff_t *, pinoff,
755               int, outfd, loff_t *, poutoff, size_t, length,
756               unsigned int, flags)
757 #endif
758 
759 /* We do ioctl like this rather than via safe_syscall3 to preserve the
760  * "third argument might be integer or pointer or not present" behaviour of
761  * the libc function.
762  */
763 #define safe_ioctl(...) safe_syscall(__NR_ioctl, __VA_ARGS__)
764 /* Similarly for fcntl. Note that callers must always:
765  *  pass the F_GETLK64 etc constants rather than the unsuffixed F_GETLK
766  *  use the flock64 struct rather than unsuffixed flock
767  * This will then work and use a 64-bit offset for both 32-bit and 64-bit hosts.
768  */
769 #ifdef __NR_fcntl64
770 #define safe_fcntl(...) safe_syscall(__NR_fcntl64, __VA_ARGS__)
771 #else
772 #define safe_fcntl(...) safe_syscall(__NR_fcntl, __VA_ARGS__)
773 #endif
774 
775 static inline int host_to_target_sock_type(int host_type)
776 {
777     int target_type;
778 
779     switch (host_type & 0xf /* SOCK_TYPE_MASK */) {
780     case SOCK_DGRAM:
781         target_type = TARGET_SOCK_DGRAM;
782         break;
783     case SOCK_STREAM:
784         target_type = TARGET_SOCK_STREAM;
785         break;
786     default:
787         target_type = host_type & 0xf /* SOCK_TYPE_MASK */;
788         break;
789     }
790 
791 #if defined(SOCK_CLOEXEC)
792     if (host_type & SOCK_CLOEXEC) {
793         target_type |= TARGET_SOCK_CLOEXEC;
794     }
795 #endif
796 
797 #if defined(SOCK_NONBLOCK)
798     if (host_type & SOCK_NONBLOCK) {
799         target_type |= TARGET_SOCK_NONBLOCK;
800     }
801 #endif
802 
803     return target_type;
804 }
805 
806 static abi_ulong target_brk;
807 static abi_ulong target_original_brk;
808 static abi_ulong brk_page;
809 
810 void target_set_brk(abi_ulong new_brk)
811 {
812     target_original_brk = target_brk = HOST_PAGE_ALIGN(new_brk);
813     brk_page = HOST_PAGE_ALIGN(target_brk);
814 }
815 
816 //#define DEBUGF_BRK(message, args...) do { fprintf(stderr, (message), ## args); } while (0)
817 #define DEBUGF_BRK(message, args...)
818 
819 /* do_brk() must return target values and target errnos. */
820 abi_long do_brk(abi_ulong new_brk)
821 {
822     abi_long mapped_addr;
823     abi_ulong new_alloc_size;
824 
825     /* brk pointers are always untagged */
826 
827     DEBUGF_BRK("do_brk(" TARGET_ABI_FMT_lx ") -> ", new_brk);
828 
829     if (!new_brk) {
830         DEBUGF_BRK(TARGET_ABI_FMT_lx " (!new_brk)\n", target_brk);
831         return target_brk;
832     }
833     if (new_brk < target_original_brk) {
834         DEBUGF_BRK(TARGET_ABI_FMT_lx " (new_brk < target_original_brk)\n",
835                    target_brk);
836         return target_brk;
837     }
838 
839     /* If the new brk is less than the highest page reserved to the
840      * target heap allocation, set it and we're almost done...  */
841     if (new_brk <= brk_page) {
842         /* Heap contents are initialized to zero, as for anonymous
843          * mapped pages.  */
844         if (new_brk > target_brk) {
845             memset(g2h_untagged(target_brk), 0, new_brk - target_brk);
846         }
847 	target_brk = new_brk;
848         DEBUGF_BRK(TARGET_ABI_FMT_lx " (new_brk <= brk_page)\n", target_brk);
849 	return target_brk;
850     }
851 
852     /* We need to allocate more memory after the brk... Note that
853      * we don't use MAP_FIXED because that will map over the top of
854      * any existing mapping (like the one with the host libc or qemu
855      * itself); instead we treat "mapped but at wrong address" as
856      * a failure and unmap again.
857      */
858     new_alloc_size = HOST_PAGE_ALIGN(new_brk - brk_page);
859     mapped_addr = get_errno(target_mmap(brk_page, new_alloc_size,
860                                         PROT_READ|PROT_WRITE,
861                                         MAP_ANON|MAP_PRIVATE, 0, 0));
862 
863     if (mapped_addr == brk_page) {
864         /* Heap contents are initialized to zero, as for anonymous
865          * mapped pages.  Technically the new pages are already
866          * initialized to zero since they *are* anonymous mapped
867          * pages, however we have to take care with the contents that
868          * come from the remaining part of the previous page: it may
869          * contains garbage data due to a previous heap usage (grown
870          * then shrunken).  */
871         memset(g2h_untagged(target_brk), 0, brk_page - target_brk);
872 
873         target_brk = new_brk;
874         brk_page = HOST_PAGE_ALIGN(target_brk);
875         DEBUGF_BRK(TARGET_ABI_FMT_lx " (mapped_addr == brk_page)\n",
876             target_brk);
877         return target_brk;
878     } else if (mapped_addr != -1) {
879         /* Mapped but at wrong address, meaning there wasn't actually
880          * enough space for this brk.
881          */
882         target_munmap(mapped_addr, new_alloc_size);
883         mapped_addr = -1;
884         DEBUGF_BRK(TARGET_ABI_FMT_lx " (mapped_addr != -1)\n", target_brk);
885     }
886     else {
887         DEBUGF_BRK(TARGET_ABI_FMT_lx " (otherwise)\n", target_brk);
888     }
889 
890 #if defined(TARGET_ALPHA)
891     /* We (partially) emulate OSF/1 on Alpha, which requires we
892        return a proper errno, not an unchanged brk value.  */
893     return -TARGET_ENOMEM;
894 #endif
895     /* For everything else, return the previous break. */
896     return target_brk;
897 }
898 
899 #if defined(TARGET_NR_select) || defined(TARGET_NR__newselect) || \
900     defined(TARGET_NR_pselect6) || defined(TARGET_NR_pselect6_time64)
901 static inline abi_long copy_from_user_fdset(fd_set *fds,
902                                             abi_ulong target_fds_addr,
903                                             int n)
904 {
905     int i, nw, j, k;
906     abi_ulong b, *target_fds;
907 
908     nw = DIV_ROUND_UP(n, TARGET_ABI_BITS);
909     if (!(target_fds = lock_user(VERIFY_READ,
910                                  target_fds_addr,
911                                  sizeof(abi_ulong) * nw,
912                                  1)))
913         return -TARGET_EFAULT;
914 
915     FD_ZERO(fds);
916     k = 0;
917     for (i = 0; i < nw; i++) {
918         /* grab the abi_ulong */
919         __get_user(b, &target_fds[i]);
920         for (j = 0; j < TARGET_ABI_BITS; j++) {
921             /* check the bit inside the abi_ulong */
922             if ((b >> j) & 1)
923                 FD_SET(k, fds);
924             k++;
925         }
926     }
927 
928     unlock_user(target_fds, target_fds_addr, 0);
929 
930     return 0;
931 }
932 
933 static inline abi_ulong copy_from_user_fdset_ptr(fd_set *fds, fd_set **fds_ptr,
934                                                  abi_ulong target_fds_addr,
935                                                  int n)
936 {
937     if (target_fds_addr) {
938         if (copy_from_user_fdset(fds, target_fds_addr, n))
939             return -TARGET_EFAULT;
940         *fds_ptr = fds;
941     } else {
942         *fds_ptr = NULL;
943     }
944     return 0;
945 }
946 
947 static inline abi_long copy_to_user_fdset(abi_ulong target_fds_addr,
948                                           const fd_set *fds,
949                                           int n)
950 {
951     int i, nw, j, k;
952     abi_long v;
953     abi_ulong *target_fds;
954 
955     nw = DIV_ROUND_UP(n, TARGET_ABI_BITS);
956     if (!(target_fds = lock_user(VERIFY_WRITE,
957                                  target_fds_addr,
958                                  sizeof(abi_ulong) * nw,
959                                  0)))
960         return -TARGET_EFAULT;
961 
962     k = 0;
963     for (i = 0; i < nw; i++) {
964         v = 0;
965         for (j = 0; j < TARGET_ABI_BITS; j++) {
966             v |= ((abi_ulong)(FD_ISSET(k, fds) != 0) << j);
967             k++;
968         }
969         __put_user(v, &target_fds[i]);
970     }
971 
972     unlock_user(target_fds, target_fds_addr, sizeof(abi_ulong) * nw);
973 
974     return 0;
975 }
976 #endif
977 
978 #if defined(__alpha__)
979 #define HOST_HZ 1024
980 #else
981 #define HOST_HZ 100
982 #endif
983 
984 static inline abi_long host_to_target_clock_t(long ticks)
985 {
986 #if HOST_HZ == TARGET_HZ
987     return ticks;
988 #else
989     return ((int64_t)ticks * TARGET_HZ) / HOST_HZ;
990 #endif
991 }
992 
993 static inline abi_long host_to_target_rusage(abi_ulong target_addr,
994                                              const struct rusage *rusage)
995 {
996     struct target_rusage *target_rusage;
997 
998     if (!lock_user_struct(VERIFY_WRITE, target_rusage, target_addr, 0))
999         return -TARGET_EFAULT;
1000     target_rusage->ru_utime.tv_sec = tswapal(rusage->ru_utime.tv_sec);
1001     target_rusage->ru_utime.tv_usec = tswapal(rusage->ru_utime.tv_usec);
1002     target_rusage->ru_stime.tv_sec = tswapal(rusage->ru_stime.tv_sec);
1003     target_rusage->ru_stime.tv_usec = tswapal(rusage->ru_stime.tv_usec);
1004     target_rusage->ru_maxrss = tswapal(rusage->ru_maxrss);
1005     target_rusage->ru_ixrss = tswapal(rusage->ru_ixrss);
1006     target_rusage->ru_idrss = tswapal(rusage->ru_idrss);
1007     target_rusage->ru_isrss = tswapal(rusage->ru_isrss);
1008     target_rusage->ru_minflt = tswapal(rusage->ru_minflt);
1009     target_rusage->ru_majflt = tswapal(rusage->ru_majflt);
1010     target_rusage->ru_nswap = tswapal(rusage->ru_nswap);
1011     target_rusage->ru_inblock = tswapal(rusage->ru_inblock);
1012     target_rusage->ru_oublock = tswapal(rusage->ru_oublock);
1013     target_rusage->ru_msgsnd = tswapal(rusage->ru_msgsnd);
1014     target_rusage->ru_msgrcv = tswapal(rusage->ru_msgrcv);
1015     target_rusage->ru_nsignals = tswapal(rusage->ru_nsignals);
1016     target_rusage->ru_nvcsw = tswapal(rusage->ru_nvcsw);
1017     target_rusage->ru_nivcsw = tswapal(rusage->ru_nivcsw);
1018     unlock_user_struct(target_rusage, target_addr, 1);
1019 
1020     return 0;
1021 }
1022 
1023 #ifdef TARGET_NR_setrlimit
1024 static inline rlim_t target_to_host_rlim(abi_ulong target_rlim)
1025 {
1026     abi_ulong target_rlim_swap;
1027     rlim_t result;
1028 
1029     target_rlim_swap = tswapal(target_rlim);
1030     if (target_rlim_swap == TARGET_RLIM_INFINITY)
1031         return RLIM_INFINITY;
1032 
1033     result = target_rlim_swap;
1034     if (target_rlim_swap != (rlim_t)result)
1035         return RLIM_INFINITY;
1036 
1037     return result;
1038 }
1039 #endif
1040 
1041 #if defined(TARGET_NR_getrlimit) || defined(TARGET_NR_ugetrlimit)
1042 static inline abi_ulong host_to_target_rlim(rlim_t rlim)
1043 {
1044     abi_ulong target_rlim_swap;
1045     abi_ulong result;
1046 
1047     if (rlim == RLIM_INFINITY || rlim != (abi_long)rlim)
1048         target_rlim_swap = TARGET_RLIM_INFINITY;
1049     else
1050         target_rlim_swap = rlim;
1051     result = tswapal(target_rlim_swap);
1052 
1053     return result;
1054 }
1055 #endif
1056 
1057 static inline int target_to_host_resource(int code)
1058 {
1059     switch (code) {
1060     case TARGET_RLIMIT_AS:
1061         return RLIMIT_AS;
1062     case TARGET_RLIMIT_CORE:
1063         return RLIMIT_CORE;
1064     case TARGET_RLIMIT_CPU:
1065         return RLIMIT_CPU;
1066     case TARGET_RLIMIT_DATA:
1067         return RLIMIT_DATA;
1068     case TARGET_RLIMIT_FSIZE:
1069         return RLIMIT_FSIZE;
1070     case TARGET_RLIMIT_LOCKS:
1071         return RLIMIT_LOCKS;
1072     case TARGET_RLIMIT_MEMLOCK:
1073         return RLIMIT_MEMLOCK;
1074     case TARGET_RLIMIT_MSGQUEUE:
1075         return RLIMIT_MSGQUEUE;
1076     case TARGET_RLIMIT_NICE:
1077         return RLIMIT_NICE;
1078     case TARGET_RLIMIT_NOFILE:
1079         return RLIMIT_NOFILE;
1080     case TARGET_RLIMIT_NPROC:
1081         return RLIMIT_NPROC;
1082     case TARGET_RLIMIT_RSS:
1083         return RLIMIT_RSS;
1084     case TARGET_RLIMIT_RTPRIO:
1085         return RLIMIT_RTPRIO;
1086 #ifdef RLIMIT_RTTIME
1087     case TARGET_RLIMIT_RTTIME:
1088         return RLIMIT_RTTIME;
1089 #endif
1090     case TARGET_RLIMIT_SIGPENDING:
1091         return RLIMIT_SIGPENDING;
1092     case TARGET_RLIMIT_STACK:
1093         return RLIMIT_STACK;
1094     default:
1095         return code;
1096     }
1097 }
1098 
1099 static inline abi_long copy_from_user_timeval(struct timeval *tv,
1100                                               abi_ulong target_tv_addr)
1101 {
1102     struct target_timeval *target_tv;
1103 
1104     if (!lock_user_struct(VERIFY_READ, target_tv, target_tv_addr, 1)) {
1105         return -TARGET_EFAULT;
1106     }
1107 
1108     __get_user(tv->tv_sec, &target_tv->tv_sec);
1109     __get_user(tv->tv_usec, &target_tv->tv_usec);
1110 
1111     unlock_user_struct(target_tv, target_tv_addr, 0);
1112 
1113     return 0;
1114 }
1115 
1116 static inline abi_long copy_to_user_timeval(abi_ulong target_tv_addr,
1117                                             const struct timeval *tv)
1118 {
1119     struct target_timeval *target_tv;
1120 
1121     if (!lock_user_struct(VERIFY_WRITE, target_tv, target_tv_addr, 0)) {
1122         return -TARGET_EFAULT;
1123     }
1124 
1125     __put_user(tv->tv_sec, &target_tv->tv_sec);
1126     __put_user(tv->tv_usec, &target_tv->tv_usec);
1127 
1128     unlock_user_struct(target_tv, target_tv_addr, 1);
1129 
1130     return 0;
1131 }
1132 
1133 #if defined(TARGET_NR_clock_adjtime64) && defined(CONFIG_CLOCK_ADJTIME)
1134 static inline abi_long copy_from_user_timeval64(struct timeval *tv,
1135                                                 abi_ulong target_tv_addr)
1136 {
1137     struct target__kernel_sock_timeval *target_tv;
1138 
1139     if (!lock_user_struct(VERIFY_READ, target_tv, target_tv_addr, 1)) {
1140         return -TARGET_EFAULT;
1141     }
1142 
1143     __get_user(tv->tv_sec, &target_tv->tv_sec);
1144     __get_user(tv->tv_usec, &target_tv->tv_usec);
1145 
1146     unlock_user_struct(target_tv, target_tv_addr, 0);
1147 
1148     return 0;
1149 }
1150 #endif
1151 
1152 static inline abi_long copy_to_user_timeval64(abi_ulong target_tv_addr,
1153                                               const struct timeval *tv)
1154 {
1155     struct target__kernel_sock_timeval *target_tv;
1156 
1157     if (!lock_user_struct(VERIFY_WRITE, target_tv, target_tv_addr, 0)) {
1158         return -TARGET_EFAULT;
1159     }
1160 
1161     __put_user(tv->tv_sec, &target_tv->tv_sec);
1162     __put_user(tv->tv_usec, &target_tv->tv_usec);
1163 
1164     unlock_user_struct(target_tv, target_tv_addr, 1);
1165 
1166     return 0;
1167 }
1168 
1169 #if defined(TARGET_NR_futex) || \
1170     defined(TARGET_NR_rt_sigtimedwait) || \
1171     defined(TARGET_NR_pselect6) || defined(TARGET_NR_pselect6) || \
1172     defined(TARGET_NR_nanosleep) || defined(TARGET_NR_clock_settime) || \
1173     defined(TARGET_NR_utimensat) || defined(TARGET_NR_mq_timedsend) || \
1174     defined(TARGET_NR_mq_timedreceive) || defined(TARGET_NR_ipc) || \
1175     defined(TARGET_NR_semop) || defined(TARGET_NR_semtimedop) || \
1176     defined(TARGET_NR_timer_settime) || \
1177     (defined(TARGET_NR_timerfd_settime) && defined(CONFIG_TIMERFD))
1178 static inline abi_long target_to_host_timespec(struct timespec *host_ts,
1179                                                abi_ulong target_addr)
1180 {
1181     struct target_timespec *target_ts;
1182 
1183     if (!lock_user_struct(VERIFY_READ, target_ts, target_addr, 1)) {
1184         return -TARGET_EFAULT;
1185     }
1186     __get_user(host_ts->tv_sec, &target_ts->tv_sec);
1187     __get_user(host_ts->tv_nsec, &target_ts->tv_nsec);
1188     unlock_user_struct(target_ts, target_addr, 0);
1189     return 0;
1190 }
1191 #endif
1192 
1193 #if defined(TARGET_NR_clock_settime64) || defined(TARGET_NR_futex_time64) || \
1194     defined(TARGET_NR_timer_settime64) || \
1195     defined(TARGET_NR_mq_timedsend_time64) || \
1196     defined(TARGET_NR_mq_timedreceive_time64) || \
1197     (defined(TARGET_NR_timerfd_settime64) && defined(CONFIG_TIMERFD)) || \
1198     defined(TARGET_NR_clock_nanosleep_time64) || \
1199     defined(TARGET_NR_rt_sigtimedwait_time64) || \
1200     defined(TARGET_NR_utimensat) || \
1201     defined(TARGET_NR_utimensat_time64) || \
1202     defined(TARGET_NR_semtimedop_time64) || \
1203     defined(TARGET_NR_pselect6_time64) || defined(TARGET_NR_ppoll_time64)
1204 static inline abi_long target_to_host_timespec64(struct timespec *host_ts,
1205                                                  abi_ulong target_addr)
1206 {
1207     struct target__kernel_timespec *target_ts;
1208 
1209     if (!lock_user_struct(VERIFY_READ, target_ts, target_addr, 1)) {
1210         return -TARGET_EFAULT;
1211     }
1212     __get_user(host_ts->tv_sec, &target_ts->tv_sec);
1213     __get_user(host_ts->tv_nsec, &target_ts->tv_nsec);
1214     /* in 32bit mode, this drops the padding */
1215     host_ts->tv_nsec = (long)(abi_long)host_ts->tv_nsec;
1216     unlock_user_struct(target_ts, target_addr, 0);
1217     return 0;
1218 }
1219 #endif
1220 
1221 static inline abi_long host_to_target_timespec(abi_ulong target_addr,
1222                                                struct timespec *host_ts)
1223 {
1224     struct target_timespec *target_ts;
1225 
1226     if (!lock_user_struct(VERIFY_WRITE, target_ts, target_addr, 0)) {
1227         return -TARGET_EFAULT;
1228     }
1229     __put_user(host_ts->tv_sec, &target_ts->tv_sec);
1230     __put_user(host_ts->tv_nsec, &target_ts->tv_nsec);
1231     unlock_user_struct(target_ts, target_addr, 1);
1232     return 0;
1233 }
1234 
1235 static inline abi_long host_to_target_timespec64(abi_ulong target_addr,
1236                                                  struct timespec *host_ts)
1237 {
1238     struct target__kernel_timespec *target_ts;
1239 
1240     if (!lock_user_struct(VERIFY_WRITE, target_ts, target_addr, 0)) {
1241         return -TARGET_EFAULT;
1242     }
1243     __put_user(host_ts->tv_sec, &target_ts->tv_sec);
1244     __put_user(host_ts->tv_nsec, &target_ts->tv_nsec);
1245     unlock_user_struct(target_ts, target_addr, 1);
1246     return 0;
1247 }
1248 
1249 #if defined(TARGET_NR_gettimeofday)
1250 static inline abi_long copy_to_user_timezone(abi_ulong target_tz_addr,
1251                                              struct timezone *tz)
1252 {
1253     struct target_timezone *target_tz;
1254 
1255     if (!lock_user_struct(VERIFY_WRITE, target_tz, target_tz_addr, 1)) {
1256         return -TARGET_EFAULT;
1257     }
1258 
1259     __put_user(tz->tz_minuteswest, &target_tz->tz_minuteswest);
1260     __put_user(tz->tz_dsttime, &target_tz->tz_dsttime);
1261 
1262     unlock_user_struct(target_tz, target_tz_addr, 1);
1263 
1264     return 0;
1265 }
1266 #endif
1267 
1268 #if defined(TARGET_NR_settimeofday)
1269 static inline abi_long copy_from_user_timezone(struct timezone *tz,
1270                                                abi_ulong target_tz_addr)
1271 {
1272     struct target_timezone *target_tz;
1273 
1274     if (!lock_user_struct(VERIFY_READ, target_tz, target_tz_addr, 1)) {
1275         return -TARGET_EFAULT;
1276     }
1277 
1278     __get_user(tz->tz_minuteswest, &target_tz->tz_minuteswest);
1279     __get_user(tz->tz_dsttime, &target_tz->tz_dsttime);
1280 
1281     unlock_user_struct(target_tz, target_tz_addr, 0);
1282 
1283     return 0;
1284 }
1285 #endif
1286 
1287 #if defined(TARGET_NR_mq_open) && defined(__NR_mq_open)
1288 #include <mqueue.h>
1289 
1290 static inline abi_long copy_from_user_mq_attr(struct mq_attr *attr,
1291                                               abi_ulong target_mq_attr_addr)
1292 {
1293     struct target_mq_attr *target_mq_attr;
1294 
1295     if (!lock_user_struct(VERIFY_READ, target_mq_attr,
1296                           target_mq_attr_addr, 1))
1297         return -TARGET_EFAULT;
1298 
1299     __get_user(attr->mq_flags, &target_mq_attr->mq_flags);
1300     __get_user(attr->mq_maxmsg, &target_mq_attr->mq_maxmsg);
1301     __get_user(attr->mq_msgsize, &target_mq_attr->mq_msgsize);
1302     __get_user(attr->mq_curmsgs, &target_mq_attr->mq_curmsgs);
1303 
1304     unlock_user_struct(target_mq_attr, target_mq_attr_addr, 0);
1305 
1306     return 0;
1307 }
1308 
1309 static inline abi_long copy_to_user_mq_attr(abi_ulong target_mq_attr_addr,
1310                                             const struct mq_attr *attr)
1311 {
1312     struct target_mq_attr *target_mq_attr;
1313 
1314     if (!lock_user_struct(VERIFY_WRITE, target_mq_attr,
1315                           target_mq_attr_addr, 0))
1316         return -TARGET_EFAULT;
1317 
1318     __put_user(attr->mq_flags, &target_mq_attr->mq_flags);
1319     __put_user(attr->mq_maxmsg, &target_mq_attr->mq_maxmsg);
1320     __put_user(attr->mq_msgsize, &target_mq_attr->mq_msgsize);
1321     __put_user(attr->mq_curmsgs, &target_mq_attr->mq_curmsgs);
1322 
1323     unlock_user_struct(target_mq_attr, target_mq_attr_addr, 1);
1324 
1325     return 0;
1326 }
1327 #endif
1328 
1329 #if defined(TARGET_NR_select) || defined(TARGET_NR__newselect)
1330 /* do_select() must return target values and target errnos. */
1331 static abi_long do_select(int n,
1332                           abi_ulong rfd_addr, abi_ulong wfd_addr,
1333                           abi_ulong efd_addr, abi_ulong target_tv_addr)
1334 {
1335     fd_set rfds, wfds, efds;
1336     fd_set *rfds_ptr, *wfds_ptr, *efds_ptr;
1337     struct timeval tv;
1338     struct timespec ts, *ts_ptr;
1339     abi_long ret;
1340 
1341     ret = copy_from_user_fdset_ptr(&rfds, &rfds_ptr, rfd_addr, n);
1342     if (ret) {
1343         return ret;
1344     }
1345     ret = copy_from_user_fdset_ptr(&wfds, &wfds_ptr, wfd_addr, n);
1346     if (ret) {
1347         return ret;
1348     }
1349     ret = copy_from_user_fdset_ptr(&efds, &efds_ptr, efd_addr, n);
1350     if (ret) {
1351         return ret;
1352     }
1353 
1354     if (target_tv_addr) {
1355         if (copy_from_user_timeval(&tv, target_tv_addr))
1356             return -TARGET_EFAULT;
1357         ts.tv_sec = tv.tv_sec;
1358         ts.tv_nsec = tv.tv_usec * 1000;
1359         ts_ptr = &ts;
1360     } else {
1361         ts_ptr = NULL;
1362     }
1363 
1364     ret = get_errno(safe_pselect6(n, rfds_ptr, wfds_ptr, efds_ptr,
1365                                   ts_ptr, NULL));
1366 
1367     if (!is_error(ret)) {
1368         if (rfd_addr && copy_to_user_fdset(rfd_addr, &rfds, n))
1369             return -TARGET_EFAULT;
1370         if (wfd_addr && copy_to_user_fdset(wfd_addr, &wfds, n))
1371             return -TARGET_EFAULT;
1372         if (efd_addr && copy_to_user_fdset(efd_addr, &efds, n))
1373             return -TARGET_EFAULT;
1374 
1375         if (target_tv_addr) {
1376             tv.tv_sec = ts.tv_sec;
1377             tv.tv_usec = ts.tv_nsec / 1000;
1378             if (copy_to_user_timeval(target_tv_addr, &tv)) {
1379                 return -TARGET_EFAULT;
1380             }
1381         }
1382     }
1383 
1384     return ret;
1385 }
1386 
1387 #if defined(TARGET_WANT_OLD_SYS_SELECT)
1388 static abi_long do_old_select(abi_ulong arg1)
1389 {
1390     struct target_sel_arg_struct *sel;
1391     abi_ulong inp, outp, exp, tvp;
1392     long nsel;
1393 
1394     if (!lock_user_struct(VERIFY_READ, sel, arg1, 1)) {
1395         return -TARGET_EFAULT;
1396     }
1397 
1398     nsel = tswapal(sel->n);
1399     inp = tswapal(sel->inp);
1400     outp = tswapal(sel->outp);
1401     exp = tswapal(sel->exp);
1402     tvp = tswapal(sel->tvp);
1403 
1404     unlock_user_struct(sel, arg1, 0);
1405 
1406     return do_select(nsel, inp, outp, exp, tvp);
1407 }
1408 #endif
1409 #endif
1410 
1411 #if defined(TARGET_NR_pselect6) || defined(TARGET_NR_pselect6_time64)
1412 static abi_long do_pselect6(abi_long arg1, abi_long arg2, abi_long arg3,
1413                             abi_long arg4, abi_long arg5, abi_long arg6,
1414                             bool time64)
1415 {
1416     abi_long rfd_addr, wfd_addr, efd_addr, n, ts_addr;
1417     fd_set rfds, wfds, efds;
1418     fd_set *rfds_ptr, *wfds_ptr, *efds_ptr;
1419     struct timespec ts, *ts_ptr;
1420     abi_long ret;
1421 
1422     /*
1423      * The 6th arg is actually two args smashed together,
1424      * so we cannot use the C library.
1425      */
1426     struct {
1427         sigset_t *set;
1428         size_t size;
1429     } sig, *sig_ptr;
1430 
1431     abi_ulong arg_sigset, arg_sigsize, *arg7;
1432 
1433     n = arg1;
1434     rfd_addr = arg2;
1435     wfd_addr = arg3;
1436     efd_addr = arg4;
1437     ts_addr = arg5;
1438 
1439     ret = copy_from_user_fdset_ptr(&rfds, &rfds_ptr, rfd_addr, n);
1440     if (ret) {
1441         return ret;
1442     }
1443     ret = copy_from_user_fdset_ptr(&wfds, &wfds_ptr, wfd_addr, n);
1444     if (ret) {
1445         return ret;
1446     }
1447     ret = copy_from_user_fdset_ptr(&efds, &efds_ptr, efd_addr, n);
1448     if (ret) {
1449         return ret;
1450     }
1451 
1452     /*
1453      * This takes a timespec, and not a timeval, so we cannot
1454      * use the do_select() helper ...
1455      */
1456     if (ts_addr) {
1457         if (time64) {
1458             if (target_to_host_timespec64(&ts, ts_addr)) {
1459                 return -TARGET_EFAULT;
1460             }
1461         } else {
1462             if (target_to_host_timespec(&ts, ts_addr)) {
1463                 return -TARGET_EFAULT;
1464             }
1465         }
1466             ts_ptr = &ts;
1467     } else {
1468         ts_ptr = NULL;
1469     }
1470 
1471     /* Extract the two packed args for the sigset */
1472     sig_ptr = NULL;
1473     if (arg6) {
1474         arg7 = lock_user(VERIFY_READ, arg6, sizeof(*arg7) * 2, 1);
1475         if (!arg7) {
1476             return -TARGET_EFAULT;
1477         }
1478         arg_sigset = tswapal(arg7[0]);
1479         arg_sigsize = tswapal(arg7[1]);
1480         unlock_user(arg7, arg6, 0);
1481 
1482         if (arg_sigset) {
1483             ret = process_sigsuspend_mask(&sig.set, arg_sigset, arg_sigsize);
1484             if (ret != 0) {
1485                 return ret;
1486             }
1487             sig_ptr = &sig;
1488             sig.size = SIGSET_T_SIZE;
1489         }
1490     }
1491 
1492     ret = get_errno(safe_pselect6(n, rfds_ptr, wfds_ptr, efds_ptr,
1493                                   ts_ptr, sig_ptr));
1494 
1495     if (sig_ptr) {
1496         finish_sigsuspend_mask(ret);
1497     }
1498 
1499     if (!is_error(ret)) {
1500         if (rfd_addr && copy_to_user_fdset(rfd_addr, &rfds, n)) {
1501             return -TARGET_EFAULT;
1502         }
1503         if (wfd_addr && copy_to_user_fdset(wfd_addr, &wfds, n)) {
1504             return -TARGET_EFAULT;
1505         }
1506         if (efd_addr && copy_to_user_fdset(efd_addr, &efds, n)) {
1507             return -TARGET_EFAULT;
1508         }
1509         if (time64) {
1510             if (ts_addr && host_to_target_timespec64(ts_addr, &ts)) {
1511                 return -TARGET_EFAULT;
1512             }
1513         } else {
1514             if (ts_addr && host_to_target_timespec(ts_addr, &ts)) {
1515                 return -TARGET_EFAULT;
1516             }
1517         }
1518     }
1519     return ret;
1520 }
1521 #endif
1522 
1523 #if defined(TARGET_NR_poll) || defined(TARGET_NR_ppoll) || \
1524     defined(TARGET_NR_ppoll_time64)
1525 static abi_long do_ppoll(abi_long arg1, abi_long arg2, abi_long arg3,
1526                          abi_long arg4, abi_long arg5, bool ppoll, bool time64)
1527 {
1528     struct target_pollfd *target_pfd;
1529     unsigned int nfds = arg2;
1530     struct pollfd *pfd;
1531     unsigned int i;
1532     abi_long ret;
1533 
1534     pfd = NULL;
1535     target_pfd = NULL;
1536     if (nfds) {
1537         if (nfds > (INT_MAX / sizeof(struct target_pollfd))) {
1538             return -TARGET_EINVAL;
1539         }
1540         target_pfd = lock_user(VERIFY_WRITE, arg1,
1541                                sizeof(struct target_pollfd) * nfds, 1);
1542         if (!target_pfd) {
1543             return -TARGET_EFAULT;
1544         }
1545 
1546         pfd = alloca(sizeof(struct pollfd) * nfds);
1547         for (i = 0; i < nfds; i++) {
1548             pfd[i].fd = tswap32(target_pfd[i].fd);
1549             pfd[i].events = tswap16(target_pfd[i].events);
1550         }
1551     }
1552     if (ppoll) {
1553         struct timespec _timeout_ts, *timeout_ts = &_timeout_ts;
1554         sigset_t *set = NULL;
1555 
1556         if (arg3) {
1557             if (time64) {
1558                 if (target_to_host_timespec64(timeout_ts, arg3)) {
1559                     unlock_user(target_pfd, arg1, 0);
1560                     return -TARGET_EFAULT;
1561                 }
1562             } else {
1563                 if (target_to_host_timespec(timeout_ts, arg3)) {
1564                     unlock_user(target_pfd, arg1, 0);
1565                     return -TARGET_EFAULT;
1566                 }
1567             }
1568         } else {
1569             timeout_ts = NULL;
1570         }
1571 
1572         if (arg4) {
1573             ret = process_sigsuspend_mask(&set, arg4, arg5);
1574             if (ret != 0) {
1575                 unlock_user(target_pfd, arg1, 0);
1576                 return ret;
1577             }
1578         }
1579 
1580         ret = get_errno(safe_ppoll(pfd, nfds, timeout_ts,
1581                                    set, SIGSET_T_SIZE));
1582 
1583         if (set) {
1584             finish_sigsuspend_mask(ret);
1585         }
1586         if (!is_error(ret) && arg3) {
1587             if (time64) {
1588                 if (host_to_target_timespec64(arg3, timeout_ts)) {
1589                     return -TARGET_EFAULT;
1590                 }
1591             } else {
1592                 if (host_to_target_timespec(arg3, timeout_ts)) {
1593                     return -TARGET_EFAULT;
1594                 }
1595             }
1596         }
1597     } else {
1598           struct timespec ts, *pts;
1599 
1600           if (arg3 >= 0) {
1601               /* Convert ms to secs, ns */
1602               ts.tv_sec = arg3 / 1000;
1603               ts.tv_nsec = (arg3 % 1000) * 1000000LL;
1604               pts = &ts;
1605           } else {
1606               /* -ve poll() timeout means "infinite" */
1607               pts = NULL;
1608           }
1609           ret = get_errno(safe_ppoll(pfd, nfds, pts, NULL, 0));
1610     }
1611 
1612     if (!is_error(ret)) {
1613         for (i = 0; i < nfds; i++) {
1614             target_pfd[i].revents = tswap16(pfd[i].revents);
1615         }
1616     }
1617     unlock_user(target_pfd, arg1, sizeof(struct target_pollfd) * nfds);
1618     return ret;
1619 }
1620 #endif
1621 
1622 static abi_long do_pipe(CPUArchState *cpu_env, abi_ulong pipedes,
1623                         int flags, int is_pipe2)
1624 {
1625     int host_pipe[2];
1626     abi_long ret;
1627     ret = pipe2(host_pipe, flags);
1628 
1629     if (is_error(ret))
1630         return get_errno(ret);
1631 
1632     /* Several targets have special calling conventions for the original
1633        pipe syscall, but didn't replicate this into the pipe2 syscall.  */
1634     if (!is_pipe2) {
1635 #if defined(TARGET_ALPHA)
1636         cpu_env->ir[IR_A4] = host_pipe[1];
1637         return host_pipe[0];
1638 #elif defined(TARGET_MIPS)
1639         cpu_env->active_tc.gpr[3] = host_pipe[1];
1640         return host_pipe[0];
1641 #elif defined(TARGET_SH4)
1642         cpu_env->gregs[1] = host_pipe[1];
1643         return host_pipe[0];
1644 #elif defined(TARGET_SPARC)
1645         cpu_env->regwptr[1] = host_pipe[1];
1646         return host_pipe[0];
1647 #endif
1648     }
1649 
1650     if (put_user_s32(host_pipe[0], pipedes)
1651         || put_user_s32(host_pipe[1], pipedes + sizeof(abi_int)))
1652         return -TARGET_EFAULT;
1653     return get_errno(ret);
1654 }
1655 
1656 static inline abi_long target_to_host_ip_mreq(struct ip_mreqn *mreqn,
1657                                               abi_ulong target_addr,
1658                                               socklen_t len)
1659 {
1660     struct target_ip_mreqn *target_smreqn;
1661 
1662     target_smreqn = lock_user(VERIFY_READ, target_addr, len, 1);
1663     if (!target_smreqn)
1664         return -TARGET_EFAULT;
1665     mreqn->imr_multiaddr.s_addr = target_smreqn->imr_multiaddr.s_addr;
1666     mreqn->imr_address.s_addr = target_smreqn->imr_address.s_addr;
1667     if (len == sizeof(struct target_ip_mreqn))
1668         mreqn->imr_ifindex = tswapal(target_smreqn->imr_ifindex);
1669     unlock_user(target_smreqn, target_addr, 0);
1670 
1671     return 0;
1672 }
1673 
1674 static inline abi_long target_to_host_sockaddr(int fd, struct sockaddr *addr,
1675                                                abi_ulong target_addr,
1676                                                socklen_t len)
1677 {
1678     const socklen_t unix_maxlen = sizeof (struct sockaddr_un);
1679     sa_family_t sa_family;
1680     struct target_sockaddr *target_saddr;
1681 
1682     if (fd_trans_target_to_host_addr(fd)) {
1683         return fd_trans_target_to_host_addr(fd)(addr, target_addr, len);
1684     }
1685 
1686     target_saddr = lock_user(VERIFY_READ, target_addr, len, 1);
1687     if (!target_saddr)
1688         return -TARGET_EFAULT;
1689 
1690     sa_family = tswap16(target_saddr->sa_family);
1691 
1692     /* Oops. The caller might send a incomplete sun_path; sun_path
1693      * must be terminated by \0 (see the manual page), but
1694      * unfortunately it is quite common to specify sockaddr_un
1695      * length as "strlen(x->sun_path)" while it should be
1696      * "strlen(...) + 1". We'll fix that here if needed.
1697      * Linux kernel has a similar feature.
1698      */
1699 
1700     if (sa_family == AF_UNIX) {
1701         if (len < unix_maxlen && len > 0) {
1702             char *cp = (char*)target_saddr;
1703 
1704             if ( cp[len-1] && !cp[len] )
1705                 len++;
1706         }
1707         if (len > unix_maxlen)
1708             len = unix_maxlen;
1709     }
1710 
1711     memcpy(addr, target_saddr, len);
1712     addr->sa_family = sa_family;
1713     if (sa_family == AF_NETLINK) {
1714         struct sockaddr_nl *nladdr;
1715 
1716         nladdr = (struct sockaddr_nl *)addr;
1717         nladdr->nl_pid = tswap32(nladdr->nl_pid);
1718         nladdr->nl_groups = tswap32(nladdr->nl_groups);
1719     } else if (sa_family == AF_PACKET) {
1720 	struct target_sockaddr_ll *lladdr;
1721 
1722 	lladdr = (struct target_sockaddr_ll *)addr;
1723 	lladdr->sll_ifindex = tswap32(lladdr->sll_ifindex);
1724 	lladdr->sll_hatype = tswap16(lladdr->sll_hatype);
1725     }
1726     unlock_user(target_saddr, target_addr, 0);
1727 
1728     return 0;
1729 }
1730 
1731 static inline abi_long host_to_target_sockaddr(abi_ulong target_addr,
1732                                                struct sockaddr *addr,
1733                                                socklen_t len)
1734 {
1735     struct target_sockaddr *target_saddr;
1736 
1737     if (len == 0) {
1738         return 0;
1739     }
1740     assert(addr);
1741 
1742     target_saddr = lock_user(VERIFY_WRITE, target_addr, len, 0);
1743     if (!target_saddr)
1744         return -TARGET_EFAULT;
1745     memcpy(target_saddr, addr, len);
1746     if (len >= offsetof(struct target_sockaddr, sa_family) +
1747         sizeof(target_saddr->sa_family)) {
1748         target_saddr->sa_family = tswap16(addr->sa_family);
1749     }
1750     if (addr->sa_family == AF_NETLINK &&
1751         len >= sizeof(struct target_sockaddr_nl)) {
1752         struct target_sockaddr_nl *target_nl =
1753                (struct target_sockaddr_nl *)target_saddr;
1754         target_nl->nl_pid = tswap32(target_nl->nl_pid);
1755         target_nl->nl_groups = tswap32(target_nl->nl_groups);
1756     } else if (addr->sa_family == AF_PACKET) {
1757         struct sockaddr_ll *target_ll = (struct sockaddr_ll *)target_saddr;
1758         target_ll->sll_ifindex = tswap32(target_ll->sll_ifindex);
1759         target_ll->sll_hatype = tswap16(target_ll->sll_hatype);
1760     } else if (addr->sa_family == AF_INET6 &&
1761                len >= sizeof(struct target_sockaddr_in6)) {
1762         struct target_sockaddr_in6 *target_in6 =
1763                (struct target_sockaddr_in6 *)target_saddr;
1764         target_in6->sin6_scope_id = tswap16(target_in6->sin6_scope_id);
1765     }
1766     unlock_user(target_saddr, target_addr, len);
1767 
1768     return 0;
1769 }
1770 
1771 static inline abi_long target_to_host_cmsg(struct msghdr *msgh,
1772                                            struct target_msghdr *target_msgh)
1773 {
1774     struct cmsghdr *cmsg = CMSG_FIRSTHDR(msgh);
1775     abi_long msg_controllen;
1776     abi_ulong target_cmsg_addr;
1777     struct target_cmsghdr *target_cmsg, *target_cmsg_start;
1778     socklen_t space = 0;
1779 
1780     msg_controllen = tswapal(target_msgh->msg_controllen);
1781     if (msg_controllen < sizeof (struct target_cmsghdr))
1782         goto the_end;
1783     target_cmsg_addr = tswapal(target_msgh->msg_control);
1784     target_cmsg = lock_user(VERIFY_READ, target_cmsg_addr, msg_controllen, 1);
1785     target_cmsg_start = target_cmsg;
1786     if (!target_cmsg)
1787         return -TARGET_EFAULT;
1788 
1789     while (cmsg && target_cmsg) {
1790         void *data = CMSG_DATA(cmsg);
1791         void *target_data = TARGET_CMSG_DATA(target_cmsg);
1792 
1793         int len = tswapal(target_cmsg->cmsg_len)
1794             - sizeof(struct target_cmsghdr);
1795 
1796         space += CMSG_SPACE(len);
1797         if (space > msgh->msg_controllen) {
1798             space -= CMSG_SPACE(len);
1799             /* This is a QEMU bug, since we allocated the payload
1800              * area ourselves (unlike overflow in host-to-target
1801              * conversion, which is just the guest giving us a buffer
1802              * that's too small). It can't happen for the payload types
1803              * we currently support; if it becomes an issue in future
1804              * we would need to improve our allocation strategy to
1805              * something more intelligent than "twice the size of the
1806              * target buffer we're reading from".
1807              */
1808             qemu_log_mask(LOG_UNIMP,
1809                           ("Unsupported ancillary data %d/%d: "
1810                            "unhandled msg size\n"),
1811                           tswap32(target_cmsg->cmsg_level),
1812                           tswap32(target_cmsg->cmsg_type));
1813             break;
1814         }
1815 
1816         if (tswap32(target_cmsg->cmsg_level) == TARGET_SOL_SOCKET) {
1817             cmsg->cmsg_level = SOL_SOCKET;
1818         } else {
1819             cmsg->cmsg_level = tswap32(target_cmsg->cmsg_level);
1820         }
1821         cmsg->cmsg_type = tswap32(target_cmsg->cmsg_type);
1822         cmsg->cmsg_len = CMSG_LEN(len);
1823 
1824         if (cmsg->cmsg_level == SOL_SOCKET && cmsg->cmsg_type == SCM_RIGHTS) {
1825             int *fd = (int *)data;
1826             int *target_fd = (int *)target_data;
1827             int i, numfds = len / sizeof(int);
1828 
1829             for (i = 0; i < numfds; i++) {
1830                 __get_user(fd[i], target_fd + i);
1831             }
1832         } else if (cmsg->cmsg_level == SOL_SOCKET
1833                &&  cmsg->cmsg_type == SCM_CREDENTIALS) {
1834             struct ucred *cred = (struct ucred *)data;
1835             struct target_ucred *target_cred =
1836                 (struct target_ucred *)target_data;
1837 
1838             __get_user(cred->pid, &target_cred->pid);
1839             __get_user(cred->uid, &target_cred->uid);
1840             __get_user(cred->gid, &target_cred->gid);
1841         } else {
1842             qemu_log_mask(LOG_UNIMP, "Unsupported ancillary data: %d/%d\n",
1843                           cmsg->cmsg_level, cmsg->cmsg_type);
1844             memcpy(data, target_data, len);
1845         }
1846 
1847         cmsg = CMSG_NXTHDR(msgh, cmsg);
1848         target_cmsg = TARGET_CMSG_NXTHDR(target_msgh, target_cmsg,
1849                                          target_cmsg_start);
1850     }
1851     unlock_user(target_cmsg, target_cmsg_addr, 0);
1852  the_end:
1853     msgh->msg_controllen = space;
1854     return 0;
1855 }
1856 
1857 static inline abi_long host_to_target_cmsg(struct target_msghdr *target_msgh,
1858                                            struct msghdr *msgh)
1859 {
1860     struct cmsghdr *cmsg = CMSG_FIRSTHDR(msgh);
1861     abi_long msg_controllen;
1862     abi_ulong target_cmsg_addr;
1863     struct target_cmsghdr *target_cmsg, *target_cmsg_start;
1864     socklen_t space = 0;
1865 
1866     msg_controllen = tswapal(target_msgh->msg_controllen);
1867     if (msg_controllen < sizeof (struct target_cmsghdr))
1868         goto the_end;
1869     target_cmsg_addr = tswapal(target_msgh->msg_control);
1870     target_cmsg = lock_user(VERIFY_WRITE, target_cmsg_addr, msg_controllen, 0);
1871     target_cmsg_start = target_cmsg;
1872     if (!target_cmsg)
1873         return -TARGET_EFAULT;
1874 
1875     while (cmsg && target_cmsg) {
1876         void *data = CMSG_DATA(cmsg);
1877         void *target_data = TARGET_CMSG_DATA(target_cmsg);
1878 
1879         int len = cmsg->cmsg_len - sizeof(struct cmsghdr);
1880         int tgt_len, tgt_space;
1881 
1882         /* We never copy a half-header but may copy half-data;
1883          * this is Linux's behaviour in put_cmsg(). Note that
1884          * truncation here is a guest problem (which we report
1885          * to the guest via the CTRUNC bit), unlike truncation
1886          * in target_to_host_cmsg, which is a QEMU bug.
1887          */
1888         if (msg_controllen < sizeof(struct target_cmsghdr)) {
1889             target_msgh->msg_flags |= tswap32(MSG_CTRUNC);
1890             break;
1891         }
1892 
1893         if (cmsg->cmsg_level == SOL_SOCKET) {
1894             target_cmsg->cmsg_level = tswap32(TARGET_SOL_SOCKET);
1895         } else {
1896             target_cmsg->cmsg_level = tswap32(cmsg->cmsg_level);
1897         }
1898         target_cmsg->cmsg_type = tswap32(cmsg->cmsg_type);
1899 
1900         /* Payload types which need a different size of payload on
1901          * the target must adjust tgt_len here.
1902          */
1903         tgt_len = len;
1904         switch (cmsg->cmsg_level) {
1905         case SOL_SOCKET:
1906             switch (cmsg->cmsg_type) {
1907             case SO_TIMESTAMP:
1908                 tgt_len = sizeof(struct target_timeval);
1909                 break;
1910             default:
1911                 break;
1912             }
1913             break;
1914         default:
1915             break;
1916         }
1917 
1918         if (msg_controllen < TARGET_CMSG_LEN(tgt_len)) {
1919             target_msgh->msg_flags |= tswap32(MSG_CTRUNC);
1920             tgt_len = msg_controllen - sizeof(struct target_cmsghdr);
1921         }
1922 
1923         /* We must now copy-and-convert len bytes of payload
1924          * into tgt_len bytes of destination space. Bear in mind
1925          * that in both source and destination we may be dealing
1926          * with a truncated value!
