xref: /openbmc/qemu/linux-user/syscall.c (revision 30ab9ef2)
1 /*
2  *  Linux syscalls
3  *
4  *  Copyright (c) 2003 Fabrice Bellard
5  *
6  *  This program is free software; you can redistribute it and/or modify
7  *  it under the terms of the GNU General Public License as published by
8  *  the Free Software Foundation; either version 2 of the License, or
9  *  (at your option) any later version.
10  *
11  *  This program is distributed in the hope that it will be useful,
12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14  *  GNU General Public License for more details.
15  *
16  *  You should have received a copy of the GNU General Public License
17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
18  */
19 #define _ATFILE_SOURCE
20 #include "qemu/osdep.h"
21 #include "qemu/cutils.h"
22 #include "qemu/path.h"
23 #include <elf.h>
24 #include <endian.h>
25 #include <grp.h>
26 #include <sys/ipc.h>
27 #include <sys/msg.h>
28 #include <sys/wait.h>
29 #include <sys/mount.h>
30 #include <sys/file.h>
31 #include <sys/fsuid.h>
32 #include <sys/personality.h>
33 #include <sys/prctl.h>
34 #include <sys/resource.h>
35 #include <sys/swap.h>
36 #include <linux/capability.h>
37 #include <sched.h>
38 #include <sys/timex.h>
39 #include <sys/socket.h>
40 #include <sys/un.h>
41 #include <sys/uio.h>
42 #include <poll.h>
43 #include <sys/times.h>
44 #include <sys/shm.h>
45 #include <sys/sem.h>
46 #include <sys/statfs.h>
47 #include <utime.h>
48 #include <sys/sysinfo.h>
49 #include <sys/signalfd.h>
50 //#include <sys/user.h>
51 #include <netinet/ip.h>
52 #include <netinet/tcp.h>
53 #include <linux/wireless.h>
54 #include <linux/icmp.h>
55 #include <linux/icmpv6.h>
56 #include <linux/errqueue.h>
57 #include <linux/random.h>
58 #include "qemu-common.h"
59 #ifdef CONFIG_TIMERFD
60 #include <sys/timerfd.h>
61 #endif
62 #ifdef CONFIG_EVENTFD
63 #include <sys/eventfd.h>
64 #endif
65 #ifdef CONFIG_EPOLL
66 #include <sys/epoll.h>
67 #endif
68 #ifdef CONFIG_ATTR
69 #include "qemu/xattr.h"
70 #endif
71 #ifdef CONFIG_SENDFILE
72 #include <sys/sendfile.h>
73 #endif
74 
75 #define termios host_termios
76 #define winsize host_winsize
77 #define termio host_termio
78 #define sgttyb host_sgttyb /* same as target */
79 #define tchars host_tchars /* same as target */
80 #define ltchars host_ltchars /* same as target */
81 
82 #include <linux/termios.h>
83 #include <linux/unistd.h>
84 #include <linux/cdrom.h>
85 #include <linux/hdreg.h>
86 #include <linux/soundcard.h>
87 #include <linux/kd.h>
88 #include <linux/mtio.h>
89 #include <linux/fs.h>
90 #if defined(CONFIG_FIEMAP)
91 #include <linux/fiemap.h>
92 #endif
93 #include <linux/fb.h>
94 #if defined(CONFIG_USBFS)
95 #include <linux/usbdevice_fs.h>
96 #include <linux/usb/ch9.h>
97 #endif
98 #include <linux/vt.h>
99 #include <linux/dm-ioctl.h>
100 #include <linux/reboot.h>
101 #include <linux/route.h>
102 #include <linux/filter.h>
103 #include <linux/blkpg.h>
104 #include <netpacket/packet.h>
105 #include <linux/netlink.h>
106 #include "linux_loop.h"
107 #include "uname.h"
108 
109 #include "qemu.h"
110 #include "fd-trans.h"
111 
112 #ifndef CLONE_IO
113 #define CLONE_IO                0x80000000      /* Clone io context */
114 #endif
115 
116 /* We can't directly call the host clone syscall, because this will
117  * badly confuse libc (breaking mutexes, for example). So we must
118  * divide clone flags into:
119  *  * flag combinations that look like pthread_create()
120  *  * flag combinations that look like fork()
121  *  * flags we can implement within QEMU itself
122  *  * flags we can't support and will return an error for
123  */
124 /* For thread creation, all these flags must be present; for
125  * fork, none must be present.
126  */
127 #define CLONE_THREAD_FLAGS                              \
128     (CLONE_VM | CLONE_FS | CLONE_FILES |                \
129      CLONE_SIGHAND | CLONE_THREAD | CLONE_SYSVSEM)
130 
131 /* These flags are ignored:
132  * CLONE_DETACHED is now ignored by the kernel;
133  * CLONE_IO is just an optimisation hint to the I/O scheduler
134  */
135 #define CLONE_IGNORED_FLAGS                     \
136     (CLONE_DETACHED | CLONE_IO)
137 
138 /* Flags for fork which we can implement within QEMU itself */
139 #define CLONE_OPTIONAL_FORK_FLAGS               \
140     (CLONE_SETTLS | CLONE_PARENT_SETTID |       \
141      CLONE_CHILD_CLEARTID | CLONE_CHILD_SETTID)
142 
143 /* Flags for thread creation which we can implement within QEMU itself */
144 #define CLONE_OPTIONAL_THREAD_FLAGS                             \
145     (CLONE_SETTLS | CLONE_PARENT_SETTID |                       \
146      CLONE_CHILD_CLEARTID | CLONE_CHILD_SETTID | CLONE_PARENT)
147 
148 #define CLONE_INVALID_FORK_FLAGS                                        \
149     (~(CSIGNAL | CLONE_OPTIONAL_FORK_FLAGS | CLONE_IGNORED_FLAGS))
150 
151 #define CLONE_INVALID_THREAD_FLAGS                                      \
152     (~(CSIGNAL | CLONE_THREAD_FLAGS | CLONE_OPTIONAL_THREAD_FLAGS |     \
153        CLONE_IGNORED_FLAGS))
154 
155 /* CLONE_VFORK is special cased early in do_fork(). The other flag bits
156  * have almost all been allocated. We cannot support any of
157  * CLONE_NEWNS, CLONE_NEWCGROUP, CLONE_NEWUTS, CLONE_NEWIPC,
158  * CLONE_NEWUSER, CLONE_NEWPID, CLONE_NEWNET, CLONE_PTRACE, CLONE_UNTRACED.
159  * The checks against the invalid thread masks above will catch these.
160  * (The one remaining unallocated bit is 0x1000 which used to be CLONE_PID.)
161  */
162 
163 /* Define DEBUG_ERESTARTSYS to force every syscall to be restarted
164  * once. This exercises the codepaths for restart.
165  */
166 //#define DEBUG_ERESTARTSYS
167 
168 //#include <linux/msdos_fs.h>
169 #define	VFAT_IOCTL_READDIR_BOTH		_IOR('r', 1, struct linux_dirent [2])
170 #define	VFAT_IOCTL_READDIR_SHORT	_IOR('r', 2, struct linux_dirent [2])
171 
172 #undef _syscall0
173 #undef _syscall1
174 #undef _syscall2
175 #undef _syscall3
176 #undef _syscall4
177 #undef _syscall5
178 #undef _syscall6
179 
180 #define _syscall0(type,name)		\
181 static type name (void)			\
182 {					\
183 	return syscall(__NR_##name);	\
184 }
185 
186 #define _syscall1(type,name,type1,arg1)		\
187 static type name (type1 arg1)			\
188 {						\
189 	return syscall(__NR_##name, arg1);	\
190 }
191 
192 #define _syscall2(type,name,type1,arg1,type2,arg2)	\
193 static type name (type1 arg1,type2 arg2)		\
194 {							\
195 	return syscall(__NR_##name, arg1, arg2);	\
196 }
197 
198 #define _syscall3(type,name,type1,arg1,type2,arg2,type3,arg3)	\
199 static type name (type1 arg1,type2 arg2,type3 arg3)		\
200 {								\
201 	return syscall(__NR_##name, arg1, arg2, arg3);		\
202 }
203 
204 #define _syscall4(type,name,type1,arg1,type2,arg2,type3,arg3,type4,arg4)	\
205 static type name (type1 arg1,type2 arg2,type3 arg3,type4 arg4)			\
206 {										\
207 	return syscall(__NR_##name, arg1, arg2, arg3, arg4);			\
208 }
209 
210 #define _syscall5(type,name,type1,arg1,type2,arg2,type3,arg3,type4,arg4,	\
211 		  type5,arg5)							\
212 static type name (type1 arg1,type2 arg2,type3 arg3,type4 arg4,type5 arg5)	\
213 {										\
214 	return syscall(__NR_##name, arg1, arg2, arg3, arg4, arg5);		\
215 }
216 
217 
218 #define _syscall6(type,name,type1,arg1,type2,arg2,type3,arg3,type4,arg4,	\
219 		  type5,arg5,type6,arg6)					\
220 static type name (type1 arg1,type2 arg2,type3 arg3,type4 arg4,type5 arg5,	\
221                   type6 arg6)							\
222 {										\
223 	return syscall(__NR_##name, arg1, arg2, arg3, arg4, arg5, arg6);	\
224 }
225 
226 
227 #define __NR_sys_uname __NR_uname
228 #define __NR_sys_getcwd1 __NR_getcwd
229 #define __NR_sys_getdents __NR_getdents
230 #define __NR_sys_getdents64 __NR_getdents64
231 #define __NR_sys_getpriority __NR_getpriority
232 #define __NR_sys_rt_sigqueueinfo __NR_rt_sigqueueinfo
233 #define __NR_sys_rt_tgsigqueueinfo __NR_rt_tgsigqueueinfo
234 #define __NR_sys_syslog __NR_syslog
235 #define __NR_sys_futex __NR_futex
236 #define __NR_sys_inotify_init __NR_inotify_init
237 #define __NR_sys_inotify_add_watch __NR_inotify_add_watch
238 #define __NR_sys_inotify_rm_watch __NR_inotify_rm_watch
239 
240 #if defined(__alpha__) || defined(__x86_64__) || defined(__s390x__)
241 #define __NR__llseek __NR_lseek
242 #endif
243 
244 /* Newer kernel ports have llseek() instead of _llseek() */
245 #if defined(TARGET_NR_llseek) && !defined(TARGET_NR__llseek)
246 #define TARGET_NR__llseek TARGET_NR_llseek
247 #endif
248 
249 #define __NR_sys_gettid __NR_gettid
250 _syscall0(int, sys_gettid)
251 
252 /* For the 64-bit guest on 32-bit host case we must emulate
253  * getdents using getdents64, because otherwise the host
254  * might hand us back more dirent records than we can fit
255  * into the guest buffer after structure format conversion.
256  * Otherwise we emulate getdents with getdents if the host has it.
257  */
258 #if defined(__NR_getdents) && HOST_LONG_BITS >= TARGET_ABI_BITS
259 #define EMULATE_GETDENTS_WITH_GETDENTS
260 #endif
261 
262 #if defined(TARGET_NR_getdents) && defined(EMULATE_GETDENTS_WITH_GETDENTS)
263 _syscall3(int, sys_getdents, uint, fd, struct linux_dirent *, dirp, uint, count);
264 #endif
265 #if (defined(TARGET_NR_getdents) && \
266       !defined(EMULATE_GETDENTS_WITH_GETDENTS)) || \
267     (defined(TARGET_NR_getdents64) && defined(__NR_getdents64))
268 _syscall3(int, sys_getdents64, uint, fd, struct linux_dirent64 *, dirp, uint, count);
269 #endif
270 #if defined(TARGET_NR__llseek) && defined(__NR_llseek)
271 _syscall5(int, _llseek,  uint,  fd, ulong, hi, ulong, lo,
272           loff_t *, res, uint, wh);
273 #endif
274 _syscall3(int, sys_rt_sigqueueinfo, pid_t, pid, int, sig, siginfo_t *, uinfo)
275 _syscall4(int, sys_rt_tgsigqueueinfo, pid_t, pid, pid_t, tid, int, sig,
276           siginfo_t *, uinfo)
277 _syscall3(int,sys_syslog,int,type,char*,bufp,int,len)
278 #ifdef __NR_exit_group
279 _syscall1(int,exit_group,int,error_code)
280 #endif
281 #if defined(TARGET_NR_set_tid_address) && defined(__NR_set_tid_address)
282 _syscall1(int,set_tid_address,int *,tidptr)
283 #endif
284 #if defined(TARGET_NR_futex) && defined(__NR_futex)
285 _syscall6(int,sys_futex,int *,uaddr,int,op,int,val,
286           const struct timespec *,timeout,int *,uaddr2,int,val3)
287 #endif
288 #define __NR_sys_sched_getaffinity __NR_sched_getaffinity
289 _syscall3(int, sys_sched_getaffinity, pid_t, pid, unsigned int, len,
290           unsigned long *, user_mask_ptr);
291 #define __NR_sys_sched_setaffinity __NR_sched_setaffinity
292 _syscall3(int, sys_sched_setaffinity, pid_t, pid, unsigned int, len,
293           unsigned long *, user_mask_ptr);
294 #define __NR_sys_getcpu __NR_getcpu
295 _syscall3(int, sys_getcpu, unsigned *, cpu, unsigned *, node, void *, tcache);
296 _syscall4(int, reboot, int, magic1, int, magic2, unsigned int, cmd,
297           void *, arg);
298 _syscall2(int, capget, struct __user_cap_header_struct *, header,
299           struct __user_cap_data_struct *, data);
300 _syscall2(int, capset, struct __user_cap_header_struct *, header,
301           struct __user_cap_data_struct *, data);
302 #if defined(TARGET_NR_ioprio_get) && defined(__NR_ioprio_get)
303 _syscall2(int, ioprio_get, int, which, int, who)
304 #endif
305 #if defined(TARGET_NR_ioprio_set) && defined(__NR_ioprio_set)
306 _syscall3(int, ioprio_set, int, which, int, who, int, ioprio)
307 #endif
308 #if defined(TARGET_NR_getrandom) && defined(__NR_getrandom)
309 _syscall3(int, getrandom, void *, buf, size_t, buflen, unsigned int, flags)
310 #endif
311 
312 #if defined(TARGET_NR_kcmp) && defined(__NR_kcmp)
313 _syscall5(int, kcmp, pid_t, pid1, pid_t, pid2, int, type,
314           unsigned long, idx1, unsigned long, idx2)
315 #endif
316 
317 static bitmask_transtbl fcntl_flags_tbl[] = {
318   { TARGET_O_ACCMODE,   TARGET_O_WRONLY,    O_ACCMODE,   O_WRONLY,    },
319   { TARGET_O_ACCMODE,   TARGET_O_RDWR,      O_ACCMODE,   O_RDWR,      },
320   { TARGET_O_CREAT,     TARGET_O_CREAT,     O_CREAT,     O_CREAT,     },
321   { TARGET_O_EXCL,      TARGET_O_EXCL,      O_EXCL,      O_EXCL,      },
322   { TARGET_O_NOCTTY,    TARGET_O_NOCTTY,    O_NOCTTY,    O_NOCTTY,    },
323   { TARGET_O_TRUNC,     TARGET_O_TRUNC,     O_TRUNC,     O_TRUNC,     },
324   { TARGET_O_APPEND,    TARGET_O_APPEND,    O_APPEND,    O_APPEND,    },
325   { TARGET_O_NONBLOCK,  TARGET_O_NONBLOCK,  O_NONBLOCK,  O_NONBLOCK,  },
326   { TARGET_O_SYNC,      TARGET_O_DSYNC,     O_SYNC,      O_DSYNC,     },
327   { TARGET_O_SYNC,      TARGET_O_SYNC,      O_SYNC,      O_SYNC,      },
328   { TARGET_FASYNC,      TARGET_FASYNC,      FASYNC,      FASYNC,      },
329   { TARGET_O_DIRECTORY, TARGET_O_DIRECTORY, O_DIRECTORY, O_DIRECTORY, },
330   { TARGET_O_NOFOLLOW,  TARGET_O_NOFOLLOW,  O_NOFOLLOW,  O_NOFOLLOW,  },
331 #if defined(O_DIRECT)
332   { TARGET_O_DIRECT,    TARGET_O_DIRECT,    O_DIRECT,    O_DIRECT,    },
333 #endif
334 #if defined(O_NOATIME)
335   { TARGET_O_NOATIME,   TARGET_O_NOATIME,   O_NOATIME,   O_NOATIME    },
336 #endif
337 #if defined(O_CLOEXEC)
338   { TARGET_O_CLOEXEC,   TARGET_O_CLOEXEC,   O_CLOEXEC,   O_CLOEXEC    },
339 #endif
340 #if defined(O_PATH)
341   { TARGET_O_PATH,      TARGET_O_PATH,      O_PATH,      O_PATH       },
342 #endif
343 #if defined(O_TMPFILE)
344   { TARGET_O_TMPFILE,   TARGET_O_TMPFILE,   O_TMPFILE,   O_TMPFILE    },
345 #endif
346   /* Don't terminate the list prematurely on 64-bit host+guest.  */
347 #if TARGET_O_LARGEFILE != 0 || O_LARGEFILE != 0
348   { TARGET_O_LARGEFILE, TARGET_O_LARGEFILE, O_LARGEFILE, O_LARGEFILE, },
349 #endif
350   { 0, 0, 0, 0 }
351 };
352 
353 static int sys_getcwd1(char *buf, size_t size)
354 {
355   if (getcwd(buf, size) == NULL) {
356       /* getcwd() sets errno */
357       return (-1);
358   }
359   return strlen(buf)+1;
360 }
361 
362 #ifdef TARGET_NR_utimensat
363 #if defined(__NR_utimensat)
364 #define __NR_sys_utimensat __NR_utimensat
365 _syscall4(int,sys_utimensat,int,dirfd,const char *,pathname,
366           const struct timespec *,tsp,int,flags)
367 #else
368 static int sys_utimensat(int dirfd, const char *pathname,
369                          const struct timespec times[2], int flags)
370 {
371     errno = ENOSYS;
372     return -1;
373 }
374 #endif
375 #endif /* TARGET_NR_utimensat */
376 
377 #ifdef TARGET_NR_renameat2
378 #if defined(__NR_renameat2)
379 #define __NR_sys_renameat2 __NR_renameat2
380 _syscall5(int, sys_renameat2, int, oldfd, const char *, old, int, newfd,
381           const char *, new, unsigned int, flags)
382 #else
383 static int sys_renameat2(int oldfd, const char *old,
384                          int newfd, const char *new, int flags)
385 {
386     if (flags == 0) {
387         return renameat(oldfd, old, newfd, new);
388     }
389     errno = ENOSYS;
390     return -1;
391 }
392 #endif
393 #endif /* TARGET_NR_renameat2 */
394 
395 #ifdef CONFIG_INOTIFY
396 #include <sys/inotify.h>
397 
398 #if defined(TARGET_NR_inotify_init) && defined(__NR_inotify_init)
399 static int sys_inotify_init(void)
400 {
401   return (inotify_init());
402 }
403 #endif
404 #if defined(TARGET_NR_inotify_add_watch) && defined(__NR_inotify_add_watch)
405 static int sys_inotify_add_watch(int fd,const char *pathname, int32_t mask)
406 {
407   return (inotify_add_watch(fd, pathname, mask));
408 }
409 #endif
410 #if defined(TARGET_NR_inotify_rm_watch) && defined(__NR_inotify_rm_watch)
411 static int sys_inotify_rm_watch(int fd, int32_t wd)
412 {
413   return (inotify_rm_watch(fd, wd));
414 }
415 #endif
416 #ifdef CONFIG_INOTIFY1
417 #if defined(TARGET_NR_inotify_init1) && defined(__NR_inotify_init1)
418 static int sys_inotify_init1(int flags)
419 {
420   return (inotify_init1(flags));
421 }
422 #endif
423 #endif
424 #else
425 /* Userspace can usually survive runtime without inotify */
426 #undef TARGET_NR_inotify_init
427 #undef TARGET_NR_inotify_init1
428 #undef TARGET_NR_inotify_add_watch
429 #undef TARGET_NR_inotify_rm_watch
430 #endif /* CONFIG_INOTIFY  */
431 
432 #if defined(TARGET_NR_prlimit64)
433 #ifndef __NR_prlimit64
434 # define __NR_prlimit64 -1
435 #endif
436 #define __NR_sys_prlimit64 __NR_prlimit64
437 /* The glibc rlimit structure may not be that used by the underlying syscall */
438 struct host_rlimit64 {
439     uint64_t rlim_cur;
440     uint64_t rlim_max;
441 };
442 _syscall4(int, sys_prlimit64, pid_t, pid, int, resource,
443           const struct host_rlimit64 *, new_limit,
444           struct host_rlimit64 *, old_limit)
445 #endif
446 
447 
448 #if defined(TARGET_NR_timer_create)
449 /* Maxiumum of 32 active POSIX timers allowed at any one time. */
450 static timer_t g_posix_timers[32] = { 0, } ;
451 
452 static inline int next_free_host_timer(void)
453 {
454     int k ;
455     /* FIXME: Does finding the next free slot require a lock? */
456     for (k = 0; k < ARRAY_SIZE(g_posix_timers); k++) {
457         if (g_posix_timers[k] == 0) {
458             g_posix_timers[k] = (timer_t) 1;
459             return k;
460         }
461     }
462     return -1;
463 }
464 #endif
465 
466 /* ARM EABI and MIPS expect 64bit types aligned even on pairs or registers */
467 #ifdef TARGET_ARM
468 static inline int regpairs_aligned(void *cpu_env, int num)
469 {
470     return ((((CPUARMState *)cpu_env)->eabi) == 1) ;
471 }
472 #elif defined(TARGET_MIPS) && (TARGET_ABI_BITS == 32)
473 static inline int regpairs_aligned(void *cpu_env, int num) { return 1; }
474 #elif defined(TARGET_PPC) && !defined(TARGET_PPC64)
475 /* SysV AVI for PPC32 expects 64bit parameters to be passed on odd/even pairs
476  * of registers which translates to the same as ARM/MIPS, because we start with
477  * r3 as arg1 */
478 static inline int regpairs_aligned(void *cpu_env, int num) { return 1; }
479 #elif defined(TARGET_SH4)
480 /* SH4 doesn't align register pairs, except for p{read,write}64 */
481 static inline int regpairs_aligned(void *cpu_env, int num)
482 {
483     switch (num) {
484     case TARGET_NR_pread64:
485     case TARGET_NR_pwrite64:
486         return 1;
487 
488     default:
489         return 0;
490     }
491 }
492 #elif defined(TARGET_XTENSA)
493 static inline int regpairs_aligned(void *cpu_env, int num) { return 1; }
494 #else
495 static inline int regpairs_aligned(void *cpu_env, int num) { return 0; }
496 #endif
497 
498 #define ERRNO_TABLE_SIZE 1200
499 
500 /* target_to_host_errno_table[] is initialized from
501  * host_to_target_errno_table[] in syscall_init(). */
502 static uint16_t target_to_host_errno_table[ERRNO_TABLE_SIZE] = {
503 };
504 
505 /*
506  * This list is the union of errno values overridden in asm-<arch>/errno.h
507  * minus the errnos that are not actually generic to all archs.
508  */
509 static uint16_t host_to_target_errno_table[ERRNO_TABLE_SIZE] = {
510     [EAGAIN]		= TARGET_EAGAIN,
511     [EIDRM]		= TARGET_EIDRM,
512     [ECHRNG]		= TARGET_ECHRNG,
513     [EL2NSYNC]		= TARGET_EL2NSYNC,
514     [EL3HLT]		= TARGET_EL3HLT,
515     [EL3RST]		= TARGET_EL3RST,
516     [ELNRNG]		= TARGET_ELNRNG,
517     [EUNATCH]		= TARGET_EUNATCH,
518     [ENOCSI]		= TARGET_ENOCSI,
519     [EL2HLT]		= TARGET_EL2HLT,
520     [EDEADLK]		= TARGET_EDEADLK,
521     [ENOLCK]		= TARGET_ENOLCK,
522     [EBADE]		= TARGET_EBADE,
523     [EBADR]		= TARGET_EBADR,
524     [EXFULL]		= TARGET_EXFULL,
525     [ENOANO]		= TARGET_ENOANO,
526     [EBADRQC]		= TARGET_EBADRQC,
527     [EBADSLT]		= TARGET_EBADSLT,
528     [EBFONT]		= TARGET_EBFONT,
529     [ENOSTR]		= TARGET_ENOSTR,
530     [ENODATA]		= TARGET_ENODATA,
531     [ETIME]		= TARGET_ETIME,
532     [ENOSR]		= TARGET_ENOSR,
533     [ENONET]		= TARGET_ENONET,
534     [ENOPKG]		= TARGET_ENOPKG,
535     [EREMOTE]		= TARGET_EREMOTE,
536     [ENOLINK]		= TARGET_ENOLINK,
537     [EADV]		= TARGET_EADV,
538     [ESRMNT]		= TARGET_ESRMNT,
539     [ECOMM]		= TARGET_ECOMM,
540     [EPROTO]		= TARGET_EPROTO,
541     [EDOTDOT]		= TARGET_EDOTDOT,
542     [EMULTIHOP]		= TARGET_EMULTIHOP,
543     [EBADMSG]		= TARGET_EBADMSG,
544     [ENAMETOOLONG]	= TARGET_ENAMETOOLONG,
545     [EOVERFLOW]		= TARGET_EOVERFLOW,
546     [ENOTUNIQ]		= TARGET_ENOTUNIQ,
547     [EBADFD]		= TARGET_EBADFD,
548     [EREMCHG]		= TARGET_EREMCHG,
549     [ELIBACC]		= TARGET_ELIBACC,
550     [ELIBBAD]		= TARGET_ELIBBAD,
551     [ELIBSCN]		= TARGET_ELIBSCN,
552     [ELIBMAX]		= TARGET_ELIBMAX,
553     [ELIBEXEC]		= TARGET_ELIBEXEC,
554     [EILSEQ]		= TARGET_EILSEQ,
555     [ENOSYS]		= TARGET_ENOSYS,
556     [ELOOP]		= TARGET_ELOOP,
557     [ERESTART]		= TARGET_ERESTART,
558     [ESTRPIPE]		= TARGET_ESTRPIPE,
559     [ENOTEMPTY]		= TARGET_ENOTEMPTY,
560     [EUSERS]		= TARGET_EUSERS,
561     [ENOTSOCK]		= TARGET_ENOTSOCK,
562     [EDESTADDRREQ]	= TARGET_EDESTADDRREQ,
563     [EMSGSIZE]		= TARGET_EMSGSIZE,
564     [EPROTOTYPE]	= TARGET_EPROTOTYPE,
565     [ENOPROTOOPT]	= TARGET_ENOPROTOOPT,
566     [EPROTONOSUPPORT]	= TARGET_EPROTONOSUPPORT,
567     [ESOCKTNOSUPPORT]	= TARGET_ESOCKTNOSUPPORT,
568     [EOPNOTSUPP]	= TARGET_EOPNOTSUPP,
569     [EPFNOSUPPORT]	= TARGET_EPFNOSUPPORT,
570     [EAFNOSUPPORT]	= TARGET_EAFNOSUPPORT,
571     [EADDRINUSE]	= TARGET_EADDRINUSE,
572     [EADDRNOTAVAIL]	= TARGET_EADDRNOTAVAIL,
573     [ENETDOWN]		= TARGET_ENETDOWN,
574     [ENETUNREACH]	= TARGET_ENETUNREACH,
575     [ENETRESET]		= TARGET_ENETRESET,
576     [ECONNABORTED]	= TARGET_ECONNABORTED,
577     [ECONNRESET]	= TARGET_ECONNRESET,
578     [ENOBUFS]		= TARGET_ENOBUFS,
579     [EISCONN]		= TARGET_EISCONN,
580     [ENOTCONN]		= TARGET_ENOTCONN,
581     [EUCLEAN]		= TARGET_EUCLEAN,
582     [ENOTNAM]		= TARGET_ENOTNAM,
583     [ENAVAIL]		= TARGET_ENAVAIL,
584     [EISNAM]		= TARGET_EISNAM,
585     [EREMOTEIO]		= TARGET_EREMOTEIO,
586     [EDQUOT]            = TARGET_EDQUOT,
587     [ESHUTDOWN]		= TARGET_ESHUTDOWN,
588     [ETOOMANYREFS]	= TARGET_ETOOMANYREFS,
589     [ETIMEDOUT]		= TARGET_ETIMEDOUT,
590     [ECONNREFUSED]	= TARGET_ECONNREFUSED,
591     [EHOSTDOWN]		= TARGET_EHOSTDOWN,
592     [EHOSTUNREACH]	= TARGET_EHOSTUNREACH,
593     [EALREADY]		= TARGET_EALREADY,
594     [EINPROGRESS]	= TARGET_EINPROGRESS,
595     [ESTALE]		= TARGET_ESTALE,
596     [ECANCELED]		= TARGET_ECANCELED,
597     [ENOMEDIUM]		= TARGET_ENOMEDIUM,
598     [EMEDIUMTYPE]	= TARGET_EMEDIUMTYPE,
599 #ifdef ENOKEY
600     [ENOKEY]		= TARGET_ENOKEY,
601 #endif
602 #ifdef EKEYEXPIRED
603     [EKEYEXPIRED]	= TARGET_EKEYEXPIRED,
604 #endif
605 #ifdef EKEYREVOKED
606     [EKEYREVOKED]	= TARGET_EKEYREVOKED,
607 #endif
608 #ifdef EKEYREJECTED
609     [EKEYREJECTED]	= TARGET_EKEYREJECTED,
610 #endif
611 #ifdef EOWNERDEAD
612     [EOWNERDEAD]	= TARGET_EOWNERDEAD,
613 #endif
614 #ifdef ENOTRECOVERABLE
615     [ENOTRECOVERABLE]	= TARGET_ENOTRECOVERABLE,
616 #endif
617 #ifdef ENOMSG
618     [ENOMSG]            = TARGET_ENOMSG,
619 #endif
620 #ifdef ERKFILL
621     [ERFKILL]           = TARGET_ERFKILL,
622 #endif
623 #ifdef EHWPOISON
624     [EHWPOISON]         = TARGET_EHWPOISON,
625 #endif
626 };
627 
628 static inline int host_to_target_errno(int err)
629 {
630     if (err >= 0 && err < ERRNO_TABLE_SIZE &&
631         host_to_target_errno_table[err]) {
632         return host_to_target_errno_table[err];
633     }
634     return err;
635 }
636 
637 static inline int target_to_host_errno(int err)
638 {
639     if (err >= 0 && err < ERRNO_TABLE_SIZE &&
640         target_to_host_errno_table[err]) {
641         return target_to_host_errno_table[err];
642     }
643     return err;
644 }
645 
646 static inline abi_long get_errno(abi_long ret)
647 {
648     if (ret == -1)
649         return -host_to_target_errno(errno);
650     else
651         return ret;
652 }
653 
654 const char *target_strerror(int err)
655 {
656     if (err == TARGET_ERESTARTSYS) {
657         return "To be restarted";
658     }
659     if (err == TARGET_QEMU_ESIGRETURN) {
660         return "Successful exit from sigreturn";
661     }
662 
663     if ((err >= ERRNO_TABLE_SIZE) || (err < 0)) {
664         return NULL;
665     }
666     return strerror(target_to_host_errno(err));
667 }
668 
669 #define safe_syscall0(type, name) \
670 static type safe_##name(void) \
671 { \
672     return safe_syscall(__NR_##name); \
673 }
674 
675 #define safe_syscall1(type, name, type1, arg1) \
676 static type safe_##name(type1 arg1) \
677 { \
678     return safe_syscall(__NR_##name, arg1); \
679 }
680 
681 #define safe_syscall2(type, name, type1, arg1, type2, arg2) \
682 static type safe_##name(type1 arg1, type2 arg2) \
683 { \
684     return safe_syscall(__NR_##name, arg1, arg2); \
685 }
686 
687 #define safe_syscall3(type, name, type1, arg1, type2, arg2, type3, arg3) \
688 static type safe_##name(type1 arg1, type2 arg2, type3 arg3) \
689 { \
690     return safe_syscall(__NR_##name, arg1, arg2, arg3); \
691 }
692 
693 #define safe_syscall4(type, name, type1, arg1, type2, arg2, type3, arg3, \
694     type4, arg4) \
695 static type safe_##name(type1 arg1, type2 arg2, type3 arg3, type4 arg4) \
696 { \
697     return safe_syscall(__NR_##name, arg1, arg2, arg3, arg4); \
698 }
699 
700 #define safe_syscall5(type, name, type1, arg1, type2, arg2, type3, arg3, \
701     type4, arg4, type5, arg5) \
702 static type safe_##name(type1 arg1, type2 arg2, type3 arg3, type4 arg4, \
703     type5 arg5) \
704 { \
705     return safe_syscall(__NR_##name, arg1, arg2, arg3, arg4, arg5); \
706 }
707 
708 #define safe_syscall6(type, name, type1, arg1, type2, arg2, type3, arg3, \
709     type4, arg4, type5, arg5, type6, arg6) \
710 static type safe_##name(type1 arg1, type2 arg2, type3 arg3, type4 arg4, \
711     type5 arg5, type6 arg6) \
712 { \
713     return safe_syscall(__NR_##name, arg1, arg2, arg3, arg4, arg5, arg6); \
714 }
715 
716 safe_syscall3(ssize_t, read, int, fd, void *, buff, size_t, count)
717 safe_syscall3(ssize_t, write, int, fd, const void *, buff, size_t, count)
718 safe_syscall4(int, openat, int, dirfd, const char *, pathname, \
719               int, flags, mode_t, mode)
720 safe_syscall4(pid_t, wait4, pid_t, pid, int *, status, int, options, \
721               struct rusage *, rusage)
722 safe_syscall5(int, waitid, idtype_t, idtype, id_t, id, siginfo_t *, infop, \
723               int, options, struct rusage *, rusage)
724 safe_syscall3(int, execve, const char *, filename, char **, argv, char **, envp)
725 safe_syscall6(int, pselect6, int, nfds, fd_set *, readfds, fd_set *, writefds, \
726               fd_set *, exceptfds, struct timespec *, timeout, void *, sig)
727 safe_syscall5(int, ppoll, struct pollfd *, ufds, unsigned int, nfds,
728               struct timespec *, tsp, const sigset_t *, sigmask,
729               size_t, sigsetsize)
730 safe_syscall6(int, epoll_pwait, int, epfd, struct epoll_event *, events,
731               int, maxevents, int, timeout, const sigset_t *, sigmask,
732               size_t, sigsetsize)
733 safe_syscall6(int,futex,int *,uaddr,int,op,int,val, \
734               const struct timespec *,timeout,int *,uaddr2,int,val3)
735 safe_syscall2(int, rt_sigsuspend, sigset_t *, newset, size_t, sigsetsize)
736 safe_syscall2(int, kill, pid_t, pid, int, sig)
737 safe_syscall2(int, tkill, int, tid, int, sig)
738 safe_syscall3(int, tgkill, int, tgid, int, pid, int, sig)
739 safe_syscall3(ssize_t, readv, int, fd, const struct iovec *, iov, int, iovcnt)
740 safe_syscall3(ssize_t, writev, int, fd, const struct iovec *, iov, int, iovcnt)
741 safe_syscall5(ssize_t, preadv, int, fd, const struct iovec *, iov, int, iovcnt,
742               unsigned long, pos_l, unsigned long, pos_h)
743 safe_syscall5(ssize_t, pwritev, int, fd, const struct iovec *, iov, int, iovcnt,
744               unsigned long, pos_l, unsigned long, pos_h)
745 safe_syscall3(int, connect, int, fd, const struct sockaddr *, addr,
746               socklen_t, addrlen)
747 safe_syscall6(ssize_t, sendto, int, fd, const void *, buf, size_t, len,
748               int, flags, const struct sockaddr *, addr, socklen_t, addrlen)
749 safe_syscall6(ssize_t, recvfrom, int, fd, void *, buf, size_t, len,
750               int, flags, struct sockaddr *, addr, socklen_t *, addrlen)
751 safe_syscall3(ssize_t, sendmsg, int, fd, const struct msghdr *, msg, int, flags)
752 safe_syscall3(ssize_t, recvmsg, int, fd, struct msghdr *, msg, int, flags)
753 safe_syscall2(int, flock, int, fd, int, operation)
754 safe_syscall4(int, rt_sigtimedwait, const sigset_t *, these, siginfo_t *, uinfo,
755               const struct timespec *, uts, size_t, sigsetsize)
756 safe_syscall4(int, accept4, int, fd, struct sockaddr *, addr, socklen_t *, len,
757               int, flags)
758 safe_syscall2(int, nanosleep, const struct timespec *, req,
759               struct timespec *, rem)
760 #ifdef TARGET_NR_clock_nanosleep
761 safe_syscall4(int, clock_nanosleep, const clockid_t, clock, int, flags,
762               const struct timespec *, req, struct timespec *, rem)
763 #endif
764 #ifdef __NR_msgsnd
765 safe_syscall4(int, msgsnd, int, msgid, const void *, msgp, size_t, sz,
766               int, flags)
767 safe_syscall5(int, msgrcv, int, msgid, void *, msgp, size_t, sz,
768               long, msgtype, int, flags)
769 safe_syscall4(int, semtimedop, int, semid, struct sembuf *, tsops,
770               unsigned, nsops, const struct timespec *, timeout)
771 #else
772 /* This host kernel architecture uses a single ipc syscall; fake up
773  * wrappers for the sub-operations to hide this implementation detail.