1927          */
1928         switch (cmsg->cmsg_level) {
1929         case SOL_SOCKET:
1930             switch (cmsg->cmsg_type) {
1931             case SCM_RIGHTS:
1932             {
1933                 int *fd = (int *)data;
1934                 int *target_fd = (int *)target_data;
1935                 int i, numfds = tgt_len / sizeof(int);
1936 
1937                 for (i = 0; i < numfds; i++) {
1938                     __put_user(fd[i], target_fd + i);
1939                 }
1940                 break;
1941             }
1942             case SO_TIMESTAMP:
1943             {
1944                 struct timeval *tv = (struct timeval *)data;
1945                 struct target_timeval *target_tv =
1946                     (struct target_timeval *)target_data;
1947 
1948                 if (len != sizeof(struct timeval) ||
1949                     tgt_len != sizeof(struct target_timeval)) {
1950                     goto unimplemented;
1951                 }
1952 
1953                 /* copy struct timeval to target */
1954                 __put_user(tv->tv_sec, &target_tv->tv_sec);
1955                 __put_user(tv->tv_usec, &target_tv->tv_usec);
1956                 break;
1957             }
1958             case SCM_CREDENTIALS:
1959             {
1960                 struct ucred *cred = (struct ucred *)data;
1961                 struct target_ucred *target_cred =
1962                     (struct target_ucred *)target_data;
1963 
1964                 __put_user(cred->pid, &target_cred->pid);
1965                 __put_user(cred->uid, &target_cred->uid);
1966                 __put_user(cred->gid, &target_cred->gid);
1967                 break;
1968             }
1969             default:
1970                 goto unimplemented;
1971             }
1972             break;
1973 
1974         case SOL_IP:
1975             switch (cmsg->cmsg_type) {
1976             case IP_TTL:
1977             {
1978                 uint32_t *v = (uint32_t *)data;
1979                 uint32_t *t_int = (uint32_t *)target_data;
1980 
1981                 if (len != sizeof(uint32_t) ||
1982                     tgt_len != sizeof(uint32_t)) {
1983                     goto unimplemented;
1984                 }
1985                 __put_user(*v, t_int);
1986                 break;
1987             }
1988             case IP_RECVERR:
1989             {
1990                 struct errhdr_t {
1991                    struct sock_extended_err ee;
1992                    struct sockaddr_in offender;
1993                 };
1994                 struct errhdr_t *errh = (struct errhdr_t *)data;
1995                 struct errhdr_t *target_errh =
1996                     (struct errhdr_t *)target_data;
1997 
1998                 if (len != sizeof(struct errhdr_t) ||
1999                     tgt_len != sizeof(struct errhdr_t)) {
2000                     goto unimplemented;
2001                 }
2002                 __put_user(errh->ee.ee_errno, &target_errh->ee.ee_errno);
2003                 __put_user(errh->ee.ee_origin, &target_errh->ee.ee_origin);
2004                 __put_user(errh->ee.ee_type,  &target_errh->ee.ee_type);
2005                 __put_user(errh->ee.ee_code, &target_errh->ee.ee_code);
2006                 __put_user(errh->ee.ee_pad, &target_errh->ee.ee_pad);
2007                 __put_user(errh->ee.ee_info, &target_errh->ee.ee_info);
2008                 __put_user(errh->ee.ee_data, &target_errh->ee.ee_data);
2009                 host_to_target_sockaddr((unsigned long) &target_errh->offender,
2010                     (void *) &errh->offender, sizeof(errh->offender));
2011                 break;
2012             }
2013             default:
2014                 goto unimplemented;
2015             }
2016             break;
2017 
2018         case SOL_IPV6:
2019             switch (cmsg->cmsg_type) {
2020             case IPV6_HOPLIMIT:
2021             {
2022                 uint32_t *v = (uint32_t *)data;
2023                 uint32_t *t_int = (uint32_t *)target_data;
2024 
2025                 if (len != sizeof(uint32_t) ||
2026                     tgt_len != sizeof(uint32_t)) {
2027                     goto unimplemented;
2028                 }
2029                 __put_user(*v, t_int);
2030                 break;
2031             }
2032             case IPV6_RECVERR:
2033             {
2034                 struct errhdr6_t {
2035                    struct sock_extended_err ee;
2036                    struct sockaddr_in6 offender;
2037                 };
2038                 struct errhdr6_t *errh = (struct errhdr6_t *)data;
2039                 struct errhdr6_t *target_errh =
2040                     (struct errhdr6_t *)target_data;
2041 
2042                 if (len != sizeof(struct errhdr6_t) ||
2043                     tgt_len != sizeof(struct errhdr6_t)) {
2044                     goto unimplemented;
2045                 }
2046                 __put_user(errh->ee.ee_errno, &target_errh->ee.ee_errno);
2047                 __put_user(errh->ee.ee_origin, &target_errh->ee.ee_origin);
2048                 __put_user(errh->ee.ee_type,  &target_errh->ee.ee_type);
2049                 __put_user(errh->ee.ee_code, &target_errh->ee.ee_code);
2050                 __put_user(errh->ee.ee_pad, &target_errh->ee.ee_pad);
2051                 __put_user(errh->ee.ee_info, &target_errh->ee.ee_info);
2052                 __put_user(errh->ee.ee_data, &target_errh->ee.ee_data);
2053                 host_to_target_sockaddr((unsigned long) &target_errh->offender,
2054                     (void *) &errh->offender, sizeof(errh->offender));
2055                 break;
2056             }
2057             default:
2058                 goto unimplemented;
2059             }
2060             break;
2061 
2062         default:
2063         unimplemented:
2064             qemu_log_mask(LOG_UNIMP, "Unsupported ancillary data: %d/%d\n",
2065                           cmsg->cmsg_level, cmsg->cmsg_type);
2066             memcpy(target_data, data, MIN(len, tgt_len));
2067             if (tgt_len > len) {
2068                 memset(target_data + len, 0, tgt_len - len);
2069             }
2070         }
2071 
2072         target_cmsg->cmsg_len = tswapal(TARGET_CMSG_LEN(tgt_len));
2073         tgt_space = TARGET_CMSG_SPACE(tgt_len);
2074         if (msg_controllen < tgt_space) {
2075             tgt_space = msg_controllen;
2076         }
2077         msg_controllen -= tgt_space;
2078         space += tgt_space;
2079         cmsg = CMSG_NXTHDR(msgh, cmsg);
2080         target_cmsg = TARGET_CMSG_NXTHDR(target_msgh, target_cmsg,
2081                                          target_cmsg_start);
2082     }
2083     unlock_user(target_cmsg, target_cmsg_addr, space);
2084  the_end:
2085     target_msgh->msg_controllen = tswapal(space);
2086     return 0;
2087 }
2088 
2089 /* do_setsockopt() Must return target values and target errnos. */
2090 static abi_long do_setsockopt(int sockfd, int level, int optname,
2091                               abi_ulong optval_addr, socklen_t optlen)
2092 {
2093     abi_long ret;
2094     int val;
2095     struct ip_mreqn *ip_mreq;
2096     struct ip_mreq_source *ip_mreq_source;
2097 
2098     switch(level) {
2099     case SOL_TCP:
2100     case SOL_UDP:
2101         /* TCP and UDP options all take an 'int' value.  */
2102         if (optlen < sizeof(uint32_t))
2103             return -TARGET_EINVAL;
2104 
2105         if (get_user_u32(val, optval_addr))
2106             return -TARGET_EFAULT;
2107         ret = get_errno(setsockopt(sockfd, level, optname, &val, sizeof(val)));
2108         break;
2109     case SOL_IP:
2110         switch(optname) {
2111         case IP_TOS:
2112         case IP_TTL:
2113         case IP_HDRINCL:
2114         case IP_ROUTER_ALERT:
2115         case IP_RECVOPTS:
2116         case IP_RETOPTS:
2117         case IP_PKTINFO:
2118         case IP_MTU_DISCOVER:
2119         case IP_RECVERR:
2120         case IP_RECVTTL:
2121         case IP_RECVTOS:
2122 #ifdef IP_FREEBIND
2123         case IP_FREEBIND:
2124 #endif
2125         case IP_MULTICAST_TTL:
2126         case IP_MULTICAST_LOOP:
2127             val = 0;
2128             if (optlen >= sizeof(uint32_t)) {
2129                 if (get_user_u32(val, optval_addr))
2130                     return -TARGET_EFAULT;
2131             } else if (optlen >= 1) {
2132                 if (get_user_u8(val, optval_addr))
2133                     return -TARGET_EFAULT;
2134             }
2135             ret = get_errno(setsockopt(sockfd, level, optname, &val, sizeof(val)));
2136             break;
2137         case IP_ADD_MEMBERSHIP:
2138         case IP_DROP_MEMBERSHIP:
2139             if (optlen < sizeof (struct target_ip_mreq) ||
2140                 optlen > sizeof (struct target_ip_mreqn))
2141                 return -TARGET_EINVAL;
2142 
2143             ip_mreq = (struct ip_mreqn *) alloca(optlen);
2144             target_to_host_ip_mreq(ip_mreq, optval_addr, optlen);
2145             ret = get_errno(setsockopt(sockfd, level, optname, ip_mreq, optlen));
2146             break;
2147 
2148         case IP_BLOCK_SOURCE:
2149         case IP_UNBLOCK_SOURCE:
2150         case IP_ADD_SOURCE_MEMBERSHIP:
2151         case IP_DROP_SOURCE_MEMBERSHIP:
2152             if (optlen != sizeof (struct target_ip_mreq_source))
2153                 return -TARGET_EINVAL;
2154 
2155             ip_mreq_source = lock_user(VERIFY_READ, optval_addr, optlen, 1);
2156             if (!ip_mreq_source) {
2157                 return -TARGET_EFAULT;
2158             }
2159             ret = get_errno(setsockopt(sockfd, level, optname, ip_mreq_source, optlen));
2160             unlock_user (ip_mreq_source, optval_addr, 0);
2161             break;
2162 
2163         default:
2164             goto unimplemented;
2165         }
2166         break;
2167     case SOL_IPV6:
2168         switch (optname) {
2169         case IPV6_MTU_DISCOVER:
2170         case IPV6_MTU:
2171         case IPV6_V6ONLY:
2172         case IPV6_RECVPKTINFO:
2173         case IPV6_UNICAST_HOPS:
2174         case IPV6_MULTICAST_HOPS:
2175         case IPV6_MULTICAST_LOOP:
2176         case IPV6_RECVERR:
2177         case IPV6_RECVHOPLIMIT:
2178         case IPV6_2292HOPLIMIT:
2179         case IPV6_CHECKSUM:
2180         case IPV6_ADDRFORM:
2181         case IPV6_2292PKTINFO:
2182         case IPV6_RECVTCLASS:
2183         case IPV6_RECVRTHDR:
2184         case IPV6_2292RTHDR:
2185         case IPV6_RECVHOPOPTS:
2186         case IPV6_2292HOPOPTS:
2187         case IPV6_RECVDSTOPTS:
2188         case IPV6_2292DSTOPTS:
2189         case IPV6_TCLASS:
2190         case IPV6_ADDR_PREFERENCES:
2191 #ifdef IPV6_RECVPATHMTU
2192         case IPV6_RECVPATHMTU:
2193 #endif
2194 #ifdef IPV6_TRANSPARENT
2195         case IPV6_TRANSPARENT:
2196 #endif
2197 #ifdef IPV6_FREEBIND
2198         case IPV6_FREEBIND:
2199 #endif
2200 #ifdef IPV6_RECVORIGDSTADDR
2201         case IPV6_RECVORIGDSTADDR:
2202 #endif
2203             val = 0;
2204             if (optlen < sizeof(uint32_t)) {
2205                 return -TARGET_EINVAL;
2206             }
2207             if (get_user_u32(val, optval_addr)) {
2208                 return -TARGET_EFAULT;
2209             }
2210             ret = get_errno(setsockopt(sockfd, level, optname,
2211                                        &val, sizeof(val)));
2212             break;
2213         case IPV6_PKTINFO:
2214         {
2215             struct in6_pktinfo pki;
2216 
2217             if (optlen < sizeof(pki)) {
2218                 return -TARGET_EINVAL;
2219             }
2220 
2221             if (copy_from_user(&pki, optval_addr, sizeof(pki))) {
2222                 return -TARGET_EFAULT;
2223             }
2224 
2225             pki.ipi6_ifindex = tswap32(pki.ipi6_ifindex);
2226 
2227             ret = get_errno(setsockopt(sockfd, level, optname,
2228                                        &pki, sizeof(pki)));
2229             break;
2230         }
2231         case IPV6_ADD_MEMBERSHIP:
2232         case IPV6_DROP_MEMBERSHIP:
2233         {
2234             struct ipv6_mreq ipv6mreq;
2235 
2236             if (optlen < sizeof(ipv6mreq)) {
2237                 return -TARGET_EINVAL;
2238             }
2239 
2240             if (copy_from_user(&ipv6mreq, optval_addr, sizeof(ipv6mreq))) {
2241                 return -TARGET_EFAULT;
2242             }
2243 
2244             ipv6mreq.ipv6mr_interface = tswap32(ipv6mreq.ipv6mr_interface);
2245 
2246             ret = get_errno(setsockopt(sockfd, level, optname,
2247                                        &ipv6mreq, sizeof(ipv6mreq)));
2248             break;
2249         }
2250         default:
2251             goto unimplemented;
2252         }
2253         break;
2254     case SOL_ICMPV6:
2255         switch (optname) {
2256         case ICMPV6_FILTER:
2257         {
2258             struct icmp6_filter icmp6f;
2259 
2260             if (optlen > sizeof(icmp6f)) {
2261                 optlen = sizeof(icmp6f);
2262             }
2263 
2264             if (copy_from_user(&icmp6f, optval_addr, optlen)) {
2265                 return -TARGET_EFAULT;
2266             }
2267 
2268             for (val = 0; val < 8; val++) {
2269                 icmp6f.data[val] = tswap32(icmp6f.data[val]);
2270             }
2271 
2272             ret = get_errno(setsockopt(sockfd, level, optname,
2273                                        &icmp6f, optlen));
2274             break;
2275         }
2276         default:
2277             goto unimplemented;
2278         }
2279         break;
2280     case SOL_RAW:
2281         switch (optname) {
2282         case ICMP_FILTER:
2283         case IPV6_CHECKSUM:
2284             /* those take an u32 value */
2285             if (optlen < sizeof(uint32_t)) {
2286                 return -TARGET_EINVAL;
2287             }
2288 
2289             if (get_user_u32(val, optval_addr)) {
2290                 return -TARGET_EFAULT;
2291             }
2292             ret = get_errno(setsockopt(sockfd, level, optname,
2293                                        &val, sizeof(val)));
2294             break;
2295 
2296         default:
2297             goto unimplemented;
2298         }
2299         break;
2300 #if defined(SOL_ALG) && defined(ALG_SET_KEY) && defined(ALG_SET_AEAD_AUTHSIZE)
2301     case SOL_ALG:
2302         switch (optname) {
2303         case ALG_SET_KEY:
2304         {
2305             char *alg_key = g_malloc(optlen);
2306 
2307             if (!alg_key) {
2308                 return -TARGET_ENOMEM;
2309             }
2310             if (copy_from_user(alg_key, optval_addr, optlen)) {
2311                 g_free(alg_key);
2312                 return -TARGET_EFAULT;
2313             }
2314             ret = get_errno(setsockopt(sockfd, level, optname,
2315                                        alg_key, optlen));
2316             g_free(alg_key);
2317             break;
2318         }
2319         case ALG_SET_AEAD_AUTHSIZE:
2320         {
2321             ret = get_errno(setsockopt(sockfd, level, optname,
2322                                        NULL, optlen));
2323             break;
2324         }
2325         default:
2326             goto unimplemented;
2327         }
2328         break;
2329 #endif
2330     case TARGET_SOL_SOCKET:
2331         switch (optname) {
2332         case TARGET_SO_RCVTIMEO:
2333         {
2334                 struct timeval tv;
2335 
2336                 optname = SO_RCVTIMEO;
2337 
2338 set_timeout:
2339                 if (optlen != sizeof(struct target_timeval)) {
2340                     return -TARGET_EINVAL;
2341                 }
2342 
2343                 if (copy_from_user_timeval(&tv, optval_addr)) {
2344                     return -TARGET_EFAULT;
2345                 }
2346 
2347                 ret = get_errno(setsockopt(sockfd, SOL_SOCKET, optname,
2348                                 &tv, sizeof(tv)));
2349                 return ret;
2350         }
2351         case TARGET_SO_SNDTIMEO:
2352                 optname = SO_SNDTIMEO;
2353                 goto set_timeout;
2354         case TARGET_SO_ATTACH_FILTER:
2355         {
2356                 struct target_sock_fprog *tfprog;
2357                 struct target_sock_filter *tfilter;
2358                 struct sock_fprog fprog;
2359                 struct sock_filter *filter;
2360                 int i;
2361 
2362                 if (optlen != sizeof(*tfprog)) {
2363                     return -TARGET_EINVAL;
2364                 }
2365                 if (!lock_user_struct(VERIFY_READ, tfprog, optval_addr, 0)) {
2366                     return -TARGET_EFAULT;
2367                 }
2368                 if (!lock_user_struct(VERIFY_READ, tfilter,
2369                                       tswapal(tfprog->filter), 0)) {
2370                     unlock_user_struct(tfprog, optval_addr, 1);
2371                     return -TARGET_EFAULT;
2372                 }
2373 
2374                 fprog.len = tswap16(tfprog->len);
2375                 filter = g_try_new(struct sock_filter, fprog.len);
2376                 if (filter == NULL) {
2377                     unlock_user_struct(tfilter, tfprog->filter, 1);
2378                     unlock_user_struct(tfprog, optval_addr, 1);
2379                     return -TARGET_ENOMEM;
2380                 }
2381                 for (i = 0; i < fprog.len; i++) {
2382                     filter[i].code = tswap16(tfilter[i].code);
2383                     filter[i].jt = tfilter[i].jt;
2384                     filter[i].jf = tfilter[i].jf;
2385                     filter[i].k = tswap32(tfilter[i].k);
2386                 }
2387                 fprog.filter = filter;
2388 
2389                 ret = get_errno(setsockopt(sockfd, SOL_SOCKET,
2390                                 SO_ATTACH_FILTER, &fprog, sizeof(fprog)));
2391                 g_free(filter);
2392 
2393                 unlock_user_struct(tfilter, tfprog->filter, 1);
2394                 unlock_user_struct(tfprog, optval_addr, 1);
2395                 return ret;
2396         }
2397 	case TARGET_SO_BINDTODEVICE:
2398 	{
2399 		char *dev_ifname, *addr_ifname;
2400 
2401 		if (optlen > IFNAMSIZ - 1) {
2402 		    optlen = IFNAMSIZ - 1;
2403 		}
2404 		dev_ifname = lock_user(VERIFY_READ, optval_addr, optlen, 1);
2405 		if (!dev_ifname) {
2406 		    return -TARGET_EFAULT;
2407 		}
2408 		optname = SO_BINDTODEVICE;
2409 		addr_ifname = alloca(IFNAMSIZ);
2410 		memcpy(addr_ifname, dev_ifname, optlen);
2411 		addr_ifname[optlen] = 0;
2412 		ret = get_errno(setsockopt(sockfd, SOL_SOCKET, optname,
2413                                            addr_ifname, optlen));
2414 		unlock_user (dev_ifname, optval_addr, 0);
2415 		return ret;
2416 	}
2417         case TARGET_SO_LINGER:
2418         {
2419                 struct linger lg;
2420                 struct target_linger *tlg;
2421 
2422                 if (optlen != sizeof(struct target_linger)) {
2423                     return -TARGET_EINVAL;
2424                 }
2425                 if (!lock_user_struct(VERIFY_READ, tlg, optval_addr, 1)) {
2426                     return -TARGET_EFAULT;
2427                 }
2428                 __get_user(lg.l_onoff, &tlg->l_onoff);
2429                 __get_user(lg.l_linger, &tlg->l_linger);
2430                 ret = get_errno(setsockopt(sockfd, SOL_SOCKET, SO_LINGER,
2431                                 &lg, sizeof(lg)));
2432                 unlock_user_struct(tlg, optval_addr, 0);
2433                 return ret;
2434         }
2435             /* Options with 'int' argument.  */
2436         case TARGET_SO_DEBUG:
2437 		optname = SO_DEBUG;
2438 		break;
2439         case TARGET_SO_REUSEADDR:
2440 		optname = SO_REUSEADDR;
2441 		break;
2442 #ifdef SO_REUSEPORT
2443         case TARGET_SO_REUSEPORT:
2444                 optname = SO_REUSEPORT;
2445                 break;
2446 #endif
2447         case TARGET_SO_TYPE:
2448 		optname = SO_TYPE;
2449 		break;
2450         case TARGET_SO_ERROR:
2451 		optname = SO_ERROR;
2452 		break;
2453         case TARGET_SO_DONTROUTE:
2454 		optname = SO_DONTROUTE;
2455 		break;
2456         case TARGET_SO_BROADCAST:
2457 		optname = SO_BROADCAST;
2458 		break;
2459         case TARGET_SO_SNDBUF:
2460 		optname = SO_SNDBUF;
2461 		break;
2462         case TARGET_SO_SNDBUFFORCE:
2463                 optname = SO_SNDBUFFORCE;
2464                 break;
2465         case TARGET_SO_RCVBUF:
2466 		optname = SO_RCVBUF;
2467 		break;
2468         case TARGET_SO_RCVBUFFORCE:
2469                 optname = SO_RCVBUFFORCE;
2470                 break;
2471         case TARGET_SO_KEEPALIVE:
2472 		optname = SO_KEEPALIVE;
2473 		break;
2474         case TARGET_SO_OOBINLINE:
2475 		optname = SO_OOBINLINE;
2476 		break;
2477         case TARGET_SO_NO_CHECK:
2478 		optname = SO_NO_CHECK;
2479 		break;
2480         case TARGET_SO_PRIORITY:
2481 		optname = SO_PRIORITY;
2482 		break;
2483 #ifdef SO_BSDCOMPAT
2484         case TARGET_SO_BSDCOMPAT:
2485 		optname = SO_BSDCOMPAT;
2486 		break;
2487 #endif
2488         case TARGET_SO_PASSCRED:
2489 		optname = SO_PASSCRED;
2490 		break;
2491         case TARGET_SO_PASSSEC:
2492                 optname = SO_PASSSEC;
2493                 break;
2494         case TARGET_SO_TIMESTAMP:
2495 		optname = SO_TIMESTAMP;
2496 		break;
2497         case TARGET_SO_RCVLOWAT:
2498 		optname = SO_RCVLOWAT;
2499 		break;
2500         default:
2501             goto unimplemented;
2502         }
2503 	if (optlen < sizeof(uint32_t))
2504             return -TARGET_EINVAL;
2505 
2506 	if (get_user_u32(val, optval_addr))
2507             return -TARGET_EFAULT;
2508 	ret = get_errno(setsockopt(sockfd, SOL_SOCKET, optname, &val, sizeof(val)));
2509         break;
2510 #ifdef SOL_NETLINK
2511     case SOL_NETLINK:
2512         switch (optname) {
2513         case NETLINK_PKTINFO:
2514         case NETLINK_ADD_MEMBERSHIP:
2515         case NETLINK_DROP_MEMBERSHIP:
2516         case NETLINK_BROADCAST_ERROR:
2517         case NETLINK_NO_ENOBUFS:
2518 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 2, 0)
2519         case NETLINK_LISTEN_ALL_NSID:
2520         case NETLINK_CAP_ACK:
2521 #endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 2, 0) */
2522 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 12, 0)
2523         case NETLINK_EXT_ACK:
2524 #endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 12, 0) */
2525 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 20, 0)
2526         case NETLINK_GET_STRICT_CHK:
2527 #endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 12, 0) */
2528             break;
2529         default:
2530             goto unimplemented;
2531         }
2532         val = 0;
2533         if (optlen < sizeof(uint32_t)) {
2534             return -TARGET_EINVAL;
2535         }
2536         if (get_user_u32(val, optval_addr)) {
2537             return -TARGET_EFAULT;
2538         }
2539         ret = get_errno(setsockopt(sockfd, SOL_NETLINK, optname, &val,
2540                                    sizeof(val)));
2541         break;
2542 #endif /* SOL_NETLINK */
2543     default:
2544     unimplemented:
2545         qemu_log_mask(LOG_UNIMP, "Unsupported setsockopt level=%d optname=%d\n",
2546                       level, optname);
2547         ret = -TARGET_ENOPROTOOPT;
2548     }
2549     return ret;
2550 }
2551 
2552 /* do_getsockopt() Must return target values and target errnos. */
2553 static abi_long do_getsockopt(int sockfd, int level, int optname,
2554                               abi_ulong optval_addr, abi_ulong optlen)
2555 {
2556     abi_long ret;
2557     int len, val;
2558     socklen_t lv;
2559 
2560     switch(level) {
2561     case TARGET_SOL_SOCKET:
2562         level = SOL_SOCKET;
2563         switch (optname) {
2564         /* These don't just return a single integer */
2565         case TARGET_SO_PEERNAME:
2566             goto unimplemented;
2567         case TARGET_SO_RCVTIMEO: {
2568             struct timeval tv;
2569             socklen_t tvlen;
2570 
2571             optname = SO_RCVTIMEO;
2572 
2573 get_timeout:
2574             if (get_user_u32(len, optlen)) {
2575                 return -TARGET_EFAULT;
2576             }
2577             if (len < 0) {
2578                 return -TARGET_EINVAL;
2579             }
2580 
2581             tvlen = sizeof(tv);
2582             ret = get_errno(getsockopt(sockfd, level, optname,
2583                                        &tv, &tvlen));
2584             if (ret < 0) {
2585                 return ret;
2586             }
2587             if (len > sizeof(struct target_timeval)) {
2588                 len = sizeof(struct target_timeval);
2589             }
2590             if (copy_to_user_timeval(optval_addr, &tv)) {
2591                 return -TARGET_EFAULT;
2592             }
2593             if (put_user_u32(len, optlen)) {
2594                 return -TARGET_EFAULT;
2595             }
2596             break;
2597         }
2598         case TARGET_SO_SNDTIMEO:
2599             optname = SO_SNDTIMEO;
2600             goto get_timeout;
2601         case TARGET_SO_PEERCRED: {
2602             struct ucred cr;
2603             socklen_t crlen;
2604             struct target_ucred *tcr;
2605 
2606             if (get_user_u32(len, optlen)) {
2607                 return -TARGET_EFAULT;
2608             }
2609             if (len < 0) {
2610                 return -TARGET_EINVAL;
2611             }
2612 
2613             crlen = sizeof(cr);
2614             ret = get_errno(getsockopt(sockfd, level, SO_PEERCRED,
2615                                        &cr, &crlen));
2616             if (ret < 0) {
2617                 return ret;
2618             }
2619             if (len > crlen) {
2620                 len = crlen;
2621             }
2622             if (!lock_user_struct(VERIFY_WRITE, tcr, optval_addr, 0)) {
2623                 return -TARGET_EFAULT;
2624             }
2625             __put_user(cr.pid, &tcr->pid);
2626             __put_user(cr.uid, &tcr->uid);
2627             __put_user(cr.gid, &tcr->gid);
2628             unlock_user_struct(tcr, optval_addr, 1);
2629             if (put_user_u32(len, optlen)) {
2630                 return -TARGET_EFAULT;
2631             }
2632             break;
2633         }
2634         case TARGET_SO_PEERSEC: {
2635             char *name;
2636 
2637             if (get_user_u32(len, optlen)) {
2638                 return -TARGET_EFAULT;
2639             }
2640             if (len < 0) {
2641                 return -TARGET_EINVAL;
2642             }
2643             name = lock_user(VERIFY_WRITE, optval_addr, len, 0);
2644             if (!name) {
2645                 return -TARGET_EFAULT;
2646             }
2647             lv = len;
2648             ret = get_errno(getsockopt(sockfd, level, SO_PEERSEC,
2649                                        name, &lv));
2650             if (put_user_u32(lv, optlen)) {
2651                 ret = -TARGET_EFAULT;
2652             }
2653             unlock_user(name, optval_addr, lv);
2654             break;
2655         }
2656         case TARGET_SO_LINGER:
2657         {
2658             struct linger lg;
2659             socklen_t lglen;
2660             struct target_linger *tlg;
2661 
2662             if (get_user_u32(len, optlen)) {
2663                 return -TARGET_EFAULT;
2664             }
2665             if (len < 0) {
2666                 return -TARGET_EINVAL;
2667             }
2668 
2669             lglen = sizeof(lg);
2670             ret = get_errno(getsockopt(sockfd, level, SO_LINGER,
2671                                        &lg, &lglen));
2672             if (ret < 0) {
2673                 return ret;
2674             }
2675             if (len > lglen) {
2676                 len = lglen;
2677             }
2678             if (!lock_user_struct(VERIFY_WRITE, tlg, optval_addr, 0)) {
2679                 return -TARGET_EFAULT;
2680             }
2681             __put_user(lg.l_onoff, &tlg->l_onoff);
2682             __put_user(lg.l_linger, &tlg->l_linger);
2683             unlock_user_struct(tlg, optval_addr, 1);
2684             if (put_user_u32(len, optlen)) {
2685                 return -TARGET_EFAULT;
2686             }
2687             break;
2688         }
2689         /* Options with 'int' argument.  */
2690         case TARGET_SO_DEBUG:
2691             optname = SO_DEBUG;
2692             goto int_case;
2693         case TARGET_SO_REUSEADDR:
2694             optname = SO_REUSEADDR;
2695             goto int_case;
2696 #ifdef SO_REUSEPORT
2697         case TARGET_SO_REUSEPORT:
2698             optname = SO_REUSEPORT;
2699             goto int_case;
2700 #endif
2701         case TARGET_SO_TYPE:
2702             optname = SO_TYPE;
2703             goto int_case;
2704         case TARGET_SO_ERROR:
2705             optname = SO_ERROR;
2706             goto int_case;
2707         case TARGET_SO_DONTROUTE:
2708             optname = SO_DONTROUTE;
2709             goto int_case;
2710         case TARGET_SO_BROADCAST:
2711             optname = SO_BROADCAST;
2712             goto int_case;
2713         case TARGET_SO_SNDBUF:
2714             optname = SO_SNDBUF;
2715             goto int_case;
2716         case TARGET_SO_RCVBUF:
2717             optname = SO_RCVBUF;
2718             goto int_case;
2719         case TARGET_SO_KEEPALIVE:
2720             optname = SO_KEEPALIVE;
2721             goto int_case;
2722         case TARGET_SO_OOBINLINE:
2723             optname = SO_OOBINLINE;
2724             goto int_case;
2725         case TARGET_SO_NO_CHECK:
2726             optname = SO_NO_CHECK;
2727             goto int_case;
2728         case TARGET_SO_PRIORITY:
2729             optname = SO_PRIORITY;
2730             goto int_case;
2731 #ifdef SO_BSDCOMPAT
2732         case TARGET_SO_BSDCOMPAT:
2733             optname = SO_BSDCOMPAT;
2734             goto int_case;
2735 #endif
2736         case TARGET_SO_PASSCRED:
2737             optname = SO_PASSCRED;
2738             goto int_case;
2739         case TARGET_SO_TIMESTAMP:
2740             optname = SO_TIMESTAMP;
2741             goto int_case;
2742         case TARGET_SO_RCVLOWAT:
2743             optname = SO_RCVLOWAT;
2744             goto int_case;
2745         case TARGET_SO_ACCEPTCONN:
2746             optname = SO_ACCEPTCONN;
2747             goto int_case;
2748         case TARGET_SO_PROTOCOL:
2749             optname = SO_PROTOCOL;
2750             goto int_case;
2751         case TARGET_SO_DOMAIN:
2752             optname = SO_DOMAIN;
2753             goto int_case;
2754         default:
2755             goto int_case;
2756         }
2757         break;
2758     case SOL_TCP:
2759     case SOL_UDP:
2760         /* TCP and UDP options all take an 'int' value.  */
2761     int_case:
2762         if (get_user_u32(len, optlen))
2763             return -TARGET_EFAULT;
2764         if (len < 0)
2765             return -TARGET_EINVAL;
2766         lv = sizeof(lv);
2767         ret = get_errno(getsockopt(sockfd, level, optname, &val, &lv));
2768         if (ret < 0)
2769             return ret;
2770         if (optname == SO_TYPE) {
2771             val = host_to_target_sock_type(val);
2772         }
2773         if (len > lv)
2774             len = lv;
2775         if (len == 4) {
2776             if (put_user_u32(val, optval_addr))
2777                 return -TARGET_EFAULT;
2778         } else {
2779             if (put_user_u8(val, optval_addr))
2780                 return -TARGET_EFAULT;
2781         }
2782         if (put_user_u32(len, optlen))
2783             return -TARGET_EFAULT;
2784         break;
2785     case SOL_IP:
2786         switch(optname) {
2787         case IP_TOS:
2788         case IP_TTL:
2789         case IP_HDRINCL:
2790         case IP_ROUTER_ALERT:
2791         case IP_RECVOPTS:
2792         case IP_RETOPTS:
2793         case IP_PKTINFO:
2794         case IP_MTU_DISCOVER:
2795         case IP_RECVERR:
2796         case IP_RECVTOS:
2797 #ifdef IP_FREEBIND
2798         case IP_FREEBIND:
2799 #endif
2800         case IP_MULTICAST_TTL:
2801         case IP_MULTICAST_LOOP:
2802             if (get_user_u32(len, optlen))
2803                 return -TARGET_EFAULT;
2804             if (len < 0)
2805                 return -TARGET_EINVAL;
2806             lv = sizeof(lv);
2807             ret = get_errno(getsockopt(sockfd, level, optname, &val, &lv));
2808             if (ret < 0)
2809                 return ret;
2810             if (len < sizeof(int) && len > 0 && val >= 0 && val < 255) {
2811                 len = 1;
2812                 if (put_user_u32(len, optlen)
2813                     || put_user_u8(val, optval_addr))
2814                     return -TARGET_EFAULT;
2815             } else {
2816                 if (len > sizeof(int))
2817                     len = sizeof(int);
2818                 if (put_user_u32(len, optlen)
2819                     || put_user_u32(val, optval_addr))
2820                     return -TARGET_EFAULT;
2821             }
2822             break;
2823         default:
2824             ret = -TARGET_ENOPROTOOPT;
2825             break;
2826         }
2827         break;
2828     case SOL_IPV6:
2829         switch (optname) {
2830         case IPV6_MTU_DISCOVER:
2831         case IPV6_MTU:
2832         case IPV6_V6ONLY:
2833         case IPV6_RECVPKTINFO:
2834         case IPV6_UNICAST_HOPS:
2835         case IPV6_MULTICAST_HOPS:
2836         case IPV6_MULTICAST_LOOP:
2837         case IPV6_RECVERR:
2838         case IPV6_RECVHOPLIMIT:
2839         case IPV6_2292HOPLIMIT:
2840         case IPV6_CHECKSUM:
2841         case IPV6_ADDRFORM:
2842         case IPV6_2292PKTINFO:
2843         case IPV6_RECVTCLASS:
2844         case IPV6_RECVRTHDR:
2845         case IPV6_2292RTHDR:
2846         case IPV6_RECVHOPOPTS:
2847         case IPV6_2292HOPOPTS:
2848         case IPV6_RECVDSTOPTS:
2849         case IPV6_2292DSTOPTS:
2850         case IPV6_TCLASS:
2851         case IPV6_ADDR_PREFERENCES:
2852 #ifdef IPV6_RECVPATHMTU
2853         case IPV6_RECVPATHMTU:
2854 #endif
2855 #ifdef IPV6_TRANSPARENT
2856         case IPV6_TRANSPARENT:
2857 #endif
2858 #ifdef IPV6_FREEBIND
2859         case IPV6_FREEBIND:
2860 #endif
2861 #ifdef IPV6_RECVORIGDSTADDR
2862         case IPV6_RECVORIGDSTADDR:
2863 #endif
2864             if (get_user_u32(len, optlen))
2865                 return -TARGET_EFAULT;
2866             if (len < 0)
2867                 return -TARGET_EINVAL;
2868             lv = sizeof(lv);
2869             ret = get_errno(getsockopt(sockfd, level, optname, &val, &lv));
2870             if (ret < 0)
2871                 return ret;
2872             if (len < sizeof(int) && len > 0 && val >= 0 && val < 255) {
2873                 len = 1;
2874                 if (put_user_u32(len, optlen)
2875                     || put_user_u8(val, optval_addr))
2876                     return -TARGET_EFAULT;
2877             } else {
2878                 if (len > sizeof(int))
2879                     len = sizeof(int);
2880                 if (put_user_u32(len, optlen)
2881                     || put_user_u32(val, optval_addr))
2882                     return -TARGET_EFAULT;
2883             }
2884             break;
2885         default:
2886             ret = -TARGET_ENOPROTOOPT;
2887             break;
2888         }
2889         break;
2890 #ifdef SOL_NETLINK
2891     case SOL_NETLINK:
2892         switch (optname) {
2893         case NETLINK_PKTINFO:
2894         case NETLINK_BROADCAST_ERROR:
2895         case NETLINK_NO_ENOBUFS:
2896 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 2, 0)
2897         case NETLINK_LISTEN_ALL_NSID:
2898         case NETLINK_CAP_ACK:
2899 #endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 2, 0) */
2900 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 12, 0)
2901         case NETLINK_EXT_ACK:
2902 #endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 12, 0) */
2903 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 20, 0)
2904         case NETLINK_GET_STRICT_CHK:
2905 #endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 12, 0) */
2906             if (get_user_u32(len, optlen)) {
2907                 return -TARGET_EFAULT;
2908             }
2909             if (len != sizeof(val)) {
2910                 return -TARGET_EINVAL;
2911             }
2912             lv = len;
2913             ret = get_errno(getsockopt(sockfd, level, optname, &val, &lv));
2914             if (ret < 0) {
2915                 return ret;
2916             }
2917             if (put_user_u32(lv, optlen)
2918                 || put_user_u32(val, optval_addr)) {
2919                 return -TARGET_EFAULT;
2920             }
2921             break;
2922 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 2, 0)
2923         case NETLINK_LIST_MEMBERSHIPS:
2924         {
2925             uint32_t *results;
2926             int i;
2927             if (get_user_u32(len, optlen)) {
2928                 return -TARGET_EFAULT;
2929             }
2930             if (len < 0) {
2931                 return -TARGET_EINVAL;
2932             }
2933             results = lock_user(VERIFY_WRITE, optval_addr, len, 1);
2934             if (!results && len > 0) {
2935                 return -TARGET_EFAULT;
2936             }
2937             lv = len;
2938             ret = get_errno(getsockopt(sockfd, level, optname, results, &lv));
2939             if (ret < 0) {
2940                 unlock_user(results, optval_addr, 0);
2941                 return ret;
2942             }
2943             /* swap host endianess to target endianess. */
2944             for (i = 0; i < (len / sizeof(uint32_t)); i++) {
2945                 results[i] = tswap32(results[i]);
2946             }
2947             if (put_user_u32(lv, optlen)) {
2948                 return -TARGET_EFAULT;
2949             }
2950             unlock_user(results, optval_addr, 0);
2951             break;
2952         }
2953 #endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 2, 0) */
2954         default:
2955             goto unimplemented;
2956         }
2957         break;
2958 #endif /* SOL_NETLINK */
2959     default:
2960     unimplemented:
2961         qemu_log_mask(LOG_UNIMP,
2962                       "getsockopt level=%d optname=%d not yet supported\n",
2963                       level, optname);
2964         ret = -TARGET_EOPNOTSUPP;
2965         break;
2966     }
2967     return ret;
2968 }
2969 
2970 /* Convert target low/high pair representing file offset into the host
2971  * low/high pair. This function doesn't handle offsets bigger than 64 bits
2972  * as the kernel doesn't handle them either.
2973  */
2974 static void target_to_host_low_high(abi_ulong tlow,
2975                                     abi_ulong thigh,
2976                                     unsigned long *hlow,
2977                                     unsigned long *hhigh)
2978 {
2979     uint64_t off = tlow |
2980         ((unsigned long long)thigh << TARGET_LONG_BITS / 2) <<
2981         TARGET_LONG_BITS / 2;
2982 
2983     *hlow = off;
2984     *hhigh = (off >> HOST_LONG_BITS / 2) >> HOST_LONG_BITS / 2;
2985 }
2986 
2987 static struct iovec *lock_iovec(int type, abi_ulong target_addr,
2988                                 abi_ulong count, int copy)
2989 {
2990     struct target_iovec *target_vec;
2991     struct iovec *vec;
2992     abi_ulong total_len, max_len;
2993     int i;
2994     int err = 0;
2995     bool bad_address = false;
2996 
2997     if (count == 0) {
2998         errno = 0;
2999         return NULL;
3000     }
3001     if (count > IOV_MAX) {
3002         errno = EINVAL;
3003         return NULL;
3004     }
3005 
3006     vec = g_try_new0(struct iovec, count);
3007     if (vec == NULL) {
3008         errno = ENOMEM;
3009         return NULL;
3010     }
3011 
3012     target_vec = lock_user(VERIFY_READ, target_addr,
3013                            count * sizeof(struct target_iovec), 1);
3014     if (target_vec == NULL) {
3015         err = EFAULT;
3016         goto fail2;
3017     }
3018 
3019     /* ??? If host page size > target page size, this will result in a
3020        value larger than what we can actually support.  */
3021     max_len = 0x7fffffff & TARGET_PAGE_MASK;
3022     total_len = 0;
3023 
3024     for (i = 0; i < count; i++) {
3025         abi_ulong base = tswapal(target_vec[i].iov_base);
3026         abi_long len = tswapal(target_vec[i].iov_len);
3027 
3028         if (len < 0) {
3029             err = EINVAL;
3030             goto fail;
3031         } else if (len == 0) {
3032             /* Zero length pointer is ignored.  */
3033             vec[i].iov_base = 0;
3034         } else {
3035             vec[i].iov_base = lock_user(type, base, len, copy);
3036             /* If the first buffer pointer is bad, this is a fault.  But
3037              * subsequent bad buffers will result in a partial write; this
3038              * is realized by filling the vector with null pointers and
3039              * zero lengths. */
3040             if (!vec[i].iov_base) {
3041                 if (i == 0) {
3042                     err = EFAULT;
3043                     goto fail;
3044                 } else {
3045                     bad_address = true;
3046                 }
3047             }
3048             if (bad_address) {
3049                 len = 0;
3050             }
3051             if (len > max_len - total_len) {
3052                 len = max_len - total_len;
3053             }
3054         }
3055         vec[i].iov_len = len;
3056         total_len += len;
3057     }
3058 
3059     unlock_user(target_vec, target_addr, 0);
3060     return vec;
3061 
3062  fail:
3063     while (--i >= 0) {
3064         if (tswapal(target_vec[i].iov_len) > 0) {
3065             unlock_user(vec[i].iov_base, tswapal(target_vec[i].iov_base), 0);
3066         }
3067     }
3068     unlock_user(target_vec, target_addr, 0);
3069  fail2:
3070     g_free(vec);
3071     errno = err;
3072     return NULL;
3073 }
3074 
3075 static void unlock_iovec(struct iovec *vec, abi_ulong target_addr,
3076                          abi_ulong count, int copy)
3077 {
3078     struct target_iovec *target_vec;
3079     int i;
3080 
3081     target_vec = lock_user(VERIFY_READ, target_addr,
3082                            count * sizeof(struct target_iovec), 1);
3083     if (target_vec) {
3084         for (i = 0; i < count; i++) {
3085             abi_ulong base = tswapal(target_vec[i].iov_base);
3086             abi_long len = tswapal(target_vec[i].iov_len);
3087             if (len < 0) {
3088                 break;
3089             }
3090             unlock_user(vec[i].iov_base, base, copy ? vec[i].iov_len : 0);
3091         }
3092         unlock_user(target_vec, target_addr, 0);
3093     }
3094 
3095     g_free(vec);
3096 }
3097 
3098 static inline int target_to_host_sock_type(int *type)
3099 {
3100     int host_type = 0;
3101     int target_type = *type;
3102 
3103     switch (target_type & TARGET_SOCK_TYPE_MASK) {
3104     case TARGET_SOCK_DGRAM:
3105         host_type = SOCK_DGRAM;
3106         break;
3107     case TARGET_SOCK_STREAM:
3108         host_type = SOCK_STREAM;
3109         break;
3110     default:
3111         host_type = target_type & TARGET_SOCK_TYPE_MASK;
3112         break;
3113     }
3114     if (target_type & TARGET_SOCK_CLOEXEC) {
3115 #if defined(SOCK_CLOEXEC)
3116         host_type |= SOCK_CLOEXEC;
3117 #else
3118         return -TARGET_EINVAL;
3119 #endif
3120     }
3121     if (target_type & TARGET_SOCK_NONBLOCK) {
3122 #if defined(SOCK_NONBLOCK)
3123         host_type |= SOCK_NONBLOCK;
3124 #elif !defined(O_NONBLOCK)
3125         return -TARGET_EINVAL;
3126 #endif
3127     }
3128     *type = host_type;
3129     return 0;
3130 }
3131 
3132 /* Try to emulate socket type flags after socket creation.  */
3133 static int sock_flags_fixup(int fd, int target_type)
3134 {
3135 #if !defined(SOCK_NONBLOCK) && defined(O_NONBLOCK)
3136     if (target_type & TARGET_SOCK_NONBLOCK) {
3137         int flags = fcntl(fd, F_GETFL);
3138         if (fcntl(fd, F_SETFL, O_NONBLOCK | flags) == -1) {
3139             close(fd);
3140             return -TARGET_EINVAL;
3141         }
3142     }
3143 #endif
3144     return fd;
3145 }
3146 
3147 /* do_socket() Must return target values and target errnos. */
3148 static abi_long do_socket(int domain, int type, int protocol)
3149 {
3150     int target_type = type;
3151     int ret;
3152 
3153     ret = target_to_host_sock_type(&type);
3154     if (ret) {
3155         return ret;
3156     }
3157 
3158     if (domain == PF_NETLINK && !(
3159 #ifdef CONFIG_RTNETLINK
3160          protocol == NETLINK_ROUTE ||
3161 #endif
3162          protocol == NETLINK_KOBJECT_UEVENT ||
3163          protocol == NETLINK_AUDIT)) {
3164         return -TARGET_EPROTONOSUPPORT;
3165     }
3166 
3167     if (domain == AF_PACKET ||
3168         (domain == AF_INET && type == SOCK_PACKET)) {
3169         protocol = tswap16(protocol);
3170     }
3171 
3172     ret = get_errno(socket(domain, type, protocol));
3173     if (ret >= 0) {
3174         ret = sock_flags_fixup(ret, target_type);
3175         if (type == SOCK_PACKET) {
3176             /* Manage an obsolete case :
3177              * if socket type is SOCK_PACKET, bind by name
3178              */
3179             fd_trans_register(ret, &target_packet_trans);
3180         } else if (domain == PF_NETLINK) {
3181             switch (protocol) {
3182 #ifdef CONFIG_RTNETLINK
3183             case NETLINK_ROUTE:
3184                 fd_trans_register(ret, &target_netlink_route_trans);
3185                 break;
3186 #endif
3187             case NETLINK_KOBJECT_UEVENT:
3188                 /* nothing to do: messages are strings */
3189                 break;
3190             case NETLINK_AUDIT:
3191                 fd_trans_register(ret, &target_netlink_audit_trans);
3192                 break;
3193             default:
3194                 g_assert_not_reached();
3195             }
3196         }
3197     }
3198     return ret;
3199 }
3200 
3201 /* do_bind() Must return target values and target errnos. */
3202 static abi_long do_bind(int sockfd, abi_ulong target_addr,
3203                         socklen_t addrlen)
3204 {
3205     void *addr;
3206     abi_long ret;
3207 
3208     if ((int)addrlen < 0) {
3209         return -TARGET_EINVAL;
3210     }
3211 
3212     addr = alloca(addrlen+1);
3213 
3214     ret = target_to_host_sockaddr(sockfd, addr, target_addr, addrlen);
3215     if (ret)
3216         return ret;
3217 
3218     return get_errno(bind(sockfd, addr, addrlen));
3219 }
3220 
3221 /* do_connect() Must return target values and target errnos. */
3222 static abi_long do_connect(int sockfd, abi_ulong target_addr,
3223                            socklen_t addrlen)
3224 {
3225     void *addr;
3226     abi_long ret;
3227 
3228     if ((int)addrlen < 0) {
3229         return -TARGET_EINVAL;
3230     }
3231 
3232     addr = alloca(addrlen+1);
3233 
3234     ret = target_to_host_sockaddr(sockfd, addr, target_addr, addrlen);
3235     if (ret)
3236         return ret;
3237 
3238     return get_errno(safe_connect(sockfd, addr, addrlen));
3239 }
3240 
3241 /* do_sendrecvmsg_locked() Must return target values and target errnos. */
3242 static abi_long do_sendrecvmsg_locked(int fd, struct target_msghdr *msgp,
3243                                       int flags, int send)
3244 {
3245     abi_long ret, len;
3246     struct msghdr msg;
3247     abi_ulong count;
3248     struct iovec *vec;
3249     abi_ulong target_vec;
3250 
3251     if (msgp->msg_name) {
3252         msg.msg_namelen = tswap32(msgp->msg_namelen);
3253         msg.msg_name = alloca(msg.msg_namelen+1);
3254         ret = target_to_host_sockaddr(fd, msg.msg_name,
3255                                       tswapal(msgp->msg_name),
3256                                       msg.msg_namelen);
3257         if (ret == -TARGET_EFAULT) {
3258             /* For connected sockets msg_name and msg_namelen must
3259              * be ignored, so returning EFAULT immediately is wrong.
3260              * Instead, pass a bad msg_name to the host kernel, and
3261              * let it decide whether to return EFAULT or not.
3262              */
3263             msg.msg_name = (void *)-1;
3264         } else if (ret) {
3265             goto out2;
3266         }
3267     } else {
3268         msg.msg_name = NULL;
3269         msg.msg_namelen = 0;
3270     }
3271     msg.msg_controllen = 2 * tswapal(msgp->msg_controllen);
3272     msg.msg_control = alloca(msg.msg_controllen);
3273     memset(msg.msg_control, 0, msg.msg_controllen);
3274 
3275     msg.msg_flags = tswap32(msgp->msg_flags);
3276 
3277     count = tswapal(msgp->msg_iovlen);
3278     target_vec = tswapal(msgp->msg_iov);
3279 
3280     if (count > IOV_MAX) {
3281         /* sendrcvmsg returns a different errno for this condition than
3282          * readv/writev, so we must catch it here before lock_iovec() does.
3283          */
3284         ret = -TARGET_EMSGSIZE;
3285         goto out2;
3286     }
3287 
3288     vec = lock_iovec(send ? VERIFY_READ : VERIFY_WRITE,
3289                      target_vec, count, send);
3290     if (vec == NULL) {
3291         ret = -host_to_target_errno(errno);
3292         goto out2;
3293     }
3294     msg.msg_iovlen = count;
3295     msg.msg_iov = vec;
3296 
3297     if (send) {
3298         if (fd_trans_target_to_host_data(fd)) {
3299             void *host_msg;
3300 
3301             host_msg = g_malloc(msg.msg_iov->iov_len);
3302             memcpy(host_msg, msg.msg_iov->iov_base, msg.msg_iov->iov_len);
3303             ret = fd_trans_target_to_host_data(fd)(host_msg,
3304                                                    msg.msg_iov->iov_len);
3305             if (ret >= 0) {
3306                 msg.msg_iov->iov_base = host_msg;
3307                 ret = get_errno(safe_sendmsg(fd, &msg, flags));
3308             }
3309             g_free(host_msg);
3310         } else {
3311             ret = target_to_host_cmsg(&msg, msgp);
3312             if (ret == 0) {
3313                 ret = get_errno(safe_sendmsg(fd, &msg, flags));
3314             }
3315         }
3316     } else {
3317         ret = get_errno(safe_recvmsg(fd, &msg, flags));
3318         if (!is_error(ret)) {
3319             len = ret;
3320             if (fd_trans_host_to_target_data(fd)) {
3321                 ret = fd_trans_host_to_target_data(fd)(msg.msg_iov->iov_base,
3322                                                MIN(msg.msg_iov->iov_len, len));
3323             } else {
3324                 ret = host_to_target_cmsg(msgp, &msg);
3325             }
3326             if (!is_error(ret)) {
3327                 msgp->msg_namelen = tswap32(msg.msg_namelen);
3328                 msgp->msg_flags = tswap32(msg.msg_flags);
3329                 if (msg.msg_name != NULL && msg.msg_name != (void *)-1) {
3330                     ret = host_to_target_sockaddr(tswapal(msgp->msg_name),
3331                                     msg.msg_name, msg.msg_namelen);
3332                     if (ret) {
3333                         goto out;
3334                     }
3335                 }
3336 
3337                 ret = len;
3338             }
3339         }
3340     }
3341 
3342 out:
3343     unlock_iovec(vec, target_vec, count, !send);
3344 out2:
3345     return ret;
3346 }
3347 
3348 static abi_long do_sendrecvmsg(int fd, abi_ulong target_msg,
3349                                int flags, int send)
3350 {
3351     abi_long ret;
3352     struct target_msghdr *msgp;
3353 
3354     if (!lock_user_struct(send ? VERIFY_READ : VERIFY_WRITE,
3355                           msgp,
3356                           target_msg,
3357                           send ? 1 : 0)) {
3358         return -TARGET_EFAULT;
3359     }
3360     ret = do_sendrecvmsg_locked(fd, msgp, flags, send);
3361     unlock_user_struct(msgp, target_msg, send ? 0 : 1);
3362     return ret;
3363 }
3364 
3365 /* We don't rely on the C library to have sendmmsg/recvmmsg support,
3366  * so it might not have this *mmsg-specific flag either.
3367  */
3368 #ifndef MSG_WAITFORONE
3369 #define MSG_WAITFORONE 0x10000
3370 #endif
3371 
3372 static abi_long do_sendrecvmmsg(int fd, abi_ulong target_msgvec,
3373                                 unsigned int vlen, unsigned int flags,
3374                                 int send)
3375 {
3376     struct target_mmsghdr *mmsgp;
3377     abi_long ret = 0;
3378     int i;
3379 
3380     if (vlen > UIO_MAXIOV) {
3381         vlen = UIO_MAXIOV;
3382     }
3383 
3384     mmsgp = lock_user(VERIFY_WRITE, target_msgvec, sizeof(*mmsgp) * vlen, 1);
3385     if (!mmsgp) {
3386         return -TARGET_EFAULT;
3387     }
3388 
3389     for (i = 0; i < vlen; i++) {
3390         ret = do_sendrecvmsg_locked(fd, &mmsgp[i].msg_hdr, flags, send);
3391         if (is_error(ret)) {
3392             break;
3393         }
3394         mmsgp[i].msg_len = tswap32(ret);
3395         /* MSG_WAITFORONE turns on MSG_DONTWAIT after one packet */
3396         if (flags & MSG_WAITFORONE) {
3397             flags |= MSG_DONTWAIT;
3398         }
3399     }
3400 
3401     unlock_user(mmsgp, target_msgvec, sizeof(*mmsgp) * i);
3402 
3403     /* Return number of datagrams sent if we sent any at all;
3404      * otherwise return the error.
3405      */
3406     if (i) {
3407         return i;
3408     }
3409     return ret;
3410 }
3411 
3412 /* do_accept4() Must return target values and target errnos. */
3413 static abi_long do_accept4(int fd, abi_ulong target_addr,
3414                            abi_ulong target_addrlen_addr, int flags)
3415 {
3416     socklen_t addrlen, ret_addrlen;
3417     void *addr;
3418     abi_long ret;
3419     int host_flags;
3420 
3421     host_flags = target_to_host_bitmask(flags, fcntl_flags_tbl);
3422 
3423     if (target_addr == 0) {
3424         return get_errno(safe_accept4(fd, NULL, NULL, host_flags));
3425     }
3426 
3427     /* linux returns EFAULT if addrlen pointer is invalid */
3428     if (get_user_u32(addrlen, target_addrlen_addr))
3429         return -TARGET_EFAULT;
3430 
3431     if ((int)addrlen < 0) {
3432         return -TARGET_EINVAL;
3433     }
3434 
3435     if (!access_ok(thread_cpu, VERIFY_WRITE, target_addr, addrlen)) {
3436         return -TARGET_EFAULT;
3437     }
3438 
3439     addr = alloca(addrlen);
3440 
3441     ret_addrlen = addrlen;
3442     ret = get_errno(safe_accept4(fd, addr, &ret_addrlen, host_flags));
3443     if (!is_error(ret)) {
3444         host_to_target_sockaddr(target_addr, addr, MIN(addrlen, ret_addrlen));
3445         if (put_user_u32(ret_addrlen, target_addrlen_addr)) {
3446             ret = -TARGET_EFAULT;
3447         }
3448     }
3449     return ret;
3450 }
3451 
3452 /* do_getpeername() Must return target values and target errnos. */
3453 static abi_long do_getpeername(int fd, abi_ulong target_addr,
3454                                abi_ulong target_addrlen_addr)
3455 {
3456     socklen_t addrlen, ret_addrlen;
3457     void *addr;
3458     abi_long ret;
3459 
3460     if (get_user_u32(addrlen, target_addrlen_addr))
3461         return -TARGET_EFAULT;
3462 
3463     if ((int)addrlen < 0) {
3464         return -TARGET_EINVAL;
3465     }
3466 
3467     if (!access_ok(thread_cpu, VERIFY_WRITE, target_addr, addrlen)) {
3468         return -TARGET_EFAULT;
3469     }
3470 
3471     addr = alloca(addrlen);
3472 
3473     ret_addrlen = addrlen;
3474     ret = get_errno(getpeername(fd, addr, &ret_addrlen));
3475     if (!is_error(ret)) {
3476         host_to_target_sockaddr(target_addr, addr, MIN(addrlen, ret_addrlen));
3477         if (put_user_u32(ret_addrlen, target_addrlen_addr)) {
3478             ret = -TARGET_EFAULT;
3479         }
3480     }
3481     return ret;
3482 }
3483 
3484 /* do_getsockname() Must return target values and target errnos. */
3485 static abi_long do_getsockname(int fd, abi_ulong target_addr,
3486                                abi_ulong target_addrlen_addr)
3487 {
3488     socklen_t addrlen, ret_addrlen;
3489     void *addr;
3490     abi_long ret;
3491 
3492     if (get_user_u32(addrlen, target_addrlen_addr))
3493         return -TARGET_EFAULT;
3494 
3495     if ((int)addrlen < 0) {
3496         return -TARGET_EINVAL;
3497     }
3498 
3499     if (!access_ok(thread_cpu, VERIFY_WRITE, target_addr, addrlen)) {
3500         return -TARGET_EFAULT;
3501     }
3502 
3503     addr = alloca(addrlen);
3504 
3505     ret_addrlen = addrlen;
3506     ret = get_errno(getsockname(fd, addr, &ret_addrlen));
3507     if (!is_error(ret)) {
3508         host_to_target_sockaddr(target_addr, addr, MIN(addrlen, ret_addrlen));
3509         if (put_user_u32(ret_addrlen, target_addrlen_addr)) {
3510             ret = -TARGET_EFAULT;
3511         }
3512     }
3513     return ret;
3514 }
3515 
3516 /* do_socketpair() Must return target values and target errnos. */
3517 static abi_long do_socketpair(int domain, int type, int protocol,
3518                               abi_ulong target_tab_addr)
3519 {
3520     int tab[2];
3521     abi_long ret;
3522 
3523     target_to_host_sock_type(&type);
3524 
3525     ret = get_errno(socketpair(domain, type, protocol, tab));
3526     if (!is_error(ret)) {
3527         if (put_user_s32(tab[0], target_tab_addr)
3528             || put_user_s32(tab[1], target_tab_addr + sizeof(tab[0])))
3529             ret = -TARGET_EFAULT;
3530     }
3531     return ret;
3532 }
3533 
3534 /* do_sendto() Must return target values and target errnos. */
3535 static abi_long do_sendto(int fd, abi_ulong msg, size_t len, int flags,
3536                           abi_ulong target_addr, socklen_t addrlen)
3537 {
3538     void *addr;
3539     void *host_msg;
3540     void *copy_msg = NULL;
3541     abi_long ret;
3542 
3543     if ((int)addrlen < 0) {
3544         return -TARGET_EINVAL;
3545     }
3546 
3547     host_msg = lock_user(VERIFY_READ, msg, len, 1);
3548     if (!host_msg)
3549         return -TARGET_EFAULT;
3550     if (fd_trans_target_to_host_data(fd)) {
3551         copy_msg = host_msg;
3552         host_msg = g_malloc(len);
3553         memcpy(host_msg, copy_msg, len);
3554         ret = fd_trans_target_to_host_data(fd)(host_msg, len);
3555         if (ret < 0) {
3556             goto fail;
3557         }
3558     }
3559     if (target_addr) {
3560         addr = alloca(addrlen+1);
3561         ret = target_to_host_sockaddr(fd, addr, target_addr, addrlen);
3562         if (ret) {
3563             goto fail;
3564         }
3565         ret = get_errno(safe_sendto(fd, host_msg, len, flags, addr, addrlen));
3566     } else {
3567         ret = get_errno(safe_sendto(fd, host_msg, len, flags, NULL, 0));
3568     }
3569 fail:
3570     if (copy_msg) {
3571         g_free(host_msg);
3572         host_msg = copy_msg;
3573     }
3574     unlock_user(host_msg, msg, 0);
3575     return ret;
3576 }
3577 
3578 /* do_recvfrom() Must return target values and target errnos. */
3579 static abi_long do_recvfrom(int fd, abi_ulong msg, size_t len, int flags,
3580                             abi_ulong target_addr,
3581                             abi_ulong target_addrlen)
3582 {
3583     socklen_t addrlen, ret_addrlen;
3584     void *addr;
3585     void *host_msg;
3586     abi_long ret;
3587 
3588     if (!msg) {
3589         host_msg = NULL;
3590     } else {
3591         host_msg = lock_user(VERIFY_WRITE, msg, len, 0);
3592         if (!host_msg) {
3593             return -TARGET_EFAULT;
3594         }
3595     }
3596     if (target_addr) {
3597         if (get_user_u32(addrlen, target_addrlen)) {
3598             ret = -TARGET_EFAULT;
3599             goto fail;
3600         }
3601         if ((int)addrlen < 0) {
3602             ret = -TARGET_EINVAL;
3603             goto fail;
3604         }
3605         addr = alloca(addrlen);
3606         ret_addrlen = addrlen;
3607         ret = get_errno(safe_recvfrom(fd, host_msg, len, flags,
3608                                       addr, &ret_addrlen));
3609     } else {
3610         addr = NULL; /* To keep compiler quiet.  */
3611         addrlen = 0; /* To keep compiler quiet.  */
3612         ret = get_errno(safe_recvfrom(fd, host_msg, len, flags, NULL, 0));
3613     }
3614     if (!is_error(ret)) {
3615         if (fd_trans_host_to_target_data(fd)) {
3616             abi_long trans;
3617             trans = fd_trans_host_to_target_data(fd)(host_msg, MIN(ret, len));
3618             if (is_error(trans)) {
3619                 ret = trans;
3620                 goto fail;
3621             }
3622         }
3623         if (target_addr) {
3624             host_to_target_sockaddr(target_addr, addr,
3625                                     MIN(addrlen, ret_addrlen));
3626             if (put_user_u32(ret_addrlen, target_addrlen)) {
3627                 ret = -TARGET_EFAULT;
3628                 goto fail;
3629             }
3630         }
3631         unlock_user(host_msg, msg, len);
3632     } else {
3633 fail:
3634         unlock_user(host_msg, msg, 0);
3635     }
3636     return ret;
3637 }
3638 
3639 #ifdef TARGET_NR_socketcall
3640 /* do_socketcall() must return target values and target errnos. */
3641 static abi_long do_socketcall(int num, abi_ulong vptr)
3642 {
3643     static const unsigned nargs[] = { /* number of arguments per operation */
3644         [TARGET_SYS_SOCKET] = 3,      /* domain, type, protocol */
3645         [TARGET_SYS_BIND] = 3,        /* fd, addr, addrlen */
3646         [TARGET_SYS_CONNECT] = 3,     /* fd, addr, addrlen */
3647         [TARGET_SYS_LISTEN] = 2,      /* fd, backlog */
3648         [TARGET_SYS_ACCEPT] = 3,      /* fd, addr, addrlen */
3649         [TARGET_SYS_GETSOCKNAME] = 3, /* fd, addr, addrlen */
3650         [TARGET_SYS_GETPEERNAME] = 3, /* fd, addr, addrlen */
3651         [TARGET_SYS_SOCKETPAIR] = 4,  /* domain, type, protocol, tab */
3652         [TARGET_SYS_SEND] = 4,        /* fd, msg, len, flags */
3653         [TARGET_SYS_RECV] = 4,        /* fd, msg, len, flags */
3654         [TARGET_SYS_SENDTO] = 6,      /* fd, msg, len, flags, addr, addrlen */
3655         [TARGET_SYS_RECVFROM] = 6,    /* fd, msg, len, flags, addr, addrlen */
3656         [TARGET_SYS_SHUTDOWN] = 2,    /* fd, how */
3657         [TARGET_SYS_SETSOCKOPT] = 5,  /* fd, level, optname, optval, optlen */
3658         [TARGET_SYS_GETSOCKOPT] = 5,  /* fd, level, optname, optval, optlen */
3659         [TARGET_SYS_SENDMSG] = 3,     /* fd, msg, flags */
3660         [TARGET_SYS_RECVMSG] = 3,     /* fd, msg, flags */
3661         [TARGET_SYS_ACCEPT4] = 4,     /* fd, addr, addrlen, flags */
3662         [TARGET_SYS_RECVMMSG] = 4,    /* fd, msgvec, vlen, flags */
3663         [TARGET_SYS_SENDMMSG] = 4,    /* fd, msgvec, vlen, flags */
3664     };
3665     abi_long a[6]; /* max 6 args */
3666     unsigned i;
3667 
3668     /* check the range of the first argument num */
3669     /* (TARGET_SYS_SENDMMSG is the highest among TARGET_SYS_xxx) */
3670     if (num < 1 || num > TARGET_SYS_SENDMMSG) {
3671         return -TARGET_EINVAL;
3672     }
3673     /* ensure we have space for args */
3674     if (nargs[num] > ARRAY_SIZE(a)) {
3675         return -TARGET_EINVAL;
3676     }
3677     /* collect the arguments in a[] according to nargs[] */
3678     for (i = 0; i < nargs[num]; ++i) {
3679         if (get_user_ual(a[i], vptr + i * sizeof(abi_long)) != 0) {
3680             return -TARGET_EFAULT;
3681         }
3682     }
3683     /* now when we have the args, invoke the appropriate underlying function */
3684     switch (num) {
3685     case TARGET_SYS_SOCKET: /* domain, type, protocol */
3686         return do_socket(a[0], a[1], a[2]);
3687     case TARGET_SYS_BIND: /* sockfd, addr, addrlen */
3688         return do_bind(a[0], a[1], a[2]);
3689     case TARGET_SYS_CONNECT: /* sockfd, addr, addrlen */
3690         return do_connect(a[0], a[1], a[2]);
3691     case TARGET_SYS_LISTEN: /* sockfd, backlog */
3692         return get_errno(listen(a[0], a[1]));
3693     case TARGET_SYS_ACCEPT: /* sockfd, addr, addrlen */
3694         return do_accept4(a[0], a[1], a[2], 0);
3695     case TARGET_SYS_GETSOCKNAME: /* sockfd, addr, addrlen */
3696         return do_getsockname(a[0], a[1], a[2]);
3697     case TARGET_SYS_GETPEERNAME: /* sockfd, addr, addrlen */
3698         return do_getpeername(a[0], a[1], a[2]);
3699     case TARGET_SYS_SOCKETPAIR: /* domain, type, protocol, tab */
3700         return do_socketpair(a[0], a[1], a[2], a[3]);
3701     case TARGET_SYS_SEND: /* sockfd, msg, len, flags */
3702         return do_sendto(a[0], a[1], a[2], a[3], 0, 0);
3703     case TARGET_SYS_RECV: /* sockfd, msg, len, flags */
3704         return do_recvfrom(a[0], a[1], a[2], a[3], 0, 0);
3705     case TARGET_SYS_SENDTO: /* sockfd, msg, len, flags, addr, addrlen */
3706         return do_sendto(a[0], a[1], a[2], a[3], a[4], a[5]);
3707     case TARGET_SYS_RECVFROM: /* sockfd, msg, len, flags, addr, addrlen */
3708         return do_recvfrom(a[0], a[1], a[2], a[3], a[4], a[5]);
3709     case TARGET_SYS_SHUTDOWN: /* sockfd, how */
3710         return get_errno(shutdown(a[0], a[1]));
3711     case TARGET_SYS_SETSOCKOPT: /* sockfd, level, optname, optval, optlen */
3712         return do_setsockopt(a[0], a[1], a[2], a[3], a[4]);
3713     case TARGET_SYS_GETSOCKOPT: /* sockfd, level, optname, optval, optlen */
3714         return do_getsockopt(a[0], a[1], a[2], a[3], a[4]);
3715     case TARGET_SYS_SENDMSG: /* sockfd, msg, flags */
3716         return do_sendrecvmsg(a[0], a[1], a[2], 1);
3717     case TARGET_SYS_RECVMSG: /* sockfd, msg, flags */
3718         return do_sendrecvmsg(a[0], a[1], a[2], 0);
3719     case TARGET_SYS_ACCEPT4: /* sockfd, addr, addrlen, flags */
3720         return do_accept4(a[0], a[1], a[2], a[3]);
3721     case TARGET_SYS_RECVMMSG: /* sockfd, msgvec, vlen, flags */
3722         return do_sendrecvmmsg(a[0], a[1], a[2], a[3], 0);
3723     case TARGET_SYS_SENDMMSG: /* sockfd, msgvec, vlen, flags */
3724         return do_sendrecvmmsg(a[0], a[1], a[2], a[3], 1);
3725     default:
3726         qemu_log_mask(LOG_UNIMP, "Unsupported socketcall: %d\n", num);
3727         return -TARGET_EINVAL;
3728     }
3729 }
3730 #endif
3731 
3732 #define N_SHM_REGIONS	32
3733 
3734 static struct shm_region {
3735     abi_ulong start;
3736     abi_ulong size;
3737     bool in_use;
3738 } shm_regions[N_SHM_REGIONS];
3739 
3740 #ifndef TARGET_SEMID64_DS
3741 /* asm-generic version of this struct */
3742 struct target_semid64_ds
3743 {
3744   struct target_ipc_perm sem_perm;
3745   abi_ulong sem_otime;
3746 #if TARGET_ABI_BITS == 32
3747   abi_ulong __unused1;
3748 #endif
3749   abi_ulong sem_ctime;
3750 #if TARGET_ABI_BITS == 32
3751   abi_ulong __unused2;
3752 #endif
3753   abi_ulong sem_nsems;
3754   abi_ulong __unused3;
3755   abi_ulong __unused4;
3756 };
3757 #endif
3758 
3759 static inline abi_long target_to_host_ipc_perm(struct ipc_perm *host_ip,
3760                                                abi_ulong target_addr)
3761 {
3762     struct target_ipc_perm *target_ip;
3763     struct target_semid64_ds *target_sd;
3764 
3765     if (!lock_user_struct(VERIFY_READ, target_sd, target_addr, 1))
3766         return -TARGET_EFAULT;
3767     target_ip = &(target_sd->sem_perm);
3768     host_ip->__key = tswap32(target_ip->__key);
3769     host_ip->uid = tswap32(target_ip->uid);
3770     host_ip->gid = tswap32(target_ip->gid);
3771     host_ip->cuid = tswap32(target_ip->cuid);
3772     host_ip->cgid = tswap32(target_ip->cgid);
3773 #if defined(TARGET_ALPHA) || defined(TARGET_MIPS) || defined(TARGET_PPC)
3774     host_ip->mode = tswap32(target_ip->mode);
3775 #else
3776     host_ip->mode = tswap16(target_ip->mode);
3777 #endif
3778 #if defined(TARGET_PPC)
3779     host_ip->__seq = tswap32(target_ip->__seq);
3780 #else
3781     host_ip->__seq = tswap16(target_ip->__seq);
3782 #endif
3783     unlock_user_struct(target_sd, target_addr, 0);
3784     return 0;
3785 }
3786 
3787 static inline abi_long host_to_target_ipc_perm(abi_ulong target_addr,
3788                                                struct ipc_perm *host_ip)
3789 {
3790     struct target_ipc_perm *target_ip;
3791     struct target_semid64_ds *target_sd;
3792 
3793     if (!lock_user_struct(VERIFY_WRITE, target_sd, target_addr, 0))
3794         return -TARGET_EFAULT;
3795     target_ip = &(target_sd->sem_perm);
3796     target_ip->__key = tswap32(host_ip->__key);
3797     target_ip->uid = tswap32(host_ip->uid);
3798     target_ip->gid = tswap32(host_ip->gid);
3799     target_ip->cuid = tswap32(host_ip->cuid);
3800     target_ip->cgid = tswap32(host_ip->cgid);
3801 #if defined(TARGET_ALPHA) || defined(TARGET_MIPS) || defined(TARGET_PPC)
3802     target_ip->mode = tswap32(host_ip->mode);
3803 #else
3804     target_ip->mode = tswap16(host_ip->mode);
3805 #endif
3806 #if defined(TARGET_PPC)
3807     target_ip->__seq = tswap32(host_ip->__seq);
3808 #else
3809     target_ip->__seq = tswap16(host_ip->__seq);
3810 #endif
3811     unlock_user_struct(target_sd, target_addr, 1);
3812     return 0;
3813 }
3814 
3815 static inline abi_long target_to_host_semid_ds(struct semid_ds *host_sd,
3816                                                abi_ulong target_addr)
3817 {
3818     struct target_semid64_ds *target_sd;
3819 
3820     if (!lock_user_struct(VERIFY_READ, target_sd, target_addr, 1))
3821         return -TARGET_EFAULT;
3822     if (target_to_host_ipc_perm(&(host_sd->sem_perm),target_addr))
3823         return -TARGET_EFAULT;
3824     host_sd->sem_nsems = tswapal(target_sd->sem_nsems);
3825     host_sd->sem_otime = tswapal(target_sd->sem_otime);
3826     host_sd->sem_ctime = tswapal(target_sd->sem_ctime);
3827     unlock_user_struct(target_sd, target_addr, 0);
3828     return 0;
3829 }
3830 
3831 static inline abi_long host_to_target_semid_ds(abi_ulong target_addr,
3832                                                struct semid_ds *host_sd)
3833 {
3834     struct target_semid64_ds *target_sd;
3835 
3836     if (!lock_user_struct(VERIFY_WRITE, target_sd, target_addr, 0))
3837         return -TARGET_EFAULT;
3838     if (host_to_target_ipc_perm(target_addr,&(host_sd->sem_perm)))
3839         return -TARGET_EFAULT;
3840     target_sd->sem_nsems = tswapal(host_sd->sem_nsems);
3841     target_sd->sem_otime = tswapal(host_sd->sem_otime);
3842     target_sd->sem_ctime = tswapal(host_sd->sem_ctime);
3843     unlock_user_struct(target_sd, target_addr, 1);
3844     return 0;
3845 }
3846 
3847 struct target_seminfo {
3848     int semmap;
3849     int semmni;
3850     int semmns;
3851     int semmnu;
3852     int semmsl;
3853     int semopm;
3854     int semume;
3855     int semusz;
3856     int semvmx;
3857     int semaem;
3858 };
3859 
3860 static inline abi_long host_to_target_seminfo(abi_ulong target_addr,
3861                                               struct seminfo *host_seminfo)
3862 {
3863     struct target_seminfo *target_seminfo;
3864     if (!lock_user_struct(VERIFY_WRITE, target_seminfo, target_addr, 0))
3865         return -TARGET_EFAULT;
3866     __put_user(host_seminfo->semmap, &target_seminfo->semmap);
3867     __put_user(host_seminfo->semmni, &target_seminfo->semmni);
3868     __put_user(host_seminfo->semmns, &target_seminfo->semmns);
3869     __put_user(host_seminfo->semmnu, &target_seminfo->semmnu);
3870     __put_user(host_seminfo->semmsl, &target_seminfo->semmsl);
3871     __put_user(host_seminfo->semopm, &target_seminfo->semopm);
3872     __put_user(host_seminfo->semume, &target_seminfo->semume);
3873     __put_user(host_seminfo->semusz, &target_seminfo->semusz);
3874     __put_user(host_seminfo->semvmx, &target_seminfo->semvmx);
3875     __put_user(host_seminfo->semaem, &target_seminfo->semaem);
3876     unlock_user_struct(target_seminfo, target_addr, 1);
3877     return 0;
3878 }
3879 
3880 union semun {
3881 	int val;
3882 	struct semid_ds *buf;
3883 	unsigned short *array;
3884 	struct seminfo *__buf;
3885 };
3886 
3887 union target_semun {
3888 	int val;
3889 	abi_ulong buf;
3890 	abi_ulong array;
3891 	abi_ulong __buf;
3892 };
3893 
3894 static inline abi_long target_to_host_semarray(int semid, unsigned short **host_array,
3895                                                abi_ulong target_addr)
3896 {
3897     int nsems;
3898     unsigned short *array;
3899     union semun semun;
3900     struct semid_ds semid_ds;
3901     int i, ret;
3902 
3903     semun.buf = &semid_ds;
3904 
3905     ret = semctl(semid, 0, IPC_STAT, semun);
3906     if (ret == -1)
3907         return get_errno(ret);
3908 
3909     nsems = semid_ds.sem_nsems;
3910 
3911     *host_array = g_try_new(unsigned short, nsems);
3912     if (!*host_array) {
3913         return -TARGET_ENOMEM;
3914     }
3915     array = lock_user(VERIFY_READ, target_addr,
3916                       nsems*sizeof(unsigned short), 1);
3917     if (!array) {
3918         g_free(*host_array);
3919         return -TARGET_EFAULT;
3920     }
3921 
3922     for(i=0; i<nsems; i++) {
3923         __get_user((*host_array)[i], &array[i]);
3924     }
3925     unlock_user(array, target_addr, 0);
3926 
3927     return 0;
3928 }
3929 
3930 static inline abi_long host_to_target_semarray(int semid, abi_ulong target_addr,
3931                                                unsigned short **host_array)
3932 {
3933     int nsems;
3934     unsigned short *array;
3935     union semun semun;
3936     struct semid_ds semid_ds;
3937     int i, ret;
3938 
3939     semun.buf = &semid_ds;
3940 
3941     ret = semctl(semid, 0, IPC_STAT, semun);
3942     if (ret == -1)
3943         return get_errno(ret);
3944 
3945     nsems = semid_ds.sem_nsems;
3946 
3947     array = lock_user(VERIFY_WRITE, target_addr,
3948                       nsems*sizeof(unsigned short), 0);
3949     if (!array)
3950         return -TARGET_EFAULT;
3951 
3952     for(i=0; i<nsems; i++) {
3953         __put_user((*host_array)[i], &array[i]);
3954     }
3955     g_free(*host_array);
3956     unlock_user(array, target_addr, 1);
3957 
3958     return 0;
3959 }
3960 
3961 static inline abi_long do_semctl(int semid, int semnum, int cmd,
3962                                  abi_ulong target_arg)
3963 {
3964     union target_semun target_su = { .buf = target_arg };
3965     union semun arg;
3966     struct semid_ds dsarg;
3967     unsigned short *array = NULL;
3968     struct seminfo seminfo;
3969     abi_long ret = -TARGET_EINVAL;
3970     abi_long err;
3971     cmd &= 0xff;
3972 
3973     switch( cmd ) {
3974 	case GETVAL:
3975 	case SETVAL:
3976             /* In 64 bit cross-endian situations, we will erroneously pick up
3977              * the wrong half of the union for the "val" element.  To rectify
3978              * this, the entire 8-byte structure is byteswapped, followed by
3979 	     * a swap of the 4 byte val field. In other cases, the data is
3980 	     * already in proper host byte order. */
3981 	    if (sizeof(target_su.val) != (sizeof(target_su.buf))) {
3982 		target_su.buf = tswapal(target_su.buf);
3983 		arg.val = tswap32(target_su.val);
3984 	    } else {
3985 		arg.val = target_su.val;
3986 	    }
3987             ret = get_errno(semctl(semid, semnum, cmd, arg));
3988             break;
3989 	case GETALL:
3990 	case SETALL:
3991             err = target_to_host_semarray(semid, &array, target_su.array);
3992             if (err)
3993                 return err;
3994             arg.array = array;
3995             ret = get_errno(semctl(semid, semnum, cmd, arg));
3996             err = host_to_target_semarray(semid, target_su.array, &array);
3997             if (err)
3998                 return err;
3999             break;
4000 	case IPC_STAT:
4001 	case IPC_SET:
4002 	case SEM_STAT:
4003             err = target_to_host_semid_ds(&dsarg, target_su.buf);
4004             if (err)
4005                 return err;
4006             arg.buf = &dsarg;
4007             ret = get_errno(semctl(semid, semnum, cmd, arg));
4008             err = host_to_target_semid_ds(target_su.buf, &dsarg);
4009             if (err)
4010                 return err;
4011             break;
4012 	case IPC_INFO:
4013 	case SEM_INFO:
4014             arg.__buf = &seminfo;
4015             ret = get_errno(semctl(semid, semnum, cmd, arg));
4016             err = host_to_target_seminfo(target_su.__buf, &seminfo);
4017             if (err)
4018                 return err;
4019             break;
4020 	case IPC_RMID:
4021 	case GETPID:
4022 	case GETNCNT:
4023 	case GETZCNT:
4024             ret = get_errno(semctl(semid, semnum, cmd, NULL));
4025             break;
4026     }
4027 
4028     return ret;
4029 }
4030 
4031 struct target_sembuf {
4032     unsigned short sem_num;
4033     short sem_op;
4034     short sem_flg;
4035 };
4036 
4037 static inline abi_long target_to_host_sembuf(struct sembuf *host_sembuf,
4038                                              abi_ulong target_addr,
4039                                              unsigned nsops)
4040 {
4041     struct target_sembuf *target_sembuf;
4042     int i;
4043 
4044     target_sembuf = lock_user(VERIFY_READ, target_addr,
4045                               nsops*sizeof(struct target_sembuf), 1);
4046     if (!target_sembuf)
4047         return -TARGET_EFAULT;
4048 
4049     for(i=0; i<nsops; i++) {
4050         __get_user(host_sembuf[i].sem_num, &target_sembuf[i].sem_num);
4051         __get_user(host_sembuf[i].sem_op, &target_sembuf[i].sem_op);
4052         __get_user(host_sembuf[i].sem_flg, &target_sembuf[i].sem_flg);
4053     }
4054 
4055     unlock_user(target_sembuf, target_addr, 0);
4056 
4057     return 0;
4058 }
4059 
4060 #if defined(TARGET_NR_ipc) || defined(TARGET_NR_semop) || \
4061     defined(TARGET_NR_semtimedop) || defined(TARGET_NR_semtimedop_time64)
4062 
4063 /*
4064  * This macro is required to handle the s390 variants, which passes the
4065  * arguments in a different order than default.
4066  */
4067 #ifdef __s390x__
4068 #define SEMTIMEDOP_IPC_ARGS(__nsops, __sops, __timeout) \
4069   (__nsops), (__timeout), (__sops)
4070 #else
4071 #define SEMTIMEDOP_IPC_ARGS(__nsops, __sops, __timeout) \
4072   (__nsops), 0, (__sops), (__timeout)
4073 #endif
4074 
4075 static inline abi_long do_semtimedop(int semid,
4076                                      abi_long ptr,
4077                                      unsigned nsops,
4078                                      abi_long timeout, bool time64)
4079 {
4080     struct sembuf *sops;
4081     struct timespec ts, *pts = NULL;
4082     abi_long ret;
4083 
4084     if (timeout) {
4085         pts = &ts;
4086         if (time64) {
4087             if (target_to_host_timespec64(pts, timeout)) {
4088                 return -TARGET_EFAULT;
4089             }
4090         } else {
4091             if (target_to_host_timespec(pts, timeout)) {
4092                 return -TARGET_EFAULT;
4093             }
4094         }
4095     }
4096 
4097     if (nsops > TARGET_SEMOPM) {
4098         return -TARGET_E2BIG;
4099     }
4100 
4101     sops = g_new(struct sembuf, nsops);
4102 
4103     if (target_to_host_sembuf(sops, ptr, nsops)) {
4104         g_free(sops);
4105         return -TARGET_EFAULT;
4106     }
4107 
4108     ret = -TARGET_ENOSYS;
4109 #ifdef __NR_semtimedop
4110     ret = get_errno(safe_semtimedop(semid, sops, nsops, pts));
4111 #endif
4112 #ifdef __NR_ipc
4113     if (ret == -TARGET_ENOSYS) {
4114         ret = get_errno(safe_ipc(IPCOP_semtimedop, semid,
4115                                  SEMTIMEDOP_IPC_ARGS(nsops, sops, (long)pts)));
4116     }
4117 #endif
4118     g_free(sops);
4119     return ret;
4120 }
4121 #endif
4122 
4123 struct target_msqid_ds
4124 {
4125     struct target_ipc_perm msg_perm;
4126     abi_ulong msg_stime;
4127 #if TARGET_ABI_BITS == 32
4128     abi_ulong __unused1;
4129 #endif
4130     abi_ulong msg_rtime;
4131 #if TARGET_ABI_BITS == 32
4132     abi_ulong __unused2;
4133 #endif
4134     abi_ulong msg_ctime;
4135 #if TARGET_ABI_BITS == 32
4136     abi_ulong __unused3;
4137 #endif
4138     abi_ulong __msg_cbytes;
4139     abi_ulong msg_qnum;
4140     abi_ulong msg_qbytes;
4141     abi_ulong msg_lspid;
4142     abi_ulong msg_lrpid;
4143     abi_ulong __unused4;
4144     abi_ulong __unused5;
4145 };
4146 
4147 static inline abi_long target_to_host_msqid_ds(struct msqid_ds *host_md,
4148                                                abi_ulong target_addr)
4149 {
4150     struct target_msqid_ds *target_md;
4151 
4152     if (!lock_user_struct(VERIFY_READ, target_md, target_addr, 1))
4153         return -TARGET_EFAULT;
4154     if (target_to_host_ipc_perm(&(host_md->msg_perm),target_addr))
4155         return -TARGET_EFAULT;
4156     host_md->msg_stime = tswapal(target_md->msg_stime);
4157     host_md->msg_rtime = tswapal(target_md->msg_rtime);
4158     host_md->msg_ctime = tswapal(target_md->msg_ctime);
4159     host_md->__msg_cbytes = tswapal(target_md->__msg_cbytes);
4160     host_md->msg_qnum = tswapal(target_md->msg_qnum);
4161     host_md->msg_qbytes = tswapal(target_md->msg_qbytes);
4162     host_md->msg_lspid = tswapal(target_md->msg_lspid);
4163     host_md->msg_lrpid = tswapal(target_md->msg_lrpid);
4164     unlock_user_struct(target_md, target_addr, 0);
4165     return 0;
4166 }
4167 
4168 static inline abi_long host_to_target_msqid_ds(abi_ulong target_addr,
4169                                                struct msqid_ds *host_md)
4170 {
4171     struct target_msqid_ds *target_md;
4172 
4173     if (!lock_user_struct(VERIFY_WRITE, target_md, target_addr, 0))
4174         return -TARGET_EFAULT;
4175     if (host_to_target_ipc_perm(target_addr,&(host_md->msg_perm)))
4176         return -TARGET_EFAULT;
4177     target_md->msg_stime = tswapal(host_md->msg_stime);
4178     target_md->msg_rtime = tswapal(host_md->msg_rtime);
4179     target_md->msg_ctime = tswapal(host_md->msg_ctime);
4180     target_md->__msg_cbytes = tswapal(host_md->__msg_cbytes);
4181     target_md->msg_qnum = tswapal(host_md->msg_qnum);
4182     target_md->msg_qbytes = tswapal(host_md->msg_qbytes);
4183     target_md->msg_lspid = tswapal(host_md->msg_lspid);
4184     target_md->msg_lrpid = tswapal(host_md->msg_lrpid);
4185     unlock_user_struct(target_md, target_addr, 1);
4186     return 0;
4187 }
4188 
4189 struct target_msginfo {
4190     int msgpool;
4191     int msgmap;
4192     int msgmax;
4193     int msgmnb;
4194     int msgmni;
4195     int msgssz;
4196     int msgtql;
4197     unsigned short int msgseg;
4198 };
4199 
4200 static inline abi_long host_to_target_msginfo(abi_ulong target_addr,
4201                                               struct msginfo *host_msginfo)
4202 {
4203     struct target_msginfo *target_msginfo;
4204     if (!lock_user_struct(VERIFY_WRITE, target_msginfo, target_addr, 0))
4205         return -TARGET_EFAULT;
4206     __put_user(host_msginfo->msgpool, &target_msginfo->msgpool);
4207     __put_user(host_msginfo->msgmap, &target_msginfo->msgmap);
4208     __put_user(host_msginfo->msgmax, &target_msginfo->msgmax);
4209     __put_user(host_msginfo->msgmnb, &target_msginfo->msgmnb);
4210     __put_user(host_msginfo->msgmni, &target_msginfo->msgmni);
4211     __put_user(host_msginfo->msgssz, &target_msginfo->msgssz);
4212     __put_user(host_msginfo->msgtql, &target_msginfo->msgtql);
4213     __put_user(host_msginfo->msgseg, &target_msginfo->msgseg);
4214     unlock_user_struct(target_msginfo, target_addr, 1);
4215     return 0;
4216 }
4217 
4218 static inline abi_long do_msgctl(int msgid, int cmd, abi_long ptr)
4219 {
4220     struct msqid_ds dsarg;
4221     struct msginfo msginfo;
4222     abi_long ret = -TARGET_EINVAL;
4223 
4224     cmd &= 0xff;
4225 
4226     switch (cmd) {
4227     case IPC_STAT:
4228     case IPC_SET:
4229     case MSG_STAT:
4230         if (target_to_host_msqid_ds(&dsarg,ptr))
4231             return -TARGET_EFAULT;
4232         ret = get_errno(msgctl(msgid, cmd, &dsarg));
4233         if (host_to_target_msqid_ds(ptr,&dsarg))
4234             return -TARGET_EFAULT;
4235         break;
4236     case IPC_RMID:
4237         ret = get_errno(msgctl(msgid, cmd, NULL));
4238         break;
4239     case IPC_INFO:
4240     case MSG_INFO:
4241         ret = get_errno(msgctl(msgid, cmd, (struct msqid_ds *)&msginfo));
4242         if (host_to_target_msginfo(ptr, &msginfo))
4243             return -TARGET_EFAULT;
4244         break;
4245     }
4246 
4247     return ret;
4248 }
4249 
4250 struct target_msgbuf {
4251     abi_long mtype;
4252     char	mtext[1];
4253 };
4254 
4255 static inline abi_long do_msgsnd(int msqid, abi_long msgp,
4256                                  ssize_t msgsz, int msgflg)
4257 {
4258     struct target_msgbuf *target_mb;
4259     struct msgbuf *host_mb;
4260     abi_long ret = 0;
4261 
4262     if (msgsz < 0) {
4263         return -TARGET_EINVAL;
4264     }
4265 
4266     if (!lock_user_struct(VERIFY_READ, target_mb, msgp, 0))
4267         return -TARGET_EFAULT;
4268     host_mb = g_try_malloc(msgsz + sizeof(long));
4269     if (!host_mb) {
4270         unlock_user_struct(target_mb, msgp, 0);
4271         return -TARGET_ENOMEM;
4272     }
4273     host_mb->mtype = (abi_long) tswapal(target_mb->mtype);
4274     memcpy(host_mb->mtext, target_mb->mtext, msgsz);
4275     ret = -TARGET_ENOSYS;
4276 #ifdef __NR_msgsnd
4277     ret = get_errno(safe_msgsnd(msqid, host_mb, msgsz, msgflg));
4278 #endif
4279 #ifdef __NR_ipc
4280     if (ret == -TARGET_ENOSYS) {
4281 #ifdef __s390x__
4282         ret = get_errno(safe_ipc(IPCOP_msgsnd, msqid, msgsz, msgflg,
4283                                  host_mb));
4284 #else
4285         ret = get_errno(safe_ipc(IPCOP_msgsnd, msqid, msgsz, msgflg,
4286                                  host_mb, 0));
4287 #endif
4288     }
4289 #endif
4290     g_free(host_mb);
4291     unlock_user_struct(target_mb, msgp, 0);
4292 
4293     return ret;
4294 }
4295 
4296 #ifdef __NR_ipc
4297 #if defined(__sparc__)
4298 /* SPARC for msgrcv it does not use the kludge on final 2 arguments.  */
4299 #define MSGRCV_ARGS(__msgp, __msgtyp) __msgp, __msgtyp
4300 #elif defined(__s390x__)
4301 /* The s390 sys_ipc variant has only five parameters.  */
4302 #define MSGRCV_ARGS(__msgp, __msgtyp) \
4303     ((long int[]){(long int)__msgp, __msgtyp})
4304 #else
4305 #define MSGRCV_ARGS(__msgp, __msgtyp) \
4306     ((long int[]){(long int)__msgp, __msgtyp}), 0
4307 #endif
4308 #endif
4309 
4310 static inline abi_long do_msgrcv(int msqid, abi_long msgp,
4311                                  ssize_t msgsz, abi_long msgtyp,
4312                                  int msgflg)
4313 {
4314     struct target_msgbuf *target_mb;
4315     char *target_mtext;
4316     struct msgbuf *host_mb;
4317     abi_long ret = 0;
4318 
4319     if (msgsz < 0) {
4320         return -TARGET_EINVAL;
4321     }
4322 
4323     if (!lock_user_struct(VERIFY_WRITE, target_mb, msgp, 0))
4324         return -TARGET_EFAULT;
4325 
4326     host_mb = g_try_malloc(msgsz + sizeof(long));
4327     if (!host_mb) {
4328         ret = -TARGET_ENOMEM;
4329         goto end;
4330     }
4331     ret = -TARGET_ENOSYS;
4332 #ifdef __NR_msgrcv
4333     ret = get_errno(safe_msgrcv(msqid, host_mb, msgsz, msgtyp, msgflg));
4334 #endif
4335 #ifdef __NR_ipc
4336     if (ret == -TARGET_ENOSYS) {
4337         ret = get_errno(safe_ipc(IPCOP_CALL(1, IPCOP_msgrcv), msqid, msgsz,
4338                         msgflg, MSGRCV_ARGS(host_mb, msgtyp)));
4339     }
4340 #endif
4341 
4342     if (ret > 0) {
4343         abi_ulong target_mtext_addr = msgp + sizeof(abi_ulong);
4344         target_mtext = lock_user(VERIFY_WRITE, target_mtext_addr, ret, 0);
4345         if (!target_mtext) {
4346             ret = -TARGET_EFAULT;
4347             goto end;
4348         }
4349         memcpy(target_mb->mtext, host_mb->mtext, ret);
4350         unlock_user(target_mtext, target_mtext_addr, ret);
4351     }
4352 
4353     target_mb->mtype = tswapal(host_mb->mtype);
4354 
4355 end:
4356     if (target_mb)
4357         unlock_user_struct(target_mb, msgp, 1);
4358     g_free(host_mb);
4359     return ret;
4360 }
4361 
4362 static inline abi_long target_to_host_shmid_ds(struct shmid_ds *host_sd,
4363                                                abi_ulong target_addr)
4364 {
4365     struct target_shmid_ds *target_sd;
4366 
4367     if (!lock_user_struct(VERIFY_READ, target_sd, target_addr, 1))
4368         return -TARGET_EFAULT;
4369     if (target_to_host_ipc_perm(&(host_sd->shm_perm), target_addr))
4370         return -TARGET_EFAULT;
4371     __get_user(host_sd->shm_segsz, &target_sd->shm_segsz);
4372     __get_user(host_sd->shm_atime, &target_sd->shm_atime);
4373     __get_user(host_sd->shm_dtime, &target_sd->shm_dtime);
4374     __get_user(host_sd->shm_ctime, &target_sd->shm_ctime);
4375     __get_user(host_sd->shm_cpid, &target_sd->shm_cpid);
4376     __get_user(host_sd->shm_lpid, &target_sd->shm_lpid);
4377     __get_user(host_sd->shm_nattch, &target_sd->shm_nattch);
4378     unlock_user_struct(target_sd, target_addr, 0);
4379     return 0;
4380 }
4381 
4382 static inline abi_long host_to_target_shmid_ds(abi_ulong target_addr,
4383                                                struct shmid_ds *host_sd)
4384 {
4385     struct target_shmid_ds *target_sd;
4386 
4387     if (!lock_user_struct(VERIFY_WRITE, target_sd, target_addr, 0))
4388         return -TARGET_EFAULT;
4389     if (host_to_target_ipc_perm(target_addr, &(host_sd->shm_perm)))
4390         return -TARGET_EFAULT;
4391     __put_user(host_sd->shm_segsz, &target_sd->shm_segsz);
4392     __put_user(host_sd->shm_atime, &target_sd->shm_atime);
4393     __put_user(host_sd->shm_dtime, &target_sd->shm_dtime);
4394     __put_user(host_sd->shm_ctime, &target_sd->shm_ctime);
4395     __put_user(host_sd->shm_cpid, &target_sd->shm_cpid);
4396     __put_user(host_sd->shm_lpid, &target_sd->shm_lpid);
4397     __put_user(host_sd->shm_nattch, &target_sd->shm_nattch);
4398     unlock_user_struct(target_sd, target_addr, 1);
4399     return 0;
4400 }
4401 
4402 struct  target_shminfo {
4403     abi_ulong shmmax;
4404     abi_ulong shmmin;
4405     abi_ulong shmmni;
4406     abi_ulong shmseg;
4407     abi_ulong shmall;
4408 };
4409 
4410 static inline abi_long host_to_target_shminfo(abi_ulong target_addr,
4411                                               struct shminfo *host_shminfo)
4412 {
4413     struct target_shminfo *target_shminfo;
4414     if (!lock_user_struct(VERIFY_WRITE, target_shminfo, target_addr, 0))
4415         return -TARGET_EFAULT;
4416     __put_user(host_shminfo->shmmax, &target_shminfo->shmmax);
4417     __put_user(host_shminfo->shmmin, &target_shminfo->shmmin);
4418     __put_user(host_shminfo->shmmni, &target_shminfo->shmmni);
4419     __put_user(host_shminfo->shmseg, &target_shminfo->shmseg);
4420     __put_user(host_shminfo->shmall, &target_shminfo->shmall);
4421     unlock_user_struct(target_shminfo, target_addr, 1);
4422     return 0;
4423 }
4424 
4425 struct target_shm_info {
4426     int used_ids;
4427     abi_ulong shm_tot;
4428     abi_ulong shm_rss;
4429     abi_ulong shm_swp;
4430     abi_ulong swap_attempts;
4431     abi_ulong swap_successes;
4432 };
4433 
4434 static inline abi_long host_to_target_shm_info(abi_ulong target_addr,
4435                                                struct shm_info *host_shm_info)
4436 {
4437     struct target_shm_info *target_shm_info;
4438     if (!lock_user_struct(VERIFY_WRITE, target_shm_info, target_addr, 0))
4439         return -TARGET_EFAULT;
4440     __put_user(host_shm_info->used_ids, &target_shm_info->used_ids);
4441     __put_user(host_shm_info->shm_tot, &target_shm_info->shm_tot);
4442     __put_user(host_shm_info->shm_rss, &target_shm_info->shm_rss);
4443     __put_user(host_shm_info->shm_swp, &target_shm_info->shm_swp);
4444     __put_user(host_shm_info->swap_attempts, &target_shm_info->swap_attempts);
4445     __put_user(host_shm_info->swap_successes, &target_shm_info->swap_successes);
4446     unlock_user_struct(target_shm_info, target_addr, 1);
4447     return 0;
4448 }
4449 
4450 static inline abi_long do_shmctl(int shmid, int cmd, abi_long buf)
4451 {
4452     struct shmid_ds dsarg;
4453     struct shminfo shminfo;
4454     struct shm_info shm_info;
4455     abi_long ret = -TARGET_EINVAL;
4456 
4457     cmd &= 0xff;
4458 
4459     switch(cmd) {
4460     case IPC_STAT:
4461     case IPC_SET:
4462     case SHM_STAT:
4463         if (target_to_host_shmid_ds(&dsarg, buf))
4464             return -TARGET_EFAULT;
4465         ret = get_errno(shmctl(shmid, cmd, &dsarg));
4466         if (host_to_target_shmid_ds(buf, &dsarg))
4467             return -TARGET_EFAULT;
4468         break;
4469     case IPC_INFO:
4470         ret = get_errno(shmctl(shmid, cmd, (struct shmid_ds *)&shminfo));
4471         if (host_to_target_shminfo(buf, &shminfo))
4472             return -TARGET_EFAULT;
4473         break;
4474     case SHM_INFO:
4475         ret = get_errno(shmctl(shmid, cmd, (struct shmid_ds *)&shm_info));
4476         if (host_to_target_shm_info(buf, &shm_info))
4477             return -TARGET_EFAULT;
4478         break;
4479     case IPC_RMID:
4480     case SHM_LOCK:
4481     case SHM_UNLOCK:
4482         ret = get_errno(shmctl(shmid, cmd, NULL));
4483         break;
4484     }
4485 
4486     return ret;
4487 }
4488 
4489 #ifndef TARGET_FORCE_SHMLBA
4490 /* For most architectures, SHMLBA is the same as the page size;
4491  * some architectures have larger values, in which case they should
4492  * define TARGET_FORCE_SHMLBA and provide a target_shmlba() function.
4493  * This corresponds to the kernel arch code defining __ARCH_FORCE_SHMLBA
4494  * and defining its own value for SHMLBA.
4495  *
4496  * The kernel also permits SHMLBA to be set by the architecture to a
4497  * value larger than the page size without setting __ARCH_FORCE_SHMLBA;
4498  * this means that addresses are rounded to the large size if
4499  * SHM_RND is set but addresses not aligned to that size are not rejected
4500  * as long as they are at least page-aligned. Since the only architecture
4501  * which uses this is ia64 this code doesn't provide for that oddity.
4502  */
4503 static inline abi_ulong target_shmlba(CPUArchState *cpu_env)
4504 {
4505     return TARGET_PAGE_SIZE;
4506 }
4507 #endif
4508 
4509 static inline abi_ulong do_shmat(CPUArchState *cpu_env,
4510                                  int shmid, abi_ulong shmaddr, int shmflg)
4511 {
4512     CPUState *cpu = env_cpu(cpu_env);
4513     abi_long raddr;
4514     void *host_raddr;
4515     struct shmid_ds shm_info;
4516     int i,ret;
4517     abi_ulong shmlba;
4518 
4519     /* shmat pointers are always untagged */
4520 
4521     /* find out the length of the shared memory segment */
4522     ret = get_errno(shmctl(shmid, IPC_STAT, &shm_info));
4523     if (is_error(ret)) {
4524         /* can't get length, bail out */
4525         return ret;
4526     }
4527 
4528     shmlba = target_shmlba(cpu_env);
4529 
4530     if (shmaddr & (shmlba - 1)) {
4531         if (shmflg & SHM_RND) {
4532             shmaddr &= ~(shmlba - 1);
4533         } else {
4534             return -TARGET_EINVAL;
4535         }
4536     }
4537     if (!guest_range_valid_untagged(shmaddr, shm_info.shm_segsz)) {
4538         return -TARGET_EINVAL;
4539     }
4540 
4541     mmap_lock();
4542 
4543     /*
4544      * We're mapping shared memory, so ensure we generate code for parallel
4545      * execution and flush old translations.  This will work up to the level
4546      * supported by the host -- anything that requires EXCP_ATOMIC will not
4547      * be atomic with respect to an external process.
4548      */
4549     if (!(cpu->tcg_cflags & CF_PARALLEL)) {
4550         cpu->tcg_cflags |= CF_PARALLEL;
4551         tb_flush(cpu);
4552     }
4553 
4554     if (shmaddr)
4555         host_raddr = shmat(shmid, (void *)g2h_untagged(shmaddr), shmflg);
4556     else {
4557         abi_ulong mmap_start;
4558 
4559         /* In order to use the host shmat, we need to honor host SHMLBA.  */
4560         mmap_start = mmap_find_vma(0, shm_info.shm_segsz, MAX(SHMLBA, shmlba));
4561 
4562         if (mmap_start == -1) {
4563             errno = ENOMEM;
4564             host_raddr = (void *)-1;
4565         } else
4566             host_raddr = shmat(shmid, g2h_untagged(mmap_start),
4567                                shmflg | SHM_REMAP);
4568     }
4569 
4570     if (host_raddr == (void *)-1) {
4571         mmap_unlock();
4572         return get_errno((long)host_raddr);
4573     }
4574     raddr=h2g((unsigned long)host_raddr);
4575 
4576     page_set_flags(raddr, raddr + shm_info.shm_segsz,
4577                    PAGE_VALID | PAGE_RESET | PAGE_READ |
4578                    (shmflg & SHM_RDONLY ? 0 : PAGE_WRITE));
4579 
4580     for (i = 0; i < N_SHM_REGIONS; i++) {
4581         if (!shm_regions[i].in_use) {
4582             shm_regions[i].in_use = true;
4583             shm_regions[i].start = raddr;
4584             shm_regions[i].size = shm_info.shm_segsz;
4585             break;
4586         }
4587     }
4588 
4589     mmap_unlock();
4590     return raddr;
4591 
4592 }
4593 
4594 static inline abi_long do_shmdt(abi_ulong shmaddr)
4595 {
4596     int i;
4597     abi_long rv;
4598 
4599     /* shmdt pointers are always untagged */
4600 
4601     mmap_lock();
4602 
4603     for (i = 0; i < N_SHM_REGIONS; ++i) {
4604         if (shm_regions[i].in_use && shm_regions[i].start == shmaddr) {
4605             shm_regions[i].in_use = false;
4606             page_set_flags(shmaddr, shmaddr + shm_regions[i].size, 0);
4607             break;
4608         }
4609     }
4610     rv = get_errno(shmdt(g2h_untagged(shmaddr)));
4611 
4612     mmap_unlock();
4613 
4614     return rv;
4615 }
4616 
4617 #ifdef TARGET_NR_ipc
4618 /* ??? This only works with linear mappings.  */
4619 /* do_ipc() must return target values and target errnos. */
4620 static abi_long do_ipc(CPUArchState *cpu_env,
4621                        unsigned int call, abi_long first,
4622                        abi_long second, abi_long third,
4623                        abi_long ptr, abi_long fifth)
4624 {
4625     int version;
4626     abi_long ret = 0;
4627 
4628     version = call >> 16;
4629     call &= 0xffff;
4630 
4631     switch (call) {
4632     case IPCOP_semop:
4633         ret = do_semtimedop(first, ptr, second, 0, false);
4634         break;
4635     case IPCOP_semtimedop:
4636     /*
4637      * The s390 sys_ipc variant has only five parameters instead of six
4638      * (as for default variant) and the only difference is the handling of
4639      * SEMTIMEDOP where on s390 the third parameter is used as a pointer
4640      * to a struct timespec where the generic variant uses fifth parameter.
4641      */
4642 #if defined(TARGET_S390X)
4643         ret = do_semtimedop(first, ptr, second, third, TARGET_ABI_BITS == 64);
4644 #else
4645         ret = do_semtimedop(first, ptr, second, fifth, TARGET_ABI_BITS == 64);
4646 #endif
4647         break;
4648 
4649     case IPCOP_semget:
4650         ret = get_errno(semget(first, second, third));
4651         break;
4652 
4653     case IPCOP_semctl: {
4654         /* The semun argument to semctl is passed by value, so dereference the
4655          * ptr argument. */
4656         abi_ulong atptr;
4657         get_user_ual(atptr, ptr);
4658         ret = do_semctl(first, second, third, atptr);
4659         break;
4660     }
4661 
4662     case IPCOP_msgget:
4663         ret = get_errno(msgget(first, second));
4664         break;
4665 
4666     case IPCOP_msgsnd:
4667         ret = do_msgsnd(first, ptr, second, third);
4668         break;
4669 
4670     case IPCOP_msgctl:
4671         ret = do_msgctl(first, second, ptr);
4672         break;
4673 
4674     case IPCOP_msgrcv:
4675         switch (version) {
4676         case 0:
4677             {
4678                 struct target_ipc_kludge {
4679                     abi_long msgp;
4680                     abi_long msgtyp;
4681                 } *tmp;
4682 
4683                 if (!lock_user_struct(VERIFY_READ, tmp, ptr, 1)) {
4684                     ret = -TARGET_EFAULT;
4685                     break;
4686                 }
4687 
4688                 ret = do_msgrcv(first, tswapal(tmp->msgp), second, tswapal(tmp->msgtyp), third);
4689 
4690                 unlock_user_struct(tmp, ptr, 0);
4691                 break;
4692             }
4693         default:
4694             ret = do_msgrcv(first, ptr, second, fifth, third);
4695         }
4696         break;
4697 
4698     case IPCOP_shmat:
4699         switch (version) {
4700         default:
4701         {
4702             abi_ulong raddr;
4703             raddr = do_shmat(cpu_env, first, ptr, second);
4704             if (is_error(raddr))
4705                 return get_errno(raddr);
4706             if (put_user_ual(raddr, third))
4707                 return -TARGET_EFAULT;
4708             break;
4709         }
4710         case 1:
4711             ret = -TARGET_EINVAL;
4712             break;
4713         }
4714 	break;
4715     case IPCOP_shmdt:
4716         ret = do_shmdt(ptr);
4717 	break;
4718 
4719     case IPCOP_shmget:
4720 	/* IPC_* flag values are the same on all linux platforms */
4721 	ret = get_errno(shmget(first, second, third));
4722 	break;
4723 
4724 	/* IPC_* and SHM_* command values are the same on all linux platforms */
4725     case IPCOP_shmctl:
4726         ret = do_shmctl(first, second, ptr);
4727         break;
4728     default:
4729         qemu_log_mask(LOG_UNIMP, "Unsupported ipc call: %d (version %d)\n",
4730                       call, version);
4731 	ret = -TARGET_ENOSYS;
4732 	break;
4733     }
4734     return ret;
4735 }
4736 #endif
4737 
4738 /* kernel structure types definitions */
4739 
4740 #define STRUCT(name, ...) STRUCT_ ## name,
4741 #define STRUCT_SPECIAL(name) STRUCT_ ## name,
4742 enum {
4743 #include "syscall_types.h"
4744 STRUCT_MAX
4745 };
4746 #undef STRUCT
4747 #undef STRUCT_SPECIAL
4748 
4749 #define STRUCT(name, ...) static const argtype struct_ ## name ## _def[] = {  __VA_ARGS__, TYPE_NULL };
4750 #define STRUCT_SPECIAL(name)
4751 #include "syscall_types.h"
4752 #undef STRUCT
4753 #undef STRUCT_SPECIAL
4754 
4755 #define MAX_STRUCT_SIZE 4096
4756 
4757 #ifdef CONFIG_FIEMAP
4758 /* So fiemap access checks don't overflow on 32 bit systems.
4759  * This is very slightly smaller than the limit imposed by
4760  * the underlying kernel.
4761  */
4762 #define FIEMAP_MAX_EXTENTS ((UINT_MAX - sizeof(struct fiemap))  \
4763                             / sizeof(struct fiemap_extent))
4764 
4765 static abi_long do_ioctl_fs_ioc_fiemap(const IOCTLEntry *ie, uint8_t *buf_temp,
4766                                        int fd, int cmd, abi_long arg)
4767 {
4768     /* The parameter for this ioctl is a struct fiemap followed
4769      * by an array of struct fiemap_extent whose size is set
4770      * in fiemap->fm_extent_count. The array is filled in by the
4771      * ioctl.
4772      */
4773     int target_size_in, target_size_out;
4774     struct fiemap *fm;
4775     const argtype *arg_type = ie->arg_type;
4776     const argtype extent_arg_type[] = { MK_STRUCT(STRUCT_fiemap_extent) };
4777     void *argptr, *p;
4778     abi_long ret;
4779     int i, extent_size = thunk_type_size(extent_arg_type, 0);
4780     uint32_t outbufsz;
4781     int free_fm = 0;
4782 
4783     assert(arg_type[0] == TYPE_PTR);
4784     assert(ie->access == IOC_RW);
4785     arg_type++;
4786     target_size_in = thunk_type_size(arg_type, 0);
4787     argptr = lock_user(VERIFY_READ, arg, target_size_in, 1);
4788     if (!argptr) {
4789         return -TARGET_EFAULT;
4790     }
4791     thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
4792     unlock_user(argptr, arg, 0);
4793     fm = (struct fiemap *)buf_temp;
4794     if (fm->fm_extent_count > FIEMAP_MAX_EXTENTS) {
4795         return -TARGET_EINVAL;
4796     }
4797 
4798     outbufsz = sizeof (*fm) +
4799         (sizeof(struct fiemap_extent) * fm->fm_extent_count);
4800 
4801     if (outbufsz > MAX_STRUCT_SIZE) {
4802         /* We can't fit all the extents into the fixed size buffer.
4803          * Allocate one that is large enough and use it instead.
4804          */
4805         fm = g_try_malloc(outbufsz);
4806         if (!fm) {
4807             return -TARGET_ENOMEM;
4808         }
4809         memcpy(fm, buf_temp, sizeof(struct fiemap));
4810         free_fm = 1;
4811     }
4812     ret = get_errno(safe_ioctl(fd, ie->host_cmd, fm));
4813     if (!is_error(ret)) {
4814         target_size_out = target_size_in;
4815         /* An extent_count of 0 means we were only counting the extents
4816          * so there are no structs to copy
4817          */
4818         if (fm->fm_extent_count != 0) {
4819             target_size_out += fm->fm_mapped_extents * extent_size;
4820         }
4821         argptr = lock_user(VERIFY_WRITE, arg, target_size_out, 0);
4822         if (!argptr) {
4823             ret = -TARGET_EFAULT;
4824         } else {
4825             /* Convert the struct fiemap */
4826             thunk_convert(argptr, fm, arg_type, THUNK_TARGET);
4827             if (fm->fm_extent_count != 0) {
4828                 p = argptr + target_size_in;
4829                 /* ...and then all the struct fiemap_extents */
4830                 for (i = 0; i < fm->fm_mapped_extents; i++) {
4831                     thunk_convert(p, &fm->fm_extents[i], extent_arg_type,
4832                                   THUNK_TARGET);
4833                     p += extent_size;
4834                 }
4835             }
4836             unlock_user(argptr, arg, target_size_out);
4837         }
4838     }
4839     if (free_fm) {
4840         g_free(fm);
4841     }
4842     return ret;
4843 }
4844 #endif
4845 
4846 static abi_long do_ioctl_ifconf(const IOCTLEntry *ie, uint8_t *buf_temp,
4847                                 int fd, int cmd, abi_long arg)
4848 {
4849     const argtype *arg_type = ie->arg_type;
4850     int target_size;
4851     void *argptr;
4852     int ret;
4853     struct ifconf *host_ifconf;
4854     uint32_t outbufsz;
4855     const argtype ifreq_arg_type[] = { MK_STRUCT(STRUCT_sockaddr_ifreq) };
4856     const argtype ifreq_max_type[] = { MK_STRUCT(STRUCT_ifmap_ifreq) };
4857     int target_ifreq_size;
4858     int nb_ifreq;
4859     int free_buf = 0;
4860     int i;
4861     int target_ifc_len;
4862     abi_long target_ifc_buf;
4863     int host_ifc_len;
4864     char *host_ifc_buf;
4865 
4866     assert(arg_type[0] == TYPE_PTR);
4867     assert(ie->access == IOC_RW);
4868 
4869     arg_type++;
4870     target_size = thunk_type_size(arg_type, 0);
4871 
4872     argptr = lock_user(VERIFY_READ, arg, target_size, 1);
4873     if (!argptr)
4874         return -TARGET_EFAULT;
4875     thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
4876     unlock_user(argptr, arg, 0);
4877 
4878     host_ifconf = (struct ifconf *)(unsigned long)buf_temp;
4879     target_ifc_buf = (abi_long)(unsigned long)host_ifconf->ifc_buf;
4880     target_ifreq_size = thunk_type_size(ifreq_max_type, 0);
4881 
4882     if (target_ifc_buf != 0) {
4883         target_ifc_len = host_ifconf->ifc_len;
4884         nb_ifreq = target_ifc_len / target_ifreq_size;
4885         host_ifc_len = nb_ifreq * sizeof(struct ifreq);
4886 
4887         outbufsz = sizeof(*host_ifconf) + host_ifc_len;
4888         if (outbufsz > MAX_STRUCT_SIZE) {
4889             /*
4890              * We can't fit all the extents into the fixed size buffer.
4891              * Allocate one that is large enough and use it instead.
4892              */
4893             host_ifconf = g_try_malloc(outbufsz);
4894             if (!host_ifconf) {
4895                 return -TARGET_ENOMEM;
4896             }
4897             memcpy(host_ifconf, buf_temp, sizeof(*host_ifconf));
4898             free_buf = 1;
4899         }
4900         host_ifc_buf = (char *)host_ifconf + sizeof(*host_ifconf);
4901 
4902         host_ifconf->ifc_len = host_ifc_len;
4903     } else {
4904       host_ifc_buf = NULL;
4905     }
4906     host_ifconf->ifc_buf = host_ifc_buf;
4907 
4908     ret = get_errno(safe_ioctl(fd, ie->host_cmd, host_ifconf));
4909     if (!is_error(ret)) {
4910 	/* convert host ifc_len to target ifc_len */
4911 
4912         nb_ifreq = host_ifconf->ifc_len / sizeof(struct ifreq);
4913         target_ifc_len = nb_ifreq * target_ifreq_size;
4914         host_ifconf->ifc_len = target_ifc_len;
4915 
4916 	/* restore target ifc_buf */
4917 
4918         host_ifconf->ifc_buf = (char *)(unsigned long)target_ifc_buf;
4919 
4920 	/* copy struct ifconf to target user */
4921 
4922         argptr = lock_user(VERIFY_WRITE, arg, target_size, 0);
4923         if (!argptr)
4924             return -TARGET_EFAULT;
4925         thunk_convert(argptr, host_ifconf, arg_type, THUNK_TARGET);
4926         unlock_user(argptr, arg, target_size);
4927 
4928         if (target_ifc_buf != 0) {
4929             /* copy ifreq[] to target user */
4930             argptr = lock_user(VERIFY_WRITE, target_ifc_buf, target_ifc_len, 0);
4931             for (i = 0; i < nb_ifreq ; i++) {
4932                 thunk_convert(argptr + i * target_ifreq_size,
4933                               host_ifc_buf + i * sizeof(struct ifreq),
4934                               ifreq_arg_type, THUNK_TARGET);
4935             }
4936             unlock_user(argptr, target_ifc_buf, target_ifc_len);
4937         }
4938     }
4939 
4940     if (free_buf) {
4941         g_free(host_ifconf);
4942     }
4943 
4944     return ret;
4945 }
4946 
4947 #if defined(CONFIG_USBFS)
4948 #if HOST_LONG_BITS > 64
4949 #error USBDEVFS thunks do not support >64 bit hosts yet.
4950 #endif
4951 struct live_urb {
4952     uint64_t target_urb_adr;
4953     uint64_t target_buf_adr;
4954     char *target_buf_ptr;
4955     struct usbdevfs_urb host_urb;
4956 };
4957 
4958 static GHashTable *usbdevfs_urb_hashtable(void)
4959 {
4960     static GHashTable *urb_hashtable;
4961 
4962     if (!urb_hashtable) {
4963         urb_hashtable = g_hash_table_new(g_int64_hash, g_int64_equal);
4964     }
4965     return urb_hashtable;
4966 }
4967 
4968 static void urb_hashtable_insert(struct live_urb *urb)
4969 {
4970     GHashTable *urb_hashtable = usbdevfs_urb_hashtable();
4971     g_hash_table_insert(urb_hashtable, urb, urb);
4972 }
4973 
4974 static struct live_urb *urb_hashtable_lookup(uint64_t target_urb_adr)
4975 {
4976     GHashTable *urb_hashtable = usbdevfs_urb_hashtable();
4977     return g_hash_table_lookup(urb_hashtable, &target_urb_adr);
4978 }
4979 
4980 static void urb_hashtable_remove(struct live_urb *urb)
4981 {
4982     GHashTable *urb_hashtable = usbdevfs_urb_hashtable();
4983     g_hash_table_remove(urb_hashtable, urb);
4984 }
4985 
4986 static abi_long
4987 do_ioctl_usbdevfs_reapurb(const IOCTLEntry *ie, uint8_t *buf_temp,
4988                           int fd, int cmd, abi_long arg)
4989 {
4990     const argtype usbfsurb_arg_type[] = { MK_STRUCT(STRUCT_usbdevfs_urb) };
4991     const argtype ptrvoid_arg_type[] = { TYPE_PTRVOID, 0, 0 };
4992     struct live_urb *lurb;
4993     void *argptr;
4994     uint64_t hurb;
4995     int target_size;
4996     uintptr_t target_urb_adr;
4997     abi_long ret;
4998 
4999     target_size = thunk_type_size(usbfsurb_arg_type, THUNK_TARGET);
5000 
5001     memset(buf_temp, 0, sizeof(uint64_t));
5002     ret = get_errno(safe_ioctl(fd, ie->host_cmd, buf_temp));
5003     if (is_error(ret)) {
5004         return ret;
5005     }
5006 
5007     memcpy(&hurb, buf_temp, sizeof(uint64_t));
5008     lurb = (void *)((uintptr_t)hurb - offsetof(struct live_urb, host_urb));
5009     if (!lurb->target_urb_adr) {
5010         return -TARGET_EFAULT;
5011     }
5012     urb_hashtable_remove(lurb);
5013     unlock_user(lurb->target_buf_ptr, lurb->target_buf_adr,
5014         lurb->host_urb.buffer_length);
5015     lurb->target_buf_ptr = NULL;
5016 
5017     /* restore the guest buffer pointer */
5018     lurb->host_urb.buffer = (void *)(uintptr_t)lurb->target_buf_adr;
5019 
5020     /* update the guest urb struct */
5021     argptr = lock_user(VERIFY_WRITE, lurb->target_urb_adr, target_size, 0);
5022     if (!argptr) {
5023         g_free(lurb);
5024         return -TARGET_EFAULT;
5025     }
5026     thunk_convert(argptr, &lurb->host_urb, usbfsurb_arg_type, THUNK_TARGET);
5027     unlock_user(argptr, lurb->target_urb_adr, target_size);
5028 
5029     target_size = thunk_type_size(ptrvoid_arg_type, THUNK_TARGET);
5030     /* write back the urb handle */
5031     argptr = lock_user(VERIFY_WRITE, arg, target_size, 0);
5032     if (!argptr) {
5033         g_free(lurb);
5034         return -TARGET_EFAULT;
5035     }
5036 
5037     /* GHashTable uses 64-bit keys but thunk_convert expects uintptr_t */
5038     target_urb_adr = lurb->target_urb_adr;
5039     thunk_convert(argptr, &target_urb_adr, ptrvoid_arg_type, THUNK_TARGET);
5040     unlock_user(argptr, arg, target_size);
5041 
5042     g_free(lurb);
5043     return ret;
5044 }
5045 
5046 static abi_long
5047 do_ioctl_usbdevfs_discardurb(const IOCTLEntry *ie,
5048                              uint8_t *buf_temp __attribute__((unused)),
5049                              int fd, int cmd, abi_long arg)
5050 {
5051     struct live_urb *lurb;
5052 
5053     /* map target address back to host URB with metadata. */
5054     lurb = urb_hashtable_lookup(arg);
5055     if (!lurb) {
5056         return -TARGET_EFAULT;
5057     }
5058     return get_errno(safe_ioctl(fd, ie->host_cmd, &lurb->host_urb));
5059 }
5060 
5061 static abi_long
5062 do_ioctl_usbdevfs_submiturb(const IOCTLEntry *ie, uint8_t *buf_temp,
5063                             int fd, int cmd, abi_long arg)
5064 {
5065     const argtype *arg_type = ie->arg_type;
5066     int target_size;
5067     abi_long ret;
5068     void *argptr;
5069     int rw_dir;
5070     struct live_urb *lurb;
5071 
5072     /*
5073      * each submitted URB needs to map to a unique ID for the
5074      * kernel, and that unique ID needs to be a pointer to
5075      * host memory.  hence, we need to malloc for each URB.
5076      * isochronous transfers have a variable length struct.