774  * Annoyingly we can't include linux/ipc.h to get the constant definitions
775  * for the call parameter because some structs in there conflict with the
776  * sys/ipc.h ones. So we just define them here, and rely on them being
777  * the same for all host architectures.
778  */
779 #define Q_SEMTIMEDOP 4
780 #define Q_MSGSND 11
781 #define Q_MSGRCV 12
782 #define Q_IPCCALL(VERSION, OP) ((VERSION) << 16 | (OP))
783 
784 safe_syscall6(int, ipc, int, call, long, first, long, second, long, third,
785               void *, ptr, long, fifth)
786 static int safe_msgsnd(int msgid, const void *msgp, size_t sz, int flags)
787 {
788     return safe_ipc(Q_IPCCALL(0, Q_MSGSND), msgid, sz, flags, (void *)msgp, 0);
789 }
790 static int safe_msgrcv(int msgid, void *msgp, size_t sz, long type, int flags)
791 {
792     return safe_ipc(Q_IPCCALL(1, Q_MSGRCV), msgid, sz, flags, msgp, type);
793 }
794 static int safe_semtimedop(int semid, struct sembuf *tsops, unsigned nsops,
795                            const struct timespec *timeout)
796 {
797     return safe_ipc(Q_IPCCALL(0, Q_SEMTIMEDOP), semid, nsops, 0, tsops,
798                     (long)timeout);
799 }
800 #endif
801 #if defined(TARGET_NR_mq_open) && defined(__NR_mq_open)
802 safe_syscall5(int, mq_timedsend, int, mqdes, const char *, msg_ptr,
803               size_t, len, unsigned, prio, const struct timespec *, timeout)
804 safe_syscall5(int, mq_timedreceive, int, mqdes, char *, msg_ptr,
805               size_t, len, unsigned *, prio, const struct timespec *, timeout)
806 #endif
807 /* We do ioctl like this rather than via safe_syscall3 to preserve the
808  * "third argument might be integer or pointer or not present" behaviour of
809  * the libc function.
810  */
811 #define safe_ioctl(...) safe_syscall(__NR_ioctl, __VA_ARGS__)
812 /* Similarly for fcntl. Note that callers must always:
813  *  pass the F_GETLK64 etc constants rather than the unsuffixed F_GETLK
814  *  use the flock64 struct rather than unsuffixed flock
815  * This will then work and use a 64-bit offset for both 32-bit and 64-bit hosts.
816  */
817 #ifdef __NR_fcntl64
818 #define safe_fcntl(...) safe_syscall(__NR_fcntl64, __VA_ARGS__)
819 #else
820 #define safe_fcntl(...) safe_syscall(__NR_fcntl, __VA_ARGS__)
821 #endif
822 
823 static inline int host_to_target_sock_type(int host_type)
824 {
825     int target_type;
826 
827     switch (host_type & 0xf /* SOCK_TYPE_MASK */) {
828     case SOCK_DGRAM:
829         target_type = TARGET_SOCK_DGRAM;
830         break;
831     case SOCK_STREAM:
832         target_type = TARGET_SOCK_STREAM;
833         break;
834     default:
835         target_type = host_type & 0xf /* SOCK_TYPE_MASK */;
836         break;
837     }
838 
839 #if defined(SOCK_CLOEXEC)
840     if (host_type & SOCK_CLOEXEC) {
841         target_type |= TARGET_SOCK_CLOEXEC;
842     }
843 #endif
844 
845 #if defined(SOCK_NONBLOCK)
846     if (host_type & SOCK_NONBLOCK) {
847         target_type |= TARGET_SOCK_NONBLOCK;
848     }
849 #endif
850 
851     return target_type;
852 }
853 
854 static abi_ulong target_brk;
855 static abi_ulong target_original_brk;
856 static abi_ulong brk_page;
857 
858 void target_set_brk(abi_ulong new_brk)
859 {
860     target_original_brk = target_brk = HOST_PAGE_ALIGN(new_brk);
861     brk_page = HOST_PAGE_ALIGN(target_brk);
862 }
863 
864 //#define DEBUGF_BRK(message, args...) do { fprintf(stderr, (message), ## args); } while (0)
865 #define DEBUGF_BRK(message, args...)
866 
867 /* do_brk() must return target values and target errnos. */
868 abi_long do_brk(abi_ulong new_brk)
869 {
870     abi_long mapped_addr;
871     abi_ulong new_alloc_size;
872 
873     DEBUGF_BRK("do_brk(" TARGET_ABI_FMT_lx ") -> ", new_brk);
874 
875     if (!new_brk) {
876         DEBUGF_BRK(TARGET_ABI_FMT_lx " (!new_brk)\n", target_brk);
877         return target_brk;
878     }
879     if (new_brk < target_original_brk) {
880         DEBUGF_BRK(TARGET_ABI_FMT_lx " (new_brk < target_original_brk)\n",
881                    target_brk);
882         return target_brk;
883     }
884 
885     /* If the new brk is less than the highest page reserved to the
886      * target heap allocation, set it and we're almost done...  */
887     if (new_brk <= brk_page) {
888         /* Heap contents are initialized to zero, as for anonymous
889          * mapped pages.  */
890         if (new_brk > target_brk) {
891             memset(g2h(target_brk), 0, new_brk - target_brk);
892         }
893 	target_brk = new_brk;
894         DEBUGF_BRK(TARGET_ABI_FMT_lx " (new_brk <= brk_page)\n", target_brk);
895 	return target_brk;
896     }
897 
898     /* We need to allocate more memory after the brk... Note that
899      * we don't use MAP_FIXED because that will map over the top of
900      * any existing mapping (like the one with the host libc or qemu
901      * itself); instead we treat "mapped but at wrong address" as
902      * a failure and unmap again.
903      */
904     new_alloc_size = HOST_PAGE_ALIGN(new_brk - brk_page);
905     mapped_addr = get_errno(target_mmap(brk_page, new_alloc_size,
906                                         PROT_READ|PROT_WRITE,
907                                         MAP_ANON|MAP_PRIVATE, 0, 0));
908 
909     if (mapped_addr == brk_page) {
910         /* Heap contents are initialized to zero, as for anonymous
911          * mapped pages.  Technically the new pages are already
912          * initialized to zero since they *are* anonymous mapped
913          * pages, however we have to take care with the contents that
914          * come from the remaining part of the previous page: it may
915          * contains garbage data due to a previous heap usage (grown
916          * then shrunken).  */
917         memset(g2h(target_brk), 0, brk_page - target_brk);
918 
919         target_brk = new_brk;
920         brk_page = HOST_PAGE_ALIGN(target_brk);
921         DEBUGF_BRK(TARGET_ABI_FMT_lx " (mapped_addr == brk_page)\n",
922             target_brk);
923         return target_brk;
924     } else if (mapped_addr != -1) {
925         /* Mapped but at wrong address, meaning there wasn't actually
926          * enough space for this brk.
927          */
928         target_munmap(mapped_addr, new_alloc_size);
929         mapped_addr = -1;
930         DEBUGF_BRK(TARGET_ABI_FMT_lx " (mapped_addr != -1)\n", target_brk);
931     }
932     else {
933         DEBUGF_BRK(TARGET_ABI_FMT_lx " (otherwise)\n", target_brk);
934     }
935 
936 #if defined(TARGET_ALPHA)
937     /* We (partially) emulate OSF/1 on Alpha, which requires we
938        return a proper errno, not an unchanged brk value.  */
939     return -TARGET_ENOMEM;
940 #endif
941     /* For everything else, return the previous break. */
942     return target_brk;
943 }
944 
945 static inline abi_long copy_from_user_fdset(fd_set *fds,
946                                             abi_ulong target_fds_addr,
947                                             int n)
948 {
949     int i, nw, j, k;
950     abi_ulong b, *target_fds;
951 
952     nw = DIV_ROUND_UP(n, TARGET_ABI_BITS);
953     if (!(target_fds = lock_user(VERIFY_READ,
954                                  target_fds_addr,
955                                  sizeof(abi_ulong) * nw,
956                                  1)))
957         return -TARGET_EFAULT;
958 
959     FD_ZERO(fds);
960     k = 0;
961     for (i = 0; i < nw; i++) {
962         /* grab the abi_ulong */
963         __get_user(b, &target_fds[i]);
964         for (j = 0; j < TARGET_ABI_BITS; j++) {
965             /* check the bit inside the abi_ulong */
966             if ((b >> j) & 1)
967                 FD_SET(k, fds);
968             k++;
969         }
970     }
971 
972     unlock_user(target_fds, target_fds_addr, 0);
973 
974     return 0;
975 }
976 
977 static inline abi_ulong copy_from_user_fdset_ptr(fd_set *fds, fd_set **fds_ptr,
978                                                  abi_ulong target_fds_addr,
979                                                  int n)
980 {
981     if (target_fds_addr) {
982         if (copy_from_user_fdset(fds, target_fds_addr, n))
983             return -TARGET_EFAULT;
984         *fds_ptr = fds;
985     } else {
986         *fds_ptr = NULL;
987     }
988     return 0;
989 }
990 
991 static inline abi_long copy_to_user_fdset(abi_ulong target_fds_addr,
992                                           const fd_set *fds,
993                                           int n)
994 {
995     int i, nw, j, k;
996     abi_long v;
997     abi_ulong *target_fds;
998 
999     nw = DIV_ROUND_UP(n, TARGET_ABI_BITS);
1000     if (!(target_fds = lock_user(VERIFY_WRITE,
1001                                  target_fds_addr,
1002                                  sizeof(abi_ulong) * nw,
1003                                  0)))
1004         return -TARGET_EFAULT;
1005 
1006     k = 0;
1007     for (i = 0; i < nw; i++) {
1008         v = 0;
1009         for (j = 0; j < TARGET_ABI_BITS; j++) {
1010             v |= ((abi_ulong)(FD_ISSET(k, fds) != 0) << j);
1011             k++;
1012         }
1013         __put_user(v, &target_fds[i]);
1014     }
1015 
1016     unlock_user(target_fds, target_fds_addr, sizeof(abi_ulong) * nw);
1017 
1018     return 0;
1019 }
1020 
1021 #if defined(__alpha__)
1022 #define HOST_HZ 1024
1023 #else
1024 #define HOST_HZ 100
1025 #endif
1026 
1027 static inline abi_long host_to_target_clock_t(long ticks)
1028 {
1029 #if HOST_HZ == TARGET_HZ
1030     return ticks;
1031 #else
1032     return ((int64_t)ticks * TARGET_HZ) / HOST_HZ;
1033 #endif
1034 }
1035 
1036 static inline abi_long host_to_target_rusage(abi_ulong target_addr,
1037                                              const struct rusage *rusage)
1038 {
1039     struct target_rusage *target_rusage;
1040 
1041     if (!lock_user_struct(VERIFY_WRITE, target_rusage, target_addr, 0))
1042         return -TARGET_EFAULT;
1043     target_rusage->ru_utime.tv_sec = tswapal(rusage->ru_utime.tv_sec);
1044     target_rusage->ru_utime.tv_usec = tswapal(rusage->ru_utime.tv_usec);
1045     target_rusage->ru_stime.tv_sec = tswapal(rusage->ru_stime.tv_sec);
1046     target_rusage->ru_stime.tv_usec = tswapal(rusage->ru_stime.tv_usec);
1047     target_rusage->ru_maxrss = tswapal(rusage->ru_maxrss);
1048     target_rusage->ru_ixrss = tswapal(rusage->ru_ixrss);
1049     target_rusage->ru_idrss = tswapal(rusage->ru_idrss);
1050     target_rusage->ru_isrss = tswapal(rusage->ru_isrss);
1051     target_rusage->ru_minflt = tswapal(rusage->ru_minflt);
1052     target_rusage->ru_majflt = tswapal(rusage->ru_majflt);
1053     target_rusage->ru_nswap = tswapal(rusage->ru_nswap);
1054     target_rusage->ru_inblock = tswapal(rusage->ru_inblock);
1055     target_rusage->ru_oublock = tswapal(rusage->ru_oublock);
1056     target_rusage->ru_msgsnd = tswapal(rusage->ru_msgsnd);
1057     target_rusage->ru_msgrcv = tswapal(rusage->ru_msgrcv);
1058     target_rusage->ru_nsignals = tswapal(rusage->ru_nsignals);
1059     target_rusage->ru_nvcsw = tswapal(rusage->ru_nvcsw);
1060     target_rusage->ru_nivcsw = tswapal(rusage->ru_nivcsw);
1061     unlock_user_struct(target_rusage, target_addr, 1);
1062 
1063     return 0;
1064 }
1065 
1066 static inline rlim_t target_to_host_rlim(abi_ulong target_rlim)
1067 {
1068     abi_ulong target_rlim_swap;
1069     rlim_t result;
1070 
1071     target_rlim_swap = tswapal(target_rlim);
1072     if (target_rlim_swap == TARGET_RLIM_INFINITY)
1073         return RLIM_INFINITY;
1074 
1075     result = target_rlim_swap;
1076     if (target_rlim_swap != (rlim_t)result)
1077         return RLIM_INFINITY;
1078 
1079     return result;
1080 }
1081 
1082 static inline abi_ulong host_to_target_rlim(rlim_t rlim)
1083 {
1084     abi_ulong target_rlim_swap;
1085     abi_ulong result;
1086 
1087     if (rlim == RLIM_INFINITY || rlim != (abi_long)rlim)
1088         target_rlim_swap = TARGET_RLIM_INFINITY;
1089     else
1090         target_rlim_swap = rlim;
1091     result = tswapal(target_rlim_swap);
1092 
1093     return result;
1094 }
1095 
1096 static inline int target_to_host_resource(int code)
1097 {
1098     switch (code) {
1099     case TARGET_RLIMIT_AS:
1100         return RLIMIT_AS;
1101     case TARGET_RLIMIT_CORE:
1102         return RLIMIT_CORE;
1103     case TARGET_RLIMIT_CPU:
1104         return RLIMIT_CPU;
1105     case TARGET_RLIMIT_DATA:
1106         return RLIMIT_DATA;
1107     case TARGET_RLIMIT_FSIZE:
1108         return RLIMIT_FSIZE;
1109     case TARGET_RLIMIT_LOCKS:
1110         return RLIMIT_LOCKS;
1111     case TARGET_RLIMIT_MEMLOCK:
1112         return RLIMIT_MEMLOCK;
1113     case TARGET_RLIMIT_MSGQUEUE:
1114         return RLIMIT_MSGQUEUE;
1115     case TARGET_RLIMIT_NICE:
1116         return RLIMIT_NICE;
1117     case TARGET_RLIMIT_NOFILE:
1118         return RLIMIT_NOFILE;
1119     case TARGET_RLIMIT_NPROC:
1120         return RLIMIT_NPROC;
1121     case TARGET_RLIMIT_RSS:
1122         return RLIMIT_RSS;
1123     case TARGET_RLIMIT_RTPRIO:
1124         return RLIMIT_RTPRIO;
1125     case TARGET_RLIMIT_SIGPENDING:
1126         return RLIMIT_SIGPENDING;
1127     case TARGET_RLIMIT_STACK:
1128         return RLIMIT_STACK;
1129     default:
1130         return code;
1131     }
1132 }
1133 
1134 static inline abi_long copy_from_user_timeval(struct timeval *tv,
1135                                               abi_ulong target_tv_addr)
1136 {
1137     struct target_timeval *target_tv;
1138 
1139     if (!lock_user_struct(VERIFY_READ, target_tv, target_tv_addr, 1))
1140         return -TARGET_EFAULT;
1141 
1142     __get_user(tv->tv_sec, &target_tv->tv_sec);
1143     __get_user(tv->tv_usec, &target_tv->tv_usec);
1144 
1145     unlock_user_struct(target_tv, target_tv_addr, 0);
1146 
1147     return 0;
1148 }
1149 
1150 static inline abi_long copy_to_user_timeval(abi_ulong target_tv_addr,
1151                                             const struct timeval *tv)
1152 {
1153     struct target_timeval *target_tv;
1154 
1155     if (!lock_user_struct(VERIFY_WRITE, target_tv, target_tv_addr, 0))
1156         return -TARGET_EFAULT;
1157 
1158     __put_user(tv->tv_sec, &target_tv->tv_sec);
1159     __put_user(tv->tv_usec, &target_tv->tv_usec);
1160 
1161     unlock_user_struct(target_tv, target_tv_addr, 1);
1162 
1163     return 0;
1164 }
1165 
1166 static inline abi_long copy_from_user_timezone(struct timezone *tz,
1167                                                abi_ulong target_tz_addr)
1168 {
1169     struct target_timezone *target_tz;
1170 
1171     if (!lock_user_struct(VERIFY_READ, target_tz, target_tz_addr, 1)) {
1172         return -TARGET_EFAULT;
1173     }
1174 
1175     __get_user(tz->tz_minuteswest, &target_tz->tz_minuteswest);
1176     __get_user(tz->tz_dsttime, &target_tz->tz_dsttime);
1177 
1178     unlock_user_struct(target_tz, target_tz_addr, 0);
1179 
1180     return 0;
1181 }
1182 
1183 #if defined(TARGET_NR_mq_open) && defined(__NR_mq_open)
1184 #include <mqueue.h>
1185 
1186 static inline abi_long copy_from_user_mq_attr(struct mq_attr *attr,
1187                                               abi_ulong target_mq_attr_addr)
1188 {
1189     struct target_mq_attr *target_mq_attr;
1190 
1191     if (!lock_user_struct(VERIFY_READ, target_mq_attr,
1192                           target_mq_attr_addr, 1))
1193         return -TARGET_EFAULT;
1194 
1195     __get_user(attr->mq_flags, &target_mq_attr->mq_flags);
1196     __get_user(attr->mq_maxmsg, &target_mq_attr->mq_maxmsg);
1197     __get_user(attr->mq_msgsize, &target_mq_attr->mq_msgsize);
1198     __get_user(attr->mq_curmsgs, &target_mq_attr->mq_curmsgs);
1199 
1200     unlock_user_struct(target_mq_attr, target_mq_attr_addr, 0);
1201 
1202     return 0;
1203 }
1204 
1205 static inline abi_long copy_to_user_mq_attr(abi_ulong target_mq_attr_addr,
1206                                             const struct mq_attr *attr)
1207 {
1208     struct target_mq_attr *target_mq_attr;
1209 
1210     if (!lock_user_struct(VERIFY_WRITE, target_mq_attr,
1211                           target_mq_attr_addr, 0))
1212         return -TARGET_EFAULT;
1213 
1214     __put_user(attr->mq_flags, &target_mq_attr->mq_flags);
1215     __put_user(attr->mq_maxmsg, &target_mq_attr->mq_maxmsg);
1216     __put_user(attr->mq_msgsize, &target_mq_attr->mq_msgsize);
1217     __put_user(attr->mq_curmsgs, &target_mq_attr->mq_curmsgs);
1218 
1219     unlock_user_struct(target_mq_attr, target_mq_attr_addr, 1);
1220 
1221     return 0;
1222 }
1223 #endif
1224 
1225 #if defined(TARGET_NR_select) || defined(TARGET_NR__newselect)
1226 /* do_select() must return target values and target errnos. */
1227 static abi_long do_select(int n,
1228                           abi_ulong rfd_addr, abi_ulong wfd_addr,
1229                           abi_ulong efd_addr, abi_ulong target_tv_addr)
1230 {
1231     fd_set rfds, wfds, efds;
1232     fd_set *rfds_ptr, *wfds_ptr, *efds_ptr;
1233     struct timeval tv;
1234     struct timespec ts, *ts_ptr;
1235     abi_long ret;
1236 
1237     ret = copy_from_user_fdset_ptr(&rfds, &rfds_ptr, rfd_addr, n);
1238     if (ret) {
1239         return ret;
1240     }
1241     ret = copy_from_user_fdset_ptr(&wfds, &wfds_ptr, wfd_addr, n);
1242     if (ret) {
1243         return ret;
1244     }
1245     ret = copy_from_user_fdset_ptr(&efds, &efds_ptr, efd_addr, n);
1246     if (ret) {
1247         return ret;
1248     }
1249 
1250     if (target_tv_addr) {
1251         if (copy_from_user_timeval(&tv, target_tv_addr))
1252             return -TARGET_EFAULT;
1253         ts.tv_sec = tv.tv_sec;
1254         ts.tv_nsec = tv.tv_usec * 1000;
1255         ts_ptr = &ts;
1256     } else {
1257         ts_ptr = NULL;
1258     }
1259 
1260     ret = get_errno(safe_pselect6(n, rfds_ptr, wfds_ptr, efds_ptr,
1261                                   ts_ptr, NULL));
1262 
1263     if (!is_error(ret)) {
1264         if (rfd_addr && copy_to_user_fdset(rfd_addr, &rfds, n))
1265             return -TARGET_EFAULT;
1266         if (wfd_addr && copy_to_user_fdset(wfd_addr, &wfds, n))
1267             return -TARGET_EFAULT;
1268         if (efd_addr && copy_to_user_fdset(efd_addr, &efds, n))
1269             return -TARGET_EFAULT;
1270 
1271         if (target_tv_addr) {
1272             tv.tv_sec = ts.tv_sec;
1273             tv.tv_usec = ts.tv_nsec / 1000;
1274             if (copy_to_user_timeval(target_tv_addr, &tv)) {
1275                 return -TARGET_EFAULT;
1276             }
1277         }
1278     }
1279 
1280     return ret;
1281 }
1282 
1283 #if defined(TARGET_WANT_OLD_SYS_SELECT)
1284 static abi_long do_old_select(abi_ulong arg1)
1285 {
1286     struct target_sel_arg_struct *sel;
1287     abi_ulong inp, outp, exp, tvp;
1288     long nsel;
1289 
1290     if (!lock_user_struct(VERIFY_READ, sel, arg1, 1)) {
1291         return -TARGET_EFAULT;
1292     }
1293 
1294     nsel = tswapal(sel->n);
1295     inp = tswapal(sel->inp);
1296     outp = tswapal(sel->outp);
1297     exp = tswapal(sel->exp);
1298     tvp = tswapal(sel->tvp);
1299 
1300     unlock_user_struct(sel, arg1, 0);
1301 
1302     return do_select(nsel, inp, outp, exp, tvp);
1303 }
1304 #endif
1305 #endif
1306 
1307 static abi_long do_pipe2(int host_pipe[], int flags)
1308 {
1309 #ifdef CONFIG_PIPE2
1310     return pipe2(host_pipe, flags);
1311 #else
1312     return -ENOSYS;
1313 #endif
1314 }
1315 
1316 static abi_long do_pipe(void *cpu_env, abi_ulong pipedes,
1317                         int flags, int is_pipe2)
1318 {
1319     int host_pipe[2];
1320     abi_long ret;
1321     ret = flags ? do_pipe2(host_pipe, flags) : pipe(host_pipe);
1322 
1323     if (is_error(ret))
1324         return get_errno(ret);
1325 
1326     /* Several targets have special calling conventions for the original
1327        pipe syscall, but didn't replicate this into the pipe2 syscall.  */
1328     if (!is_pipe2) {
1329 #if defined(TARGET_ALPHA)
1330         ((CPUAlphaState *)cpu_env)->ir[IR_A4] = host_pipe[1];
1331         return host_pipe[0];
1332 #elif defined(TARGET_MIPS)
1333         ((CPUMIPSState*)cpu_env)->active_tc.gpr[3] = host_pipe[1];
1334         return host_pipe[0];
1335 #elif defined(TARGET_SH4)
1336         ((CPUSH4State*)cpu_env)->gregs[1] = host_pipe[1];
1337         return host_pipe[0];
1338 #elif defined(TARGET_SPARC)
1339         ((CPUSPARCState*)cpu_env)->regwptr[1] = host_pipe[1];
1340         return host_pipe[0];
1341 #endif
1342     }
1343 
1344     if (put_user_s32(host_pipe[0], pipedes)
1345         || put_user_s32(host_pipe[1], pipedes + sizeof(host_pipe[0])))
1346         return -TARGET_EFAULT;
1347     return get_errno(ret);
1348 }
1349 
1350 static inline abi_long target_to_host_ip_mreq(struct ip_mreqn *mreqn,
1351                                               abi_ulong target_addr,
1352                                               socklen_t len)
1353 {
1354     struct target_ip_mreqn *target_smreqn;
1355 
1356     target_smreqn = lock_user(VERIFY_READ, target_addr, len, 1);
1357     if (!target_smreqn)
1358         return -TARGET_EFAULT;
1359     mreqn->imr_multiaddr.s_addr = target_smreqn->imr_multiaddr.s_addr;
1360     mreqn->imr_address.s_addr = target_smreqn->imr_address.s_addr;
1361     if (len == sizeof(struct target_ip_mreqn))
1362         mreqn->imr_ifindex = tswapal(target_smreqn->imr_ifindex);
1363     unlock_user(target_smreqn, target_addr, 0);
1364 
1365     return 0;
1366 }
1367 
1368 static inline abi_long target_to_host_sockaddr(int fd, struct sockaddr *addr,
1369                                                abi_ulong target_addr,
1370                                                socklen_t len)
1371 {
1372     const socklen_t unix_maxlen = sizeof (struct sockaddr_un);
1373     sa_family_t sa_family;
1374     struct target_sockaddr *target_saddr;
1375 
1376     if (fd_trans_target_to_host_addr(fd)) {
1377         return fd_trans_target_to_host_addr(fd)(addr, target_addr, len);
1378     }
1379 
1380     target_saddr = lock_user(VERIFY_READ, target_addr, len, 1);
1381     if (!target_saddr)
1382         return -TARGET_EFAULT;
1383 
1384     sa_family = tswap16(target_saddr->sa_family);
1385 
1386     /* Oops. The caller might send a incomplete sun_path; sun_path
1387      * must be terminated by \0 (see the manual page), but
1388      * unfortunately it is quite common to specify sockaddr_un
1389      * length as "strlen(x->sun_path)" while it should be
1390      * "strlen(...) + 1". We'll fix that here if needed.
1391      * Linux kernel has a similar feature.
1392      */
1393 
1394     if (sa_family == AF_UNIX) {
1395         if (len < unix_maxlen && len > 0) {
1396             char *cp = (char*)target_saddr;
1397 
1398             if ( cp[len-1] && !cp[len] )
1399                 len++;
1400         }
1401         if (len > unix_maxlen)
1402             len = unix_maxlen;
1403     }
1404 
1405     memcpy(addr, target_saddr, len);
1406     addr->sa_family = sa_family;
1407     if (sa_family == AF_NETLINK) {
1408         struct sockaddr_nl *nladdr;
1409 
1410         nladdr = (struct sockaddr_nl *)addr;
1411         nladdr->nl_pid = tswap32(nladdr->nl_pid);
1412         nladdr->nl_groups = tswap32(nladdr->nl_groups);
1413     } else if (sa_family == AF_PACKET) {
1414 	struct target_sockaddr_ll *lladdr;
1415 
1416 	lladdr = (struct target_sockaddr_ll *)addr;
1417 	lladdr->sll_ifindex = tswap32(lladdr->sll_ifindex);
1418 	lladdr->sll_hatype = tswap16(lladdr->sll_hatype);
1419     }
1420     unlock_user(target_saddr, target_addr, 0);
1421 
1422     return 0;
1423 }
1424 
1425 static inline abi_long host_to_target_sockaddr(abi_ulong target_addr,
1426                                                struct sockaddr *addr,
1427                                                socklen_t len)
1428 {
1429     struct target_sockaddr *target_saddr;
1430 
1431     if (len == 0) {
1432         return 0;
1433     }
1434     assert(addr);
1435 
1436     target_saddr = lock_user(VERIFY_WRITE, target_addr, len, 0);
1437     if (!target_saddr)
1438         return -TARGET_EFAULT;
1439     memcpy(target_saddr, addr, len);
1440     if (len >= offsetof(struct target_sockaddr, sa_family) +
1441         sizeof(target_saddr->sa_family)) {
1442         target_saddr->sa_family = tswap16(addr->sa_family);
1443     }
1444     if (addr->sa_family == AF_NETLINK && len >= sizeof(struct sockaddr_nl)) {
1445         struct sockaddr_nl *target_nl = (struct sockaddr_nl *)target_saddr;
1446         target_nl->nl_pid = tswap32(target_nl->nl_pid);
1447         target_nl->nl_groups = tswap32(target_nl->nl_groups);
1448     } else if (addr->sa_family == AF_PACKET) {
1449         struct sockaddr_ll *target_ll = (struct sockaddr_ll *)target_saddr;
1450         target_ll->sll_ifindex = tswap32(target_ll->sll_ifindex);
1451         target_ll->sll_hatype = tswap16(target_ll->sll_hatype);
1452     } else if (addr->sa_family == AF_INET6 &&
1453                len >= sizeof(struct target_sockaddr_in6)) {
1454         struct target_sockaddr_in6 *target_in6 =
1455                (struct target_sockaddr_in6 *)target_saddr;
1456         target_in6->sin6_scope_id = tswap16(target_in6->sin6_scope_id);
1457     }
1458     unlock_user(target_saddr, target_addr, len);
1459 
1460     return 0;
1461 }
1462 
1463 static inline abi_long target_to_host_cmsg(struct msghdr *msgh,
1464                                            struct target_msghdr *target_msgh)
1465 {
1466     struct cmsghdr *cmsg = CMSG_FIRSTHDR(msgh);
1467     abi_long msg_controllen;
1468     abi_ulong target_cmsg_addr;
1469     struct target_cmsghdr *target_cmsg, *target_cmsg_start;
1470     socklen_t space = 0;
1471 
1472     msg_controllen = tswapal(target_msgh->msg_controllen);
1473     if (msg_controllen < sizeof (struct target_cmsghdr))
1474         goto the_end;
1475     target_cmsg_addr = tswapal(target_msgh->msg_control);
1476     target_cmsg = lock_user(VERIFY_READ, target_cmsg_addr, msg_controllen, 1);
1477     target_cmsg_start = target_cmsg;
1478     if (!target_cmsg)
1479         return -TARGET_EFAULT;
1480 
1481     while (cmsg && target_cmsg) {
1482         void *data = CMSG_DATA(cmsg);
1483         void *target_data = TARGET_CMSG_DATA(target_cmsg);
1484 
1485         int len = tswapal(target_cmsg->cmsg_len)
1486             - sizeof(struct target_cmsghdr);
1487 
1488         space += CMSG_SPACE(len);
1489         if (space > msgh->msg_controllen) {
1490             space -= CMSG_SPACE(len);
1491             /* This is a QEMU bug, since we allocated the payload
1492              * area ourselves (unlike overflow in host-to-target
1493              * conversion, which is just the guest giving us a buffer
1494              * that's too small). It can't happen for the payload types
1495              * we currently support; if it becomes an issue in future
1496              * we would need to improve our allocation strategy to
1497              * something more intelligent than "twice the size of the
1498              * target buffer we're reading from".
1499              */
1500             gemu_log("Host cmsg overflow\n");
1501             break;
1502         }
1503 
1504         if (tswap32(target_cmsg->cmsg_level) == TARGET_SOL_SOCKET) {
1505             cmsg->cmsg_level = SOL_SOCKET;
1506         } else {
1507             cmsg->cmsg_level = tswap32(target_cmsg->cmsg_level);
1508         }
1509         cmsg->cmsg_type = tswap32(target_cmsg->cmsg_type);
1510         cmsg->cmsg_len = CMSG_LEN(len);
1511 
1512         if (cmsg->cmsg_level == SOL_SOCKET && cmsg->cmsg_type == SCM_RIGHTS) {
1513             int *fd = (int *)data;
1514             int *target_fd = (int *)target_data;
1515             int i, numfds = len / sizeof(int);
1516 
1517             for (i = 0; i < numfds; i++) {
1518                 __get_user(fd[i], target_fd + i);
1519             }
1520         } else if (cmsg->cmsg_level == SOL_SOCKET
1521                &&  cmsg->cmsg_type == SCM_CREDENTIALS) {
1522             struct ucred *cred = (struct ucred *)data;
1523             struct target_ucred *target_cred =
1524                 (struct target_ucred *)target_data;
1525 
1526             __get_user(cred->pid, &target_cred->pid);
1527             __get_user(cred->uid, &target_cred->uid);
1528             __get_user(cred->gid, &target_cred->gid);
1529         } else {
1530             gemu_log("Unsupported ancillary data: %d/%d\n",
1531                                         cmsg->cmsg_level, cmsg->cmsg_type);
1532             memcpy(data, target_data, len);
1533         }
1534 
1535         cmsg = CMSG_NXTHDR(msgh, cmsg);
1536         target_cmsg = TARGET_CMSG_NXTHDR(target_msgh, target_cmsg,
1537                                          target_cmsg_start);
1538     }
1539     unlock_user(target_cmsg, target_cmsg_addr, 0);
1540  the_end:
1541     msgh->msg_controllen = space;
1542     return 0;
1543 }
1544 
1545 static inline abi_long host_to_target_cmsg(struct target_msghdr *target_msgh,
1546                                            struct msghdr *msgh)
1547 {
1548     struct cmsghdr *cmsg = CMSG_FIRSTHDR(msgh);
1549     abi_long msg_controllen;
1550     abi_ulong target_cmsg_addr;
1551     struct target_cmsghdr *target_cmsg, *target_cmsg_start;
1552     socklen_t space = 0;
1553 
1554     msg_controllen = tswapal(target_msgh->msg_controllen);
1555     if (msg_controllen < sizeof (struct target_cmsghdr))
1556         goto the_end;
1557     target_cmsg_addr = tswapal(target_msgh->msg_control);
1558     target_cmsg = lock_user(VERIFY_WRITE, target_cmsg_addr, msg_controllen, 0);
1559     target_cmsg_start = target_cmsg;
1560     if (!target_cmsg)
1561         return -TARGET_EFAULT;
1562 
1563     while (cmsg && target_cmsg) {
1564         void *data = CMSG_DATA(cmsg);
1565         void *target_data = TARGET_CMSG_DATA(target_cmsg);
1566 
1567         int len = cmsg->cmsg_len - sizeof(struct cmsghdr);
1568         int tgt_len, tgt_space;
1569 
1570         /* We never copy a half-header but may copy half-data;
1571          * this is Linux's behaviour in put_cmsg(). Note that
1572          * truncation here is a guest problem (which we report
1573          * to the guest via the CTRUNC bit), unlike truncation
1574          * in target_to_host_cmsg, which is a QEMU bug.
1575          */
1576         if (msg_controllen < sizeof(struct target_cmsghdr)) {
1577             target_msgh->msg_flags |= tswap32(MSG_CTRUNC);
1578             break;
1579         }
1580 
1581         if (cmsg->cmsg_level == SOL_SOCKET) {
1582             target_cmsg->cmsg_level = tswap32(TARGET_SOL_SOCKET);
1583         } else {
1584             target_cmsg->cmsg_level = tswap32(cmsg->cmsg_level);
1585         }
1586         target_cmsg->cmsg_type = tswap32(cmsg->cmsg_type);
1587 
1588         /* Payload types which need a different size of payload on
1589          * the target must adjust tgt_len here.
1590          */
1591         tgt_len = len;
1592         switch (cmsg->cmsg_level) {
1593         case SOL_SOCKET:
1594             switch (cmsg->cmsg_type) {
1595             case SO_TIMESTAMP:
1596                 tgt_len = sizeof(struct target_timeval);
1597                 break;
1598             default:
1599                 break;
1600             }
1601             break;
1602         default:
1603             break;
1604         }
1605 
1606         if (msg_controllen < TARGET_CMSG_LEN(tgt_len)) {
1607             target_msgh->msg_flags |= tswap32(MSG_CTRUNC);
1608             tgt_len = msg_controllen - sizeof(struct target_cmsghdr);
1609         }
1610 
1611         /* We must now copy-and-convert len bytes of payload
1612          * into tgt_len bytes of destination space. Bear in mind
1613          * that in both source and destination we may be dealing
1614          * with a truncated value!