5077      */
5078     arg_type++;
5079     target_size = thunk_type_size(arg_type, THUNK_TARGET);
5080 
5081     /* construct host copy of urb and metadata */
5082     lurb = g_try_new0(struct live_urb, 1);
5083     if (!lurb) {
5084         return -TARGET_ENOMEM;
5085     }
5086 
5087     argptr = lock_user(VERIFY_READ, arg, target_size, 1);
5088     if (!argptr) {
5089         g_free(lurb);
5090         return -TARGET_EFAULT;
5091     }
5092     thunk_convert(&lurb->host_urb, argptr, arg_type, THUNK_HOST);
5093     unlock_user(argptr, arg, 0);
5094 
5095     lurb->target_urb_adr = arg;
5096     lurb->target_buf_adr = (uintptr_t)lurb->host_urb.buffer;
5097 
5098     /* buffer space used depends on endpoint type so lock the entire buffer */
5099     /* control type urbs should check the buffer contents for true direction */
5100     rw_dir = lurb->host_urb.endpoint & USB_DIR_IN ? VERIFY_WRITE : VERIFY_READ;
5101     lurb->target_buf_ptr = lock_user(rw_dir, lurb->target_buf_adr,
5102         lurb->host_urb.buffer_length, 1);
5103     if (lurb->target_buf_ptr == NULL) {
5104         g_free(lurb);
5105         return -TARGET_EFAULT;
5106     }
5107 
5108     /* update buffer pointer in host copy */
5109     lurb->host_urb.buffer = lurb->target_buf_ptr;
5110 
5111     ret = get_errno(safe_ioctl(fd, ie->host_cmd, &lurb->host_urb));
5112     if (is_error(ret)) {
5113         unlock_user(lurb->target_buf_ptr, lurb->target_buf_adr, 0);
5114         g_free(lurb);
5115     } else {
5116         urb_hashtable_insert(lurb);
5117     }
5118 
5119     return ret;
5120 }
5121 #endif /* CONFIG_USBFS */
5122 
5123 static abi_long do_ioctl_dm(const IOCTLEntry *ie, uint8_t *buf_temp, int fd,
5124                             int cmd, abi_long arg)
5125 {
5126     void *argptr;
5127     struct dm_ioctl *host_dm;
5128     abi_long guest_data;
5129     uint32_t guest_data_size;
5130     int target_size;
5131     const argtype *arg_type = ie->arg_type;
5132     abi_long ret;
5133     void *big_buf = NULL;
5134     char *host_data;
5135 
5136     arg_type++;
5137     target_size = thunk_type_size(arg_type, 0);
5138     argptr = lock_user(VERIFY_READ, arg, target_size, 1);
5139     if (!argptr) {
5140         ret = -TARGET_EFAULT;
5141         goto out;
5142     }
5143     thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
5144     unlock_user(argptr, arg, 0);
5145 
5146     /* buf_temp is too small, so fetch things into a bigger buffer */
5147     big_buf = g_malloc0(((struct dm_ioctl*)buf_temp)->data_size * 2);
5148     memcpy(big_buf, buf_temp, target_size);
5149     buf_temp = big_buf;
5150     host_dm = big_buf;
5151 
5152     guest_data = arg + host_dm->data_start;
5153     if ((guest_data - arg) < 0) {
5154         ret = -TARGET_EINVAL;
5155         goto out;
5156     }
5157     guest_data_size = host_dm->data_size - host_dm->data_start;
5158     host_data = (char*)host_dm + host_dm->data_start;
5159 
5160     argptr = lock_user(VERIFY_READ, guest_data, guest_data_size, 1);
5161     if (!argptr) {
5162         ret = -TARGET_EFAULT;
5163         goto out;
5164     }
5165 
5166     switch (ie->host_cmd) {
5167     case DM_REMOVE_ALL:
5168     case DM_LIST_DEVICES:
5169     case DM_DEV_CREATE:
5170     case DM_DEV_REMOVE:
5171     case DM_DEV_SUSPEND:
5172     case DM_DEV_STATUS:
5173     case DM_DEV_WAIT:
5174     case DM_TABLE_STATUS:
5175     case DM_TABLE_CLEAR:
5176     case DM_TABLE_DEPS:
5177     case DM_LIST_VERSIONS:
5178         /* no input data */
5179         break;
5180     case DM_DEV_RENAME:
5181     case DM_DEV_SET_GEOMETRY:
5182         /* data contains only strings */
5183         memcpy(host_data, argptr, guest_data_size);
5184         break;
5185     case DM_TARGET_MSG:
5186         memcpy(host_data, argptr, guest_data_size);
5187         *(uint64_t*)host_data = tswap64(*(uint64_t*)argptr);
5188         break;
5189     case DM_TABLE_LOAD:
5190     {
5191         void *gspec = argptr;
5192         void *cur_data = host_data;
5193         const argtype arg_type[] = { MK_STRUCT(STRUCT_dm_target_spec) };
5194         int spec_size = thunk_type_size(arg_type, 0);
5195         int i;
5196 
5197         for (i = 0; i < host_dm->target_count; i++) {
5198             struct dm_target_spec *spec = cur_data;
5199             uint32_t next;
5200             int slen;
5201 
5202             thunk_convert(spec, gspec, arg_type, THUNK_HOST);
5203             slen = strlen((char*)gspec + spec_size) + 1;
5204             next = spec->next;
5205             spec->next = sizeof(*spec) + slen;
5206             strcpy((char*)&spec[1], gspec + spec_size);
5207             gspec += next;
5208             cur_data += spec->next;
5209         }
5210         break;
5211     }
5212     default:
5213         ret = -TARGET_EINVAL;
5214         unlock_user(argptr, guest_data, 0);
5215         goto out;
5216     }
5217     unlock_user(argptr, guest_data, 0);
5218 
5219     ret = get_errno(safe_ioctl(fd, ie->host_cmd, buf_temp));
5220     if (!is_error(ret)) {
5221         guest_data = arg + host_dm->data_start;
5222         guest_data_size = host_dm->data_size - host_dm->data_start;
5223         argptr = lock_user(VERIFY_WRITE, guest_data, guest_data_size, 0);
5224         switch (ie->host_cmd) {
5225         case DM_REMOVE_ALL:
5226         case DM_DEV_CREATE:
5227         case DM_DEV_REMOVE:
5228         case DM_DEV_RENAME:
5229         case DM_DEV_SUSPEND:
5230         case DM_DEV_STATUS:
5231         case DM_TABLE_LOAD:
5232         case DM_TABLE_CLEAR:
5233         case DM_TARGET_MSG:
5234         case DM_DEV_SET_GEOMETRY:
5235             /* no return data */
5236             break;
5237         case DM_LIST_DEVICES:
5238         {
5239             struct dm_name_list *nl = (void*)host_dm + host_dm->data_start;
5240             uint32_t remaining_data = guest_data_size;
5241             void *cur_data = argptr;
5242             const argtype arg_type[] = { MK_STRUCT(STRUCT_dm_name_list) };
5243             int nl_size = 12; /* can't use thunk_size due to alignment */
5244 
5245             while (1) {
5246                 uint32_t next = nl->next;
5247                 if (next) {
5248                     nl->next = nl_size + (strlen(nl->name) + 1);
5249                 }
5250                 if (remaining_data < nl->next) {
5251                     host_dm->flags |= DM_BUFFER_FULL_FLAG;
5252                     break;
5253                 }
5254                 thunk_convert(cur_data, nl, arg_type, THUNK_TARGET);
5255                 strcpy(cur_data + nl_size, nl->name);
5256                 cur_data += nl->next;
5257                 remaining_data -= nl->next;
5258                 if (!next) {
5259                     break;
5260                 }
5261                 nl = (void*)nl + next;
5262             }
5263             break;
5264         }
5265         case DM_DEV_WAIT:
5266         case DM_TABLE_STATUS:
5267         {
5268             struct dm_target_spec *spec = (void*)host_dm + host_dm->data_start;
5269             void *cur_data = argptr;
5270             const argtype arg_type[] = { MK_STRUCT(STRUCT_dm_target_spec) };
5271             int spec_size = thunk_type_size(arg_type, 0);
5272             int i;
5273 
5274             for (i = 0; i < host_dm->target_count; i++) {
5275                 uint32_t next = spec->next;
5276                 int slen = strlen((char*)&spec[1]) + 1;
5277                 spec->next = (cur_data - argptr) + spec_size + slen;
5278                 if (guest_data_size < spec->next) {
5279                     host_dm->flags |= DM_BUFFER_FULL_FLAG;
5280                     break;
5281                 }
5282                 thunk_convert(cur_data, spec, arg_type, THUNK_TARGET);
5283                 strcpy(cur_data + spec_size, (char*)&spec[1]);
5284                 cur_data = argptr + spec->next;
5285                 spec = (void*)host_dm + host_dm->data_start + next;
5286             }
5287             break;
5288         }
5289         case DM_TABLE_DEPS:
5290         {
5291             void *hdata = (void*)host_dm + host_dm->data_start;
5292             int count = *(uint32_t*)hdata;
5293             uint64_t *hdev = hdata + 8;
5294             uint64_t *gdev = argptr + 8;
5295             int i;
5296 
5297             *(uint32_t*)argptr = tswap32(count);
5298             for (i = 0; i < count; i++) {
5299                 *gdev = tswap64(*hdev);
5300                 gdev++;
5301                 hdev++;
5302             }
5303             break;
5304         }
5305         case DM_LIST_VERSIONS:
5306         {
5307             struct dm_target_versions *vers = (void*)host_dm + host_dm->data_start;
5308             uint32_t remaining_data = guest_data_size;
5309             void *cur_data = argptr;
5310             const argtype arg_type[] = { MK_STRUCT(STRUCT_dm_target_versions) };
5311             int vers_size = thunk_type_size(arg_type, 0);
5312 
5313             while (1) {
5314                 uint32_t next = vers->next;
5315                 if (next) {
5316                     vers->next = vers_size + (strlen(vers->name) + 1);
5317                 }
5318                 if (remaining_data < vers->next) {
5319                     host_dm->flags |= DM_BUFFER_FULL_FLAG;
5320                     break;
5321                 }
5322                 thunk_convert(cur_data, vers, arg_type, THUNK_TARGET);
5323                 strcpy(cur_data + vers_size, vers->name);
5324                 cur_data += vers->next;
5325                 remaining_data -= vers->next;
5326                 if (!next) {
5327                     break;
5328                 }
5329                 vers = (void*)vers + next;
5330             }
5331             break;
5332         }
5333         default:
5334             unlock_user(argptr, guest_data, 0);
5335             ret = -TARGET_EINVAL;
5336             goto out;
5337         }
5338         unlock_user(argptr, guest_data, guest_data_size);
5339 
5340         argptr = lock_user(VERIFY_WRITE, arg, target_size, 0);
5341         if (!argptr) {
5342             ret = -TARGET_EFAULT;
5343             goto out;
5344         }
5345         thunk_convert(argptr, buf_temp, arg_type, THUNK_TARGET);
5346         unlock_user(argptr, arg, target_size);
5347     }
5348 out:
5349     g_free(big_buf);
5350     return ret;
5351 }
5352 
5353 static abi_long do_ioctl_blkpg(const IOCTLEntry *ie, uint8_t *buf_temp, int fd,
5354                                int cmd, abi_long arg)
5355 {
5356     void *argptr;
5357     int target_size;
5358     const argtype *arg_type = ie->arg_type;
5359     const argtype part_arg_type[] = { MK_STRUCT(STRUCT_blkpg_partition) };
5360     abi_long ret;
5361 
5362     struct blkpg_ioctl_arg *host_blkpg = (void*)buf_temp;
5363     struct blkpg_partition host_part;
5364 
5365     /* Read and convert blkpg */
5366     arg_type++;
5367     target_size = thunk_type_size(arg_type, 0);
5368     argptr = lock_user(VERIFY_READ, arg, target_size, 1);
5369     if (!argptr) {
5370         ret = -TARGET_EFAULT;
5371         goto out;
5372     }
5373     thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
5374     unlock_user(argptr, arg, 0);
5375 
5376     switch (host_blkpg->op) {
5377     case BLKPG_ADD_PARTITION:
5378     case BLKPG_DEL_PARTITION:
5379         /* payload is struct blkpg_partition */
5380         break;
5381     default:
5382         /* Unknown opcode */
5383         ret = -TARGET_EINVAL;
5384         goto out;
5385     }
5386 
5387     /* Read and convert blkpg->data */
5388     arg = (abi_long)(uintptr_t)host_blkpg->data;
5389     target_size = thunk_type_size(part_arg_type, 0);
5390     argptr = lock_user(VERIFY_READ, arg, target_size, 1);
5391     if (!argptr) {
5392         ret = -TARGET_EFAULT;
5393         goto out;
5394     }
5395     thunk_convert(&host_part, argptr, part_arg_type, THUNK_HOST);
5396     unlock_user(argptr, arg, 0);
5397 
5398     /* Swizzle the data pointer to our local copy and call! */
5399     host_blkpg->data = &host_part;
5400     ret = get_errno(safe_ioctl(fd, ie->host_cmd, host_blkpg));
5401 
5402 out:
5403     return ret;
5404 }
5405 
5406 static abi_long do_ioctl_rt(const IOCTLEntry *ie, uint8_t *buf_temp,
5407                                 int fd, int cmd, abi_long arg)
5408 {
5409     const argtype *arg_type = ie->arg_type;
5410     const StructEntry *se;
5411     const argtype *field_types;
5412     const int *dst_offsets, *src_offsets;
5413     int target_size;
5414     void *argptr;
5415     abi_ulong *target_rt_dev_ptr = NULL;
5416     unsigned long *host_rt_dev_ptr = NULL;
5417     abi_long ret;
5418     int i;
5419 
5420     assert(ie->access == IOC_W);
5421     assert(*arg_type == TYPE_PTR);
5422     arg_type++;
5423     assert(*arg_type == TYPE_STRUCT);
5424     target_size = thunk_type_size(arg_type, 0);
5425     argptr = lock_user(VERIFY_READ, arg, target_size, 1);
5426     if (!argptr) {
5427         return -TARGET_EFAULT;
5428     }
5429     arg_type++;
5430     assert(*arg_type == (int)STRUCT_rtentry);
5431     se = struct_entries + *arg_type++;
5432     assert(se->convert[0] == NULL);
5433     /* convert struct here to be able to catch rt_dev string */
5434     field_types = se->field_types;
5435     dst_offsets = se->field_offsets[THUNK_HOST];
5436     src_offsets = se->field_offsets[THUNK_TARGET];
5437     for (i = 0; i < se->nb_fields; i++) {
5438         if (dst_offsets[i] == offsetof(struct rtentry, rt_dev)) {
5439             assert(*field_types == TYPE_PTRVOID);
5440             target_rt_dev_ptr = (abi_ulong *)(argptr + src_offsets[i]);
5441             host_rt_dev_ptr = (unsigned long *)(buf_temp + dst_offsets[i]);
5442             if (*target_rt_dev_ptr != 0) {
5443                 *host_rt_dev_ptr = (unsigned long)lock_user_string(
5444                                                   tswapal(*target_rt_dev_ptr));
5445                 if (!*host_rt_dev_ptr) {
5446                     unlock_user(argptr, arg, 0);
5447                     return -TARGET_EFAULT;
5448                 }
5449             } else {
5450                 *host_rt_dev_ptr = 0;
5451             }
5452             field_types++;
5453             continue;
5454         }
5455         field_types = thunk_convert(buf_temp + dst_offsets[i],
5456                                     argptr + src_offsets[i],
5457                                     field_types, THUNK_HOST);
5458     }
5459     unlock_user(argptr, arg, 0);
5460 
5461     ret = get_errno(safe_ioctl(fd, ie->host_cmd, buf_temp));
5462 
5463     assert(host_rt_dev_ptr != NULL);
5464     assert(target_rt_dev_ptr != NULL);
5465     if (*host_rt_dev_ptr != 0) {
5466         unlock_user((void *)*host_rt_dev_ptr,
5467                     *target_rt_dev_ptr, 0);
5468     }
5469     return ret;
5470 }
5471 
5472 static abi_long do_ioctl_kdsigaccept(const IOCTLEntry *ie, uint8_t *buf_temp,
5473                                      int fd, int cmd, abi_long arg)
5474 {
5475     int sig = target_to_host_signal(arg);
5476     return get_errno(safe_ioctl(fd, ie->host_cmd, sig));
5477 }
5478 
5479 static abi_long do_ioctl_SIOCGSTAMP(const IOCTLEntry *ie, uint8_t *buf_temp,
5480                                     int fd, int cmd, abi_long arg)
5481 {
5482     struct timeval tv;
5483     abi_long ret;
5484 
5485     ret = get_errno(safe_ioctl(fd, SIOCGSTAMP, &tv));
5486     if (is_error(ret)) {
5487         return ret;
5488     }
5489 
5490     if (cmd == (int)TARGET_SIOCGSTAMP_OLD) {
5491         if (copy_to_user_timeval(arg, &tv)) {
5492             return -TARGET_EFAULT;
5493         }
5494     } else {
5495         if (copy_to_user_timeval64(arg, &tv)) {
5496             return -TARGET_EFAULT;
5497         }
5498     }
5499 
5500     return ret;
5501 }
5502 
5503 static abi_long do_ioctl_SIOCGSTAMPNS(const IOCTLEntry *ie, uint8_t *buf_temp,
5504                                       int fd, int cmd, abi_long arg)
5505 {
5506     struct timespec ts;
5507     abi_long ret;
5508 
5509     ret = get_errno(safe_ioctl(fd, SIOCGSTAMPNS, &ts));
5510     if (is_error(ret)) {
5511         return ret;
5512     }
5513 
5514     if (cmd == (int)TARGET_SIOCGSTAMPNS_OLD) {
5515         if (host_to_target_timespec(arg, &ts)) {
5516             return -TARGET_EFAULT;
5517         }
5518     } else{
5519         if (host_to_target_timespec64(arg, &ts)) {
5520             return -TARGET_EFAULT;
5521         }
5522     }
5523 
5524     return ret;
5525 }
5526 
5527 #ifdef TIOCGPTPEER
5528 static abi_long do_ioctl_tiocgptpeer(const IOCTLEntry *ie, uint8_t *buf_temp,
5529                                      int fd, int cmd, abi_long arg)
5530 {
5531     int flags = target_to_host_bitmask(arg, fcntl_flags_tbl);
5532     return get_errno(safe_ioctl(fd, ie->host_cmd, flags));
5533 }
5534 #endif
5535 
5536 #ifdef HAVE_DRM_H
5537 
5538 static void unlock_drm_version(struct drm_version *host_ver,
5539                                struct target_drm_version *target_ver,
5540                                bool copy)
5541 {
5542     unlock_user(host_ver->name, target_ver->name,
5543                                 copy ? host_ver->name_len : 0);
5544     unlock_user(host_ver->date, target_ver->date,
5545                                 copy ? host_ver->date_len : 0);
5546     unlock_user(host_ver->desc, target_ver->desc,
5547                                 copy ? host_ver->desc_len : 0);
5548 }
5549 
5550 static inline abi_long target_to_host_drmversion(struct drm_version *host_ver,
5551                                           struct target_drm_version *target_ver)
5552 {
5553     memset(host_ver, 0, sizeof(*host_ver));
5554 
5555     __get_user(host_ver->name_len, &target_ver->name_len);
5556     if (host_ver->name_len) {
5557         host_ver->name = lock_user(VERIFY_WRITE, target_ver->name,
5558                                    target_ver->name_len, 0);
5559         if (!host_ver->name) {
5560             return -EFAULT;
5561         }
5562     }
5563 
5564     __get_user(host_ver->date_len, &target_ver->date_len);
5565     if (host_ver->date_len) {
5566         host_ver->date = lock_user(VERIFY_WRITE, target_ver->date,
5567                                    target_ver->date_len, 0);
5568         if (!host_ver->date) {
5569             goto err;
5570         }
5571     }
5572 
5573     __get_user(host_ver->desc_len, &target_ver->desc_len);
5574     if (host_ver->desc_len) {
5575         host_ver->desc = lock_user(VERIFY_WRITE, target_ver->desc,
5576                                    target_ver->desc_len, 0);
5577         if (!host_ver->desc) {
5578             goto err;
5579         }
5580     }
5581 
5582     return 0;
5583 err:
5584     unlock_drm_version(host_ver, target_ver, false);
5585     return -EFAULT;
5586 }
5587 
5588 static inline void host_to_target_drmversion(
5589                                           struct target_drm_version *target_ver,
5590                                           struct drm_version *host_ver)
5591 {
5592     __put_user(host_ver->version_major, &target_ver->version_major);
5593     __put_user(host_ver->version_minor, &target_ver->version_minor);
5594     __put_user(host_ver->version_patchlevel, &target_ver->version_patchlevel);
5595     __put_user(host_ver->name_len, &target_ver->name_len);
5596     __put_user(host_ver->date_len, &target_ver->date_len);
5597     __put_user(host_ver->desc_len, &target_ver->desc_len);
5598     unlock_drm_version(host_ver, target_ver, true);
5599 }
5600 
5601 static abi_long do_ioctl_drm(const IOCTLEntry *ie, uint8_t *buf_temp,
5602                              int fd, int cmd, abi_long arg)
5603 {
5604     struct drm_version *ver;
5605     struct target_drm_version *target_ver;
5606     abi_long ret;
5607 
5608     switch (ie->host_cmd) {
5609     case DRM_IOCTL_VERSION:
5610         if (!lock_user_struct(VERIFY_WRITE, target_ver, arg, 0)) {
5611             return -TARGET_EFAULT;
5612         }
5613         ver = (struct drm_version *)buf_temp;
5614         ret = target_to_host_drmversion(ver, target_ver);
5615         if (!is_error(ret)) {
5616             ret = get_errno(safe_ioctl(fd, ie->host_cmd, ver));
5617             if (is_error(ret)) {
5618                 unlock_drm_version(ver, target_ver, false);
5619             } else {
5620                 host_to_target_drmversion(target_ver, ver);
5621             }
5622         }
5623         unlock_user_struct(target_ver, arg, 0);
5624         return ret;
5625     }
5626     return -TARGET_ENOSYS;
5627 }
5628 
5629 static abi_long do_ioctl_drm_i915_getparam(const IOCTLEntry *ie,
5630                                            struct drm_i915_getparam *gparam,
5631                                            int fd, abi_long arg)
5632 {
5633     abi_long ret;
5634     int value;
5635     struct target_drm_i915_getparam *target_gparam;
5636 
5637     if (!lock_user_struct(VERIFY_READ, target_gparam, arg, 0)) {
5638         return -TARGET_EFAULT;
5639     }
5640 
5641     __get_user(gparam->param, &target_gparam->param);
5642     gparam->value = &value;
5643     ret = get_errno(safe_ioctl(fd, ie->host_cmd, gparam));
5644     put_user_s32(value, target_gparam->value);
5645 
5646     unlock_user_struct(target_gparam, arg, 0);
5647     return ret;
5648 }
5649 
5650 static abi_long do_ioctl_drm_i915(const IOCTLEntry *ie, uint8_t *buf_temp,
5651                                   int fd, int cmd, abi_long arg)
5652 {
5653     switch (ie->host_cmd) {
5654     case DRM_IOCTL_I915_GETPARAM:
5655         return do_ioctl_drm_i915_getparam(ie,
5656                                           (struct drm_i915_getparam *)buf_temp,
5657                                           fd, arg);
5658     default:
5659         return -TARGET_ENOSYS;
5660     }
5661 }
5662 
5663 #endif
5664 
5665 static abi_long do_ioctl_TUNSETTXFILTER(const IOCTLEntry *ie, uint8_t *buf_temp,
5666                                         int fd, int cmd, abi_long arg)
5667 {
5668     struct tun_filter *filter = (struct tun_filter *)buf_temp;
5669     struct tun_filter *target_filter;
5670     char *target_addr;
5671 
5672     assert(ie->access == IOC_W);
5673 
5674     target_filter = lock_user(VERIFY_READ, arg, sizeof(*target_filter), 1);
5675     if (!target_filter) {
5676         return -TARGET_EFAULT;
5677     }
5678     filter->flags = tswap16(target_filter->flags);
5679     filter->count = tswap16(target_filter->count);
5680     unlock_user(target_filter, arg, 0);
5681 
5682     if (filter->count) {
5683         if (offsetof(struct tun_filter, addr) + filter->count * ETH_ALEN >
5684             MAX_STRUCT_SIZE) {
5685             return -TARGET_EFAULT;
5686         }
5687 
5688         target_addr = lock_user(VERIFY_READ,
5689                                 arg + offsetof(struct tun_filter, addr),
5690                                 filter->count * ETH_ALEN, 1);
5691         if (!target_addr) {
5692             return -TARGET_EFAULT;
5693         }
5694         memcpy(filter->addr, target_addr, filter->count * ETH_ALEN);
5695         unlock_user(target_addr, arg + offsetof(struct tun_filter, addr), 0);
5696     }
5697 
5698     return get_errno(safe_ioctl(fd, ie->host_cmd, filter));
5699 }
5700 
5701 IOCTLEntry ioctl_entries[] = {
5702 #define IOCTL(cmd, access, ...) \
5703     { TARGET_ ## cmd, cmd, #cmd, access, 0, {  __VA_ARGS__ } },
5704 #define IOCTL_SPECIAL(cmd, access, dofn, ...)                      \
5705     { TARGET_ ## cmd, cmd, #cmd, access, dofn, {  __VA_ARGS__ } },
5706 #define IOCTL_IGNORE(cmd) \
5707     { TARGET_ ## cmd, 0, #cmd },
5708 #include "ioctls.h"
5709     { 0, 0, },
5710 };
5711 
5712 /* ??? Implement proper locking for ioctls.  */
5713 /* do_ioctl() Must return target values and target errnos. */
5714 static abi_long do_ioctl(int fd, int cmd, abi_long arg)
5715 {
5716     const IOCTLEntry *ie;
5717     const argtype *arg_type;
5718     abi_long ret;
5719     uint8_t buf_temp[MAX_STRUCT_SIZE];
5720     int target_size;
5721     void *argptr;
5722 
5723     ie = ioctl_entries;
5724     for(;;) {
5725         if (ie->target_cmd == 0) {
5726             qemu_log_mask(
5727                 LOG_UNIMP, "Unsupported ioctl: cmd=0x%04lx\n", (long)cmd);
5728             return -TARGET_ENOSYS;
5729         }
5730         if (ie->target_cmd == cmd)
5731             break;
5732         ie++;
5733     }
5734     arg_type = ie->arg_type;
5735     if (ie->do_ioctl) {
5736         return ie->do_ioctl(ie, buf_temp, fd, cmd, arg);
5737     } else if (!ie->host_cmd) {
5738         /* Some architectures define BSD ioctls in their headers
5739            that are not implemented in Linux.  */
5740         return -TARGET_ENOSYS;
5741     }
5742 
5743     switch(arg_type[0]) {
5744     case TYPE_NULL:
5745         /* no argument */
5746         ret = get_errno(safe_ioctl(fd, ie->host_cmd));
5747         break;
5748     case TYPE_PTRVOID:
5749     case TYPE_INT:
5750     case TYPE_LONG:
5751     case TYPE_ULONG:
5752         ret = get_errno(safe_ioctl(fd, ie->host_cmd, arg));
5753         break;
5754     case TYPE_PTR:
5755         arg_type++;
5756         target_size = thunk_type_size(arg_type, 0);
5757         switch(ie->access) {
5758         case IOC_R:
5759             ret = get_errno(safe_ioctl(fd, ie->host_cmd, buf_temp));
5760             if (!is_error(ret)) {
5761                 argptr = lock_user(VERIFY_WRITE, arg, target_size, 0);
5762                 if (!argptr)
5763                     return -TARGET_EFAULT;
5764                 thunk_convert(argptr, buf_temp, arg_type, THUNK_TARGET);
5765                 unlock_user(argptr, arg, target_size);
5766             }
5767             break;
5768         case IOC_W:
5769             argptr = lock_user(VERIFY_READ, arg, target_size, 1);
5770             if (!argptr)
5771                 return -TARGET_EFAULT;
5772             thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
5773             unlock_user(argptr, arg, 0);
5774             ret = get_errno(safe_ioctl(fd, ie->host_cmd, buf_temp));
5775             break;
5776         default:
5777         case IOC_RW:
5778             argptr = lock_user(VERIFY_READ, arg, target_size, 1);
5779             if (!argptr)
5780                 return -TARGET_EFAULT;
5781             thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
5782             unlock_user(argptr, arg, 0);
5783             ret = get_errno(safe_ioctl(fd, ie->host_cmd, buf_temp));
5784             if (!is_error(ret)) {
5785                 argptr = lock_user(VERIFY_WRITE, arg, target_size, 0);
5786                 if (!argptr)
5787                     return -TARGET_EFAULT;
5788                 thunk_convert(argptr, buf_temp, arg_type, THUNK_TARGET);
5789                 unlock_user(argptr, arg, target_size);
5790             }
5791             break;
5792         }
5793         break;
5794     default:
5795         qemu_log_mask(LOG_UNIMP,
5796                       "Unsupported ioctl type: cmd=0x%04lx type=%d\n",
5797                       (long)cmd, arg_type[0]);
5798         ret = -TARGET_ENOSYS;
5799         break;
5800     }
5801     return ret;
5802 }
5803 
5804 static const bitmask_transtbl iflag_tbl[] = {
5805         { TARGET_IGNBRK, TARGET_IGNBRK, IGNBRK, IGNBRK },
5806         { TARGET_BRKINT, TARGET_BRKINT, BRKINT, BRKINT },
5807         { TARGET_IGNPAR, TARGET_IGNPAR, IGNPAR, IGNPAR },
5808         { TARGET_PARMRK, TARGET_PARMRK, PARMRK, PARMRK },
5809         { TARGET_INPCK, TARGET_INPCK, INPCK, INPCK },
5810         { TARGET_ISTRIP, TARGET_ISTRIP, ISTRIP, ISTRIP },
5811         { TARGET_INLCR, TARGET_INLCR, INLCR, INLCR },
5812         { TARGET_IGNCR, TARGET_IGNCR, IGNCR, IGNCR },
5813         { TARGET_ICRNL, TARGET_ICRNL, ICRNL, ICRNL },
5814         { TARGET_IUCLC, TARGET_IUCLC, IUCLC, IUCLC },
5815         { TARGET_IXON, TARGET_IXON, IXON, IXON },
5816         { TARGET_IXANY, TARGET_IXANY, IXANY, IXANY },
5817         { TARGET_IXOFF, TARGET_IXOFF, IXOFF, IXOFF },
5818         { TARGET_IMAXBEL, TARGET_IMAXBEL, IMAXBEL, IMAXBEL },
5819         { TARGET_IUTF8, TARGET_IUTF8, IUTF8, IUTF8},
5820         { 0, 0, 0, 0 }
5821 };
5822 
5823 static const bitmask_transtbl oflag_tbl[] = {
5824 	{ TARGET_OPOST, TARGET_OPOST, OPOST, OPOST },
5825 	{ TARGET_OLCUC, TARGET_OLCUC, OLCUC, OLCUC },
5826 	{ TARGET_ONLCR, TARGET_ONLCR, ONLCR, ONLCR },
5827 	{ TARGET_OCRNL, TARGET_OCRNL, OCRNL, OCRNL },
5828 	{ TARGET_ONOCR, TARGET_ONOCR, ONOCR, ONOCR },
5829 	{ TARGET_ONLRET, TARGET_ONLRET, ONLRET, ONLRET },
5830 	{ TARGET_OFILL, TARGET_OFILL, OFILL, OFILL },
5831 	{ TARGET_OFDEL, TARGET_OFDEL, OFDEL, OFDEL },
5832 	{ TARGET_NLDLY, TARGET_NL0, NLDLY, NL0 },
5833 	{ TARGET_NLDLY, TARGET_NL1, NLDLY, NL1 },
5834 	{ TARGET_CRDLY, TARGET_CR0, CRDLY, CR0 },
5835 	{ TARGET_CRDLY, TARGET_CR1, CRDLY, CR1 },
5836 	{ TARGET_CRDLY, TARGET_CR2, CRDLY, CR2 },
5837 	{ TARGET_CRDLY, TARGET_CR3, CRDLY, CR3 },
5838 	{ TARGET_TABDLY, TARGET_TAB0, TABDLY, TAB0 },
5839 	{ TARGET_TABDLY, TARGET_TAB1, TABDLY, TAB1 },
5840 	{ TARGET_TABDLY, TARGET_TAB2, TABDLY, TAB2 },
5841 	{ TARGET_TABDLY, TARGET_TAB3, TABDLY, TAB3 },
5842 	{ TARGET_BSDLY, TARGET_BS0, BSDLY, BS0 },
5843 	{ TARGET_BSDLY, TARGET_BS1, BSDLY, BS1 },
5844 	{ TARGET_VTDLY, TARGET_VT0, VTDLY, VT0 },
5845 	{ TARGET_VTDLY, TARGET_VT1, VTDLY, VT1 },
5846 	{ TARGET_FFDLY, TARGET_FF0, FFDLY, FF0 },
5847 	{ TARGET_FFDLY, TARGET_FF1, FFDLY, FF1 },
5848 	{ 0, 0, 0, 0 }
5849 };
5850 
5851 static const bitmask_transtbl cflag_tbl[] = {
5852 	{ TARGET_CBAUD, TARGET_B0, CBAUD, B0 },
5853 	{ TARGET_CBAUD, TARGET_B50, CBAUD, B50 },
5854 	{ TARGET_CBAUD, TARGET_B75, CBAUD, B75 },
5855 	{ TARGET_CBAUD, TARGET_B110, CBAUD, B110 },
5856 	{ TARGET_CBAUD, TARGET_B134, CBAUD, B134 },
5857 	{ TARGET_CBAUD, TARGET_B150, CBAUD, B150 },
5858 	{ TARGET_CBAUD, TARGET_B200, CBAUD, B200 },
5859 	{ TARGET_CBAUD, TARGET_B300, CBAUD, B300 },
5860 	{ TARGET_CBAUD, TARGET_B600, CBAUD, B600 },
5861 	{ TARGET_CBAUD, TARGET_B1200, CBAUD, B1200 },
5862 	{ TARGET_CBAUD, TARGET_B1800, CBAUD, B1800 },
5863 	{ TARGET_CBAUD, TARGET_B2400, CBAUD, B2400 },
5864 	{ TARGET_CBAUD, TARGET_B4800, CBAUD, B4800 },
5865 	{ TARGET_CBAUD, TARGET_B9600, CBAUD, B9600 },
5866 	{ TARGET_CBAUD, TARGET_B19200, CBAUD, B19200 },
5867 	{ TARGET_CBAUD, TARGET_B38400, CBAUD, B38400 },
5868 	{ TARGET_CBAUD, TARGET_B57600, CBAUD, B57600 },
5869 	{ TARGET_CBAUD, TARGET_B115200, CBAUD, B115200 },
5870 	{ TARGET_CBAUD, TARGET_B230400, CBAUD, B230400 },
5871 	{ TARGET_CBAUD, TARGET_B460800, CBAUD, B460800 },
5872 	{ TARGET_CSIZE, TARGET_CS5, CSIZE, CS5 },
5873 	{ TARGET_CSIZE, TARGET_CS6, CSIZE, CS6 },
5874 	{ TARGET_CSIZE, TARGET_CS7, CSIZE, CS7 },
5875 	{ TARGET_CSIZE, TARGET_CS8, CSIZE, CS8 },
5876 	{ TARGET_CSTOPB, TARGET_CSTOPB, CSTOPB, CSTOPB },
5877 	{ TARGET_CREAD, TARGET_CREAD, CREAD, CREAD },
5878 	{ TARGET_PARENB, TARGET_PARENB, PARENB, PARENB },
5879 	{ TARGET_PARODD, TARGET_PARODD, PARODD, PARODD },
5880 	{ TARGET_HUPCL, TARGET_HUPCL, HUPCL, HUPCL },
5881 	{ TARGET_CLOCAL, TARGET_CLOCAL, CLOCAL, CLOCAL },
5882 	{ TARGET_CRTSCTS, TARGET_CRTSCTS, CRTSCTS, CRTSCTS },
5883 	{ 0, 0, 0, 0 }
5884 };
5885 
5886 static const bitmask_transtbl lflag_tbl[] = {
5887   { TARGET_ISIG, TARGET_ISIG, ISIG, ISIG },
5888   { TARGET_ICANON, TARGET_ICANON, ICANON, ICANON },
5889   { TARGET_XCASE, TARGET_XCASE, XCASE, XCASE },
5890   { TARGET_ECHO, TARGET_ECHO, ECHO, ECHO },
5891   { TARGET_ECHOE, TARGET_ECHOE, ECHOE, ECHOE },
5892   { TARGET_ECHOK, TARGET_ECHOK, ECHOK, ECHOK },
5893   { TARGET_ECHONL, TARGET_ECHONL, ECHONL, ECHONL },
5894   { TARGET_NOFLSH, TARGET_NOFLSH, NOFLSH, NOFLSH },
5895   { TARGET_TOSTOP, TARGET_TOSTOP, TOSTOP, TOSTOP },
5896   { TARGET_ECHOCTL, TARGET_ECHOCTL, ECHOCTL, ECHOCTL },
5897   { TARGET_ECHOPRT, TARGET_ECHOPRT, ECHOPRT, ECHOPRT },
5898   { TARGET_ECHOKE, TARGET_ECHOKE, ECHOKE, ECHOKE },
5899   { TARGET_FLUSHO, TARGET_FLUSHO, FLUSHO, FLUSHO },
5900   { TARGET_PENDIN, TARGET_PENDIN, PENDIN, PENDIN },
5901   { TARGET_IEXTEN, TARGET_IEXTEN, IEXTEN, IEXTEN },
5902   { TARGET_EXTPROC, TARGET_EXTPROC, EXTPROC, EXTPROC},
5903   { 0, 0, 0, 0 }
5904 };
5905 
5906 static void target_to_host_termios (void *dst, const void *src)
5907 {
5908     struct host_termios *host = dst;
5909     const struct target_termios *target = src;
5910 
5911     host->c_iflag =
5912         target_to_host_bitmask(tswap32(target->c_iflag), iflag_tbl);
5913     host->c_oflag =
5914         target_to_host_bitmask(tswap32(target->c_oflag), oflag_tbl);
5915     host->c_cflag =
5916         target_to_host_bitmask(tswap32(target->c_cflag), cflag_tbl);
5917     host->c_lflag =
5918         target_to_host_bitmask(tswap32(target->c_lflag), lflag_tbl);
5919     host->c_line = target->c_line;
5920 
5921     memset(host->c_cc, 0, sizeof(host->c_cc));
5922     host->c_cc[VINTR] = target->c_cc[TARGET_VINTR];
5923     host->c_cc[VQUIT] = target->c_cc[TARGET_VQUIT];
5924     host->c_cc[VERASE] = target->c_cc[TARGET_VERASE];
5925     host->c_cc[VKILL] = target->c_cc[TARGET_VKILL];
5926     host->c_cc[VEOF] = target->c_cc[TARGET_VEOF];
5927     host->c_cc[VTIME] = target->c_cc[TARGET_VTIME];
5928     host->c_cc[VMIN] = target->c_cc[TARGET_VMIN];
5929     host->c_cc[VSWTC] = target->c_cc[TARGET_VSWTC];
5930     host->c_cc[VSTART] = target->c_cc[TARGET_VSTART];
5931     host->c_cc[VSTOP] = target->c_cc[TARGET_VSTOP];
5932     host->c_cc[VSUSP] = target->c_cc[TARGET_VSUSP];
5933     host->c_cc[VEOL] = target->c_cc[TARGET_VEOL];
5934     host->c_cc[VREPRINT] = target->c_cc[TARGET_VREPRINT];
5935     host->c_cc[VDISCARD] = target->c_cc[TARGET_VDISCARD];
5936     host->c_cc[VWERASE] = target->c_cc[TARGET_VWERASE];
5937     host->c_cc[VLNEXT] = target->c_cc[TARGET_VLNEXT];
5938     host->c_cc[VEOL2] = target->c_cc[TARGET_VEOL2];
5939 }
5940 
5941 static void host_to_target_termios (void *dst, const void *src)
5942 {
5943     struct target_termios *target = dst;
5944     const struct host_termios *host = src;
5945 
5946     target->c_iflag =
5947         tswap32(host_to_target_bitmask(host->c_iflag, iflag_tbl));
5948     target->c_oflag =
5949         tswap32(host_to_target_bitmask(host->c_oflag, oflag_tbl));
5950     target->c_cflag =
5951         tswap32(host_to_target_bitmask(host->c_cflag, cflag_tbl));
5952     target->c_lflag =
5953         tswap32(host_to_target_bitmask(host->c_lflag, lflag_tbl));
5954     target->c_line = host->c_line;
5955 
5956     memset(target->c_cc, 0, sizeof(target->c_cc));
5957     target->c_cc[TARGET_VINTR] = host->c_cc[VINTR];
5958     target->c_cc[TARGET_VQUIT] = host->c_cc[VQUIT];
5959     target->c_cc[TARGET_VERASE] = host->c_cc[VERASE];
5960     target->c_cc[TARGET_VKILL] = host->c_cc[VKILL];
5961     target->c_cc[TARGET_VEOF] = host->c_cc[VEOF];
5962     target->c_cc[TARGET_VTIME] = host->c_cc[VTIME];
5963     target->c_cc[TARGET_VMIN] = host->c_cc[VMIN];
5964     target->c_cc[TARGET_VSWTC] = host->c_cc[VSWTC];
5965     target->c_cc[TARGET_VSTART] = host->c_cc[VSTART];
5966     target->c_cc[TARGET_VSTOP] = host->c_cc[VSTOP];
5967     target->c_cc[TARGET_VSUSP] = host->c_cc[VSUSP];
5968     target->c_cc[TARGET_VEOL] = host->c_cc[VEOL];
5969     target->c_cc[TARGET_VREPRINT] = host->c_cc[VREPRINT];
5970     target->c_cc[TARGET_VDISCARD] = host->c_cc[VDISCARD];
5971     target->c_cc[TARGET_VWERASE] = host->c_cc[VWERASE];
5972     target->c_cc[TARGET_VLNEXT] = host->c_cc[VLNEXT];
5973     target->c_cc[TARGET_VEOL2] = host->c_cc[VEOL2];
5974 }
5975 
5976 static const StructEntry struct_termios_def = {
5977     .convert = { host_to_target_termios, target_to_host_termios },
5978     .size = { sizeof(struct target_termios), sizeof(struct host_termios) },
5979     .align = { __alignof__(struct target_termios), __alignof__(struct host_termios) },
5980     .print = print_termios,
5981 };
5982 
5983 static const bitmask_transtbl mmap_flags_tbl[] = {
5984     { TARGET_MAP_SHARED, TARGET_MAP_SHARED, MAP_SHARED, MAP_SHARED },
5985     { TARGET_MAP_PRIVATE, TARGET_MAP_PRIVATE, MAP_PRIVATE, MAP_PRIVATE },
5986     { TARGET_MAP_FIXED, TARGET_MAP_FIXED, MAP_FIXED, MAP_FIXED },
5987     { TARGET_MAP_ANONYMOUS, TARGET_MAP_ANONYMOUS,
5988       MAP_ANONYMOUS, MAP_ANONYMOUS },
5989     { TARGET_MAP_GROWSDOWN, TARGET_MAP_GROWSDOWN,
5990       MAP_GROWSDOWN, MAP_GROWSDOWN },
5991     { TARGET_MAP_DENYWRITE, TARGET_MAP_DENYWRITE,
5992       MAP_DENYWRITE, MAP_DENYWRITE },
5993     { TARGET_MAP_EXECUTABLE, TARGET_MAP_EXECUTABLE,
5994       MAP_EXECUTABLE, MAP_EXECUTABLE },
5995     { TARGET_MAP_LOCKED, TARGET_MAP_LOCKED, MAP_LOCKED, MAP_LOCKED },
5996     { TARGET_MAP_NORESERVE, TARGET_MAP_NORESERVE,
5997       MAP_NORESERVE, MAP_NORESERVE },
5998     { TARGET_MAP_HUGETLB, TARGET_MAP_HUGETLB, MAP_HUGETLB, MAP_HUGETLB },
5999     /* MAP_STACK had been ignored by the kernel for quite some time.
6000        Recognize it for the target insofar as we do not want to pass
6001        it through to the host.  */
6002     { TARGET_MAP_STACK, TARGET_MAP_STACK, 0, 0 },
6003     { 0, 0, 0, 0 }
6004 };
6005 
6006 /*
6007  * NOTE: TARGET_ABI32 is defined for TARGET_I386 (but not for TARGET_X86_64)
6008  *       TARGET_I386 is defined if TARGET_X86_64 is defined
6009  */
6010 #if defined(TARGET_I386)
6011 
6012 /* NOTE: there is really one LDT for all the threads */
6013 static uint8_t *ldt_table;
6014 
6015 static abi_long read_ldt(abi_ulong ptr, unsigned long bytecount)
6016 {
6017     int size;
6018     void *p;
6019 
6020     if (!ldt_table)
6021         return 0;
6022     size = TARGET_LDT_ENTRIES * TARGET_LDT_ENTRY_SIZE;
6023     if (size > bytecount)
6024         size = bytecount;
6025     p = lock_user(VERIFY_WRITE, ptr, size, 0);
6026     if (!p)
6027         return -TARGET_EFAULT;
6028     /* ??? Should this by byteswapped?  */
6029     memcpy(p, ldt_table, size);
6030     unlock_user(p, ptr, size);
6031     return size;
6032 }
6033 
6034 /* XXX: add locking support */
6035 static abi_long write_ldt(CPUX86State *env,
6036                           abi_ulong ptr, unsigned long bytecount, int oldmode)
6037 {
6038     struct target_modify_ldt_ldt_s ldt_info;
6039     struct target_modify_ldt_ldt_s *target_ldt_info;
6040     int seg_32bit, contents, read_exec_only, limit_in_pages;
6041     int seg_not_present, useable, lm;
6042     uint32_t *lp, entry_1, entry_2;
6043 
6044     if (bytecount != sizeof(ldt_info))
6045         return -TARGET_EINVAL;
6046     if (!lock_user_struct(VERIFY_READ, target_ldt_info, ptr, 1))
6047         return -TARGET_EFAULT;
6048     ldt_info.entry_number = tswap32(target_ldt_info->entry_number);
6049     ldt_info.base_addr = tswapal(target_ldt_info->base_addr);
6050     ldt_info.limit = tswap32(target_ldt_info->limit);
6051     ldt_info.flags = tswap32(target_ldt_info->flags);
6052     unlock_user_struct(target_ldt_info, ptr, 0);
6053 
6054     if (ldt_info.entry_number >= TARGET_LDT_ENTRIES)
6055         return -TARGET_EINVAL;
6056     seg_32bit = ldt_info.flags & 1;
6057     contents = (ldt_info.flags >> 1) & 3;
6058     read_exec_only = (ldt_info.flags >> 3) & 1;
6059     limit_in_pages = (ldt_info.flags >> 4) & 1;
6060     seg_not_present = (ldt_info.flags >> 5) & 1;
6061     useable = (ldt_info.flags >> 6) & 1;
6062 #ifdef TARGET_ABI32
6063     lm = 0;
6064 #else
6065     lm = (ldt_info.flags >> 7) & 1;
6066 #endif
6067     if (contents == 3) {
6068         if (oldmode)
6069             return -TARGET_EINVAL;
6070         if (seg_not_present == 0)
6071             return -TARGET_EINVAL;
6072     }
6073     /* allocate the LDT */
6074     if (!ldt_table) {
6075         env->ldt.base = target_mmap(0,
6076                                     TARGET_LDT_ENTRIES * TARGET_LDT_ENTRY_SIZE,
6077                                     PROT_READ|PROT_WRITE,
6078                                     MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);
6079         if (env->ldt.base == -1)
6080             return -TARGET_ENOMEM;
6081         memset(g2h_untagged(env->ldt.base), 0,
6082                TARGET_LDT_ENTRIES * TARGET_LDT_ENTRY_SIZE);
6083         env->ldt.limit = 0xffff;
6084         ldt_table = g2h_untagged(env->ldt.base);
6085     }
6086 
6087     /* NOTE: same code as Linux kernel */
6088     /* Allow LDTs to be cleared by the user. */
6089     if (ldt_info.base_addr == 0 && ldt_info.limit == 0) {
6090         if (oldmode ||
6091             (contents == 0		&&
6092              read_exec_only == 1	&&
6093              seg_32bit == 0		&&
6094              limit_in_pages == 0	&&
6095              seg_not_present == 1	&&
6096              useable == 0 )) {
6097             entry_1 = 0;
6098             entry_2 = 0;
6099             goto install;
6100         }
6101     }
6102 
6103     entry_1 = ((ldt_info.base_addr & 0x0000ffff) << 16) |
6104         (ldt_info.limit & 0x0ffff);
6105     entry_2 = (ldt_info.base_addr & 0xff000000) |
6106         ((ldt_info.base_addr & 0x00ff0000) >> 16) |
6107         (ldt_info.limit & 0xf0000) |
6108         ((read_exec_only ^ 1) << 9) |
6109         (contents << 10) |
6110         ((seg_not_present ^ 1) << 15) |
6111         (seg_32bit << 22) |
6112         (limit_in_pages << 23) |
6113         (lm << 21) |
6114         0x7000;
6115     if (!oldmode)
6116         entry_2 |= (useable << 20);
6117 
6118     /* Install the new entry ...  */
6119 install:
6120     lp = (uint32_t *)(ldt_table + (ldt_info.entry_number << 3));
6121     lp[0] = tswap32(entry_1);
6122     lp[1] = tswap32(entry_2);
6123     return 0;
6124 }
6125 
6126 /* specific and weird i386 syscalls */
6127 static abi_long do_modify_ldt(CPUX86State *env, int func, abi_ulong ptr,
6128                               unsigned long bytecount)
6129 {
6130     abi_long ret;
6131 
6132     switch (func) {
6133     case 0:
6134         ret = read_ldt(ptr, bytecount);
6135         break;
6136     case 1:
6137         ret = write_ldt(env, ptr, bytecount, 1);
6138         break;
6139     case 0x11:
6140         ret = write_ldt(env, ptr, bytecount, 0);
6141         break;
6142     default:
6143         ret = -TARGET_ENOSYS;
6144         break;
6145     }
6146     return ret;
6147 }
6148 
6149 #if defined(TARGET_ABI32)
6150 abi_long do_set_thread_area(CPUX86State *env, abi_ulong ptr)
6151 {
6152     uint64_t *gdt_table = g2h_untagged(env->gdt.base);
6153     struct target_modify_ldt_ldt_s ldt_info;
6154     struct target_modify_ldt_ldt_s *target_ldt_info;
6155     int seg_32bit, contents, read_exec_only, limit_in_pages;
6156     int seg_not_present, useable, lm;
6157     uint32_t *lp, entry_1, entry_2;
6158     int i;
6159 
6160     lock_user_struct(VERIFY_WRITE, target_ldt_info, ptr, 1);
6161     if (!target_ldt_info)
6162         return -TARGET_EFAULT;
6163     ldt_info.entry_number = tswap32(target_ldt_info->entry_number);
6164     ldt_info.base_addr = tswapal(target_ldt_info->base_addr);
6165     ldt_info.limit = tswap32(target_ldt_info->limit);
6166     ldt_info.flags = tswap32(target_ldt_info->flags);
6167     if (ldt_info.entry_number == -1) {
6168         for (i=TARGET_GDT_ENTRY_TLS_MIN; i<=TARGET_GDT_ENTRY_TLS_MAX; i++) {
6169             if (gdt_table[i] == 0) {
6170                 ldt_info.entry_number = i;
6171                 target_ldt_info->entry_number = tswap32(i);
6172                 break;
6173             }
6174         }
6175     }
6176     unlock_user_struct(target_ldt_info, ptr, 1);
6177 
6178     if (ldt_info.entry_number < TARGET_GDT_ENTRY_TLS_MIN ||
6179         ldt_info.entry_number > TARGET_GDT_ENTRY_TLS_MAX)
6180            return -TARGET_EINVAL;
6181     seg_32bit = ldt_info.flags & 1;
6182     contents = (ldt_info.flags >> 1) & 3;
6183     read_exec_only = (ldt_info.flags >> 3) & 1;
6184     limit_in_pages = (ldt_info.flags >> 4) & 1;
6185     seg_not_present = (ldt_info.flags >> 5) & 1;
6186     useable = (ldt_info.flags >> 6) & 1;
6187 #ifdef TARGET_ABI32
6188     lm = 0;
6189 #else
6190     lm = (ldt_info.flags >> 7) & 1;
6191 #endif
6192 
6193     if (contents == 3) {
6194         if (seg_not_present == 0)
6195             return -TARGET_EINVAL;
6196     }
6197 
6198     /* NOTE: same code as Linux kernel */
6199     /* Allow LDTs to be cleared by the user. */
6200     if (ldt_info.base_addr == 0 && ldt_info.limit == 0) {
6201         if ((contents == 0             &&
6202              read_exec_only == 1       &&
6203              seg_32bit == 0            &&
6204              limit_in_pages == 0       &&
6205              seg_not_present == 1      &&
6206              useable == 0 )) {
6207             entry_1 = 0;
6208             entry_2 = 0;
6209             goto install;
6210         }
6211     }
6212 
6213     entry_1 = ((ldt_info.base_addr & 0x0000ffff) << 16) |
6214         (ldt_info.limit & 0x0ffff);
6215     entry_2 = (ldt_info.base_addr & 0xff000000) |
6216         ((ldt_info.base_addr & 0x00ff0000) >> 16) |
6217         (ldt_info.limit & 0xf0000) |
6218         ((read_exec_only ^ 1) << 9) |
6219         (contents << 10) |
6220         ((seg_not_present ^ 1) << 15) |
6221         (seg_32bit << 22) |
6222         (limit_in_pages << 23) |
6223         (useable << 20) |
6224         (lm << 21) |
6225         0x7000;
6226 
6227     /* Install the new entry ...  */
6228 install:
6229     lp = (uint32_t *)(gdt_table + ldt_info.entry_number);
6230     lp[0] = tswap32(entry_1);
6231     lp[1] = tswap32(entry_2);
6232     return 0;
6233 }
6234 
6235 static abi_long do_get_thread_area(CPUX86State *env, abi_ulong ptr)
6236 {
6237     struct target_modify_ldt_ldt_s *target_ldt_info;
6238     uint64_t *gdt_table = g2h_untagged(env->gdt.base);
6239     uint32_t base_addr, limit, flags;
6240     int seg_32bit, contents, read_exec_only, limit_in_pages, idx;
6241     int seg_not_present, useable, lm;
6242     uint32_t *lp, entry_1, entry_2;
6243 
6244     lock_user_struct(VERIFY_WRITE, target_ldt_info, ptr, 1);
6245     if (!target_ldt_info)
6246         return -TARGET_EFAULT;
6247     idx = tswap32(target_ldt_info->entry_number);
6248     if (idx < TARGET_GDT_ENTRY_TLS_MIN ||
6249         idx > TARGET_GDT_ENTRY_TLS_MAX) {
6250         unlock_user_struct(target_ldt_info, ptr, 1);
6251         return -TARGET_EINVAL;
6252     }
6253     lp = (uint32_t *)(gdt_table + idx);
6254     entry_1 = tswap32(lp[0]);
6255     entry_2 = tswap32(lp[1]);
6256 
6257     read_exec_only = ((entry_2 >> 9) & 1) ^ 1;
6258     contents = (entry_2 >> 10) & 3;
6259     seg_not_present = ((entry_2 >> 15) & 1) ^ 1;
6260     seg_32bit = (entry_2 >> 22) & 1;
6261     limit_in_pages = (entry_2 >> 23) & 1;
6262     useable = (entry_2 >> 20) & 1;
6263 #ifdef TARGET_ABI32
6264     lm = 0;
6265 #else
6266     lm = (entry_2 >> 21) & 1;
6267 #endif
6268     flags = (seg_32bit << 0) | (contents << 1) |
6269         (read_exec_only << 3) | (limit_in_pages << 4) |
6270         (seg_not_present << 5) | (useable << 6) | (lm << 7);
6271     limit = (entry_1 & 0xffff) | (entry_2  & 0xf0000);
6272     base_addr = (entry_1 >> 16) |
6273         (entry_2 & 0xff000000) |
6274         ((entry_2 & 0xff) << 16);
6275     target_ldt_info->base_addr = tswapal(base_addr);
6276     target_ldt_info->limit = tswap32(limit);
6277     target_ldt_info->flags = tswap32(flags);
6278     unlock_user_struct(target_ldt_info, ptr, 1);
6279     return 0;
6280 }
6281 
6282 abi_long do_arch_prctl(CPUX86State *env, int code, abi_ulong addr)
6283 {
6284     return -TARGET_ENOSYS;
6285 }
6286 #else
6287 abi_long do_arch_prctl(CPUX86State *env, int code, abi_ulong addr)
6288 {
6289     abi_long ret = 0;
6290     abi_ulong val;
6291     int idx;
6292 
6293     switch(code) {
6294     case TARGET_ARCH_SET_GS:
6295     case TARGET_ARCH_SET_FS:
6296         if (code == TARGET_ARCH_SET_GS)
6297             idx = R_GS;
6298         else
6299             idx = R_FS;
6300         cpu_x86_load_seg(env, idx, 0);
6301         env->segs[idx].base = addr;
6302         break;
6303     case TARGET_ARCH_GET_GS:
6304     case TARGET_ARCH_GET_FS:
6305         if (code == TARGET_ARCH_GET_GS)
6306             idx = R_GS;
6307         else
6308             idx = R_FS;
6309         val = env->segs[idx].base;
6310         if (put_user(val, addr, abi_ulong))
6311             ret = -TARGET_EFAULT;
6312         break;
6313     default:
6314         ret = -TARGET_EINVAL;
6315         break;
6316     }
6317     return ret;
6318 }
6319 #endif /* defined(TARGET_ABI32 */
6320 #endif /* defined(TARGET_I386) */
6321 
6322 /*
6323  * These constants are generic.  Supply any that are missing from the host.
6324  */
6325 #ifndef PR_SET_NAME
6326 # define PR_SET_NAME    15
6327 # define PR_GET_NAME    16
6328 #endif
6329 #ifndef PR_SET_FP_MODE
6330 # define PR_SET_FP_MODE 45
6331 # define PR_GET_FP_MODE 46
6332 # define PR_FP_MODE_FR   (1 << 0)
6333 # define PR_FP_MODE_FRE  (1 << 1)
6334 #endif
6335 #ifndef PR_SVE_SET_VL
6336 # define PR_SVE_SET_VL  50
6337 # define PR_SVE_GET_VL  51
6338 # define PR_SVE_VL_LEN_MASK  0xffff
6339 # define PR_SVE_VL_INHERIT   (1 << 17)
6340 #endif
6341 #ifndef PR_PAC_RESET_KEYS
6342 # define PR_PAC_RESET_KEYS  54
6343 # define PR_PAC_APIAKEY   (1 << 0)
6344 # define PR_PAC_APIBKEY   (1 << 1)
6345 # define PR_PAC_APDAKEY   (1 << 2)
6346 # define PR_PAC_APDBKEY   (1 << 3)
6347 # define PR_PAC_APGAKEY   (1 << 4)
6348 #endif
6349 #ifndef PR_SET_TAGGED_ADDR_CTRL
6350 # define PR_SET_TAGGED_ADDR_CTRL 55
6351 # define PR_GET_TAGGED_ADDR_CTRL 56
6352 # define PR_TAGGED_ADDR_ENABLE  (1UL << 0)
6353 #endif
6354 #ifndef PR_MTE_TCF_SHIFT
6355 # define PR_MTE_TCF_SHIFT       1
6356 # define PR_MTE_TCF_NONE        (0UL << PR_MTE_TCF_SHIFT)
6357 # define PR_MTE_TCF_SYNC        (1UL << PR_MTE_TCF_SHIFT)
6358 # define PR_MTE_TCF_ASYNC       (2UL << PR_MTE_TCF_SHIFT)
6359 # define PR_MTE_TCF_MASK        (3UL << PR_MTE_TCF_SHIFT)
6360 # define PR_MTE_TAG_SHIFT       3
6361 # define PR_MTE_TAG_MASK        (0xffffUL << PR_MTE_TAG_SHIFT)
6362 #endif
6363 #ifndef PR_SET_IO_FLUSHER
6364 # define PR_SET_IO_FLUSHER 57
6365 # define PR_GET_IO_FLUSHER 58
6366 #endif
6367 #ifndef PR_SET_SYSCALL_USER_DISPATCH
6368 # define PR_SET_SYSCALL_USER_DISPATCH 59
6369 #endif
6370 #ifndef PR_SME_SET_VL
6371 # define PR_SME_SET_VL  63
6372 # define PR_SME_GET_VL  64
6373 # define PR_SME_VL_LEN_MASK  0xffff
6374 # define PR_SME_VL_INHERIT   (1 << 17)
6375 #endif
6376 
6377 #include "target_prctl.h"
6378 
6379 static abi_long do_prctl_inval0(CPUArchState *env)
6380 {
6381     return -TARGET_EINVAL;
6382 }
6383 
6384 static abi_long do_prctl_inval1(CPUArchState *env, abi_long arg2)
6385 {
6386     return -TARGET_EINVAL;
6387 }
6388 
6389 #ifndef do_prctl_get_fp_mode
6390 #define do_prctl_get_fp_mode do_prctl_inval0
6391 #endif
6392 #ifndef do_prctl_set_fp_mode
6393 #define do_prctl_set_fp_mode do_prctl_inval1
6394 #endif
6395 #ifndef do_prctl_sve_get_vl
6396 #define do_prctl_sve_get_vl do_prctl_inval0
6397 #endif
6398 #ifndef do_prctl_sve_set_vl
6399 #define do_prctl_sve_set_vl do_prctl_inval1
6400 #endif
6401 #ifndef do_prctl_reset_keys
6402 #define do_prctl_reset_keys do_prctl_inval1
6403 #endif
6404 #ifndef do_prctl_set_tagged_addr_ctrl
6405 #define do_prctl_set_tagged_addr_ctrl do_prctl_inval1
6406 #endif
6407 #ifndef do_prctl_get_tagged_addr_ctrl
6408 #define do_prctl_get_tagged_addr_ctrl do_prctl_inval0
6409 #endif
6410 #ifndef do_prctl_get_unalign
6411 #define do_prctl_get_unalign do_prctl_inval1
6412 #endif
6413 #ifndef do_prctl_set_unalign
6414 #define do_prctl_set_unalign do_prctl_inval1
6415 #endif
6416 #ifndef do_prctl_sme_get_vl
6417 #define do_prctl_sme_get_vl do_prctl_inval0
6418 #endif
6419 #ifndef do_prctl_sme_set_vl
6420 #define do_prctl_sme_set_vl do_prctl_inval1
6421 #endif
6422 
6423 static abi_long do_prctl(CPUArchState *env, abi_long option, abi_long arg2,
6424                          abi_long arg3, abi_long arg4, abi_long arg5)
6425 {
6426     abi_long ret;
6427 
6428     switch (option) {
6429     case PR_GET_PDEATHSIG:
6430         {
6431             int deathsig;
6432             ret = get_errno(prctl(PR_GET_PDEATHSIG, &deathsig,
6433                                   arg3, arg4, arg5));
6434             if (!is_error(ret) &&
6435                 put_user_s32(host_to_target_signal(deathsig), arg2)) {
6436                 return -TARGET_EFAULT;
6437             }
6438             return ret;
6439         }
6440     case PR_SET_PDEATHSIG:
6441         return get_errno(prctl(PR_SET_PDEATHSIG, target_to_host_signal(arg2),
6442                                arg3, arg4, arg5));
6443     case PR_GET_NAME:
6444         {
6445             void *name = lock_user(VERIFY_WRITE, arg2, 16, 1);
6446             if (!name) {
6447                 return -TARGET_EFAULT;
6448             }
6449             ret = get_errno(prctl(PR_GET_NAME, (uintptr_t)name,
6450                                   arg3, arg4, arg5));
6451             unlock_user(name, arg2, 16);
6452             return ret;
6453         }
6454     case PR_SET_NAME:
6455         {
6456             void *name = lock_user(VERIFY_READ, arg2, 16, 1);
6457             if (!name) {
6458                 return -TARGET_EFAULT;
6459             }
6460             ret = get_errno(prctl(PR_SET_NAME, (uintptr_t)name,
6461                                   arg3, arg4, arg5));
6462             unlock_user(name, arg2, 0);
6463             return ret;
6464         }
6465     case PR_GET_FP_MODE:
6466         return do_prctl_get_fp_mode(env);
6467     case PR_SET_FP_MODE:
6468         return do_prctl_set_fp_mode(env, arg2);
6469     case PR_SVE_GET_VL:
6470         return do_prctl_sve_get_vl(env);
6471     case PR_SVE_SET_VL:
6472         return do_prctl_sve_set_vl(env, arg2);
6473     case PR_SME_GET_VL:
6474         return do_prctl_sme_get_vl(env);
6475     case PR_SME_SET_VL:
6476         return do_prctl_sme_set_vl(env, arg2);
6477     case PR_PAC_RESET_KEYS:
6478         if (arg3 || arg4 || arg5) {
6479             return -TARGET_EINVAL;
6480         }
6481         return do_prctl_reset_keys(env, arg2);
6482     case PR_SET_TAGGED_ADDR_CTRL:
6483         if (arg3 || arg4 || arg5) {
6484             return -TARGET_EINVAL;
6485         }
6486         return do_prctl_set_tagged_addr_ctrl(env, arg2);
6487     case PR_GET_TAGGED_ADDR_CTRL:
6488         if (arg2 || arg3 || arg4 || arg5) {
6489             return -TARGET_EINVAL;
6490         }
6491         return do_prctl_get_tagged_addr_ctrl(env);
6492 
6493     case PR_GET_UNALIGN:
6494         return do_prctl_get_unalign(env, arg2);
6495     case PR_SET_UNALIGN:
6496         return do_prctl_set_unalign(env, arg2);
6497 
6498     case PR_CAP_AMBIENT:
6499     case PR_CAPBSET_READ:
6500     case PR_CAPBSET_DROP:
6501     case PR_GET_DUMPABLE:
6502     case PR_SET_DUMPABLE:
6503     case PR_GET_KEEPCAPS:
6504     case PR_SET_KEEPCAPS:
6505     case PR_GET_SECUREBITS:
6506     case PR_SET_SECUREBITS:
6507     case PR_GET_TIMING:
6508     case PR_SET_TIMING:
6509     case PR_GET_TIMERSLACK:
6510     case PR_SET_TIMERSLACK:
6511     case PR_MCE_KILL:
6512     case PR_MCE_KILL_GET:
6513     case PR_GET_NO_NEW_PRIVS:
6514     case PR_SET_NO_NEW_PRIVS:
6515     case PR_GET_IO_FLUSHER:
6516     case PR_SET_IO_FLUSHER:
6517         /* Some prctl options have no pointer arguments and we can pass on. */
6518         return get_errno(prctl(option, arg2, arg3, arg4, arg5));
6519 
6520     case PR_GET_CHILD_SUBREAPER:
6521     case PR_SET_CHILD_SUBREAPER:
6522     case PR_GET_SPECULATION_CTRL:
6523     case PR_SET_SPECULATION_CTRL:
6524     case PR_GET_TID_ADDRESS:
6525         /* TODO */
6526         return -TARGET_EINVAL;
6527 
6528     case PR_GET_FPEXC:
6529     case PR_SET_FPEXC:
6530         /* Was used for SPE on PowerPC. */
6531         return -TARGET_EINVAL;
6532 
6533     case PR_GET_ENDIAN:
6534     case PR_SET_ENDIAN:
6535     case PR_GET_FPEMU:
6536     case PR_SET_FPEMU:
6537     case PR_SET_MM:
6538     case PR_GET_SECCOMP:
6539     case PR_SET_SECCOMP:
6540     case PR_SET_SYSCALL_USER_DISPATCH:
6541     case PR_GET_THP_DISABLE:
6542     case PR_SET_THP_DISABLE:
6543     case PR_GET_TSC:
6544     case PR_SET_TSC:
6545         /* Disable to prevent the target disabling stuff we need. */
6546         return -TARGET_EINVAL;
6547 
6548     default:
6549         qemu_log_mask(LOG_UNIMP, "Unsupported prctl: " TARGET_ABI_FMT_ld "\n",
6550                       option);
6551         return -TARGET_EINVAL;
6552     }
6553 }
6554 
6555 #define NEW_STACK_SIZE 0x40000
6556 
6557 
6558 static pthread_mutex_t clone_lock = PTHREAD_MUTEX_INITIALIZER;
6559 typedef struct {
6560     CPUArchState *env;
6561     pthread_mutex_t mutex;
6562     pthread_cond_t cond;
6563     pthread_t thread;
6564     uint32_t tid;
6565     abi_ulong child_tidptr;
6566     abi_ulong parent_tidptr;
6567     sigset_t sigmask;
6568 } new_thread_info;
6569 
6570 static void *clone_func(void *arg)
6571 {
6572     new_thread_info *info = arg;
6573     CPUArchState *env;
6574     CPUState *cpu;
6575     TaskState *ts;
6576 
6577     rcu_register_thread();
6578     tcg_register_thread();
6579     env = info->env;
6580     cpu = env_cpu(env);
6581     thread_cpu = cpu;
6582     ts = (TaskState *)cpu->opaque;
6583     info->tid = sys_gettid();
6584     task_settid(ts);
6585     if (info->child_tidptr)
6586         put_user_u32(info->tid, info->child_tidptr);
6587     if (info->parent_tidptr)
6588         put_user_u32(info->tid, info->parent_tidptr);
6589     qemu_guest_random_seed_thread_part2(cpu->random_seed);
6590     /* Enable signals.  */
6591     sigprocmask(SIG_SETMASK, &info->sigmask, NULL);
6592     /* Signal to the parent that we're ready.  */
6593     pthread_mutex_lock(&info->mutex);
6594     pthread_cond_broadcast(&info->cond);
6595     pthread_mutex_unlock(&info->mutex);
6596     /* Wait until the parent has finished initializing the tls state.  */
6597     pthread_mutex_lock(&clone_lock);
6598     pthread_mutex_unlock(&clone_lock);
6599     cpu_loop(env);
6600     /* never exits */
6601     return NULL;
6602 }
6603 
6604 /* do_fork() Must return host values and target errnos (unlike most
6605    do_*() functions). */
6606 static int do_fork(CPUArchState *env, unsigned int flags, abi_ulong newsp,
6607                    abi_ulong parent_tidptr, target_ulong newtls,
6608                    abi_ulong child_tidptr)
6609 {
6610     CPUState *cpu = env_cpu(env);
6611     int ret;
6612     TaskState *ts;
6613     CPUState *new_cpu;
6614     CPUArchState *new_env;
6615     sigset_t sigmask;
6616 
6617     flags &= ~CLONE_IGNORED_FLAGS;
6618 
6619     /* Emulate vfork() with fork() */
6620     if (flags & CLONE_VFORK)
6621         flags &= ~(CLONE_VFORK | CLONE_VM);
6622 
6623     if (flags & CLONE_VM) {
6624         TaskState *parent_ts = (TaskState *)cpu->opaque;
6625         new_thread_info info;
6626         pthread_attr_t attr;
6627 
6628         if (((flags & CLONE_THREAD_FLAGS) != CLONE_THREAD_FLAGS) ||
6629             (flags & CLONE_INVALID_THREAD_FLAGS)) {
6630             return -TARGET_EINVAL;
6631         }
6632 
6633         ts = g_new0(TaskState, 1);
6634         init_task_state(ts);
6635 
6636         /* Grab a mutex so that thread setup appears atomic.  */
6637         pthread_mutex_lock(&clone_lock);
6638 
6639         /*
6640          * If this is our first additional thread, we need to ensure we
6641          * generate code for parallel execution and flush old translations.
6642          * Do this now so that the copy gets CF_PARALLEL too.
6643          */
6644         if (!(cpu->tcg_cflags & CF_PARALLEL)) {
6645             cpu->tcg_cflags |= CF_PARALLEL;
6646             tb_flush(cpu);
6647         }
6648 
6649         /* we create a new CPU instance. */
6650         new_env = cpu_copy(env);
6651         /* Init regs that differ from the parent.  */
6652         cpu_clone_regs_child(new_env, newsp, flags);
6653         cpu_clone_regs_parent(env, flags);
6654         new_cpu = env_cpu(new_env);
6655         new_cpu->opaque = ts;
6656         ts->bprm = parent_ts->bprm;
6657         ts->info = parent_ts->info;
6658         ts->signal_mask = parent_ts->signal_mask;
6659 
6660         if (flags & CLONE_CHILD_CLEARTID) {
6661             ts->child_tidptr = child_tidptr;
6662         }
6663 
6664         if (flags & CLONE_SETTLS) {
6665             cpu_set_tls (new_env, newtls);
6666         }
6667 
6668         memset(&info, 0, sizeof(info));
6669         pthread_mutex_init(&info.mutex, NULL);
6670         pthread_mutex_lock(&info.mutex);
6671         pthread_cond_init(&info.cond, NULL);
6672         info.env = new_env;
6673         if (flags & CLONE_CHILD_SETTID) {
6674             info.child_tidptr = child_tidptr;
6675         }
6676         if (flags & CLONE_PARENT_SETTID) {
6677             info.parent_tidptr = parent_tidptr;
6678         }
6679 
6680         ret = pthread_attr_init(&attr);
6681         ret = pthread_attr_setstacksize(&attr, NEW_STACK_SIZE);
6682         ret = pthread_attr_setdetachstate(&attr, PTHREAD_CREATE_DETACHED);
6683         /* It is not safe to deliver signals until the child has finished
6684            initializing, so temporarily block all signals.  */
6685         sigfillset(&sigmask);
6686         sigprocmask(SIG_BLOCK, &sigmask, &info.sigmask);
6687         cpu->random_seed = qemu_guest_random_seed_thread_part1();
6688 
6689         ret = pthread_create(&info.thread, &attr, clone_func, &info);
6690         /* TODO: Free new CPU state if thread creation failed.  */
6691 
6692         sigprocmask(SIG_SETMASK, &info.sigmask, NULL);
6693         pthread_attr_destroy(&attr);
6694         if (ret == 0) {
6695             /* Wait for the child to initialize.  */
6696             pthread_cond_wait(&info.cond, &info.mutex);
6697             ret = info.tid;
6698         } else {
6699             ret = -1;
6700         }
6701         pthread_mutex_unlock(&info.mutex);
6702         pthread_cond_destroy(&info.cond);
6703         pthread_mutex_destroy(&info.mutex);
6704         pthread_mutex_unlock(&clone_lock);
6705     } else {
6706         /* if no CLONE_VM, we consider it is a fork */
6707         if (flags & CLONE_INVALID_FORK_FLAGS) {
6708             return -TARGET_EINVAL;
6709         }
6710 
6711         /* We can't support custom termination signals */
6712         if ((flags & CSIGNAL) != TARGET_SIGCHLD) {
6713             return -TARGET_EINVAL;
6714         }
6715 
6716         if (block_signals()) {
6717             return -QEMU_ERESTARTSYS;
6718         }
6719 
6720         fork_start();
6721         ret = fork();
6722         if (ret == 0) {
6723             /* Child Process.  */
6724             cpu_clone_regs_child(env, newsp, flags);
6725             fork_end(1);
6726             /* There is a race condition here.  The parent process could
6727                theoretically read the TID in the child process before the child
6728                tid is set.  This would require using either ptrace
6729                (not implemented) or having *_tidptr to point at a shared memory
6730                mapping.  We can't repeat the spinlock hack used above because
6731                the child process gets its own copy of the lock.  */
6732             if (flags & CLONE_CHILD_SETTID)
6733                 put_user_u32(sys_gettid(), child_tidptr);
6734             if (flags & CLONE_PARENT_SETTID)
6735                 put_user_u32(sys_gettid(), parent_tidptr);
6736             ts = (TaskState *)cpu->opaque;
6737             if (flags & CLONE_SETTLS)
6738                 cpu_set_tls (env, newtls);
6739             if (flags & CLONE_CHILD_CLEARTID)
6740                 ts->child_tidptr = child_tidptr;
6741         } else {
6742             cpu_clone_regs_parent(env, flags);
6743             fork_end(0);
6744         }
6745     }
6746     return ret;
6747 }
6748 
6749 /* warning : doesn't handle linux specific flags... */
6750 static int target_to_host_fcntl_cmd(int cmd)
6751 {
6752     int ret;
6753 
6754     switch(cmd) {
6755     case TARGET_F_DUPFD:
6756     case TARGET_F_GETFD:
6757     case TARGET_F_SETFD:
6758     case TARGET_F_GETFL:
6759     case TARGET_F_SETFL:
6760     case TARGET_F_OFD_GETLK:
6761     case TARGET_F_OFD_SETLK:
6762     case TARGET_F_OFD_SETLKW:
6763         ret = cmd;
6764         break;
6765     case TARGET_F_GETLK:
6766         ret = F_GETLK64;
6767         break;
6768     case TARGET_F_SETLK:
6769         ret = F_SETLK64;
6770         break;
6771     case TARGET_F_SETLKW:
6772         ret = F_SETLKW64;
6773         break;
6774     case TARGET_F_GETOWN:
6775         ret = F_GETOWN;
6776         break;
6777     case TARGET_F_SETOWN:
6778         ret = F_SETOWN;
6779         break;
6780     case TARGET_F_GETSIG:
6781         ret = F_GETSIG;
6782         break;
6783     case TARGET_F_SETSIG:
6784         ret = F_SETSIG;
6785         break;
6786 #if TARGET_ABI_BITS == 32
6787     case TARGET_F_GETLK64:
6788         ret = F_GETLK64;
6789         break;
6790     case TARGET_F_SETLK64:
6791         ret = F_SETLK64;
6792         break;
6793     case TARGET_F_SETLKW64:
6794         ret = F_SETLKW64;
6795         break;
6796 #endif
6797     case TARGET_F_SETLEASE:
6798         ret = F_SETLEASE;
6799         break;
6800     case TARGET_F_GETLEASE:
6801         ret = F_GETLEASE;
6802         break;
6803 #ifdef F_DUPFD_CLOEXEC
6804     case TARGET_F_DUPFD_CLOEXEC:
6805         ret = F_DUPFD_CLOEXEC;
6806         break;
6807 #endif
6808     case TARGET_F_NOTIFY:
6809         ret = F_NOTIFY;
6810         break;
6811 #ifdef F_GETOWN_EX
6812     case TARGET_F_GETOWN_EX:
6813         ret = F_GETOWN_EX;
6814         break;
6815 #endif
6816 #ifdef F_SETOWN_EX
6817     case TARGET_F_SETOWN_EX:
6818         ret = F_SETOWN_EX;
6819         break;
6820 #endif
6821 #ifdef F_SETPIPE_SZ
6822     case TARGET_F_SETPIPE_SZ:
6823         ret = F_SETPIPE_SZ;
6824         break;
6825     case TARGET_F_GETPIPE_SZ:
6826         ret = F_GETPIPE_SZ;
6827         break;
6828 #endif
6829 #ifdef F_ADD_SEALS
6830     case TARGET_F_ADD_SEALS:
6831         ret = F_ADD_SEALS;
6832         break;
6833     case TARGET_F_GET_SEALS:
6834         ret = F_GET_SEALS;
6835         break;
6836 #endif
6837     default:
6838         ret = -TARGET_EINVAL;
6839         break;
6840     }
6841 
6842 #if defined(__powerpc64__)
6843     /* On PPC64, glibc headers has the F_*LK* defined to 12, 13 and 14 and
6844      * is not supported by kernel. The glibc fcntl call actually adjusts
6845      * them to 5, 6 and 7 before making the syscall(). Since we make the
6846      * syscall directly, adjust to what is supported by the kernel.
6847      */
6848     if (ret >= F_GETLK64 && ret <= F_SETLKW64) {
6849         ret -= F_GETLK64 - 5;
6850     }
6851 #endif
6852 
6853     return ret;
6854 }
6855 
6856 #define FLOCK_TRANSTBL \
6857     switch (type) { \
6858     TRANSTBL_CONVERT(F_RDLCK); \
6859     TRANSTBL_CONVERT(F_WRLCK); \
6860     TRANSTBL_CONVERT(F_UNLCK); \
6861     }
6862 
6863 static int target_to_host_flock(int type)
6864 {
6865 #define TRANSTBL_CONVERT(a) case TARGET_##a: return a
6866     FLOCK_TRANSTBL
6867 #undef  TRANSTBL_CONVERT
6868     return -TARGET_EINVAL;
6869 }
6870 
6871 static int host_to_target_flock(int type)
6872 {
6873 #define TRANSTBL_CONVERT(a) case a: return TARGET_##a
6874     FLOCK_TRANSTBL
6875 #undef  TRANSTBL_CONVERT
6876     /* if we don't know how to convert the value coming
6877      * from the host we copy to the target field as-is
6878      */
6879     return type;
6880 }
6881 
6882 static inline abi_long copy_from_user_flock(struct flock64 *fl,
6883                                             abi_ulong target_flock_addr)
6884 {
6885     struct target_flock *target_fl;
6886     int l_type;
6887 
6888     if (!lock_user_struct(VERIFY_READ, target_fl, target_flock_addr, 1)) {
6889         return -TARGET_EFAULT;
6890     }
6891 
6892     __get_user(l_type, &target_fl->l_type);
6893     l_type = target_to_host_flock(l_type);
6894     if (l_type < 0) {
6895         return l_type;
6896     }
6897     fl->l_type = l_type;
6898     __get_user(fl->l_whence, &target_fl->l_whence);
6899     __get_user(fl->l_start, &target_fl->l_start);
6900     __get_user(fl->l_len, &target_fl->l_len);
6901     __get_user(fl->l_pid, &target_fl->l_pid);
6902     unlock_user_struct(target_fl, target_flock_addr, 0);
6903     return 0;
6904 }
6905 
6906 static inline abi_long copy_to_user_flock(abi_ulong target_flock_addr,
6907                                           const struct flock64 *fl)
6908 {
6909     struct target_flock *target_fl;
6910     short l_type;
6911 
6912     if (!lock_user_struct(VERIFY_WRITE, target_fl, target_flock_addr, 0)) {
6913         return -TARGET_EFAULT;
6914     }
6915 
6916     l_type = host_to_target_flock(fl->l_type);
6917     __put_user(l_type, &target_fl->l_type);
6918     __put_user(fl->l_whence, &target_fl->l_whence);
6919     __put_user(fl->l_start, &target_fl->l_start);
6920     __put_user(fl->l_len, &target_fl->l_len);
6921     __put_user(fl->l_pid, &target_fl->l_pid);
6922     unlock_user_struct(target_fl, target_flock_addr, 1);
6923     return 0;
6924 }
6925 
6926 typedef abi_long from_flock64_fn(struct flock64 *fl, abi_ulong target_addr);
6927 typedef abi_long to_flock64_fn(abi_ulong target_addr, const struct flock64 *fl);
6928 
6929 #if defined(TARGET_ARM) && TARGET_ABI_BITS == 32
6930 struct target_oabi_flock64 {
6931     abi_short l_type;
6932     abi_short l_whence;
6933     abi_llong l_start;
6934     abi_llong l_len;
6935     abi_int   l_pid;
6936 } QEMU_PACKED;
6937 
6938 static inline abi_long copy_from_user_oabi_flock64(struct flock64 *fl,
6939                                                    abi_ulong target_flock_addr)
6940 {
6941     struct target_oabi_flock64 *target_fl;
6942     int l_type;
6943 
6944     if (!lock_user_struct(VERIFY_READ, target_fl, target_flock_addr, 1)) {
6945         return -TARGET_EFAULT;
6946     }
6947 
6948     __get_user(l_type, &target_fl->l_type);
6949     l_type = target_to_host_flock(l_type);
6950     if (l_type < 0) {
6951         return l_type;
6952     }
6953     fl->l_type = l_type;
6954     __get_user(fl->l_whence, &target_fl->l_whence);
6955     __get_user(fl->l_start, &target_fl->l_start);
6956     __get_user(fl->l_len, &target_fl->l_len);
6957     __get_user(fl->l_pid, &target_fl->l_pid);
6958     unlock_user_struct(target_fl, target_flock_addr, 0);
6959     return 0;
6960 }
6961 
6962 static inline abi_long copy_to_user_oabi_flock64(abi_ulong target_flock_addr,
6963                                                  const struct flock64 *fl)
6964 {
6965     struct target_oabi_flock64 *target_fl;
6966     short l_type;
6967 
6968     if (!lock_user_struct(VERIFY_WRITE, target_fl, target_flock_addr, 0)) {
6969         return -TARGET_EFAULT;
6970     }
6971 
6972     l_type = host_to_target_flock(fl->l_type);
6973     __put_user(l_type, &target_fl->l_type);
6974     __put_user(fl->l_whence, &target_fl->l_whence);
6975     __put_user(fl->l_start, &target_fl->l_start);
6976     __put_user(fl->l_len, &target_fl->l_len);
6977     __put_user(fl->l_pid, &target_fl->l_pid);
6978     unlock_user_struct(target_fl, target_flock_addr, 1);
6979     return 0;
6980 }
6981 #endif
6982 
6983 static inline abi_long copy_from_user_flock64(struct flock64 *fl,
6984                                               abi_ulong target_flock_addr)
6985 {
6986     struct target_flock64 *target_fl;
6987     int l_type;
6988 
6989     if (!lock_user_struct(VERIFY_READ, target_fl, target_flock_addr, 1)) {
6990         return -TARGET_EFAULT;
6991     }
6992 
6993     __get_user(l_type, &target_fl->l_type);
6994     l_type = target_to_host_flock(l_type);
6995     if (l_type < 0) {
6996         return l_type;
6997     }
6998     fl->l_type = l_type;
6999     __get_user(fl->l_whence, &target_fl->l_whence);
7000     __get_user(fl->l_start, &target_fl->l_start);
7001     __get_user(fl->l_len, &target_fl->l_len);
7002     __get_user(fl->l_pid, &target_fl->l_pid);
7003     unlock_user_struct(target_fl, target_flock_addr, 0);
7004     return 0;
7005 }
7006 
7007 static inline abi_long copy_to_user_flock64(abi_ulong target_flock_addr,
7008                                             const struct flock64 *fl)
7009 {
7010     struct target_flock64 *target_fl;
7011     short l_type;
7012 
7013     if (!lock_user_struct(VERIFY_WRITE, target_fl, target_flock_addr, 0)) {
7014         return -TARGET_EFAULT;
7015     }
7016 
7017     l_type = host_to_target_flock(fl->l_type);
7018     __put_user(l_type, &target_fl->l_type);
7019     __put_user(fl->l_whence, &target_fl->l_whence);
7020     __put_user(fl->l_start, &target_fl->l_start);
7021     __put_user(fl->l_len, &target_fl->l_len);
7022     __put_user(fl->l_pid, &target_fl->l_pid);
7023     unlock_user_struct(target_fl, target_flock_addr, 1);
7024     return 0;
7025 }
7026 
7027 static abi_long do_fcntl(int fd, int cmd, abi_ulong arg)
7028 {
7029     struct flock64 fl64;
7030 #ifdef F_GETOWN_EX
7031     struct f_owner_ex fox;
7032     struct target_f_owner_ex *target_fox;
7033 #endif
7034     abi_long ret;
7035     int host_cmd = target_to_host_fcntl_cmd(cmd);
7036 
7037     if (host_cmd == -TARGET_EINVAL)
7038 	    return host_cmd;
7039 
7040     switch(cmd) {
7041     case TARGET_F_GETLK:
7042         ret = copy_from_user_flock(&fl64, arg);
7043         if (ret) {
7044             return ret;
7045         }
7046         ret = get_errno(safe_fcntl(fd, host_cmd, &fl64));
7047         if (ret == 0) {
7048             ret = copy_to_user_flock(arg, &fl64);
7049         }
7050         break;
7051 
7052     case TARGET_F_SETLK:
7053     case TARGET_F_SETLKW:
7054         ret = copy_from_user_flock(&fl64, arg);
7055         if (ret) {
7056             return ret;
7057         }
7058         ret = get_errno(safe_fcntl(fd, host_cmd, &fl64));
7059         break;
7060 
7061     case TARGET_F_GETLK64:
7062     case TARGET_F_OFD_GETLK:
7063         ret = copy_from_user_flock64(&fl64, arg);
7064         if (ret) {
7065             return ret;
7066         }
7067         ret = get_errno(safe_fcntl(fd, host_cmd, &fl64));
7068         if (ret == 0) {
7069             ret = copy_to_user_flock64(arg, &fl64);
7070         }
7071         break;
7072     case TARGET_F_SETLK64:
7073     case TARGET_F_SETLKW64:
7074     case TARGET_F_OFD_SETLK:
7075     case TARGET_F_OFD_SETLKW:
7076         ret = copy_from_user_flock64(&fl64, arg);
7077         if (ret) {
7078             return ret;
7079         }
7080         ret = get_errno(safe_fcntl(fd, host_cmd, &fl64));
7081         break;
7082 
7083     case TARGET_F_GETFL:
7084         ret = get_errno(safe_fcntl(fd, host_cmd, arg));
7085         if (ret >= 0) {
7086             ret = host_to_target_bitmask(ret, fcntl_flags_tbl);
7087         }
7088         break;
7089 
7090     case TARGET_F_SETFL:
7091         ret = get_errno(safe_fcntl(fd, host_cmd,
7092                                    target_to_host_bitmask(arg,
7093                                                           fcntl_flags_tbl)));
7094         break;
7095 
7096 #ifdef F_GETOWN_EX
7097     case TARGET_F_GETOWN_EX:
7098         ret = get_errno(safe_fcntl(fd, host_cmd, &fox));
7099         if (ret >= 0) {
7100             if (!lock_user_struct(VERIFY_WRITE, target_fox, arg, 0))
7101                 return -TARGET_EFAULT;
7102             target_fox->type = tswap32(fox.type);
7103             target_fox->pid = tswap32(fox.pid);
7104             unlock_user_struct(target_fox, arg, 1);
7105         }
7106         break;
7107 #endif
7108 
7109 #ifdef F_SETOWN_EX
7110     case TARGET_F_SETOWN_EX:
7111         if (!lock_user_struct(VERIFY_READ, target_fox, arg, 1))
7112             return -TARGET_EFAULT;
7113         fox.type = tswap32(target_fox->type);
7114         fox.pid = tswap32(target_fox->pid);
7115         unlock_user_struct(target_fox, arg, 0);
7116         ret = get_errno(safe_fcntl(fd, host_cmd, &fox));
7117         break;
7118 #endif
7119 
7120     case TARGET_F_SETSIG:
7121         ret = get_errno(safe_fcntl(fd, host_cmd, target_to_host_signal(arg)));
7122         break;
7123 
7124     case TARGET_F_GETSIG:
7125         ret = host_to_target_signal(get_errno(safe_fcntl(fd, host_cmd, arg)));
7126         break;
7127 
7128     case TARGET_F_SETOWN:
7129     case TARGET_F_GETOWN:
7130     case TARGET_F_SETLEASE:
7131     case TARGET_F_GETLEASE:
7132     case TARGET_F_SETPIPE_SZ:
7133     case TARGET_F_GETPIPE_SZ:
7134     case TARGET_F_ADD_SEALS:
7135     case TARGET_F_GET_SEALS:
7136         ret = get_errno(safe_fcntl(fd, host_cmd, arg));
7137         break;
7138 
7139     default:
7140         ret = get_errno(safe_fcntl(fd, cmd, arg));
7141         break;
7142     }
7143     return ret;
7144 }
7145 
7146 #ifdef USE_UID16
7147 
7148 static inline int high2lowuid(int uid)
7149 {
7150     if (uid > 65535)
7151         return 65534;
7152     else
7153         return uid;
7154 }
7155 
7156 static inline int high2lowgid(int gid)
7157 {
7158     if (gid > 65535)
7159         return 65534;
7160     else
7161         return gid;
7162 }
7163 
7164 static inline int low2highuid(int uid)
7165 {
7166     if ((int16_t)uid == -1)
7167         return -1;
7168     else
7169         return uid;
7170 }
7171 
7172 static inline int low2highgid(int gid)
7173 {
7174     if ((int16_t)gid == -1)
7175         return -1;
7176     else
7177         return gid;
7178 }
7179 static inline int tswapid(int id)
7180 {
7181     return tswap16(id);
7182 }
7183 
7184 #define put_user_id(x, gaddr) put_user_u16(x, gaddr)
7185 
7186 #else /* !USE_UID16 */
7187 static inline int high2lowuid(int uid)
7188 {
7189     return uid;
7190 }
7191 static inline int high2lowgid(int gid)
7192 {
7193     return gid;
7194 }
7195 static inline int low2highuid(int uid)
7196 {
7197     return uid;
7198 }
7199 static inline int low2highgid(int gid)
7200 {
7201     return gid;
7202 }
7203 static inline int tswapid(int id)
7204 {
7205     return tswap32(id);
7206 }
7207 
7208 #define put_user_id(x, gaddr) put_user_u32(x, gaddr)
7209 
7210 #endif /* USE_UID16 */
7211 
7212 /* We must do direct syscalls for setting UID/GID, because we want to
7213  * implement the Linux system call semantics of "change only for this thread",
7214  * not the libc/POSIX semantics of "change for all threads in process".
7215  * (See http://ewontfix.com/17/ for more details.)
7216  * We use the 32-bit version of the syscalls if present; if it is not
7217  * then either the host architecture supports 32-bit UIDs natively with
7218  * the standard syscall, or the 16-bit UID is the best we can do.
7219  */
7220 #ifdef __NR_setuid32
7221 #define __NR_sys_setuid __NR_setuid32
7222 #else
7223 #define __NR_sys_setuid __NR_setuid
7224 #endif
7225 #ifdef __NR_setgid32
7226 #define __NR_sys_setgid __NR_setgid32
7227 #else
7228 #define __NR_sys_setgid __NR_setgid
7229 #endif
7230 #ifdef __NR_setresuid32
7231 #define __NR_sys_setresuid __NR_setresuid32
7232 #else
7233 #define __NR_sys_setresuid __NR_setresuid
7234 #endif
7235 #ifdef __NR_setresgid32
7236 #define __NR_sys_setresgid __NR_setresgid32
7237 #else
7238 #define __NR_sys_setresgid __NR_setresgid
7239 #endif
7240 
7241 _syscall1(int, sys_setuid, uid_t, uid)
7242 _syscall1(int, sys_setgid, gid_t, gid)
7243 _syscall3(int, sys_setresuid, uid_t, ruid, uid_t, euid, uid_t, suid)
7244 _syscall3(int, sys_setresgid, gid_t, rgid, gid_t, egid, gid_t, sgid)
7245 
7246 void syscall_init(void)
7247 {
7248     IOCTLEntry *ie;
7249     const argtype *arg_type;
7250     int size;
7251 
7252     thunk_init(STRUCT_MAX);
7253 
7254 #define STRUCT(name, ...) thunk_register_struct(STRUCT_ ## name, #name, struct_ ## name ## _def);
7255 #define STRUCT_SPECIAL(name) thunk_register_struct_direct(STRUCT_ ## name, #name, &struct_ ## name ## _def);
7256 #include "syscall_types.h"
7257 #undef STRUCT
7258 #undef STRUCT_SPECIAL
7259 
7260     /* we patch the ioctl size if necessary. We rely on the fact that
7261        no ioctl has all the bits at '1' in the size field */
7262     ie = ioctl_entries;
7263     while (ie->target_cmd != 0) {
7264         if (((ie->target_cmd >> TARGET_IOC_SIZESHIFT) & TARGET_IOC_SIZEMASK) ==
7265             TARGET_IOC_SIZEMASK) {
7266             arg_type = ie->arg_type;
7267             if (arg_type[0] != TYPE_PTR) {
7268                 fprintf(stderr, "cannot patch size for ioctl 0x%x\n",
7269                         ie->target_cmd);
7270                 exit(1);
7271             }
7272             arg_type++;
7273             size = thunk_type_size(arg_type, 0);
7274             ie->target_cmd = (ie->target_cmd &
7275                               ~(TARGET_IOC_SIZEMASK << TARGET_IOC_SIZESHIFT)) |
7276                 (size << TARGET_IOC_SIZESHIFT);
7277         }
7278 
7279         /* automatic consistency check if same arch */
7280 #if (defined(__i386__) && defined(TARGET_I386) && defined(TARGET_ABI32)) || \
7281     (defined(__x86_64__) && defined(TARGET_X86_64))
7282         if (unlikely(ie->target_cmd != ie->host_cmd)) {
7283             fprintf(stderr, "ERROR: ioctl(%s): target=0x%x host=0x%x\n",
7284                     ie->name, ie->target_cmd, ie->host_cmd);
7285         }
7286 #endif
7287         ie++;
7288     }
7289 }
7290 
7291 #ifdef TARGET_NR_truncate64
7292 static inline abi_long target_truncate64(CPUArchState *cpu_env, const char *arg1,
7293                                          abi_long arg2,
7294                                          abi_long arg3,
7295                                          abi_long arg4)
7296 {
7297     if (regpairs_aligned(cpu_env, TARGET_NR_truncate64)) {
7298         arg2 = arg3;
7299         arg3 = arg4;
7300     }
7301     return get_errno(truncate64(arg1, target_offset64(arg2, arg3)));
7302 }
7303 #endif
7304 
7305 #ifdef TARGET_NR_ftruncate64
7306 static inline abi_long target_ftruncate64(CPUArchState *cpu_env, abi_long arg1,
7307                                           abi_long arg2,
7308                                           abi_long arg3,
7309                                           abi_long arg4)
7310 {
7311     if (regpairs_aligned(cpu_env, TARGET_NR_ftruncate64)) {
7312         arg2 = arg3;
7313         arg3 = arg4;
7314     }
7315     return get_errno(ftruncate64(arg1, target_offset64(arg2, arg3)));
7316 }
7317 #endif
7318 
7319 #if defined(TARGET_NR_timer_settime) || \
7320     (defined(TARGET_NR_timerfd_settime) && defined(CONFIG_TIMERFD))
7321 static inline abi_long target_to_host_itimerspec(struct itimerspec *host_its,
7322                                                  abi_ulong target_addr)
7323 {
7324     if (target_to_host_timespec(&host_its->it_interval, target_addr +
7325                                 offsetof(struct target_itimerspec,
7326                                          it_interval)) ||
7327         target_to_host_timespec(&host_its->it_value, target_addr +
7328                                 offsetof(struct target_itimerspec,
7329                                          it_value))) {
7330         return -TARGET_EFAULT;
7331     }
7332 
7333     return 0;
7334 }
7335 #endif
7336 
7337 #if defined(TARGET_NR_timer_settime64) || \
7338     (defined(TARGET_NR_timerfd_settime64) && defined(CONFIG_TIMERFD))
7339 static inline abi_long target_to_host_itimerspec64(struct itimerspec *host_its,
7340                                                    abi_ulong target_addr)
7341 {
7342     if (target_to_host_timespec64(&host_its->it_interval, target_addr +
7343                                   offsetof(struct target__kernel_itimerspec,
7344                                            it_interval)) ||
7345         target_to_host_timespec64(&host_its->it_value, target_addr +
7346                                   offsetof(struct target__kernel_itimerspec,
7347                                            it_value))) {
7348         return -TARGET_EFAULT;
7349     }
7350 
7351     return 0;
7352 }
7353 #endif
7354 
7355 #if ((defined(TARGET_NR_timerfd_gettime) || \
7356       defined(TARGET_NR_timerfd_settime)) && defined(CONFIG_TIMERFD)) || \
7357       defined(TARGET_NR_timer_gettime) || defined(TARGET_NR_timer_settime)
7358 static inline abi_long host_to_target_itimerspec(abi_ulong target_addr,
7359                                                  struct itimerspec *host_its)
7360 {
7361     if (host_to_target_timespec(target_addr + offsetof(struct target_itimerspec,
7362                                                        it_interval),
7363                                 &host_its->it_interval) ||
7364         host_to_target_timespec(target_addr + offsetof(struct target_itimerspec,
7365                                                        it_value),
7366                                 &host_its->it_value)) {
7367         return -TARGET_EFAULT;
7368     }
7369     return 0;
7370 }
7371 #endif
7372 
7373 #if ((defined(TARGET_NR_timerfd_gettime64) || \
7374       defined(TARGET_NR_timerfd_settime64)) && defined(CONFIG_TIMERFD)) || \
7375       defined(TARGET_NR_timer_gettime64) || defined(TARGET_NR_timer_settime64)
7376 static inline abi_long host_to_target_itimerspec64(abi_ulong target_addr,
7377                                                    struct itimerspec *host_its)
7378 {
7379     if (host_to_target_timespec64(target_addr +
7380                                   offsetof(struct target__kernel_itimerspec,
7381                                            it_interval),
7382                                   &host_its->it_interval) ||
7383         host_to_target_timespec64(target_addr +
7384                                   offsetof(struct target__kernel_itimerspec,
7385                                            it_value),
7386                                   &host_its->it_value)) {
7387         return -TARGET_EFAULT;
7388     }
7389     return 0;
7390 }
7391 #endif
7392 
7393 #if defined(TARGET_NR_adjtimex) || \
7394     (defined(TARGET_NR_clock_adjtime) && defined(CONFIG_CLOCK_ADJTIME))
7395 static inline abi_long target_to_host_timex(struct timex *host_tx,
7396                                             abi_long target_addr)
7397 {
7398     struct target_timex *target_tx;
7399 
7400     if (!lock_user_struct(VERIFY_READ, target_tx, target_addr, 1)) {
7401         return -TARGET_EFAULT;
7402     }
7403 
7404     __get_user(host_tx->modes, &target_tx->modes);
7405     __get_user(host_tx->offset, &target_tx->offset);
7406     __get_user(host_tx->freq, &target_tx->freq);
7407     __get_user(host_tx->maxerror, &target_tx->maxerror);
7408     __get_user(host_tx->esterror, &target_tx->esterror);
7409     __get_user(host_tx->status, &target_tx->status);
7410     __get_user(host_tx->constant, &target_tx->constant);
7411     __get_user(host_tx->precision, &target_tx->precision);
7412     __get_user(host_tx->tolerance, &target_tx->tolerance);
7413     __get_user(host_tx->time.tv_sec, &target_tx->time.tv_sec);
7414     __get_user(host_tx->time.tv_usec, &target_tx->time.tv_usec);
7415     __get_user(host_tx->tick, &target_tx->tick);
7416     __get_user(host_tx->ppsfreq, &target_tx->ppsfreq);
7417     __get_user(host_tx->jitter, &target_tx->jitter);
7418     __get_user(host_tx->shift, &target_tx->shift);
7419     __get_user(host_tx->stabil, &target_tx->stabil);
7420     __get_user(host_tx->jitcnt, &target_tx->jitcnt);
7421     __get_user(host_tx->calcnt, &target_tx->calcnt);
7422     __get_user(host_tx->errcnt, &target_tx->errcnt);
7423     __get_user(host_tx->stbcnt, &target_tx->stbcnt);
7424     __get_user(host_tx->tai, &target_tx->tai);
7425 
7426     unlock_user_struct(target_tx, target_addr, 0);
7427     return 0;
7428 }
7429 
7430 static inline abi_long host_to_target_timex(abi_long target_addr,
7431                                             struct timex *host_tx)
7432 {
7433     struct target_timex *target_tx;
7434 
7435     if (!lock_user_struct(VERIFY_WRITE, target_tx, target_addr, 0)) {
7436         return -TARGET_EFAULT;
7437     }
7438 
7439     __put_user(host_tx->modes, &target_tx->modes);
7440     __put_user(host_tx->offset, &target_tx->offset);
7441     __put_user(host_tx->freq, &target_tx->freq);
7442     __put_user(host_tx->maxerror, &target_tx->maxerror);
7443     __put_user(host_tx->esterror, &target_tx->esterror);
7444     __put_user(host_tx->status, &target_tx->status);
7445     __put_user(host_tx->constant, &target_tx->constant);
7446     __put_user(host_tx->precision, &target_tx->precision);
7447     __put_user(host_tx->tolerance, &target_tx->tolerance);
7448     __put_user(host_tx->time.tv_sec, &target_tx->time.tv_sec);
7449     __put_user(host_tx->time.tv_usec, &target_tx->time.tv_usec);
7450     __put_user(host_tx->tick, &target_tx->tick);
7451     __put_user(host_tx->ppsfreq, &target_tx->ppsfreq);
7452     __put_user(host_tx->jitter, &target_tx->jitter);
7453     __put_user(host_tx->shift, &target_tx->shift);
7454     __put_user(host_tx->stabil, &target_tx->stabil);
7455     __put_user(host_tx->jitcnt, &target_tx->jitcnt);
7456     __put_user(host_tx->calcnt, &target_tx->calcnt);
7457     __put_user(host_tx->errcnt, &target_tx->errcnt);
7458     __put_user(host_tx->stbcnt, &target_tx->stbcnt);
7459     __put_user(host_tx->tai, &target_tx->tai);
7460 
7461     unlock_user_struct(target_tx, target_addr, 1);
7462     return 0;
7463 }
7464 #endif
7465 
7466 
7467 #if defined(TARGET_NR_clock_adjtime64) && defined(CONFIG_CLOCK_ADJTIME)
7468 static inline abi_long target_to_host_timex64(struct timex *host_tx,
7469                                               abi_long target_addr)
7470 {
7471     struct target__kernel_timex *target_tx;
7472 
7473     if (copy_from_user_timeval64(&host_tx->time, target_addr +
7474                                  offsetof(struct target__kernel_timex,
7475                                           time))) {
7476         return -TARGET_EFAULT;
7477     }
7478 
7479     if (!lock_user_struct(VERIFY_READ, target_tx, target_addr, 1)) {
7480         return -TARGET_EFAULT;
7481     }
7482 
7483     __get_user(host_tx->modes, &target_tx->modes);
7484     __get_user(host_tx->offset, &target_tx->offset);
7485     __get_user(host_tx->freq, &target_tx->freq);
7486     __get_user(host_tx->maxerror, &target_tx->maxerror);
7487     __get_user(host_tx->esterror, &target_tx->esterror);
7488     __get_user(host_tx->status, &target_tx->status);
7489     __get_user(host_tx->constant, &target_tx->constant);
7490     __get_user(host_tx->precision, &target_tx->precision);
7491     __get_user(host_tx->tolerance, &target_tx->tolerance);
7492     __get_user(host_tx->tick, &target_tx->tick);
7493     __get_user(host_tx->ppsfreq, &target_tx->ppsfreq);
7494     __get_user(host_tx->jitter, &target_tx->jitter);
7495     __get_user(host_tx->shift, &target_tx->shift);
7496     __get_user(host_tx->stabil, &target_tx->stabil);
7497     __get_user(host_tx->jitcnt, &target_tx->jitcnt);
7498     __get_user(host_tx->calcnt, &target_tx->calcnt);
7499     __get_user(host_tx->errcnt, &target_tx->errcnt);
7500     __get_user(host_tx->stbcnt, &target_tx->stbcnt);
7501     __get_user(host_tx->tai, &target_tx->tai);
7502 
7503     unlock_user_struct(target_tx, target_addr, 0);
7504     return 0;
7505 }
7506 
7507 static inline abi_long host_to_target_timex64(abi_long target_addr,
7508                                               struct timex *host_tx)
7509 {
7510     struct target__kernel_timex *target_tx;
7511 
7512    if (copy_to_user_timeval64(target_addr +
7513                               offsetof(struct target__kernel_timex, time),
7514                               &host_tx->time)) {
7515         return -TARGET_EFAULT;
7516     }
7517 
7518     if (!lock_user_struct(VERIFY_WRITE, target_tx, target_addr, 0)) {
7519         return -TARGET_EFAULT;
7520     }
7521 
7522     __put_user(host_tx->modes, &target_tx->modes);
7523     __put_user(host_tx->offset, &target_tx->offset);
7524     __put_user(host_tx->freq, &target_tx->freq);
7525     __put_user(host_tx->maxerror, &target_tx->maxerror);
7526     __put_user(host_tx->esterror, &target_tx->esterror);
7527     __put_user(host_tx->status, &target_tx->status);
7528     __put_user(host_tx->constant, &target_tx->constant);
7529     __put_user(host_tx->precision, &target_tx->precision);
7530     __put_user(host_tx->tolerance, &target_tx->tolerance);
7531     __put_user(host_tx->tick, &target_tx->tick);
7532     __put_user(host_tx->ppsfreq, &target_tx->ppsfreq);
7533     __put_user(host_tx->jitter, &target_tx->jitter);
7534     __put_user(host_tx->shift, &target_tx->shift);
7535     __put_user(host_tx->stabil, &target_tx->stabil);
7536     __put_user(host_tx->jitcnt, &target_tx->jitcnt);
7537     __put_user(host_tx->calcnt, &target_tx->calcnt);
7538     __put_user(host_tx->errcnt, &target_tx->errcnt);
7539     __put_user(host_tx->stbcnt, &target_tx->stbcnt);
7540     __put_user(host_tx->tai, &target_tx->tai);
7541 
7542     unlock_user_struct(target_tx, target_addr, 1);
7543     return 0;
7544 }
7545 #endif
7546 
7547 #ifndef HAVE_SIGEV_NOTIFY_THREAD_ID
7548 #define sigev_notify_thread_id _sigev_un._tid
7549 #endif
7550 
7551 static inline abi_long target_to_host_sigevent(struct sigevent *host_sevp,
7552                                                abi_ulong target_addr)
7553 {
7554     struct target_sigevent *target_sevp;
7555 
7556     if (!lock_user_struct(VERIFY_READ, target_sevp, target_addr, 1)) {
7557         return -TARGET_EFAULT;
7558     }
7559 
7560     /* This union is awkward on 64 bit systems because it has a 32 bit
7561      * integer and a pointer in it; we follow the conversion approach
7562      * used for handling sigval types in signal.c so the guest should get
7563      * the correct value back even if we did a 64 bit byteswap and it's
7564      * using the 32 bit integer.
7565      */
7566     host_sevp->sigev_value.sival_ptr =
7567         (void *)(uintptr_t)tswapal(target_sevp->sigev_value.sival_ptr);
7568     host_sevp->sigev_signo =
7569         target_to_host_signal(tswap32(target_sevp->sigev_signo));
7570     host_sevp->sigev_notify = tswap32(target_sevp->sigev_notify);
7571     host_sevp->sigev_notify_thread_id = tswap32(target_sevp->_sigev_un._tid);
7572 
7573     unlock_user_struct(target_sevp, target_addr, 1);
7574     return 0;
7575 }
7576 
7577 #if defined(TARGET_NR_mlockall)
7578 static inline int target_to_host_mlockall_arg(int arg)
7579 {
7580     int result = 0;
7581 
7582     if (arg & TARGET_MCL_CURRENT) {
7583         result |= MCL_CURRENT;
7584     }
7585     if (arg & TARGET_MCL_FUTURE) {
7586         result |= MCL_FUTURE;
7587     }
7588 #ifdef MCL_ONFAULT
7589     if (arg & TARGET_MCL_ONFAULT) {
7590         result |= MCL_ONFAULT;
7591     }
7592 #endif
7593 
7594     return result;
7595 }
7596 #endif
7597 
7598 #if (defined(TARGET_NR_stat64) || defined(TARGET_NR_lstat64) ||     \
7599      defined(TARGET_NR_fstat64) || defined(TARGET_NR_fstatat64) ||  \
7600      defined(TARGET_NR_newfstatat))
7601 static inline abi_long host_to_target_stat64(CPUArchState *cpu_env,
7602                                              abi_ulong target_addr,
7603                                              struct stat *host_st)
7604 {
7605 #if defined(TARGET_ARM) && defined(TARGET_ABI32)
7606     if (cpu_env->eabi) {
7607         struct target_eabi_stat64 *target_st;
7608 
7609         if (!lock_user_struct(VERIFY_WRITE, target_st, target_addr, 0))
7610             return -TARGET_EFAULT;
7611         memset(target_st, 0, sizeof(struct target_eabi_stat64));
7612         __put_user(host_st->st_dev, &target_st->st_dev);
7613         __put_user(host_st->st_ino, &target_st->st_ino);
7614 #ifdef TARGET_STAT64_HAS_BROKEN_ST_INO
7615         __put_user(host_st->st_ino, &target_st->__st_ino);
7616 #endif
7617         __put_user(host_st->st_mode, &target_st->st_mode);
7618         __put_user(host_st->st_nlink, &target_st->st_nlink);
7619         __put_user(host_st->st_uid, &target_st->st_uid);
7620         __put_user(host_st->st_gid, &target_st->st_gid);
7621         __put_user(host_st->st_rdev, &target_st->st_rdev);
7622         __put_user(host_st->st_size, &target_st->st_size);
7623         __put_user(host_st->st_blksize, &target_st->st_blksize);
7624         __put_user(host_st->st_blocks, &target_st->st_blocks);
7625         __put_user(host_st->st_atime, &target_st->target_st_atime);
7626         __put_user(host_st->st_mtime, &target_st->target_st_mtime);
7627         __put_user(host_st->st_ctime, &target_st->target_st_ctime);
7628 #ifdef HAVE_STRUCT_STAT_ST_ATIM
7629         __put_user(host_st->st_atim.tv_nsec, &target_st->target_st_atime_nsec);
7630         __put_user(host_st->st_mtim.tv_nsec, &target_st->target_st_mtime_nsec);
7631         __put_user(host_st->st_ctim.tv_nsec, &target_st->target_st_ctime_nsec);
7632 #endif
7633         unlock_user_struct(target_st, target_addr, 1);
7634     } else
7635 #endif
7636     {
7637 #if defined(TARGET_HAS_STRUCT_STAT64)
7638         struct target_stat64 *target_st;
7639 #else
7640         struct target_stat *target_st;
7641 #endif
7642 
7643         if (!lock_user_struct(VERIFY_WRITE, target_st, target_addr, 0))
7644             return -TARGET_EFAULT;
7645         memset(target_st, 0, sizeof(*target_st));
7646         __put_user(host_st->st_dev, &target_st->st_dev);
7647         __put_user(host_st->st_ino, &target_st->st_ino);
7648 #ifdef TARGET_STAT64_HAS_BROKEN_ST_INO
7649         __put_user(host_st->st_ino, &target_st->__st_ino);
7650 #endif
7651         __put_user(host_st->st_mode, &target_st->st_mode);
7652         __put_user(host_st->st_nlink, &target_st->st_nlink);
7653         __put_user(host_st->st_uid, &target_st->st_uid);
7654         __put_user(host_st->st_gid, &target_st->st_gid);
7655         __put_user(host_st->st_rdev, &target_st->st_rdev);
7656         /* XXX: better use of kernel struct */
7657         __put_user(host_st->st_size, &target_st->st_size);
7658         __put_user(host_st->st_blksize, &target_st->st_blksize);
7659         __put_user(host_st->st_blocks, &target_st->st_blocks);
7660         __put_user(host_st->st_atime, &target_st->target_st_atime);
7661         __put_user(host_st->st_mtime, &target_st->target_st_mtime);
7662         __put_user(host_st->st_ctime, &target_st->target_st_ctime);
7663 #ifdef HAVE_STRUCT_STAT_ST_ATIM
7664         __put_user(host_st->st_atim.tv_nsec, &target_st->target_st_atime_nsec);
7665         __put_user(host_st->st_mtim.tv_nsec, &target_st->target_st_mtime_nsec);
7666         __put_user(host_st->st_ctim.tv_nsec, &target_st->target_st_ctime_nsec);
7667 #endif
7668         unlock_user_struct(target_st, target_addr, 1);
7669     }
7670 
7671     return 0;
7672 }
7673 #endif
7674 
7675 #if defined(TARGET_NR_statx) && defined(__NR_statx)
7676 static inline abi_long host_to_target_statx(struct target_statx *host_stx,
7677                                             abi_ulong target_addr)
7678 {
7679     struct target_statx *target_stx;
7680 
7681     if (!lock_user_struct(VERIFY_WRITE, target_stx, target_addr,  0)) {
7682         return -TARGET_EFAULT;
7683     }
7684     memset(target_stx, 0, sizeof(*target_stx));
7685 
7686     __put_user(host_stx->stx_mask, &target_stx->stx_mask);
7687     __put_user(host_stx->stx_blksize, &target_stx->stx_blksize);
7688     __put_user(host_stx->stx_attributes, &target_stx->stx_attributes);
7689     __put_user(host_stx->stx_nlink, &target_stx->stx_nlink);
7690     __put_user(host_stx->stx_uid, &target_stx->stx_uid);
7691     __put_user(host_stx->stx_gid, &target_stx->stx_gid);
7692     __put_user(host_stx->stx_mode, &target_stx->stx_mode);
7693     __put_user(host_stx->stx_ino, &target_stx->stx_ino);
7694     __put_user(host_stx->stx_size, &target_stx->stx_size);
7695     __put_user(host_stx->stx_blocks, &target_stx->stx_blocks);
7696     __put_user(host_stx->stx_attributes_mask, &target_stx->stx_attributes_mask);
7697     __put_user(host_stx->stx_atime.tv_sec, &target_stx->stx_atime.tv_sec);
7698     __put_user(host_stx->stx_atime.tv_nsec, &target_stx->stx_atime.tv_nsec);
7699     __put_user(host_stx->stx_btime.tv_sec, &target_stx->stx_btime.tv_sec);
7700     __put_user(host_stx->stx_btime.tv_nsec, &target_stx->stx_btime.tv_nsec);
7701     __put_user(host_stx->stx_ctime.tv_sec, &target_stx->stx_ctime.tv_sec);
7702     __put_user(host_stx->stx_ctime.tv_nsec, &target_stx->stx_ctime.tv_nsec);
7703     __put_user(host_stx->stx_mtime.tv_sec, &target_stx->stx_mtime.tv_sec);
7704     __put_user(host_stx->stx_mtime.tv_nsec, &target_stx->stx_mtime.tv_nsec);
7705     __put_user(host_stx->stx_rdev_major, &target_stx->stx_rdev_major);
7706     __put_user(host_stx->stx_rdev_minor, &target_stx->stx_rdev_minor);
7707     __put_user(host_stx->stx_dev_major, &target_stx->stx_dev_major);
7708     __put_user(host_stx->stx_dev_minor, &target_stx->stx_dev_minor);
7709 
7710     unlock_user_struct(target_stx, target_addr, 1);
7711 
7712     return 0;
7713 }
7714 #endif
7715 
7716 static int do_sys_futex(int *uaddr, int op, int val,
7717                          const struct timespec *timeout, int *uaddr2,
7718                          int val3)
7719 {
7720 #if HOST_LONG_BITS == 64
7721 #if defined(__NR_futex)
7722     /* always a 64-bit time_t, it doesn't define _time64 version  */
7723     return sys_futex(uaddr, op, val, timeout, uaddr2, val3);
7724 
7725 #endif
7726 #else /* HOST_LONG_BITS == 64 */
7727 #if defined(__NR_futex_time64)
7728     if (sizeof(timeout->tv_sec) == 8) {
7729         /* _time64 function on 32bit arch */
7730         return sys_futex_time64(uaddr, op, val, timeout, uaddr2, val3);
7731     }
7732 #endif
7733 #if defined(__NR_futex)
7734     /* old function on 32bit arch */
7735     return sys_futex(uaddr, op, val, timeout, uaddr2, val3);
7736 #endif
7737 #endif /* HOST_LONG_BITS == 64 */
7738     g_assert_not_reached();
7739 }
7740 
7741 static int do_safe_futex(int *uaddr, int op, int val,
7742                          const struct timespec *timeout, int *uaddr2,
7743                          int val3)
7744 {
7745 #if HOST_LONG_BITS == 64
7746 #if defined(__NR_futex)
7747     /* always a 64-bit time_t, it doesn't define _time64 version  */
7748     return get_errno(safe_futex(uaddr, op, val, timeout, uaddr2, val3));
7749 #endif
7750 #else /* HOST_LONG_BITS == 64 */
7751 #if defined(__NR_futex_time64)
7752     if (sizeof(timeout->tv_sec) == 8) {
7753         /* _time64 function on 32bit arch */
7754         return get_errno(safe_futex_time64(uaddr, op, val, timeout, uaddr2,
7755                                            val3));
7756     }
7757 #endif
7758 #if defined(__NR_futex)
7759     /* old function on 32bit arch */
7760     return get_errno(safe_futex(uaddr, op, val, timeout, uaddr2, val3));
7761 #endif
7762 #endif /* HOST_LONG_BITS == 64 */
7763     return -TARGET_ENOSYS;
7764 }
7765 
7766 /* ??? Using host futex calls even when target atomic operations
7767    are not really atomic probably breaks things.  However implementing
7768    futexes locally would make futexes shared between multiple processes
7769    tricky.  However they're probably useless because guest atomic
7770    operations won't work either.  */
7771 #if defined(TARGET_NR_futex) || defined(TARGET_NR_futex_time64)
7772 static int do_futex(CPUState *cpu, bool time64, target_ulong uaddr,
7773                     int op, int val, target_ulong timeout,
7774                     target_ulong uaddr2, int val3)
7775 {
7776     struct timespec ts, *pts;
7777     int base_op;
7778 
7779     /* ??? We assume FUTEX_* constants are the same on both host
7780        and target.  */
7781 #ifdef FUTEX_CMD_MASK
7782     base_op = op & FUTEX_CMD_MASK;
7783 #else
7784     base_op = op;
7785 #endif
7786     switch (base_op) {
7787     case FUTEX_WAIT:
7788     case FUTEX_WAIT_BITSET:
7789         if (timeout) {
7790             pts = &ts;
7791             if (time64
7792                 ? target_to_host_timespec64(pts, timeout)
7793                 : target_to_host_timespec(pts, timeout)) {
7794                 return -TARGET_EFAULT;
7795             }
7796         } else {
7797             pts = NULL;
7798         }
7799         return do_safe_futex(g2h(cpu, uaddr),
7800                              op, tswap32(val), pts, NULL, val3);
7801     case FUTEX_WAKE:
7802         return do_safe_futex(g2h(cpu, uaddr),
7803                              op, val, NULL, NULL, 0);
7804     case FUTEX_FD:
7805         return do_safe_futex(g2h(cpu, uaddr),
7806                              op, val, NULL, NULL, 0);
7807     case FUTEX_REQUEUE:
7808     case FUTEX_CMP_REQUEUE:
7809     case FUTEX_WAKE_OP:
7810         /* For FUTEX_REQUEUE, FUTEX_CMP_REQUEUE, and FUTEX_WAKE_OP, the
7811            TIMEOUT parameter is interpreted as a uint32_t by the kernel.
7812            But the prototype takes a `struct timespec *'; insert casts
7813            to satisfy the compiler.  We do not need to tswap TIMEOUT
7814            since it's not compared to guest memory.  */
7815         pts = (struct timespec *)(uintptr_t) timeout;
7816         return do_safe_futex(g2h(cpu, uaddr), op, val, pts, g2h(cpu, uaddr2),
7817                              (base_op == FUTEX_CMP_REQUEUE
7818                               ? tswap32(val3) : val3));
7819     default:
7820         return -TARGET_ENOSYS;
7821     }
7822 }
7823 #endif
7824 
7825 #if defined(TARGET_NR_name_to_handle_at) && defined(CONFIG_OPEN_BY_HANDLE)
7826 static abi_long do_name_to_handle_at(abi_long dirfd, abi_long pathname,
7827                                      abi_long handle, abi_long mount_id,
7828                                      abi_long flags)
7829 {
7830     struct file_handle *target_fh;
7831     struct file_handle *fh;
7832     int mid = 0;
7833     abi_long ret;
7834     char *name;
7835     unsigned int size, total_size;
7836 
7837     if (get_user_s32(size, handle)) {
7838         return -TARGET_EFAULT;
7839     }
7840 
7841     name = lock_user_string(pathname);
7842     if (!name) {
7843         return -TARGET_EFAULT;
7844     }
7845 
7846     total_size = sizeof(struct file_handle) + size;
7847     target_fh = lock_user(VERIFY_WRITE, handle, total_size, 0);
7848     if (!target_fh) {
7849         unlock_user(name, pathname, 0);
7850         return -TARGET_EFAULT;
7851     }
7852 
7853     fh = g_malloc0(total_size);
7854     fh->handle_bytes = size;
7855 
7856     ret = get_errno(name_to_handle_at(dirfd, path(name), fh, &mid, flags));
7857     unlock_user(name, pathname, 0);
7858 
7859     /* man name_to_handle_at(2):
7860      * Other than the use of the handle_bytes field, the caller should treat
7861      * the file_handle structure as an opaque data type
7862      */
7863 
7864     memcpy(target_fh, fh, total_size);
7865     target_fh->handle_bytes = tswap32(fh->handle_bytes);
7866     target_fh->handle_type = tswap32(fh->handle_type);
7867     g_free(fh);
7868     unlock_user(target_fh, handle, total_size);
7869 
7870     if (put_user_s32(mid, mount_id)) {
7871         return -TARGET_EFAULT;
7872     }
7873 
7874     return ret;
7875 
7876 }
7877 #endif
7878 
7879 #if defined(TARGET_NR_open_by_handle_at) && defined(CONFIG_OPEN_BY_HANDLE)
7880 static abi_long do_open_by_handle_at(abi_long mount_fd, abi_long handle,
7881                                      abi_long flags)
7882 {
7883     struct file_handle *target_fh;
7884     struct file_handle *fh;
7885     unsigned int size, total_size;
7886     abi_long ret;
7887 
7888     if (get_user_s32(size, handle)) {
7889         return -TARGET_EFAULT;
7890     }
7891 
7892     total_size = sizeof(struct file_handle) + size;
7893     target_fh = lock_user(VERIFY_READ, handle, total_size, 1);
7894     if (!target_fh) {
7895         return -TARGET_EFAULT;
7896     }
7897 
7898     fh = g_memdup(target_fh, total_size);
7899     fh->handle_bytes = size;
7900     fh->handle_type = tswap32(target_fh->handle_type);
7901 
7902     ret = get_errno(open_by_handle_at(mount_fd, fh,
7903                     target_to_host_bitmask(flags, fcntl_flags_tbl)));
7904 
7905     g_free(fh);
7906 
7907     unlock_user(target_fh, handle, total_size);
7908 
7909     return ret;
7910 }
7911 #endif
7912 
7913 #if defined(TARGET_NR_signalfd) || defined(TARGET_NR_signalfd4)
7914 
7915 static abi_long do_signalfd4(int fd, abi_long mask, int flags)
7916 {
7917     int host_flags;
7918     target_sigset_t *target_mask;
7919     sigset_t host_mask;
7920     abi_long ret;
7921 
7922     if (flags & ~(TARGET_O_NONBLOCK_MASK | TARGET_O_CLOEXEC)) {
7923         return -TARGET_EINVAL;
7924     }
7925     if (!lock_user_struct(VERIFY_READ, target_mask, mask, 1)) {
7926         return -TARGET_EFAULT;
7927     }
7928 
7929     target_to_host_sigset(&host_mask, target_mask);
7930 
7931     host_flags = target_to_host_bitmask(flags, fcntl_flags_tbl);
7932 
7933     ret = get_errno(signalfd(fd, &host_mask, host_flags));
7934     if (ret >= 0) {
7935         fd_trans_register(ret, &target_signalfd_trans);
7936     }
7937 
7938     unlock_user_struct(target_mask, mask, 0);
7939 
7940     return ret;
7941 }
7942 #endif
7943 
7944 /* Map host to target signal numbers for the wait family of syscalls.
7945    Assume all other status bits are the same.  */
7946 int host_to_target_waitstatus(int status)
7947 {
7948     if (WIFSIGNALED(status)) {
7949         return host_to_target_signal(WTERMSIG(status)) | (status & ~0x7f);
7950     }
7951     if (WIFSTOPPED(status)) {
7952         return (host_to_target_signal(WSTOPSIG(status)) << 8)
7953                | (status & 0xff);
7954     }
7955     return status;
7956 }
7957 
7958 static int open_self_cmdline(CPUArchState *cpu_env, int fd)
7959 {
7960     CPUState *cpu = env_cpu(cpu_env);
7961     struct linux_binprm *bprm = ((TaskState *)cpu->opaque)->bprm;
7962     int i;
7963 
7964     for (i = 0; i < bprm->argc; i++) {
7965         size_t len = strlen(bprm->argv[i]) + 1;
7966 
7967         if (write(fd, bprm->argv[i], len) != len) {
7968             return -1;
7969         }
7970     }
7971 
7972     return 0;
7973 }
7974 
7975 static int open_self_maps(CPUArchState *cpu_env, int fd)
7976 {
7977     CPUState *cpu = env_cpu(cpu_env);
7978     TaskState *ts = cpu->opaque;
7979     GSList *map_info = read_self_maps();
7980     GSList *s;
7981     int count;
7982 
7983     for (s = map_info; s; s = g_slist_next(s)) {
7984         MapInfo *e = (MapInfo *) s->data;
7985 
7986         if (h2g_valid(e->start)) {
7987             unsigned long min = e->start;
7988             unsigned long max = e->end;
7989             int flags = page_get_flags(h2g(min));
7990             const char *path;
7991 
7992             max = h2g_valid(max - 1) ?
7993                 max : (uintptr_t) g2h_untagged(GUEST_ADDR_MAX) + 1;
7994 
7995             if (page_check_range(h2g(min), max - min, flags) == -1) {
7996                 continue;
7997             }
7998 
7999 #ifdef TARGET_HPPA
8000             if (h2g(max) == ts->info->stack_limit) {
8001 #else
8002             if (h2g(min) == ts->info->stack_limit) {
8003 #endif
8004                 path = "[stack]";
8005             } else {
8006                 path = e->path;
8007             }
8008 
8009             count = dprintf(fd, TARGET_ABI_FMT_ptr "-" TARGET_ABI_FMT_ptr
8010                             " %c%c%c%c %08" PRIx64 " %s %"PRId64,
8011                             h2g(min), h2g(max - 1) + 1,
8012                             (flags & PAGE_READ) ? 'r' : '-',
8013                             (flags & PAGE_WRITE_ORG) ? 'w' : '-',
8014                             (flags & PAGE_EXEC) ? 'x' : '-',
8015                             e->is_priv ? 'p' : 's',
8016                             (uint64_t) e->offset, e->dev, e->inode);
8017             if (path) {
8018                 dprintf(fd, "%*s%s\n", 73 - count, "", path);
8019             } else {
8020                 dprintf(fd, "\n");
8021             }
8022         }
8023     }
8024 
8025     free_self_maps(map_info);
8026 
8027 #ifdef TARGET_VSYSCALL_PAGE
8028     /*
8029      * We only support execution from the vsyscall page.
8030      * This is as if CONFIG_LEGACY_VSYSCALL_XONLY=y from v5.3.
8031      */
8032     count = dprintf(fd, TARGET_FMT_lx "-" TARGET_FMT_lx
8033                     " --xp 00000000 00:00 0",
8034                     TARGET_VSYSCALL_PAGE, TARGET_VSYSCALL_PAGE + TARGET_PAGE_SIZE);
8035     dprintf(fd, "%*s%s\n", 73 - count, "",  "[vsyscall]");
8036 #endif
8037 
8038     return 0;
8039 }
8040 
8041 static int open_self_stat(CPUArchState *cpu_env, int fd)
8042 {
8043     CPUState *cpu = env_cpu(cpu_env);
8044     TaskState *ts = cpu->opaque;
8045     g_autoptr(GString) buf = g_string_new(NULL);
8046     int i;
8047 
8048     for (i = 0; i < 44; i++) {
8049         if (i == 0) {
8050             /* pid */
8051             g_string_printf(buf, FMT_pid " ", getpid());
8052         } else if (i == 1) {
8053             /* app name */
8054             gchar *bin = g_strrstr(ts->bprm->argv[0], "/");
8055             bin = bin ? bin + 1 : ts->bprm->argv[0];
8056             g_string_printf(buf, "(%.15s) ", bin);
8057         } else if (i == 3) {
8058             /* ppid */
8059             g_string_printf(buf, FMT_pid " ", getppid());
8060         } else if (i == 21) {
8061             /* starttime */
8062             g_string_printf(buf, "%" PRIu64 " ", ts->start_boottime);
8063         } else if (i == 27) {
8064             /* stack bottom */
8065             g_string_printf(buf, TARGET_ABI_FMT_ld " ", ts->info->start_stack);
8066         } else {
8067             /* for the rest, there is MasterCard */
8068             g_string_printf(buf, "0%c", i == 43 ? '\n' : ' ');
8069         }
8070 
8071         if (write(fd, buf->str, buf->len) != buf->len) {
8072             return -1;
8073         }
8074     }
8075 
8076     return 0;
8077 }
8078 
8079 static int open_self_auxv(CPUArchState *cpu_env, int fd)
8080 {
8081     CPUState *cpu = env_cpu(cpu_env);
8082     TaskState *ts = cpu->opaque;
8083     abi_ulong auxv = ts->info->saved_auxv;
8084     abi_ulong len = ts->info->auxv_len;
8085     char *ptr;
8086 
8087     /*
8088      * Auxiliary vector is stored in target process stack.
8089      * read in whole auxv vector and copy it to file
8090      */
8091     ptr = lock_user(VERIFY_READ, auxv, len, 0);
8092     if (ptr != NULL) {
8093         while (len > 0) {
8094             ssize_t r;
8095             r = write(fd, ptr, len);
8096             if (r <= 0) {
8097                 break;
8098             }
8099             len -= r;
8100             ptr += r;
8101         }
8102         lseek(fd, 0, SEEK_SET);
8103         unlock_user(ptr, auxv, len);
8104     }
8105 
8106     return 0;
8107 }
8108 
8109 static int is_proc_myself(const char *filename, const char *entry)
8110 {
8111     if (!strncmp(filename, "/proc/", strlen("/proc/"))) {
8112         filename += strlen("/proc/");
8113         if (!strncmp(filename, "self/", strlen("self/"))) {
8114             filename += strlen("self/");
8115         } else if (*filename >= '1' && *filename <= '9') {
8116             char myself[80];
8117             snprintf(myself, sizeof(myself), "%d/", getpid());
8118             if (!strncmp(filename, myself, strlen(myself))) {
8119                 filename += strlen(myself);
8120             } else {
8121                 return 0;
8122             }
8123         } else {
8124             return 0;
8125         }
8126         if (!strcmp(filename, entry)) {
8127             return 1;
8128         }
8129     }
8130     return 0;
8131 }
8132 
8133 #if HOST_BIG_ENDIAN != TARGET_BIG_ENDIAN || \
8134     defined(TARGET_SPARC) || defined(TARGET_M68K) || defined(TARGET_HPPA)
8135 static int is_proc(const char *filename, const char *entry)
8136 {
8137     return strcmp(filename, entry) == 0;
8138 }
8139 #endif
8140 
8141 #if HOST_BIG_ENDIAN != TARGET_BIG_ENDIAN
8142 static int open_net_route(CPUArchState *cpu_env, int fd)
8143 {
8144     FILE *fp;
8145     char *line = NULL;
8146     size_t len = 0;
8147     ssize_t read;
8148 
8149     fp = fopen("/proc/net/route", "r");
8150     if (fp == NULL) {
8151         return -1;
8152     }
8153 
8154     /* read header */
8155 
8156     read = getline(&line, &len, fp);
8157     dprintf(fd, "%s", line);
8158 
8159     /* read routes */
8160 
8161     while ((read = getline(&line, &len, fp)) != -1) {
8162         char iface[16];
8163         uint32_t dest, gw, mask;
8164         unsigned int flags, refcnt, use, metric, mtu, window, irtt;
8165         int fields;
8166 
8167         fields = sscanf(line,
8168                         "%s\t%08x\t%08x\t%04x\t%d\t%d\t%d\t%08x\t%d\t%u\t%u\n",
8169                         iface, &dest, &gw, &flags, &refcnt, &use, &metric,
8170                         &mask, &mtu, &window, &irtt);
8171         if (fields != 11) {
8172             continue;
8173         }
8174         dprintf(fd, "%s\t%08x\t%08x\t%04x\t%d\t%d\t%d\t%08x\t%d\t%u\t%u\n",
8175                 iface, tswap32(dest), tswap32(gw), flags, refcnt, use,
8176                 metric, tswap32(mask), mtu, window, irtt);
8177     }
8178 
8179     free(line);
8180     fclose(fp);
8181 
8182     return 0;
8183 }
8184 #endif
8185 
8186 #if defined(TARGET_SPARC)
8187 static int open_cpuinfo(CPUArchState *cpu_env, int fd)
8188 {
8189     dprintf(fd, "type\t\t: sun4u\n");
8190     return 0;
8191 }
8192 #endif
8193 
8194 #if defined(TARGET_HPPA)
8195 static int open_cpuinfo(CPUArchState *cpu_env, int fd)
8196 {
8197     dprintf(fd, "cpu family\t: PA-RISC 1.1e\n");
8198     dprintf(fd, "cpu\t\t: PA7300LC (PCX-L2)\n");
8199     dprintf(fd, "capabilities\t: os32\n");
8200     dprintf(fd, "model\t\t: 9000/778/B160L\n");
8201     dprintf(fd, "model name\t: Merlin L2 160 QEMU (9000/778/B160L)\n");
8202     return 0;
8203 }
8204 #endif
8205 
8206 #if defined(TARGET_M68K)
8207 static int open_hardware(CPUArchState *cpu_env, int fd)
8208 {
8209     dprintf(fd, "Model:\t\tqemu-m68k\n");
8210     return 0;
8211 }
8212 #endif
8213 
8214 static int do_openat(CPUArchState *cpu_env, int dirfd, const char *pathname, int flags, mode_t mode)
8215 {
8216     struct fake_open {
8217         const char *filename;
8218         int (*fill)(CPUArchState *cpu_env, int fd);
8219         int (*cmp)(const char *s1, const char *s2);
8220     };
8221     const struct fake_open *fake_open;
8222     static const struct fake_open fakes[] = {
8223         { "maps", open_self_maps, is_proc_myself },
8224         { "stat", open_self_stat, is_proc_myself },
8225         { "auxv", open_self_auxv, is_proc_myself },
8226         { "cmdline", open_self_cmdline, is_proc_myself },
8227 #if HOST_BIG_ENDIAN != TARGET_BIG_ENDIAN
8228         { "/proc/net/route", open_net_route, is_proc },
8229 #endif
8230 #if defined(TARGET_SPARC) || defined(TARGET_HPPA)
8231         { "/proc/cpuinfo", open_cpuinfo, is_proc },
8232 #endif
8233 #if defined(TARGET_M68K)
8234         { "/proc/hardware", open_hardware, is_proc },
8235 #endif
8236         { NULL, NULL, NULL }
8237     };
8238 
8239     if (is_proc_myself(pathname, "exe")) {
8240         int execfd = qemu_getauxval(AT_EXECFD);
8241         return execfd ? execfd : safe_openat(dirfd, exec_path, flags, mode);
8242     }
8243 
8244     for (fake_open = fakes; fake_open->filename; fake_open++) {
8245         if (fake_open->cmp(pathname, fake_open->filename)) {
8246             break;
8247         }
8248     }
8249 
8250     if (fake_open->filename) {
8251         const char *tmpdir;
8252         char filename[PATH_MAX];
8253         int fd, r;
8254 
8255         fd = memfd_create("qemu-open", 0);
8256         if (fd < 0) {
8257             if (errno != ENOSYS) {
8258                 return fd;
8259             }
8260             /* create temporary file to map stat to */
8261             tmpdir = getenv("TMPDIR");
8262             if (!tmpdir)
8263                 tmpdir = "/tmp";
8264             snprintf(filename, sizeof(filename), "%s/qemu-open.XXXXXX", tmpdir);
8265             fd = mkstemp(filename);
8266             if (fd < 0) {
8267                 return fd;
8268             }
8269             unlink(filename);
8270         }
8271 
8272         if ((r = fake_open->fill(cpu_env, fd))) {
8273             int e = errno;
8274             close(fd);
8275             errno = e;
8276             return r;
8277         }
8278         lseek(fd, 0, SEEK_SET);
8279 
8280         return fd;
8281     }
8282 
8283     return safe_openat(dirfd, path(pathname), flags, mode);
8284 }
8285 
8286 #define TIMER_MAGIC 0x0caf0000
8287 #define TIMER_MAGIC_MASK 0xffff0000
8288 
8289 /* Convert QEMU provided timer ID back to internal 16bit index format */
8290 static target_timer_t get_timer_id(abi_long arg)
8291 {
8292     target_timer_t timerid = arg;
8293 
8294     if ((timerid & TIMER_MAGIC_MASK) != TIMER_MAGIC) {
8295         return -TARGET_EINVAL;
8296     }
8297 
8298     timerid &= 0xffff;
8299 
8300     if (timerid >= ARRAY_SIZE(g_posix_timers)) {
8301         return -TARGET_EINVAL;
8302     }
8303 
8304     return timerid;
8305 }
8306 
8307 static int target_to_host_cpu_mask(unsigned long *host_mask,
8308                                    size_t host_size,
8309                                    abi_ulong target_addr,
8310                                    size_t target_size)
8311 {
8312     unsigned target_bits = sizeof(abi_ulong) * 8;
8313     unsigned host_bits = sizeof(*host_mask) * 8;
8314     abi_ulong *target_mask;
8315     unsigned i, j;
8316 
8317     assert(host_size >= target_size);
8318 
8319     target_mask = lock_user(VERIFY_READ, target_addr, target_size, 1);
8320     if (!target_mask) {
8321         return -TARGET_EFAULT;
8322     }
8323     memset(host_mask, 0, host_size);
8324 
8325     for (i = 0 ; i < target_size / sizeof(abi_ulong); i++) {
8326         unsigned bit = i * target_bits;
8327         abi_ulong val;
8328 
8329         __get_user(val, &target_mask[i]);
8330         for (j = 0; j < target_bits; j++, bit++) {
8331             if (val & (1UL << j)) {
8332                 host_mask[bit / host_bits] |= 1UL << (bit % host_bits);
8333             }
8334         }
8335     }
8336 
8337     unlock_user(target_mask, target_addr, 0);
8338     return 0;
8339 }
8340 
8341 static int host_to_target_cpu_mask(const unsigned long *host_mask,
8342                                    size_t host_size,
8343                                    abi_ulong target_addr,
8344                                    size_t target_size)
8345 {
8346     unsigned target_bits = sizeof(abi_ulong) * 8;
8347     unsigned host_bits = sizeof(*host_mask) * 8;
8348     abi_ulong *target_mask;
8349     unsigned i, j;
8350 
8351     assert(host_size >= target_size);
8352 
8353     target_mask = lock_user(VERIFY_WRITE, target_addr, target_size, 0);
8354     if (!target_mask) {
8355         return -TARGET_EFAULT;
8356     }
8357 
8358     for (i = 0 ; i < target_size / sizeof(abi_ulong); i++) {
8359         unsigned bit = i * target_bits;
8360         abi_ulong val = 0;
8361 
8362         for (j = 0; j < target_bits; j++, bit++) {
8363             if (host_mask[bit / host_bits] & (1UL << (bit % host_bits))) {
8364                 val |= 1UL << j;
8365             }
8366         }
8367         __put_user(val, &target_mask[i]);
8368     }
8369 
8370     unlock_user(target_mask, target_addr, target_size);
8371     return 0;
8372 }
8373 
8374 #ifdef TARGET_NR_getdents
8375 static int do_getdents(abi_long dirfd, abi_long arg2, abi_long count)
8376 {
8377     g_autofree void *hdirp = NULL;
8378     void *tdirp;
8379     int hlen, hoff, toff;
8380     int hreclen, treclen;
8381     off64_t prev_diroff = 0;
8382 
8383     hdirp = g_try_malloc(count);
8384     if (!hdirp) {
8385         return -TARGET_ENOMEM;
8386     }
8387 
8388 #ifdef EMULATE_GETDENTS_WITH_GETDENTS
8389     hlen = sys_getdents(dirfd, hdirp, count);
8390 #else
8391     hlen = sys_getdents64(dirfd, hdirp, count);
8392 #endif
8393 
8394     hlen = get_errno(hlen);
8395     if (is_error(hlen)) {
8396         return hlen;
8397     }
8398 
8399     tdirp = lock_user(VERIFY_WRITE, arg2, count, 0);
8400     if (!tdirp) {
8401         return -TARGET_EFAULT;
8402     }
8403 
8404     for (hoff = toff = 0; hoff < hlen; hoff += hreclen, toff += treclen) {
8405 #ifdef EMULATE_GETDENTS_WITH_GETDENTS
8406         struct linux_dirent *hde = hdirp + hoff;
8407 #else
8408         struct linux_dirent64 *hde = hdirp + hoff;
8409 #endif
8410         struct target_dirent *tde = tdirp + toff;
8411         int namelen;
8412         uint8_t type;
8413 
8414         namelen = strlen(hde->d_name);
8415         hreclen = hde->d_reclen;
8416         treclen = offsetof(struct target_dirent, d_name) + namelen + 2;
8417         treclen = QEMU_ALIGN_UP(treclen, __alignof(struct target_dirent));
8418 
8419         if (toff + treclen > count) {
8420             /*
8421              * If the host struct is smaller than the target struct, or
8422              * requires less alignment and thus packs into less space,
8423              * then the host can return more entries than we can pass
8424              * on to the guest.
8425              */
8426             if (toff == 0) {
8427                 toff = -TARGET_EINVAL; /* result buffer is too small */
8428                 break;
8429             }
8430             /*
8431              * Return what we have, resetting the file pointer to the
8432              * location of the first record not returned.
8433              */
8434             lseek64(dirfd, prev_diroff, SEEK_SET);
8435             break;
8436         }
8437 
8438         prev_diroff = hde->d_off;
8439         tde->d_ino = tswapal(hde->d_ino);
8440         tde->d_off = tswapal(hde->d_off);
8441         tde->d_reclen = tswap16(treclen);
8442         memcpy(tde->d_name, hde->d_name, namelen + 1);
8443 
8444         /*
8445          * The getdents type is in what was formerly a padding byte at the
8446          * end of the structure.