1615          */
1616         switch (cmsg->cmsg_level) {
1617         case SOL_SOCKET:
1618             switch (cmsg->cmsg_type) {
1619             case SCM_RIGHTS:
1620             {
1621                 int *fd = (int *)data;
1622                 int *target_fd = (int *)target_data;
1623                 int i, numfds = tgt_len / sizeof(int);
1624 
1625                 for (i = 0; i < numfds; i++) {
1626                     __put_user(fd[i], target_fd + i);
1627                 }
1628                 break;
1629             }
1630             case SO_TIMESTAMP:
1631             {
1632                 struct timeval *tv = (struct timeval *)data;
1633                 struct target_timeval *target_tv =
1634                     (struct target_timeval *)target_data;
1635 
1636                 if (len != sizeof(struct timeval) ||
1637                     tgt_len != sizeof(struct target_timeval)) {
1638                     goto unimplemented;
1639                 }
1640 
1641                 /* copy struct timeval to target */
1642                 __put_user(tv->tv_sec, &target_tv->tv_sec);
1643                 __put_user(tv->tv_usec, &target_tv->tv_usec);
1644                 break;
1645             }
1646             case SCM_CREDENTIALS:
1647             {
1648                 struct ucred *cred = (struct ucred *)data;
1649                 struct target_ucred *target_cred =
1650                     (struct target_ucred *)target_data;
1651 
1652                 __put_user(cred->pid, &target_cred->pid);
1653                 __put_user(cred->uid, &target_cred->uid);
1654                 __put_user(cred->gid, &target_cred->gid);
1655                 break;
1656             }
1657             default:
1658                 goto unimplemented;
1659             }
1660             break;
1661 
1662         case SOL_IP:
1663             switch (cmsg->cmsg_type) {
1664             case IP_TTL:
1665             {
1666                 uint32_t *v = (uint32_t *)data;
1667                 uint32_t *t_int = (uint32_t *)target_data;
1668 
1669                 if (len != sizeof(uint32_t) ||
1670                     tgt_len != sizeof(uint32_t)) {
1671                     goto unimplemented;
1672                 }
1673                 __put_user(*v, t_int);
1674                 break;
1675             }
1676             case IP_RECVERR:
1677             {
1678                 struct errhdr_t {
1679                    struct sock_extended_err ee;
1680                    struct sockaddr_in offender;
1681                 };
1682                 struct errhdr_t *errh = (struct errhdr_t *)data;
1683                 struct errhdr_t *target_errh =
1684                     (struct errhdr_t *)target_data;
1685 
1686                 if (len != sizeof(struct errhdr_t) ||
1687                     tgt_len != sizeof(struct errhdr_t)) {
1688                     goto unimplemented;
1689                 }
1690                 __put_user(errh->ee.ee_errno, &target_errh->ee.ee_errno);
1691                 __put_user(errh->ee.ee_origin, &target_errh->ee.ee_origin);
1692                 __put_user(errh->ee.ee_type,  &target_errh->ee.ee_type);
1693                 __put_user(errh->ee.ee_code, &target_errh->ee.ee_code);
1694                 __put_user(errh->ee.ee_pad, &target_errh->ee.ee_pad);
1695                 __put_user(errh->ee.ee_info, &target_errh->ee.ee_info);
1696                 __put_user(errh->ee.ee_data, &target_errh->ee.ee_data);
1697                 host_to_target_sockaddr((unsigned long) &target_errh->offender,
1698                     (void *) &errh->offender, sizeof(errh->offender));
1699                 break;
1700             }
1701             default:
1702                 goto unimplemented;
1703             }
1704             break;
1705 
1706         case SOL_IPV6:
1707             switch (cmsg->cmsg_type) {
1708             case IPV6_HOPLIMIT:
1709             {
1710                 uint32_t *v = (uint32_t *)data;
1711                 uint32_t *t_int = (uint32_t *)target_data;
1712 
1713                 if (len != sizeof(uint32_t) ||
1714                     tgt_len != sizeof(uint32_t)) {
1715                     goto unimplemented;
1716                 }
1717                 __put_user(*v, t_int);
1718                 break;
1719             }
1720             case IPV6_RECVERR:
1721             {
1722                 struct errhdr6_t {
1723                    struct sock_extended_err ee;
1724                    struct sockaddr_in6 offender;
1725                 };
1726                 struct errhdr6_t *errh = (struct errhdr6_t *)data;
1727                 struct errhdr6_t *target_errh =
1728                     (struct errhdr6_t *)target_data;
1729 
1730                 if (len != sizeof(struct errhdr6_t) ||
1731                     tgt_len != sizeof(struct errhdr6_t)) {
1732                     goto unimplemented;
1733                 }
1734                 __put_user(errh->ee.ee_errno, &target_errh->ee.ee_errno);
1735                 __put_user(errh->ee.ee_origin, &target_errh->ee.ee_origin);
1736                 __put_user(errh->ee.ee_type,  &target_errh->ee.ee_type);
1737                 __put_user(errh->ee.ee_code, &target_errh->ee.ee_code);
1738                 __put_user(errh->ee.ee_pad, &target_errh->ee.ee_pad);
1739                 __put_user(errh->ee.ee_info, &target_errh->ee.ee_info);
1740                 __put_user(errh->ee.ee_data, &target_errh->ee.ee_data);
1741                 host_to_target_sockaddr((unsigned long) &target_errh->offender,
1742                     (void *) &errh->offender, sizeof(errh->offender));
1743                 break;
1744             }
1745             default:
1746                 goto unimplemented;
1747             }
1748             break;
1749 
1750         default:
1751         unimplemented:
1752             gemu_log("Unsupported ancillary data: %d/%d\n",
1753                                         cmsg->cmsg_level, cmsg->cmsg_type);
1754             memcpy(target_data, data, MIN(len, tgt_len));
1755             if (tgt_len > len) {
1756                 memset(target_data + len, 0, tgt_len - len);
1757             }
1758         }
1759 
1760         target_cmsg->cmsg_len = tswapal(TARGET_CMSG_LEN(tgt_len));
1761         tgt_space = TARGET_CMSG_SPACE(tgt_len);
1762         if (msg_controllen < tgt_space) {
1763             tgt_space = msg_controllen;
1764         }
1765         msg_controllen -= tgt_space;
1766         space += tgt_space;
1767         cmsg = CMSG_NXTHDR(msgh, cmsg);
1768         target_cmsg = TARGET_CMSG_NXTHDR(target_msgh, target_cmsg,
1769                                          target_cmsg_start);
1770     }
1771     unlock_user(target_cmsg, target_cmsg_addr, space);
1772  the_end:
1773     target_msgh->msg_controllen = tswapal(space);
1774     return 0;
1775 }
1776 
1777 /* do_setsockopt() Must return target values and target errnos. */
1778 static abi_long do_setsockopt(int sockfd, int level, int optname,
1779                               abi_ulong optval_addr, socklen_t optlen)
1780 {
1781     abi_long ret;
1782     int val;
1783     struct ip_mreqn *ip_mreq;
1784     struct ip_mreq_source *ip_mreq_source;
1785 
1786     switch(level) {
1787     case SOL_TCP:
1788         /* TCP options all take an 'int' value.  */
1789         if (optlen < sizeof(uint32_t))
1790             return -TARGET_EINVAL;
1791 
1792         if (get_user_u32(val, optval_addr))
1793             return -TARGET_EFAULT;
1794         ret = get_errno(setsockopt(sockfd, level, optname, &val, sizeof(val)));
1795         break;
1796     case SOL_IP:
1797         switch(optname) {
1798         case IP_TOS:
1799         case IP_TTL:
1800         case IP_HDRINCL:
1801         case IP_ROUTER_ALERT:
1802         case IP_RECVOPTS:
1803         case IP_RETOPTS:
1804         case IP_PKTINFO:
1805         case IP_MTU_DISCOVER:
1806         case IP_RECVERR:
1807         case IP_RECVTTL:
1808         case IP_RECVTOS:
1809 #ifdef IP_FREEBIND
1810         case IP_FREEBIND:
1811 #endif
1812         case IP_MULTICAST_TTL:
1813         case IP_MULTICAST_LOOP:
1814             val = 0;
1815             if (optlen >= sizeof(uint32_t)) {
1816                 if (get_user_u32(val, optval_addr))
1817                     return -TARGET_EFAULT;
1818             } else if (optlen >= 1) {
1819                 if (get_user_u8(val, optval_addr))
1820                     return -TARGET_EFAULT;
1821             }
1822             ret = get_errno(setsockopt(sockfd, level, optname, &val, sizeof(val)));
1823             break;
1824         case IP_ADD_MEMBERSHIP:
1825         case IP_DROP_MEMBERSHIP:
1826             if (optlen < sizeof (struct target_ip_mreq) ||
1827                 optlen > sizeof (struct target_ip_mreqn))
1828                 return -TARGET_EINVAL;
1829 
1830             ip_mreq = (struct ip_mreqn *) alloca(optlen);
1831             target_to_host_ip_mreq(ip_mreq, optval_addr, optlen);
1832             ret = get_errno(setsockopt(sockfd, level, optname, ip_mreq, optlen));
1833             break;
1834 
1835         case IP_BLOCK_SOURCE:
1836         case IP_UNBLOCK_SOURCE:
1837         case IP_ADD_SOURCE_MEMBERSHIP:
1838         case IP_DROP_SOURCE_MEMBERSHIP:
1839             if (optlen != sizeof (struct target_ip_mreq_source))
1840                 return -TARGET_EINVAL;
1841 
1842             ip_mreq_source = lock_user(VERIFY_READ, optval_addr, optlen, 1);
1843             ret = get_errno(setsockopt(sockfd, level, optname, ip_mreq_source, optlen));
1844             unlock_user (ip_mreq_source, optval_addr, 0);
1845             break;
1846 
1847         default:
1848             goto unimplemented;
1849         }
1850         break;
1851     case SOL_IPV6:
1852         switch (optname) {
1853         case IPV6_MTU_DISCOVER:
1854         case IPV6_MTU:
1855         case IPV6_V6ONLY:
1856         case IPV6_RECVPKTINFO:
1857         case IPV6_UNICAST_HOPS:
1858         case IPV6_MULTICAST_HOPS:
1859         case IPV6_MULTICAST_LOOP:
1860         case IPV6_RECVERR:
1861         case IPV6_RECVHOPLIMIT:
1862         case IPV6_2292HOPLIMIT:
1863         case IPV6_CHECKSUM:
1864         case IPV6_ADDRFORM:
1865         case IPV6_2292PKTINFO:
1866         case IPV6_RECVTCLASS:
1867         case IPV6_RECVRTHDR:
1868         case IPV6_2292RTHDR:
1869         case IPV6_RECVHOPOPTS:
1870         case IPV6_2292HOPOPTS:
1871         case IPV6_RECVDSTOPTS:
1872         case IPV6_2292DSTOPTS:
1873         case IPV6_TCLASS:
1874 #ifdef IPV6_RECVPATHMTU
1875         case IPV6_RECVPATHMTU:
1876 #endif
1877 #ifdef IPV6_TRANSPARENT
1878         case IPV6_TRANSPARENT:
1879 #endif
1880 #ifdef IPV6_FREEBIND
1881         case IPV6_FREEBIND:
1882 #endif
1883 #ifdef IPV6_RECVORIGDSTADDR
1884         case IPV6_RECVORIGDSTADDR:
1885 #endif
1886             val = 0;
1887             if (optlen < sizeof(uint32_t)) {
1888                 return -TARGET_EINVAL;
1889             }
1890             if (get_user_u32(val, optval_addr)) {
1891                 return -TARGET_EFAULT;
1892             }
1893             ret = get_errno(setsockopt(sockfd, level, optname,
1894                                        &val, sizeof(val)));
1895             break;
1896         case IPV6_PKTINFO:
1897         {
1898             struct in6_pktinfo pki;
1899 
1900             if (optlen < sizeof(pki)) {
1901                 return -TARGET_EINVAL;
1902             }
1903 
1904             if (copy_from_user(&pki, optval_addr, sizeof(pki))) {
1905                 return -TARGET_EFAULT;
1906             }
1907 
1908             pki.ipi6_ifindex = tswap32(pki.ipi6_ifindex);
1909 
1910             ret = get_errno(setsockopt(sockfd, level, optname,
1911                                        &pki, sizeof(pki)));
1912             break;
1913         }
1914         default:
1915             goto unimplemented;
1916         }
1917         break;
1918     case SOL_ICMPV6:
1919         switch (optname) {
1920         case ICMPV6_FILTER:
1921         {
1922             struct icmp6_filter icmp6f;
1923 
1924             if (optlen > sizeof(icmp6f)) {
1925                 optlen = sizeof(icmp6f);
1926             }
1927 
1928             if (copy_from_user(&icmp6f, optval_addr, optlen)) {
1929                 return -TARGET_EFAULT;
1930             }
1931 
1932             for (val = 0; val < 8; val++) {
1933                 icmp6f.data[val] = tswap32(icmp6f.data[val]);
1934             }
1935 
1936             ret = get_errno(setsockopt(sockfd, level, optname,
1937                                        &icmp6f, optlen));
1938             break;
1939         }
1940         default:
1941             goto unimplemented;
1942         }
1943         break;
1944     case SOL_RAW:
1945         switch (optname) {
1946         case ICMP_FILTER:
1947         case IPV6_CHECKSUM:
1948             /* those take an u32 value */
1949             if (optlen < sizeof(uint32_t)) {
1950                 return -TARGET_EINVAL;
1951             }
1952 
1953             if (get_user_u32(val, optval_addr)) {
1954                 return -TARGET_EFAULT;
1955             }
1956             ret = get_errno(setsockopt(sockfd, level, optname,
1957                                        &val, sizeof(val)));
1958             break;
1959 
1960         default:
1961             goto unimplemented;
1962         }
1963         break;
1964     case TARGET_SOL_SOCKET:
1965         switch (optname) {
1966         case TARGET_SO_RCVTIMEO:
1967         {
1968                 struct timeval tv;
1969 
1970                 optname = SO_RCVTIMEO;
1971 
1972 set_timeout:
1973                 if (optlen != sizeof(struct target_timeval)) {
1974                     return -TARGET_EINVAL;
1975                 }
1976 
1977                 if (copy_from_user_timeval(&tv, optval_addr)) {
1978                     return -TARGET_EFAULT;
1979                 }
1980 
1981                 ret = get_errno(setsockopt(sockfd, SOL_SOCKET, optname,
1982                                 &tv, sizeof(tv)));
1983                 return ret;
1984         }
1985         case TARGET_SO_SNDTIMEO:
1986                 optname = SO_SNDTIMEO;
1987                 goto set_timeout;
1988         case TARGET_SO_ATTACH_FILTER:
1989         {
1990                 struct target_sock_fprog *tfprog;
1991                 struct target_sock_filter *tfilter;
1992                 struct sock_fprog fprog;
1993                 struct sock_filter *filter;
1994                 int i;
1995 
1996                 if (optlen != sizeof(*tfprog)) {
1997                     return -TARGET_EINVAL;
1998                 }
1999                 if (!lock_user_struct(VERIFY_READ, tfprog, optval_addr, 0)) {
2000                     return -TARGET_EFAULT;
2001                 }
2002                 if (!lock_user_struct(VERIFY_READ, tfilter,
2003                                       tswapal(tfprog->filter), 0)) {
2004                     unlock_user_struct(tfprog, optval_addr, 1);
2005                     return -TARGET_EFAULT;
2006                 }
2007 
2008                 fprog.len = tswap16(tfprog->len);
2009                 filter = g_try_new(struct sock_filter, fprog.len);
2010                 if (filter == NULL) {
2011                     unlock_user_struct(tfilter, tfprog->filter, 1);
2012                     unlock_user_struct(tfprog, optval_addr, 1);
2013                     return -TARGET_ENOMEM;
2014                 }
2015                 for (i = 0; i < fprog.len; i++) {
2016                     filter[i].code = tswap16(tfilter[i].code);
2017                     filter[i].jt = tfilter[i].jt;
2018                     filter[i].jf = tfilter[i].jf;
2019                     filter[i].k = tswap32(tfilter[i].k);
2020                 }
2021                 fprog.filter = filter;
2022 
2023                 ret = get_errno(setsockopt(sockfd, SOL_SOCKET,
2024                                 SO_ATTACH_FILTER, &fprog, sizeof(fprog)));
2025                 g_free(filter);
2026 
2027                 unlock_user_struct(tfilter, tfprog->filter, 1);
2028                 unlock_user_struct(tfprog, optval_addr, 1);
2029                 return ret;
2030         }
2031 	case TARGET_SO_BINDTODEVICE:
2032 	{
2033 		char *dev_ifname, *addr_ifname;
2034 
2035 		if (optlen > IFNAMSIZ - 1) {
2036 		    optlen = IFNAMSIZ - 1;
2037 		}
2038 		dev_ifname = lock_user(VERIFY_READ, optval_addr, optlen, 1);
2039 		if (!dev_ifname) {
2040 		    return -TARGET_EFAULT;
2041 		}
2042 		optname = SO_BINDTODEVICE;
2043 		addr_ifname = alloca(IFNAMSIZ);
2044 		memcpy(addr_ifname, dev_ifname, optlen);
2045 		addr_ifname[optlen] = 0;
2046 		ret = get_errno(setsockopt(sockfd, SOL_SOCKET, optname,
2047                                            addr_ifname, optlen));
2048 		unlock_user (dev_ifname, optval_addr, 0);
2049 		return ret;
2050 	}
2051         case TARGET_SO_LINGER:
2052         {
2053                 struct linger lg;
2054                 struct target_linger *tlg;
2055 
2056                 if (optlen != sizeof(struct target_linger)) {
2057                     return -TARGET_EINVAL;
2058                 }
2059                 if (!lock_user_struct(VERIFY_READ, tlg, optval_addr, 1)) {
2060                     return -TARGET_EFAULT;
2061                 }
2062                 __get_user(lg.l_onoff, &tlg->l_onoff);
2063                 __get_user(lg.l_linger, &tlg->l_linger);
2064                 ret = get_errno(setsockopt(sockfd, SOL_SOCKET, SO_LINGER,
2065                                 &lg, sizeof(lg)));
2066                 unlock_user_struct(tlg, optval_addr, 0);
2067                 return ret;
2068         }
2069             /* Options with 'int' argument.  */
2070         case TARGET_SO_DEBUG:
2071 		optname = SO_DEBUG;
2072 		break;
2073         case TARGET_SO_REUSEADDR:
2074 		optname = SO_REUSEADDR;
2075 		break;
2076 #ifdef SO_REUSEPORT
2077         case TARGET_SO_REUSEPORT:
2078                 optname = SO_REUSEPORT;
2079                 break;
2080 #endif
2081         case TARGET_SO_TYPE:
2082 		optname = SO_TYPE;
2083 		break;
2084         case TARGET_SO_ERROR:
2085 		optname = SO_ERROR;
2086 		break;
2087         case TARGET_SO_DONTROUTE:
2088 		optname = SO_DONTROUTE;
2089 		break;
2090         case TARGET_SO_BROADCAST:
2091 		optname = SO_BROADCAST;
2092 		break;
2093         case TARGET_SO_SNDBUF:
2094 		optname = SO_SNDBUF;
2095 		break;
2096         case TARGET_SO_SNDBUFFORCE:
2097                 optname = SO_SNDBUFFORCE;
2098                 break;
2099         case TARGET_SO_RCVBUF:
2100 		optname = SO_RCVBUF;
2101 		break;
2102         case TARGET_SO_RCVBUFFORCE:
2103                 optname = SO_RCVBUFFORCE;
2104                 break;
2105         case TARGET_SO_KEEPALIVE:
2106 		optname = SO_KEEPALIVE;
2107 		break;
2108         case TARGET_SO_OOBINLINE:
2109 		optname = SO_OOBINLINE;
2110 		break;
2111         case TARGET_SO_NO_CHECK:
2112 		optname = SO_NO_CHECK;
2113 		break;
2114         case TARGET_SO_PRIORITY:
2115 		optname = SO_PRIORITY;
2116 		break;
2117 #ifdef SO_BSDCOMPAT
2118         case TARGET_SO_BSDCOMPAT:
2119 		optname = SO_BSDCOMPAT;
2120 		break;
2121 #endif
2122         case TARGET_SO_PASSCRED:
2123 		optname = SO_PASSCRED;
2124 		break;
2125         case TARGET_SO_PASSSEC:
2126                 optname = SO_PASSSEC;
2127                 break;
2128         case TARGET_SO_TIMESTAMP:
2129 		optname = SO_TIMESTAMP;
2130 		break;
2131         case TARGET_SO_RCVLOWAT:
2132 		optname = SO_RCVLOWAT;
2133 		break;
2134         default:
2135             goto unimplemented;
2136         }
2137 	if (optlen < sizeof(uint32_t))
2138             return -TARGET_EINVAL;
2139 
2140 	if (get_user_u32(val, optval_addr))
2141             return -TARGET_EFAULT;
2142 	ret = get_errno(setsockopt(sockfd, SOL_SOCKET, optname, &val, sizeof(val)));
2143         break;
2144     default:
2145     unimplemented:
2146         gemu_log("Unsupported setsockopt level=%d optname=%d\n", level, optname);
2147         ret = -TARGET_ENOPROTOOPT;
2148     }
2149     return ret;
2150 }
2151 
2152 /* do_getsockopt() Must return target values and target errnos. */
2153 static abi_long do_getsockopt(int sockfd, int level, int optname,
2154                               abi_ulong optval_addr, abi_ulong optlen)
2155 {
2156     abi_long ret;
2157     int len, val;
2158     socklen_t lv;
2159 
2160     switch(level) {
2161     case TARGET_SOL_SOCKET:
2162         level = SOL_SOCKET;
2163         switch (optname) {
2164         /* These don't just return a single integer */
2165         case TARGET_SO_RCVTIMEO:
2166         case TARGET_SO_SNDTIMEO:
2167         case TARGET_SO_PEERNAME:
2168             goto unimplemented;
2169         case TARGET_SO_PEERCRED: {
2170             struct ucred cr;
2171             socklen_t crlen;
2172             struct target_ucred *tcr;
2173 
2174             if (get_user_u32(len, optlen)) {
2175                 return -TARGET_EFAULT;
2176             }
2177             if (len < 0) {
2178                 return -TARGET_EINVAL;
2179             }
2180 
2181             crlen = sizeof(cr);
2182             ret = get_errno(getsockopt(sockfd, level, SO_PEERCRED,
2183                                        &cr, &crlen));
2184             if (ret < 0) {
2185                 return ret;
2186             }
2187             if (len > crlen) {
2188                 len = crlen;
2189             }
2190             if (!lock_user_struct(VERIFY_WRITE, tcr, optval_addr, 0)) {
2191                 return -TARGET_EFAULT;
2192             }
2193             __put_user(cr.pid, &tcr->pid);
2194             __put_user(cr.uid, &tcr->uid);
2195             __put_user(cr.gid, &tcr->gid);
2196             unlock_user_struct(tcr, optval_addr, 1);
2197             if (put_user_u32(len, optlen)) {
2198                 return -TARGET_EFAULT;
2199             }
2200             break;
2201         }
2202         case TARGET_SO_LINGER:
2203         {
2204             struct linger lg;
2205             socklen_t lglen;
2206             struct target_linger *tlg;
2207 
2208             if (get_user_u32(len, optlen)) {
2209                 return -TARGET_EFAULT;
2210             }
2211             if (len < 0) {
2212                 return -TARGET_EINVAL;
2213             }
2214 
2215             lglen = sizeof(lg);
2216             ret = get_errno(getsockopt(sockfd, level, SO_LINGER,
2217                                        &lg, &lglen));
2218             if (ret < 0) {
2219                 return ret;
2220             }
2221             if (len > lglen) {
2222                 len = lglen;
2223             }
2224             if (!lock_user_struct(VERIFY_WRITE, tlg, optval_addr, 0)) {
2225                 return -TARGET_EFAULT;
2226             }
2227             __put_user(lg.l_onoff, &tlg->l_onoff);
2228             __put_user(lg.l_linger, &tlg->l_linger);
2229             unlock_user_struct(tlg, optval_addr, 1);
2230             if (put_user_u32(len, optlen)) {
2231                 return -TARGET_EFAULT;
2232             }
2233             break;
2234         }
2235         /* Options with 'int' argument.  */
2236         case TARGET_SO_DEBUG:
2237             optname = SO_DEBUG;
2238             goto int_case;
2239         case TARGET_SO_REUSEADDR:
2240             optname = SO_REUSEADDR;
2241             goto int_case;
2242 #ifdef SO_REUSEPORT
2243         case TARGET_SO_REUSEPORT:
2244             optname = SO_REUSEPORT;
2245             goto int_case;
2246 #endif
2247         case TARGET_SO_TYPE:
2248             optname = SO_TYPE;
2249             goto int_case;
2250         case TARGET_SO_ERROR:
2251             optname = SO_ERROR;
2252             goto int_case;
2253         case TARGET_SO_DONTROUTE:
2254             optname = SO_DONTROUTE;
2255             goto int_case;
2256         case TARGET_SO_BROADCAST:
2257             optname = SO_BROADCAST;
2258             goto int_case;
2259         case TARGET_SO_SNDBUF:
2260             optname = SO_SNDBUF;
2261             goto int_case;
2262         case TARGET_SO_RCVBUF:
2263             optname = SO_RCVBUF;
2264             goto int_case;
2265         case TARGET_SO_KEEPALIVE:
2266             optname = SO_KEEPALIVE;
2267             goto int_case;
2268         case TARGET_SO_OOBINLINE:
2269             optname = SO_OOBINLINE;
2270             goto int_case;
2271         case TARGET_SO_NO_CHECK:
2272             optname = SO_NO_CHECK;
2273             goto int_case;
2274         case TARGET_SO_PRIORITY:
2275             optname = SO_PRIORITY;
2276             goto int_case;
2277 #ifdef SO_BSDCOMPAT
2278         case TARGET_SO_BSDCOMPAT:
2279             optname = SO_BSDCOMPAT;
2280             goto int_case;
2281 #endif
2282         case TARGET_SO_PASSCRED:
2283             optname = SO_PASSCRED;
2284             goto int_case;
2285         case TARGET_SO_TIMESTAMP:
2286             optname = SO_TIMESTAMP;
2287             goto int_case;
2288         case TARGET_SO_RCVLOWAT:
2289             optname = SO_RCVLOWAT;
2290             goto int_case;
2291         case TARGET_SO_ACCEPTCONN:
2292             optname = SO_ACCEPTCONN;
2293             goto int_case;
2294         default:
2295             goto int_case;
2296         }
2297         break;
2298     case SOL_TCP:
2299         /* TCP options all take an 'int' value.  */
2300     int_case:
2301         if (get_user_u32(len, optlen))
2302             return -TARGET_EFAULT;
2303         if (len < 0)
2304             return -TARGET_EINVAL;
2305         lv = sizeof(lv);
2306         ret = get_errno(getsockopt(sockfd, level, optname, &val, &lv));
2307         if (ret < 0)
2308             return ret;
2309         if (optname == SO_TYPE) {
2310             val = host_to_target_sock_type(val);
2311         }
2312         if (len > lv)
2313             len = lv;
2314         if (len == 4) {
2315             if (put_user_u32(val, optval_addr))
2316                 return -TARGET_EFAULT;
2317         } else {
2318             if (put_user_u8(val, optval_addr))
2319                 return -TARGET_EFAULT;
2320         }
2321         if (put_user_u32(len, optlen))
2322             return -TARGET_EFAULT;
2323         break;
2324     case SOL_IP:
2325         switch(optname) {
2326         case IP_TOS:
2327         case IP_TTL:
2328         case IP_HDRINCL:
2329         case IP_ROUTER_ALERT:
2330         case IP_RECVOPTS:
2331         case IP_RETOPTS:
2332         case IP_PKTINFO:
2333         case IP_MTU_DISCOVER:
2334         case IP_RECVERR:
2335         case IP_RECVTOS:
2336 #ifdef IP_FREEBIND
2337         case IP_FREEBIND:
2338 #endif
2339         case IP_MULTICAST_TTL:
2340         case IP_MULTICAST_LOOP:
2341             if (get_user_u32(len, optlen))
2342                 return -TARGET_EFAULT;
2343             if (len < 0)
2344                 return -TARGET_EINVAL;
2345             lv = sizeof(lv);
2346             ret = get_errno(getsockopt(sockfd, level, optname, &val, &lv));
2347             if (ret < 0)
2348                 return ret;
2349             if (len < sizeof(int) && len > 0 && val >= 0 && val < 255) {
2350                 len = 1;
2351                 if (put_user_u32(len, optlen)
2352                     || put_user_u8(val, optval_addr))
2353                     return -TARGET_EFAULT;
2354             } else {
2355                 if (len > sizeof(int))
2356                     len = sizeof(int);
2357                 if (put_user_u32(len, optlen)
2358                     || put_user_u32(val, optval_addr))
2359                     return -TARGET_EFAULT;
2360             }
2361             break;
2362         default:
2363             ret = -TARGET_ENOPROTOOPT;
2364             break;
2365         }
2366         break;
2367     case SOL_IPV6:
2368         switch (optname) {
2369         case IPV6_MTU_DISCOVER:
2370         case IPV6_MTU:
2371         case IPV6_V6ONLY:
2372         case IPV6_RECVPKTINFO:
2373         case IPV6_UNICAST_HOPS:
2374         case IPV6_MULTICAST_HOPS:
2375         case IPV6_MULTICAST_LOOP:
2376         case IPV6_RECVERR:
2377         case IPV6_RECVHOPLIMIT:
2378         case IPV6_2292HOPLIMIT:
2379         case IPV6_CHECKSUM:
2380         case IPV6_ADDRFORM:
2381         case IPV6_2292PKTINFO:
2382         case IPV6_RECVTCLASS:
2383         case IPV6_RECVRTHDR:
2384         case IPV6_2292RTHDR:
2385         case IPV6_RECVHOPOPTS:
2386         case IPV6_2292HOPOPTS:
2387         case IPV6_RECVDSTOPTS:
2388         case IPV6_2292DSTOPTS:
2389         case IPV6_TCLASS:
2390 #ifdef IPV6_RECVPATHMTU
2391         case IPV6_RECVPATHMTU:
2392 #endif
2393 #ifdef IPV6_TRANSPARENT
2394         case IPV6_TRANSPARENT:
2395 #endif
2396 #ifdef IPV6_FREEBIND
2397         case IPV6_FREEBIND:
2398 #endif
2399 #ifdef IPV6_RECVORIGDSTADDR
2400         case IPV6_RECVORIGDSTADDR:
2401 #endif
2402             if (get_user_u32(len, optlen))
2403                 return -TARGET_EFAULT;
2404             if (len < 0)
2405                 return -TARGET_EINVAL;
2406             lv = sizeof(lv);
2407             ret = get_errno(getsockopt(sockfd, level, optname, &val, &lv));
2408             if (ret < 0)
2409                 return ret;
2410             if (len < sizeof(int) && len > 0 && val >= 0 && val < 255) {
2411                 len = 1;
2412                 if (put_user_u32(len, optlen)
2413                     || put_user_u8(val, optval_addr))
2414                     return -TARGET_EFAULT;
2415             } else {
2416                 if (len > sizeof(int))
2417                     len = sizeof(int);
2418                 if (put_user_u32(len, optlen)
2419                     || put_user_u32(val, optval_addr))
2420                     return -TARGET_EFAULT;
2421             }
2422             break;
2423         default:
2424             ret = -TARGET_ENOPROTOOPT;
2425             break;
2426         }
2427         break;
2428     default:
2429     unimplemented:
2430         gemu_log("getsockopt level=%d optname=%d not yet supported\n",
2431                  level, optname);
2432         ret = -TARGET_EOPNOTSUPP;
2433         break;
2434     }
2435     return ret;
2436 }
2437 
2438 /* Convert target low/high pair representing file offset into the host
2439  * low/high pair. This function doesn't handle offsets bigger than 64 bits
2440  * as the kernel doesn't handle them either.
2441  */
2442 static void target_to_host_low_high(abi_ulong tlow,
2443                                     abi_ulong thigh,
2444                                     unsigned long *hlow,
2445                                     unsigned long *hhigh)
2446 {
2447     uint64_t off = tlow |
2448         ((unsigned long long)thigh << TARGET_LONG_BITS / 2) <<
2449         TARGET_LONG_BITS / 2;
2450 
2451     *hlow = off;
2452     *hhigh = (off >> HOST_LONG_BITS / 2) >> HOST_LONG_BITS / 2;
2453 }
2454 
2455 static struct iovec *lock_iovec(int type, abi_ulong target_addr,
2456                                 abi_ulong count, int copy)
2457 {
2458     struct target_iovec *target_vec;
2459     struct iovec *vec;
2460     abi_ulong total_len, max_len;
2461     int i;
2462     int err = 0;
2463     bool bad_address = false;
2464 
2465     if (count == 0) {
2466         errno = 0;
2467         return NULL;
2468     }
2469     if (count > IOV_MAX) {
2470         errno = EINVAL;
2471         return NULL;
2472     }
2473 
2474     vec = g_try_new0(struct iovec, count);
2475     if (vec == NULL) {
2476         errno = ENOMEM;
2477         return NULL;
2478     }
2479 
2480     target_vec = lock_user(VERIFY_READ, target_addr,
2481                            count * sizeof(struct target_iovec), 1);
2482     if (target_vec == NULL) {
2483         err = EFAULT;
2484         goto fail2;
2485     }
2486 
2487     /* ??? If host page size > target page size, this will result in a
2488        value larger than what we can actually support.  */
2489     max_len = 0x7fffffff & TARGET_PAGE_MASK;
2490     total_len = 0;
2491 
2492     for (i = 0; i < count; i++) {
2493         abi_ulong base = tswapal(target_vec[i].iov_base);
2494         abi_long len = tswapal(target_vec[i].iov_len);
2495 
2496         if (len < 0) {
2497             err = EINVAL;
2498             goto fail;
2499         } else if (len == 0) {
2500             /* Zero length pointer is ignored.  */
2501             vec[i].iov_base = 0;
2502         } else {
2503             vec[i].iov_base = lock_user(type, base, len, copy);
2504             /* If the first buffer pointer is bad, this is a fault.  But
2505              * subsequent bad buffers will result in a partial write; this
2506              * is realized by filling the vector with null pointers and
2507              * zero lengths. */
2508             if (!vec[i].iov_base) {
2509                 if (i == 0) {
2510                     err = EFAULT;
2511                     goto fail;
2512                 } else {
2513                     bad_address = true;
2514                 }
2515             }
2516             if (bad_address) {
2517                 len = 0;
2518             }
2519             if (len > max_len - total_len) {
2520                 len = max_len - total_len;
2521             }
2522         }
2523         vec[i].iov_len = len;
2524         total_len += len;
2525     }
2526 
2527     unlock_user(target_vec, target_addr, 0);
2528     return vec;
2529 
2530  fail:
2531     while (--i >= 0) {
2532         if (tswapal(target_vec[i].iov_len) > 0) {
2533             unlock_user(vec[i].iov_base, tswapal(target_vec[i].iov_base), 0);
2534         }
2535     }
2536     unlock_user(target_vec, target_addr, 0);
2537  fail2:
2538     g_free(vec);
2539     errno = err;
2540     return NULL;
2541 }
2542 
2543 static void unlock_iovec(struct iovec *vec, abi_ulong target_addr,
2544                          abi_ulong count, int copy)
2545 {
2546     struct target_iovec *target_vec;
2547     int i;
2548 
2549     target_vec = lock_user(VERIFY_READ, target_addr,
2550                            count * sizeof(struct target_iovec), 1);
2551     if (target_vec) {
2552         for (i = 0; i < count; i++) {
2553             abi_ulong base = tswapal(target_vec[i].iov_base);
2554             abi_long len = tswapal(target_vec[i].iov_len);
2555             if (len < 0) {
2556                 break;
2557             }
2558             unlock_user(vec[i].iov_base, base, copy ? vec[i].iov_len : 0);
2559         }
2560         unlock_user(target_vec, target_addr, 0);
2561     }
2562 
2563     g_free(vec);
2564 }
2565 
2566 static inline int target_to_host_sock_type(int *type)
2567 {
2568     int host_type = 0;
2569     int target_type = *type;
2570 
2571     switch (target_type & TARGET_SOCK_TYPE_MASK) {
2572     case TARGET_SOCK_DGRAM:
2573         host_type = SOCK_DGRAM;
2574         break;
2575     case TARGET_SOCK_STREAM:
2576         host_type = SOCK_STREAM;
2577         break;
2578     default:
2579         host_type = target_type & TARGET_SOCK_TYPE_MASK;
2580         break;
2581     }
2582     if (target_type & TARGET_SOCK_CLOEXEC) {
2583 #if defined(SOCK_CLOEXEC)
2584         host_type |= SOCK_CLOEXEC;
2585 #else
2586         return -TARGET_EINVAL;
2587 #endif
2588     }
2589     if (target_type & TARGET_SOCK_NONBLOCK) {
2590 #if defined(SOCK_NONBLOCK)
2591         host_type |= SOCK_NONBLOCK;
2592 #elif !defined(O_NONBLOCK)
2593         return -TARGET_EINVAL;
2594 #endif
2595     }
2596     *type = host_type;
2597     return 0;
2598 }
2599 
2600 /* Try to emulate socket type flags after socket creation.  */
2601 static int sock_flags_fixup(int fd, int target_type)
2602 {
2603 #if !defined(SOCK_NONBLOCK) && defined(O_NONBLOCK)
2604     if (target_type & TARGET_SOCK_NONBLOCK) {
2605         int flags = fcntl(fd, F_GETFL);
2606         if (fcntl(fd, F_SETFL, O_NONBLOCK | flags) == -1) {
2607             close(fd);
2608             return -TARGET_EINVAL;
2609         }
2610     }
2611 #endif
2612     return fd;
2613 }
2614 
2615 /* do_socket() Must return target values and target errnos. */
2616 static abi_long do_socket(int domain, int type, int protocol)
2617 {
2618     int target_type = type;
2619     int ret;
2620 
2621     ret = target_to_host_sock_type(&type);
2622     if (ret) {
2623         return ret;
2624     }
2625 
2626     if (domain == PF_NETLINK && !(
2627 #ifdef CONFIG_RTNETLINK
2628          protocol == NETLINK_ROUTE ||
2629 #endif
2630          protocol == NETLINK_KOBJECT_UEVENT ||
2631          protocol == NETLINK_AUDIT)) {
2632         return -EPFNOSUPPORT;
2633     }
2634 
2635     if (domain == AF_PACKET ||
2636         (domain == AF_INET && type == SOCK_PACKET)) {
2637         protocol = tswap16(protocol);
2638     }
2639 
2640     ret = get_errno(socket(domain, type, protocol));
2641     if (ret >= 0) {
2642         ret = sock_flags_fixup(ret, target_type);
2643         if (type == SOCK_PACKET) {
2644             /* Manage an obsolete case :
2645              * if socket type is SOCK_PACKET, bind by name
2646              */
2647             fd_trans_register(ret, &target_packet_trans);
2648         } else if (domain == PF_NETLINK) {
2649             switch (protocol) {
2650 #ifdef CONFIG_RTNETLINK
2651             case NETLINK_ROUTE:
2652                 fd_trans_register(ret, &target_netlink_route_trans);
2653                 break;
2654 #endif
2655             case NETLINK_KOBJECT_UEVENT:
2656                 /* nothing to do: messages are strings */
2657                 break;
2658             case NETLINK_AUDIT:
2659                 fd_trans_register(ret, &target_netlink_audit_trans);
2660                 break;
2661             default:
2662                 g_assert_not_reached();
2663             }
2664         }
2665     }
2666     return ret;
2667 }
2668 
2669 /* do_bind() Must return target values and target errnos. */
2670 static abi_long do_bind(int sockfd, abi_ulong target_addr,
2671                         socklen_t addrlen)
2672 {
2673     void *addr;
2674     abi_long ret;
2675 
2676     if ((int)addrlen < 0) {
2677         return -TARGET_EINVAL;
2678     }
2679 
2680     addr = alloca(addrlen+1);
2681 
2682     ret = target_to_host_sockaddr(sockfd, addr, target_addr, addrlen);
2683     if (ret)
2684         return ret;
2685 
2686     return get_errno(bind(sockfd, addr, addrlen));
2687 }
2688 
2689 /* do_connect() Must return target values and target errnos. */
2690 static abi_long do_connect(int sockfd, abi_ulong target_addr,
2691                            socklen_t addrlen)
2692 {
2693     void *addr;
2694     abi_long ret;
2695 
2696     if ((int)addrlen < 0) {
2697         return -TARGET_EINVAL;
2698     }
2699 
2700     addr = alloca(addrlen+1);
2701 
2702     ret = target_to_host_sockaddr(sockfd, addr, target_addr, addrlen);
2703     if (ret)
2704         return ret;
2705 
2706     return get_errno(safe_connect(sockfd, addr, addrlen));
2707 }
2708 
2709 /* do_sendrecvmsg_locked() Must return target values and target errnos. */
2710 static abi_long do_sendrecvmsg_locked(int fd, struct target_msghdr *msgp,
2711                                       int flags, int send)
2712 {
2713     abi_long ret, len;
2714     struct msghdr msg;
2715     abi_ulong count;
2716     struct iovec *vec;
2717     abi_ulong target_vec;
2718 
2719     if (msgp->msg_name) {
2720         msg.msg_namelen = tswap32(msgp->msg_namelen);
2721         msg.msg_name = alloca(msg.msg_namelen+1);
2722         ret = target_to_host_sockaddr(fd, msg.msg_name,
2723                                       tswapal(msgp->msg_name),
2724                                       msg.msg_namelen);
2725         if (ret == -TARGET_EFAULT) {
2726             /* For connected sockets msg_name and msg_namelen must
2727              * be ignored, so returning EFAULT immediately is wrong.