8447          */
8448 #ifdef EMULATE_GETDENTS_WITH_GETDENTS
8449         type = *((uint8_t *)hde + hreclen - 1);
8450 #else
8451         type = hde->d_type;
8452 #endif
8453         *((uint8_t *)tde + treclen - 1) = type;
8454     }
8455 
8456     unlock_user(tdirp, arg2, toff);
8457     return toff;
8458 }
8459 #endif /* TARGET_NR_getdents */
8460 
8461 #if defined(TARGET_NR_getdents64) && defined(__NR_getdents64)
8462 static int do_getdents64(abi_long dirfd, abi_long arg2, abi_long count)
8463 {
8464     g_autofree void *hdirp = NULL;
8465     void *tdirp;
8466     int hlen, hoff, toff;
8467     int hreclen, treclen;
8468     off64_t prev_diroff = 0;
8469 
8470     hdirp = g_try_malloc(count);
8471     if (!hdirp) {
8472         return -TARGET_ENOMEM;
8473     }
8474 
8475     hlen = get_errno(sys_getdents64(dirfd, hdirp, count));
8476     if (is_error(hlen)) {
8477         return hlen;
8478     }
8479 
8480     tdirp = lock_user(VERIFY_WRITE, arg2, count, 0);
8481     if (!tdirp) {
8482         return -TARGET_EFAULT;
8483     }
8484 
8485     for (hoff = toff = 0; hoff < hlen; hoff += hreclen, toff += treclen) {
8486         struct linux_dirent64 *hde = hdirp + hoff;
8487         struct target_dirent64 *tde = tdirp + toff;
8488         int namelen;
8489 
8490         namelen = strlen(hde->d_name) + 1;
8491         hreclen = hde->d_reclen;
8492         treclen = offsetof(struct target_dirent64, d_name) + namelen;
8493         treclen = QEMU_ALIGN_UP(treclen, __alignof(struct target_dirent64));
8494 
8495         if (toff + treclen > count) {
8496             /*
8497              * If the host struct is smaller than the target struct, or
8498              * requires less alignment and thus packs into less space,
8499              * then the host can return more entries than we can pass
8500              * on to the guest.
8501              */
8502             if (toff == 0) {
8503                 toff = -TARGET_EINVAL; /* result buffer is too small */
8504                 break;
8505             }
8506             /*
8507              * Return what we have, resetting the file pointer to the
8508              * location of the first record not returned.
8509              */
8510             lseek64(dirfd, prev_diroff, SEEK_SET);
8511             break;
8512         }
8513 
8514         prev_diroff = hde->d_off;
8515         tde->d_ino = tswap64(hde->d_ino);
8516         tde->d_off = tswap64(hde->d_off);
8517         tde->d_reclen = tswap16(treclen);
8518         tde->d_type = hde->d_type;
8519         memcpy(tde->d_name, hde->d_name, namelen);
8520     }
8521 
8522     unlock_user(tdirp, arg2, toff);
8523     return toff;
8524 }
8525 #endif /* TARGET_NR_getdents64 */
8526 
8527 #if defined(TARGET_NR_pivot_root) && defined(__NR_pivot_root)
8528 _syscall2(int, pivot_root, const char *, new_root, const char *, put_old)
8529 #endif
8530 
8531 /* This is an internal helper for do_syscall so that it is easier
8532  * to have a single return point, so that actions, such as logging
8533  * of syscall results, can be performed.
8534  * All errnos that do_syscall() returns must be -TARGET_<errcode>.
8535  */
8536 static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
8537                             abi_long arg2, abi_long arg3, abi_long arg4,
8538                             abi_long arg5, abi_long arg6, abi_long arg7,
8539                             abi_long arg8)
8540 {
8541     CPUState *cpu = env_cpu(cpu_env);
8542     abi_long ret;
8543 #if defined(TARGET_NR_stat) || defined(TARGET_NR_stat64) \
8544     || defined(TARGET_NR_lstat) || defined(TARGET_NR_lstat64) \
8545     || defined(TARGET_NR_fstat) || defined(TARGET_NR_fstat64) \
8546     || defined(TARGET_NR_statx)
8547     struct stat st;
8548 #endif
8549 #if defined(TARGET_NR_statfs) || defined(TARGET_NR_statfs64) \
8550     || defined(TARGET_NR_fstatfs)
8551     struct statfs stfs;
8552 #endif
8553     void *p;
8554 
8555     switch(num) {
8556     case TARGET_NR_exit:
8557         /* In old applications this may be used to implement _exit(2).
8558            However in threaded applications it is used for thread termination,
8559            and _exit_group is used for application termination.
8560            Do thread termination if we have more then one thread.  */
8561 
8562         if (block_signals()) {
8563             return -QEMU_ERESTARTSYS;
8564         }
8565 
8566         pthread_mutex_lock(&clone_lock);
8567 
8568         if (CPU_NEXT(first_cpu)) {
8569             TaskState *ts = cpu->opaque;
8570 
8571             object_property_set_bool(OBJECT(cpu), "realized", false, NULL);
8572             object_unref(OBJECT(cpu));
8573             /*
8574              * At this point the CPU should be unrealized and removed
8575              * from cpu lists. We can clean-up the rest of the thread
8576              * data without the lock held.
8577              */
8578 
8579             pthread_mutex_unlock(&clone_lock);
8580 
8581             if (ts->child_tidptr) {
8582                 put_user_u32(0, ts->child_tidptr);
8583                 do_sys_futex(g2h(cpu, ts->child_tidptr),
8584                              FUTEX_WAKE, INT_MAX, NULL, NULL, 0);
8585             }
8586             thread_cpu = NULL;
8587             g_free(ts);
8588             rcu_unregister_thread();
8589             pthread_exit(NULL);
8590         }
8591 
8592         pthread_mutex_unlock(&clone_lock);
8593         preexit_cleanup(cpu_env, arg1);
8594         _exit(arg1);
8595         return 0; /* avoid warning */
8596     case TARGET_NR_read:
8597         if (arg2 == 0 && arg3 == 0) {
8598             return get_errno(safe_read(arg1, 0, 0));
8599         } else {
8600             if (!(p = lock_user(VERIFY_WRITE, arg2, arg3, 0)))
8601                 return -TARGET_EFAULT;
8602             ret = get_errno(safe_read(arg1, p, arg3));
8603             if (ret >= 0 &&
8604                 fd_trans_host_to_target_data(arg1)) {
8605                 ret = fd_trans_host_to_target_data(arg1)(p, ret);
8606             }
8607             unlock_user(p, arg2, ret);
8608         }
8609         return ret;
8610     case TARGET_NR_write:
8611         if (arg2 == 0 && arg3 == 0) {
8612             return get_errno(safe_write(arg1, 0, 0));
8613         }
8614         if (!(p = lock_user(VERIFY_READ, arg2, arg3, 1)))
8615             return -TARGET_EFAULT;
8616         if (fd_trans_target_to_host_data(arg1)) {
8617             void *copy = g_malloc(arg3);
8618             memcpy(copy, p, arg3);
8619             ret = fd_trans_target_to_host_data(arg1)(copy, arg3);
8620             if (ret >= 0) {
8621                 ret = get_errno(safe_write(arg1, copy, ret));
8622             }
8623             g_free(copy);
8624         } else {
8625             ret = get_errno(safe_write(arg1, p, arg3));
8626         }
8627         unlock_user(p, arg2, 0);
8628         return ret;
8629 
8630 #ifdef TARGET_NR_open
8631     case TARGET_NR_open:
8632         if (!(p = lock_user_string(arg1)))
8633             return -TARGET_EFAULT;
8634         ret = get_errno(do_openat(cpu_env, AT_FDCWD, p,
8635                                   target_to_host_bitmask(arg2, fcntl_flags_tbl),
8636                                   arg3));
8637         fd_trans_unregister(ret);
8638         unlock_user(p, arg1, 0);
8639         return ret;
8640 #endif
8641     case TARGET_NR_openat:
8642         if (!(p = lock_user_string(arg2)))
8643             return -TARGET_EFAULT;
8644         ret = get_errno(do_openat(cpu_env, arg1, p,
8645                                   target_to_host_bitmask(arg3, fcntl_flags_tbl),
8646                                   arg4));
8647         fd_trans_unregister(ret);
8648         unlock_user(p, arg2, 0);
8649         return ret;
8650 #if defined(TARGET_NR_name_to_handle_at) && defined(CONFIG_OPEN_BY_HANDLE)
8651     case TARGET_NR_name_to_handle_at:
8652         ret = do_name_to_handle_at(arg1, arg2, arg3, arg4, arg5);
8653         return ret;
8654 #endif
8655 #if defined(TARGET_NR_open_by_handle_at) && defined(CONFIG_OPEN_BY_HANDLE)
8656     case TARGET_NR_open_by_handle_at:
8657         ret = do_open_by_handle_at(arg1, arg2, arg3);
8658         fd_trans_unregister(ret);
8659         return ret;
8660 #endif
8661 #if defined(__NR_pidfd_open) && defined(TARGET_NR_pidfd_open)
8662     case TARGET_NR_pidfd_open:
8663         return get_errno(pidfd_open(arg1, arg2));
8664 #endif
8665 #if defined(__NR_pidfd_send_signal) && defined(TARGET_NR_pidfd_send_signal)
8666     case TARGET_NR_pidfd_send_signal:
8667         {
8668             siginfo_t uinfo;
8669 
8670             p = lock_user(VERIFY_READ, arg3, sizeof(target_siginfo_t), 1);
8671             if (!p) {
8672                 return -TARGET_EFAULT;
8673             }
8674             target_to_host_siginfo(&uinfo, p);
8675             unlock_user(p, arg3, 0);
8676             ret = get_errno(pidfd_send_signal(arg1, target_to_host_signal(arg2),
8677                 &uinfo, arg4));
8678         }
8679         return ret;
8680 #endif
8681 #if defined(__NR_pidfd_getfd) && defined(TARGET_NR_pidfd_getfd)
8682     case TARGET_NR_pidfd_getfd:
8683         return get_errno(pidfd_getfd(arg1, arg2, arg3));
8684 #endif
8685     case TARGET_NR_close:
8686         fd_trans_unregister(arg1);
8687         return get_errno(close(arg1));
8688 
8689     case TARGET_NR_brk:
8690         return do_brk(arg1);
8691 #ifdef TARGET_NR_fork
8692     case TARGET_NR_fork:
8693         return get_errno(do_fork(cpu_env, TARGET_SIGCHLD, 0, 0, 0, 0));
8694 #endif
8695 #ifdef TARGET_NR_waitpid
8696     case TARGET_NR_waitpid:
8697         {
8698             int status;
8699             ret = get_errno(safe_wait4(arg1, &status, arg3, 0));
8700             if (!is_error(ret) && arg2 && ret
8701                 && put_user_s32(host_to_target_waitstatus(status), arg2))
8702                 return -TARGET_EFAULT;
8703         }
8704         return ret;
8705 #endif
8706 #ifdef TARGET_NR_waitid
8707     case TARGET_NR_waitid:
8708         {
8709             siginfo_t info;
8710             info.si_pid = 0;
8711             ret = get_errno(safe_waitid(arg1, arg2, &info, arg4, NULL));
8712             if (!is_error(ret) && arg3 && info.si_pid != 0) {
8713                 if (!(p = lock_user(VERIFY_WRITE, arg3, sizeof(target_siginfo_t), 0)))
8714                     return -TARGET_EFAULT;
8715                 host_to_target_siginfo(p, &info);
8716                 unlock_user(p, arg3, sizeof(target_siginfo_t));
8717             }
8718         }
8719         return ret;
8720 #endif
8721 #ifdef TARGET_NR_creat /* not on alpha */
8722     case TARGET_NR_creat:
8723         if (!(p = lock_user_string(arg1)))
8724             return -TARGET_EFAULT;
8725         ret = get_errno(creat(p, arg2));
8726         fd_trans_unregister(ret);
8727         unlock_user(p, arg1, 0);
8728         return ret;
8729 #endif
8730 #ifdef TARGET_NR_link
8731     case TARGET_NR_link:
8732         {
8733             void * p2;
8734             p = lock_user_string(arg1);
8735             p2 = lock_user_string(arg2);
8736             if (!p || !p2)
8737                 ret = -TARGET_EFAULT;
8738             else
8739                 ret = get_errno(link(p, p2));
8740             unlock_user(p2, arg2, 0);
8741             unlock_user(p, arg1, 0);
8742         }
8743         return ret;
8744 #endif
8745 #if defined(TARGET_NR_linkat)
8746     case TARGET_NR_linkat:
8747         {
8748             void * p2 = NULL;
8749             if (!arg2 || !arg4)
8750                 return -TARGET_EFAULT;
8751             p  = lock_user_string(arg2);
8752             p2 = lock_user_string(arg4);
8753             if (!p || !p2)
8754                 ret = -TARGET_EFAULT;
8755             else
8756                 ret = get_errno(linkat(arg1, p, arg3, p2, arg5));
8757             unlock_user(p, arg2, 0);
8758             unlock_user(p2, arg4, 0);
8759         }
8760         return ret;
8761 #endif
8762 #ifdef TARGET_NR_unlink
8763     case TARGET_NR_unlink:
8764         if (!(p = lock_user_string(arg1)))
8765             return -TARGET_EFAULT;
8766         ret = get_errno(unlink(p));
8767         unlock_user(p, arg1, 0);
8768         return ret;
8769 #endif
8770 #if defined(TARGET_NR_unlinkat)
8771     case TARGET_NR_unlinkat:
8772         if (!(p = lock_user_string(arg2)))
8773             return -TARGET_EFAULT;
8774         ret = get_errno(unlinkat(arg1, p, arg3));
8775         unlock_user(p, arg2, 0);
8776         return ret;
8777 #endif
8778     case TARGET_NR_execve:
8779         {
8780             char **argp, **envp;
8781             int argc, envc;
8782             abi_ulong gp;
8783             abi_ulong guest_argp;
8784             abi_ulong guest_envp;
8785             abi_ulong addr;
8786             char **q;
8787 
8788             argc = 0;
8789             guest_argp = arg2;
8790             for (gp = guest_argp; gp; gp += sizeof(abi_ulong)) {
8791                 if (get_user_ual(addr, gp))
8792                     return -TARGET_EFAULT;
8793                 if (!addr)
8794                     break;
8795                 argc++;
8796             }
8797             envc = 0;
8798             guest_envp = arg3;
8799             for (gp = guest_envp; gp; gp += sizeof(abi_ulong)) {
8800                 if (get_user_ual(addr, gp))
8801                     return -TARGET_EFAULT;
8802                 if (!addr)
8803                     break;
8804                 envc++;
8805             }
8806 
8807             argp = g_new0(char *, argc + 1);
8808             envp = g_new0(char *, envc + 1);
8809 
8810             for (gp = guest_argp, q = argp; gp;
8811                   gp += sizeof(abi_ulong), q++) {
8812                 if (get_user_ual(addr, gp))
8813                     goto execve_efault;
8814                 if (!addr)
8815                     break;
8816                 if (!(*q = lock_user_string(addr)))
8817                     goto execve_efault;
8818             }
8819             *q = NULL;
8820 
8821             for (gp = guest_envp, q = envp; gp;
8822                   gp += sizeof(abi_ulong), q++) {
8823                 if (get_user_ual(addr, gp))
8824                     goto execve_efault;
8825                 if (!addr)
8826                     break;
8827                 if (!(*q = lock_user_string(addr)))
8828                     goto execve_efault;
8829             }
8830             *q = NULL;
8831 
8832             if (!(p = lock_user_string(arg1)))
8833                 goto execve_efault;
8834             /* Although execve() is not an interruptible syscall it is
8835              * a special case where we must use the safe_syscall wrapper:
8836              * if we allow a signal to happen before we make the host
8837              * syscall then we will 'lose' it, because at the point of
8838              * execve the process leaves QEMU's control. So we use the
8839              * safe syscall wrapper to ensure that we either take the
8840              * signal as a guest signal, or else it does not happen
8841              * before the execve completes and makes it the other
8842              * program's problem.
8843              */
8844             ret = get_errno(safe_execve(p, argp, envp));
8845             unlock_user(p, arg1, 0);
8846 
8847             goto execve_end;
8848 
8849         execve_efault:
8850             ret = -TARGET_EFAULT;
8851 
8852         execve_end:
8853             for (gp = guest_argp, q = argp; *q;
8854                   gp += sizeof(abi_ulong), q++) {
8855                 if (get_user_ual(addr, gp)
8856                     || !addr)
8857                     break;
8858                 unlock_user(*q, addr, 0);
8859             }
8860             for (gp = guest_envp, q = envp; *q;
8861                   gp += sizeof(abi_ulong), q++) {
8862                 if (get_user_ual(addr, gp)
8863                     || !addr)
8864                     break;
8865                 unlock_user(*q, addr, 0);
8866             }
8867 
8868             g_free(argp);
8869             g_free(envp);
8870         }
8871         return ret;
8872     case TARGET_NR_chdir:
8873         if (!(p = lock_user_string(arg1)))
8874             return -TARGET_EFAULT;
8875         ret = get_errno(chdir(p));
8876         unlock_user(p, arg1, 0);
8877         return ret;
8878 #ifdef TARGET_NR_time
8879     case TARGET_NR_time:
8880         {
8881             time_t host_time;
8882             ret = get_errno(time(&host_time));
8883             if (!is_error(ret)
8884                 && arg1
8885                 && put_user_sal(host_time, arg1))
8886                 return -TARGET_EFAULT;
8887         }
8888         return ret;
8889 #endif
8890 #ifdef TARGET_NR_mknod
8891     case TARGET_NR_mknod:
8892         if (!(p = lock_user_string(arg1)))
8893             return -TARGET_EFAULT;
8894         ret = get_errno(mknod(p, arg2, arg3));
8895         unlock_user(p, arg1, 0);
8896         return ret;
8897 #endif
8898 #if defined(TARGET_NR_mknodat)
8899     case TARGET_NR_mknodat:
8900         if (!(p = lock_user_string(arg2)))
8901             return -TARGET_EFAULT;
8902         ret = get_errno(mknodat(arg1, p, arg3, arg4));
8903         unlock_user(p, arg2, 0);
8904         return ret;
8905 #endif
8906 #ifdef TARGET_NR_chmod
8907     case TARGET_NR_chmod:
8908         if (!(p = lock_user_string(arg1)))
8909             return -TARGET_EFAULT;
8910         ret = get_errno(chmod(p, arg2));
8911         unlock_user(p, arg1, 0);
8912         return ret;
8913 #endif
8914 #ifdef TARGET_NR_lseek
8915     case TARGET_NR_lseek:
8916         return get_errno(lseek(arg1, arg2, arg3));
8917 #endif
8918 #if defined(TARGET_NR_getxpid) && defined(TARGET_ALPHA)
8919     /* Alpha specific */
8920     case TARGET_NR_getxpid:
8921         cpu_env->ir[IR_A4] = getppid();
8922         return get_errno(getpid());
8923 #endif
8924 #ifdef TARGET_NR_getpid
8925     case TARGET_NR_getpid:
8926         return get_errno(getpid());
8927 #endif
8928     case TARGET_NR_mount:
8929         {
8930             /* need to look at the data field */
8931             void *p2, *p3;
8932 
8933             if (arg1) {
8934                 p = lock_user_string(arg1);
8935                 if (!p) {
8936                     return -TARGET_EFAULT;
8937                 }
8938             } else {
8939                 p = NULL;
8940             }
8941 
8942             p2 = lock_user_string(arg2);
8943             if (!p2) {
8944                 if (arg1) {
8945                     unlock_user(p, arg1, 0);
8946                 }
8947                 return -TARGET_EFAULT;
8948             }
8949 
8950             if (arg3) {
8951                 p3 = lock_user_string(arg3);
8952                 if (!p3) {
8953                     if (arg1) {
8954                         unlock_user(p, arg1, 0);
8955                     }
8956                     unlock_user(p2, arg2, 0);
8957                     return -TARGET_EFAULT;
8958                 }
8959             } else {
8960                 p3 = NULL;
8961             }
8962 
8963             /* FIXME - arg5 should be locked, but it isn't clear how to
8964              * do that since it's not guaranteed to be a NULL-terminated
8965              * string.
8966              */
8967             if (!arg5) {
8968                 ret = mount(p, p2, p3, (unsigned long)arg4, NULL);
8969             } else {
8970                 ret = mount(p, p2, p3, (unsigned long)arg4, g2h(cpu, arg5));
8971             }
8972             ret = get_errno(ret);
8973 
8974             if (arg1) {
8975                 unlock_user(p, arg1, 0);
8976             }
8977             unlock_user(p2, arg2, 0);
8978             if (arg3) {
8979                 unlock_user(p3, arg3, 0);
8980             }
8981         }
8982         return ret;
8983 #if defined(TARGET_NR_umount) || defined(TARGET_NR_oldumount)
8984 #if defined(TARGET_NR_umount)
8985     case TARGET_NR_umount:
8986 #endif
8987 #if defined(TARGET_NR_oldumount)
8988     case TARGET_NR_oldumount:
8989 #endif
8990         if (!(p = lock_user_string(arg1)))
8991             return -TARGET_EFAULT;
8992         ret = get_errno(umount(p));
8993         unlock_user(p, arg1, 0);
8994         return ret;
8995 #endif
8996 #ifdef TARGET_NR_stime /* not on alpha */
8997     case TARGET_NR_stime:
8998         {
8999             struct timespec ts;
9000             ts.tv_nsec = 0;
9001             if (get_user_sal(ts.tv_sec, arg1)) {
9002                 return -TARGET_EFAULT;
9003             }
9004             return get_errno(clock_settime(CLOCK_REALTIME, &ts));
9005         }
9006 #endif
9007 #ifdef TARGET_NR_alarm /* not on alpha */
9008     case TARGET_NR_alarm:
9009         return alarm(arg1);
9010 #endif
9011 #ifdef TARGET_NR_pause /* not on alpha */
9012     case TARGET_NR_pause:
9013         if (!block_signals()) {
9014             sigsuspend(&((TaskState *)cpu->opaque)->signal_mask);
9015         }
9016         return -TARGET_EINTR;
9017 #endif
9018 #ifdef TARGET_NR_utime
9019     case TARGET_NR_utime:
9020         {
9021             struct utimbuf tbuf, *host_tbuf;
9022             struct target_utimbuf *target_tbuf;
9023             if (arg2) {
9024                 if (!lock_user_struct(VERIFY_READ, target_tbuf, arg2, 1))
9025                     return -TARGET_EFAULT;
9026                 tbuf.actime = tswapal(target_tbuf->actime);
9027                 tbuf.modtime = tswapal(target_tbuf->modtime);
9028                 unlock_user_struct(target_tbuf, arg2, 0);
9029                 host_tbuf = &tbuf;
9030             } else {
9031                 host_tbuf = NULL;
9032             }
9033             if (!(p = lock_user_string(arg1)))
9034                 return -TARGET_EFAULT;
9035             ret = get_errno(utime(p, host_tbuf));
9036             unlock_user(p, arg1, 0);
9037         }
9038         return ret;
9039 #endif
9040 #ifdef TARGET_NR_utimes
9041     case TARGET_NR_utimes:
9042         {
9043             struct timeval *tvp, tv[2];
9044             if (arg2) {
9045                 if (copy_from_user_timeval(&tv[0], arg2)
9046                     || copy_from_user_timeval(&tv[1],
9047                                               arg2 + sizeof(struct target_timeval)))
9048                     return -TARGET_EFAULT;
9049                 tvp = tv;
9050             } else {
9051                 tvp = NULL;
9052             }
9053             if (!(p = lock_user_string(arg1)))
9054                 return -TARGET_EFAULT;
9055             ret = get_errno(utimes(p, tvp));
9056             unlock_user(p, arg1, 0);
9057         }
9058         return ret;
9059 #endif
9060 #if defined(TARGET_NR_futimesat)
9061     case TARGET_NR_futimesat:
9062         {
9063             struct timeval *tvp, tv[2];
9064             if (arg3) {
9065                 if (copy_from_user_timeval(&tv[0], arg3)
9066                     || copy_from_user_timeval(&tv[1],
9067                                               arg3 + sizeof(struct target_timeval)))
9068                     return -TARGET_EFAULT;
9069                 tvp = tv;
9070             } else {
9071                 tvp = NULL;
9072             }
9073             if (!(p = lock_user_string(arg2))) {
9074                 return -TARGET_EFAULT;
9075             }
9076             ret = get_errno(futimesat(arg1, path(p), tvp));
9077             unlock_user(p, arg2, 0);
9078         }
9079         return ret;
9080 #endif
9081 #ifdef TARGET_NR_access
9082     case TARGET_NR_access:
9083         if (!(p = lock_user_string(arg1))) {
9084             return -TARGET_EFAULT;
9085         }
9086         ret = get_errno(access(path(p), arg2));
9087         unlock_user(p, arg1, 0);
9088         return ret;
9089 #endif
9090 #if defined(TARGET_NR_faccessat) && defined(__NR_faccessat)
9091     case TARGET_NR_faccessat:
9092         if (!(p = lock_user_string(arg2))) {
9093             return -TARGET_EFAULT;
9094         }
9095         ret = get_errno(faccessat(arg1, p, arg3, 0));
9096         unlock_user(p, arg2, 0);
9097         return ret;
9098 #endif
9099 #ifdef TARGET_NR_nice /* not on alpha */
9100     case TARGET_NR_nice:
9101         return get_errno(nice(arg1));
9102 #endif
9103     case TARGET_NR_sync:
9104         sync();
9105         return 0;
9106 #if defined(TARGET_NR_syncfs) && defined(CONFIG_SYNCFS)
9107     case TARGET_NR_syncfs:
9108         return get_errno(syncfs(arg1));
9109 #endif
9110     case TARGET_NR_kill:
9111         return get_errno(safe_kill(arg1, target_to_host_signal(arg2)));
9112 #ifdef TARGET_NR_rename
9113     case TARGET_NR_rename:
9114         {
9115             void *p2;
9116             p = lock_user_string(arg1);
9117             p2 = lock_user_string(arg2);
9118             if (!p || !p2)
9119                 ret = -TARGET_EFAULT;
9120             else
9121                 ret = get_errno(rename(p, p2));
9122             unlock_user(p2, arg2, 0);
9123             unlock_user(p, arg1, 0);
9124         }
9125         return ret;
9126 #endif
9127 #if defined(TARGET_NR_renameat)
9128     case TARGET_NR_renameat:
9129         {
9130             void *p2;
9131             p  = lock_user_string(arg2);
9132             p2 = lock_user_string(arg4);
9133             if (!p || !p2)
9134                 ret = -TARGET_EFAULT;
9135             else
9136                 ret = get_errno(renameat(arg1, p, arg3, p2));
9137             unlock_user(p2, arg4, 0);
9138             unlock_user(p, arg2, 0);
9139         }
9140         return ret;
9141 #endif
9142 #if defined(TARGET_NR_renameat2)
9143     case TARGET_NR_renameat2:
9144         {
9145             void *p2;
9146             p  = lock_user_string(arg2);
9147             p2 = lock_user_string(arg4);
9148             if (!p || !p2) {
9149                 ret = -TARGET_EFAULT;
9150             } else {
9151                 ret = get_errno(sys_renameat2(arg1, p, arg3, p2, arg5));
9152             }
9153             unlock_user(p2, arg4, 0);
9154             unlock_user(p, arg2, 0);
9155         }
9156         return ret;
9157 #endif
9158 #ifdef TARGET_NR_mkdir
9159     case TARGET_NR_mkdir:
9160         if (!(p = lock_user_string(arg1)))
9161             return -TARGET_EFAULT;
9162         ret = get_errno(mkdir(p, arg2));
9163         unlock_user(p, arg1, 0);
9164         return ret;
9165 #endif
9166 #if defined(TARGET_NR_mkdirat)
9167     case TARGET_NR_mkdirat:
9168         if (!(p = lock_user_string(arg2)))
9169             return -TARGET_EFAULT;
9170         ret = get_errno(mkdirat(arg1, p, arg3));
9171         unlock_user(p, arg2, 0);
9172         return ret;
9173 #endif
9174 #ifdef TARGET_NR_rmdir
9175     case TARGET_NR_rmdir:
9176         if (!(p = lock_user_string(arg1)))
9177             return -TARGET_EFAULT;
9178         ret = get_errno(rmdir(p));
9179         unlock_user(p, arg1, 0);
9180         return ret;
9181 #endif
9182     case TARGET_NR_dup:
9183         ret = get_errno(dup(arg1));
9184         if (ret >= 0) {
9185             fd_trans_dup(arg1, ret);
9186         }
9187         return ret;
9188 #ifdef TARGET_NR_pipe
9189     case TARGET_NR_pipe:
9190         return do_pipe(cpu_env, arg1, 0, 0);
9191 #endif
9192 #ifdef TARGET_NR_pipe2
9193     case TARGET_NR_pipe2:
9194         return do_pipe(cpu_env, arg1,
9195                        target_to_host_bitmask(arg2, fcntl_flags_tbl), 1);
9196 #endif
9197     case TARGET_NR_times:
9198         {
9199             struct target_tms *tmsp;
9200             struct tms tms;
9201             ret = get_errno(times(&tms));
9202             if (arg1) {
9203                 tmsp = lock_user(VERIFY_WRITE, arg1, sizeof(struct target_tms), 0);
9204                 if (!tmsp)
9205                     return -TARGET_EFAULT;
9206                 tmsp->tms_utime = tswapal(host_to_target_clock_t(tms.tms_utime));
9207                 tmsp->tms_stime = tswapal(host_to_target_clock_t(tms.tms_stime));
9208                 tmsp->tms_cutime = tswapal(host_to_target_clock_t(tms.tms_cutime));
9209                 tmsp->tms_cstime = tswapal(host_to_target_clock_t(tms.tms_cstime));
9210             }
9211             if (!is_error(ret))
9212                 ret = host_to_target_clock_t(ret);
9213         }
9214         return ret;
9215     case TARGET_NR_acct:
9216         if (arg1 == 0) {
9217             ret = get_errno(acct(NULL));
9218         } else {
9219             if (!(p = lock_user_string(arg1))) {
9220                 return -TARGET_EFAULT;
9221             }
9222             ret = get_errno(acct(path(p)));
9223             unlock_user(p, arg1, 0);
9224         }
9225         return ret;
9226 #ifdef TARGET_NR_umount2
9227     case TARGET_NR_umount2:
9228         if (!(p = lock_user_string(arg1)))
9229             return -TARGET_EFAULT;
9230         ret = get_errno(umount2(p, arg2));
9231         unlock_user(p, arg1, 0);
9232         return ret;
9233 #endif
9234     case TARGET_NR_ioctl:
9235         return do_ioctl(arg1, arg2, arg3);
9236 #ifdef TARGET_NR_fcntl
9237     case TARGET_NR_fcntl:
9238         return do_fcntl(arg1, arg2, arg3);
9239 #endif
9240     case TARGET_NR_setpgid:
9241         return get_errno(setpgid(arg1, arg2));
9242     case TARGET_NR_umask:
9243         return get_errno(umask(arg1));
9244     case TARGET_NR_chroot:
9245         if (!(p = lock_user_string(arg1)))
9246             return -TARGET_EFAULT;
9247         ret = get_errno(chroot(p));
9248         unlock_user(p, arg1, 0);
9249         return ret;
9250 #ifdef TARGET_NR_dup2
9251     case TARGET_NR_dup2:
9252         ret = get_errno(dup2(arg1, arg2));
9253         if (ret >= 0) {
9254             fd_trans_dup(arg1, arg2);
9255         }
9256         return ret;
9257 #endif
9258 #if defined(CONFIG_DUP3) && defined(TARGET_NR_dup3)
9259     case TARGET_NR_dup3:
9260     {
9261         int host_flags;
9262 
9263         if ((arg3 & ~TARGET_O_CLOEXEC) != 0) {
9264             return -EINVAL;
9265         }
9266         host_flags = target_to_host_bitmask(arg3, fcntl_flags_tbl);
9267         ret = get_errno(dup3(arg1, arg2, host_flags));
9268         if (ret >= 0) {
9269             fd_trans_dup(arg1, arg2);
9270         }
9271         return ret;
9272     }
9273 #endif
9274 #ifdef TARGET_NR_getppid /* not on alpha */
9275     case TARGET_NR_getppid:
9276         return get_errno(getppid());
9277 #endif
9278 #ifdef TARGET_NR_getpgrp
9279     case TARGET_NR_getpgrp:
9280         return get_errno(getpgrp());
9281 #endif
9282     case TARGET_NR_setsid:
9283         return get_errno(setsid());
9284 #ifdef TARGET_NR_sigaction
9285     case TARGET_NR_sigaction:
9286         {
9287 #if defined(TARGET_MIPS)
9288 	    struct target_sigaction act, oact, *pact, *old_act;
9289 
9290 	    if (arg2) {
9291                 if (!lock_user_struct(VERIFY_READ, old_act, arg2, 1))
9292                     return -TARGET_EFAULT;
9293 		act._sa_handler = old_act->_sa_handler;
9294 		target_siginitset(&act.sa_mask, old_act->sa_mask.sig[0]);
9295 		act.sa_flags = old_act->sa_flags;
9296 		unlock_user_struct(old_act, arg2, 0);
9297 		pact = &act;
9298 	    } else {
9299 		pact = NULL;
9300 	    }
9301 
9302         ret = get_errno(do_sigaction(arg1, pact, &oact, 0));
9303 
9304 	    if (!is_error(ret) && arg3) {
9305                 if (!lock_user_struct(VERIFY_WRITE, old_act, arg3, 0))
9306                     return -TARGET_EFAULT;
9307 		old_act->_sa_handler = oact._sa_handler;
9308 		old_act->sa_flags = oact.sa_flags;
9309 		old_act->sa_mask.sig[0] = oact.sa_mask.sig[0];
9310 		old_act->sa_mask.sig[1] = 0;
9311 		old_act->sa_mask.sig[2] = 0;
9312 		old_act->sa_mask.sig[3] = 0;
9313 		unlock_user_struct(old_act, arg3, 1);
9314 	    }
9315 #else
9316             struct target_old_sigaction *old_act;
9317             struct target_sigaction act, oact, *pact;
9318             if (arg2) {
9319                 if (!lock_user_struct(VERIFY_READ, old_act, arg2, 1))
9320                     return -TARGET_EFAULT;
9321                 act._sa_handler = old_act->_sa_handler;
9322                 target_siginitset(&act.sa_mask, old_act->sa_mask);
9323                 act.sa_flags = old_act->sa_flags;
9324 #ifdef TARGET_ARCH_HAS_SA_RESTORER
9325                 act.sa_restorer = old_act->sa_restorer;
9326 #endif
9327                 unlock_user_struct(old_act, arg2, 0);
9328                 pact = &act;
9329             } else {
9330                 pact = NULL;
9331             }
9332             ret = get_errno(do_sigaction(arg1, pact, &oact, 0));
9333             if (!is_error(ret) && arg3) {
9334                 if (!lock_user_struct(VERIFY_WRITE, old_act, arg3, 0))
9335                     return -TARGET_EFAULT;
9336                 old_act->_sa_handler = oact._sa_handler;
9337                 old_act->sa_mask = oact.sa_mask.sig[0];
9338                 old_act->sa_flags = oact.sa_flags;
9339 #ifdef TARGET_ARCH_HAS_SA_RESTORER
9340                 old_act->sa_restorer = oact.sa_restorer;
9341 #endif
9342                 unlock_user_struct(old_act, arg3, 1);
9343             }
9344 #endif
9345         }
9346         return ret;
9347 #endif
9348     case TARGET_NR_rt_sigaction:
9349         {
9350             /*
9351              * For Alpha and SPARC this is a 5 argument syscall, with
9352              * a 'restorer' parameter which must be copied into the
9353              * sa_restorer field of the sigaction struct.
9354              * For Alpha that 'restorer' is arg5; for SPARC it is arg4,
9355              * and arg5 is the sigsetsize.
9356              */
9357 #if defined(TARGET_ALPHA)
9358             target_ulong sigsetsize = arg4;
9359             target_ulong restorer = arg5;
9360 #elif defined(TARGET_SPARC)
9361             target_ulong restorer = arg4;
9362             target_ulong sigsetsize = arg5;
9363 #else
9364             target_ulong sigsetsize = arg4;
9365             target_ulong restorer = 0;
9366 #endif
9367             struct target_sigaction *act = NULL;
9368             struct target_sigaction *oact = NULL;
9369 
9370             if (sigsetsize != sizeof(target_sigset_t)) {
9371                 return -TARGET_EINVAL;
9372             }
9373             if (arg2 && !lock_user_struct(VERIFY_READ, act, arg2, 1)) {
9374                 return -TARGET_EFAULT;
9375             }
9376             if (arg3 && !lock_user_struct(VERIFY_WRITE, oact, arg3, 0)) {
9377                 ret = -TARGET_EFAULT;
9378             } else {
9379                 ret = get_errno(do_sigaction(arg1, act, oact, restorer));
9380                 if (oact) {
9381                     unlock_user_struct(oact, arg3, 1);
9382                 }
9383             }
9384             if (act) {
9385                 unlock_user_struct(act, arg2, 0);
9386             }
9387         }
9388         return ret;
9389 #ifdef TARGET_NR_sgetmask /* not on alpha */
9390     case TARGET_NR_sgetmask:
9391         {
9392             sigset_t cur_set;
9393             abi_ulong target_set;
9394             ret = do_sigprocmask(0, NULL, &cur_set);
9395             if (!ret) {
9396                 host_to_target_old_sigset(&target_set, &cur_set);
9397                 ret = target_set;
9398             }
9399         }
9400         return ret;
9401 #endif
9402 #ifdef TARGET_NR_ssetmask /* not on alpha */
9403     case TARGET_NR_ssetmask:
9404         {
9405             sigset_t set, oset;
9406             abi_ulong target_set = arg1;
9407             target_to_host_old_sigset(&set, &target_set);
9408             ret = do_sigprocmask(SIG_SETMASK, &set, &oset);
9409             if (!ret) {
9410                 host_to_target_old_sigset(&target_set, &oset);
9411                 ret = target_set;
9412             }
9413         }
9414         return ret;
9415 #endif
9416 #ifdef TARGET_NR_sigprocmask
9417     case TARGET_NR_sigprocmask:
9418         {
9419 #if defined(TARGET_ALPHA)
9420             sigset_t set, oldset;
9421             abi_ulong mask;
9422             int how;
9423 
9424             switch (arg1) {
9425             case TARGET_SIG_BLOCK:
9426                 how = SIG_BLOCK;
9427                 break;
9428             case TARGET_SIG_UNBLOCK:
9429                 how = SIG_UNBLOCK;
9430                 break;
9431             case TARGET_SIG_SETMASK:
9432                 how = SIG_SETMASK;
9433                 break;
9434             default:
9435                 return -TARGET_EINVAL;
9436             }
9437             mask = arg2;
9438             target_to_host_old_sigset(&set, &mask);
9439 
9440             ret = do_sigprocmask(how, &set, &oldset);
9441             if (!is_error(ret)) {
9442                 host_to_target_old_sigset(&mask, &oldset);
9443                 ret = mask;
9444                 cpu_env->ir[IR_V0] = 0; /* force no error */
9445             }
9446 #else
9447             sigset_t set, oldset, *set_ptr;
9448             int how;
9449 
9450             if (arg2) {
9451                 p = lock_user(VERIFY_READ, arg2, sizeof(target_sigset_t), 1);
9452                 if (!p) {
9453                     return -TARGET_EFAULT;
9454                 }
9455                 target_to_host_old_sigset(&set, p);
9456                 unlock_user(p, arg2, 0);
9457                 set_ptr = &set;
9458                 switch (arg1) {
9459                 case TARGET_SIG_BLOCK:
9460                     how = SIG_BLOCK;
9461                     break;
9462                 case TARGET_SIG_UNBLOCK:
9463                     how = SIG_UNBLOCK;
9464                     break;
9465                 case TARGET_SIG_SETMASK:
9466                     how = SIG_SETMASK;
9467                     break;
9468                 default:
9469                     return -TARGET_EINVAL;
9470                 }
9471             } else {
9472                 how = 0;
9473                 set_ptr = NULL;
9474             }
9475             ret = do_sigprocmask(how, set_ptr, &oldset);
9476             if (!is_error(ret) && arg3) {
9477                 if (!(p = lock_user(VERIFY_WRITE, arg3, sizeof(target_sigset_t), 0)))
9478                     return -TARGET_EFAULT;
9479                 host_to_target_old_sigset(p, &oldset);
9480                 unlock_user(p, arg3, sizeof(target_sigset_t));
9481             }
9482 #endif
9483         }
9484         return ret;
9485 #endif
9486     case TARGET_NR_rt_sigprocmask:
9487         {
9488             int how = arg1;
9489             sigset_t set, oldset, *set_ptr;
9490 
9491             if (arg4 != sizeof(target_sigset_t)) {
9492                 return -TARGET_EINVAL;
9493             }
9494 
9495             if (arg2) {
9496                 p = lock_user(VERIFY_READ, arg2, sizeof(target_sigset_t), 1);
9497                 if (!p) {
9498                     return -TARGET_EFAULT;
9499                 }
9500                 target_to_host_sigset(&set, p);
9501                 unlock_user(p, arg2, 0);
9502                 set_ptr = &set;
9503                 switch(how) {
9504                 case TARGET_SIG_BLOCK:
9505                     how = SIG_BLOCK;
9506                     break;
9507                 case TARGET_SIG_UNBLOCK:
9508                     how = SIG_UNBLOCK;
9509                     break;
9510                 case TARGET_SIG_SETMASK:
9511                     how = SIG_SETMASK;
9512                     break;
9513                 default:
9514                     return -TARGET_EINVAL;
9515                 }
9516             } else {
9517                 how = 0;
9518                 set_ptr = NULL;
9519             }
9520             ret = do_sigprocmask(how, set_ptr, &oldset);
9521             if (!is_error(ret) && arg3) {
9522                 if (!(p = lock_user(VERIFY_WRITE, arg3, sizeof(target_sigset_t), 0)))
9523                     return -TARGET_EFAULT;
9524                 host_to_target_sigset(p, &oldset);
9525                 unlock_user(p, arg3, sizeof(target_sigset_t));
9526             }
9527         }
9528         return ret;
9529 #ifdef TARGET_NR_sigpending
9530     case TARGET_NR_sigpending:
9531         {
9532             sigset_t set;
9533             ret = get_errno(sigpending(&set));
9534             if (!is_error(ret)) {
9535                 if (!(p = lock_user(VERIFY_WRITE, arg1, sizeof(target_sigset_t), 0)))
9536                     return -TARGET_EFAULT;
9537                 host_to_target_old_sigset(p, &set);
9538                 unlock_user(p, arg1, sizeof(target_sigset_t));
9539             }
9540         }
9541         return ret;
9542 #endif
9543     case TARGET_NR_rt_sigpending:
9544         {
9545             sigset_t set;
9546 
9547             /* Yes, this check is >, not != like most. We follow the kernel's
9548              * logic and it does it like this because it implements
9549              * NR_sigpending through the same code path, and in that case
9550              * the old_sigset_t is smaller in size.
9551              */
9552             if (arg2 > sizeof(target_sigset_t)) {
9553                 return -TARGET_EINVAL;
9554             }
9555 
9556             ret = get_errno(sigpending(&set));
9557             if (!is_error(ret)) {
9558                 if (!(p = lock_user(VERIFY_WRITE, arg1, sizeof(target_sigset_t), 0)))
9559                     return -TARGET_EFAULT;
9560                 host_to_target_sigset(p, &set);
9561                 unlock_user(p, arg1, sizeof(target_sigset_t));
9562             }
9563         }
9564         return ret;
9565 #ifdef TARGET_NR_sigsuspend
9566     case TARGET_NR_sigsuspend:
9567         {
9568             sigset_t *set;
9569 
9570 #if defined(TARGET_ALPHA)
9571             TaskState *ts = cpu->opaque;
9572             /* target_to_host_old_sigset will bswap back */
9573             abi_ulong mask = tswapal(arg1);
9574             set = &ts->sigsuspend_mask;
9575             target_to_host_old_sigset(set, &mask);
9576 #else
9577             ret = process_sigsuspend_mask(&set, arg1, sizeof(target_sigset_t));
9578             if (ret != 0) {
9579                 return ret;
9580             }
9581 #endif
9582             ret = get_errno(safe_rt_sigsuspend(set, SIGSET_T_SIZE));
9583             finish_sigsuspend_mask(ret);
9584         }
9585         return ret;
9586 #endif
9587     case TARGET_NR_rt_sigsuspend:
9588         {
9589             sigset_t *set;
9590 
9591             ret = process_sigsuspend_mask(&set, arg1, arg2);
9592             if (ret != 0) {
9593                 return ret;
9594             }
9595             ret = get_errno(safe_rt_sigsuspend(set, SIGSET_T_SIZE));
9596             finish_sigsuspend_mask(ret);
9597         }
9598         return ret;
9599 #ifdef TARGET_NR_rt_sigtimedwait
9600     case TARGET_NR_rt_sigtimedwait:
9601         {
9602             sigset_t set;
9603             struct timespec uts, *puts;
9604             siginfo_t uinfo;
9605 
9606             if (arg4 != sizeof(target_sigset_t)) {
9607                 return -TARGET_EINVAL;
9608             }
9609 
9610             if (!(p = lock_user(VERIFY_READ, arg1, sizeof(target_sigset_t), 1)))
9611                 return -TARGET_EFAULT;
9612             target_to_host_sigset(&set, p);
9613             unlock_user(p, arg1, 0);
9614             if (arg3) {
9615                 puts = &uts;
9616                 if (target_to_host_timespec(puts, arg3)) {
9617                     return -TARGET_EFAULT;
9618                 }
9619             } else {
9620                 puts = NULL;
9621             }
9622             ret = get_errno(safe_rt_sigtimedwait(&set, &uinfo, puts,
9623                                                  SIGSET_T_SIZE));
9624             if (!is_error(ret)) {
9625                 if (arg2) {
9626                     p = lock_user(VERIFY_WRITE, arg2, sizeof(target_siginfo_t),
9627                                   0);
9628                     if (!p) {
9629                         return -TARGET_EFAULT;
9630                     }
9631                     host_to_target_siginfo(p, &uinfo);
9632                     unlock_user(p, arg2, sizeof(target_siginfo_t));
9633                 }
9634                 ret = host_to_target_signal(ret);
9635             }
9636         }
9637         return ret;
9638 #endif
9639 #ifdef TARGET_NR_rt_sigtimedwait_time64
9640     case TARGET_NR_rt_sigtimedwait_time64:
9641         {
9642             sigset_t set;
9643             struct timespec uts, *puts;
9644             siginfo_t uinfo;
9645 
9646             if (arg4 != sizeof(target_sigset_t)) {
9647                 return -TARGET_EINVAL;
9648             }
9649 
9650             p = lock_user(VERIFY_READ, arg1, sizeof(target_sigset_t), 1);
9651             if (!p) {
9652                 return -TARGET_EFAULT;
9653             }
9654             target_to_host_sigset(&set, p);
9655             unlock_user(p, arg1, 0);
9656             if (arg3) {
9657                 puts = &uts;
9658                 if (target_to_host_timespec64(puts, arg3)) {
9659                     return -TARGET_EFAULT;
9660                 }
9661             } else {
9662                 puts = NULL;
9663             }
9664             ret = get_errno(safe_rt_sigtimedwait(&set, &uinfo, puts,
9665                                                  SIGSET_T_SIZE));
9666             if (!is_error(ret)) {
9667                 if (arg2) {
9668                     p = lock_user(VERIFY_WRITE, arg2,
9669                                   sizeof(target_siginfo_t), 0);
9670                     if (!p) {
9671                         return -TARGET_EFAULT;
9672                     }
9673                     host_to_target_siginfo(p, &uinfo);
9674                     unlock_user(p, arg2, sizeof(target_siginfo_t));
9675                 }
9676                 ret = host_to_target_signal(ret);
9677             }
9678         }
9679         return ret;
9680 #endif
9681     case TARGET_NR_rt_sigqueueinfo:
9682         {
9683             siginfo_t uinfo;
9684 
9685             p = lock_user(VERIFY_READ, arg3, sizeof(target_siginfo_t), 1);
9686             if (!p) {
9687                 return -TARGET_EFAULT;
9688             }
9689             target_to_host_siginfo(&uinfo, p);
9690             unlock_user(p, arg3, 0);
9691             ret = get_errno(sys_rt_sigqueueinfo(arg1, target_to_host_signal(arg2), &uinfo));
9692         }
9693         return ret;
9694     case TARGET_NR_rt_tgsigqueueinfo:
9695         {
9696             siginfo_t uinfo;
9697 
9698             p = lock_user(VERIFY_READ, arg4, sizeof(target_siginfo_t), 1);
9699             if (!p) {
9700                 return -TARGET_EFAULT;
9701             }
9702             target_to_host_siginfo(&uinfo, p);
9703             unlock_user(p, arg4, 0);
9704             ret = get_errno(sys_rt_tgsigqueueinfo(arg1, arg2, target_to_host_signal(arg3), &uinfo));
9705         }
9706         return ret;
9707 #ifdef TARGET_NR_sigreturn
9708     case TARGET_NR_sigreturn:
9709         if (block_signals()) {
9710             return -QEMU_ERESTARTSYS;
9711         }
9712         return do_sigreturn(cpu_env);
9713 #endif
9714     case TARGET_NR_rt_sigreturn:
9715         if (block_signals()) {
9716             return -QEMU_ERESTARTSYS;
9717         }
9718         return do_rt_sigreturn(cpu_env);
9719     case TARGET_NR_sethostname:
9720         if (!(p = lock_user_string(arg1)))
9721             return -TARGET_EFAULT;
9722         ret = get_errno(sethostname(p, arg2));
9723         unlock_user(p, arg1, 0);
9724         return ret;
9725 #ifdef TARGET_NR_setrlimit
9726     case TARGET_NR_setrlimit:
9727         {
9728             int resource = target_to_host_resource(arg1);
9729             struct target_rlimit *target_rlim;
9730             struct rlimit rlim;
9731             if (!lock_user_struct(VERIFY_READ, target_rlim, arg2, 1))
9732                 return -TARGET_EFAULT;
9733             rlim.rlim_cur = target_to_host_rlim(target_rlim->rlim_cur);
9734             rlim.rlim_max = target_to_host_rlim(target_rlim->rlim_max);
9735             unlock_user_struct(target_rlim, arg2, 0);
9736             /*
9737              * If we just passed through resource limit settings for memory then
9738              * they would also apply to QEMU's own allocations, and QEMU will
9739              * crash or hang or die if its allocations fail. Ideally we would
9740              * track the guest allocations in QEMU and apply the limits ourselves.
9741              * For now, just tell the guest the call succeeded but don't actually
9742              * limit anything.
9743              */
9744             if (resource != RLIMIT_AS &&
9745                 resource != RLIMIT_DATA &&
9746                 resource != RLIMIT_STACK) {
9747                 return get_errno(setrlimit(resource, &rlim));
9748             } else {
9749                 return 0;
9750             }
9751         }
9752 #endif
9753 #ifdef TARGET_NR_getrlimit
9754     case TARGET_NR_getrlimit:
9755         {
9756             int resource = target_to_host_resource(arg1);
9757             struct target_rlimit *target_rlim;
9758             struct rlimit rlim;
9759 
9760             ret = get_errno(getrlimit(resource, &rlim));
9761             if (!is_error(ret)) {
9762                 if (!lock_user_struct(VERIFY_WRITE, target_rlim, arg2, 0))
9763                     return -TARGET_EFAULT;
9764                 target_rlim->rlim_cur = host_to_target_rlim(rlim.rlim_cur);
9765                 target_rlim->rlim_max = host_to_target_rlim(rlim.rlim_max);
9766                 unlock_user_struct(target_rlim, arg2, 1);
9767             }
9768         }
9769         return ret;
9770 #endif
9771     case TARGET_NR_getrusage:
9772         {
9773             struct rusage rusage;
9774             ret = get_errno(getrusage(arg1, &rusage));
9775             if (!is_error(ret)) {
9776                 ret = host_to_target_rusage(arg2, &rusage);
9777             }
9778         }
9779         return ret;
9780 #if defined(TARGET_NR_gettimeofday)
9781     case TARGET_NR_gettimeofday:
9782         {
9783             struct timeval tv;
9784             struct timezone tz;
9785 
9786             ret = get_errno(gettimeofday(&tv, &tz));
9787             if (!is_error(ret)) {
9788                 if (arg1 && copy_to_user_timeval(arg1, &tv)) {
9789                     return -TARGET_EFAULT;
9790                 }
9791                 if (arg2 && copy_to_user_timezone(arg2, &tz)) {
9792                     return -TARGET_EFAULT;
9793                 }
9794             }
9795         }
9796         return ret;
9797 #endif
9798 #if defined(TARGET_NR_settimeofday)
9799     case TARGET_NR_settimeofday:
9800         {
9801             struct timeval tv, *ptv = NULL;
9802             struct timezone tz, *ptz = NULL;
9803 
9804             if (arg1) {
9805                 if (copy_from_user_timeval(&tv, arg1)) {
9806                     return -TARGET_EFAULT;
9807                 }
9808                 ptv = &tv;
9809             }
9810 
9811             if (arg2) {
9812                 if (copy_from_user_timezone(&tz, arg2)) {
9813                     return -TARGET_EFAULT;
9814                 }
9815                 ptz = &tz;
9816             }
9817 
9818             return get_errno(settimeofday(ptv, ptz));
9819         }
9820 #endif
9821 #if defined(TARGET_NR_select)
9822     case TARGET_NR_select:
9823 #if defined(TARGET_WANT_NI_OLD_SELECT)
9824         /* some architectures used to have old_select here
9825          * but now ENOSYS it.
9826          */
9827         ret = -TARGET_ENOSYS;
9828 #elif defined(TARGET_WANT_OLD_SYS_SELECT)
9829         ret = do_old_select(arg1);
9830 #else
9831         ret = do_select(arg1, arg2, arg3, arg4, arg5);
9832 #endif
9833         return ret;
9834 #endif
9835 #ifdef TARGET_NR_pselect6
9836     case TARGET_NR_pselect6:
9837         return do_pselect6(arg1, arg2, arg3, arg4, arg5, arg6, false);
9838 #endif
9839 #ifdef TARGET_NR_pselect6_time64
9840     case TARGET_NR_pselect6_time64:
9841         return do_pselect6(arg1, arg2, arg3, arg4, arg5, arg6, true);
9842 #endif
9843 #ifdef TARGET_NR_symlink
9844     case TARGET_NR_symlink:
9845         {
9846             void *p2;
9847             p = lock_user_string(arg1);
9848             p2 = lock_user_string(arg2);
9849             if (!p || !p2)
9850                 ret = -TARGET_EFAULT;
9851             else
9852                 ret = get_errno(symlink(p, p2));
9853             unlock_user(p2, arg2, 0);
9854             unlock_user(p, arg1, 0);
9855         }
9856         return ret;
9857 #endif
9858 #if defined(TARGET_NR_symlinkat)
9859     case TARGET_NR_symlinkat:
9860         {
9861             void *p2;
9862             p  = lock_user_string(arg1);
9863             p2 = lock_user_string(arg3);
9864             if (!p || !p2)
9865                 ret = -TARGET_EFAULT;
9866             else
9867                 ret = get_errno(symlinkat(p, arg2, p2));
9868             unlock_user(p2, arg3, 0);
9869             unlock_user(p, arg1, 0);
9870         }
9871         return ret;
9872 #endif
9873 #ifdef TARGET_NR_readlink
9874     case TARGET_NR_readlink:
9875         {
9876             void *p2;
9877             p = lock_user_string(arg1);
9878             p2 = lock_user(VERIFY_WRITE, arg2, arg3, 0);
9879             if (!p || !p2) {
9880                 ret = -TARGET_EFAULT;
9881             } else if (!arg3) {
9882                 /* Short circuit this for the magic exe check. */
9883                 ret = -TARGET_EINVAL;
9884             } else if (is_proc_myself((const char *)p, "exe")) {
9885                 char real[PATH_MAX], *temp;
9886                 temp = realpath(exec_path, real);
9887                 /* Return value is # of bytes that we wrote to the buffer. */
9888                 if (temp == NULL) {
9889                     ret = get_errno(-1);
9890                 } else {
9891                     /* Don't worry about sign mismatch as earlier mapping
9892                      * logic would have thrown a bad address error. */
9893                     ret = MIN(strlen(real), arg3);
9894                     /* We cannot NUL terminate the string. */
9895                     memcpy(p2, real, ret);
9896                 }
9897             } else {
9898                 ret = get_errno(readlink(path(p), p2, arg3));
9899             }
9900             unlock_user(p2, arg2, ret);
9901             unlock_user(p, arg1, 0);
9902         }
9903         return ret;
9904 #endif
9905 #if defined(TARGET_NR_readlinkat)
9906     case TARGET_NR_readlinkat:
9907         {
9908             void *p2;
9909             p  = lock_user_string(arg2);
9910             p2 = lock_user(VERIFY_WRITE, arg3, arg4, 0);
9911             if (!p || !p2) {
9912                 ret = -TARGET_EFAULT;
9913             } else if (!arg4) {
9914                 /* Short circuit this for the magic exe check. */
9915                 ret = -TARGET_EINVAL;
9916             } else if (is_proc_myself((const char *)p, "exe")) {
9917                 char real[PATH_MAX], *temp;
9918                 temp = realpath(exec_path, real);
9919                 /* Return value is # of bytes that we wrote to the buffer. */
9920                 if (temp == NULL) {
9921                     ret = get_errno(-1);
9922                 } else {
9923                     /* Don't worry about sign mismatch as earlier mapping
9924                      * logic would have thrown a bad address error. */
9925                     ret = MIN(strlen(real), arg4);
9926                     /* We cannot NUL terminate the string. */
9927                     memcpy(p2, real, ret);
9928                 }
9929             } else {
9930                 ret = get_errno(readlinkat(arg1, path(p), p2, arg4));
9931             }
9932             unlock_user(p2, arg3, ret);
9933             unlock_user(p, arg2, 0);
9934         }
9935         return ret;
9936 #endif
9937 #ifdef TARGET_NR_swapon
9938     case TARGET_NR_swapon:
9939         if (!(p = lock_user_string(arg1)))
9940             return -TARGET_EFAULT;
9941         ret = get_errno(swapon(p, arg2));
9942         unlock_user(p, arg1, 0);
9943         return ret;
9944 #endif
9945     case TARGET_NR_reboot:
9946         if (arg3 == LINUX_REBOOT_CMD_RESTART2) {
9947            /* arg4 must be ignored in all other cases */
9948            p = lock_user_string(arg4);
9949            if (!p) {
9950                return -TARGET_EFAULT;
9951            }
9952            ret = get_errno(reboot(arg1, arg2, arg3, p));
9953            unlock_user(p, arg4, 0);
9954         } else {
9955            ret = get_errno(reboot(arg1, arg2, arg3, NULL));
9956         }
9957         return ret;
9958 #ifdef TARGET_NR_mmap
9959     case TARGET_NR_mmap:
9960 #if (defined(TARGET_I386) && defined(TARGET_ABI32)) || \
9961     (defined(TARGET_ARM) && defined(TARGET_ABI32)) || \
9962     defined(TARGET_M68K) || defined(TARGET_CRIS) || defined(TARGET_MICROBLAZE) \
9963     || defined(TARGET_S390X)
9964         {
9965             abi_ulong *v;
9966             abi_ulong v1, v2, v3, v4, v5, v6;
9967             if (!(v = lock_user(VERIFY_READ, arg1, 6 * sizeof(abi_ulong), 1)))
9968                 return -TARGET_EFAULT;
9969             v1 = tswapal(v[0]);
9970             v2 = tswapal(v[1]);
9971             v3 = tswapal(v[2]);
9972             v4 = tswapal(v[3]);
9973             v5 = tswapal(v[4]);
9974             v6 = tswapal(v[5]);
9975             unlock_user(v, arg1, 0);
9976             ret = get_errno(target_mmap(v1, v2, v3,
9977                                         target_to_host_bitmask(v4, mmap_flags_tbl),
9978                                         v5, v6));
9979         }
9980 #else
9981         /* mmap pointers are always untagged */
9982         ret = get_errno(target_mmap(arg1, arg2, arg3,
9983                                     target_to_host_bitmask(arg4, mmap_flags_tbl),
9984                                     arg5,
9985                                     arg6));
9986 #endif
9987         return ret;
9988 #endif
9989 #ifdef TARGET_NR_mmap2
9990     case TARGET_NR_mmap2:
9991 #ifndef MMAP_SHIFT
9992 #define MMAP_SHIFT 12
9993 #endif
9994         ret = target_mmap(arg1, arg2, arg3,
9995                           target_to_host_bitmask(arg4, mmap_flags_tbl),
9996                           arg5, arg6 << MMAP_SHIFT);
9997         return get_errno(ret);
9998 #endif
9999     case TARGET_NR_munmap:
10000         arg1 = cpu_untagged_addr(cpu, arg1);
10001         return get_errno(target_munmap(arg1, arg2));
10002     case TARGET_NR_mprotect:
10003         arg1 = cpu_untagged_addr(cpu, arg1);
10004         {
10005             TaskState *ts = cpu->opaque;
10006             /* Special hack to detect libc making the stack executable.  */
10007             if ((arg3 & PROT_GROWSDOWN)
10008                 && arg1 >= ts->info->stack_limit
10009                 && arg1 <= ts->info->start_stack) {
10010                 arg3 &= ~PROT_GROWSDOWN;
10011                 arg2 = arg2 + arg1 - ts->info->stack_limit;
10012                 arg1 = ts->info->stack_limit;
10013             }
10014         }
10015         return get_errno(target_mprotect(arg1, arg2, arg3));
10016 #ifdef TARGET_NR_mremap
10017     case TARGET_NR_mremap:
10018         arg1 = cpu_untagged_addr(cpu, arg1);
10019         /* mremap new_addr (arg5) is always untagged */
10020         return get_errno(target_mremap(arg1, arg2, arg3, arg4, arg5));
10021 #endif
10022         /* ??? msync/mlock/munlock are broken for softmmu.  */
10023 #ifdef TARGET_NR_msync
10024     case TARGET_NR_msync:
10025         return get_errno(msync(g2h(cpu, arg1), arg2, arg3));
10026 #endif
10027 #ifdef TARGET_NR_mlock
10028     case TARGET_NR_mlock:
10029         return get_errno(mlock(g2h(cpu, arg1), arg2));
10030 #endif
10031 #ifdef TARGET_NR_munlock
10032     case TARGET_NR_munlock:
10033         return get_errno(munlock(g2h(cpu, arg1), arg2));
10034 #endif
10035 #ifdef TARGET_NR_mlockall
10036     case TARGET_NR_mlockall:
10037         return get_errno(mlockall(target_to_host_mlockall_arg(arg1)));
10038 #endif
10039 #ifdef TARGET_NR_munlockall
10040     case TARGET_NR_munlockall:
10041         return get_errno(munlockall());
10042 #endif
10043 #ifdef TARGET_NR_truncate
10044     case TARGET_NR_truncate:
10045         if (!(p = lock_user_string(arg1)))
10046             return -TARGET_EFAULT;
10047         ret = get_errno(truncate(p, arg2));
10048         unlock_user(p, arg1, 0);
10049         return ret;
10050 #endif
10051 #ifdef TARGET_NR_ftruncate
10052     case TARGET_NR_ftruncate:
10053         return get_errno(ftruncate(arg1, arg2));
10054 #endif
10055     case TARGET_NR_fchmod:
10056         return get_errno(fchmod(arg1, arg2));
10057 #if defined(TARGET_NR_fchmodat)
10058     case TARGET_NR_fchmodat:
10059         if (!(p = lock_user_string(arg2)))
10060             return -TARGET_EFAULT;
10061         ret = get_errno(fchmodat(arg1, p, arg3, 0));
10062         unlock_user(p, arg2, 0);
10063         return ret;
10064 #endif
10065     case TARGET_NR_getpriority:
10066         /* Note that negative values are valid for getpriority, so we must
10067            differentiate based on errno settings.  */
10068         errno = 0;
10069         ret = getpriority(arg1, arg2);
10070         if (ret == -1 && errno != 0) {
10071             return -host_to_target_errno(errno);
10072         }
10073 #ifdef TARGET_ALPHA
10074         /* Return value is the unbiased priority.  Signal no error.  */
10075         cpu_env->ir[IR_V0] = 0;
10076 #else
10077         /* Return value is a biased priority to avoid negative numbers.  */
10078         ret = 20 - ret;
10079 #endif
10080         return ret;
10081     case TARGET_NR_setpriority:
10082         return get_errno(setpriority(arg1, arg2, arg3));
10083 #ifdef TARGET_NR_statfs
10084     case TARGET_NR_statfs:
10085         if (!(p = lock_user_string(arg1))) {
10086             return -TARGET_EFAULT;
10087         }
10088         ret = get_errno(statfs(path(p), &stfs));
10089         unlock_user(p, arg1, 0);
10090     convert_statfs:
10091         if (!is_error(ret)) {
10092             struct target_statfs *target_stfs;
10093 
10094             if (!lock_user_struct(VERIFY_WRITE, target_stfs, arg2, 0))
10095                 return -TARGET_EFAULT;
10096             __put_user(stfs.f_type, &target_stfs->f_type);
10097             __put_user(stfs.f_bsize, &target_stfs->f_bsize);
10098             __put_user(stfs.f_blocks, &target_stfs->f_blocks);
10099             __put_user(stfs.f_bfree, &target_stfs->f_bfree);
10100             __put_user(stfs.f_bavail, &target_stfs->f_bavail);
10101             __put_user(stfs.f_files, &target_stfs->f_files);
10102             __put_user(stfs.f_ffree, &target_stfs->f_ffree);
10103             __put_user(stfs.f_fsid.__val[0], &target_stfs->f_fsid.val[0]);
10104             __put_user(stfs.f_fsid.__val[1], &target_stfs->f_fsid.val[1]);
10105             __put_user(stfs.f_namelen, &target_stfs->f_namelen);
10106             __put_user(stfs.f_frsize, &target_stfs->f_frsize);
10107 #ifdef _STATFS_F_FLAGS
10108             __put_user(stfs.f_flags, &target_stfs->f_flags);
10109 #else
10110             __put_user(0, &target_stfs->f_flags);
10111 #endif
10112             memset(target_stfs->f_spare, 0, sizeof(target_stfs->f_spare));
10113             unlock_user_struct(target_stfs, arg2, 1);
10114         }
10115         return ret;
10116 #endif
10117 #ifdef TARGET_NR_fstatfs
10118     case TARGET_NR_fstatfs:
10119         ret = get_errno(fstatfs(arg1, &stfs));
10120         goto convert_statfs;
10121 #endif
10122 #ifdef TARGET_NR_statfs64
10123     case TARGET_NR_statfs64:
10124         if (!(p = lock_user_string(arg1))) {
10125             return -TARGET_EFAULT;
10126         }
10127         ret = get_errno(statfs(path(p), &stfs));
10128         unlock_user(p, arg1, 0);
10129     convert_statfs64:
10130         if (!is_error(ret)) {
10131             struct target_statfs64 *target_stfs;
10132 
10133             if (!lock_user_struct(VERIFY_WRITE, target_stfs, arg3, 0))
10134                 return -TARGET_EFAULT;
10135             __put_user(stfs.f_type, &target_stfs->f_type);
10136             __put_user(stfs.f_bsize, &target_stfs->f_bsize);
10137             __put_user(stfs.f_blocks, &target_stfs->f_blocks);
10138             __put_user(stfs.f_bfree, &target_stfs->f_bfree);
10139             __put_user(stfs.f_bavail, &target_stfs->f_bavail);
10140             __put_user(stfs.f_files, &target_stfs->f_files);
10141             __put_user(stfs.f_ffree, &target_stfs->f_ffree);
10142             __put_user(stfs.f_fsid.__val[0], &target_stfs->f_fsid.val[0]);
10143             __put_user(stfs.f_fsid.__val[1], &target_stfs->f_fsid.val[1]);
10144             __put_user(stfs.f_namelen, &target_stfs->f_namelen);
10145             __put_user(stfs.f_frsize, &target_stfs->f_frsize);
10146 #ifdef _STATFS_F_FLAGS
10147             __put_user(stfs.f_flags, &target_stfs->f_flags);
10148 #else
10149             __put_user(0, &target_stfs->f_flags);
10150 #endif
10151             memset(target_stfs->f_spare, 0, sizeof(target_stfs->f_spare));
10152             unlock_user_struct(target_stfs, arg3, 1);
10153         }
10154         return ret;
10155     case TARGET_NR_fstatfs64:
10156         ret = get_errno(fstatfs(arg1, &stfs));
10157         goto convert_statfs64;
10158 #endif
10159 #ifdef TARGET_NR_socketcall
10160     case TARGET_NR_socketcall:
10161         return do_socketcall(arg1, arg2);
10162 #endif
10163 #ifdef TARGET_NR_accept
10164     case TARGET_NR_accept:
10165         return do_accept4(arg1, arg2, arg3, 0);
10166 #endif
10167 #ifdef TARGET_NR_accept4
10168     case TARGET_NR_accept4:
10169         return do_accept4(arg1, arg2, arg3, arg4);
10170 #endif
10171 #ifdef TARGET_NR_bind
10172     case TARGET_NR_bind:
10173         return do_bind(arg1, arg2, arg3);
10174 #endif
10175 #ifdef TARGET_NR_connect
10176     case TARGET_NR_connect:
10177         return do_connect(arg1, arg2, arg3);
10178 #endif
10179 #ifdef TARGET_NR_getpeername
10180     case TARGET_NR_getpeername:
10181         return do_getpeername(arg1, arg2, arg3);
10182 #endif
10183 #ifdef TARGET_NR_getsockname
10184     case TARGET_NR_getsockname:
10185         return do_getsockname(arg1, arg2, arg3);
10186 #endif
10187 #ifdef TARGET_NR_getsockopt
10188     case TARGET_NR_getsockopt:
10189         return do_getsockopt(arg1, arg2, arg3, arg4, arg5);
10190 #endif
10191 #ifdef TARGET_NR_listen
10192     case TARGET_NR_listen:
10193         return get_errno(listen(arg1, arg2));
10194 #endif
10195 #ifdef TARGET_NR_recv
10196     case TARGET_NR_recv:
10197         return do_recvfrom(arg1, arg2, arg3, arg4, 0, 0);
10198 #endif
10199 #ifdef TARGET_NR_recvfrom
10200     case TARGET_NR_recvfrom:
10201         return do_recvfrom(arg1, arg2, arg3, arg4, arg5, arg6);
10202 #endif
10203 #ifdef TARGET_NR_recvmsg
10204     case TARGET_NR_recvmsg:
10205         return do_sendrecvmsg(arg1, arg2, arg3, 0);
10206 #endif
10207 #ifdef TARGET_NR_send
10208     case TARGET_NR_send:
10209         return do_sendto(arg1, arg2, arg3, arg4, 0, 0);
10210 #endif
10211 #ifdef TARGET_NR_sendmsg
10212     case TARGET_NR_sendmsg:
10213         return do_sendrecvmsg(arg1, arg2, arg3, 1);
10214 #endif
10215 #ifdef TARGET_NR_sendmmsg
10216     case TARGET_NR_sendmmsg:
10217         return do_sendrecvmmsg(arg1, arg2, arg3, arg4, 1);
10218 #endif
10219 #ifdef TARGET_NR_recvmmsg
10220     case TARGET_NR_recvmmsg:
10221         return do_sendrecvmmsg(arg1, arg2, arg3, arg4, 0);
10222 #endif
10223 #ifdef TARGET_NR_sendto
10224     case TARGET_NR_sendto:
10225         return do_sendto(arg1, arg2, arg3, arg4, arg5, arg6);
10226 #endif
10227 #ifdef TARGET_NR_shutdown
10228     case TARGET_NR_shutdown:
10229         return get_errno(shutdown(arg1, arg2));
10230 #endif
10231 #if defined(TARGET_NR_getrandom) && defined(__NR_getrandom)
10232     case TARGET_NR_getrandom:
10233         p = lock_user(VERIFY_WRITE, arg1, arg2, 0);
10234         if (!p) {
10235             return -TARGET_EFAULT;
10236         }
10237         ret = get_errno(getrandom(p, arg2, arg3));
10238         unlock_user(p, arg1, ret);
10239         return ret;
10240 #endif
10241 #ifdef TARGET_NR_socket
10242     case TARGET_NR_socket:
10243         return do_socket(arg1, arg2, arg3);
10244 #endif
10245 #ifdef TARGET_NR_socketpair
10246     case TARGET_NR_socketpair:
10247         return do_socketpair(arg1, arg2, arg3, arg4);
10248 #endif
10249 #ifdef TARGET_NR_setsockopt
10250     case TARGET_NR_setsockopt:
10251         return do_setsockopt(arg1, arg2, arg3, arg4, (socklen_t) arg5);
10252 #endif
10253 #if defined(TARGET_NR_syslog)
10254     case TARGET_NR_syslog:
10255         {
10256             int len = arg2;
10257 
10258             switch (arg1) {
10259             case TARGET_SYSLOG_ACTION_CLOSE:         /* Close log */
10260             case TARGET_SYSLOG_ACTION_OPEN:          /* Open log */
10261             case TARGET_SYSLOG_ACTION_CLEAR:         /* Clear ring buffer */
10262             case TARGET_SYSLOG_ACTION_CONSOLE_OFF:   /* Disable logging */
10263             case TARGET_SYSLOG_ACTION_CONSOLE_ON:    /* Enable logging */
10264             case TARGET_SYSLOG_ACTION_CONSOLE_LEVEL: /* Set messages level */
10265             case TARGET_SYSLOG_ACTION_SIZE_UNREAD:   /* Number of chars */
10266             case TARGET_SYSLOG_ACTION_SIZE_BUFFER:   /* Size of the buffer */
10267                 return get_errno(sys_syslog((int)arg1, NULL, (int)arg3));
10268             case TARGET_SYSLOG_ACTION_READ:          /* Read from log */
10269             case TARGET_SYSLOG_ACTION_READ_CLEAR:    /* Read/clear msgs */
10270             case TARGET_SYSLOG_ACTION_READ_ALL:      /* Read last messages */
10271                 {
10272                     if (len < 0) {
10273                         return -TARGET_EINVAL;
10274                     }
10275                     if (len == 0) {
10276                         return 0;
10277                     }
10278                     p = lock_user(VERIFY_WRITE, arg2, arg3, 0);
10279                     if (!p) {
10280                         return -TARGET_EFAULT;
10281                     }
10282                     ret = get_errno(sys_syslog((int)arg1, p, (int)arg3));
10283                     unlock_user(p, arg2, arg3);
10284                 }
10285                 return ret;
10286             default:
10287                 return -TARGET_EINVAL;
10288             }
10289         }
10290         break;
10291 #endif
10292     case TARGET_NR_setitimer:
10293         {
10294             struct itimerval value, ovalue, *pvalue;
10295 
10296             if (arg2) {
10297                 pvalue = &value;
10298                 if (copy_from_user_timeval(&pvalue->it_interval, arg2)
10299                     || copy_from_user_timeval(&pvalue->it_value,
10300                                               arg2 + sizeof(struct target_timeval)))
10301                     return -TARGET_EFAULT;
10302             } else {
10303                 pvalue = NULL;
10304             }
10305             ret = get_errno(setitimer(arg1, pvalue, &ovalue));
10306             if (!is_error(ret) && arg3) {
10307                 if (copy_to_user_timeval(arg3,
10308                                          &ovalue.it_interval)
10309                     || copy_to_user_timeval(arg3 + sizeof(struct target_timeval),
10310                                             &ovalue.it_value))
10311                     return -TARGET_EFAULT;
10312             }
10313         }
10314         return ret;
10315     case TARGET_NR_getitimer:
10316         {
10317             struct itimerval value;
10318 
10319             ret = get_errno(getitimer(arg1, &value));
10320             if (!is_error(ret) && arg2) {
10321                 if (copy_to_user_timeval(arg2,
10322                                          &value.it_interval)
10323                     || copy_to_user_timeval(arg2 + sizeof(struct target_timeval),
10324                                             &value.it_value))
10325                     return -TARGET_EFAULT;
10326             }
10327         }
10328         return ret;
10329 #ifdef TARGET_NR_stat
10330     case TARGET_NR_stat:
10331         if (!(p = lock_user_string(arg1))) {
10332             return -TARGET_EFAULT;
10333         }
10334         ret = get_errno(stat(path(p), &st));
10335         unlock_user(p, arg1, 0);
10336         goto do_stat;
10337 #endif
10338 #ifdef TARGET_NR_lstat
10339     case TARGET_NR_lstat:
10340         if (!(p = lock_user_string(arg1))) {
10341             return -TARGET_EFAULT;
10342         }
10343         ret = get_errno(lstat(path(p), &st));
10344         unlock_user(p, arg1, 0);
10345         goto do_stat;
10346 #endif
10347 #ifdef TARGET_NR_fstat
10348     case TARGET_NR_fstat:
10349         {
10350             ret = get_errno(fstat(arg1, &st));
10351 #if defined(TARGET_NR_stat) || defined(TARGET_NR_lstat)
10352         do_stat:
10353 #endif
10354             if (!is_error(ret)) {
10355                 struct target_stat *target_st;
10356 
10357                 if (!lock_user_struct(VERIFY_WRITE, target_st, arg2, 0))
10358                     return -TARGET_EFAULT;
10359                 memset(target_st, 0, sizeof(*target_st));
10360                 __put_user(st.st_dev, &target_st->st_dev);
10361                 __put_user(st.st_ino, &target_st->st_ino);
10362                 __put_user(st.st_mode, &target_st->st_mode);
10363                 __put_user(st.st_uid, &target_st->st_uid);
10364                 __put_user(st.st_gid, &target_st->st_gid);
10365                 __put_user(st.st_nlink, &target_st->st_nlink);
10366                 __put_user(st.st_rdev, &target_st->st_rdev);
10367                 __put_user(st.st_size, &target_st->st_size);
10368                 __put_user(st.st_blksize, &target_st->st_blksize);
10369                 __put_user(st.st_blocks, &target_st->st_blocks);
10370                 __put_user(st.st_atime, &target_st->target_st_atime);
10371                 __put_user(st.st_mtime, &target_st->target_st_mtime);
10372                 __put_user(st.st_ctime, &target_st->target_st_ctime);
10373 #if defined(HAVE_STRUCT_STAT_ST_ATIM) && defined(TARGET_STAT_HAVE_NSEC)
10374                 __put_user(st.st_atim.tv_nsec,
10375                            &target_st->target_st_atime_nsec);
10376                 __put_user(st.st_mtim.tv_nsec,
10377                            &target_st->target_st_mtime_nsec);
10378                 __put_user(st.st_ctim.tv_nsec,
10379                            &target_st->target_st_ctime_nsec);
10380 #endif
10381                 unlock_user_struct(target_st, arg2, 1);
10382             }
10383         }
10384         return ret;
10385 #endif
10386     case TARGET_NR_vhangup:
10387         return get_errno(vhangup());
10388 #ifdef TARGET_NR_syscall
10389     case TARGET_NR_syscall:
10390         return do_syscall(cpu_env, arg1 & 0xffff, arg2, arg3, arg4, arg5,
10391                           arg6, arg7, arg8, 0);
10392 #endif
10393 #if defined(TARGET_NR_wait4)
10394     case TARGET_NR_wait4:
10395         {
10396             int status;
10397             abi_long status_ptr = arg2;
10398             struct rusage rusage, *rusage_ptr;
10399             abi_ulong target_rusage = arg4;
10400             abi_long rusage_err;
10401             if (target_rusage)
10402                 rusage_ptr = &rusage;
10403             else
10404                 rusage_ptr = NULL;
10405             ret = get_errno(safe_wait4(arg1, &status, arg3, rusage_ptr));
10406             if (!is_error(ret)) {
10407                 if (status_ptr && ret) {
10408                     status = host_to_target_waitstatus(status);
10409                     if (put_user_s32(status, status_ptr))
10410                         return -TARGET_EFAULT;
10411                 }
10412                 if (target_rusage) {
10413                     rusage_err = host_to_target_rusage(target_rusage, &rusage);
10414                     if (rusage_err) {
10415                         ret = rusage_err;
10416                     }
10417                 }
10418             }
10419         }
10420         return ret;
10421 #endif
10422 #ifdef TARGET_NR_swapoff
10423     case TARGET_NR_swapoff:
10424         if (!(p = lock_user_string(arg1)))
10425             return -TARGET_EFAULT;
10426         ret = get_errno(swapoff(p));
10427         unlock_user(p, arg1, 0);
10428         return ret;
10429 #endif
10430     case TARGET_NR_sysinfo:
10431         {
10432             struct target_sysinfo *target_value;
10433             struct sysinfo value;
10434             ret = get_errno(sysinfo(&value));
10435             if (!is_error(ret) && arg1)
10436             {
10437                 if (!lock_user_struct(VERIFY_WRITE, target_value, arg1, 0))
10438                     return -TARGET_EFAULT;
10439                 __put_user(value.uptime, &target_value->uptime);
10440                 __put_user(value.loads[0], &target_value->loads[0]);
10441                 __put_user(value.loads[1], &target_value->loads[1]);
10442                 __put_user(value.loads[2], &target_value->loads[2]);
10443                 __put_user(value.totalram, &target_value->totalram);
10444                 __put_user(value.freeram, &target_value->freeram);
10445                 __put_user(value.sharedram, &target_value->sharedram);
10446                 __put_user(value.bufferram, &target_value->bufferram);
10447                 __put_user(value.totalswap, &target_value->totalswap);
10448                 __put_user(value.freeswap, &target_value->freeswap);
10449                 __put_user(value.procs, &target_value->procs);
10450                 __put_user(value.totalhigh, &target_value->totalhigh);
10451                 __put_user(value.freehigh, &target_value->freehigh);
10452                 __put_user(value.mem_unit, &target_value->mem_unit);
10453                 unlock_user_struct(target_value, arg1, 1);
10454             }
10455         }
10456         return ret;
10457 #ifdef TARGET_NR_ipc
10458     case TARGET_NR_ipc:
10459         return do_ipc(cpu_env, arg1, arg2, arg3, arg4, arg5, arg6);
10460 #endif
10461 #ifdef TARGET_NR_semget
10462     case TARGET_NR_semget:
10463         return get_errno(semget(arg1, arg2, arg3));
10464 #endif
10465 #ifdef TARGET_NR_semop
10466     case TARGET_NR_semop:
10467         return do_semtimedop(arg1, arg2, arg3, 0, false);
10468 #endif
10469 #ifdef TARGET_NR_semtimedop
10470     case TARGET_NR_semtimedop:
10471         return do_semtimedop(arg1, arg2, arg3, arg4, false);
10472 #endif
10473 #ifdef TARGET_NR_semtimedop_time64
10474     case TARGET_NR_semtimedop_time64:
10475         return do_semtimedop(arg1, arg2, arg3, arg4, true);
10476 #endif
10477 #ifdef TARGET_NR_semctl
10478     case TARGET_NR_semctl:
10479         return do_semctl(arg1, arg2, arg3, arg4);
10480 #endif
10481 #ifdef TARGET_NR_msgctl
10482     case TARGET_NR_msgctl:
10483         return do_msgctl(arg1, arg2, arg3);
10484 #endif
10485 #ifdef TARGET_NR_msgget
10486     case TARGET_NR_msgget:
10487         return get_errno(msgget(arg1, arg2));
10488 #endif
10489 #ifdef TARGET_NR_msgrcv
10490     case TARGET_NR_msgrcv:
10491         return do_msgrcv(arg1, arg2, arg3, arg4, arg5);
10492 #endif
10493 #ifdef TARGET_NR_msgsnd
10494     case TARGET_NR_msgsnd:
10495         return do_msgsnd(arg1, arg2, arg3, arg4);
10496 #endif
10497 #ifdef TARGET_NR_shmget
10498     case TARGET_NR_shmget:
10499         return get_errno(shmget(arg1, arg2, arg3));
10500 #endif
10501 #ifdef TARGET_NR_shmctl
10502     case TARGET_NR_shmctl:
10503         return do_shmctl(arg1, arg2, arg3);
10504 #endif
10505 #ifdef TARGET_NR_shmat
10506     case TARGET_NR_shmat:
10507         return do_shmat(cpu_env, arg1, arg2, arg3);
10508 #endif
10509 #ifdef TARGET_NR_shmdt
10510     case TARGET_NR_shmdt:
10511         return do_shmdt(arg1);
10512 #endif
10513     case TARGET_NR_fsync:
10514         return get_errno(fsync(arg1));
10515     case TARGET_NR_clone:
10516         /* Linux manages to have three different orderings for its
10517          * arguments to clone(); the BACKWARDS and BACKWARDS2 defines
10518          * match the kernel's CONFIG_CLONE_* settings.
10519          * Microblaze is further special in that it uses a sixth
10520          * implicit argument to clone for the TLS pointer.
10521          */
10522 #if defined(TARGET_MICROBLAZE)
10523         ret = get_errno(do_fork(cpu_env, arg1, arg2, arg4, arg6, arg5));
10524 #elif defined(TARGET_CLONE_BACKWARDS)
10525         ret = get_errno(do_fork(cpu_env, arg1, arg2, arg3, arg4, arg5));
10526 #elif defined(TARGET_CLONE_BACKWARDS2)
10527         ret = get_errno(do_fork(cpu_env, arg2, arg1, arg3, arg5, arg4));
10528 #else
10529         ret = get_errno(do_fork(cpu_env, arg1, arg2, arg3, arg5, arg4));
10530 #endif
10531         return ret;
10532 #ifdef __NR_exit_group
10533         /* new thread calls */
10534     case TARGET_NR_exit_group:
10535         preexit_cleanup(cpu_env, arg1);
10536         return get_errno(exit_group(arg1));
10537 #endif
10538     case TARGET_NR_setdomainname:
10539         if (!(p = lock_user_string(arg1)))
10540             return -TARGET_EFAULT;
10541         ret = get_errno(setdomainname(p, arg2));
10542         unlock_user(p, arg1, 0);
10543         return ret;
10544     case TARGET_NR_uname:
10545         /* no need to transcode because we use the linux syscall */
10546         {
10547             struct new_utsname * buf;
10548 
10549             if (!lock_user_struct(VERIFY_WRITE, buf, arg1, 0))
10550                 return -TARGET_EFAULT;
10551             ret = get_errno(sys_uname(buf));
10552             if (!is_error(ret)) {
10553                 /* Overwrite the native machine name with whatever is being
10554                    emulated. */
10555                 g_strlcpy(buf->machine, cpu_to_uname_machine(cpu_env),
10556                           sizeof(buf->machine));
10557                 /* Allow the user to override the reported release.  */
10558                 if (qemu_uname_release && *qemu_uname_release) {
10559                     g_strlcpy(buf->release, qemu_uname_release,
10560                               sizeof(buf->release));
10561                 }
10562             }
10563             unlock_user_struct(buf, arg1, 1);
10564         }
10565         return ret;
10566 #ifdef TARGET_I386
10567     case TARGET_NR_modify_ldt:
10568         return do_modify_ldt(cpu_env, arg1, arg2, arg3);
10569 #if !defined(TARGET_X86_64)
10570     case TARGET_NR_vm86:
10571         return do_vm86(cpu_env, arg1, arg2);
10572 #endif
10573 #endif
10574 #if defined(TARGET_NR_adjtimex)
10575     case TARGET_NR_adjtimex:
10576         {
10577             struct timex host_buf;
10578 
10579             if (target_to_host_timex(&host_buf, arg1) != 0) {
10580                 return -TARGET_EFAULT;
10581             }
10582             ret = get_errno(adjtimex(&host_buf));
10583             if (!is_error(ret)) {
10584                 if (host_to_target_timex(arg1, &host_buf) != 0) {
10585                     return -TARGET_EFAULT;
10586                 }
10587             }
10588         }
10589         return ret;
10590 #endif
10591 #if defined(TARGET_NR_clock_adjtime) && defined(CONFIG_CLOCK_ADJTIME)
10592     case TARGET_NR_clock_adjtime:
10593         {
10594             struct timex htx, *phtx = &htx;
10595 
10596             if (target_to_host_timex(phtx, arg2) != 0) {
10597                 return -TARGET_EFAULT;
10598             }
10599             ret = get_errno(clock_adjtime(arg1, phtx));
10600             if (!is_error(ret) && phtx) {
10601                 if (host_to_target_timex(arg2, phtx) != 0) {
10602                     return -TARGET_EFAULT;
10603                 }
10604             }
10605         }
10606         return ret;
10607 #endif
10608 #if defined(TARGET_NR_clock_adjtime64) && defined(CONFIG_CLOCK_ADJTIME)
10609     case TARGET_NR_clock_adjtime64:
10610         {
10611             struct timex htx;
10612 
10613             if (target_to_host_timex64(&htx, arg2) != 0) {
10614                 return -TARGET_EFAULT;
10615             }
10616             ret = get_errno(clock_adjtime(arg1, &htx));
10617             if (!is_error(ret) && host_to_target_timex64(arg2, &htx)) {
10618                     return -TARGET_EFAULT;
10619             }
10620         }
10621         return ret;
10622 #endif
10623     case TARGET_NR_getpgid:
10624         return get_errno(getpgid(arg1));
10625     case TARGET_NR_fchdir:
10626         return get_errno(fchdir(arg1));
10627     case TARGET_NR_personality:
10628         return get_errno(personality(arg1));
10629 #ifdef TARGET_NR__llseek /* Not on alpha */
10630     case TARGET_NR__llseek:
10631         {
10632             int64_t res;
10633 #if !defined(__NR_llseek)
10634             res = lseek(arg1, ((uint64_t)arg2 << 32) | (abi_ulong)arg3, arg5);
10635             if (res == -1) {
10636                 ret = get_errno(res);
10637             } else {
10638                 ret = 0;
10639             }
10640 #else
10641             ret = get_errno(_llseek(arg1, arg2, arg3, &res, arg5));
10642 #endif
10643             if ((ret == 0) && put_user_s64(res, arg4)) {
10644                 return -TARGET_EFAULT;
10645             }
10646         }
10647         return ret;
10648 #endif
10649 #ifdef TARGET_NR_getdents
10650     case TARGET_NR_getdents:
10651         return do_getdents(arg1, arg2, arg3);
10652 #endif /* TARGET_NR_getdents */
10653 #if defined(TARGET_NR_getdents64) && defined(__NR_getdents64)
10654     case TARGET_NR_getdents64:
10655         return do_getdents64(arg1, arg2, arg3);
10656 #endif /* TARGET_NR_getdents64 */
10657 #if defined(TARGET_NR__newselect)
10658     case TARGET_NR__newselect:
10659         return do_select(arg1, arg2, arg3, arg4, arg5);
10660 #endif
10661 #ifdef TARGET_NR_poll
10662     case TARGET_NR_poll:
10663         return do_ppoll(arg1, arg2, arg3, arg4, arg5, false, false);
10664 #endif
10665 #ifdef TARGET_NR_ppoll
10666     case TARGET_NR_ppoll:
10667         return do_ppoll(arg1, arg2, arg3, arg4, arg5, true, false);
10668 #endif
10669 #ifdef TARGET_NR_ppoll_time64
10670     case TARGET_NR_ppoll_time64:
10671         return do_ppoll(arg1, arg2, arg3, arg4, arg5, true, true);
10672 #endif
10673     case TARGET_NR_flock:
10674         /* NOTE: the flock constant seems to be the same for every
10675            Linux platform */
10676         return get_errno(safe_flock(arg1, arg2));
10677     case TARGET_NR_readv:
10678         {
10679             struct iovec *vec = lock_iovec(VERIFY_WRITE, arg2, arg3, 0);
10680             if (vec != NULL) {
10681                 ret = get_errno(safe_readv(arg1, vec, arg3));
10682                 unlock_iovec(vec, arg2, arg3, 1);
10683             } else {
10684                 ret = -host_to_target_errno(errno);
10685             }
10686         }
10687         return ret;
10688     case TARGET_NR_writev:
10689         {
10690             struct iovec *vec = lock_iovec(VERIFY_READ, arg2, arg3, 1);
10691             if (vec != NULL) {
10692                 ret = get_errno(safe_writev(arg1, vec, arg3));
10693                 unlock_iovec(vec, arg2, arg3, 0);
10694             } else {
10695                 ret = -host_to_target_errno(errno);
10696             }
10697         }
10698         return ret;
10699 #if defined(TARGET_NR_preadv)
10700     case TARGET_NR_preadv:
10701         {
10702             struct iovec *vec = lock_iovec(VERIFY_WRITE, arg2, arg3, 0);
10703             if (vec != NULL) {
10704                 unsigned long low, high;
10705 
10706                 target_to_host_low_high(arg4, arg5, &low, &high);
10707                 ret = get_errno(safe_preadv(arg1, vec, arg3, low, high));
10708                 unlock_iovec(vec, arg2, arg3, 1);
10709             } else {
10710                 ret = -host_to_target_errno(errno);
10711            }
10712         }
10713         return ret;
10714 #endif
10715 #if defined(TARGET_NR_pwritev)
10716     case TARGET_NR_pwritev:
10717         {
10718             struct iovec *vec = lock_iovec(VERIFY_READ, arg2, arg3, 1);
10719             if (vec != NULL) {
10720                 unsigned long low, high;
10721 
10722                 target_to_host_low_high(arg4, arg5, &low, &high);
10723                 ret = get_errno(safe_pwritev(arg1, vec, arg3, low, high));
10724                 unlock_iovec(vec, arg2, arg3, 0);
10725             } else {
10726                 ret = -host_to_target_errno(errno);
10727            }
10728         }
10729         return ret;
10730 #endif
10731     case TARGET_NR_getsid:
10732         return get_errno(getsid(arg1));
10733 #if defined(TARGET_NR_fdatasync) /* Not on alpha (osf_datasync ?) */
10734     case TARGET_NR_fdatasync:
10735         return get_errno(fdatasync(arg1));
10736 #endif
10737     case TARGET_NR_sched_getaffinity:
10738         {
10739             unsigned int mask_size;
10740             unsigned long *mask;
10741 
10742             /*
10743              * sched_getaffinity needs multiples of ulong, so need to take
10744              * care of mismatches between target ulong and host ulong sizes.
10745              */
10746             if (arg2 & (sizeof(abi_ulong) - 1)) {
10747                 return -TARGET_EINVAL;
10748             }
10749             mask_size = (arg2 + (sizeof(*mask) - 1)) & ~(sizeof(*mask) - 1);
10750 
10751             mask = alloca(mask_size);
10752             memset(mask, 0, mask_size);
10753             ret = get_errno(sys_sched_getaffinity(arg1, mask_size, mask));
10754 
10755             if (!is_error(ret)) {
10756                 if (ret > arg2) {
10757                     /* More data returned than the caller's buffer will fit.
10758                      * This only happens if sizeof(abi_long) < sizeof(long)
10759                      * and the caller passed us a buffer holding an odd number
10760                      * of abi_longs. If the host kernel is actually using the
10761                      * extra 4 bytes then fail EINVAL; otherwise we can just
10762                      * ignore them and only copy the interesting part.
10763                      */
10764                     int numcpus = sysconf(_SC_NPROCESSORS_CONF);
10765                     if (numcpus > arg2 * 8) {
10766                         return -TARGET_EINVAL;
10767                     }
10768                     ret = arg2;
10769                 }
10770 
10771                 if (host_to_target_cpu_mask(mask, mask_size, arg3, ret)) {
10772                     return -TARGET_EFAULT;
10773                 }
10774             }
10775         }
10776         return ret;
10777     case TARGET_NR_sched_setaffinity:
10778         {
10779             unsigned int mask_size;
10780             unsigned long *mask;
10781 
10782             /*
10783              * sched_setaffinity needs multiples of ulong, so need to take
10784              * care of mismatches between target ulong and host ulong sizes.
10785              */
10786             if (arg2 & (sizeof(abi_ulong) - 1)) {
10787                 return -TARGET_EINVAL;
10788             }
10789             mask_size = (arg2 + (sizeof(*mask) - 1)) & ~(sizeof(*mask) - 1);
10790             mask = alloca(mask_size);
10791 
10792             ret = target_to_host_cpu_mask(mask, mask_size, arg3, arg2);
10793             if (ret) {
10794                 return ret;
10795             }
10796 
10797             return get_errno(sys_sched_setaffinity(arg1, mask_size, mask));
10798         }
10799     case TARGET_NR_getcpu:
10800         {
10801             unsigned cpu, node;
10802             ret = get_errno(sys_getcpu(arg1 ? &cpu : NULL,
10803                                        arg2 ? &node : NULL,
10804                                        NULL));
10805             if (is_error(ret)) {
10806                 return ret;
10807             }
10808             if (arg1 && put_user_u32(cpu, arg1)) {
10809                 return -TARGET_EFAULT;
10810             }
10811             if (arg2 && put_user_u32(node, arg2)) {
10812                 return -TARGET_EFAULT;
10813             }
10814         }
10815         return ret;
10816     case TARGET_NR_sched_setparam:
10817         {
10818             struct target_sched_param *target_schp;
10819             struct sched_param schp;
10820 
10821             if (arg2 == 0) {
10822                 return -TARGET_EINVAL;
10823             }
10824             if (!lock_user_struct(VERIFY_READ, target_schp, arg2, 1)) {
10825                 return -TARGET_EFAULT;
10826             }
10827             schp.sched_priority = tswap32(target_schp->sched_priority);
10828             unlock_user_struct(target_schp, arg2, 0);
10829             return get_errno(sys_sched_setparam(arg1, &schp));
10830         }
10831     case TARGET_NR_sched_getparam:
10832         {
10833             struct target_sched_param *target_schp;
10834             struct sched_param schp;
10835 
10836             if (arg2 == 0) {
10837                 return -TARGET_EINVAL;
10838             }
10839             ret = get_errno(sys_sched_getparam(arg1, &schp));
10840             if (!is_error(ret)) {
10841                 if (!lock_user_struct(VERIFY_WRITE, target_schp, arg2, 0)) {
10842                     return -TARGET_EFAULT;
10843                 }
10844                 target_schp->sched_priority = tswap32(schp.sched_priority);
10845                 unlock_user_struct(target_schp, arg2, 1);
10846             }
10847         }
10848         return ret;
10849     case TARGET_NR_sched_setscheduler:
10850         {
10851             struct target_sched_param *target_schp;
10852             struct sched_param schp;
10853             if (arg3 == 0) {
10854                 return -TARGET_EINVAL;
10855             }
10856             if (!lock_user_struct(VERIFY_READ, target_schp, arg3, 1)) {
10857                 return -TARGET_EFAULT;
10858             }
10859             schp.sched_priority = tswap32(target_schp->sched_priority);
10860             unlock_user_struct(target_schp, arg3, 0);
10861             return get_errno(sys_sched_setscheduler(arg1, arg2, &schp));
10862         }
10863     case TARGET_NR_sched_getscheduler:
10864         return get_errno(sys_sched_getscheduler(arg1));
10865     case TARGET_NR_sched_getattr:
10866         {
10867             struct target_sched_attr *target_scha;
10868             struct sched_attr scha;
10869             if (arg2 == 0) {
10870                 return -TARGET_EINVAL;
10871             }
10872             if (arg3 > sizeof(scha)) {
10873                 arg3 = sizeof(scha);
10874             }
10875             ret = get_errno(sys_sched_getattr(arg1, &scha, arg3, arg4));
10876             if (!is_error(ret)) {
10877                 target_scha = lock_user(VERIFY_WRITE, arg2, arg3, 0);
10878                 if (!target_scha) {
10879                     return -TARGET_EFAULT;
10880                 }
10881                 target_scha->size = tswap32(scha.size);
10882                 target_scha->sched_policy = tswap32(scha.sched_policy);
10883                 target_scha->sched_flags = tswap64(scha.sched_flags);
10884                 target_scha->sched_nice = tswap32(scha.sched_nice);
10885                 target_scha->sched_priority = tswap32(scha.sched_priority);
10886                 target_scha->sched_runtime = tswap64(scha.sched_runtime);
10887                 target_scha->sched_deadline = tswap64(scha.sched_deadline);
10888                 target_scha->sched_period = tswap64(scha.sched_period);
10889                 if (scha.size > offsetof(struct sched_attr, sched_util_min)) {
10890                     target_scha->sched_util_min = tswap32(scha.sched_util_min);
10891                     target_scha->sched_util_max = tswap32(scha.sched_util_max);
10892                 }
10893                 unlock_user(target_scha, arg2, arg3);
10894             }
10895             return ret;
10896         }
10897     case TARGET_NR_sched_setattr:
10898         {
10899             struct target_sched_attr *target_scha;
10900             struct sched_attr scha;
10901             uint32_t size;
10902             int zeroed;
10903             if (arg2 == 0) {
10904                 return -TARGET_EINVAL;
10905             }
10906             if (get_user_u32(size, arg2)) {
10907                 return -TARGET_EFAULT;
10908             }
10909             if (!size) {
10910                 size = offsetof(struct target_sched_attr, sched_util_min);
10911             }
10912             if (size < offsetof(struct target_sched_attr, sched_util_min)) {
10913                 if (put_user_u32(sizeof(struct target_sched_attr), arg2)) {
10914                     return -TARGET_EFAULT;
10915                 }
10916                 return -TARGET_E2BIG;
10917             }
10918 
10919             zeroed = check_zeroed_user(arg2, sizeof(struct target_sched_attr), size);
10920             if (zeroed < 0) {
10921                 return zeroed;
10922             } else if (zeroed == 0) {
10923                 if (put_user_u32(sizeof(struct target_sched_attr), arg2)) {
10924                     return -TARGET_EFAULT;
10925                 }
10926                 return -TARGET_E2BIG;
10927             }
10928             if (size > sizeof(struct target_sched_attr)) {
10929                 size = sizeof(struct target_sched_attr);
10930             }
10931 
10932             target_scha = lock_user(VERIFY_READ, arg2, size, 1);
10933             if (!target_scha) {
10934                 return -TARGET_EFAULT;
10935             }
10936             scha.size = size;
10937             scha.sched_policy = tswap32(target_scha->sched_policy);
10938             scha.sched_flags = tswap64(target_scha->sched_flags);
10939             scha.sched_nice = tswap32(target_scha->sched_nice);
10940             scha.sched_priority = tswap32(target_scha->sched_priority);
10941             scha.sched_runtime = tswap64(target_scha->sched_runtime);
10942             scha.sched_deadline = tswap64(target_scha->sched_deadline);
10943             scha.sched_period = tswap64(target_scha->sched_period);
10944             if (size > offsetof(struct target_sched_attr, sched_util_min)) {
10945                 scha.sched_util_min = tswap32(target_scha->sched_util_min);
10946                 scha.sched_util_max = tswap32(target_scha->sched_util_max);
10947             }
10948             unlock_user(target_scha, arg2, 0);
10949             return get_errno(sys_sched_setattr(arg1, &scha, arg3));
10950         }
10951     case TARGET_NR_sched_yield:
10952         return get_errno(sched_yield());
10953     case TARGET_NR_sched_get_priority_max:
10954         return get_errno(sched_get_priority_max(arg1));
10955     case TARGET_NR_sched_get_priority_min:
10956         return get_errno(sched_get_priority_min(arg1));
10957 #ifdef TARGET_NR_sched_rr_get_interval
10958     case TARGET_NR_sched_rr_get_interval:
10959         {
10960             struct timespec ts;
10961             ret = get_errno(sched_rr_get_interval(arg1, &ts));
10962             if (!is_error(ret)) {
10963                 ret = host_to_target_timespec(arg2, &ts);
10964             }
10965         }
10966         return ret;
10967 #endif
10968 #ifdef TARGET_NR_sched_rr_get_interval_time64
10969     case TARGET_NR_sched_rr_get_interval_time64:
10970         {
10971             struct timespec ts;
10972             ret = get_errno(sched_rr_get_interval(arg1, &ts));
10973             if (!is_error(ret)) {
10974                 ret = host_to_target_timespec64(arg2, &ts);
10975             }
10976         }
10977         return ret;
10978 #endif
10979 #if defined(TARGET_NR_nanosleep)
10980     case TARGET_NR_nanosleep:
10981         {
10982             struct timespec req, rem;
10983             target_to_host_timespec(&req, arg1);
10984             ret = get_errno(safe_nanosleep(&req, &rem));
10985             if (is_error(ret) && arg2) {
10986                 host_to_target_timespec(arg2, &rem);
10987             }
10988         }
10989         return ret;
10990 #endif
10991     case TARGET_NR_prctl:
10992         return do_prctl(cpu_env, arg1, arg2, arg3, arg4, arg5);
10993         break;
10994 #ifdef TARGET_NR_arch_prctl
10995     case TARGET_NR_arch_prctl:
10996         return do_arch_prctl(cpu_env, arg1, arg2);
10997 #endif
10998 #ifdef TARGET_NR_pread64
10999     case TARGET_NR_pread64:
11000         if (regpairs_aligned(cpu_env, num)) {
11001             arg4 = arg5;
11002             arg5 = arg6;
11003         }
11004         if (arg2 == 0 && arg3 == 0) {
11005             /* Special-case NULL buffer and zero length, which should succeed */
11006             p = 0;
11007         } else {
11008             p = lock_user(VERIFY_WRITE, arg2, arg3, 0);
11009             if (!p) {
11010                 return -TARGET_EFAULT;
11011             }
11012         }
11013         ret = get_errno(pread64(arg1, p, arg3, target_offset64(arg4, arg5)));
11014         unlock_user(p, arg2, ret);
11015         return ret;
11016     case TARGET_NR_pwrite64:
11017         if (regpairs_aligned(cpu_env, num)) {
11018             arg4 = arg5;
11019             arg5 = arg6;
11020         }
11021         if (arg2 == 0 && arg3 == 0) {
11022             /* Special-case NULL buffer and zero length, which should succeed */
11023             p = 0;
11024         } else {
11025             p = lock_user(VERIFY_READ, arg2, arg3, 1);
11026             if (!p) {
11027                 return -TARGET_EFAULT;
11028             }
11029         }
11030         ret = get_errno(pwrite64(arg1, p, arg3, target_offset64(arg4, arg5)));
11031         unlock_user(p, arg2, 0);
11032         return ret;
11033 #endif
11034     case TARGET_NR_getcwd:
11035         if (!(p = lock_user(VERIFY_WRITE, arg1, arg2, 0)))
11036             return -TARGET_EFAULT;
11037         ret = get_errno(sys_getcwd1(p, arg2));
11038         unlock_user(p, arg1, ret);
11039         return ret;
11040     case TARGET_NR_capget:
11041     case TARGET_NR_capset:
11042     {
11043         struct target_user_cap_header *target_header;
11044         struct target_user_cap_data *target_data = NULL;
11045         struct __user_cap_header_struct header;
11046         struct __user_cap_data_struct data[2];
11047         struct __user_cap_data_struct *dataptr = NULL;
11048         int i, target_datalen;
11049         int data_items = 1;
11050 
11051         if (!lock_user_struct(VERIFY_WRITE, target_header, arg1, 1)) {
11052             return -TARGET_EFAULT;
11053         }
11054         header.version = tswap32(target_header->version);
11055         header.pid = tswap32(target_header->pid);
11056 
11057         if (header.version != _LINUX_CAPABILITY_VERSION) {
11058             /* Version 2 and up takes pointer to two user_data structs */
11059             data_items = 2;
11060         }
11061 
11062         target_datalen = sizeof(*target_data) * data_items;
11063 
11064         if (arg2) {
11065             if (num == TARGET_NR_capget) {
11066                 target_data = lock_user(VERIFY_WRITE, arg2, target_datalen, 0);
11067             } else {
11068                 target_data = lock_user(VERIFY_READ, arg2, target_datalen, 1);
11069             }
11070             if (!target_data) {
11071                 unlock_user_struct(target_header, arg1, 0);
11072                 return -TARGET_EFAULT;
11073             }
11074 
11075             if (num == TARGET_NR_capset) {
11076                 for (i = 0; i < data_items; i++) {
11077                     data[i].effective = tswap32(target_data[i].effective);
11078                     data[i].permitted = tswap32(target_data[i].permitted);
11079                     data[i].inheritable = tswap32(target_data[i].inheritable);
11080                 }
11081             }
11082 
11083             dataptr = data;
11084         }
11085 
11086         if (num == TARGET_NR_capget) {
11087             ret = get_errno(capget(&header, dataptr));
11088         } else {
11089             ret = get_errno(capset(&header, dataptr));
11090         }
11091 
11092         /* The kernel always updates version for both capget and capset */
11093         target_header->version = tswap32(header.version);
11094         unlock_user_struct(target_header, arg1, 1);
11095 
11096         if (arg2) {
11097             if (num == TARGET_NR_capget) {
11098                 for (i = 0; i < data_items; i++) {
11099                     target_data[i].effective = tswap32(data[i].effective);
11100                     target_data[i].permitted = tswap32(data[i].permitted);
11101                     target_data[i].inheritable = tswap32(data[i].inheritable);
11102                 }
11103                 unlock_user(target_data, arg2, target_datalen);
11104             } else {
11105                 unlock_user(target_data, arg2, 0);
11106             }
11107         }
11108         return ret;
11109     }
11110     case TARGET_NR_sigaltstack:
11111         return do_sigaltstack(arg1, arg2, cpu_env);
11112 
11113 #ifdef CONFIG_SENDFILE
11114 #ifdef TARGET_NR_sendfile
11115     case TARGET_NR_sendfile:
11116     {
11117         off_t *offp = NULL;
11118         off_t off;
11119         if (arg3) {
11120             ret = get_user_sal(off, arg3);
11121             if (is_error(ret)) {
11122                 return ret;
11123             }
11124             offp = &off;
11125         }
11126         ret = get_errno(sendfile(arg1, arg2, offp, arg4));
11127         if (!is_error(ret) && arg3) {
11128             abi_long ret2 = put_user_sal(off, arg3);
11129             if (is_error(ret2)) {
11130                 ret = ret2;
11131             }
11132         }
11133         return ret;
11134     }
11135 #endif
11136 #ifdef TARGET_NR_sendfile64
11137     case TARGET_NR_sendfile64:
11138     {
11139         off_t *offp = NULL;
11140         off_t off;
11141         if (arg3) {
11142             ret = get_user_s64(off, arg3);
11143             if (is_error(ret)) {
11144                 return ret;
11145             }
11146             offp = &off;
11147         }
11148         ret = get_errno(sendfile(arg1, arg2, offp, arg4));
11149         if (!is_error(ret) && arg3) {
11150             abi_long ret2 = put_user_s64(off, arg3);
11151             if (is_error(ret2)) {
11152                 ret = ret2;
11153             }
11154         }
11155         return ret;
11156     }
11157 #endif
11158 #endif
11159 #ifdef TARGET_NR_vfork
11160     case TARGET_NR_vfork:
11161         return get_errno(do_fork(cpu_env,
11162                          CLONE_VFORK | CLONE_VM | TARGET_SIGCHLD,
11163                          0, 0, 0, 0));
11164 #endif
11165 #ifdef TARGET_NR_ugetrlimit
11166     case TARGET_NR_ugetrlimit:
11167     {
11168 	struct rlimit rlim;
11169 	int resource = target_to_host_resource(arg1);
11170 	ret = get_errno(getrlimit(resource, &rlim));
11171 	if (!is_error(ret)) {
11172 	    struct target_rlimit *target_rlim;
11173             if (!lock_user_struct(VERIFY_WRITE, target_rlim, arg2, 0))
11174                 return -TARGET_EFAULT;
11175 	    target_rlim->rlim_cur = host_to_target_rlim(rlim.rlim_cur);
11176 	    target_rlim->rlim_max = host_to_target_rlim(rlim.rlim_max);
11177             unlock_user_struct(target_rlim, arg2, 1);
11178 	}
11179         return ret;
11180     }
11181 #endif
11182 #ifdef TARGET_NR_truncate64
11183     case TARGET_NR_truncate64:
11184         if (!(p = lock_user_string(arg1)))
11185             return -TARGET_EFAULT;
11186 	ret = target_truncate64(cpu_env, p, arg2, arg3, arg4);
11187         unlock_user(p, arg1, 0);
11188         return ret;
11189 #endif
11190 #ifdef TARGET_NR_ftruncate64
11191     case TARGET_NR_ftruncate64:
11192         return target_ftruncate64(cpu_env, arg1, arg2, arg3, arg4);
11193 #endif
11194 #ifdef TARGET_NR_stat64
11195     case TARGET_NR_stat64:
11196         if (!(p = lock_user_string(arg1))) {
11197             return -TARGET_EFAULT;
11198         }
11199         ret = get_errno(stat(path(p), &st));
11200         unlock_user(p, arg1, 0);
11201         if (!is_error(ret))
11202             ret = host_to_target_stat64(cpu_env, arg2, &st);
11203         return ret;
11204 #endif
11205 #ifdef TARGET_NR_lstat64
11206     case TARGET_NR_lstat64:
11207         if (!(p = lock_user_string(arg1))) {
11208             return -TARGET_EFAULT;
11209         }
11210         ret = get_errno(lstat(path(p), &st));
11211         unlock_user(p, arg1, 0);
11212         if (!is_error(ret))
11213             ret = host_to_target_stat64(cpu_env, arg2, &st);
11214         return ret;
11215 #endif
11216 #ifdef TARGET_NR_fstat64
11217     case TARGET_NR_fstat64:
11218         ret = get_errno(fstat(arg1, &st));
11219         if (!is_error(ret))
11220             ret = host_to_target_stat64(cpu_env, arg2, &st);
11221         return ret;
11222 #endif
11223 #if (defined(TARGET_NR_fstatat64) || defined(TARGET_NR_newfstatat))
11224 #ifdef TARGET_NR_fstatat64
11225     case TARGET_NR_fstatat64:
11226 #endif
11227 #ifdef TARGET_NR_newfstatat
11228     case TARGET_NR_newfstatat:
11229 #endif
11230         if (!(p = lock_user_string(arg2))) {
11231             return -TARGET_EFAULT;
11232         }
11233         ret = get_errno(fstatat(arg1, path(p), &st, arg4));
11234         unlock_user(p, arg2, 0);
11235         if (!is_error(ret))
11236             ret = host_to_target_stat64(cpu_env, arg3, &st);
11237         return ret;
11238 #endif
11239 #if defined(TARGET_NR_statx)
11240     case TARGET_NR_statx:
11241         {
11242             struct target_statx *target_stx;
11243             int dirfd = arg1;
11244             int flags = arg3;
11245 
11246             p = lock_user_string(arg2);
11247             if (p == NULL) {
11248                 return -TARGET_EFAULT;
11249             }
11250 #if defined(__NR_statx)
11251             {
11252                 /*
11253                  * It is assumed that struct statx is architecture independent.
11254                  */
11255                 struct target_statx host_stx;
11256                 int mask = arg4;
11257 
11258                 ret = get_errno(sys_statx(dirfd, p, flags, mask, &host_stx));
11259                 if (!is_error(ret)) {
11260                     if (host_to_target_statx(&host_stx, arg5) != 0) {
11261                         unlock_user(p, arg2, 0);
11262                         return -TARGET_EFAULT;
11263                     }
11264                 }
11265 
11266                 if (ret != -TARGET_ENOSYS) {
11267                     unlock_user(p, arg2, 0);
11268                     return ret;
11269                 }
11270             }
11271 #endif
11272             ret = get_errno(fstatat(dirfd, path(p), &st, flags));
11273             unlock_user(p, arg2, 0);
11274 
11275             if (!is_error(ret)) {
11276                 if (!lock_user_struct(VERIFY_WRITE, target_stx, arg5, 0)) {
11277                     return -TARGET_EFAULT;
11278                 }
11279                 memset(target_stx, 0, sizeof(*target_stx));
11280                 __put_user(major(st.st_dev), &target_stx->stx_dev_major);
11281                 __put_user(minor(st.st_dev), &target_stx->stx_dev_minor);
11282                 __put_user(st.st_ino, &target_stx->stx_ino);
11283                 __put_user(st.st_mode, &target_stx->stx_mode);
11284                 __put_user(st.st_uid, &target_stx->stx_uid);
11285                 __put_user(st.st_gid, &target_stx->stx_gid);
11286                 __put_user(st.st_nlink, &target_stx->stx_nlink);
11287                 __put_user(major(st.st_rdev), &target_stx->stx_rdev_major);
11288                 __put_user(minor(st.st_rdev), &target_stx->stx_rdev_minor);
11289                 __put_user(st.st_size, &target_stx->stx_size);
11290                 __put_user(st.st_blksize, &target_stx->stx_blksize);
11291                 __put_user(st.st_blocks, &target_stx->stx_blocks);
11292                 __put_user(st.st_atime, &target_stx->stx_atime.tv_sec);
11293                 __put_user(st.st_mtime, &target_stx->stx_mtime.tv_sec);
11294                 __put_user(st.st_ctime, &target_stx->stx_ctime.tv_sec);
11295                 unlock_user_struct(target_stx, arg5, 1);
11296             }
11297         }
11298         return ret;
11299 #endif
11300 #ifdef TARGET_NR_lchown
11301     case TARGET_NR_lchown:
11302         if (!(p = lock_user_string(arg1)))
11303             return -TARGET_EFAULT;
11304         ret = get_errno(lchown(p, low2highuid(arg2), low2highgid(arg3)));
11305         unlock_user(p, arg1, 0);
11306         return ret;
11307 #endif
11308 #ifdef TARGET_NR_getuid
11309     case TARGET_NR_getuid:
11310         return get_errno(high2lowuid(getuid()));
11311 #endif
11312 #ifdef TARGET_NR_getgid
11313     case TARGET_NR_getgid:
11314         return get_errno(high2lowgid(getgid()));
11315 #endif
11316 #ifdef TARGET_NR_geteuid
11317     case TARGET_NR_geteuid:
11318         return get_errno(high2lowuid(geteuid()));
11319 #endif
11320 #ifdef TARGET_NR_getegid
11321     case TARGET_NR_getegid:
11322         return get_errno(high2lowgid(getegid()));
11323 #endif
11324     case TARGET_NR_setreuid:
11325         return get_errno(setreuid(low2highuid(arg1), low2highuid(arg2)));
11326     case TARGET_NR_setregid:
11327         return get_errno(setregid(low2highgid(arg1), low2highgid(arg2)));
11328     case TARGET_NR_getgroups:
11329         {
11330             int gidsetsize = arg1;
11331             target_id *target_grouplist;
11332             gid_t *grouplist;
11333             int i;
11334 
11335             grouplist = alloca(gidsetsize * sizeof(gid_t));
11336             ret = get_errno(getgroups(gidsetsize, grouplist));
11337             if (gidsetsize == 0)
11338                 return ret;
11339             if (!is_error(ret)) {
11340                 target_grouplist = lock_user(VERIFY_WRITE, arg2, gidsetsize * sizeof(target_id), 0);
11341                 if (!target_grouplist)
11342                     return -TARGET_EFAULT;
11343                 for(i = 0;i < ret; i++)
11344                     target_grouplist[i] = tswapid(high2lowgid(grouplist[i]));
11345                 unlock_user(target_grouplist, arg2, gidsetsize * sizeof(target_id));
11346             }
11347         }
11348         return ret;
11349     case TARGET_NR_setgroups:
11350         {
11351             int gidsetsize = arg1;
11352             target_id *target_grouplist;
11353             gid_t *grouplist = NULL;
11354             int i;
11355             if (gidsetsize) {
11356                 grouplist = alloca(gidsetsize * sizeof(gid_t));
11357                 target_grouplist = lock_user(VERIFY_READ, arg2, gidsetsize * sizeof(target_id), 1);
11358                 if (!target_grouplist) {
11359                     return -TARGET_EFAULT;
11360                 }
11361                 for (i = 0; i < gidsetsize; i++) {
11362                     grouplist[i] = low2highgid(tswapid(target_grouplist[i]));
11363                 }
11364                 unlock_user(target_grouplist, arg2, 0);
11365             }
11366             return get_errno(setgroups(gidsetsize, grouplist));
11367         }
11368     case TARGET_NR_fchown:
11369         return get_errno(fchown(arg1, low2highuid(arg2), low2highgid(arg3)));
11370 #if defined(TARGET_NR_fchownat)
11371     case TARGET_NR_fchownat:
11372         if (!(p = lock_user_string(arg2)))
11373             return -TARGET_EFAULT;
11374         ret = get_errno(fchownat(arg1, p, low2highuid(arg3),
11375                                  low2highgid(arg4), arg5));
11376         unlock_user(p, arg2, 0);
11377         return ret;
11378 #endif
11379 #ifdef TARGET_NR_setresuid
11380     case TARGET_NR_setresuid:
11381         return get_errno(sys_setresuid(low2highuid(arg1),
11382                                        low2highuid(arg2),
11383                                        low2highuid(arg3)));
11384 #endif
11385 #ifdef TARGET_NR_getresuid
11386     case TARGET_NR_getresuid:
11387         {
11388             uid_t ruid, euid, suid;
11389             ret = get_errno(getresuid(&ruid, &euid, &suid));
11390             if (!is_error(ret)) {
11391                 if (put_user_id(high2lowuid(ruid), arg1)
11392                     || put_user_id(high2lowuid(euid), arg2)
11393                     || put_user_id(high2lowuid(suid), arg3))
11394                     return -TARGET_EFAULT;
11395             }
11396         }
11397         return ret;
11398 #endif
11399 #ifdef TARGET_NR_getresgid
11400     case TARGET_NR_setresgid:
11401         return get_errno(sys_setresgid(low2highgid(arg1),
11402                                        low2highgid(arg2),
11403                                        low2highgid(arg3)));
11404 #endif
11405 #ifdef TARGET_NR_getresgid
11406     case TARGET_NR_getresgid:
11407         {
11408             gid_t rgid, egid, sgid;
11409             ret = get_errno(getresgid(&rgid, &egid, &sgid));
11410             if (!is_error(ret)) {
11411                 if (put_user_id(high2lowgid(rgid), arg1)
11412                     || put_user_id(high2lowgid(egid), arg2)
11413                     || put_user_id(high2lowgid(sgid), arg3))
11414                     return -TARGET_EFAULT;
11415             }
11416         }
11417         return ret;
11418 #endif
11419 #ifdef TARGET_NR_chown
11420     case TARGET_NR_chown:
11421         if (!(p = lock_user_string(arg1)))
11422             return -TARGET_EFAULT;
11423         ret = get_errno(chown(p, low2highuid(arg2), low2highgid(arg3)));
11424         unlock_user(p, arg1, 0);
11425         return ret;
11426 #endif
11427     case TARGET_NR_setuid:
11428         return get_errno(sys_setuid(low2highuid(arg1)));
11429     case TARGET_NR_setgid:
11430         return get_errno(sys_setgid(low2highgid(arg1)));
11431     case TARGET_NR_setfsuid:
11432         return get_errno(setfsuid(arg1));
11433     case TARGET_NR_setfsgid:
11434         return get_errno(setfsgid(arg1));
11435 
11436 #ifdef TARGET_NR_lchown32
11437     case TARGET_NR_lchown32:
11438         if (!(p = lock_user_string(arg1)))
11439             return -TARGET_EFAULT;
11440         ret = get_errno(lchown(p, arg2, arg3));
11441         unlock_user(p, arg1, 0);
11442         return ret;
11443 #endif
11444 #ifdef TARGET_NR_getuid32
11445     case TARGET_NR_getuid32:
11446         return get_errno(getuid());
11447 #endif
11448 
11449 #if defined(TARGET_NR_getxuid) && defined(TARGET_ALPHA)
11450    /* Alpha specific */
11451     case TARGET_NR_getxuid:
11452          {
11453             uid_t euid;
11454             euid=geteuid();
11455             cpu_env->ir[IR_A4]=euid;
11456          }
11457         return get_errno(getuid());
11458 #endif
11459 #if defined(TARGET_NR_getxgid) && defined(TARGET_ALPHA)
11460    /* Alpha specific */
11461     case TARGET_NR_getxgid:
11462          {
11463             uid_t egid;
11464             egid=getegid();
11465             cpu_env->ir[IR_A4]=egid;
11466          }
11467         return get_errno(getgid());
11468 #endif
11469 #if defined(TARGET_NR_osf_getsysinfo) && defined(TARGET_ALPHA)
11470     /* Alpha specific */
11471     case TARGET_NR_osf_getsysinfo:
11472         ret = -TARGET_EOPNOTSUPP;
11473         switch (arg1) {
11474           case TARGET_GSI_IEEE_FP_CONTROL:
11475             {
11476                 uint64_t fpcr = cpu_alpha_load_fpcr(cpu_env);
11477                 uint64_t swcr = cpu_env->swcr;
11478 
11479                 swcr &= ~SWCR_STATUS_MASK;
11480                 swcr |= (fpcr >> 35) & SWCR_STATUS_MASK;
11481 
11482                 if (put_user_u64 (swcr, arg2))
11483                         return -TARGET_EFAULT;
11484                 ret = 0;
11485             }
11486             break;
11487 
11488           /* case GSI_IEEE_STATE_AT_SIGNAL:
11489              -- Not implemented in linux kernel.
11490              case GSI_UACPROC:
11491              -- Retrieves current unaligned access state; not much used.
11492              case GSI_PROC_TYPE:
11493              -- Retrieves implver information; surely not used.
11494              case GSI_GET_HWRPB:
11495              -- Grabs a copy of the HWRPB; surely not used.
11496           */
11497         }
11498         return ret;
11499 #endif
11500 #if defined(TARGET_NR_osf_setsysinfo) && defined(TARGET_ALPHA)
11501     /* Alpha specific */
11502     case TARGET_NR_osf_setsysinfo:
11503         ret = -TARGET_EOPNOTSUPP;
11504         switch (arg1) {
11505           case TARGET_SSI_IEEE_FP_CONTROL:
11506             {
11507                 uint64_t swcr, fpcr;
11508 
11509                 if (get_user_u64 (swcr, arg2)) {
11510                     return -TARGET_EFAULT;
11511                 }
11512 
11513                 /*
11514                  * The kernel calls swcr_update_status to update the
11515                  * status bits from the fpcr at every point that it
11516                  * could be queried.  Therefore, we store the status
11517                  * bits only in FPCR.
11518                  */
11519                 cpu_env->swcr = swcr & (SWCR_TRAP_ENABLE_MASK | SWCR_MAP_MASK);
11520 
11521                 fpcr = cpu_alpha_load_fpcr(cpu_env);
11522                 fpcr &= ((uint64_t)FPCR_DYN_MASK << 32);
11523                 fpcr |= alpha_ieee_swcr_to_fpcr(swcr);
11524                 cpu_alpha_store_fpcr(cpu_env, fpcr);
11525                 ret = 0;
11526             }
11527             break;
11528 
11529           case TARGET_SSI_IEEE_RAISE_EXCEPTION:
11530             {
11531                 uint64_t exc, fpcr, fex;
11532 
11533                 if (get_user_u64(exc, arg2)) {
11534                     return -TARGET_EFAULT;
11535                 }
11536                 exc &= SWCR_STATUS_MASK;
11537                 fpcr = cpu_alpha_load_fpcr(cpu_env);
11538 
11539                 /* Old exceptions are not signaled.  */
11540                 fex = alpha_ieee_fpcr_to_swcr(fpcr);
11541                 fex = exc & ~fex;
11542                 fex >>= SWCR_STATUS_TO_EXCSUM_SHIFT;
11543                 fex &= (cpu_env)->swcr;
11544 
11545                 /* Update the hardware fpcr.  */
11546                 fpcr |= alpha_ieee_swcr_to_fpcr(exc);
11547                 cpu_alpha_store_fpcr(cpu_env, fpcr);
11548 
11549                 if (fex) {
11550                     int si_code = TARGET_FPE_FLTUNK;
11551                     target_siginfo_t info;
11552 
11553                     if (fex & SWCR_TRAP_ENABLE_DNO) {
11554                         si_code = TARGET_FPE_FLTUND;
11555                     }
11556                     if (fex & SWCR_TRAP_ENABLE_INE) {
11557                         si_code = TARGET_FPE_FLTRES;
11558                     }
11559                     if (fex & SWCR_TRAP_ENABLE_UNF) {
11560                         si_code = TARGET_FPE_FLTUND;
11561                     }
11562                     if (fex & SWCR_TRAP_ENABLE_OVF) {
11563                         si_code = TARGET_FPE_FLTOVF;
11564                     }
11565                     if (fex & SWCR_TRAP_ENABLE_DZE) {
11566                         si_code = TARGET_FPE_FLTDIV;
11567                     }
11568                     if (fex & SWCR_TRAP_ENABLE_INV) {
11569                         si_code = TARGET_FPE_FLTINV;
11570                     }
11571 
11572                     info.si_signo = SIGFPE;
11573                     info.si_errno = 0;
11574                     info.si_code = si_code;
11575                     info._sifields._sigfault._addr = (cpu_env)->pc;
11576                     queue_signal(cpu_env, info.si_signo,
11577                                  QEMU_SI_FAULT, &info);
11578                 }
11579                 ret = 0;
11580             }
11581             break;
11582 
11583           /* case SSI_NVPAIRS:
11584              -- Used with SSIN_UACPROC to enable unaligned accesses.