2728              * Instead, pass a bad msg_name to the host kernel, and
2729              * let it decide whether to return EFAULT or not.
2730              */
2731             msg.msg_name = (void *)-1;
2732         } else if (ret) {
2733             goto out2;
2734         }
2735     } else {
2736         msg.msg_name = NULL;
2737         msg.msg_namelen = 0;
2738     }
2739     msg.msg_controllen = 2 * tswapal(msgp->msg_controllen);
2740     msg.msg_control = alloca(msg.msg_controllen);
2741     memset(msg.msg_control, 0, msg.msg_controllen);
2742 
2743     msg.msg_flags = tswap32(msgp->msg_flags);
2744 
2745     count = tswapal(msgp->msg_iovlen);
2746     target_vec = tswapal(msgp->msg_iov);
2747 
2748     if (count > IOV_MAX) {
2749         /* sendrcvmsg returns a different errno for this condition than
2750          * readv/writev, so we must catch it here before lock_iovec() does.
2751          */
2752         ret = -TARGET_EMSGSIZE;
2753         goto out2;
2754     }
2755 
2756     vec = lock_iovec(send ? VERIFY_READ : VERIFY_WRITE,
2757                      target_vec, count, send);
2758     if (vec == NULL) {
2759         ret = -host_to_target_errno(errno);
2760         goto out2;
2761     }
2762     msg.msg_iovlen = count;
2763     msg.msg_iov = vec;
2764 
2765     if (send) {
2766         if (fd_trans_target_to_host_data(fd)) {
2767             void *host_msg;
2768 
2769             host_msg = g_malloc(msg.msg_iov->iov_len);
2770             memcpy(host_msg, msg.msg_iov->iov_base, msg.msg_iov->iov_len);
2771             ret = fd_trans_target_to_host_data(fd)(host_msg,
2772                                                    msg.msg_iov->iov_len);
2773             if (ret >= 0) {
2774                 msg.msg_iov->iov_base = host_msg;
2775                 ret = get_errno(safe_sendmsg(fd, &msg, flags));
2776             }
2777             g_free(host_msg);
2778         } else {
2779             ret = target_to_host_cmsg(&msg, msgp);
2780             if (ret == 0) {
2781                 ret = get_errno(safe_sendmsg(fd, &msg, flags));
2782             }
2783         }
2784     } else {
2785         ret = get_errno(safe_recvmsg(fd, &msg, flags));
2786         if (!is_error(ret)) {
2787             len = ret;
2788             if (fd_trans_host_to_target_data(fd)) {
2789                 ret = fd_trans_host_to_target_data(fd)(msg.msg_iov->iov_base,
2790                                                MIN(msg.msg_iov->iov_len, len));
2791             } else {
2792                 ret = host_to_target_cmsg(msgp, &msg);
2793             }
2794             if (!is_error(ret)) {
2795                 msgp->msg_namelen = tswap32(msg.msg_namelen);
2796                 msgp->msg_flags = tswap32(msg.msg_flags);
2797                 if (msg.msg_name != NULL && msg.msg_name != (void *)-1) {
2798                     ret = host_to_target_sockaddr(tswapal(msgp->msg_name),
2799                                     msg.msg_name, msg.msg_namelen);
2800                     if (ret) {
2801                         goto out;
2802                     }
2803                 }
2804 
2805                 ret = len;
2806             }
2807         }
2808     }
2809 
2810 out:
2811     unlock_iovec(vec, target_vec, count, !send);
2812 out2:
2813     return ret;
2814 }
2815 
2816 static abi_long do_sendrecvmsg(int fd, abi_ulong target_msg,
2817                                int flags, int send)
2818 {
2819     abi_long ret;
2820     struct target_msghdr *msgp;
2821 
2822     if (!lock_user_struct(send ? VERIFY_READ : VERIFY_WRITE,
2823                           msgp,
2824                           target_msg,
2825                           send ? 1 : 0)) {
2826         return -TARGET_EFAULT;
2827     }
2828     ret = do_sendrecvmsg_locked(fd, msgp, flags, send);
2829     unlock_user_struct(msgp, target_msg, send ? 0 : 1);
2830     return ret;
2831 }
2832 
2833 /* We don't rely on the C library to have sendmmsg/recvmmsg support,
2834  * so it might not have this *mmsg-specific flag either.
2835  */
2836 #ifndef MSG_WAITFORONE
2837 #define MSG_WAITFORONE 0x10000
2838 #endif
2839 
2840 static abi_long do_sendrecvmmsg(int fd, abi_ulong target_msgvec,
2841                                 unsigned int vlen, unsigned int flags,
2842                                 int send)
2843 {
2844     struct target_mmsghdr *mmsgp;
2845     abi_long ret = 0;
2846     int i;
2847 
2848     if (vlen > UIO_MAXIOV) {
2849         vlen = UIO_MAXIOV;
2850     }
2851 
2852     mmsgp = lock_user(VERIFY_WRITE, target_msgvec, sizeof(*mmsgp) * vlen, 1);
2853     if (!mmsgp) {
2854         return -TARGET_EFAULT;
2855     }
2856 
2857     for (i = 0; i < vlen; i++) {
2858         ret = do_sendrecvmsg_locked(fd, &mmsgp[i].msg_hdr, flags, send);
2859         if (is_error(ret)) {
2860             break;
2861         }
2862         mmsgp[i].msg_len = tswap32(ret);
2863         /* MSG_WAITFORONE turns on MSG_DONTWAIT after one packet */
2864         if (flags & MSG_WAITFORONE) {
2865             flags |= MSG_DONTWAIT;
2866         }
2867     }
2868 
2869     unlock_user(mmsgp, target_msgvec, sizeof(*mmsgp) * i);
2870 
2871     /* Return number of datagrams sent if we sent any at all;
2872      * otherwise return the error.
2873      */
2874     if (i) {
2875         return i;
2876     }
2877     return ret;
2878 }
2879 
2880 /* do_accept4() Must return target values and target errnos. */
2881 static abi_long do_accept4(int fd, abi_ulong target_addr,
2882                            abi_ulong target_addrlen_addr, int flags)
2883 {
2884     socklen_t addrlen, ret_addrlen;
2885     void *addr;
2886     abi_long ret;
2887     int host_flags;
2888 
2889     host_flags = target_to_host_bitmask(flags, fcntl_flags_tbl);
2890 
2891     if (target_addr == 0) {
2892         return get_errno(safe_accept4(fd, NULL, NULL, host_flags));
2893     }
2894 
2895     /* linux returns EINVAL if addrlen pointer is invalid */
2896     if (get_user_u32(addrlen, target_addrlen_addr))
2897         return -TARGET_EINVAL;
2898 
2899     if ((int)addrlen < 0) {
2900         return -TARGET_EINVAL;
2901     }
2902 
2903     if (!access_ok(VERIFY_WRITE, target_addr, addrlen))
2904         return -TARGET_EINVAL;
2905 
2906     addr = alloca(addrlen);
2907 
2908     ret_addrlen = addrlen;
2909     ret = get_errno(safe_accept4(fd, addr, &ret_addrlen, host_flags));
2910     if (!is_error(ret)) {
2911         host_to_target_sockaddr(target_addr, addr, MIN(addrlen, ret_addrlen));
2912         if (put_user_u32(ret_addrlen, target_addrlen_addr)) {
2913             ret = -TARGET_EFAULT;
2914         }
2915     }
2916     return ret;
2917 }
2918 
2919 /* do_getpeername() Must return target values and target errnos. */
2920 static abi_long do_getpeername(int fd, abi_ulong target_addr,
2921                                abi_ulong target_addrlen_addr)
2922 {
2923     socklen_t addrlen, ret_addrlen;
2924     void *addr;
2925     abi_long ret;
2926 
2927     if (get_user_u32(addrlen, target_addrlen_addr))
2928         return -TARGET_EFAULT;
2929 
2930     if ((int)addrlen < 0) {
2931         return -TARGET_EINVAL;
2932     }
2933 
2934     if (!access_ok(VERIFY_WRITE, target_addr, addrlen))
2935         return -TARGET_EFAULT;
2936 
2937     addr = alloca(addrlen);
2938 
2939     ret_addrlen = addrlen;
2940     ret = get_errno(getpeername(fd, addr, &ret_addrlen));
2941     if (!is_error(ret)) {
2942         host_to_target_sockaddr(target_addr, addr, MIN(addrlen, ret_addrlen));
2943         if (put_user_u32(ret_addrlen, target_addrlen_addr)) {
2944             ret = -TARGET_EFAULT;
2945         }
2946     }
2947     return ret;
2948 }
2949 
2950 /* do_getsockname() Must return target values and target errnos. */
2951 static abi_long do_getsockname(int fd, abi_ulong target_addr,
2952                                abi_ulong target_addrlen_addr)
2953 {
2954     socklen_t addrlen, ret_addrlen;
2955     void *addr;
2956     abi_long ret;
2957 
2958     if (get_user_u32(addrlen, target_addrlen_addr))
2959         return -TARGET_EFAULT;
2960 
2961     if ((int)addrlen < 0) {
2962         return -TARGET_EINVAL;
2963     }
2964 
2965     if (!access_ok(VERIFY_WRITE, target_addr, addrlen))
2966         return -TARGET_EFAULT;
2967 
2968     addr = alloca(addrlen);
2969 
2970     ret_addrlen = addrlen;
2971     ret = get_errno(getsockname(fd, addr, &ret_addrlen));
2972     if (!is_error(ret)) {
2973         host_to_target_sockaddr(target_addr, addr, MIN(addrlen, ret_addrlen));
2974         if (put_user_u32(ret_addrlen, target_addrlen_addr)) {
2975             ret = -TARGET_EFAULT;
2976         }
2977     }
2978     return ret;
2979 }
2980 
2981 /* do_socketpair() Must return target values and target errnos. */
2982 static abi_long do_socketpair(int domain, int type, int protocol,
2983                               abi_ulong target_tab_addr)
2984 {
2985     int tab[2];
2986     abi_long ret;
2987 
2988     target_to_host_sock_type(&type);
2989 
2990     ret = get_errno(socketpair(domain, type, protocol, tab));
2991     if (!is_error(ret)) {
2992         if (put_user_s32(tab[0], target_tab_addr)
2993             || put_user_s32(tab[1], target_tab_addr + sizeof(tab[0])))
2994             ret = -TARGET_EFAULT;
2995     }
2996     return ret;
2997 }
2998 
2999 /* do_sendto() Must return target values and target errnos. */
3000 static abi_long do_sendto(int fd, abi_ulong msg, size_t len, int flags,
3001                           abi_ulong target_addr, socklen_t addrlen)
3002 {
3003     void *addr;
3004     void *host_msg;
3005     void *copy_msg = NULL;
3006     abi_long ret;
3007 
3008     if ((int)addrlen < 0) {
3009         return -TARGET_EINVAL;
3010     }
3011 
3012     host_msg = lock_user(VERIFY_READ, msg, len, 1);
3013     if (!host_msg)
3014         return -TARGET_EFAULT;
3015     if (fd_trans_target_to_host_data(fd)) {
3016         copy_msg = host_msg;
3017         host_msg = g_malloc(len);
3018         memcpy(host_msg, copy_msg, len);
3019         ret = fd_trans_target_to_host_data(fd)(host_msg, len);
3020         if (ret < 0) {
3021             goto fail;
3022         }
3023     }
3024     if (target_addr) {
3025         addr = alloca(addrlen+1);
3026         ret = target_to_host_sockaddr(fd, addr, target_addr, addrlen);
3027         if (ret) {
3028             goto fail;
3029         }
3030         ret = get_errno(safe_sendto(fd, host_msg, len, flags, addr, addrlen));
3031     } else {
3032         ret = get_errno(safe_sendto(fd, host_msg, len, flags, NULL, 0));
3033     }
3034 fail:
3035     if (copy_msg) {
3036         g_free(host_msg);
3037         host_msg = copy_msg;
3038     }
3039     unlock_user(host_msg, msg, 0);
3040     return ret;
3041 }
3042 
3043 /* do_recvfrom() Must return target values and target errnos. */
3044 static abi_long do_recvfrom(int fd, abi_ulong msg, size_t len, int flags,
3045                             abi_ulong target_addr,
3046                             abi_ulong target_addrlen)
3047 {
3048     socklen_t addrlen, ret_addrlen;
3049     void *addr;
3050     void *host_msg;
3051     abi_long ret;
3052 
3053     host_msg = lock_user(VERIFY_WRITE, msg, len, 0);
3054     if (!host_msg)
3055         return -TARGET_EFAULT;
3056     if (target_addr) {
3057         if (get_user_u32(addrlen, target_addrlen)) {
3058             ret = -TARGET_EFAULT;
3059             goto fail;
3060         }
3061         if ((int)addrlen < 0) {
3062             ret = -TARGET_EINVAL;
3063             goto fail;
3064         }
3065         addr = alloca(addrlen);
3066         ret_addrlen = addrlen;
3067         ret = get_errno(safe_recvfrom(fd, host_msg, len, flags,
3068                                       addr, &ret_addrlen));
3069     } else {
3070         addr = NULL; /* To keep compiler quiet.  */
3071         addrlen = 0; /* To keep compiler quiet.  */
3072         ret = get_errno(safe_recvfrom(fd, host_msg, len, flags, NULL, 0));
3073     }
3074     if (!is_error(ret)) {
3075         if (fd_trans_host_to_target_data(fd)) {
3076             abi_long trans;
3077             trans = fd_trans_host_to_target_data(fd)(host_msg, MIN(ret, len));
3078             if (is_error(trans)) {
3079                 ret = trans;
3080                 goto fail;
3081             }
3082         }
3083         if (target_addr) {
3084             host_to_target_sockaddr(target_addr, addr,
3085                                     MIN(addrlen, ret_addrlen));
3086             if (put_user_u32(ret_addrlen, target_addrlen)) {
3087                 ret = -TARGET_EFAULT;
3088                 goto fail;
3089             }
3090         }
3091         unlock_user(host_msg, msg, len);
3092     } else {
3093 fail:
3094         unlock_user(host_msg, msg, 0);
3095     }
3096     return ret;
3097 }
3098 
3099 #ifdef TARGET_NR_socketcall
3100 /* do_socketcall() must return target values and target errnos. */
3101 static abi_long do_socketcall(int num, abi_ulong vptr)
3102 {
3103     static const unsigned nargs[] = { /* number of arguments per operation */
3104         [TARGET_SYS_SOCKET] = 3,      /* domain, type, protocol */
3105         [TARGET_SYS_BIND] = 3,        /* fd, addr, addrlen */
3106         [TARGET_SYS_CONNECT] = 3,     /* fd, addr, addrlen */
3107         [TARGET_SYS_LISTEN] = 2,      /* fd, backlog */
3108         [TARGET_SYS_ACCEPT] = 3,      /* fd, addr, addrlen */
3109         [TARGET_SYS_GETSOCKNAME] = 3, /* fd, addr, addrlen */
3110         [TARGET_SYS_GETPEERNAME] = 3, /* fd, addr, addrlen */
3111         [TARGET_SYS_SOCKETPAIR] = 4,  /* domain, type, protocol, tab */
3112         [TARGET_SYS_SEND] = 4,        /* fd, msg, len, flags */
3113         [TARGET_SYS_RECV] = 4,        /* fd, msg, len, flags */
3114         [TARGET_SYS_SENDTO] = 6,      /* fd, msg, len, flags, addr, addrlen */
3115         [TARGET_SYS_RECVFROM] = 6,    /* fd, msg, len, flags, addr, addrlen */
3116         [TARGET_SYS_SHUTDOWN] = 2,    /* fd, how */
3117         [TARGET_SYS_SETSOCKOPT] = 5,  /* fd, level, optname, optval, optlen */
3118         [TARGET_SYS_GETSOCKOPT] = 5,  /* fd, level, optname, optval, optlen */
3119         [TARGET_SYS_SENDMSG] = 3,     /* fd, msg, flags */
3120         [TARGET_SYS_RECVMSG] = 3,     /* fd, msg, flags */
3121         [TARGET_SYS_ACCEPT4] = 4,     /* fd, addr, addrlen, flags */
3122         [TARGET_SYS_RECVMMSG] = 4,    /* fd, msgvec, vlen, flags */
3123         [TARGET_SYS_SENDMMSG] = 4,    /* fd, msgvec, vlen, flags */
3124     };
3125     abi_long a[6]; /* max 6 args */
3126     unsigned i;
3127 
3128     /* check the range of the first argument num */
3129     /* (TARGET_SYS_SENDMMSG is the highest among TARGET_SYS_xxx) */
3130     if (num < 1 || num > TARGET_SYS_SENDMMSG) {
3131         return -TARGET_EINVAL;
3132     }
3133     /* ensure we have space for args */
3134     if (nargs[num] > ARRAY_SIZE(a)) {
3135         return -TARGET_EINVAL;
3136     }
3137     /* collect the arguments in a[] according to nargs[] */
3138     for (i = 0; i < nargs[num]; ++i) {
3139         if (get_user_ual(a[i], vptr + i * sizeof(abi_long)) != 0) {
3140             return -TARGET_EFAULT;
3141         }
3142     }
3143     /* now when we have the args, invoke the appropriate underlying function */
3144     switch (num) {
3145     case TARGET_SYS_SOCKET: /* domain, type, protocol */
3146         return do_socket(a[0], a[1], a[2]);
3147     case TARGET_SYS_BIND: /* sockfd, addr, addrlen */
3148         return do_bind(a[0], a[1], a[2]);
3149     case TARGET_SYS_CONNECT: /* sockfd, addr, addrlen */
3150         return do_connect(a[0], a[1], a[2]);
3151     case TARGET_SYS_LISTEN: /* sockfd, backlog */
3152         return get_errno(listen(a[0], a[1]));
3153     case TARGET_SYS_ACCEPT: /* sockfd, addr, addrlen */
3154         return do_accept4(a[0], a[1], a[2], 0);
3155     case TARGET_SYS_GETSOCKNAME: /* sockfd, addr, addrlen */
3156         return do_getsockname(a[0], a[1], a[2]);
3157     case TARGET_SYS_GETPEERNAME: /* sockfd, addr, addrlen */
3158         return do_getpeername(a[0], a[1], a[2]);
3159     case TARGET_SYS_SOCKETPAIR: /* domain, type, protocol, tab */
3160         return do_socketpair(a[0], a[1], a[2], a[3]);
3161     case TARGET_SYS_SEND: /* sockfd, msg, len, flags */
3162         return do_sendto(a[0], a[1], a[2], a[3], 0, 0);
3163     case TARGET_SYS_RECV: /* sockfd, msg, len, flags */
3164         return do_recvfrom(a[0], a[1], a[2], a[3], 0, 0);
3165     case TARGET_SYS_SENDTO: /* sockfd, msg, len, flags, addr, addrlen */
3166         return do_sendto(a[0], a[1], a[2], a[3], a[4], a[5]);
3167     case TARGET_SYS_RECVFROM: /* sockfd, msg, len, flags, addr, addrlen */
3168         return do_recvfrom(a[0], a[1], a[2], a[3], a[4], a[5]);
3169     case TARGET_SYS_SHUTDOWN: /* sockfd, how */
3170         return get_errno(shutdown(a[0], a[1]));
3171     case TARGET_SYS_SETSOCKOPT: /* sockfd, level, optname, optval, optlen */
3172         return do_setsockopt(a[0], a[1], a[2], a[3], a[4]);
3173     case TARGET_SYS_GETSOCKOPT: /* sockfd, level, optname, optval, optlen */
3174         return do_getsockopt(a[0], a[1], a[2], a[3], a[4]);
3175     case TARGET_SYS_SENDMSG: /* sockfd, msg, flags */
3176         return do_sendrecvmsg(a[0], a[1], a[2], 1);
3177     case TARGET_SYS_RECVMSG: /* sockfd, msg, flags */
3178         return do_sendrecvmsg(a[0], a[1], a[2], 0);
3179     case TARGET_SYS_ACCEPT4: /* sockfd, addr, addrlen, flags */
3180         return do_accept4(a[0], a[1], a[2], a[3]);
3181     case TARGET_SYS_RECVMMSG: /* sockfd, msgvec, vlen, flags */
3182         return do_sendrecvmmsg(a[0], a[1], a[2], a[3], 0);
3183     case TARGET_SYS_SENDMMSG: /* sockfd, msgvec, vlen, flags */
3184         return do_sendrecvmmsg(a[0], a[1], a[2], a[3], 1);
3185     default:
3186         gemu_log("Unsupported socketcall: %d\n", num);
3187         return -TARGET_EINVAL;
3188     }
3189 }
3190 #endif
3191 
3192 #define N_SHM_REGIONS	32
3193 
3194 static struct shm_region {
3195     abi_ulong start;
3196     abi_ulong size;
3197     bool in_use;
3198 } shm_regions[N_SHM_REGIONS];
3199 
3200 #ifndef TARGET_SEMID64_DS
3201 /* asm-generic version of this struct */
3202 struct target_semid64_ds
3203 {
3204   struct target_ipc_perm sem_perm;
3205   abi_ulong sem_otime;
3206 #if TARGET_ABI_BITS == 32
3207   abi_ulong __unused1;
3208 #endif
3209   abi_ulong sem_ctime;
3210 #if TARGET_ABI_BITS == 32
3211   abi_ulong __unused2;
3212 #endif
3213   abi_ulong sem_nsems;
3214   abi_ulong __unused3;
3215   abi_ulong __unused4;
3216 };
3217 #endif
3218 
3219 static inline abi_long target_to_host_ipc_perm(struct ipc_perm *host_ip,
3220                                                abi_ulong target_addr)
3221 {
3222     struct target_ipc_perm *target_ip;
3223     struct target_semid64_ds *target_sd;
3224 
3225     if (!lock_user_struct(VERIFY_READ, target_sd, target_addr, 1))
3226         return -TARGET_EFAULT;
3227     target_ip = &(target_sd->sem_perm);
3228     host_ip->__key = tswap32(target_ip->__key);
3229     host_ip->uid = tswap32(target_ip->uid);
3230     host_ip->gid = tswap32(target_ip->gid);
3231     host_ip->cuid = tswap32(target_ip->cuid);
3232     host_ip->cgid = tswap32(target_ip->cgid);
3233 #if defined(TARGET_ALPHA) || defined(TARGET_MIPS) || defined(TARGET_PPC)
3234     host_ip->mode = tswap32(target_ip->mode);
3235 #else
3236     host_ip->mode = tswap16(target_ip->mode);
3237 #endif
3238 #if defined(TARGET_PPC)
3239     host_ip->__seq = tswap32(target_ip->__seq);
3240 #else
3241     host_ip->__seq = tswap16(target_ip->__seq);
3242 #endif
3243     unlock_user_struct(target_sd, target_addr, 0);
3244     return 0;
3245 }
3246 
3247 static inline abi_long host_to_target_ipc_perm(abi_ulong target_addr,
3248                                                struct ipc_perm *host_ip)
3249 {
3250     struct target_ipc_perm *target_ip;
3251     struct target_semid64_ds *target_sd;
3252 
3253     if (!lock_user_struct(VERIFY_WRITE, target_sd, target_addr, 0))
3254         return -TARGET_EFAULT;
3255     target_ip = &(target_sd->sem_perm);
3256     target_ip->__key = tswap32(host_ip->__key);
3257     target_ip->uid = tswap32(host_ip->uid);
3258     target_ip->gid = tswap32(host_ip->gid);
3259     target_ip->cuid = tswap32(host_ip->cuid);
3260     target_ip->cgid = tswap32(host_ip->cgid);
3261 #if defined(TARGET_ALPHA) || defined(TARGET_MIPS) || defined(TARGET_PPC)
3262     target_ip->mode = tswap32(host_ip->mode);
3263 #else
3264     target_ip->mode = tswap16(host_ip->mode);
3265 #endif
3266 #if defined(TARGET_PPC)
3267     target_ip->__seq = tswap32(host_ip->__seq);
3268 #else
3269     target_ip->__seq = tswap16(host_ip->__seq);
3270 #endif
3271     unlock_user_struct(target_sd, target_addr, 1);
3272     return 0;
3273 }
3274 
3275 static inline abi_long target_to_host_semid_ds(struct semid_ds *host_sd,
3276                                                abi_ulong target_addr)
3277 {
3278     struct target_semid64_ds *target_sd;
3279 
3280     if (!lock_user_struct(VERIFY_READ, target_sd, target_addr, 1))
3281         return -TARGET_EFAULT;
3282     if (target_to_host_ipc_perm(&(host_sd->sem_perm),target_addr))
3283         return -TARGET_EFAULT;
3284     host_sd->sem_nsems = tswapal(target_sd->sem_nsems);
3285     host_sd->sem_otime = tswapal(target_sd->sem_otime);
3286     host_sd->sem_ctime = tswapal(target_sd->sem_ctime);
3287     unlock_user_struct(target_sd, target_addr, 0);
3288     return 0;
3289 }
3290 
3291 static inline abi_long host_to_target_semid_ds(abi_ulong target_addr,
3292                                                struct semid_ds *host_sd)
3293 {
3294     struct target_semid64_ds *target_sd;
3295 
3296     if (!lock_user_struct(VERIFY_WRITE, target_sd, target_addr, 0))
3297         return -TARGET_EFAULT;
3298     if (host_to_target_ipc_perm(target_addr,&(host_sd->sem_perm)))
3299         return -TARGET_EFAULT;
3300     target_sd->sem_nsems = tswapal(host_sd->sem_nsems);
3301     target_sd->sem_otime = tswapal(host_sd->sem_otime);
3302     target_sd->sem_ctime = tswapal(host_sd->sem_ctime);
3303     unlock_user_struct(target_sd, target_addr, 1);
3304     return 0;
3305 }
3306 
3307 struct target_seminfo {
3308     int semmap;
3309     int semmni;
3310     int semmns;
3311     int semmnu;
3312     int semmsl;
3313     int semopm;
3314     int semume;
3315     int semusz;
3316     int semvmx;
3317     int semaem;
3318 };
3319 
3320 static inline abi_long host_to_target_seminfo(abi_ulong target_addr,
3321                                               struct seminfo *host_seminfo)
3322 {
3323     struct target_seminfo *target_seminfo;
3324     if (!lock_user_struct(VERIFY_WRITE, target_seminfo, target_addr, 0))
3325         return -TARGET_EFAULT;
3326     __put_user(host_seminfo->semmap, &target_seminfo->semmap);
3327     __put_user(host_seminfo->semmni, &target_seminfo->semmni);
3328     __put_user(host_seminfo->semmns, &target_seminfo->semmns);
3329     __put_user(host_seminfo->semmnu, &target_seminfo->semmnu);
3330     __put_user(host_seminfo->semmsl, &target_seminfo->semmsl);
3331     __put_user(host_seminfo->semopm, &target_seminfo->semopm);
3332     __put_user(host_seminfo->semume, &target_seminfo->semume);
3333     __put_user(host_seminfo->semusz, &target_seminfo->semusz);
3334     __put_user(host_seminfo->semvmx, &target_seminfo->semvmx);
3335     __put_user(host_seminfo->semaem, &target_seminfo->semaem);
3336     unlock_user_struct(target_seminfo, target_addr, 1);
3337     return 0;
3338 }
3339 
3340 union semun {
3341 	int val;
3342 	struct semid_ds *buf;
3343 	unsigned short *array;
3344 	struct seminfo *__buf;
3345 };
3346 
3347 union target_semun {
3348 	int val;
3349 	abi_ulong buf;
3350 	abi_ulong array;
3351 	abi_ulong __buf;
3352 };
3353 
3354 static inline abi_long target_to_host_semarray(int semid, unsigned short **host_array,
3355                                                abi_ulong target_addr)
3356 {
3357     int nsems;
3358     unsigned short *array;
3359     union semun semun;
3360     struct semid_ds semid_ds;
3361     int i, ret;
3362 
3363     semun.buf = &semid_ds;
3364 
3365     ret = semctl(semid, 0, IPC_STAT, semun);
3366     if (ret == -1)
3367         return get_errno(ret);
3368 
3369     nsems = semid_ds.sem_nsems;
3370 
3371     *host_array = g_try_new(unsigned short, nsems);
3372     if (!*host_array) {
3373         return -TARGET_ENOMEM;
3374     }
3375     array = lock_user(VERIFY_READ, target_addr,
3376                       nsems*sizeof(unsigned short), 1);
3377     if (!array) {
3378         g_free(*host_array);
3379         return -TARGET_EFAULT;
3380     }
3381 
3382     for(i=0; i<nsems; i++) {
3383         __get_user((*host_array)[i], &array[i]);
3384     }
3385     unlock_user(array, target_addr, 0);
3386 
3387     return 0;
3388 }
3389 
3390 static inline abi_long host_to_target_semarray(int semid, abi_ulong target_addr,
3391                                                unsigned short **host_array)
3392 {
3393     int nsems;
3394     unsigned short *array;
3395     union semun semun;
3396     struct semid_ds semid_ds;
3397     int i, ret;
3398 
3399     semun.buf = &semid_ds;
3400 
3401     ret = semctl(semid, 0, IPC_STAT, semun);
3402     if (ret == -1)
3403         return get_errno(ret);
3404 
3405     nsems = semid_ds.sem_nsems;
3406 
3407     array = lock_user(VERIFY_WRITE, target_addr,
3408                       nsems*sizeof(unsigned short), 0);
3409     if (!array)
3410         return -TARGET_EFAULT;
3411 
3412     for(i=0; i<nsems; i++) {
3413         __put_user((*host_array)[i], &array[i]);
3414     }
3415     g_free(*host_array);
3416     unlock_user(array, target_addr, 1);
3417 
3418     return 0;
3419 }
3420 
3421 static inline abi_long do_semctl(int semid, int semnum, int cmd,
3422                                  abi_ulong target_arg)
3423 {
3424     union target_semun target_su = { .buf = target_arg };
3425     union semun arg;
3426     struct semid_ds dsarg;
3427     unsigned short *array = NULL;
3428     struct seminfo seminfo;
3429     abi_long ret = -TARGET_EINVAL;
3430     abi_long err;
3431     cmd &= 0xff;
3432 
3433     switch( cmd ) {
3434 	case GETVAL:
3435 	case SETVAL:
3436             /* In 64 bit cross-endian situations, we will erroneously pick up
3437              * the wrong half of the union for the "val" element.  To rectify
3438              * this, the entire 8-byte structure is byteswapped, followed by
3439 	     * a swap of the 4 byte val field. In other cases, the data is
3440 	     * already in proper host byte order. */
3441 	    if (sizeof(target_su.val) != (sizeof(target_su.buf))) {
3442 		target_su.buf = tswapal(target_su.buf);
3443 		arg.val = tswap32(target_su.val);
3444 	    } else {
3445 		arg.val = target_su.val;
3446 	    }
3447             ret = get_errno(semctl(semid, semnum, cmd, arg));
3448             break;
3449 	case GETALL:
3450 	case SETALL:
3451             err = target_to_host_semarray(semid, &array, target_su.array);
3452             if (err)
3453                 return err;
3454             arg.array = array;
3455             ret = get_errno(semctl(semid, semnum, cmd, arg));
3456             err = host_to_target_semarray(semid, target_su.array, &array);
3457             if (err)
3458                 return err;
3459             break;
3460 	case IPC_STAT:
3461 	case IPC_SET:
3462 	case SEM_STAT:
3463             err = target_to_host_semid_ds(&dsarg, target_su.buf);
3464             if (err)
3465                 return err;
3466             arg.buf = &dsarg;
3467             ret = get_errno(semctl(semid, semnum, cmd, arg));
3468             err = host_to_target_semid_ds(target_su.buf, &dsarg);
3469             if (err)
3470                 return err;
3471             break;
3472 	case IPC_INFO:
3473 	case SEM_INFO:
3474             arg.__buf = &seminfo;
3475             ret = get_errno(semctl(semid, semnum, cmd, arg));
3476             err = host_to_target_seminfo(target_su.__buf, &seminfo);
3477             if (err)
3478                 return err;
3479             break;
3480 	case IPC_RMID:
3481 	case GETPID:
3482 	case GETNCNT:
3483 	case GETZCNT:
3484             ret = get_errno(semctl(semid, semnum, cmd, NULL));
3485             break;
3486     }
3487 
3488     return ret;
3489 }
3490 
3491 struct target_sembuf {
3492     unsigned short sem_num;
3493     short sem_op;
3494     short sem_flg;
3495 };
3496 
3497 static inline abi_long target_to_host_sembuf(struct sembuf *host_sembuf,
3498                                              abi_ulong target_addr,
3499                                              unsigned nsops)
3500 {
3501     struct target_sembuf *target_sembuf;
3502     int i;
3503 
3504     target_sembuf = lock_user(VERIFY_READ, target_addr,
3505                               nsops*sizeof(struct target_sembuf), 1);
3506     if (!target_sembuf)
3507         return -TARGET_EFAULT;
3508 
3509     for(i=0; i<nsops; i++) {
3510         __get_user(host_sembuf[i].sem_num, &target_sembuf[i].sem_num);
3511         __get_user(host_sembuf[i].sem_op, &target_sembuf[i].sem_op);
3512         __get_user(host_sembuf[i].sem_flg, &target_sembuf[i].sem_flg);
3513     }
3514 
3515     unlock_user(target_sembuf, target_addr, 0);
3516 
3517     return 0;
3518 }
3519 
3520 static inline abi_long do_semop(int semid, abi_long ptr, unsigned nsops)
3521 {
3522     struct sembuf sops[nsops];
3523 
3524     if (target_to_host_sembuf(sops, ptr, nsops))
3525         return -TARGET_EFAULT;
3526 
3527     return get_errno(safe_semtimedop(semid, sops, nsops, NULL));
3528 }
3529 
3530 struct target_msqid_ds
3531 {
3532     struct target_ipc_perm msg_perm;
3533     abi_ulong msg_stime;
3534 #if TARGET_ABI_BITS == 32
3535     abi_ulong __unused1;
3536 #endif
3537     abi_ulong msg_rtime;
3538 #if TARGET_ABI_BITS == 32
3539     abi_ulong __unused2;
3540 #endif
3541     abi_ulong msg_ctime;
3542 #if TARGET_ABI_BITS == 32
3543     abi_ulong __unused3;
3544 #endif
3545     abi_ulong __msg_cbytes;
3546     abi_ulong msg_qnum;
3547     abi_ulong msg_qbytes;
3548     abi_ulong msg_lspid;
3549     abi_ulong msg_lrpid;
3550     abi_ulong __unused4;
3551     abi_ulong __unused5;
3552 };
3553 
3554 static inline abi_long target_to_host_msqid_ds(struct msqid_ds *host_md,
3555                                                abi_ulong target_addr)
3556 {
3557     struct target_msqid_ds *target_md;
3558 
3559     if (!lock_user_struct(VERIFY_READ, target_md, target_addr, 1))
3560         return -TARGET_EFAULT;
3561     if (target_to_host_ipc_perm(&(host_md->msg_perm),target_addr))
3562         return -TARGET_EFAULT;
3563     host_md->msg_stime = tswapal(target_md->msg_stime);
3564     host_md->msg_rtime = tswapal(target_md->msg_rtime);
3565     host_md->msg_ctime = tswapal(target_md->msg_ctime);
3566     host_md->__msg_cbytes = tswapal(target_md->__msg_cbytes);
3567     host_md->msg_qnum = tswapal(target_md->msg_qnum);