11585              case SSI_IEEE_STATE_AT_SIGNAL:
11586              case SSI_IEEE_IGNORE_STATE_AT_SIGNAL:
11587              -- Not implemented in linux kernel
11588           */
11589         }
11590         return ret;
11591 #endif
11592 #ifdef TARGET_NR_osf_sigprocmask
11593     /* Alpha specific.  */
11594     case TARGET_NR_osf_sigprocmask:
11595         {
11596             abi_ulong mask;
11597             int how;
11598             sigset_t set, oldset;
11599 
11600             switch(arg1) {
11601             case TARGET_SIG_BLOCK:
11602                 how = SIG_BLOCK;
11603                 break;
11604             case TARGET_SIG_UNBLOCK:
11605                 how = SIG_UNBLOCK;
11606                 break;
11607             case TARGET_SIG_SETMASK:
11608                 how = SIG_SETMASK;
11609                 break;
11610             default:
11611                 return -TARGET_EINVAL;
11612             }
11613             mask = arg2;
11614             target_to_host_old_sigset(&set, &mask);
11615             ret = do_sigprocmask(how, &set, &oldset);
11616             if (!ret) {
11617                 host_to_target_old_sigset(&mask, &oldset);
11618                 ret = mask;
11619             }
11620         }
11621         return ret;
11622 #endif
11623 
11624 #ifdef TARGET_NR_getgid32
11625     case TARGET_NR_getgid32:
11626         return get_errno(getgid());
11627 #endif
11628 #ifdef TARGET_NR_geteuid32
11629     case TARGET_NR_geteuid32:
11630         return get_errno(geteuid());
11631 #endif
11632 #ifdef TARGET_NR_getegid32
11633     case TARGET_NR_getegid32:
11634         return get_errno(getegid());
11635 #endif
11636 #ifdef TARGET_NR_setreuid32
11637     case TARGET_NR_setreuid32:
11638         return get_errno(setreuid(arg1, arg2));
11639 #endif
11640 #ifdef TARGET_NR_setregid32
11641     case TARGET_NR_setregid32:
11642         return get_errno(setregid(arg1, arg2));
11643 #endif
11644 #ifdef TARGET_NR_getgroups32
11645     case TARGET_NR_getgroups32:
11646         {
11647             int gidsetsize = arg1;
11648             uint32_t *target_grouplist;
11649             gid_t *grouplist;
11650             int i;
11651 
11652             grouplist = alloca(gidsetsize * sizeof(gid_t));
11653             ret = get_errno(getgroups(gidsetsize, grouplist));
11654             if (gidsetsize == 0)
11655                 return ret;
11656             if (!is_error(ret)) {
11657                 target_grouplist = lock_user(VERIFY_WRITE, arg2, gidsetsize * 4, 0);
11658                 if (!target_grouplist) {
11659                     return -TARGET_EFAULT;
11660                 }
11661                 for(i = 0;i < ret; i++)
11662                     target_grouplist[i] = tswap32(grouplist[i]);
11663                 unlock_user(target_grouplist, arg2, gidsetsize * 4);
11664             }
11665         }
11666         return ret;
11667 #endif
11668 #ifdef TARGET_NR_setgroups32
11669     case TARGET_NR_setgroups32:
11670         {
11671             int gidsetsize = arg1;
11672             uint32_t *target_grouplist;
11673             gid_t *grouplist;
11674             int i;
11675 
11676             grouplist = alloca(gidsetsize * sizeof(gid_t));
11677             target_grouplist = lock_user(VERIFY_READ, arg2, gidsetsize * 4, 1);
11678             if (!target_grouplist) {
11679                 return -TARGET_EFAULT;
11680             }
11681             for(i = 0;i < gidsetsize; i++)
11682                 grouplist[i] = tswap32(target_grouplist[i]);
11683             unlock_user(target_grouplist, arg2, 0);
11684             return get_errno(setgroups(gidsetsize, grouplist));
11685         }
11686 #endif
11687 #ifdef TARGET_NR_fchown32
11688     case TARGET_NR_fchown32:
11689         return get_errno(fchown(arg1, arg2, arg3));
11690 #endif
11691 #ifdef TARGET_NR_setresuid32
11692     case TARGET_NR_setresuid32:
11693         return get_errno(sys_setresuid(arg1, arg2, arg3));
11694 #endif
11695 #ifdef TARGET_NR_getresuid32
11696     case TARGET_NR_getresuid32:
11697         {
11698             uid_t ruid, euid, suid;
11699             ret = get_errno(getresuid(&ruid, &euid, &suid));
11700             if (!is_error(ret)) {
11701                 if (put_user_u32(ruid, arg1)
11702                     || put_user_u32(euid, arg2)
11703                     || put_user_u32(suid, arg3))
11704                     return -TARGET_EFAULT;
11705             }
11706         }
11707         return ret;
11708 #endif
11709 #ifdef TARGET_NR_setresgid32
11710     case TARGET_NR_setresgid32:
11711         return get_errno(sys_setresgid(arg1, arg2, arg3));
11712 #endif
11713 #ifdef TARGET_NR_getresgid32
11714     case TARGET_NR_getresgid32:
11715         {
11716             gid_t rgid, egid, sgid;
11717             ret = get_errno(getresgid(&rgid, &egid, &sgid));
11718             if (!is_error(ret)) {
11719                 if (put_user_u32(rgid, arg1)
11720                     || put_user_u32(egid, arg2)
11721                     || put_user_u32(sgid, arg3))
11722                     return -TARGET_EFAULT;
11723             }
11724         }
11725         return ret;
11726 #endif
11727 #ifdef TARGET_NR_chown32
11728     case TARGET_NR_chown32:
11729         if (!(p = lock_user_string(arg1)))
11730             return -TARGET_EFAULT;
11731         ret = get_errno(chown(p, arg2, arg3));
11732         unlock_user(p, arg1, 0);
11733         return ret;
11734 #endif
11735 #ifdef TARGET_NR_setuid32
11736     case TARGET_NR_setuid32:
11737         return get_errno(sys_setuid(arg1));
11738 #endif
11739 #ifdef TARGET_NR_setgid32
11740     case TARGET_NR_setgid32:
11741         return get_errno(sys_setgid(arg1));
11742 #endif
11743 #ifdef TARGET_NR_setfsuid32
11744     case TARGET_NR_setfsuid32:
11745         return get_errno(setfsuid(arg1));
11746 #endif
11747 #ifdef TARGET_NR_setfsgid32
11748     case TARGET_NR_setfsgid32:
11749         return get_errno(setfsgid(arg1));
11750 #endif
11751 #ifdef TARGET_NR_mincore
11752     case TARGET_NR_mincore:
11753         {
11754             void *a = lock_user(VERIFY_READ, arg1, arg2, 0);
11755             if (!a) {
11756                 return -TARGET_ENOMEM;
11757             }
11758             p = lock_user_string(arg3);
11759             if (!p) {
11760                 ret = -TARGET_EFAULT;
11761             } else {
11762                 ret = get_errno(mincore(a, arg2, p));
11763                 unlock_user(p, arg3, ret);
11764             }
11765             unlock_user(a, arg1, 0);
11766         }
11767         return ret;
11768 #endif
11769 #ifdef TARGET_NR_arm_fadvise64_64
11770     case TARGET_NR_arm_fadvise64_64:
11771         /* arm_fadvise64_64 looks like fadvise64_64 but
11772          * with different argument order: fd, advice, offset, len
11773          * rather than the usual fd, offset, len, advice.
11774          * Note that offset and len are both 64-bit so appear as
11775          * pairs of 32-bit registers.
11776          */
11777         ret = posix_fadvise(arg1, target_offset64(arg3, arg4),
11778                             target_offset64(arg5, arg6), arg2);
11779         return -host_to_target_errno(ret);
11780 #endif
11781 
11782 #if TARGET_ABI_BITS == 32
11783 
11784 #ifdef TARGET_NR_fadvise64_64
11785     case TARGET_NR_fadvise64_64:
11786 #if defined(TARGET_PPC) || defined(TARGET_XTENSA)
11787         /* 6 args: fd, advice, offset (high, low), len (high, low) */
11788         ret = arg2;
11789         arg2 = arg3;
11790         arg3 = arg4;
11791         arg4 = arg5;
11792         arg5 = arg6;
11793         arg6 = ret;
11794 #else
11795         /* 6 args: fd, offset (high, low), len (high, low), advice */
11796         if (regpairs_aligned(cpu_env, num)) {
11797             /* offset is in (3,4), len in (5,6) and advice in 7 */
11798             arg2 = arg3;
11799             arg3 = arg4;
11800             arg4 = arg5;
11801             arg5 = arg6;
11802             arg6 = arg7;
11803         }
11804 #endif
11805         ret = posix_fadvise(arg1, target_offset64(arg2, arg3),
11806                             target_offset64(arg4, arg5), arg6);
11807         return -host_to_target_errno(ret);
11808 #endif
11809 
11810 #ifdef TARGET_NR_fadvise64
11811     case TARGET_NR_fadvise64:
11812         /* 5 args: fd, offset (high, low), len, advice */
11813         if (regpairs_aligned(cpu_env, num)) {
11814             /* offset is in (3,4), len in 5 and advice in 6 */
11815             arg2 = arg3;
11816             arg3 = arg4;
11817             arg4 = arg5;
11818             arg5 = arg6;
11819         }
11820         ret = posix_fadvise(arg1, target_offset64(arg2, arg3), arg4, arg5);
11821         return -host_to_target_errno(ret);
11822 #endif
11823 
11824 #else /* not a 32-bit ABI */
11825 #if defined(TARGET_NR_fadvise64_64) || defined(TARGET_NR_fadvise64)
11826 #ifdef TARGET_NR_fadvise64_64
11827     case TARGET_NR_fadvise64_64:
11828 #endif
11829 #ifdef TARGET_NR_fadvise64
11830     case TARGET_NR_fadvise64:
11831 #endif
11832 #ifdef TARGET_S390X
11833         switch (arg4) {
11834         case 4: arg4 = POSIX_FADV_NOREUSE + 1; break; /* make sure it's an invalid value */
11835         case 5: arg4 = POSIX_FADV_NOREUSE + 2; break; /* ditto */
11836         case 6: arg4 = POSIX_FADV_DONTNEED; break;
11837         case 7: arg4 = POSIX_FADV_NOREUSE; break;
11838         default: break;
11839         }
11840 #endif
11841         return -host_to_target_errno(posix_fadvise(arg1, arg2, arg3, arg4));
11842 #endif
11843 #endif /* end of 64-bit ABI fadvise handling */
11844 
11845 #ifdef TARGET_NR_madvise
11846     case TARGET_NR_madvise:
11847         return target_madvise(arg1, arg2, arg3);
11848 #endif
11849 #ifdef TARGET_NR_fcntl64
11850     case TARGET_NR_fcntl64:
11851     {
11852         int cmd;
11853         struct flock64 fl;
11854         from_flock64_fn *copyfrom = copy_from_user_flock64;
11855         to_flock64_fn *copyto = copy_to_user_flock64;
11856 
11857 #ifdef TARGET_ARM
11858         if (!cpu_env->eabi) {
11859             copyfrom = copy_from_user_oabi_flock64;
11860             copyto = copy_to_user_oabi_flock64;
11861         }
11862 #endif
11863 
11864         cmd = target_to_host_fcntl_cmd(arg2);
11865         if (cmd == -TARGET_EINVAL) {
11866             return cmd;
11867         }
11868 
11869         switch(arg2) {
11870         case TARGET_F_GETLK64:
11871             ret = copyfrom(&fl, arg3);
11872             if (ret) {
11873                 break;
11874             }
11875             ret = get_errno(safe_fcntl(arg1, cmd, &fl));
11876             if (ret == 0) {
11877                 ret = copyto(arg3, &fl);
11878             }
11879 	    break;
11880 
11881         case TARGET_F_SETLK64:
11882         case TARGET_F_SETLKW64:
11883             ret = copyfrom(&fl, arg3);
11884             if (ret) {
11885                 break;
11886             }
11887             ret = get_errno(safe_fcntl(arg1, cmd, &fl));
11888 	    break;
11889         default:
11890             ret = do_fcntl(arg1, arg2, arg3);
11891             break;
11892         }
11893         return ret;
11894     }
11895 #endif
11896 #ifdef TARGET_NR_cacheflush
11897     case TARGET_NR_cacheflush:
11898         /* self-modifying code is handled automatically, so nothing needed */
11899         return 0;
11900 #endif
11901 #ifdef TARGET_NR_getpagesize
11902     case TARGET_NR_getpagesize:
11903         return TARGET_PAGE_SIZE;
11904 #endif
11905     case TARGET_NR_gettid:
11906         return get_errno(sys_gettid());
11907 #ifdef TARGET_NR_readahead
11908     case TARGET_NR_readahead:
11909 #if TARGET_ABI_BITS == 32
11910         if (regpairs_aligned(cpu_env, num)) {
11911             arg2 = arg3;
11912             arg3 = arg4;
11913             arg4 = arg5;
11914         }
11915         ret = get_errno(readahead(arg1, target_offset64(arg2, arg3) , arg4));
11916 #else
11917         ret = get_errno(readahead(arg1, arg2, arg3));
11918 #endif
11919         return ret;
11920 #endif
11921 #ifdef CONFIG_ATTR
11922 #ifdef TARGET_NR_setxattr
11923     case TARGET_NR_listxattr:
11924     case TARGET_NR_llistxattr:
11925     {
11926         void *p, *b = 0;
11927         if (arg2) {
11928             b = lock_user(VERIFY_WRITE, arg2, arg3, 0);
11929             if (!b) {
11930                 return -TARGET_EFAULT;
11931             }
11932         }
11933         p = lock_user_string(arg1);
11934         if (p) {
11935             if (num == TARGET_NR_listxattr) {
11936                 ret = get_errno(listxattr(p, b, arg3));
11937             } else {
11938                 ret = get_errno(llistxattr(p, b, arg3));
11939             }
11940         } else {
11941             ret = -TARGET_EFAULT;
11942         }
11943         unlock_user(p, arg1, 0);
11944         unlock_user(b, arg2, arg3);
11945         return ret;
11946     }
11947     case TARGET_NR_flistxattr:
11948     {
11949         void *b = 0;
11950         if (arg2) {
11951             b = lock_user(VERIFY_WRITE, arg2, arg3, 0);
11952             if (!b) {
11953                 return -TARGET_EFAULT;
11954             }
11955         }
11956         ret = get_errno(flistxattr(arg1, b, arg3));
11957         unlock_user(b, arg2, arg3);
11958         return ret;
11959     }
11960     case TARGET_NR_setxattr:
11961     case TARGET_NR_lsetxattr:
11962         {
11963             void *p, *n, *v = 0;
11964             if (arg3) {
11965                 v = lock_user(VERIFY_READ, arg3, arg4, 1);
11966                 if (!v) {
11967                     return -TARGET_EFAULT;
11968                 }
11969             }
11970             p = lock_user_string(arg1);
11971             n = lock_user_string(arg2);
11972             if (p && n) {
11973                 if (num == TARGET_NR_setxattr) {
11974                     ret = get_errno(setxattr(p, n, v, arg4, arg5));
11975                 } else {
11976                     ret = get_errno(lsetxattr(p, n, v, arg4, arg5));
11977                 }
11978             } else {
11979                 ret = -TARGET_EFAULT;
11980             }
11981             unlock_user(p, arg1, 0);
11982             unlock_user(n, arg2, 0);
11983             unlock_user(v, arg3, 0);
11984         }
11985         return ret;
11986     case TARGET_NR_fsetxattr:
11987         {
11988             void *n, *v = 0;
11989             if (arg3) {
11990                 v = lock_user(VERIFY_READ, arg3, arg4, 1);
11991                 if (!v) {
11992                     return -TARGET_EFAULT;
11993                 }
11994             }
11995             n = lock_user_string(arg2);
11996             if (n) {
11997                 ret = get_errno(fsetxattr(arg1, n, v, arg4, arg5));
11998             } else {
11999                 ret = -TARGET_EFAULT;
12000             }
12001             unlock_user(n, arg2, 0);
12002             unlock_user(v, arg3, 0);
12003         }
12004         return ret;
12005     case TARGET_NR_getxattr:
12006     case TARGET_NR_lgetxattr:
12007         {
12008             void *p, *n, *v = 0;
12009             if (arg3) {
12010                 v = lock_user(VERIFY_WRITE, arg3, arg4, 0);
12011                 if (!v) {
12012                     return -TARGET_EFAULT;
12013                 }
12014             }
12015             p = lock_user_string(arg1);
12016             n = lock_user_string(arg2);
12017             if (p && n) {
12018                 if (num == TARGET_NR_getxattr) {
12019                     ret = get_errno(getxattr(p, n, v, arg4));
12020                 } else {
12021                     ret = get_errno(lgetxattr(p, n, v, arg4));
12022                 }
12023             } else {
12024                 ret = -TARGET_EFAULT;
12025             }
12026             unlock_user(p, arg1, 0);
12027             unlock_user(n, arg2, 0);
12028             unlock_user(v, arg3, arg4);
12029         }
12030         return ret;
12031     case TARGET_NR_fgetxattr:
12032         {
12033             void *n, *v = 0;
12034             if (arg3) {
12035                 v = lock_user(VERIFY_WRITE, arg3, arg4, 0);
12036                 if (!v) {
12037                     return -TARGET_EFAULT;
12038                 }
12039             }
12040             n = lock_user_string(arg2);
12041             if (n) {
12042                 ret = get_errno(fgetxattr(arg1, n, v, arg4));
12043             } else {
12044                 ret = -TARGET_EFAULT;
12045             }
12046             unlock_user(n, arg2, 0);
12047             unlock_user(v, arg3, arg4);
12048         }
12049         return ret;
12050     case TARGET_NR_removexattr:
12051     case TARGET_NR_lremovexattr:
12052         {
12053             void *p, *n;
12054             p = lock_user_string(arg1);
12055             n = lock_user_string(arg2);
12056             if (p && n) {
12057                 if (num == TARGET_NR_removexattr) {
12058                     ret = get_errno(removexattr(p, n));
12059                 } else {
12060                     ret = get_errno(lremovexattr(p, n));
12061                 }
12062             } else {
12063                 ret = -TARGET_EFAULT;
12064             }
12065             unlock_user(p, arg1, 0);
12066             unlock_user(n, arg2, 0);
12067         }
12068         return ret;
12069     case TARGET_NR_fremovexattr:
12070         {
12071             void *n;
12072             n = lock_user_string(arg2);
12073             if (n) {
12074                 ret = get_errno(fremovexattr(arg1, n));
12075             } else {
12076                 ret = -TARGET_EFAULT;
12077             }
12078             unlock_user(n, arg2, 0);
12079         }
12080         return ret;
12081 #endif
12082 #endif /* CONFIG_ATTR */
12083 #ifdef TARGET_NR_set_thread_area
12084     case TARGET_NR_set_thread_area:
12085 #if defined(TARGET_MIPS)
12086       cpu_env->active_tc.CP0_UserLocal = arg1;
12087       return 0;
12088 #elif defined(TARGET_CRIS)
12089       if (arg1 & 0xff)
12090           ret = -TARGET_EINVAL;
12091       else {
12092           cpu_env->pregs[PR_PID] = arg1;
12093           ret = 0;
12094       }
12095       return ret;
12096 #elif defined(TARGET_I386) && defined(TARGET_ABI32)
12097       return do_set_thread_area(cpu_env, arg1);
12098 #elif defined(TARGET_M68K)
12099       {
12100           TaskState *ts = cpu->opaque;
12101           ts->tp_value = arg1;
12102           return 0;
12103       }
12104 #else
12105       return -TARGET_ENOSYS;
12106 #endif
12107 #endif
12108 #ifdef TARGET_NR_get_thread_area
12109     case TARGET_NR_get_thread_area:
12110 #if defined(TARGET_I386) && defined(TARGET_ABI32)
12111         return do_get_thread_area(cpu_env, arg1);
12112 #elif defined(TARGET_M68K)
12113         {
12114             TaskState *ts = cpu->opaque;
12115             return ts->tp_value;
12116         }
12117 #else
12118         return -TARGET_ENOSYS;
12119 #endif
12120 #endif
12121 #ifdef TARGET_NR_getdomainname
12122     case TARGET_NR_getdomainname:
12123         return -TARGET_ENOSYS;
12124 #endif
12125 
12126 #ifdef TARGET_NR_clock_settime
12127     case TARGET_NR_clock_settime:
12128     {
12129         struct timespec ts;
12130 
12131         ret = target_to_host_timespec(&ts, arg2);
12132         if (!is_error(ret)) {
12133             ret = get_errno(clock_settime(arg1, &ts));
12134         }
12135         return ret;
12136     }
12137 #endif
12138 #ifdef TARGET_NR_clock_settime64
12139     case TARGET_NR_clock_settime64:
12140     {
12141         struct timespec ts;
12142 
12143         ret = target_to_host_timespec64(&ts, arg2);
12144         if (!is_error(ret)) {
12145             ret = get_errno(clock_settime(arg1, &ts));
12146         }
12147         return ret;
12148     }
12149 #endif
12150 #ifdef TARGET_NR_clock_gettime
12151     case TARGET_NR_clock_gettime:
12152     {
12153         struct timespec ts;
12154         ret = get_errno(clock_gettime(arg1, &ts));
12155         if (!is_error(ret)) {
12156             ret = host_to_target_timespec(arg2, &ts);
12157         }
12158         return ret;
12159     }
12160 #endif
12161 #ifdef TARGET_NR_clock_gettime64
12162     case TARGET_NR_clock_gettime64:
12163     {
12164         struct timespec ts;
12165         ret = get_errno(clock_gettime(arg1, &ts));
12166         if (!is_error(ret)) {
12167             ret = host_to_target_timespec64(arg2, &ts);
12168         }
12169         return ret;
12170     }
12171 #endif
12172 #ifdef TARGET_NR_clock_getres
12173     case TARGET_NR_clock_getres:
12174     {
12175         struct timespec ts;
12176         ret = get_errno(clock_getres(arg1, &ts));
12177         if (!is_error(ret)) {
12178             host_to_target_timespec(arg2, &ts);
12179         }
12180         return ret;
12181     }
12182 #endif
12183 #ifdef TARGET_NR_clock_getres_time64
12184     case TARGET_NR_clock_getres_time64:
12185     {
12186         struct timespec ts;
12187         ret = get_errno(clock_getres(arg1, &ts));
12188         if (!is_error(ret)) {
12189             host_to_target_timespec64(arg2, &ts);
12190         }
12191         return ret;
12192     }
12193 #endif
12194 #ifdef TARGET_NR_clock_nanosleep
12195     case TARGET_NR_clock_nanosleep:
12196     {
12197         struct timespec ts;
12198         if (target_to_host_timespec(&ts, arg3)) {
12199             return -TARGET_EFAULT;
12200         }
12201         ret = get_errno(safe_clock_nanosleep(arg1, arg2,
12202                                              &ts, arg4 ? &ts : NULL));
12203         /*
12204          * if the call is interrupted by a signal handler, it fails
12205          * with error -TARGET_EINTR and if arg4 is not NULL and arg2 is not
12206          * TIMER_ABSTIME, it returns the remaining unslept time in arg4.
12207          */
12208         if (ret == -TARGET_EINTR && arg4 && arg2 != TIMER_ABSTIME &&
12209             host_to_target_timespec(arg4, &ts)) {
12210               return -TARGET_EFAULT;
12211         }
12212 
12213         return ret;
12214     }
12215 #endif
12216 #ifdef TARGET_NR_clock_nanosleep_time64
12217     case TARGET_NR_clock_nanosleep_time64:
12218     {
12219         struct timespec ts;
12220 
12221         if (target_to_host_timespec64(&ts, arg3)) {
12222             return -TARGET_EFAULT;
12223         }
12224 
12225         ret = get_errno(safe_clock_nanosleep(arg1, arg2,
12226                                              &ts, arg4 ? &ts : NULL));
12227 
12228         if (ret == -TARGET_EINTR && arg4 && arg2 != TIMER_ABSTIME &&
12229             host_to_target_timespec64(arg4, &ts)) {
12230             return -TARGET_EFAULT;
12231         }
12232         return ret;
12233     }
12234 #endif
12235 
12236 #if defined(TARGET_NR_set_tid_address)
12237     case TARGET_NR_set_tid_address:
12238     {
12239         TaskState *ts = cpu->opaque;
12240         ts->child_tidptr = arg1;
12241         /* do not call host set_tid_address() syscall, instead return tid() */
12242         return get_errno(sys_gettid());
12243     }
12244 #endif
12245 
12246     case TARGET_NR_tkill:
12247         return get_errno(safe_tkill((int)arg1, target_to_host_signal(arg2)));
12248 
12249     case TARGET_NR_tgkill:
12250         return get_errno(safe_tgkill((int)arg1, (int)arg2,
12251                          target_to_host_signal(arg3)));
12252 
12253 #ifdef TARGET_NR_set_robust_list
12254     case TARGET_NR_set_robust_list:
12255     case TARGET_NR_get_robust_list:
12256         /* The ABI for supporting robust futexes has userspace pass
12257          * the kernel a pointer to a linked list which is updated by
12258          * userspace after the syscall; the list is walked by the kernel
12259          * when the thread exits. Since the linked list in QEMU guest
12260          * memory isn't a valid linked list for the host and we have
12261          * no way to reliably intercept the thread-death event, we can't
12262          * support these. Silently return ENOSYS so that guest userspace
12263          * falls back to a non-robust futex implementation (which should
12264          * be OK except in the corner case of the guest crashing while
12265          * holding a mutex that is shared with another process via
12266          * shared memory).
12267          */
12268         return -TARGET_ENOSYS;
12269 #endif
12270 
12271 #if defined(TARGET_NR_utimensat)
12272     case TARGET_NR_utimensat:
12273         {
12274             struct timespec *tsp, ts[2];
12275             if (!arg3) {
12276                 tsp = NULL;
12277             } else {
12278                 if (target_to_host_timespec(ts, arg3)) {
12279                     return -TARGET_EFAULT;
12280                 }
12281                 if (target_to_host_timespec(ts + 1, arg3 +
12282                                             sizeof(struct target_timespec))) {
12283                     return -TARGET_EFAULT;
12284                 }
12285                 tsp = ts;
12286             }
12287             if (!arg2)
12288                 ret = get_errno(sys_utimensat(arg1, NULL, tsp, arg4));
12289             else {
12290                 if (!(p = lock_user_string(arg2))) {
12291                     return -TARGET_EFAULT;
12292                 }
12293                 ret = get_errno(sys_utimensat(arg1, path(p), tsp, arg4));
12294                 unlock_user(p, arg2, 0);
12295             }
12296         }
12297         return ret;
12298 #endif
12299 #ifdef TARGET_NR_utimensat_time64
12300     case TARGET_NR_utimensat_time64:
12301         {
12302             struct timespec *tsp, ts[2];
12303             if (!arg3) {
12304                 tsp = NULL;
12305             } else {
12306                 if (target_to_host_timespec64(ts, arg3)) {
12307                     return -TARGET_EFAULT;
12308                 }
12309                 if (target_to_host_timespec64(ts + 1, arg3 +
12310                                      sizeof(struct target__kernel_timespec))) {
12311                     return -TARGET_EFAULT;
12312                 }
12313                 tsp = ts;
12314             }
12315             if (!arg2)
12316                 ret = get_errno(sys_utimensat(arg1, NULL, tsp, arg4));
12317             else {
12318                 p = lock_user_string(arg2);
12319                 if (!p) {
12320                     return -TARGET_EFAULT;
12321                 }
12322                 ret = get_errno(sys_utimensat(arg1, path(p), tsp, arg4));
12323                 unlock_user(p, arg2, 0);
12324             }
12325         }
12326         return ret;
12327 #endif
12328 #ifdef TARGET_NR_futex
12329     case TARGET_NR_futex:
12330         return do_futex(cpu, false, arg1, arg2, arg3, arg4, arg5, arg6);
12331 #endif
12332 #ifdef TARGET_NR_futex_time64
12333     case TARGET_NR_futex_time64:
12334         return do_futex(cpu, true, arg1, arg2, arg3, arg4, arg5, arg6);
12335 #endif
12336 #ifdef CONFIG_INOTIFY
12337 #if defined(TARGET_NR_inotify_init)
12338     case TARGET_NR_inotify_init:
12339         ret = get_errno(inotify_init());
12340         if (ret >= 0) {
12341             fd_trans_register(ret, &target_inotify_trans);
12342         }
12343         return ret;
12344 #endif
12345 #if defined(TARGET_NR_inotify_init1) && defined(CONFIG_INOTIFY1)
12346     case TARGET_NR_inotify_init1:
12347         ret = get_errno(inotify_init1(target_to_host_bitmask(arg1,
12348                                           fcntl_flags_tbl)));
12349         if (ret >= 0) {
12350             fd_trans_register(ret, &target_inotify_trans);
12351         }
12352         return ret;
12353 #endif
12354 #if defined(TARGET_NR_inotify_add_watch)
12355     case TARGET_NR_inotify_add_watch:
12356         p = lock_user_string(arg2);
12357         ret = get_errno(inotify_add_watch(arg1, path(p), arg3));
12358         unlock_user(p, arg2, 0);
12359         return ret;
12360 #endif
12361 #if defined(TARGET_NR_inotify_rm_watch)
12362     case TARGET_NR_inotify_rm_watch:
12363         return get_errno(inotify_rm_watch(arg1, arg2));
12364 #endif
12365 #endif
12366 
12367 #if defined(TARGET_NR_mq_open) && defined(__NR_mq_open)
12368     case TARGET_NR_mq_open:
12369         {
12370             struct mq_attr posix_mq_attr;
12371             struct mq_attr *pposix_mq_attr;
12372             int host_flags;
12373 
12374             host_flags = target_to_host_bitmask(arg2, fcntl_flags_tbl);
12375             pposix_mq_attr = NULL;
12376             if (arg4) {
12377                 if (copy_from_user_mq_attr(&posix_mq_attr, arg4) != 0) {
12378                     return -TARGET_EFAULT;
12379                 }
12380                 pposix_mq_attr = &posix_mq_attr;
12381             }
12382             p = lock_user_string(arg1 - 1);
12383             if (!p) {
12384                 return -TARGET_EFAULT;
12385             }
12386             ret = get_errno(mq_open(p, host_flags, arg3, pposix_mq_attr));
12387             unlock_user (p, arg1, 0);
12388         }
12389         return ret;
12390 
12391     case TARGET_NR_mq_unlink:
12392         p = lock_user_string(arg1 - 1);
12393         if (!p) {
12394             return -TARGET_EFAULT;
12395         }
12396         ret = get_errno(mq_unlink(p));
12397         unlock_user (p, arg1, 0);
12398         return ret;
12399 
12400 #ifdef TARGET_NR_mq_timedsend
12401     case TARGET_NR_mq_timedsend:
12402         {
12403             struct timespec ts;
12404 
12405             p = lock_user (VERIFY_READ, arg2, arg3, 1);
12406             if (arg5 != 0) {
12407                 if (target_to_host_timespec(&ts, arg5)) {
12408                     return -TARGET_EFAULT;
12409                 }
12410                 ret = get_errno(safe_mq_timedsend(arg1, p, arg3, arg4, &ts));
12411                 if (!is_error(ret) && host_to_target_timespec(arg5, &ts)) {
12412                     return -TARGET_EFAULT;
12413                 }
12414             } else {
12415                 ret = get_errno(safe_mq_timedsend(arg1, p, arg3, arg4, NULL));
12416             }
12417             unlock_user (p, arg2, arg3);
12418         }
12419         return ret;
12420 #endif
12421 #ifdef TARGET_NR_mq_timedsend_time64
12422     case TARGET_NR_mq_timedsend_time64:
12423         {
12424             struct timespec ts;
12425 
12426             p = lock_user(VERIFY_READ, arg2, arg3, 1);
12427             if (arg5 != 0) {
12428                 if (target_to_host_timespec64(&ts, arg5)) {
12429                     return -TARGET_EFAULT;
12430                 }
12431                 ret = get_errno(safe_mq_timedsend(arg1, p, arg3, arg4, &ts));
12432                 if (!is_error(ret) && host_to_target_timespec64(arg5, &ts)) {
12433                     return -TARGET_EFAULT;
12434                 }
12435             } else {
12436                 ret = get_errno(safe_mq_timedsend(arg1, p, arg3, arg4, NULL));
12437             }
12438             unlock_user(p, arg2, arg3);
12439         }
12440         return ret;
12441 #endif
12442 
12443 #ifdef TARGET_NR_mq_timedreceive
12444     case TARGET_NR_mq_timedreceive:
12445         {
12446             struct timespec ts;
12447             unsigned int prio;
12448 
12449             p = lock_user (VERIFY_READ, arg2, arg3, 1);
12450             if (arg5 != 0) {
12451                 if (target_to_host_timespec(&ts, arg5)) {
12452                     return -TARGET_EFAULT;
12453                 }
12454                 ret = get_errno(safe_mq_timedreceive(arg1, p, arg3,
12455                                                      &prio, &ts));
12456                 if (!is_error(ret) && host_to_target_timespec(arg5, &ts)) {
12457                     return -TARGET_EFAULT;
12458                 }
12459             } else {
12460                 ret = get_errno(safe_mq_timedreceive(arg1, p, arg3,
12461                                                      &prio, NULL));
12462             }
12463             unlock_user (p, arg2, arg3);
12464             if (arg4 != 0)
12465                 put_user_u32(prio, arg4);
12466         }
12467         return ret;
12468 #endif
12469 #ifdef TARGET_NR_mq_timedreceive_time64
12470     case TARGET_NR_mq_timedreceive_time64:
12471         {
12472             struct timespec ts;
12473             unsigned int prio;
12474 
12475             p = lock_user(VERIFY_READ, arg2, arg3, 1);
12476             if (arg5 != 0) {
12477                 if (target_to_host_timespec64(&ts, arg5)) {
12478                     return -TARGET_EFAULT;
12479                 }
12480                 ret = get_errno(safe_mq_timedreceive(arg1, p, arg3,
12481                                                      &prio, &ts));
12482                 if (!is_error(ret) && host_to_target_timespec64(arg5, &ts)) {
12483                     return -TARGET_EFAULT;
12484                 }
12485             } else {
12486                 ret = get_errno(safe_mq_timedreceive(arg1, p, arg3,
12487                                                      &prio, NULL));
12488             }
12489             unlock_user(p, arg2, arg3);
12490             if (arg4 != 0) {
12491                 put_user_u32(prio, arg4);
12492             }
12493         }
12494         return ret;
12495 #endif
12496 
12497     /* Not implemented for now... */
12498 /*     case TARGET_NR_mq_notify: */
12499 /*         break; */
12500 
12501     case TARGET_NR_mq_getsetattr:
12502         {
12503             struct mq_attr posix_mq_attr_in, posix_mq_attr_out;
12504             ret = 0;
12505             if (arg2 != 0) {
12506                 copy_from_user_mq_attr(&posix_mq_attr_in, arg2);
12507                 ret = get_errno(mq_setattr(arg1, &posix_mq_attr_in,
12508                                            &posix_mq_attr_out));
12509             } else if (arg3 != 0) {
12510                 ret = get_errno(mq_getattr(arg1, &posix_mq_attr_out));
12511             }
12512             if (ret == 0 && arg3 != 0) {
12513                 copy_to_user_mq_attr(arg3, &posix_mq_attr_out);
12514             }
12515         }
12516         return ret;
12517 #endif
12518 
12519 #ifdef CONFIG_SPLICE
12520 #ifdef TARGET_NR_tee
12521     case TARGET_NR_tee:
12522         {
12523             ret = get_errno(tee(arg1,arg2,arg3,arg4));
12524         }
12525         return ret;
12526 #endif
12527 #ifdef TARGET_NR_splice
12528     case TARGET_NR_splice:
12529         {
12530             loff_t loff_in, loff_out;
12531             loff_t *ploff_in = NULL, *ploff_out = NULL;
12532             if (arg2) {
12533                 if (get_user_u64(loff_in, arg2)) {
12534                     return -TARGET_EFAULT;
12535                 }
12536                 ploff_in = &loff_in;
12537             }
12538             if (arg4) {
12539                 if (get_user_u64(loff_out, arg4)) {
12540                     return -TARGET_EFAULT;
12541                 }
12542                 ploff_out = &loff_out;
12543             }
12544             ret = get_errno(splice(arg1, ploff_in, arg3, ploff_out, arg5, arg6));
12545             if (arg2) {
12546                 if (put_user_u64(loff_in, arg2)) {
12547                     return -TARGET_EFAULT;
12548                 }
12549             }
12550             if (arg4) {
12551                 if (put_user_u64(loff_out, arg4)) {
12552                     return -TARGET_EFAULT;
12553                 }
12554             }
12555         }
12556         return ret;
12557 #endif
12558 #ifdef TARGET_NR_vmsplice
12559 	case TARGET_NR_vmsplice:
12560         {
12561             struct iovec *vec = lock_iovec(VERIFY_READ, arg2, arg3, 1);
12562             if (vec != NULL) {
12563                 ret = get_errno(vmsplice(arg1, vec, arg3, arg4));
12564                 unlock_iovec(vec, arg2, arg3, 0);
12565             } else {
12566                 ret = -host_to_target_errno(errno);
12567             }
12568         }
12569         return ret;
12570 #endif
12571 #endif /* CONFIG_SPLICE */
12572 #ifdef CONFIG_EVENTFD
12573 #if defined(TARGET_NR_eventfd)
12574     case TARGET_NR_eventfd:
12575         ret = get_errno(eventfd(arg1, 0));
12576         if (ret >= 0) {
12577             fd_trans_register(ret, &target_eventfd_trans);
12578         }
12579         return ret;
12580 #endif
12581 #if defined(TARGET_NR_eventfd2)
12582     case TARGET_NR_eventfd2:
12583     {
12584         int host_flags = arg2 & (~(TARGET_O_NONBLOCK_MASK | TARGET_O_CLOEXEC));
12585         if (arg2 & TARGET_O_NONBLOCK) {
12586             host_flags |= O_NONBLOCK;
12587         }
12588         if (arg2 & TARGET_O_CLOEXEC) {
12589             host_flags |= O_CLOEXEC;
12590         }
12591         ret = get_errno(eventfd(arg1, host_flags));
12592         if (ret >= 0) {
12593             fd_trans_register(ret, &target_eventfd_trans);
12594         }
12595         return ret;
12596     }
12597 #endif
12598 #endif /* CONFIG_EVENTFD  */
12599 #if defined(CONFIG_FALLOCATE) && defined(TARGET_NR_fallocate)
12600     case TARGET_NR_fallocate:
12601 #if TARGET_ABI_BITS == 32
12602         ret = get_errno(fallocate(arg1, arg2, target_offset64(arg3, arg4),
12603                                   target_offset64(arg5, arg6)));
12604 #else
12605         ret = get_errno(fallocate(arg1, arg2, arg3, arg4));
12606 #endif
12607         return ret;
12608 #endif
12609 #if defined(CONFIG_SYNC_FILE_RANGE)
12610 #if defined(TARGET_NR_sync_file_range)
12611     case TARGET_NR_sync_file_range:
12612 #if TARGET_ABI_BITS == 32
12613 #if defined(TARGET_MIPS)
12614         ret = get_errno(sync_file_range(arg1, target_offset64(arg3, arg4),
12615                                         target_offset64(arg5, arg6), arg7));
12616 #else
12617         ret = get_errno(sync_file_range(arg1, target_offset64(arg2, arg3),
12618                                         target_offset64(arg4, arg5), arg6));
12619 #endif /* !TARGET_MIPS */
12620 #else
12621         ret = get_errno(sync_file_range(arg1, arg2, arg3, arg4));
12622 #endif
12623         return ret;
12624 #endif
12625 #if defined(TARGET_NR_sync_file_range2) || \
12626     defined(TARGET_NR_arm_sync_file_range)
12627 #if defined(TARGET_NR_sync_file_range2)
12628     case TARGET_NR_sync_file_range2:
12629 #endif
12630 #if defined(TARGET_NR_arm_sync_file_range)
12631     case TARGET_NR_arm_sync_file_range:
12632 #endif
12633         /* This is like sync_file_range but the arguments are reordered */
12634 #if TARGET_ABI_BITS == 32
12635         ret = get_errno(sync_file_range(arg1, target_offset64(arg3, arg4),
12636                                         target_offset64(arg5, arg6), arg2));
12637 #else
12638         ret = get_errno(sync_file_range(arg1, arg3, arg4, arg2));
12639 #endif
12640         return ret;
12641 #endif
12642 #endif
12643 #if defined(TARGET_NR_signalfd4)
12644     case TARGET_NR_signalfd4:
12645         return do_signalfd4(arg1, arg2, arg4);
12646 #endif
12647 #if defined(TARGET_NR_signalfd)
12648     case TARGET_NR_signalfd:
12649         return do_signalfd4(arg1, arg2, 0);
12650 #endif
12651 #if defined(CONFIG_EPOLL)
12652 #if defined(TARGET_NR_epoll_create)
12653     case TARGET_NR_epoll_create:
12654         return get_errno(epoll_create(arg1));
12655 #endif
12656 #if defined(TARGET_NR_epoll_create1) && defined(CONFIG_EPOLL_CREATE1)
12657     case TARGET_NR_epoll_create1:
12658         return get_errno(epoll_create1(target_to_host_bitmask(arg1, fcntl_flags_tbl)));
12659 #endif
12660 #if defined(TARGET_NR_epoll_ctl)
12661     case TARGET_NR_epoll_ctl:
12662     {
12663         struct epoll_event ep;
12664         struct epoll_event *epp = 0;
12665         if (arg4) {
12666             if (arg2 != EPOLL_CTL_DEL) {
12667                 struct target_epoll_event *target_ep;
12668                 if (!lock_user_struct(VERIFY_READ, target_ep, arg4, 1)) {
12669                     return -TARGET_EFAULT;
12670                 }
12671                 ep.events = tswap32(target_ep->events);
12672                 /*
12673                  * The epoll_data_t union is just opaque data to the kernel,
12674                  * so we transfer all 64 bits across and need not worry what
12675                  * actual data type it is.
12676                  */
12677                 ep.data.u64 = tswap64(target_ep->data.u64);
12678                 unlock_user_struct(target_ep, arg4, 0);
12679             }
12680             /*
12681              * before kernel 2.6.9, EPOLL_CTL_DEL operation required a
12682              * non-null pointer, even though this argument is ignored.
12683              *
12684              */
12685             epp = &ep;
12686         }
12687         return get_errno(epoll_ctl(arg1, arg2, arg3, epp));
12688     }
12689 #endif
12690 
12691 #if defined(TARGET_NR_epoll_wait) || defined(TARGET_NR_epoll_pwait)
12692 #if defined(TARGET_NR_epoll_wait)
12693     case TARGET_NR_epoll_wait:
12694 #endif
12695 #if defined(TARGET_NR_epoll_pwait)
12696     case TARGET_NR_epoll_pwait:
12697 #endif
12698     {
12699         struct target_epoll_event *target_ep;
12700         struct epoll_event *ep;
12701         int epfd = arg1;
12702         int maxevents = arg3;
12703         int timeout = arg4;
12704 
12705         if (maxevents <= 0 || maxevents > TARGET_EP_MAX_EVENTS) {
12706             return -TARGET_EINVAL;
12707         }
12708 
12709         target_ep = lock_user(VERIFY_WRITE, arg2,
12710                               maxevents * sizeof(struct target_epoll_event), 1);
12711         if (!target_ep) {
12712             return -TARGET_EFAULT;
12713         }
12714 
12715         ep = g_try_new(struct epoll_event, maxevents);
12716         if (!ep) {
12717             unlock_user(target_ep, arg2, 0);
12718             return -TARGET_ENOMEM;
12719         }
12720 
12721         switch (num) {
12722 #if defined(TARGET_NR_epoll_pwait)
12723         case TARGET_NR_epoll_pwait:
12724         {
12725             sigset_t *set = NULL;
12726 
12727             if (arg5) {
12728                 ret = process_sigsuspend_mask(&set, arg5, arg6);
12729                 if (ret != 0) {
12730                     break;
12731                 }
12732             }
12733 
12734             ret = get_errno(safe_epoll_pwait(epfd, ep, maxevents, timeout,
12735                                              set, SIGSET_T_SIZE));
12736 
12737             if (set) {
12738                 finish_sigsuspend_mask(ret);
12739             }
12740             break;
12741         }
12742 #endif
12743 #if defined(TARGET_NR_epoll_wait)
12744         case TARGET_NR_epoll_wait:
12745             ret = get_errno(safe_epoll_pwait(epfd, ep, maxevents, timeout,
12746                                              NULL, 0));
12747             break;
12748 #endif
12749         default:
12750             ret = -TARGET_ENOSYS;
12751         }
12752         if (!is_error(ret)) {
12753             int i;
12754             for (i = 0; i < ret; i++) {
12755                 target_ep[i].events = tswap32(ep[i].events);
12756                 target_ep[i].data.u64 = tswap64(ep[i].data.u64);
12757             }
12758             unlock_user(target_ep, arg2,
12759                         ret * sizeof(struct target_epoll_event));
12760         } else {
12761             unlock_user(target_ep, arg2, 0);
12762         }
12763         g_free(ep);
12764         return ret;
12765     }
12766 #endif
12767 #endif
12768 #ifdef TARGET_NR_prlimit64
12769     case TARGET_NR_prlimit64:
12770     {
12771         /* args: pid, resource number, ptr to new rlimit, ptr to old rlimit */
12772         struct target_rlimit64 *target_rnew, *target_rold;
12773         struct host_rlimit64 rnew, rold, *rnewp = 0;
12774         int resource = target_to_host_resource(arg2);
12775 
12776         if (arg3 && (resource != RLIMIT_AS &&
12777                      resource != RLIMIT_DATA &&
12778                      resource != RLIMIT_STACK)) {
12779             if (!lock_user_struct(VERIFY_READ, target_rnew, arg3, 1)) {
12780                 return -TARGET_EFAULT;
12781             }
12782             rnew.rlim_cur = tswap64(target_rnew->rlim_cur);
12783             rnew.rlim_max = tswap64(target_rnew->rlim_max);
12784             unlock_user_struct(target_rnew, arg3, 0);
12785             rnewp = &rnew;
12786         }
12787 
12788         ret = get_errno(sys_prlimit64(arg1, resource, rnewp, arg4 ? &rold : 0));
12789         if (!is_error(ret) && arg4) {
12790             if (!lock_user_struct(VERIFY_WRITE, target_rold, arg4, 1)) {
12791                 return -TARGET_EFAULT;
12792             }
12793             target_rold->rlim_cur = tswap64(rold.rlim_cur);
12794             target_rold->rlim_max = tswap64(rold.rlim_max);
12795             unlock_user_struct(target_rold, arg4, 1);
12796         }
12797         return ret;
12798     }
12799 #endif
12800 #ifdef TARGET_NR_gethostname
12801     case TARGET_NR_gethostname:
12802     {
12803         char *name = lock_user(VERIFY_WRITE, arg1, arg2, 0);
12804         if (name) {
12805             ret = get_errno(gethostname(name, arg2));
12806             unlock_user(name, arg1, arg2);
12807         } else {
12808             ret = -TARGET_EFAULT;
12809         }
12810         return ret;
12811     }
12812 #endif
12813 #ifdef TARGET_NR_atomic_cmpxchg_32
12814     case TARGET_NR_atomic_cmpxchg_32:
12815     {
12816         /* should use start_exclusive from main.c */
12817         abi_ulong mem_value;
12818         if (get_user_u32(mem_value, arg6)) {
12819             target_siginfo_t info;
12820             info.si_signo = SIGSEGV;
12821             info.si_errno = 0;
12822             info.si_code = TARGET_SEGV_MAPERR;
12823             info._sifields._sigfault._addr = arg6;
12824             queue_signal(cpu_env, info.si_signo, QEMU_SI_FAULT, &info);
12825             ret = 0xdeadbeef;
12826 
12827         }
12828         if (mem_value == arg2)
12829             put_user_u32(arg1, arg6);
12830         return mem_value;
12831     }
12832 #endif
12833 #ifdef TARGET_NR_atomic_barrier
12834     case TARGET_NR_atomic_barrier:
12835         /* Like the kernel implementation and the
12836            qemu arm barrier, no-op this? */
12837         return 0;
12838 #endif
12839 
12840 #ifdef TARGET_NR_timer_create
12841     case TARGET_NR_timer_create:
12842     {
12843         /* args: clockid_t clockid, struct sigevent *sevp, timer_t *timerid */
12844 
12845         struct sigevent host_sevp = { {0}, }, *phost_sevp = NULL;
12846 
12847         int clkid = arg1;
12848         int timer_index = next_free_host_timer();
12849 
12850         if (timer_index < 0) {
12851             ret = -TARGET_EAGAIN;
12852         } else {
12853             timer_t *phtimer = g_posix_timers  + timer_index;
12854 
12855             if (arg2) {
12856                 phost_sevp = &host_sevp;
12857                 ret = target_to_host_sigevent(phost_sevp, arg2);
12858                 if (ret != 0) {
12859                     free_host_timer_slot(timer_index);
12860                     return ret;
12861                 }
12862             }
12863 
12864             ret = get_errno(timer_create(clkid, phost_sevp, phtimer));
12865             if (ret) {
12866                 free_host_timer_slot(timer_index);
12867             } else {
12868                 if (put_user(TIMER_MAGIC | timer_index, arg3, target_timer_t)) {
12869                     timer_delete(*phtimer);
12870                     free_host_timer_slot(timer_index);
12871                     return -TARGET_EFAULT;
12872                 }
12873             }
12874         }
12875         return ret;
12876     }
12877 #endif
12878 
12879 #ifdef TARGET_NR_timer_settime
12880     case TARGET_NR_timer_settime:
12881     {
12882         /* args: timer_t timerid, int flags, const struct itimerspec *new_value,
12883          * struct itimerspec * old_value */
12884         target_timer_t timerid = get_timer_id(arg1);
12885 
12886         if (timerid < 0) {
12887             ret = timerid;
12888         } else if (arg3 == 0) {
12889             ret = -TARGET_EINVAL;
12890         } else {
12891             timer_t htimer = g_posix_timers[timerid];
12892             struct itimerspec hspec_new = {{0},}, hspec_old = {{0},};
12893 
12894             if (target_to_host_itimerspec(&hspec_new, arg3)) {
12895                 return -TARGET_EFAULT;
12896             }
12897             ret = get_errno(
12898                           timer_settime(htimer, arg2, &hspec_new, &hspec_old));
12899             if (arg4 && host_to_target_itimerspec(arg4, &hspec_old)) {
12900                 return -TARGET_EFAULT;
12901             }
12902         }
12903         return ret;
12904     }
12905 #endif
12906 
12907 #ifdef TARGET_NR_timer_settime64
12908     case TARGET_NR_timer_settime64:
12909     {
12910         target_timer_t timerid = get_timer_id(arg1);
12911 
12912         if (timerid < 0) {
12913             ret = timerid;
12914         } else if (arg3 == 0) {
12915             ret = -TARGET_EINVAL;
12916         } else {
12917             timer_t htimer = g_posix_timers[timerid];
12918             struct itimerspec hspec_new = {{0},}, hspec_old = {{0},};
12919 
12920             if (target_to_host_itimerspec64(&hspec_new, arg3)) {
12921                 return -TARGET_EFAULT;
12922             }
12923             ret = get_errno(
12924                           timer_settime(htimer, arg2, &hspec_new, &hspec_old));
12925             if (arg4 && host_to_target_itimerspec64(arg4, &hspec_old)) {
12926                 return -TARGET_EFAULT;
12927             }
12928         }
12929         return ret;
12930     }
12931 #endif
12932 
12933 #ifdef TARGET_NR_timer_gettime
12934     case TARGET_NR_timer_gettime:
12935     {
12936         /* args: timer_t timerid, struct itimerspec *curr_value */
12937         target_timer_t timerid = get_timer_id(arg1);
12938 
12939         if (timerid < 0) {
12940             ret = timerid;
12941         } else if (!arg2) {
12942             ret = -TARGET_EFAULT;
12943         } else {
12944             timer_t htimer = g_posix_timers[timerid];
12945             struct itimerspec hspec;
12946             ret = get_errno(timer_gettime(htimer, &hspec));
12947 
12948             if (host_to_target_itimerspec(arg2, &hspec)) {
12949                 ret = -TARGET_EFAULT;
12950             }
12951         }
12952         return ret;
12953     }
12954 #endif
12955 
12956 #ifdef TARGET_NR_timer_gettime64
12957     case TARGET_NR_timer_gettime64:
12958     {
12959         /* args: timer_t timerid, struct itimerspec64 *curr_value */
12960         target_timer_t timerid = get_timer_id(arg1);
12961 
12962         if (timerid < 0) {
12963             ret = timerid;
12964         } else if (!arg2) {
12965             ret = -TARGET_EFAULT;
12966         } else {
12967             timer_t htimer = g_posix_timers[timerid];
12968             struct itimerspec hspec;
12969             ret = get_errno(timer_gettime(htimer, &hspec));
12970 
12971             if (host_to_target_itimerspec64(arg2, &hspec)) {
12972                 ret = -TARGET_EFAULT;
12973             }
12974         }
12975         return ret;
12976     }
12977 #endif
12978 
12979 #ifdef TARGET_NR_timer_getoverrun
12980     case TARGET_NR_timer_getoverrun:
12981     {
12982         /* args: timer_t timerid */
12983         target_timer_t timerid = get_timer_id(arg1);
12984 
12985         if (timerid < 0) {
12986             ret = timerid;
12987         } else {
12988             timer_t htimer = g_posix_timers[timerid];
12989             ret = get_errno(timer_getoverrun(htimer));
12990         }
12991         return ret;
12992     }
12993 #endif
12994 
12995 #ifdef TARGET_NR_timer_delete
12996     case TARGET_NR_timer_delete:
12997     {
12998         /* args: timer_t timerid */
12999         target_timer_t timerid = get_timer_id(arg1);
13000 
13001         if (timerid < 0) {
13002             ret = timerid;
13003         } else {
13004             timer_t htimer = g_posix_timers[timerid];
13005             ret = get_errno(timer_delete(htimer));
13006             free_host_timer_slot(timerid);
13007         }
13008         return ret;
13009     }
13010 #endif
13011 
13012 #if defined(TARGET_NR_timerfd_create) && defined(CONFIG_TIMERFD)
13013     case TARGET_NR_timerfd_create:
13014         return get_errno(timerfd_create(arg1,
13015                           target_to_host_bitmask(arg2, fcntl_flags_tbl)));
13016 #endif
13017 
13018 #if defined(TARGET_NR_timerfd_gettime) && defined(CONFIG_TIMERFD)
13019     case TARGET_NR_timerfd_gettime:
13020         {
13021             struct itimerspec its_curr;
13022 
13023             ret = get_errno(timerfd_gettime(arg1, &its_curr));
13024 
13025             if (arg2 && host_to_target_itimerspec(arg2, &its_curr)) {
13026                 return -TARGET_EFAULT;
13027             }
13028         }
13029         return ret;
13030 #endif
13031 
13032 #if defined(TARGET_NR_timerfd_gettime64) && defined(CONFIG_TIMERFD)
13033     case TARGET_NR_timerfd_gettime64:
13034         {
13035             struct itimerspec its_curr;
13036 
13037             ret = get_errno(timerfd_gettime(arg1, &its_curr));
13038 
13039             if (arg2 && host_to_target_itimerspec64(arg2, &its_curr)) {
13040                 return -TARGET_EFAULT;
13041             }
13042         }
13043         return ret;
13044 #endif
13045 
13046 #if defined(TARGET_NR_timerfd_settime) && defined(CONFIG_TIMERFD)
13047     case TARGET_NR_timerfd_settime:
13048         {
13049             struct itimerspec its_new, its_old, *p_new;
13050 
13051             if (arg3) {
13052                 if (target_to_host_itimerspec(&its_new, arg3)) {
13053                     return -TARGET_EFAULT;
13054                 }
13055                 p_new = &its_new;
13056             } else {
13057                 p_new = NULL;
13058             }
13059 
13060             ret = get_errno(timerfd_settime(arg1, arg2, p_new, &its_old));
13061 
13062             if (arg4 && host_to_target_itimerspec(arg4, &its_old)) {
13063                 return -TARGET_EFAULT;
13064             }
13065         }
13066         return ret;
13067 #endif
13068 
13069 #if defined(TARGET_NR_timerfd_settime64) && defined(CONFIG_TIMERFD)
13070     case TARGET_NR_timerfd_settime64:
13071         {
13072             struct itimerspec its_new, its_old, *p_new;
13073 
13074             if (arg3) {
13075                 if (target_to_host_itimerspec64(&its_new, arg3)) {
13076                     return -TARGET_EFAULT;
13077                 }
13078                 p_new = &its_new;
13079             } else {
13080                 p_new = NULL;
13081             }
13082 
13083             ret = get_errno(timerfd_settime(arg1, arg2, p_new, &its_old));
13084 
13085             if (arg4 && host_to_target_itimerspec64(arg4, &its_old)) {
13086                 return -TARGET_EFAULT;
13087             }
13088         }
13089         return ret;
13090 #endif
13091 
13092 #if defined(TARGET_NR_ioprio_get) && defined(__NR_ioprio_get)
13093     case TARGET_NR_ioprio_get:
13094         return get_errno(ioprio_get(arg1, arg2));
13095 #endif
13096 
13097 #if defined(TARGET_NR_ioprio_set) && defined(__NR_ioprio_set)
13098     case TARGET_NR_ioprio_set:
13099         return get_errno(ioprio_set(arg1, arg2, arg3));
13100 #endif
13101 
13102 #if defined(TARGET_NR_setns) && defined(CONFIG_SETNS)
13103     case TARGET_NR_setns:
13104         return get_errno(setns(arg1, arg2));
13105 #endif
13106 #if defined(TARGET_NR_unshare) && defined(CONFIG_SETNS)
13107     case TARGET_NR_unshare:
13108         return get_errno(unshare(arg1));
13109 #endif
13110 #if defined(TARGET_NR_kcmp) && defined(__NR_kcmp)
13111     case TARGET_NR_kcmp:
13112         return get_errno(kcmp(arg1, arg2, arg3, arg4, arg5));
13113 #endif
13114 #ifdef TARGET_NR_swapcontext
13115     case TARGET_NR_swapcontext:
13116         /* PowerPC specific.  */
13117         return do_swapcontext(cpu_env, arg1, arg2, arg3);
13118 #endif
13119 #ifdef TARGET_NR_memfd_create
13120     case TARGET_NR_memfd_create:
13121         p = lock_user_string(arg1);
13122         if (!p) {
13123             return -TARGET_EFAULT;
13124         }
13125         ret = get_errno(memfd_create(p, arg2));
13126         fd_trans_unregister(ret);
13127         unlock_user(p, arg1, 0);
13128         return ret;
13129 #endif
13130 #if defined TARGET_NR_membarrier && defined __NR_membarrier
13131     case TARGET_NR_membarrier:
13132         return get_errno(membarrier(arg1, arg2));
13133 #endif
13134 
13135 #if defined(TARGET_NR_copy_file_range) && defined(__NR_copy_file_range)
13136     case TARGET_NR_copy_file_range:
13137         {
13138             loff_t inoff, outoff;
13139             loff_t *pinoff = NULL, *poutoff = NULL;
13140 
13141             if (arg2) {
13142                 if (get_user_u64(inoff, arg2)) {
13143                     return -TARGET_EFAULT;
13144                 }
13145                 pinoff = &inoff;
13146             }
13147             if (arg4) {
13148                 if (get_user_u64(outoff, arg4)) {
13149                     return -TARGET_EFAULT;
13150                 }
13151                 poutoff = &outoff;
13152             }
13153             /* Do not sign-extend the count parameter. */
13154             ret = get_errno(safe_copy_file_range(arg1, pinoff, arg3, poutoff,
13155                                                  (abi_ulong)arg5, arg6));
13156             if (!is_error(ret) && ret > 0) {
13157                 if (arg2) {
13158                     if (put_user_u64(inoff, arg2)) {
13159                         return -TARGET_EFAULT;
13160                     }
13161                 }
13162                 if (arg4) {
13163                     if (put_user_u64(outoff, arg4)) {
13164                         return -TARGET_EFAULT;
13165                     }
13166                 }
13167             }
13168         }
13169         return ret;
13170 #endif
13171 
13172 #if defined(TARGET_NR_pivot_root)
13173     case TARGET_NR_pivot_root:
13174         {
13175             void *p2;
13176             p = lock_user_string(arg1); /* new_root */
13177             p2 = lock_user_string(arg2); /* put_old */
13178             if (!p || !p2) {
13179                 ret = -TARGET_EFAULT;
13180             } else {
13181                 ret = get_errno(pivot_root(p, p2));
13182             }
13183             unlock_user(p2, arg2, 0);
13184             unlock_user(p, arg1, 0);
13185         }
13186         return ret;
13187 #endif
13188 
13189     default:
13190         qemu_log_mask(LOG_UNIMP, "Unsupported syscall: %d\n", num);
13191         return -TARGET_ENOSYS;
13192     }
13193     return ret;
13194 }
13195 
13196 abi_long do_syscall(CPUArchState *cpu_env, int num, abi_long arg1,
13197                     abi_long arg2, abi_long arg3, abi_long arg4,
13198                     abi_long arg5, abi_long arg6, abi_long arg7,
13199                     abi_long arg8)
13200 {
13201     CPUState *cpu = env_cpu(cpu_env);
13202     abi_long ret;
13203 
13204 #ifdef DEBUG_ERESTARTSYS
13205     /* Debug-only code for exercising the syscall-restart code paths
13206      * in the per-architecture cpu main loops: restart every syscall
13207      * the guest makes once before letting it through.
13208      */
13209     {
13210         static bool flag;
13211         flag = !flag;
13212         if (flag) {
13213             return -QEMU_ERESTARTSYS;
13214         }
13215     }
13216 #endif
13217 
13218     record_syscall_start(cpu, num, arg1,
13219                          arg2, arg3, arg4, arg5, arg6, arg7, arg8);
13220 
13221     if (unlikely(qemu_loglevel_mask(LOG_STRACE))) {
13222         print_syscall(cpu_env, num, arg1, arg2, arg3, arg4, arg5, arg6);
13223     }
13224 
13225     ret = do_syscall1(cpu_env, num, arg1, arg2, arg3, arg4,
13226                       arg5, arg6, arg7, arg8);
13227 
13228     if (unlikely(qemu_loglevel_mask(LOG_STRACE))) {
13229         print_syscall_ret(cpu_env, num, ret, arg1, arg2,
13230                           arg3, arg4, arg5, arg6);
13231     }
13232 
13233     record_syscall_return(cpu, num, ret);
13234     return ret;
13235 }
13236