3568     host_md->msg_qbytes = tswapal(target_md->msg_qbytes);
3569     host_md->msg_lspid = tswapal(target_md->msg_lspid);
3570     host_md->msg_lrpid = tswapal(target_md->msg_lrpid);
3571     unlock_user_struct(target_md, target_addr, 0);
3572     return 0;
3573 }
3574 
3575 static inline abi_long host_to_target_msqid_ds(abi_ulong target_addr,
3576                                                struct msqid_ds *host_md)
3577 {
3578     struct target_msqid_ds *target_md;
3579 
3580     if (!lock_user_struct(VERIFY_WRITE, target_md, target_addr, 0))
3581         return -TARGET_EFAULT;
3582     if (host_to_target_ipc_perm(target_addr,&(host_md->msg_perm)))
3583         return -TARGET_EFAULT;
3584     target_md->msg_stime = tswapal(host_md->msg_stime);
3585     target_md->msg_rtime = tswapal(host_md->msg_rtime);
3586     target_md->msg_ctime = tswapal(host_md->msg_ctime);
3587     target_md->__msg_cbytes = tswapal(host_md->__msg_cbytes);
3588     target_md->msg_qnum = tswapal(host_md->msg_qnum);
3589     target_md->msg_qbytes = tswapal(host_md->msg_qbytes);
3590     target_md->msg_lspid = tswapal(host_md->msg_lspid);
3591     target_md->msg_lrpid = tswapal(host_md->msg_lrpid);
3592     unlock_user_struct(target_md, target_addr, 1);
3593     return 0;
3594 }
3595 
3596 struct target_msginfo {
3597     int msgpool;
3598     int msgmap;
3599     int msgmax;
3600     int msgmnb;
3601     int msgmni;
3602     int msgssz;
3603     int msgtql;
3604     unsigned short int msgseg;
3605 };
3606 
3607 static inline abi_long host_to_target_msginfo(abi_ulong target_addr,
3608                                               struct msginfo *host_msginfo)
3609 {
3610     struct target_msginfo *target_msginfo;
3611     if (!lock_user_struct(VERIFY_WRITE, target_msginfo, target_addr, 0))
3612         return -TARGET_EFAULT;
3613     __put_user(host_msginfo->msgpool, &target_msginfo->msgpool);
3614     __put_user(host_msginfo->msgmap, &target_msginfo->msgmap);
3615     __put_user(host_msginfo->msgmax, &target_msginfo->msgmax);
3616     __put_user(host_msginfo->msgmnb, &target_msginfo->msgmnb);
3617     __put_user(host_msginfo->msgmni, &target_msginfo->msgmni);
3618     __put_user(host_msginfo->msgssz, &target_msginfo->msgssz);
3619     __put_user(host_msginfo->msgtql, &target_msginfo->msgtql);
3620     __put_user(host_msginfo->msgseg, &target_msginfo->msgseg);
3621     unlock_user_struct(target_msginfo, target_addr, 1);
3622     return 0;
3623 }
3624 
3625 static inline abi_long do_msgctl(int msgid, int cmd, abi_long ptr)
3626 {
3627     struct msqid_ds dsarg;
3628     struct msginfo msginfo;
3629     abi_long ret = -TARGET_EINVAL;
3630 
3631     cmd &= 0xff;
3632 
3633     switch (cmd) {
3634     case IPC_STAT:
3635     case IPC_SET:
3636     case MSG_STAT:
3637         if (target_to_host_msqid_ds(&dsarg,ptr))
3638             return -TARGET_EFAULT;
3639         ret = get_errno(msgctl(msgid, cmd, &dsarg));
3640         if (host_to_target_msqid_ds(ptr,&dsarg))
3641             return -TARGET_EFAULT;
3642         break;
3643     case IPC_RMID:
3644         ret = get_errno(msgctl(msgid, cmd, NULL));
3645         break;
3646     case IPC_INFO:
3647     case MSG_INFO:
3648         ret = get_errno(msgctl(msgid, cmd, (struct msqid_ds *)&msginfo));
3649         if (host_to_target_msginfo(ptr, &msginfo))
3650             return -TARGET_EFAULT;
3651         break;
3652     }
3653 
3654     return ret;
3655 }
3656 
3657 struct target_msgbuf {
3658     abi_long mtype;
3659     char	mtext[1];
3660 };
3661 
3662 static inline abi_long do_msgsnd(int msqid, abi_long msgp,
3663                                  ssize_t msgsz, int msgflg)
3664 {
3665     struct target_msgbuf *target_mb;
3666     struct msgbuf *host_mb;
3667     abi_long ret = 0;
3668 
3669     if (msgsz < 0) {
3670         return -TARGET_EINVAL;
3671     }
3672 
3673     if (!lock_user_struct(VERIFY_READ, target_mb, msgp, 0))
3674         return -TARGET_EFAULT;
3675     host_mb = g_try_malloc(msgsz + sizeof(long));
3676     if (!host_mb) {
3677         unlock_user_struct(target_mb, msgp, 0);
3678         return -TARGET_ENOMEM;
3679     }
3680     host_mb->mtype = (abi_long) tswapal(target_mb->mtype);
3681     memcpy(host_mb->mtext, target_mb->mtext, msgsz);
3682     ret = get_errno(safe_msgsnd(msqid, host_mb, msgsz, msgflg));
3683     g_free(host_mb);
3684     unlock_user_struct(target_mb, msgp, 0);
3685 
3686     return ret;
3687 }
3688 
3689 static inline abi_long do_msgrcv(int msqid, abi_long msgp,
3690                                  ssize_t msgsz, abi_long msgtyp,
3691                                  int msgflg)
3692 {
3693     struct target_msgbuf *target_mb;
3694     char *target_mtext;
3695     struct msgbuf *host_mb;
3696     abi_long ret = 0;
3697 
3698     if (msgsz < 0) {
3699         return -TARGET_EINVAL;
3700     }
3701 
3702     if (!lock_user_struct(VERIFY_WRITE, target_mb, msgp, 0))
3703         return -TARGET_EFAULT;
3704 
3705     host_mb = g_try_malloc(msgsz + sizeof(long));
3706     if (!host_mb) {
3707         ret = -TARGET_ENOMEM;
3708         goto end;
3709     }
3710     ret = get_errno(safe_msgrcv(msqid, host_mb, msgsz, msgtyp, msgflg));
3711 
3712     if (ret > 0) {
3713         abi_ulong target_mtext_addr = msgp + sizeof(abi_ulong);
3714         target_mtext = lock_user(VERIFY_WRITE, target_mtext_addr, ret, 0);
3715         if (!target_mtext) {
3716             ret = -TARGET_EFAULT;
3717             goto end;
3718         }
3719         memcpy(target_mb->mtext, host_mb->mtext, ret);
3720         unlock_user(target_mtext, target_mtext_addr, ret);
3721     }
3722 
3723     target_mb->mtype = tswapal(host_mb->mtype);
3724 
3725 end:
3726     if (target_mb)
3727         unlock_user_struct(target_mb, msgp, 1);
3728     g_free(host_mb);
3729     return ret;
3730 }
3731 
3732 static inline abi_long target_to_host_shmid_ds(struct shmid_ds *host_sd,
3733                                                abi_ulong target_addr)
3734 {
3735     struct target_shmid_ds *target_sd;
3736 
3737     if (!lock_user_struct(VERIFY_READ, target_sd, target_addr, 1))
3738         return -TARGET_EFAULT;
3739     if (target_to_host_ipc_perm(&(host_sd->shm_perm), target_addr))
3740         return -TARGET_EFAULT;
3741     __get_user(host_sd->shm_segsz, &target_sd->shm_segsz);
3742     __get_user(host_sd->shm_atime, &target_sd->shm_atime);
3743     __get_user(host_sd->shm_dtime, &target_sd->shm_dtime);
3744     __get_user(host_sd->shm_ctime, &target_sd->shm_ctime);
3745     __get_user(host_sd->shm_cpid, &target_sd->shm_cpid);
3746     __get_user(host_sd->shm_lpid, &target_sd->shm_lpid);
3747     __get_user(host_sd->shm_nattch, &target_sd->shm_nattch);
3748     unlock_user_struct(target_sd, target_addr, 0);
3749     return 0;
3750 }
3751 
3752 static inline abi_long host_to_target_shmid_ds(abi_ulong target_addr,
3753                                                struct shmid_ds *host_sd)
3754 {
3755     struct target_shmid_ds *target_sd;
3756 
3757     if (!lock_user_struct(VERIFY_WRITE, target_sd, target_addr, 0))
3758         return -TARGET_EFAULT;
3759     if (host_to_target_ipc_perm(target_addr, &(host_sd->shm_perm)))
3760         return -TARGET_EFAULT;
3761     __put_user(host_sd->shm_segsz, &target_sd->shm_segsz);
3762     __put_user(host_sd->shm_atime, &target_sd->shm_atime);
3763     __put_user(host_sd->shm_dtime, &target_sd->shm_dtime);
3764     __put_user(host_sd->shm_ctime, &target_sd->shm_ctime);
3765     __put_user(host_sd->shm_cpid, &target_sd->shm_cpid);
3766     __put_user(host_sd->shm_lpid, &target_sd->shm_lpid);
3767     __put_user(host_sd->shm_nattch, &target_sd->shm_nattch);
3768     unlock_user_struct(target_sd, target_addr, 1);
3769     return 0;
3770 }
3771 
3772 struct  target_shminfo {
3773     abi_ulong shmmax;
3774     abi_ulong shmmin;
3775     abi_ulong shmmni;
3776     abi_ulong shmseg;
3777     abi_ulong shmall;
3778 };
3779 
3780 static inline abi_long host_to_target_shminfo(abi_ulong target_addr,
3781                                               struct shminfo *host_shminfo)
3782 {
3783     struct target_shminfo *target_shminfo;
3784     if (!lock_user_struct(VERIFY_WRITE, target_shminfo, target_addr, 0))
3785         return -TARGET_EFAULT;
3786     __put_user(host_shminfo->shmmax, &target_shminfo->shmmax);
3787     __put_user(host_shminfo->shmmin, &target_shminfo->shmmin);
3788     __put_user(host_shminfo->shmmni, &target_shminfo->shmmni);
3789     __put_user(host_shminfo->shmseg, &target_shminfo->shmseg);
3790     __put_user(host_shminfo->shmall, &target_shminfo->shmall);
3791     unlock_user_struct(target_shminfo, target_addr, 1);
3792     return 0;
3793 }
3794 
3795 struct target_shm_info {
3796     int used_ids;
3797     abi_ulong shm_tot;
3798     abi_ulong shm_rss;
3799     abi_ulong shm_swp;
3800     abi_ulong swap_attempts;
3801     abi_ulong swap_successes;
3802 };
3803 
3804 static inline abi_long host_to_target_shm_info(abi_ulong target_addr,
3805                                                struct shm_info *host_shm_info)
3806 {
3807     struct target_shm_info *target_shm_info;
3808     if (!lock_user_struct(VERIFY_WRITE, target_shm_info, target_addr, 0))
3809         return -TARGET_EFAULT;
3810     __put_user(host_shm_info->used_ids, &target_shm_info->used_ids);
3811     __put_user(host_shm_info->shm_tot, &target_shm_info->shm_tot);
3812     __put_user(host_shm_info->shm_rss, &target_shm_info->shm_rss);
3813     __put_user(host_shm_info->shm_swp, &target_shm_info->shm_swp);
3814     __put_user(host_shm_info->swap_attempts, &target_shm_info->swap_attempts);
3815     __put_user(host_shm_info->swap_successes, &target_shm_info->swap_successes);
3816     unlock_user_struct(target_shm_info, target_addr, 1);
3817     return 0;
3818 }
3819 
3820 static inline abi_long do_shmctl(int shmid, int cmd, abi_long buf)
3821 {
3822     struct shmid_ds dsarg;
3823     struct shminfo shminfo;
3824     struct shm_info shm_info;
3825     abi_long ret = -TARGET_EINVAL;
3826 
3827     cmd &= 0xff;
3828 
3829     switch(cmd) {
3830     case IPC_STAT:
3831     case IPC_SET:
3832     case SHM_STAT:
3833         if (target_to_host_shmid_ds(&dsarg, buf))
3834             return -TARGET_EFAULT;
3835         ret = get_errno(shmctl(shmid, cmd, &dsarg));
3836         if (host_to_target_shmid_ds(buf, &dsarg))
3837             return -TARGET_EFAULT;
3838         break;
3839     case IPC_INFO:
3840         ret = get_errno(shmctl(shmid, cmd, (struct shmid_ds *)&shminfo));
3841         if (host_to_target_shminfo(buf, &shminfo))
3842             return -TARGET_EFAULT;
3843         break;
3844     case SHM_INFO:
3845         ret = get_errno(shmctl(shmid, cmd, (struct shmid_ds *)&shm_info));
3846         if (host_to_target_shm_info(buf, &shm_info))
3847             return -TARGET_EFAULT;
3848         break;
3849     case IPC_RMID:
3850     case SHM_LOCK:
3851     case SHM_UNLOCK:
3852         ret = get_errno(shmctl(shmid, cmd, NULL));
3853         break;
3854     }
3855 
3856     return ret;
3857 }
3858 
3859 #ifndef TARGET_FORCE_SHMLBA
3860 /* For most architectures, SHMLBA is the same as the page size;
3861  * some architectures have larger values, in which case they should
3862  * define TARGET_FORCE_SHMLBA and provide a target_shmlba() function.
3863  * This corresponds to the kernel arch code defining __ARCH_FORCE_SHMLBA
3864  * and defining its own value for SHMLBA.
3865  *
3866  * The kernel also permits SHMLBA to be set by the architecture to a
3867  * value larger than the page size without setting __ARCH_FORCE_SHMLBA;
3868  * this means that addresses are rounded to the large size if
3869  * SHM_RND is set but addresses not aligned to that size are not rejected
3870  * as long as they are at least page-aligned. Since the only architecture
3871  * which uses this is ia64 this code doesn't provide for that oddity.
3872  */
3873 static inline abi_ulong target_shmlba(CPUArchState *cpu_env)
3874 {
3875     return TARGET_PAGE_SIZE;
3876 }
3877 #endif
3878 
3879 static inline abi_ulong do_shmat(CPUArchState *cpu_env,
3880                                  int shmid, abi_ulong shmaddr, int shmflg)
3881 {
3882     abi_long raddr;
3883     void *host_raddr;
3884     struct shmid_ds shm_info;
3885     int i,ret;
3886     abi_ulong shmlba;
3887 
3888     /* find out the length of the shared memory segment */
3889     ret = get_errno(shmctl(shmid, IPC_STAT, &shm_info));
3890     if (is_error(ret)) {
3891         /* can't get length, bail out */
3892         return ret;
3893     }
3894 
3895     shmlba = target_shmlba(cpu_env);
3896 
3897     if (shmaddr & (shmlba - 1)) {
3898         if (shmflg & SHM_RND) {
3899             shmaddr &= ~(shmlba - 1);
3900         } else {
3901             return -TARGET_EINVAL;
3902         }
3903     }
3904     if (!guest_range_valid(shmaddr, shm_info.shm_segsz)) {
3905         return -TARGET_EINVAL;
3906     }
3907 
3908     mmap_lock();
3909 
3910     if (shmaddr)
3911         host_raddr = shmat(shmid, (void *)g2h(shmaddr), shmflg);
3912     else {
3913         abi_ulong mmap_start;
3914 
3915         /* In order to use the host shmat, we need to honor host SHMLBA.  */
3916         mmap_start = mmap_find_vma(0, shm_info.shm_segsz, MAX(SHMLBA, shmlba));
3917 
3918         if (mmap_start == -1) {
3919             errno = ENOMEM;
3920             host_raddr = (void *)-1;
3921         } else
3922             host_raddr = shmat(shmid, g2h(mmap_start), shmflg | SHM_REMAP);
3923     }
3924 
3925     if (host_raddr == (void *)-1) {
3926         mmap_unlock();
3927         return get_errno((long)host_raddr);
3928     }
3929     raddr=h2g((unsigned long)host_raddr);
3930 
3931     page_set_flags(raddr, raddr + shm_info.shm_segsz,
3932                    PAGE_VALID | PAGE_READ |
3933                    ((shmflg & SHM_RDONLY)? 0 : PAGE_WRITE));
3934 
3935     for (i = 0; i < N_SHM_REGIONS; i++) {
3936         if (!shm_regions[i].in_use) {
3937             shm_regions[i].in_use = true;
3938             shm_regions[i].start = raddr;
3939             shm_regions[i].size = shm_info.shm_segsz;
3940             break;
3941         }
3942     }
3943 
3944     mmap_unlock();
3945     return raddr;
3946 
3947 }
3948 
3949 static inline abi_long do_shmdt(abi_ulong shmaddr)
3950 {
3951     int i;
3952     abi_long rv;
3953 
3954     mmap_lock();
3955 
3956     for (i = 0; i < N_SHM_REGIONS; ++i) {
3957         if (shm_regions[i].in_use && shm_regions[i].start == shmaddr) {
3958             shm_regions[i].in_use = false;
3959             page_set_flags(shmaddr, shmaddr + shm_regions[i].size, 0);
3960             break;
3961         }
3962     }
3963     rv = get_errno(shmdt(g2h(shmaddr)));
3964 
3965     mmap_unlock();
3966 
3967     return rv;
3968 }
3969 
3970 #ifdef TARGET_NR_ipc
3971 /* ??? This only works with linear mappings.  */
3972 /* do_ipc() must return target values and target errnos. */
3973 static abi_long do_ipc(CPUArchState *cpu_env,
3974                        unsigned int call, abi_long first,
3975                        abi_long second, abi_long third,
3976                        abi_long ptr, abi_long fifth)
3977 {
3978     int version;
3979     abi_long ret = 0;
3980 
3981     version = call >> 16;
3982     call &= 0xffff;
3983 
3984     switch (call) {
3985     case IPCOP_semop:
3986         ret = do_semop(first, ptr, second);
3987         break;
3988 
3989     case IPCOP_semget:
3990         ret = get_errno(semget(first, second, third));
3991         break;
3992 
3993     case IPCOP_semctl: {
3994         /* The semun argument to semctl is passed by value, so dereference the
3995          * ptr argument. */
3996         abi_ulong atptr;
3997         get_user_ual(atptr, ptr);
3998         ret = do_semctl(first, second, third, atptr);
3999         break;
4000     }
4001 
4002     case IPCOP_msgget:
4003         ret = get_errno(msgget(first, second));
4004         break;
4005 
4006     case IPCOP_msgsnd:
4007         ret = do_msgsnd(first, ptr, second, third);
4008         break;
4009 
4010     case IPCOP_msgctl:
4011         ret = do_msgctl(first, second, ptr);
4012         break;
4013 
4014     case IPCOP_msgrcv:
4015         switch (version) {
4016         case 0:
4017             {
4018                 struct target_ipc_kludge {
4019                     abi_long msgp;
4020                     abi_long msgtyp;
4021                 } *tmp;
4022 
4023                 if (!lock_user_struct(VERIFY_READ, tmp, ptr, 1)) {
4024                     ret = -TARGET_EFAULT;
4025                     break;
4026                 }
4027 
4028                 ret = do_msgrcv(first, tswapal(tmp->msgp), second, tswapal(tmp->msgtyp), third);
4029 
4030                 unlock_user_struct(tmp, ptr, 0);
4031                 break;
4032             }
4033         default:
4034             ret = do_msgrcv(first, ptr, second, fifth, third);
4035         }
4036         break;
4037 
4038     case IPCOP_shmat:
4039         switch (version) {
4040         default:
4041         {
4042             abi_ulong raddr;
4043             raddr = do_shmat(cpu_env, first, ptr, second);
4044             if (is_error(raddr))
4045                 return get_errno(raddr);
4046             if (put_user_ual(raddr, third))
4047                 return -TARGET_EFAULT;
4048             break;
4049         }
4050         case 1:
4051             ret = -TARGET_EINVAL;
4052             break;
4053         }
4054 	break;
4055     case IPCOP_shmdt:
4056         ret = do_shmdt(ptr);
4057 	break;
4058 
4059     case IPCOP_shmget:
4060 	/* IPC_* flag values are the same on all linux platforms */
4061 	ret = get_errno(shmget(first, second, third));
4062 	break;
4063 
4064 	/* IPC_* and SHM_* command values are the same on all linux platforms */
4065     case IPCOP_shmctl:
4066         ret = do_shmctl(first, second, ptr);
4067         break;
4068     default:
4069 	gemu_log("Unsupported ipc call: %d (version %d)\n", call, version);
4070 	ret = -TARGET_ENOSYS;
4071 	break;
4072     }
4073     return ret;
4074 }
4075 #endif
4076 
4077 /* kernel structure types definitions */
4078 
4079 #define STRUCT(name, ...) STRUCT_ ## name,
4080 #define STRUCT_SPECIAL(name) STRUCT_ ## name,
4081 enum {
4082 #include "syscall_types.h"
4083 STRUCT_MAX
4084 };
4085 #undef STRUCT
4086 #undef STRUCT_SPECIAL
4087 
4088 #define STRUCT(name, ...) static const argtype struct_ ## name ## _def[] = {  __VA_ARGS__, TYPE_NULL };
4089 #define STRUCT_SPECIAL(name)
4090 #include "syscall_types.h"
4091 #undef STRUCT
4092 #undef STRUCT_SPECIAL
4093 
4094 typedef struct IOCTLEntry IOCTLEntry;
4095 
4096 typedef abi_long do_ioctl_fn(const IOCTLEntry *ie, uint8_t *buf_temp,
4097                              int fd, int cmd, abi_long arg);
4098 
4099 struct IOCTLEntry {
4100     int target_cmd;
4101     unsigned int host_cmd;
4102     const char *name;
4103     int access;
4104     do_ioctl_fn *do_ioctl;
4105     const argtype arg_type[5];
4106 };
4107 
4108 #define IOC_R 0x0001
4109 #define IOC_W 0x0002
4110 #define IOC_RW (IOC_R | IOC_W)
4111 
4112 #define MAX_STRUCT_SIZE 4096
4113 
4114 #ifdef CONFIG_FIEMAP
4115 /* So fiemap access checks don't overflow on 32 bit systems.
4116  * This is very slightly smaller than the limit imposed by
4117  * the underlying kernel.
4118  */
4119 #define FIEMAP_MAX_EXTENTS ((UINT_MAX - sizeof(struct fiemap))  \
4120                             / sizeof(struct fiemap_extent))
4121 
4122 static abi_long do_ioctl_fs_ioc_fiemap(const IOCTLEntry *ie, uint8_t *buf_temp,
4123                                        int fd, int cmd, abi_long arg)
4124 {
4125     /* The parameter for this ioctl is a struct fiemap followed
4126      * by an array of struct fiemap_extent whose size is set
4127      * in fiemap->fm_extent_count. The array is filled in by the
4128      * ioctl.
4129      */
4130     int target_size_in, target_size_out;
4131     struct fiemap *fm;
4132     const argtype *arg_type = ie->arg_type;
4133     const argtype extent_arg_type[] = { MK_STRUCT(STRUCT_fiemap_extent) };
4134     void *argptr, *p;
4135     abi_long ret;
4136     int i, extent_size = thunk_type_size(extent_arg_type, 0);
4137     uint32_t outbufsz;
4138     int free_fm = 0;
4139 
4140     assert(arg_type[0] == TYPE_PTR);
4141     assert(ie->access == IOC_RW);
4142     arg_type++;
4143     target_size_in = thunk_type_size(arg_type, 0);
4144     argptr = lock_user(VERIFY_READ, arg, target_size_in, 1);
4145     if (!argptr) {
4146         return -TARGET_EFAULT;
4147     }
4148     thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
4149     unlock_user(argptr, arg, 0);
4150     fm = (struct fiemap *)buf_temp;
4151     if (fm->fm_extent_count > FIEMAP_MAX_EXTENTS) {
4152         return -TARGET_EINVAL;
4153     }
4154 
4155     outbufsz = sizeof (*fm) +
4156         (sizeof(struct fiemap_extent) * fm->fm_extent_count);
4157 
4158     if (outbufsz > MAX_STRUCT_SIZE) {
4159         /* We can't fit all the extents into the fixed size buffer.
4160          * Allocate one that is large enough and use it instead.
4161          */
4162         fm = g_try_malloc(outbufsz);
4163         if (!fm) {
4164             return -TARGET_ENOMEM;
4165         }
4166         memcpy(fm, buf_temp, sizeof(struct fiemap));
4167         free_fm = 1;
4168     }
4169     ret = get_errno(safe_ioctl(fd, ie->host_cmd, fm));
4170     if (!is_error(ret)) {
4171         target_size_out = target_size_in;
4172         /* An extent_count of 0 means we were only counting the extents
4173          * so there are no structs to copy
4174          */
4175         if (fm->fm_extent_count != 0) {
4176             target_size_out += fm->fm_mapped_extents * extent_size;
4177         }
4178         argptr = lock_user(VERIFY_WRITE, arg, target_size_out, 0);
4179         if (!argptr) {
4180             ret = -TARGET_EFAULT;
4181         } else {
4182             /* Convert the struct fiemap */
4183             thunk_convert(argptr, fm, arg_type, THUNK_TARGET);
4184             if (fm->fm_extent_count != 0) {
4185                 p = argptr + target_size_in;
4186                 /* ...and then all the struct fiemap_extents */
4187                 for (i = 0; i < fm->fm_mapped_extents; i++) {
4188                     thunk_convert(p, &fm->fm_extents[i], extent_arg_type,
4189                                   THUNK_TARGET);
4190                     p += extent_size;
4191                 }
4192             }
4193             unlock_user(argptr, arg, target_size_out);
4194         }
4195     }
4196     if (free_fm) {
4197         g_free(fm);
4198     }
4199     return ret;
4200 }
4201 #endif
4202 
4203 static abi_long do_ioctl_ifconf(const IOCTLEntry *ie, uint8_t *buf_temp,
4204                                 int fd, int cmd, abi_long arg)
4205 {
4206     const argtype *arg_type = ie->arg_type;
4207     int target_size;
4208     void *argptr;
4209     int ret;
4210     struct ifconf *host_ifconf;
4211     uint32_t outbufsz;
4212     const argtype ifreq_arg_type[] = { MK_STRUCT(STRUCT_sockaddr_ifreq) };
4213     int target_ifreq_size;
4214     int nb_ifreq;
4215     int free_buf = 0;
4216     int i;
4217     int target_ifc_len;
4218     abi_long target_ifc_buf;
4219     int host_ifc_len;
4220     char *host_ifc_buf;
4221 
4222     assert(arg_type[0] == TYPE_PTR);
4223     assert(ie->access == IOC_RW);
4224 
4225     arg_type++;
4226     target_size = thunk_type_size(arg_type, 0);
4227 
4228     argptr = lock_user(VERIFY_READ, arg, target_size, 1);
4229     if (!argptr)
4230         return -TARGET_EFAULT;
4231     thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
4232     unlock_user(argptr, arg, 0);
4233 
4234     host_ifconf = (struct ifconf *)(unsigned long)buf_temp;
4235     target_ifc_buf = (abi_long)(unsigned long)host_ifconf->ifc_buf;
4236     target_ifreq_size = thunk_type_size(ifreq_arg_type, 0);
4237 
4238     if (target_ifc_buf != 0) {
4239         target_ifc_len = host_ifconf->ifc_len;
4240         nb_ifreq = target_ifc_len / target_ifreq_size;
4241         host_ifc_len = nb_ifreq * sizeof(struct ifreq);
4242 
4243         outbufsz = sizeof(*host_ifconf) + host_ifc_len;
4244         if (outbufsz > MAX_STRUCT_SIZE) {
4245             /*
4246              * We can't fit all the extents into the fixed size buffer.
4247              * Allocate one that is large enough and use it instead.
4248              */
4249             host_ifconf = malloc(outbufsz);
4250             if (!host_ifconf) {
4251                 return -TARGET_ENOMEM;
4252             }
4253             memcpy(host_ifconf, buf_temp, sizeof(*host_ifconf));
4254             free_buf = 1;
4255         }
4256         host_ifc_buf = (char *)host_ifconf + sizeof(*host_ifconf);
4257 
4258         host_ifconf->ifc_len = host_ifc_len;
4259     } else {
4260       host_ifc_buf = NULL;
4261     }
4262     host_ifconf->ifc_buf = host_ifc_buf;
4263 
4264     ret = get_errno(safe_ioctl(fd, ie->host_cmd, host_ifconf));
4265     if (!is_error(ret)) {
4266 	/* convert host ifc_len to target ifc_len */
4267 
4268         nb_ifreq = host_ifconf->ifc_len / sizeof(struct ifreq);
4269         target_ifc_len = nb_ifreq * target_ifreq_size;
4270         host_ifconf->ifc_len = target_ifc_len;
4271 
4272 	/* restore target ifc_buf */
4273 
4274         host_ifconf->ifc_buf = (char *)(unsigned long)target_ifc_buf;
4275 
4276 	/* copy struct ifconf to target user */
4277 
4278         argptr = lock_user(VERIFY_WRITE, arg, target_size, 0);
4279         if (!argptr)
4280             return -TARGET_EFAULT;
4281         thunk_convert(argptr, host_ifconf, arg_type, THUNK_TARGET);
4282         unlock_user(argptr, arg, target_size);
4283 
4284         if (target_ifc_buf != 0) {
4285             /* copy ifreq[] to target user */
4286             argptr = lock_user(VERIFY_WRITE, target_ifc_buf, target_ifc_len, 0);
4287             for (i = 0; i < nb_ifreq ; i++) {
4288                 thunk_convert(argptr + i * target_ifreq_size,
4289                               host_ifc_buf + i * sizeof(struct ifreq),
4290                               ifreq_arg_type, THUNK_TARGET);
4291             }
4292             unlock_user(argptr, target_ifc_buf, target_ifc_len);
4293         }
4294     }
4295 
4296     if (free_buf) {
4297         free(host_ifconf);
4298     }
4299 
4300     return ret;
4301 }
4302 
4303 #if defined(CONFIG_USBFS)
4304 #if HOST_LONG_BITS > 64
4305 #error USBDEVFS thunks do not support >64 bit hosts yet.
4306 #endif
4307 struct live_urb {
4308     uint64_t target_urb_adr;
4309     uint64_t target_buf_adr;
4310     char *target_buf_ptr;
4311     struct usbdevfs_urb host_urb;
4312 };
4313 
4314 static GHashTable *usbdevfs_urb_hashtable(void)
4315 {
4316     static GHashTable *urb_hashtable;
4317 
4318     if (!urb_hashtable) {
4319         urb_hashtable = g_hash_table_new(g_int64_hash, g_int64_equal);
4320     }
4321     return urb_hashtable;
4322 }
4323 
4324 static void urb_hashtable_insert(struct live_urb *urb)
4325 {
4326     GHashTable *urb_hashtable = usbdevfs_urb_hashtable();
4327     g_hash_table_insert(urb_hashtable, urb, urb);
4328 }
4329 
4330 static struct live_urb *urb_hashtable_lookup(uint64_t target_urb_adr)
4331 {
4332     GHashTable *urb_hashtable = usbdevfs_urb_hashtable();
4333     return g_hash_table_lookup(urb_hashtable, &target_urb_adr);
4334 }
4335 
4336 static void urb_hashtable_remove(struct live_urb *urb)
4337 {
4338     GHashTable *urb_hashtable = usbdevfs_urb_hashtable();
4339     g_hash_table_remove(urb_hashtable, urb);
4340 }
4341 
4342 static abi_long
4343 do_ioctl_usbdevfs_reapurb(const IOCTLEntry *ie, uint8_t *buf_temp,
4344                           int fd, int cmd, abi_long arg)
4345 {
4346     const argtype usbfsurb_arg_type[] = { MK_STRUCT(STRUCT_usbdevfs_urb) };
4347     const argtype ptrvoid_arg_type[] = { TYPE_PTRVOID, 0, 0 };
4348     struct live_urb *lurb;
4349     void *argptr;
4350     uint64_t hurb;
4351     int target_size;
4352     uintptr_t target_urb_adr;
4353     abi_long ret;
4354 
4355     target_size = thunk_type_size(usbfsurb_arg_type, THUNK_TARGET);
4356 
4357     memset(buf_temp, 0, sizeof(uint64_t));
4358     ret = get_errno(safe_ioctl(fd, ie->host_cmd, buf_temp));
4359     if (is_error(ret)) {
4360         return ret;
4361     }
4362 
4363     memcpy(&hurb, buf_temp, sizeof(uint64_t));
4364     lurb = (void *)((uintptr_t)hurb - offsetof(struct live_urb, host_urb));
4365     if (!lurb->target_urb_adr) {
4366         return -TARGET_EFAULT;
4367     }
4368     urb_hashtable_remove(lurb);
4369     unlock_user(lurb->target_buf_ptr, lurb->target_buf_adr,
4370         lurb->host_urb.buffer_length);
4371     lurb->target_buf_ptr = NULL;
4372 
4373     /* restore the guest buffer pointer */
4374     lurb->host_urb.buffer = (void *)(uintptr_t)lurb->target_buf_adr;
4375 
4376     /* update the guest urb struct */
4377     argptr = lock_user(VERIFY_WRITE, lurb->target_urb_adr, target_size, 0);
4378     if (!argptr) {
4379         g_free(lurb);
4380         return -TARGET_EFAULT;
4381     }
4382     thunk_convert(argptr, &lurb->host_urb, usbfsurb_arg_type, THUNK_TARGET);
4383     unlock_user(argptr, lurb->target_urb_adr, target_size);
4384 
4385     target_size = thunk_type_size(ptrvoid_arg_type, THUNK_TARGET);
4386     /* write back the urb handle */
4387     argptr = lock_user(VERIFY_WRITE, arg, target_size, 0);
4388     if (!argptr) {
4389         g_free(lurb);
4390         return -TARGET_EFAULT;
4391     }
4392 
4393     /* GHashTable uses 64-bit keys but thunk_convert expects uintptr_t */
4394     target_urb_adr = lurb->target_urb_adr;
4395     thunk_convert(argptr, &target_urb_adr, ptrvoid_arg_type, THUNK_TARGET);
4396     unlock_user(argptr, arg, target_size);
4397 
4398     g_free(lurb);
4399     return ret;
4400 }
4401 
4402 static abi_long
4403 do_ioctl_usbdevfs_discardurb(const IOCTLEntry *ie,
4404                              uint8_t *buf_temp __attribute__((unused)),
4405                              int fd, int cmd, abi_long arg)
4406 {
4407     struct live_urb *lurb;
4408 
4409     /* map target address back to host URB with metadata. */
4410     lurb = urb_hashtable_lookup(arg);
4411     if (!lurb) {
4412         return -TARGET_EFAULT;
4413     }
4414     return get_errno(safe_ioctl(fd, ie->host_cmd, &lurb->host_urb));
4415 }
4416 
4417 static abi_long
4418 do_ioctl_usbdevfs_submiturb(const IOCTLEntry *ie, uint8_t *buf_temp,
4419                             int fd, int cmd, abi_long arg)
4420 {
4421     const argtype *arg_type = ie->arg_type;
4422     int target_size;
4423     abi_long ret;
4424     void *argptr;
4425     int rw_dir;
4426     struct live_urb *lurb;
4427 
4428     /*
4429      * each submitted URB needs to map to a unique ID for the
4430      * kernel, and that unique ID needs to be a pointer to
4431      * host memory.  hence, we need to malloc for each URB.
4432      * isochronous transfers have a variable length struct.
4433      */
4434     arg_type++;
4435     target_size = thunk_type_size(arg_type, THUNK_TARGET);
4436 
4437     /* construct host copy of urb and metadata */
4438     lurb = g_try_malloc0(sizeof(struct live_urb));
4439     if (!lurb) {
4440         return -TARGET_ENOMEM;
4441     }
4442 
4443     argptr = lock_user(VERIFY_READ, arg, target_size, 1);
4444     if (!argptr) {
4445         g_free(lurb);
4446         return -TARGET_EFAULT;
4447     }
4448     thunk_convert(&lurb->host_urb, argptr, arg_type, THUNK_HOST);
4449     unlock_user(argptr, arg, 0);
4450 
4451     lurb->target_urb_adr = arg;
4452     lurb->target_buf_adr = (uintptr_t)lurb->host_urb.buffer;
4453 
4454     /* buffer space used depends on endpoint type so lock the entire buffer */
4455     /* control type urbs should check the buffer contents for true direction */
4456     rw_dir = lurb->host_urb.endpoint & USB_DIR_IN ? VERIFY_WRITE : VERIFY_READ;
4457     lurb->target_buf_ptr = lock_user(rw_dir, lurb->target_buf_adr,
4458         lurb->host_urb.buffer_length, 1);
4459     if (lurb->target_buf_ptr == NULL) {
4460         g_free(lurb);
4461         return -TARGET_EFAULT;
4462     }
4463 
4464     /* update buffer pointer in host copy */
4465     lurb->host_urb.buffer = lurb->target_buf_ptr;
4466 
4467     ret = get_errno(safe_ioctl(fd, ie->host_cmd, &lurb->host_urb));
4468     if (is_error(ret)) {
4469         unlock_user(lurb->target_buf_ptr, lurb->target_buf_adr, 0);
4470         g_free(lurb);
4471     } else {
4472         urb_hashtable_insert(lurb);
4473     }
4474 
4475     return ret;
4476 }
4477 #endif /* CONFIG_USBFS */
4478 
4479 static abi_long do_ioctl_dm(const IOCTLEntry *ie, uint8_t *buf_temp, int fd,
4480                             int cmd, abi_long arg)
4481 {
4482     void *argptr;
4483     struct dm_ioctl *host_dm;
4484     abi_long guest_data;
4485     uint32_t guest_data_size;
4486     int target_size;
4487     const argtype *arg_type = ie->arg_type;
4488     abi_long ret;
4489     void *big_buf = NULL;
4490     char *host_data;
4491 
4492     arg_type++;
4493     target_size = thunk_type_size(arg_type, 0);
4494     argptr = lock_user(VERIFY_READ, arg, target_size, 1);
4495     if (!argptr) {
4496         ret = -TARGET_EFAULT;
4497         goto out;
4498     }
4499     thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
4500     unlock_user(argptr, arg, 0);
4501 
4502     /* buf_temp is too small, so fetch things into a bigger buffer */
4503     big_buf = g_malloc0(((struct dm_ioctl*)buf_temp)->data_size * 2);
4504     memcpy(big_buf, buf_temp, target_size);
4505     buf_temp = big_buf;
4506     host_dm = big_buf;
4507 
4508     guest_data = arg + host_dm->data_start;
4509     if ((guest_data - arg) < 0) {
4510         ret = -TARGET_EINVAL;
4511         goto out;
4512     }
4513     guest_data_size = host_dm->data_size - host_dm->data_start;
4514     host_data = (char*)host_dm + host_dm->data_start;
4515 
4516     argptr = lock_user(VERIFY_READ, guest_data, guest_data_size, 1);
4517     if (!argptr) {
4518         ret = -TARGET_EFAULT;
4519         goto out;
4520     }
4521 
4522     switch (ie->host_cmd) {
4523     case DM_REMOVE_ALL:
4524     case DM_LIST_DEVICES:
4525     case DM_DEV_CREATE:
4526     case DM_DEV_REMOVE:
4527     case DM_DEV_SUSPEND:
4528     case DM_DEV_STATUS:
4529     case DM_DEV_WAIT:
4530     case DM_TABLE_STATUS:
4531     case DM_TABLE_CLEAR:
4532     case DM_TABLE_DEPS:
4533     case DM_LIST_VERSIONS:
4534         /* no input data */
4535         break;
4536     case DM_DEV_RENAME:
4537     case DM_DEV_SET_GEOMETRY:
4538         /* data contains only strings */
4539         memcpy(host_data, argptr, guest_data_size);
4540         break;
4541     case DM_TARGET_MSG:
4542         memcpy(host_data, argptr, guest_data_size);
4543         *(uint64_t*)host_data = tswap64(*(uint64_t*)argptr);
4544         break;
4545     case DM_TABLE_LOAD:
4546     {
4547         void *gspec = argptr;
4548         void *cur_data = host_data;
4549         const argtype arg_type[] = { MK_STRUCT(STRUCT_dm_target_spec) };
4550         int spec_size = thunk_type_size(arg_type, 0);
4551         int i;
4552 
4553         for (i = 0; i < host_dm->target_count; i++) {
4554             struct dm_target_spec *spec = cur_data;
4555             uint32_t next;
4556             int slen;
4557 
4558             thunk_convert(spec, gspec, arg_type, THUNK_HOST);
4559             slen = strlen((char*)gspec + spec_size) + 1;
4560             next = spec->next;
4561             spec->next = sizeof(*spec) + slen;
4562             strcpy((char*)&spec[1], gspec + spec_size);
4563             gspec += next;
4564             cur_data += spec->next;
4565         }
4566         break;
4567     }
4568     default:
4569         ret = -TARGET_EINVAL;
4570         unlock_user(argptr, guest_data, 0);
4571         goto out;
4572     }
4573     unlock_user(argptr, guest_data, 0);
4574 
4575     ret = get_errno(safe_ioctl(fd, ie->host_cmd, buf_temp));
4576     if (!is_error(ret)) {
4577         guest_data = arg + host_dm->data_start;
4578         guest_data_size = host_dm->data_size - host_dm->data_start;
4579         argptr = lock_user(VERIFY_WRITE, guest_data, guest_data_size, 0);
4580         switch (ie->host_cmd) {
4581         case DM_REMOVE_ALL:
4582         case DM_DEV_CREATE:
4583         case DM_DEV_REMOVE:
4584         case DM_DEV_RENAME:
4585         case DM_DEV_SUSPEND:
4586         case DM_DEV_STATUS:
4587         case DM_TABLE_LOAD:
4588         case DM_TABLE_CLEAR:
4589         case DM_TARGET_MSG:
4590         case DM_DEV_SET_GEOMETRY:
4591             /* no return data */
4592             break;
4593         case DM_LIST_DEVICES:
4594         {
4595             struct dm_name_list *nl = (void*)host_dm + host_dm->data_start;
4596             uint32_t remaining_data = guest_data_size;
4597             void *cur_data = argptr;
4598             const argtype arg_type[] = { MK_STRUCT(STRUCT_dm_name_list) };
4599             int nl_size = 12; /* can't use thunk_size due to alignment */
4600 
4601             while (1) {
4602                 uint32_t next = nl->next;
4603                 if (next) {
4604                     nl->next = nl_size + (strlen(nl->name) + 1);
4605                 }
4606                 if (remaining_data < nl->next) {
4607                     host_dm->flags |= DM_BUFFER_FULL_FLAG;
4608                     break;
4609                 }
4610                 thunk_convert(cur_data, nl, arg_type, THUNK_TARGET);
4611                 strcpy(cur_data + nl_size, nl->name);
4612                 cur_data += nl->next;
4613                 remaining_data -= nl->next;
4614                 if (!next) {
4615                     break;
4616                 }
4617                 nl = (void*)nl + next;
4618             }
4619             break;
4620         }
4621         case DM_DEV_WAIT:
4622         case DM_TABLE_STATUS:
4623         {
4624             struct dm_target_spec *spec = (void*)host_dm + host_dm->data_start;
4625             void *cur_data = argptr;
4626             const argtype arg_type[] = { MK_STRUCT(STRUCT_dm_target_spec) };
4627             int spec_size = thunk_type_size(arg_type, 0);
4628             int i;
4629 
4630             for (i = 0; i < host_dm->target_count; i++) {
4631                 uint32_t next = spec->next;
4632                 int slen = strlen((char*)&spec[1]) + 1;
4633                 spec->next = (cur_data - argptr) + spec_size + slen;
4634                 if (guest_data_size < spec->next) {
4635                     host_dm->flags |= DM_BUFFER_FULL_FLAG;
4636                     break;
4637                 }
4638                 thunk_convert(cur_data, spec, arg_type, THUNK_TARGET);
4639                 strcpy(cur_data + spec_size, (char*)&spec[1]);
4640                 cur_data = argptr + spec->next;
4641                 spec = (void*)host_dm + host_dm->data_start + next;
4642             }
4643             break;
4644         }
4645         case DM_TABLE_DEPS:
4646         {
4647             void *hdata = (void*)host_dm + host_dm->data_start;
4648             int count = *(uint32_t*)hdata;
4649             uint64_t *hdev = hdata + 8;
4650             uint64_t *gdev = argptr + 8;
4651             int i;
4652 
4653             *(uint32_t*)argptr = tswap32(count);
4654             for (i = 0; i < count; i++) {
4655                 *gdev = tswap64(*hdev);
4656                 gdev++;
4657                 hdev++;
4658             }
4659             break;
4660         }
4661         case DM_LIST_VERSIONS:
4662         {
4663             struct dm_target_versions *vers = (void*)host_dm + host_dm->data_start;
4664             uint32_t remaining_data = guest_data_size;
4665             void *cur_data = argptr;
4666             const argtype arg_type[] = { MK_STRUCT(STRUCT_dm_target_versions) };
4667             int vers_size = thunk_type_size(arg_type, 0);
4668 
4669             while (1) {
4670                 uint32_t next = vers->next;
4671                 if (next) {
4672                     vers->next = vers_size + (strlen(vers->name) + 1);
4673                 }
4674                 if (remaining_data < vers->next) {
4675                     host_dm->flags |= DM_BUFFER_FULL_FLAG;
4676                     break;
4677                 }
4678                 thunk_convert(cur_data, vers, arg_type, THUNK_TARGET);
4679                 strcpy(cur_data + vers_size, vers->name);
4680                 cur_data += vers->next;
4681                 remaining_data -= vers->next;
4682                 if (!next) {
4683                     break;
4684                 }
4685                 vers = (void*)vers + next;
4686             }
4687             break;
4688         }
4689         default:
4690             unlock_user(argptr, guest_data, 0);
4691             ret = -TARGET_EINVAL;
4692             goto out;
4693         }
4694         unlock_user(argptr, guest_data, guest_data_size);
4695 
4696         argptr = lock_user(VERIFY_WRITE, arg, target_size, 0);
4697         if (!argptr) {
4698             ret = -TARGET_EFAULT;
4699             goto out;
4700         }
4701         thunk_convert(argptr, buf_temp, arg_type, THUNK_TARGET);
4702         unlock_user(argptr, arg, target_size);
4703     }
4704 out:
4705     g_free(big_buf);
4706     return ret;
4707 }
4708 
4709 static abi_long do_ioctl_blkpg(const IOCTLEntry *ie, uint8_t *buf_temp, int fd,
4710                                int cmd, abi_long arg)
4711 {
4712     void *argptr;
4713     int target_size;
4714     const argtype *arg_type = ie->arg_type;
4715     const argtype part_arg_type[] = { MK_STRUCT(STRUCT_blkpg_partition) };
4716     abi_long ret;
4717 
4718     struct blkpg_ioctl_arg *host_blkpg = (void*)buf_temp;
4719     struct blkpg_partition host_part;
4720 
4721     /* Read and convert blkpg */
4722     arg_type++;
4723     target_size = thunk_type_size(arg_type, 0);
4724     argptr = lock_user(VERIFY_READ, arg, target_size, 1);
4725     if (!argptr) {
4726         ret = -TARGET_EFAULT;
4727         goto out;
4728     }
4729     thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
4730     unlock_user(argptr, arg, 0);
4731 
4732     switch (host_blkpg->op) {
4733     case BLKPG_ADD_PARTITION:
4734     case BLKPG_DEL_PARTITION:
4735         /* payload is struct blkpg_partition */
4736         break;
4737     default:
4738         /* Unknown opcode */
4739         ret = -TARGET_EINVAL;
4740         goto out;
4741     }
4742 
4743     /* Read and convert blkpg->data */
4744     arg = (abi_long)(uintptr_t)host_blkpg->data;
4745     target_size = thunk_type_size(part_arg_type, 0);
4746     argptr = lock_user(VERIFY_READ, arg, target_size, 1);
4747     if (!argptr) {
4748         ret = -TARGET_EFAULT;
4749         goto out;
4750     }
4751     thunk_convert(&host_part, argptr, part_arg_type, THUNK_HOST);
4752     unlock_user(argptr, arg, 0);
4753 
4754     /* Swizzle the data pointer to our local copy and call! */
4755     host_blkpg->data = &host_part;
4756     ret = get_errno(safe_ioctl(fd, ie->host_cmd, host_blkpg));
4757 
4758 out:
4759     return ret;
4760 }
4761 
4762 static abi_long do_ioctl_rt(const IOCTLEntry *ie, uint8_t *buf_temp,
4763                                 int fd, int cmd, abi_long arg)
4764 {
4765     const argtype *arg_type = ie->arg_type;
4766     const StructEntry *se;
4767     const argtype *field_types;
4768     const int *dst_offsets, *src_offsets;
4769     int target_size;
4770     void *argptr;
4771     abi_ulong *target_rt_dev_ptr = NULL;
4772     unsigned long *host_rt_dev_ptr = NULL;
4773     abi_long ret;
4774     int i;
4775 
4776     assert(ie->access == IOC_W);
4777     assert(*arg_type == TYPE_PTR);
4778     arg_type++;
4779     assert(*arg_type == TYPE_STRUCT);
4780     target_size = thunk_type_size(arg_type, 0);
4781     argptr = lock_user(VERIFY_READ, arg, target_size, 1);
4782     if (!argptr) {
4783         return -TARGET_EFAULT;
4784     }
4785     arg_type++;
4786     assert(*arg_type == (int)STRUCT_rtentry);
4787     se = struct_entries + *arg_type++;
4788     assert(se->convert[0] == NULL);
4789     /* convert struct here to be able to catch rt_dev string */
4790     field_types = se->field_types;
4791     dst_offsets = se->field_offsets[THUNK_HOST];
4792     src_offsets = se->field_offsets[THUNK_TARGET];
4793     for (i = 0; i < se->nb_fields; i++) {
4794         if (dst_offsets[i] == offsetof(struct rtentry, rt_dev)) {
4795             assert(*field_types == TYPE_PTRVOID);
4796             target_rt_dev_ptr = (abi_ulong *)(argptr + src_offsets[i]);
4797             host_rt_dev_ptr = (unsigned long *)(buf_temp + dst_offsets[i]);
4798             if (*target_rt_dev_ptr != 0) {
4799                 *host_rt_dev_ptr = (unsigned long)lock_user_string(
4800                                                   tswapal(*target_rt_dev_ptr));
4801                 if (!*host_rt_dev_ptr) {
4802                     unlock_user(argptr, arg, 0);
4803                     return -TARGET_EFAULT;
4804                 }
4805             } else {
4806                 *host_rt_dev_ptr = 0;
4807             }
4808             field_types++;
4809             continue;
4810         }
4811         field_types = thunk_convert(buf_temp + dst_offsets[i],
4812                                     argptr + src_offsets[i],
4813                                     field_types, THUNK_HOST);
4814     }
4815     unlock_user(argptr, arg, 0);
4816 
4817     ret = get_errno(safe_ioctl(fd, ie->host_cmd, buf_temp));
4818 
4819     assert(host_rt_dev_ptr != NULL);
4820     assert(target_rt_dev_ptr != NULL);
4821     if (*host_rt_dev_ptr != 0) {
4822         unlock_user((void *)*host_rt_dev_ptr,
4823                     *target_rt_dev_ptr, 0);
4824     }
4825     return ret;
4826 }
4827 
4828 static abi_long do_ioctl_kdsigaccept(const IOCTLEntry *ie, uint8_t *buf_temp,
4829                                      int fd, int cmd, abi_long arg)
4830 {
4831     int sig = target_to_host_signal(arg);
4832     return get_errno(safe_ioctl(fd, ie->host_cmd, sig));
4833 }
4834 
4835 #ifdef TIOCGPTPEER
4836 static abi_long do_ioctl_tiocgptpeer(const IOCTLEntry *ie, uint8_t *buf_temp,
4837                                      int fd, int cmd, abi_long arg)
4838 {
4839     int flags = target_to_host_bitmask(arg, fcntl_flags_tbl);
4840     return get_errno(safe_ioctl(fd, ie->host_cmd, flags));
4841 }
4842 #endif
4843 
4844 static IOCTLEntry ioctl_entries[] = {
4845 #define IOCTL(cmd, access, ...) \
4846     { TARGET_ ## cmd, cmd, #cmd, access, 0, {  __VA_ARGS__ } },
4847 #define IOCTL_SPECIAL(cmd, access, dofn, ...)                      \
4848     { TARGET_ ## cmd, cmd, #cmd, access, dofn, {  __VA_ARGS__ } },
4849 #define IOCTL_IGNORE(cmd) \
4850     { TARGET_ ## cmd, 0, #cmd },
4851 #include "ioctls.h"
4852     { 0, 0, },
4853 };
4854 
4855 /* ??? Implement proper locking for ioctls.  */
4856 /* do_ioctl() Must return target values and target errnos. */
4857 static abi_long do_ioctl(int fd, int cmd, abi_long arg)
4858 {
4859     const IOCTLEntry *ie;
4860     const argtype *arg_type;
4861     abi_long ret;
4862     uint8_t buf_temp[MAX_STRUCT_SIZE];
4863     int target_size;
4864     void *argptr;
4865 
4866     ie = ioctl_entries;
4867     for(;;) {
4868         if (ie->target_cmd == 0) {
4869             gemu_log("Unsupported ioctl: cmd=0x%04lx\n", (long)cmd);
4870             return -TARGET_ENOSYS;
4871         }
4872         if (ie->target_cmd == cmd)
4873             break;
4874         ie++;
4875     }
4876     arg_type = ie->arg_type;
4877     if (ie->do_ioctl) {
4878         return ie->do_ioctl(ie, buf_temp, fd, cmd, arg);
4879     } else if (!ie->host_cmd) {
4880         /* Some architectures define BSD ioctls in their headers
4881            that are not implemented in Linux.  */
4882         return -TARGET_ENOSYS;
4883     }
4884 
4885     switch(arg_type[0]) {
4886     case TYPE_NULL:
4887         /* no argument */
4888         ret = get_errno(safe_ioctl(fd, ie->host_cmd));
4889         break;
4890     case TYPE_PTRVOID:
4891     case TYPE_INT:
4892         ret = get_errno(safe_ioctl(fd, ie->host_cmd, arg));
4893         break;
4894     case TYPE_PTR:
4895         arg_type++;
4896         target_size = thunk_type_size(arg_type, 0);
4897         switch(ie->access) {
4898         case IOC_R:
4899             ret = get_errno(safe_ioctl(fd, ie->host_cmd, buf_temp));
4900             if (!is_error(ret)) {
4901                 argptr = lock_user(VERIFY_WRITE, arg, target_size, 0);
4902                 if (!argptr)
4903                     return -TARGET_EFAULT;
4904                 thunk_convert(argptr, buf_temp, arg_type, THUNK_TARGET);
4905                 unlock_user(argptr, arg, target_size);
4906             }
4907             break;
4908         case IOC_W:
4909             argptr = lock_user(VERIFY_READ, arg, target_size, 1);
4910             if (!argptr)
4911                 return -TARGET_EFAULT;
4912             thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
4913             unlock_user(argptr, arg, 0);
4914             ret = get_errno(safe_ioctl(fd, ie->host_cmd, buf_temp));
4915             break;
4916         default:
4917         case IOC_RW:
4918             argptr = lock_user(VERIFY_READ, arg, target_size, 1);
4919             if (!argptr)
4920                 return -TARGET_EFAULT;
4921             thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
4922             unlock_user(argptr, arg, 0);
4923             ret = get_errno(safe_ioctl(fd, ie->host_cmd, buf_temp));
4924             if (!is_error(ret)) {
4925                 argptr = lock_user(VERIFY_WRITE, arg, target_size, 0);
4926                 if (!argptr)
4927                     return -TARGET_EFAULT;
4928                 thunk_convert(argptr, buf_temp, arg_type, THUNK_TARGET);
4929                 unlock_user(argptr, arg, target_size);
4930             }
4931             break;
4932         }
4933         break;
4934     default:
4935         gemu_log("Unsupported ioctl type: cmd=0x%04lx type=%d\n",
4936                  (long)cmd, arg_type[0]);
4937         ret = -TARGET_ENOSYS;
4938         break;
4939     }
4940     return ret;
4941 }
4942 
4943 static const bitmask_transtbl iflag_tbl[] = {
4944         { TARGET_IGNBRK, TARGET_IGNBRK, IGNBRK, IGNBRK },
4945         { TARGET_BRKINT, TARGET_BRKINT, BRKINT, BRKINT },
4946         { TARGET_IGNPAR, TARGET_IGNPAR, IGNPAR, IGNPAR },
4947         { TARGET_PARMRK, TARGET_PARMRK, PARMRK, PARMRK },
4948         { TARGET_INPCK, TARGET_INPCK, INPCK, INPCK },
4949         { TARGET_ISTRIP, TARGET_ISTRIP, ISTRIP, ISTRIP },
4950         { TARGET_INLCR, TARGET_INLCR, INLCR, INLCR },
4951         { TARGET_IGNCR, TARGET_IGNCR, IGNCR, IGNCR },
4952         { TARGET_ICRNL, TARGET_ICRNL, ICRNL, ICRNL },
4953         { TARGET_IUCLC, TARGET_IUCLC, IUCLC, IUCLC },
4954         { TARGET_IXON, TARGET_IXON, IXON, IXON },
4955         { TARGET_IXANY, TARGET_IXANY, IXANY, IXANY },
4956         { TARGET_IXOFF, TARGET_IXOFF, IXOFF, IXOFF },
4957         { TARGET_IMAXBEL, TARGET_IMAXBEL, IMAXBEL, IMAXBEL },
4958         { 0, 0, 0, 0 }
4959 };
4960 
4961 static const bitmask_transtbl oflag_tbl[] = {
4962 	{ TARGET_OPOST, TARGET_OPOST, OPOST, OPOST },
4963 	{ TARGET_OLCUC, TARGET_OLCUC, OLCUC, OLCUC },
4964 	{ TARGET_ONLCR, TARGET_ONLCR, ONLCR, ONLCR },
4965 	{ TARGET_OCRNL, TARGET_OCRNL, OCRNL, OCRNL },
4966 	{ TARGET_ONOCR, TARGET_ONOCR, ONOCR, ONOCR },
4967 	{ TARGET_ONLRET, TARGET_ONLRET, ONLRET, ONLRET },
4968 	{ TARGET_OFILL, TARGET_OFILL, OFILL, OFILL },
4969 	{ TARGET_OFDEL, TARGET_OFDEL, OFDEL, OFDEL },
4970 	{ TARGET_NLDLY, TARGET_NL0, NLDLY, NL0 },
4971 	{ TARGET_NLDLY, TARGET_NL1, NLDLY, NL1 },
4972 	{ TARGET_CRDLY, TARGET_CR0, CRDLY, CR0 },
4973 	{ TARGET_CRDLY, TARGET_CR1, CRDLY, CR1 },
4974 	{ TARGET_CRDLY, TARGET_CR2, CRDLY, CR2 },
4975 	{ TARGET_CRDLY, TARGET_CR3, CRDLY, CR3 },
4976 	{ TARGET_TABDLY, TARGET_TAB0, TABDLY, TAB0 },
4977 	{ TARGET_TABDLY, TARGET_TAB1, TABDLY, TAB1 },
4978 	{ TARGET_TABDLY, TARGET_TAB2, TABDLY, TAB2 },
4979 	{ TARGET_TABDLY, TARGET_TAB3, TABDLY, TAB3 },
4980 	{ TARGET_BSDLY, TARGET_BS0, BSDLY, BS0 },
4981 	{ TARGET_BSDLY, TARGET_BS1, BSDLY, BS1 },
4982 	{ TARGET_VTDLY, TARGET_VT0, VTDLY, VT0 },
4983 	{ TARGET_VTDLY, TARGET_VT1, VTDLY, VT1 },
4984 	{ TARGET_FFDLY, TARGET_FF0, FFDLY, FF0 },
4985 	{ TARGET_FFDLY, TARGET_FF1, FFDLY, FF1 },
4986 	{ 0, 0, 0, 0 }
4987 };
4988 
4989 static const bitmask_transtbl cflag_tbl[] = {
4990 	{ TARGET_CBAUD, TARGET_B0, CBAUD, B0 },
4991 	{ TARGET_CBAUD, TARGET_B50, CBAUD, B50 },
4992 	{ TARGET_CBAUD, TARGET_B75, CBAUD, B75 },
4993 	{ TARGET_CBAUD, TARGET_B110, CBAUD, B110 },
4994 	{ TARGET_CBAUD, TARGET_B134, CBAUD, B134 },
4995 	{ TARGET_CBAUD, TARGET_B150, CBAUD, B150 },
4996 	{ TARGET_CBAUD, TARGET_B200, CBAUD, B200 },
4997 	{ TARGET_CBAUD, TARGET_B300, CBAUD, B300 },
4998 	{ TARGET_CBAUD, TARGET_B600, CBAUD, B600 },
4999 	{ TARGET_CBAUD, TARGET_B1200, CBAUD, B1200 },
5000 	{ TARGET_CBAUD, TARGET_B1800, CBAUD, B1800 },
5001 	{ TARGET_CBAUD, TARGET_B2400, CBAUD, B2400 },
5002 	{ TARGET_CBAUD, TARGET_B4800, CBAUD, B4800 },
5003 	{ TARGET_CBAUD, TARGET_B9600, CBAUD, B9600 },
5004 	{ TARGET_CBAUD, TARGET_B19200, CBAUD, B19200 },
5005 	{ TARGET_CBAUD, TARGET_B38400, CBAUD, B38400 },
5006 	{ TARGET_CBAUD, TARGET_B57600, CBAUD, B57600 },
5007 	{ TARGET_CBAUD, TARGET_B115200, CBAUD, B115200 },
5008 	{ TARGET_CBAUD, TARGET_B230400, CBAUD, B230400 },
5009 	{ TARGET_CBAUD, TARGET_B460800, CBAUD, B460800 },
5010 	{ TARGET_CSIZE, TARGET_CS5, CSIZE, CS5 },
5011 	{ TARGET_CSIZE, TARGET_CS6, CSIZE, CS6 },
5012 	{ TARGET_CSIZE, TARGET_CS7, CSIZE, CS7 },
5013 	{ TARGET_CSIZE, TARGET_CS8, CSIZE, CS8 },
5014 	{ TARGET_CSTOPB, TARGET_CSTOPB, CSTOPB, CSTOPB },
5015 	{ TARGET_CREAD, TARGET_CREAD, CREAD, CREAD },
5016 	{ TARGET_PARENB, TARGET_PARENB, PARENB, PARENB },
5017 	{ TARGET_PARODD, TARGET_PARODD, PARODD, PARODD },
5018 	{ TARGET_HUPCL, TARGET_HUPCL, HUPCL, HUPCL },
5019 	{ TARGET_CLOCAL, TARGET_CLOCAL, CLOCAL, CLOCAL },
5020 	{ TARGET_CRTSCTS, TARGET_CRTSCTS, CRTSCTS, CRTSCTS },
5021 	{ 0, 0, 0, 0 }
5022 };
5023 
5024 static const bitmask_transtbl lflag_tbl[] = {
5025 	{ TARGET_ISIG, TARGET_ISIG, ISIG, ISIG },
5026 	{ TARGET_ICANON, TARGET_ICANON, ICANON, ICANON },
5027 	{ TARGET_XCASE, TARGET_XCASE, XCASE, XCASE },
5028 	{ TARGET_ECHO, TARGET_ECHO, ECHO, ECHO },
5029 	{ TARGET_ECHOE, TARGET_ECHOE, ECHOE, ECHOE },
5030 	{ TARGET_ECHOK, TARGET_ECHOK, ECHOK, ECHOK },
5031 	{ TARGET_ECHONL, TARGET_ECHONL, ECHONL, ECHONL },
5032 	{ TARGET_NOFLSH, TARGET_NOFLSH, NOFLSH, NOFLSH },
5033 	{ TARGET_TOSTOP, TARGET_TOSTOP, TOSTOP, TOSTOP },
5034 	{ TARGET_ECHOCTL, TARGET_ECHOCTL, ECHOCTL, ECHOCTL },
5035 	{ TARGET_ECHOPRT, TARGET_ECHOPRT, ECHOPRT, ECHOPRT },
5036 	{ TARGET_ECHOKE, TARGET_ECHOKE, ECHOKE, ECHOKE },
5037 	{ TARGET_FLUSHO, TARGET_FLUSHO, FLUSHO, FLUSHO },
5038 	{ TARGET_PENDIN, TARGET_PENDIN, PENDIN, PENDIN },
5039 	{ TARGET_IEXTEN, TARGET_IEXTEN, IEXTEN, IEXTEN },
5040 	{ 0, 0, 0, 0 }
5041 };
5042 
5043 static void target_to_host_termios (void *dst, const void *src)
5044 {
5045     struct host_termios *host = dst;
5046     const struct target_termios *target = src;
5047 
5048     host->c_iflag =
5049         target_to_host_bitmask(tswap32(target->c_iflag), iflag_tbl);
5050     host->c_oflag =
5051         target_to_host_bitmask(tswap32(target->c_oflag), oflag_tbl);
5052     host->c_cflag =
5053         target_to_host_bitmask(tswap32(target->c_cflag), cflag_tbl);
5054     host->c_lflag =
5055         target_to_host_bitmask(tswap32(target->c_lflag), lflag_tbl);
5056     host->c_line = target->c_line;
5057 
5058     memset(host->c_cc, 0, sizeof(host->c_cc));
5059     host->c_cc[VINTR] = target->c_cc[TARGET_VINTR];
5060     host->c_cc[VQUIT] = target->c_cc[TARGET_VQUIT];
5061     host->c_cc[VERASE] = target->c_cc[TARGET_VERASE];
5062     host->c_cc[VKILL] = target->c_cc[TARGET_VKILL];
5063     host->c_cc[VEOF] = target->c_cc[TARGET_VEOF];
5064     host->c_cc[VTIME] = target->c_cc[TARGET_VTIME];
5065     host->c_cc[VMIN] = target->c_cc[TARGET_VMIN];
5066     host->c_cc[VSWTC] = target->c_cc[TARGET_VSWTC];
5067     host->c_cc[VSTART] = target->c_cc[TARGET_VSTART];
5068     host->c_cc[VSTOP] = target->c_cc[TARGET_VSTOP];
5069     host->c_cc[VSUSP] = target->c_cc[TARGET_VSUSP];
5070     host->c_cc[VEOL] = target->c_cc[TARGET_VEOL];
5071     host->c_cc[VREPRINT] = target->c_cc[TARGET_VREPRINT];
5072     host->c_cc[VDISCARD] = target->c_cc[TARGET_VDISCARD];
5073     host->c_cc[VWERASE] = target->c_cc[TARGET_VWERASE];
5074     host->c_cc[VLNEXT] = target->c_cc[TARGET_VLNEXT];
5075     host->c_cc[VEOL2] = target->c_cc[TARGET_VEOL2];
5076 }
5077 
5078 static void host_to_target_termios (void *dst, const void *src)
5079 {
5080     struct target_termios *target = dst;
5081     const struct host_termios *host = src;
5082 
5083     target->c_iflag =
5084         tswap32(host_to_target_bitmask(host->c_iflag, iflag_tbl));
5085     target->c_oflag =
5086         tswap32(host_to_target_bitmask(host->c_oflag, oflag_tbl));
5087     target->c_cflag =
5088         tswap32(host_to_target_bitmask(host->c_cflag, cflag_tbl));
5089     target->c_lflag =
5090         tswap32(host_to_target_bitmask(host->c_lflag, lflag_tbl));
5091     target->c_line = host->c_line;
5092 
5093     memset(target->c_cc, 0, sizeof(target->c_cc));
5094     target->c_cc[TARGET_VINTR] = host->c_cc[VINTR];
5095     target->c_cc[TARGET_VQUIT] = host->c_cc[VQUIT];
5096     target->c_cc[TARGET_VERASE] = host->c_cc[VERASE];
5097     target->c_cc[TARGET_VKILL] = host->c_cc[VKILL];
5098     target->c_cc[TARGET_VEOF] = host->c_cc[VEOF];
5099     target->c_cc[TARGET_VTIME] = host->c_cc[VTIME];
5100     target->c_cc[TARGET_VMIN] = host->c_cc[VMIN];
5101     target->c_cc[TARGET_VSWTC] = host->c_cc[VSWTC];
5102     target->c_cc[TARGET_VSTART] = host->c_cc[VSTART];
5103     target->c_cc[TARGET_VSTOP] = host->c_cc[VSTOP];
5104     target->c_cc[TARGET_VSUSP] = host->c_cc[VSUSP];
5105     target->c_cc[TARGET_VEOL] = host->c_cc[VEOL];
5106     target->c_cc[TARGET_VREPRINT] = host->c_cc[VREPRINT];
5107     target->c_cc[TARGET_VDISCARD] = host->c_cc[VDISCARD];
5108     target->c_cc[TARGET_VWERASE] = host->c_cc[VWERASE];
5109     target->c_cc[TARGET_VLNEXT] = host->c_cc[VLNEXT];
5110     target->c_cc[TARGET_VEOL2] = host->c_cc[VEOL2];
5111 }
5112 
5113 static const StructEntry struct_termios_def = {
5114     .convert = { host_to_target_termios, target_to_host_termios },
5115     .size = { sizeof(struct target_termios), sizeof(struct host_termios) },
5116     .align = { __alignof__(struct target_termios), __alignof__(struct host_termios) },
5117 };
5118 
5119 static bitmask_transtbl mmap_flags_tbl[] = {
5120     { TARGET_MAP_SHARED, TARGET_MAP_SHARED, MAP_SHARED, MAP_SHARED },
5121     { TARGET_MAP_PRIVATE, TARGET_MAP_PRIVATE, MAP_PRIVATE, MAP_PRIVATE },
5122     { TARGET_MAP_FIXED, TARGET_MAP_FIXED, MAP_FIXED, MAP_FIXED },
5123     { TARGET_MAP_ANONYMOUS, TARGET_MAP_ANONYMOUS,
5124       MAP_ANONYMOUS, MAP_ANONYMOUS },
5125     { TARGET_MAP_GROWSDOWN, TARGET_MAP_GROWSDOWN,
5126       MAP_GROWSDOWN, MAP_GROWSDOWN },
5127     { TARGET_MAP_DENYWRITE, TARGET_MAP_DENYWRITE,
5128       MAP_DENYWRITE, MAP_DENYWRITE },
5129     { TARGET_MAP_EXECUTABLE, TARGET_MAP_EXECUTABLE,
5130       MAP_EXECUTABLE, MAP_EXECUTABLE },
5131     { TARGET_MAP_LOCKED, TARGET_MAP_LOCKED, MAP_LOCKED, MAP_LOCKED },
5132     { TARGET_MAP_NORESERVE, TARGET_MAP_NORESERVE,
5133       MAP_NORESERVE, MAP_NORESERVE },
5134     { TARGET_MAP_HUGETLB, TARGET_MAP_HUGETLB, MAP_HUGETLB, MAP_HUGETLB },
5135     /* MAP_STACK had been ignored by the kernel for quite some time.
5136        Recognize it for the target insofar as we do not want to pass
5137        it through to the host.  */
5138     { TARGET_MAP_STACK, TARGET_MAP_STACK, 0, 0 },
5139     { 0, 0, 0, 0 }
5140 };
5141 
5142 #if defined(TARGET_I386)
5143 
5144 /* NOTE: there is really one LDT for all the threads */
5145 static uint8_t *ldt_table;
5146 
5147 static abi_long read_ldt(abi_ulong ptr, unsigned long bytecount)
5148 {
5149     int size;
5150     void *p;
5151 
5152     if (!ldt_table)
5153         return 0;
5154     size = TARGET_LDT_ENTRIES * TARGET_LDT_ENTRY_SIZE;
5155     if (size > bytecount)
5156         size = bytecount;
5157     p = lock_user(VERIFY_WRITE, ptr, size, 0);
5158     if (!p)
5159         return -TARGET_EFAULT;
5160     /* ??? Should this by byteswapped?  */
5161     memcpy(p, ldt_table, size);
5162     unlock_user(p, ptr, size);
5163     return size;
5164 }
5165 
5166 /* XXX: add locking support */
5167 static abi_long write_ldt(CPUX86State *env,
5168                           abi_ulong ptr, unsigned long bytecount, int oldmode)
5169 {
5170     struct target_modify_ldt_ldt_s ldt_info;
5171     struct target_modify_ldt_ldt_s *target_ldt_info;
5172     int seg_32bit, contents, read_exec_only, limit_in_pages;
5173     int seg_not_present, useable, lm;
5174     uint32_t *lp, entry_1, entry_2;
5175 
5176     if (bytecount != sizeof(ldt_info))
5177         return -TARGET_EINVAL;
5178     if (!lock_user_struct(VERIFY_READ, target_ldt_info, ptr, 1))
5179         return -TARGET_EFAULT;
5180     ldt_info.entry_number = tswap32(target_ldt_info->entry_number);
5181     ldt_info.base_addr = tswapal(target_ldt_info->base_addr);
5182     ldt_info.limit = tswap32(target_ldt_info->limit);
5183     ldt_info.flags = tswap32(target_ldt_info->flags);
5184     unlock_user_struct(target_ldt_info, ptr, 0);
5185 
5186     if (ldt_info.entry_number >= TARGET_LDT_ENTRIES)
5187         return -TARGET_EINVAL;
5188     seg_32bit = ldt_info.flags & 1;
5189     contents = (ldt_info.flags >> 1) & 3;
5190     read_exec_only = (ldt_info.flags >> 3) & 1;
5191     limit_in_pages = (ldt_info.flags >> 4) & 1;
5192     seg_not_present = (ldt_info.flags >> 5) & 1;
5193     useable = (ldt_info.flags >> 6) & 1;
5194 #ifdef TARGET_ABI32
5195     lm = 0;
5196 #else
5197     lm = (ldt_info.flags >> 7) & 1;
5198 #endif
5199     if (contents == 3) {
5200         if (oldmode)
5201             return -TARGET_EINVAL;
5202         if (seg_not_present == 0)
5203             return -TARGET_EINVAL;
5204     }
5205     /* allocate the LDT */
5206     if (!ldt_table) {
5207         env->ldt.base = target_mmap(0,
5208                                     TARGET_LDT_ENTRIES * TARGET_LDT_ENTRY_SIZE,
5209                                     PROT_READ|PROT_WRITE,
5210                                     MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);
5211         if (env->ldt.base == -1)
5212             return -TARGET_ENOMEM;
5213         memset(g2h(env->ldt.base), 0,
5214                TARGET_LDT_ENTRIES * TARGET_LDT_ENTRY_SIZE);
5215         env->ldt.limit = 0xffff;
5216         ldt_table = g2h(env->ldt.base);
5217     }
5218 
5219     /* NOTE: same code as Linux kernel */
5220     /* Allow LDTs to be cleared by the user. */
5221     if (ldt_info.base_addr == 0 && ldt_info.limit == 0) {
5222         if (oldmode ||
5223             (contents == 0		&&
5224              read_exec_only == 1	&&
5225              seg_32bit == 0		&&
5226              limit_in_pages == 0	&&
5227              seg_not_present == 1	&&
5228              useable == 0 )) {
5229             entry_1 = 0;
5230             entry_2 = 0;
5231             goto install;
5232         }
5233     }
5234 
5235     entry_1 = ((ldt_info.base_addr & 0x0000ffff) << 16) |
5236         (ldt_info.limit & 0x0ffff);
5237     entry_2 = (ldt_info.base_addr & 0xff000000) |
5238         ((ldt_info.base_addr & 0x00ff0000) >> 16) |
5239         (ldt_info.limit & 0xf0000) |
5240         ((read_exec_only ^ 1) << 9) |
5241         (contents << 10) |
5242         ((seg_not_present ^ 1) << 15) |
5243         (seg_32bit << 22) |
5244         (limit_in_pages << 23) |
5245         (lm << 21) |
5246         0x7000;
5247     if (!oldmode)
5248         entry_2 |= (useable << 20);
5249 
5250     /* Install the new entry ...  */
5251 install:
5252     lp = (uint32_t *)(ldt_table + (ldt_info.entry_number << 3));
5253     lp[0] = tswap32(entry_1);
5254     lp[1] = tswap32(entry_2);
5255     return 0;
5256 }
5257 
5258 /* specific and weird i386 syscalls */
5259 static abi_long do_modify_ldt(CPUX86State *env, int func, abi_ulong ptr,
5260                               unsigned long bytecount)
5261 {
5262     abi_long ret;
5263 
5264     switch (func) {
5265     case 0:
5266         ret = read_ldt(ptr, bytecount);
5267         break;
5268     case 1:
5269         ret = write_ldt(env, ptr, bytecount, 1);
5270         break;
5271     case 0x11:
5272         ret = write_ldt(env, ptr, bytecount, 0);
5273         break;
5274     default:
5275         ret = -TARGET_ENOSYS;
5276         break;
5277     }
5278     return ret;
5279 }
5280 
5281 #if defined(TARGET_I386) && defined(TARGET_ABI32)
5282 abi_long do_set_thread_area(CPUX86State *env, abi_ulong ptr)
5283 {
5284     uint64_t *gdt_table = g2h(env->gdt.base);
5285     struct target_modify_ldt_ldt_s ldt_info;
5286     struct target_modify_ldt_ldt_s *target_ldt_info;
5287     int seg_32bit, contents, read_exec_only, limit_in_pages;
5288     int seg_not_present, useable, lm;
5289     uint32_t *lp, entry_1, entry_2;
5290     int i;
5291 
5292     lock_user_struct(VERIFY_WRITE, target_ldt_info, ptr, 1);
5293     if (!target_ldt_info)
5294         return -TARGET_EFAULT;
5295     ldt_info.entry_number = tswap32(target_ldt_info->entry_number);
5296     ldt_info.base_addr = tswapal(target_ldt_info->base_addr);
5297     ldt_info.limit = tswap32(target_ldt_info->limit);
5298     ldt_info.flags = tswap32(target_ldt_info->flags);
5299     if (ldt_info.entry_number == -1) {
5300         for (i=TARGET_GDT_ENTRY_TLS_MIN; i<=TARGET_GDT_ENTRY_TLS_MAX; i++) {
5301             if (gdt_table[i] == 0) {
5302                 ldt_info.entry_number = i;
5303                 target_ldt_info->entry_number = tswap32(i);
5304                 break;
5305             }
5306         }
5307     }
5308     unlock_user_struct(target_ldt_info, ptr, 1);
5309 
5310     if (ldt_info.entry_number < TARGET_GDT_ENTRY_TLS_MIN ||
5311         ldt_info.entry_number > TARGET_GDT_ENTRY_TLS_MAX)
5312            return -TARGET_EINVAL;
5313     seg_32bit = ldt_info.flags & 1;
5314     contents = (ldt_info.flags >> 1) & 3;
5315     read_exec_only = (ldt_info.flags >> 3) & 1;
5316     limit_in_pages = (ldt_info.flags >> 4) & 1;
5317     seg_not_present = (ldt_info.flags >> 5) & 1;
5318     useable = (ldt_info.flags >> 6) & 1;
5319 #ifdef TARGET_ABI32
5320     lm = 0;
5321 #else
5322     lm = (ldt_info.flags >> 7) & 1;
5323 #endif
5324 
5325     if (contents == 3) {
5326         if (seg_not_present == 0)
5327             return -TARGET_EINVAL;
5328     }
5329 
5330     /* NOTE: same code as Linux kernel */
5331     /* Allow LDTs to be cleared by the user. */
5332     if (ldt_info.base_addr == 0 && ldt_info.limit == 0) {
5333         if ((contents == 0             &&
5334              read_exec_only == 1       &&
5335              seg_32bit == 0            &&
5336              limit_in_pages == 0       &&
5337              seg_not_present == 1      &&
5338              useable == 0 )) {
5339             entry_1 = 0;
5340             entry_2 = 0;
5341             goto install;
5342         }
5343     }
5344 
5345     entry_1 = ((ldt_info.base_addr & 0x0000ffff) << 16) |
5346         (ldt_info.limit & 0x0ffff);
5347     entry_2 = (ldt_info.base_addr & 0xff000000) |
5348         ((ldt_info.base_addr & 0x00ff0000) >> 16) |
5349         (ldt_info.limit & 0xf0000) |
5350         ((read_exec_only ^ 1) << 9) |
5351         (contents << 10) |
5352         ((seg_not_present ^ 1) << 15) |
5353         (seg_32bit << 22) |
5354         (limit_in_pages << 23) |
5355         (useable << 20) |
5356         (lm << 21) |
5357         0x7000;
5358 
5359     /* Install the new entry ...  */
5360 install:
5361     lp = (uint32_t *)(gdt_table + ldt_info.entry_number);
5362     lp[0] = tswap32(entry_1);
5363     lp[1] = tswap32(entry_2);
5364     return 0;
5365 }
5366 
5367 static abi_long do_get_thread_area(CPUX86State *env, abi_ulong ptr)
5368 {
5369     struct target_modify_ldt_ldt_s *target_ldt_info;
5370     uint64_t *gdt_table = g2h(env->gdt.base);
5371     uint32_t base_addr, limit, flags;
5372     int seg_32bit, contents, read_exec_only, limit_in_pages, idx;
5373     int seg_not_present, useable, lm;
5374     uint32_t *lp, entry_1, entry_2;
5375 
5376     lock_user_struct(VERIFY_WRITE, target_ldt_info, ptr, 1);
5377     if (!target_ldt_info)
5378         return -TARGET_EFAULT;
5379     idx = tswap32(target_ldt_info->entry_number);
5380     if (idx < TARGET_GDT_ENTRY_TLS_MIN ||
5381         idx > TARGET_GDT_ENTRY_TLS_MAX) {
5382         unlock_user_struct(target_ldt_info, ptr, 1);
5383         return -TARGET_EINVAL;
5384     }
5385     lp = (uint32_t *)(gdt_table + idx);
5386     entry_1 = tswap32(lp[0]);
5387     entry_2 = tswap32(lp[1]);
5388 
5389     read_exec_only = ((entry_2 >> 9) & 1) ^ 1;
5390     contents = (entry_2 >> 10) & 3;
5391     seg_not_present = ((entry_2 >> 15) & 1) ^ 1;
5392     seg_32bit = (entry_2 >> 22) & 1;
5393     limit_in_pages = (entry_2 >> 23) & 1;
5394     useable = (entry_2 >> 20) & 1;
5395 #ifdef TARGET_ABI32
5396     lm = 0;
5397 #else
5398     lm = (entry_2 >> 21) & 1;
5399 #endif
5400     flags = (seg_32bit << 0) | (contents << 1) |
5401         (read_exec_only << 3) | (limit_in_pages << 4) |
5402         (seg_not_present << 5) | (useable << 6) | (lm << 7);
5403     limit = (entry_1 & 0xffff) | (entry_2  & 0xf0000);
5404     base_addr = (entry_1 >> 16) |
5405         (entry_2 & 0xff000000) |
5406         ((entry_2 & 0xff) << 16);
5407     target_ldt_info->base_addr = tswapal(base_addr);
5408     target_ldt_info->limit = tswap32(limit);
5409     target_ldt_info->flags = tswap32(flags);
5410     unlock_user_struct(target_ldt_info, ptr, 1);
5411     return 0;
5412 }
5413 #endif /* TARGET_I386 && TARGET_ABI32 */
5414 
5415 #ifndef TARGET_ABI32
5416 abi_long do_arch_prctl(CPUX86State *env, int code, abi_ulong addr)
5417 {
5418     abi_long ret = 0;
5419     abi_ulong val;
5420     int idx;
5421 
5422     switch(code) {
5423     case TARGET_ARCH_SET_GS:
5424     case TARGET_ARCH_SET_FS:
5425         if (code == TARGET_ARCH_SET_GS)
5426             idx = R_GS;
5427         else
5428             idx = R_FS;
5429         cpu_x86_load_seg(env, idx, 0);
5430         env->segs[idx].base = addr;
5431         break;
5432     case TARGET_ARCH_GET_GS:
5433     case TARGET_ARCH_GET_FS:
5434         if (code == TARGET_ARCH_GET_GS)
5435             idx = R_GS;
5436         else
5437             idx = R_FS;
5438         val = env->segs[idx].base;
5439         if (put_user(val, addr, abi_ulong))
5440             ret = -TARGET_EFAULT;
5441         break;
5442     default:
5443         ret = -TARGET_EINVAL;
5444         break;
5445     }
5446     return ret;
5447 }
5448 #endif
5449 
5450 #endif /* defined(TARGET_I386) */
5451 
5452 #define NEW_STACK_SIZE 0x40000
5453 
5454 
5455 static pthread_mutex_t clone_lock = PTHREAD_MUTEX_INITIALIZER;
5456 typedef struct {
5457     CPUArchState *env;
5458     pthread_mutex_t mutex;
5459     pthread_cond_t cond;
5460     pthread_t thread;
5461     uint32_t tid;
5462     abi_ulong child_tidptr;
5463     abi_ulong parent_tidptr;
5464     sigset_t sigmask;
5465 } new_thread_info;
5466 
5467 static void *clone_func(void *arg)
5468 {
5469     new_thread_info *info = arg;
5470     CPUArchState *env;
5471     CPUState *cpu;
5472     TaskState *ts;
5473 
5474     rcu_register_thread();
5475     tcg_register_thread();
5476     env = info->env;
5477     cpu = ENV_GET_CPU(env);
5478     thread_cpu = cpu;
5479     ts = (TaskState *)cpu->opaque;
5480     info->tid = sys_gettid();
5481     task_settid(ts);
5482     if (info->child_tidptr)
5483         put_user_u32(info->tid, info->child_tidptr);
5484     if (info->parent_tidptr)
5485         put_user_u32(info->tid, info->parent_tidptr);
5486     /* Enable signals.  */
5487     sigprocmask(SIG_SETMASK, &info->sigmask, NULL);
5488     /* Signal to the parent that we're ready.  */
5489     pthread_mutex_lock(&info->mutex);
5490     pthread_cond_broadcast(&info->cond);
5491     pthread_mutex_unlock(&info->mutex);
5492     /* Wait until the parent has finished initializing the tls state.  */
5493     pthread_mutex_lock(&clone_lock);
5494     pthread_mutex_unlock(&clone_lock);
5495     cpu_loop(env);
5496     /* never exits */
5497     return NULL;
5498 }
5499 
5500 /* do_fork() Must return host values and target errnos (unlike most
5501    do_*() functions). */
5502 static int do_fork(CPUArchState *env, unsigned int flags, abi_ulong newsp,
5503                    abi_ulong parent_tidptr, target_ulong newtls,
5504                    abi_ulong child_tidptr)
5505 {
5506     CPUState *cpu = ENV_GET_CPU(env);
5507     int ret;
5508     TaskState *ts;
5509     CPUState *new_cpu;
5510     CPUArchState *new_env;
5511     sigset_t sigmask;
5512 
5513     flags &= ~CLONE_IGNORED_FLAGS;
5514 
5515     /* Emulate vfork() with fork() */
5516     if (flags & CLONE_VFORK)
5517         flags &= ~(CLONE_VFORK | CLONE_VM);
5518 
5519     if (flags & CLONE_VM) {
5520         TaskState *parent_ts = (TaskState *)cpu->opaque;
5521         new_thread_info info;
5522         pthread_attr_t attr;
5523 
5524         if (((flags & CLONE_THREAD_FLAGS) != CLONE_THREAD_FLAGS) ||
5525             (flags & CLONE_INVALID_THREAD_FLAGS)) {
5526             return -TARGET_EINVAL;
5527         }
5528 
5529         ts = g_new0(TaskState, 1);
5530         init_task_state(ts);
5531 
5532         /* Grab a mutex so that thread setup appears atomic.  */
5533         pthread_mutex_lock(&clone_lock);
5534 
5535         /* we create a new CPU instance. */
5536         new_env = cpu_copy(env);
5537         /* Init regs that differ from the parent.  */
5538         cpu_clone_regs(new_env, newsp);
5539         new_cpu = ENV_GET_CPU(new_env);
5540         new_cpu->opaque = ts;
5541         ts->bprm = parent_ts->bprm;
5542         ts->info = parent_ts->info;
5543         ts->signal_mask = parent_ts->signal_mask;
5544 
5545         if (flags & CLONE_CHILD_CLEARTID) {
5546             ts->child_tidptr = child_tidptr;
5547         }
5548 
5549         if (flags & CLONE_SETTLS) {
5550             cpu_set_tls (new_env, newtls);
5551         }
5552 
5553         memset(&info, 0, sizeof(info));
5554         pthread_mutex_init(&info.mutex, NULL);
5555         pthread_mutex_lock(&info.mutex);
5556         pthread_cond_init(&info.cond, NULL);
5557         info.env = new_env;
5558         if (flags & CLONE_CHILD_SETTID) {
5559             info.child_tidptr = child_tidptr;
5560         }
5561         if (flags & CLONE_PARENT_SETTID) {
5562             info.parent_tidptr = parent_tidptr;
5563         }
5564 
5565         ret = pthread_attr_init(&attr);
5566         ret = pthread_attr_setstacksize(&attr, NEW_STACK_SIZE);
5567         ret = pthread_attr_setdetachstate(&attr, PTHREAD_CREATE_DETACHED);
5568         /* It is not safe to deliver signals until the child has finished
5569            initializing, so temporarily block all signals.  */
5570         sigfillset(&sigmask);
5571         sigprocmask(SIG_BLOCK, &sigmask, &info.sigmask);
5572 
5573         /* If this is our first additional thread, we need to ensure we
5574          * generate code for parallel execution and flush old translations.
5575          */
5576         if (!parallel_cpus) {
5577             parallel_cpus = true;
5578             tb_flush(cpu);
5579         }
5580 
5581         ret = pthread_create(&info.thread, &attr, clone_func, &info);
5582         /* TODO: Free new CPU state if thread creation failed.  */
5583 
5584         sigprocmask(SIG_SETMASK, &info.sigmask, NULL);
5585         pthread_attr_destroy(&attr);
5586         if (ret == 0) {
5587             /* Wait for the child to initialize.  */
5588             pthread_cond_wait(&info.cond, &info.mutex);
5589             ret = info.tid;
5590         } else {
5591             ret = -1;
5592         }
5593         pthread_mutex_unlock(&info.mutex);
5594         pthread_cond_destroy(&info.cond);
5595         pthread_mutex_destroy(&info.mutex);
5596         pthread_mutex_unlock(&clone_lock);
5597     } else {
5598         /* if no CLONE_VM, we consider it is a fork */
5599         if (flags & CLONE_INVALID_FORK_FLAGS) {
5600             return -TARGET_EINVAL;
5601         }
5602 
5603         /* We can't support custom termination signals */
5604         if ((flags & CSIGNAL) != TARGET_SIGCHLD) {
5605             return -TARGET_EINVAL;
5606         }
5607 
5608         if (block_signals()) {
5609             return -TARGET_ERESTARTSYS;
5610         }
5611 
5612         fork_start();
5613         ret = fork();
5614         if (ret == 0) {
5615             /* Child Process.  */
5616             cpu_clone_regs(env, newsp);
5617             fork_end(1);
5618             /* There is a race condition here.  The parent process could
5619                theoretically read the TID in the child process before the child
5620                tid is set.  This would require using either ptrace
5621                (not implemented) or having *_tidptr to point at a shared memory
5622                mapping.  We can't repeat the spinlock hack used above because
5623                the child process gets its own copy of the lock.  */
5624             if (flags & CLONE_CHILD_SETTID)
5625                 put_user_u32(sys_gettid(), child_tidptr);
5626             if (flags & CLONE_PARENT_SETTID)
5627                 put_user_u32(sys_gettid(), parent_tidptr);
5628             ts = (TaskState *)cpu->opaque;
5629             if (flags & CLONE_SETTLS)
5630                 cpu_set_tls (env, newtls);
5631             if (flags & CLONE_CHILD_CLEARTID)
5632                 ts->child_tidptr = child_tidptr;
5633         } else {
5634             fork_end(0);
5635         }
5636     }
5637     return ret;
5638 }
5639 
5640 /* warning : doesn't handle linux specific flags... */
5641 static int target_to_host_fcntl_cmd(int cmd)
5642 {
5643     int ret;
5644 
5645     switch(cmd) {
5646     case TARGET_F_DUPFD:
5647     case TARGET_F_GETFD:
5648     case TARGET_F_SETFD:
5649     case TARGET_F_GETFL:
5650     case TARGET_F_SETFL:
5651         ret = cmd;
5652         break;
5653     case TARGET_F_GETLK:
5654         ret = F_GETLK64;
5655         break;
5656     case TARGET_F_SETLK:
5657         ret = F_SETLK64;
5658         break;
5659     case TARGET_F_SETLKW:
5660         ret = F_SETLKW64;
5661         break;
5662     case TARGET_F_GETOWN:
5663         ret = F_GETOWN;
5664         break;
5665     case TARGET_F_SETOWN:
5666         ret = F_SETOWN;
5667         break;
5668     case TARGET_F_GETSIG:
5669         ret = F_GETSIG;
5670         break;
5671     case TARGET_F_SETSIG:
5672         ret = F_SETSIG;
5673         break;
5674 #if TARGET_ABI_BITS == 32
5675     case TARGET_F_GETLK64:
5676         ret = F_GETLK64;
5677         break;
5678     case TARGET_F_SETLK64:
5679         ret = F_SETLK64;
5680         break;
5681     case TARGET_F_SETLKW64:
5682         ret = F_SETLKW64;
5683         break;
5684 #endif
5685     case TARGET_F_SETLEASE:
5686         ret = F_SETLEASE;
5687         break;
5688     case TARGET_F_GETLEASE:
5689         ret = F_GETLEASE;
5690         break;
5691 #ifdef F_DUPFD_CLOEXEC
5692     case TARGET_F_DUPFD_CLOEXEC:
5693         ret = F_DUPFD_CLOEXEC;
5694         break;
5695 #endif
5696     case TARGET_F_NOTIFY:
5697         ret = F_NOTIFY;
5698         break;
5699 #ifdef F_GETOWN_EX
5700     case TARGET_F_GETOWN_EX:
5701         ret = F_GETOWN_EX;
5702         break;
5703 #endif
5704 #ifdef F_SETOWN_EX
5705     case TARGET_F_SETOWN_EX:
5706         ret = F_SETOWN_EX;
5707         break;
5708 #endif
5709 #ifdef F_SETPIPE_SZ
5710     case TARGET_F_SETPIPE_SZ:
5711         ret = F_SETPIPE_SZ;
5712         break;
5713     case TARGET_F_GETPIPE_SZ:
5714         ret = F_GETPIPE_SZ;
5715         break;
5716 #endif
5717     default:
5718         ret = -TARGET_EINVAL;
5719         break;
5720     }
5721 
5722 #if defined(__powerpc64__)
5723     /* On PPC64, glibc headers has the F_*LK* defined to 12, 13 and 14 and
5724      * is not supported by kernel. The glibc fcntl call actually adjusts
5725      * them to 5, 6 and 7 before making the syscall(). Since we make the
5726      * syscall directly, adjust to what is supported by the kernel.
5727      */
5728     if (ret >= F_GETLK64 && ret <= F_SETLKW64) {
5729         ret -= F_GETLK64 - 5;
5730     }
5731 #endif
5732 
5733     return ret;
5734 }
5735 
5736 #define FLOCK_TRANSTBL \
5737     switch (type) { \
5738     TRANSTBL_CONVERT(F_RDLCK); \
5739     TRANSTBL_CONVERT(F_WRLCK); \
5740     TRANSTBL_CONVERT(F_UNLCK); \
5741     TRANSTBL_CONVERT(F_EXLCK); \
5742     TRANSTBL_CONVERT(F_SHLCK); \
5743     }
5744 
5745 static int target_to_host_flock(int type)
5746 {
5747 #define TRANSTBL_CONVERT(a) case TARGET_##a: return a
5748     FLOCK_TRANSTBL
5749 #undef  TRANSTBL_CONVERT
5750     return -TARGET_EINVAL;
5751 }
5752 
5753 static int host_to_target_flock(int type)
5754 {
5755 #define TRANSTBL_CONVERT(a) case a: return TARGET_##a
5756     FLOCK_TRANSTBL
5757 #undef  TRANSTBL_CONVERT
5758     /* if we don't know how to convert the value coming
5759      * from the host we copy to the target field as-is
5760      */
5761     return type;
5762 }
5763 
5764 static inline abi_long copy_from_user_flock(struct flock64 *fl,
5765                                             abi_ulong target_flock_addr)
5766 {
5767     struct target_flock *target_fl;
5768     int l_type;
5769 
5770     if (!lock_user_struct(VERIFY_READ, target_fl, target_flock_addr, 1)) {
5771         return -TARGET_EFAULT;
5772     }
5773 
5774     __get_user(l_type, &target_fl->l_type);
5775     l_type = target_to_host_flock(l_type);
5776     if (l_type < 0) {
5777         return l_type;
5778     }
5779     fl->l_type = l_type;
5780     __get_user(fl->l_whence, &target_fl->l_whence);
5781     __get_user(fl->l_start, &target_fl->l_start);
5782     __get_user(fl->l_len, &target_fl->l_len);
5783     __get_user(fl->l_pid, &target_fl->l_pid);
5784     unlock_user_struct(target_fl, target_flock_addr, 0);
5785     return 0;
5786 }
5787 
5788 static inline abi_long copy_to_user_flock(abi_ulong target_flock_addr,
5789                                           const struct flock64 *fl)
5790 {
5791     struct target_flock *target_fl;
5792     short l_type;
5793 
5794     if (!lock_user_struct(VERIFY_WRITE, target_fl, target_flock_addr, 0)) {
5795         return -TARGET_EFAULT;
5796     }
5797 
5798     l_type = host_to_target_flock(fl->l_type);
5799     __put_user(l_type, &target_fl->l_type);
5800     __put_user(fl->l_whence, &target_fl->l_whence);
5801     __put_user(fl->l_start, &target_fl->l_start);
5802     __put_user(fl->l_len, &target_fl->l_len);
5803     __put_user(fl->l_pid, &target_fl->l_pid);
5804     unlock_user_struct(target_fl, target_flock_addr, 1);
5805     return 0;
5806 }
5807 
5808 typedef abi_long from_flock64_fn(struct flock64 *fl, abi_ulong target_addr);
5809 typedef abi_long to_flock64_fn(abi_ulong target_addr, const struct flock64 *fl);
5810 
5811 #if defined(TARGET_ARM) && TARGET_ABI_BITS == 32
5812 static inline abi_long copy_from_user_oabi_flock64(struct flock64 *fl,
5813                                                    abi_ulong target_flock_addr)
5814 {
5815     struct target_oabi_flock64 *target_fl;
5816     int l_type;
5817 
5818     if (!lock_user_struct(VERIFY_READ, target_fl, target_flock_addr, 1)) {
5819         return -TARGET_EFAULT;
5820     }
5821 
5822     __get_user(l_type, &target_fl->l_type);
5823     l_type = target_to_host_flock(l_type);
5824     if (l_type < 0) {
5825         return l_type;
5826     }
5827     fl->l_type = l_type;
5828     __get_user(fl->l_whence, &target_fl->l_whence);
5829     __get_user(fl->l_start, &target_fl->l_start);
5830     __get_user(fl->l_len, &target_fl->l_len);
5831     __get_user(fl->l_pid, &target_fl->l_pid);
5832     unlock_user_struct(target_fl, target_flock_addr, 0);
5833     return 0;
5834 }
5835 
5836 static inline abi_long copy_to_user_oabi_flock64(abi_ulong target_flock_addr,
5837                                                  const struct flock64 *fl)
5838 {
5839     struct target_oabi_flock64 *target_fl;
5840     short l_type;
5841 
5842     if (!lock_user_struct(VERIFY_WRITE, target_fl, target_flock_addr, 0)) {
5843         return -TARGET_EFAULT;
5844     }
5845 
5846     l_type = host_to_target_flock(fl->l_type);
5847     __put_user(l_type, &target_fl->l_type);
5848     __put_user(fl->l_whence, &target_fl->l_whence);
5849     __put_user(fl->l_start, &target_fl->l_start);
5850     __put_user(fl->l_len, &target_fl->l_len);
5851     __put_user(fl->l_pid, &target_fl->l_pid);
5852     unlock_user_struct(target_fl, target_flock_addr, 1);
5853     return 0;
5854 }
5855 #endif
5856 
5857 static inline abi_long copy_from_user_flock64(struct flock64 *fl,
5858                                               abi_ulong target_flock_addr)
5859 {
5860     struct target_flock64 *target_fl;
5861     int l_type;
5862 
5863     if (!lock_user_struct(VERIFY_READ, target_fl, target_flock_addr, 1)) {
5864         return -TARGET_EFAULT;
5865     }
5866 
5867     __get_user(l_type, &target_fl->l_type);
5868     l_type = target_to_host_flock(l_type);
5869     if (l_type < 0) {
5870         return l_type;
5871     }
5872     fl->l_type = l_type;
5873     __get_user(fl->l_whence, &target_fl->l_whence);
5874     __get_user(fl->l_start, &target_fl->l_start);
5875     __get_user(fl->l_len, &target_fl->l_len);
5876     __get_user(fl->l_pid, &target_fl->l_pid);
5877     unlock_user_struct(target_fl, target_flock_addr, 0);
5878     return 0;
5879 }
5880 
5881 static inline abi_long copy_to_user_flock64(abi_ulong target_flock_addr,
5882                                             const struct flock64 *fl)
5883 {
5884     struct target_flock64 *target_fl;
5885     short l_type;
5886 
5887     if (!lock_user_struct(VERIFY_WRITE, target_fl, target_flock_addr, 0)) {
5888         return -TARGET_EFAULT;
5889     }
5890 
5891     l_type = host_to_target_flock(fl->l_type);
5892     __put_user(l_type, &target_fl->l_type);
5893     __put_user(fl->l_whence, &target_fl->l_whence);
5894     __put_user(fl->l_start, &target_fl->l_start);
5895     __put_user(fl->l_len, &target_fl->l_len);
5896     __put_user(fl->l_pid, &target_fl->l_pid);
5897     unlock_user_struct(target_fl, target_flock_addr, 1);
5898     return 0;
5899 }
5900 
5901 static abi_long do_fcntl(int fd, int cmd, abi_ulong arg)
5902 {
5903     struct flock64 fl64;
5904 #ifdef F_GETOWN_EX
5905     struct f_owner_ex fox;
5906     struct target_f_owner_ex *target_fox;
5907 #endif
5908     abi_long ret;
5909     int host_cmd = target_to_host_fcntl_cmd(cmd);
5910 
5911     if (host_cmd == -TARGET_EINVAL)
5912 	    return host_cmd;
5913 
5914     switch(cmd) {
5915     case TARGET_F_GETLK:
5916         ret = copy_from_user_flock(&fl64, arg);
5917         if (ret) {
5918             return ret;
5919         }
5920         ret = get_errno(safe_fcntl(fd, host_cmd, &fl64));
5921         if (ret == 0) {
5922             ret = copy_to_user_flock(arg, &fl64);
5923         }
5924         break;
5925 
5926     case TARGET_F_SETLK:
5927     case TARGET_F_SETLKW:
5928         ret = copy_from_user_flock(&fl64, arg);
5929         if (ret) {
5930             return ret;
5931         }
5932         ret = get_errno(safe_fcntl(fd, host_cmd, &fl64));
5933         break;
5934 
5935     case TARGET_F_GETLK64:
5936         ret = copy_from_user_flock64(&fl64, arg);
5937         if (ret) {
5938             return ret;
5939         }
5940         ret = get_errno(safe_fcntl(fd, host_cmd, &fl64));
5941         if (ret == 0) {
5942             ret = copy_to_user_flock64(arg, &fl64);
5943         }
5944         break;
5945     case TARGET_F_SETLK64:
5946     case TARGET_F_SETLKW64:
5947         ret = copy_from_user_flock64(&fl64, arg);
5948         if (ret) {
5949             return ret;
5950         }
5951         ret = get_errno(safe_fcntl(fd, host_cmd, &fl64));
5952         break;
5953 
5954     case TARGET_F_GETFL:
5955         ret = get_errno(safe_fcntl(fd, host_cmd, arg));
5956         if (ret >= 0) {
5957             ret = host_to_target_bitmask(ret, fcntl_flags_tbl);
5958         }
5959         break;
5960 
5961     case TARGET_F_SETFL:
5962         ret = get_errno(safe_fcntl(fd, host_cmd,
5963                                    target_to_host_bitmask(arg,
5964                                                           fcntl_flags_tbl)));
5965         break;
5966 
5967 #ifdef F_GETOWN_EX
5968     case TARGET_F_GETOWN_EX:
5969         ret = get_errno(safe_fcntl(fd, host_cmd, &fox));
5970         if (ret >= 0) {
5971             if (!lock_user_struct(VERIFY_WRITE, target_fox, arg, 0))
5972                 return -TARGET_EFAULT;
5973             target_fox->type = tswap32(fox.type);
5974             target_fox->pid = tswap32(fox.pid);
5975             unlock_user_struct(target_fox, arg, 1);
5976         }
5977         break;
5978 #endif
5979 
5980 #ifdef F_SETOWN_EX
5981     case TARGET_F_SETOWN_EX:
5982         if (!lock_user_struct(VERIFY_READ, target_fox, arg, 1))
5983             return -TARGET_EFAULT;
5984         fox.type = tswap32(target_fox->type);
5985         fox.pid = tswap32(target_fox->pid);
5986         unlock_user_struct(target_fox, arg, 0);
5987         ret = get_errno(safe_fcntl(fd, host_cmd, &fox));
5988         break;
5989 #endif
5990 
5991     case TARGET_F_SETOWN:
5992     case TARGET_F_GETOWN:
5993     case TARGET_F_SETSIG:
5994     case TARGET_F_GETSIG:
5995     case TARGET_F_SETLEASE:
5996     case TARGET_F_GETLEASE:
5997     case TARGET_F_SETPIPE_SZ:
5998     case TARGET_F_GETPIPE_SZ:
5999         ret = get_errno(safe_fcntl(fd, host_cmd, arg));
6000         break;
6001 
6002     default:
6003         ret = get_errno(safe_fcntl(fd, cmd, arg));
6004         break;
6005     }
6006     return ret;
6007 }
6008 
6009 #ifdef USE_UID16
6010 
6011 static inline int high2lowuid(int uid)
6012 {
6013     if (uid > 65535)
6014         return 65534;
6015     else
6016         return uid;
6017 }
6018 
6019 static inline int high2lowgid(int gid)
6020 {
6021     if (gid > 65535)
6022         return 65534;
6023     else
6024         return gid;
6025 }
6026 
6027 static inline int low2highuid(int uid)
6028 {
6029     if ((int16_t)uid == -1)
6030         return -1;
6031     else
6032         return uid;
6033 }
6034 
6035 static inline int low2highgid(int gid)
6036 {
6037     if ((int16_t)gid == -1)
6038         return -1;
6039     else
6040         return gid;
6041 }
6042 static inline int tswapid(int id)
6043 {
6044     return tswap16(id);
6045 }
6046 
6047 #define put_user_id(x, gaddr) put_user_u16(x, gaddr)
6048 
6049 #else /* !USE_UID16 */
6050 static inline int high2lowuid(int uid)
6051 {
6052     return uid;
6053 }
6054 static inline int high2lowgid(int gid)
6055 {
6056     return gid;
6057 }
6058 static inline int low2highuid(int uid)
6059 {
6060     return uid;
6061 }
6062 static inline int low2highgid(int gid)
6063 {
6064     return gid;
6065 }
6066 static inline int tswapid(int id)
6067 {
6068     return tswap32(id);
6069 }
6070 
6071 #define put_user_id(x, gaddr) put_user_u32(x, gaddr)
6072 
6073 #endif /* USE_UID16 */
6074 
6075 /* We must do direct syscalls for setting UID/GID, because we want to
6076  * implement the Linux system call semantics of "change only for this thread",
6077  * not the libc/POSIX semantics of "change for all threads in process".
6078  * (See http://ewontfix.com/17/ for more details.)
6079  * We use the 32-bit version of the syscalls if present; if it is not
6080  * then either the host architecture supports 32-bit UIDs natively with
6081  * the standard syscall, or the 16-bit UID is the best we can do.
6082  */
6083 #ifdef __NR_setuid32
6084 #define __NR_sys_setuid __NR_setuid32
6085 #else
6086 #define __NR_sys_setuid __NR_setuid
6087 #endif
6088 #ifdef __NR_setgid32
6089 #define __NR_sys_setgid __NR_setgid32
6090 #else
6091 #define __NR_sys_setgid __NR_setgid
6092 #endif
6093 #ifdef __NR_setresuid32
6094 #define __NR_sys_setresuid __NR_setresuid32
6095 #else
6096 #define __NR_sys_setresuid __NR_setresuid
6097 #endif
6098 #ifdef __NR_setresgid32
6099 #define __NR_sys_setresgid __NR_setresgid32
6100 #else
6101 #define __NR_sys_setresgid __NR_setresgid
6102 #endif
6103 
6104 _syscall1(int, sys_setuid, uid_t, uid)
6105 _syscall1(int, sys_setgid, gid_t, gid)
6106 _syscall3(int, sys_setresuid, uid_t, ruid, uid_t, euid, uid_t, suid)
6107 _syscall3(int, sys_setresgid, gid_t, rgid, gid_t, egid, gid_t, sgid)
6108 
6109 void syscall_init(void)
6110 {
6111     IOCTLEntry *ie;
6112     const argtype *arg_type;
6113     int size;
6114     int i;
6115 
6116     thunk_init(STRUCT_MAX);
6117 
6118 #define STRUCT(name, ...) thunk_register_struct(STRUCT_ ## name, #name, struct_ ## name ## _def);
6119 #define STRUCT_SPECIAL(name) thunk_register_struct_direct(STRUCT_ ## name, #name, &struct_ ## name ## _def);
6120 #include "syscall_types.h"
6121 #undef STRUCT
6122 #undef STRUCT_SPECIAL
6123 
6124     /* Build target_to_host_errno_table[] table from
6125      * host_to_target_errno_table[]. */
6126     for (i = 0; i < ERRNO_TABLE_SIZE; i++) {
6127         target_to_host_errno_table[host_to_target_errno_table[i]] = i;
6128     }
6129 
6130     /* we patch the ioctl size if necessary. We rely on the fact that
6131        no ioctl has all the bits at '1' in the size field */
6132     ie = ioctl_entries;
6133     while (ie->target_cmd != 0) {
6134         if (((ie->target_cmd >> TARGET_IOC_SIZESHIFT) & TARGET_IOC_SIZEMASK) ==
6135             TARGET_IOC_SIZEMASK) {
6136             arg_type = ie->arg_type;
6137             if (arg_type[0] != TYPE_PTR) {
6138                 fprintf(stderr, "cannot patch size for ioctl 0x%x\n",
6139                         ie->target_cmd);
6140                 exit(1);
6141             }
6142             arg_type++;
6143             size = thunk_type_size(arg_type, 0);
6144             ie->target_cmd = (ie->target_cmd &
6145                               ~(TARGET_IOC_SIZEMASK << TARGET_IOC_SIZESHIFT)) |
6146                 (size << TARGET_IOC_SIZESHIFT);
6147         }
6148 
6149         /* automatic consistency check if same arch */
6150 #if (defined(__i386__) && defined(TARGET_I386) && defined(TARGET_ABI32)) || \
6151     (defined(__x86_64__) && defined(TARGET_X86_64))
6152         if (unlikely(ie->target_cmd != ie->host_cmd)) {
6153             fprintf(stderr, "ERROR: ioctl(%s): target=0x%x host=0x%x\n",
6154                     ie->name, ie->target_cmd, ie->host_cmd);
6155         }
6156 #endif
6157         ie++;
6158     }
6159 }
6160 
6161 #if TARGET_ABI_BITS == 32
6162 static inline uint64_t target_offset64(uint32_t word0, uint32_t word1)
6163 {
6164 #ifdef TARGET_WORDS_BIGENDIAN
6165     return ((uint64_t)word0 << 32) | word1;
6166 #else
6167     return ((uint64_t)word1 << 32) | word0;
6168 #endif
6169 }
6170 #else /* TARGET_ABI_BITS == 32 */
6171 static inline uint64_t target_offset64(uint64_t word0, uint64_t word1)
6172 {
6173     return word0;
6174 }
6175 #endif /* TARGET_ABI_BITS != 32 */
6176 
6177 #ifdef TARGET_NR_truncate64
6178 static inline abi_long target_truncate64(void *cpu_env, const char *arg1,
6179                                          abi_long arg2,
6180                                          abi_long arg3,
6181                                          abi_long arg4)
6182 {
6183     if (regpairs_aligned(cpu_env, TARGET_NR_truncate64)) {
6184         arg2 = arg3;
6185         arg3 = arg4;
6186     }
6187     return get_errno(truncate64(arg1, target_offset64(arg2, arg3)));
6188 }
6189 #endif
6190 
6191 #ifdef TARGET_NR_ftruncate64
6192 static inline abi_long target_ftruncate64(void *cpu_env, abi_long arg1,
6193                                           abi_long arg2,
6194                                           abi_long arg3,
6195                                           abi_long arg4)
6196 {
6197     if (regpairs_aligned(cpu_env, TARGET_NR_ftruncate64)) {
6198         arg2 = arg3;
6199         arg3 = arg4;
6200     }
6201     return get_errno(ftruncate64(arg1, target_offset64(arg2, arg3)));
6202 }
6203 #endif
6204 
6205 static inline abi_long target_to_host_timespec(struct timespec *host_ts,
6206                                                abi_ulong target_addr)
6207 {
6208     struct target_timespec *target_ts;
6209 
6210     if (!lock_user_struct(VERIFY_READ, target_ts, target_addr, 1))
6211         return -TARGET_EFAULT;
6212     __get_user(host_ts->tv_sec, &target_ts->tv_sec);
6213     __get_user(host_ts->tv_nsec, &target_ts->tv_nsec);
6214     unlock_user_struct(target_ts, target_addr, 0);
6215     return 0;
6216 }
6217 
6218 static inline abi_long host_to_target_timespec(abi_ulong target_addr,
6219                                                struct timespec *host_ts)
6220 {
6221     struct target_timespec *target_ts;
6222 
6223     if (!lock_user_struct(VERIFY_WRITE, target_ts, target_addr, 0))
6224         return -TARGET_EFAULT;
6225     __put_user(host_ts->tv_sec, &target_ts->tv_sec);
6226     __put_user(host_ts->tv_nsec, &target_ts->tv_nsec);
6227     unlock_user_struct(target_ts, target_addr, 1);
6228     return 0;
6229 }
6230 
6231 static inline abi_long target_to_host_itimerspec(struct itimerspec *host_itspec,
6232                                                  abi_ulong target_addr)
6233 {
6234     struct target_itimerspec *target_itspec;
6235 
6236     if (!lock_user_struct(VERIFY_READ, target_itspec, target_addr, 1)) {
6237         return -TARGET_EFAULT;
6238     }
6239 
6240     host_itspec->it_interval.tv_sec =
6241                             tswapal(target_itspec->it_interval.tv_sec);
6242     host_itspec->it_interval.tv_nsec =
6243                             tswapal(target_itspec->it_interval.tv_nsec);
6244     host_itspec->it_value.tv_sec = tswapal(target_itspec->it_value.tv_sec);
6245     host_itspec->it_value.tv_nsec = tswapal(target_itspec->it_value.tv_nsec);
6246 
6247     unlock_user_struct(target_itspec, target_addr, 1);
6248     return 0;
6249 }
6250 
6251 static inline abi_long host_to_target_itimerspec(abi_ulong target_addr,
6252                                                struct itimerspec *host_its)
6253 {
6254     struct target_itimerspec *target_itspec;
6255 
6256     if (!lock_user_struct(VERIFY_WRITE, target_itspec, target_addr, 0)) {
6257         return -TARGET_EFAULT;
6258     }
6259 
6260     target_itspec->it_interval.tv_sec = tswapal(host_its->it_interval.tv_sec);
6261     target_itspec->it_interval.tv_nsec = tswapal(host_its->it_interval.tv_nsec);
6262 
6263     target_itspec->it_value.tv_sec = tswapal(host_its->it_value.tv_sec);
6264     target_itspec->it_value.tv_nsec = tswapal(host_its->it_value.tv_nsec);
6265 
6266     unlock_user_struct(target_itspec, target_addr, 0);
6267     return 0;
6268 }
6269 
6270 static inline abi_long target_to_host_timex(struct timex *host_tx,
6271                                             abi_long target_addr)
6272 {
6273     struct target_timex *target_tx;
6274 
6275     if (!lock_user_struct(VERIFY_READ, target_tx, target_addr, 1)) {
6276         return -TARGET_EFAULT;
6277     }
6278 
6279     __get_user(host_tx->modes, &target_tx->modes);
6280     __get_user(host_tx->offset, &target_tx->offset);
6281     __get_user(host_tx->freq, &target_tx->freq);
6282     __get_user(host_tx->maxerror, &target_tx->maxerror);
6283     __get_user(host_tx->esterror, &target_tx->esterror);
6284     __get_user(host_tx->status, &target_tx->status);
6285     __get_user(host_tx->constant, &target_tx->constant);
6286     __get_user(host_tx->precision, &target_tx->precision);
6287     __get_user(host_tx->tolerance, &target_tx->tolerance);
6288     __get_user(host_tx->time.tv_sec, &target_tx->time.tv_sec);
6289     __get_user(host_tx->time.tv_usec, &target_tx->time.tv_usec);
6290     __get_user(host_tx->tick, &target_tx->tick);
6291     __get_user(host_tx->ppsfreq, &target_tx->ppsfreq);
6292     __get_user(host_tx->jitter, &target_tx->jitter);
6293     __get_user(host_tx->shift, &target_tx->shift);
6294     __get_user(host_tx->stabil, &target_tx->stabil);
6295     __get_user(host_tx->jitcnt, &target_tx->jitcnt);
6296     __get_user(host_tx->calcnt, &target_tx->calcnt);
6297     __get_user(host_tx->errcnt, &target_tx->errcnt);
6298     __get_user(host_tx->stbcnt, &target_tx->stbcnt);
6299     __get_user(host_tx->tai, &target_tx->tai);
6300 
6301     unlock_user_struct(target_tx, target_addr, 0);
6302     return 0;
6303 }
6304 
6305 static inline abi_long host_to_target_timex(abi_long target_addr,
6306                                             struct timex *host_tx)
6307 {
6308     struct target_timex *target_tx;
6309 
6310     if (!lock_user_struct(VERIFY_WRITE, target_tx, target_addr, 0)) {
6311         return -TARGET_EFAULT;
6312     }
6313 
6314     __put_user(host_tx->modes, &target_tx->modes);
6315     __put_user(host_tx->offset, &target_tx->offset);
6316     __put_user(host_tx->freq, &target_tx->freq);
6317     __put_user(host_tx->maxerror, &target_tx->maxerror);
6318     __put_user(host_tx->esterror, &target_tx->esterror);
6319     __put_user(host_tx->status, &target_tx->status);
6320     __put_user(host_tx->constant, &target_tx->constant);
6321     __put_user(host_tx->precision, &target_tx->precision);
6322     __put_user(host_tx->tolerance, &target_tx->tolerance);
6323     __put_user(host_tx->time.tv_sec, &target_tx->time.tv_sec);
6324     __put_user(host_tx->time.tv_usec, &target_tx->time.tv_usec);
6325     __put_user(host_tx->tick, &target_tx->tick);
6326     __put_user(host_tx->ppsfreq, &target_tx->ppsfreq);
6327     __put_user(host_tx->jitter, &target_tx->jitter);
6328     __put_user(host_tx->shift, &target_tx->shift);
6329     __put_user(host_tx->stabil, &target_tx->stabil);
6330     __put_user(host_tx->jitcnt, &target_tx->jitcnt);
6331     __put_user(host_tx->calcnt, &target_tx->calcnt);
6332     __put_user(host_tx->errcnt, &target_tx->errcnt);
6333     __put_user(host_tx->stbcnt, &target_tx->stbcnt);
6334     __put_user(host_tx->tai, &target_tx->tai);
6335 
6336     unlock_user_struct(target_tx, target_addr, 1);
6337     return 0;
6338 }
6339 
6340 
6341 static inline abi_long target_to_host_sigevent(struct sigevent *host_sevp,
6342                                                abi_ulong target_addr)
6343 {
6344     struct target_sigevent *target_sevp;
6345 
6346     if (!lock_user_struct(VERIFY_READ, target_sevp, target_addr, 1)) {
6347         return -TARGET_EFAULT;
6348     }
6349 
6350     /* This union is awkward on 64 bit systems because it has a 32 bit
6351      * integer and a pointer in it; we follow the conversion approach
6352      * used for handling sigval types in signal.c so the guest should get
6353      * the correct value back even if we did a 64 bit byteswap and it's
6354      * using the 32 bit integer.
6355      */
6356     host_sevp->sigev_value.sival_ptr =
6357         (void *)(uintptr_t)tswapal(target_sevp->sigev_value.sival_ptr);
6358     host_sevp->sigev_signo =
6359         target_to_host_signal(tswap32(target_sevp->sigev_signo));
6360     host_sevp->sigev_notify = tswap32(target_sevp->sigev_notify);
6361     host_sevp->_sigev_un._tid = tswap32(target_sevp->_sigev_un._tid);
6362 
6363     unlock_user_struct(target_sevp, target_addr, 1);
6364     return 0;
6365 }
6366 
6367 #if defined(TARGET_NR_mlockall)
6368 static inline int target_to_host_mlockall_arg(int arg)
6369 {
6370     int result = 0;
6371 
6372     if (arg & TARGET_MLOCKALL_MCL_CURRENT) {
6373         result |= MCL_CURRENT;
6374     }
6375     if (arg & TARGET_MLOCKALL_MCL_FUTURE) {
6376         result |= MCL_FUTURE;
6377     }
6378     return result;
6379 }
6380 #endif
6381 
6382 #if (defined(TARGET_NR_stat64) || defined(TARGET_NR_lstat64) ||     \
6383      defined(TARGET_NR_fstat64) || defined(TARGET_NR_fstatat64) ||  \
6384      defined(TARGET_NR_newfstatat))
6385 static inline abi_long host_to_target_stat64(void *cpu_env,
6386                                              abi_ulong target_addr,
6387                                              struct stat *host_st)
6388 {
6389 #if defined(TARGET_ARM) && defined(TARGET_ABI32)
6390     if (((CPUARMState *)cpu_env)->eabi) {
6391         struct target_eabi_stat64 *target_st;
6392 
6393         if (!lock_user_struct(VERIFY_WRITE, target_st, target_addr, 0))
6394             return -TARGET_EFAULT;
6395         memset(target_st, 0, sizeof(struct target_eabi_stat64));
6396         __put_user(host_st->st_dev, &target_st->st_dev);
6397         __put_user(host_st->st_ino, &target_st->st_ino);
6398 #ifdef TARGET_STAT64_HAS_BROKEN_ST_INO
6399         __put_user(host_st->st_ino, &target_st->__st_ino);
6400 #endif
6401         __put_user(host_st->st_mode, &target_st->st_mode);
6402         __put_user(host_st->st_nlink, &target_st->st_nlink);
6403         __put_user(host_st->st_uid, &target_st->st_uid);
6404         __put_user(host_st->st_gid, &target_st->st_gid);
6405         __put_user(host_st->st_rdev, &target_st->st_rdev);
6406         __put_user(host_st->st_size, &target_st->st_size);
6407         __put_user(host_st->st_blksize, &target_st->st_blksize);
6408         __put_user(host_st->st_blocks, &target_st->st_blocks);
6409         __put_user(host_st->st_atime, &target_st->target_st_atime);
6410         __put_user(host_st->st_mtime, &target_st->target_st_mtime);
6411         __put_user(host_st->st_ctime, &target_st->target_st_ctime);
6412         unlock_user_struct(target_st, target_addr, 1);
6413     } else
6414 #endif
6415     {
6416 #if defined(TARGET_HAS_STRUCT_STAT64)
6417         struct target_stat64 *target_st;
6418 #else
6419         struct target_stat *target_st;
6420 #endif
6421 
6422         if (!lock_user_struct(VERIFY_WRITE, target_st, target_addr, 0))
6423             return -TARGET_EFAULT;
6424         memset(target_st, 0, sizeof(*target_st));
6425         __put_user(host_st->st_dev, &target_st->st_dev);
6426         __put_user(host_st->st_ino, &target_st->st_ino);
6427 #ifdef TARGET_STAT64_HAS_BROKEN_ST_INO
6428         __put_user(host_st->st_ino, &target_st->__st_ino);
6429 #endif
6430         __put_user(host_st->st_mode, &target_st->st_mode);
6431         __put_user(host_st->st_nlink, &target_st->st_nlink);
6432         __put_user(host_st->st_uid, &target_st->st_uid);
6433         __put_user(host_st->st_gid, &target_st->st_gid);
6434         __put_user(host_st->st_rdev, &target_st->st_rdev);
6435         /* XXX: better use of kernel struct */
6436         __put_user(host_st->st_size, &target_st->st_size);
6437         __put_user(host_st->st_blksize, &target_st->st_blksize);
6438         __put_user(host_st->st_blocks, &target_st->st_blocks);
6439         __put_user(host_st->st_atime, &target_st->target_st_atime);
6440         __put_user(host_st->st_mtime, &target_st->target_st_mtime);
6441         __put_user(host_st->st_ctime, &target_st->target_st_ctime);
6442         unlock_user_struct(target_st, target_addr, 1);
6443     }
6444 
6445     return 0;
6446 }
6447 #endif
6448 
6449 /* ??? Using host futex calls even when target atomic operations
6450    are not really atomic probably breaks things.  However implementing
6451    futexes locally would make futexes shared between multiple processes
6452    tricky.  However they're probably useless because guest atomic
6453    operations won't work either.  */
6454 static int do_futex(target_ulong uaddr, int op, int val, target_ulong timeout,
6455                     target_ulong uaddr2, int val3)
6456 {
6457     struct timespec ts, *pts;
6458     int base_op;
6459 
6460     /* ??? We assume FUTEX_* constants are the same on both host
6461        and target.  */
6462 #ifdef FUTEX_CMD_MASK
6463     base_op = op & FUTEX_CMD_MASK;
6464 #else
6465     base_op = op;
6466 #endif
6467     switch (base_op) {
6468     case FUTEX_WAIT:
6469     case FUTEX_WAIT_BITSET:
6470         if (timeout) {
6471             pts = &ts;
6472             target_to_host_timespec(pts, timeout);
6473         } else {
6474             pts = NULL;
6475         }
6476         return get_errno(safe_futex(g2h(uaddr), op, tswap32(val),
6477                          pts, NULL, val3));
6478     case FUTEX_WAKE:
6479         return get_errno(safe_futex(g2h(uaddr), op, val, NULL, NULL, 0));
6480     case FUTEX_FD:
6481         return get_errno(safe_futex(g2h(uaddr), op, val, NULL, NULL, 0));
6482     case FUTEX_REQUEUE:
6483     case FUTEX_CMP_REQUEUE:
6484     case FUTEX_WAKE_OP:
6485         /* For FUTEX_REQUEUE, FUTEX_CMP_REQUEUE, and FUTEX_WAKE_OP, the
6486            TIMEOUT parameter is interpreted as a uint32_t by the kernel.
6487            But the prototype takes a `struct timespec *'; insert casts
6488            to satisfy the compiler.  We do not need to tswap TIMEOUT
6489            since it's not compared to guest memory.  */
6490         pts = (struct timespec *)(uintptr_t) timeout;
6491         return get_errno(safe_futex(g2h(uaddr), op, val, pts,
6492                                     g2h(uaddr2),
6493                                     (base_op == FUTEX_CMP_REQUEUE
6494                                      ? tswap32(val3)
6495                                      : val3)));
6496     default:
6497         return -TARGET_ENOSYS;
6498     }
6499 }
6500 #if defined(TARGET_NR_name_to_handle_at) && defined(CONFIG_OPEN_BY_HANDLE)
6501 static abi_long do_name_to_handle_at(abi_long dirfd, abi_long pathname,
6502                                      abi_long handle, abi_long mount_id,
6503                                      abi_long flags)
6504 {
6505     struct file_handle *target_fh;
6506     struct file_handle *fh;
6507     int mid = 0;
6508     abi_long ret;
6509     char *name;
6510     unsigned int size, total_size;
6511 
6512     if (get_user_s32(size, handle)) {
6513         return -TARGET_EFAULT;
6514     }
6515 
6516     name = lock_user_string(pathname);
6517     if (!name) {
6518         return -TARGET_EFAULT;
6519     }
6520 
6521     total_size = sizeof(struct file_handle) + size;
6522     target_fh = lock_user(VERIFY_WRITE, handle, total_size, 0);
6523     if (!target_fh) {
6524         unlock_user(name, pathname, 0);
6525         return -TARGET_EFAULT;
6526     }
6527 
6528     fh = g_malloc0(total_size);
6529     fh->handle_bytes = size;
6530 
6531     ret = get_errno(name_to_handle_at(dirfd, path(name), fh, &mid, flags));
6532     unlock_user(name, pathname, 0);
6533 
6534     /* man name_to_handle_at(2):
6535      * Other than the use of the handle_bytes field, the caller should treat
6536      * the file_handle structure as an opaque data type
6537      */
6538 
6539     memcpy(target_fh, fh, total_size);
6540     target_fh->handle_bytes = tswap32(fh->handle_bytes);
6541     target_fh->handle_type = tswap32(fh->handle_type);
6542     g_free(fh);
6543     unlock_user(target_fh, handle, total_size);
6544 
6545     if (put_user_s32(mid, mount_id)) {
6546         return -TARGET_EFAULT;
6547     }
6548 
6549     return ret;
6550 
6551 }
6552 #endif
6553 
6554 #if defined(TARGET_NR_open_by_handle_at) && defined(CONFIG_OPEN_BY_HANDLE)
6555 static abi_long do_open_by_handle_at(abi_long mount_fd, abi_long handle,
6556                                      abi_long flags)
6557 {
6558     struct file_handle *target_fh;
6559     struct file_handle *fh;
6560     unsigned int size, total_size;
6561     abi_long ret;
6562 
6563     if (get_user_s32(size, handle)) {
6564         return -TARGET_EFAULT;
6565     }
6566 
6567     total_size = sizeof(struct file_handle) + size;
6568     target_fh = lock_user(VERIFY_READ, handle, total_size, 1);
6569     if (!target_fh) {
6570         return -TARGET_EFAULT;
6571     }
6572 
6573     fh = g_memdup(target_fh, total_size);
6574     fh->handle_bytes = size;
6575     fh->handle_type = tswap32(target_fh->handle_type);
6576 
6577     ret = get_errno(open_by_handle_at(mount_fd, fh,
6578                     target_to_host_bitmask(flags, fcntl_flags_tbl)));
6579 
6580     g_free(fh);
6581 
6582     unlock_user(target_fh, handle, total_size);
6583 
6584     return ret;
6585 }
6586 #endif
6587 
6588 #if defined(TARGET_NR_signalfd) || defined(TARGET_NR_signalfd4)
6589 
6590 static abi_long do_signalfd4(int fd, abi_long mask, int flags)
6591 {
6592     int host_flags;
6593     target_sigset_t *target_mask;
6594     sigset_t host_mask;
6595     abi_long ret;
6596 
6597     if (flags & ~(TARGET_O_NONBLOCK | TARGET_O_CLOEXEC)) {
6598         return -TARGET_EINVAL;
6599     }
6600     if (!lock_user_struct(VERIFY_READ, target_mask, mask, 1)) {
6601         return -TARGET_EFAULT;
6602     }
6603 
6604     target_to_host_sigset(&host_mask, target_mask);
6605 
6606     host_flags = target_to_host_bitmask(flags, fcntl_flags_tbl);
6607 
6608     ret = get_errno(signalfd(fd, &host_mask, host_flags));
6609     if (ret >= 0) {
6610         fd_trans_register(ret, &target_signalfd_trans);
6611     }
6612 
6613     unlock_user_struct(target_mask, mask, 0);
6614 
6615     return ret;
6616 }
6617 #endif
6618 
6619 /* Map host to target signal numbers for the wait family of syscalls.
6620    Assume all other status bits are the same.  */
6621 int host_to_target_waitstatus(int status)
6622 {
6623     if (WIFSIGNALED(status)) {
6624         return host_to_target_signal(WTERMSIG(status)) | (status & ~0x7f);
6625     }
6626     if (WIFSTOPPED(status)) {
6627         return (host_to_target_signal(WSTOPSIG(status)) << 8)
6628                | (status & 0xff);
6629     }
6630     return status;
6631 }
6632 
6633 static int open_self_cmdline(void *cpu_env, int fd)
6634 {
6635     CPUState *cpu = ENV_GET_CPU((CPUArchState *)cpu_env);
6636     struct linux_binprm *bprm = ((TaskState *)cpu->opaque)->bprm;
6637     int i;
6638 
6639     for (i = 0; i < bprm->argc; i++) {
6640         size_t len = strlen(bprm->argv[i]) + 1;
6641 
6642         if (write(fd, bprm->argv[i], len) != len) {
6643             return -1;
6644         }
6645     }
6646 
6647     return 0;
6648 }
6649 
6650 static int open_self_maps(void *cpu_env, int fd)
6651 {
6652     CPUState *cpu = ENV_GET_CPU((CPUArchState *)cpu_env);
6653     TaskState *ts = cpu->opaque;
6654     FILE *fp;
6655     char *line = NULL;
6656     size_t len = 0;
6657     ssize_t read;
6658 
6659     fp = fopen("/proc/self/maps", "r");
6660     if (fp == NULL) {
6661         return -1;
6662     }
6663 
6664     while ((read = getline(&line, &len, fp)) != -1) {
6665         int fields, dev_maj, dev_min, inode;
6666         uint64_t min, max, offset;
6667         char flag_r, flag_w, flag_x, flag_p;
6668         char path[512] = "";
6669         fields = sscanf(line, "%"PRIx64"-%"PRIx64" %c%c%c%c %"PRIx64" %x:%x %d"
6670                         " %512s", &min, &max, &flag_r, &flag_w, &flag_x,
6671                         &flag_p, &offset, &dev_maj, &dev_min, &inode, path);
6672 
6673         if ((fields < 10) || (fields > 11)) {
6674             continue;
6675         }
6676         if (h2g_valid(min)) {
6677             int flags = page_get_flags(h2g(min));
6678             max = h2g_valid(max - 1) ? max : (uintptr_t)g2h(GUEST_ADDR_MAX) + 1;
6679             if (page_check_range(h2g(min), max - min, flags) == -1) {
6680                 continue;
6681             }
6682             if (h2g(min) == ts->info->stack_limit) {
6683                 pstrcpy(path, sizeof(path), "      [stack]");
6684             }
6685             dprintf(fd, TARGET_ABI_FMT_ptr "-" TARGET_ABI_FMT_ptr
6686                     " %c%c%c%c %08" PRIx64 " %02x:%02x %d %s%s\n",
6687                     h2g(min), h2g(max - 1) + 1, flag_r, flag_w,
6688                     flag_x, flag_p, offset, dev_maj, dev_min, inode,
6689                     path[0] ? "         " : "", path);
6690         }
6691     }
6692 
6693     free(line);
6694     fclose(fp);
6695 
6696     return 0;
6697 }
6698 
6699 static int open_self_stat(void *cpu_env, int fd)
6700 {
6701     CPUState *cpu = ENV_GET_CPU((CPUArchState *)cpu_env);
6702     TaskState *ts = cpu->opaque;
6703     abi_ulong start_stack = ts->info->start_stack;
6704     int i;
6705 
6706     for (i = 0; i < 44; i++) {
6707       char buf[128];
6708       int len;
6709       uint64_t val = 0;
6710 
6711       if (i == 0) {
6712         /* pid */
6713         val = getpid();
6714         snprintf(buf, sizeof(buf), "%"PRId64 " ", val);
6715       } else if (i == 1) {
6716         /* app name */
6717         snprintf(buf, sizeof(buf), "(%s) ", ts->bprm->argv[0]);
6718       } else if (i == 27) {
6719         /* stack bottom */
6720         val = start_stack;
6721         snprintf(buf, sizeof(buf), "%"PRId64 " ", val);
6722       } else {
6723         /* for the rest, there is MasterCard */
6724         snprintf(buf, sizeof(buf), "0%c", i == 43 ? '\n' : ' ');
6725       }
6726 
6727       len = strlen(buf);
6728       if (write(fd, buf, len) != len) {
6729           return -1;
6730       }
6731     }
6732 
6733     return 0;
6734 }
6735 
6736 static int open_self_auxv(void *cpu_env, int fd)
6737 {
6738     CPUState *cpu = ENV_GET_CPU((CPUArchState *)cpu_env);
6739     TaskState *ts = cpu->opaque;
6740     abi_ulong auxv = ts->info->saved_auxv;
6741     abi_ulong len = ts->info->auxv_len;
6742     char *ptr;
6743 
6744     /*
6745      * Auxiliary vector is stored in target process stack.
6746      * read in whole auxv vector and copy it to file
6747      */
6748     ptr = lock_user(VERIFY_READ, auxv, len, 0);
6749     if (ptr != NULL) {
6750         while (len > 0) {
6751             ssize_t r;
6752             r = write(fd, ptr, len);
6753             if (r <= 0) {
6754                 break;
6755             }
6756             len -= r;
6757             ptr += r;
6758         }
6759         lseek(fd, 0, SEEK_SET);
6760         unlock_user(ptr, auxv, len);
6761     }
6762 
6763     return 0;
6764 }
6765 
6766 static int is_proc_myself(const char *filename, const char *entry)
6767 {
6768     if (!strncmp(filename, "/proc/", strlen("/proc/"))) {
6769         filename += strlen("/proc/");
6770         if (!strncmp(filename, "self/", strlen("self/"))) {
6771             filename += strlen("self/");
6772         } else if (*filename >= '1' && *filename <= '9') {
6773             char myself[80];
6774             snprintf(myself, sizeof(myself), "%d/", getpid());
6775             if (!strncmp(filename, myself, strlen(myself))) {
6776                 filename += strlen(myself);
6777             } else {
6778                 return 0;
6779             }
6780         } else {
6781             return 0;
6782         }
6783         if (!strcmp(filename, entry)) {
6784             return 1;
6785         }
6786     }
6787     return 0;
6788 }
6789 
6790 #if defined(HOST_WORDS_BIGENDIAN) != defined(TARGET_WORDS_BIGENDIAN) || \
6791     defined(TARGET_SPARC) || defined(TARGET_M68K)
6792 static int is_proc(const char *filename, const char *entry)
6793 {
6794     return strcmp(filename, entry) == 0;
6795 }
6796 #endif
6797 
6798 #if defined(HOST_WORDS_BIGENDIAN) != defined(TARGET_WORDS_BIGENDIAN)
6799 static int open_net_route(void *cpu_env, int fd)
6800 {
6801     FILE *fp;
6802     char *line = NULL;
6803     size_t len = 0;
6804     ssize_t read;
6805 
6806     fp = fopen("/proc/net/route", "r");
6807     if (fp == NULL) {
6808         return -1;
6809     }
6810 
6811     /* read header */
6812 
6813     read = getline(&line, &len, fp);
6814     dprintf(fd, "%s", line);
6815 
6816     /* read routes */
6817 
6818     while ((read = getline(&line, &len, fp)) != -1) {
6819         char iface[16];
6820         uint32_t dest, gw, mask;
6821         unsigned int flags, refcnt, use, metric, mtu, window, irtt;
6822         int fields;
6823 
6824         fields = sscanf(line,
6825                         "%s\t%08x\t%08x\t%04x\t%d\t%d\t%d\t%08x\t%d\t%u\t%u\n",
6826                         iface, &dest, &gw, &flags, &refcnt, &use, &metric,
6827                         &mask, &mtu, &window, &irtt);
6828         if (fields != 11) {
6829             continue;
6830         }
6831         dprintf(fd, "%s\t%08x\t%08x\t%04x\t%d\t%d\t%d\t%08x\t%d\t%u\t%u\n",
6832                 iface, tswap32(dest), tswap32(gw), flags, refcnt, use,
6833                 metric, tswap32(mask), mtu, window, irtt);
6834     }
6835 
6836     free(line);
6837     fclose(fp);
6838 
6839     return 0;
6840 }
6841 #endif
6842 
6843 #if defined(TARGET_SPARC)
6844 static int open_cpuinfo(void *cpu_env, int fd)
6845 {
6846     dprintf(fd, "type\t\t: sun4u\n");
6847     return 0;
6848 }
6849 #endif
6850 
6851 #if defined(TARGET_M68K)
6852 static int open_hardware(void *cpu_env, int fd)
6853 {
6854     dprintf(fd, "Model:\t\tqemu-m68k\n");
6855     return 0;
6856 }
6857 #endif
6858 
6859 static int do_openat(void *cpu_env, int dirfd, const char *pathname, int flags, mode_t mode)
6860 {
6861     struct fake_open {
6862         const char *filename;
6863         int (*fill)(void *cpu_env, int fd);
6864         int (*cmp)(const char *s1, const char *s2);
6865     };
6866     const struct fake_open *fake_open;
6867     static const struct fake_open fakes[] = {
6868         { "maps", open_self_maps, is_proc_myself },
6869         { "stat", open_self_stat, is_proc_myself },
6870         { "auxv", open_self_auxv, is_proc_myself },
6871         { "cmdline", open_self_cmdline, is_proc_myself },
6872 #if defined(HOST_WORDS_BIGENDIAN) != defined(TARGET_WORDS_BIGENDIAN)
6873         { "/proc/net/route", open_net_route, is_proc },
6874 #endif
6875 #if defined(TARGET_SPARC)
6876         { "/proc/cpuinfo", open_cpuinfo, is_proc },
6877 #endif
6878 #if defined(TARGET_M68K)
6879         { "/proc/hardware", open_hardware, is_proc },
6880 #endif
6881         { NULL, NULL, NULL }
6882     };
6883 
6884     if (is_proc_myself(pathname, "exe")) {
6885         int execfd = qemu_getauxval(AT_EXECFD);
6886         return execfd ? execfd : safe_openat(dirfd, exec_path, flags, mode);
6887     }
6888 
6889     for (fake_open = fakes; fake_open->filename; fake_open++) {
6890         if (fake_open->cmp(pathname, fake_open->filename)) {
6891             break;
6892         }
6893     }
6894 
6895     if (fake_open->filename) {
6896         const char *tmpdir;
6897         char filename[PATH_MAX];
6898         int fd, r;
6899 
6900         /* create temporary file to map stat to */
6901         tmpdir = getenv("TMPDIR");
6902         if (!tmpdir)
6903             tmpdir = "/tmp";
6904         snprintf(filename, sizeof(filename), "%s/qemu-open.XXXXXX", tmpdir);
6905         fd = mkstemp(filename);
6906         if (fd < 0) {
6907             return fd;
6908         }
6909         unlink(filename);
6910 
6911         if ((r = fake_open->fill(cpu_env, fd))) {
6912             int e = errno;
6913             close(fd);
6914             errno = e;
6915             return r;
6916         }
6917         lseek(fd, 0, SEEK_SET);
6918 
6919         return fd;
6920     }
6921 
6922     return safe_openat(dirfd, path(pathname), flags, mode);
6923 }
6924 
6925 #define TIMER_MAGIC 0x0caf0000
6926 #define TIMER_MAGIC_MASK 0xffff0000
6927 
6928 /* Convert QEMU provided timer ID back to internal 16bit index format */
6929 static target_timer_t get_timer_id(abi_long arg)
6930 {
6931     target_timer_t timerid = arg;
6932 
6933     if ((timerid & TIMER_MAGIC_MASK) != TIMER_MAGIC) {
6934         return -TARGET_EINVAL;
6935     }
6936 
6937     timerid &= 0xffff;
6938 
6939     if (timerid >= ARRAY_SIZE(g_posix_timers)) {
6940         return -TARGET_EINVAL;
6941     }
6942 
6943     return timerid;
6944 }
6945 
6946 static int target_to_host_cpu_mask(unsigned long *host_mask,
6947                                    size_t host_size,
6948                                    abi_ulong target_addr,
6949                                    size_t target_size)
6950 {
6951     unsigned target_bits = sizeof(abi_ulong) * 8;
6952     unsigned host_bits = sizeof(*host_mask) * 8;
6953     abi_ulong *target_mask;
6954     unsigned i, j;
6955 
6956     assert(host_size >= target_size);
6957 
6958     target_mask = lock_user(VERIFY_READ, target_addr, target_size, 1);
6959     if (!target_mask) {
6960         return -TARGET_EFAULT;
6961     }
6962     memset(host_mask, 0, host_size);
6963 
6964     for (i = 0 ; i < target_size / sizeof(abi_ulong); i++) {
6965         unsigned bit = i * target_bits;
6966         abi_ulong val;
6967 
6968         __get_user(val, &target_mask[i]);
6969         for (j = 0; j < target_bits; j++, bit++) {
6970             if (val & (1UL << j)) {
6971                 host_mask[bit / host_bits] |= 1UL << (bit % host_bits);
6972             }
6973         }
6974     }
6975 
6976     unlock_user(target_mask, target_addr, 0);
6977     return 0;
6978 }
6979 
6980 static int host_to_target_cpu_mask(const unsigned long *host_mask,
6981                                    size_t host_size,
6982                                    abi_ulong target_addr,
6983                                    size_t target_size)
6984 {
6985     unsigned target_bits = sizeof(abi_ulong) * 8;
6986     unsigned host_bits = sizeof(*host_mask) * 8;
6987     abi_ulong *target_mask;
6988     unsigned i, j;
6989 
6990     assert(host_size >= target_size);
6991 
6992     target_mask = lock_user(VERIFY_WRITE, target_addr, target_size, 0);
6993     if (!target_mask) {
6994         return -TARGET_EFAULT;
6995     }
6996 
6997     for (i = 0 ; i < target_size / sizeof(abi_ulong); i++) {
6998         unsigned bit = i * target_bits;
6999         abi_ulong val = 0;
7000 
7001         for (j = 0; j < target_bits; j++, bit++) {
7002             if (host_mask[bit / host_bits] & (1UL << (bit % host_bits))) {
7003                 val |= 1UL << j;
7004             }
7005         }
7006         __put_user(val, &target_mask[i]);
7007     }
7008 
7009     unlock_user(target_mask, target_addr, target_size);
7010     return 0;
7011 }
7012 
7013 /* This is an internal helper for do_syscall so that it is easier
7014  * to have a single return point, so that actions, such as logging
7015  * of syscall results, can be performed.
7016  * All errnos that do_syscall() returns must be -TARGET_<errcode>.
7017  */
7018 static abi_long do_syscall1(void *cpu_env, int num, abi_long arg1,
7019                             abi_long arg2, abi_long arg3, abi_long arg4,
7020                             abi_long arg5, abi_long arg6, abi_long arg7,
7021                             abi_long arg8)
7022 {
7023     CPUState *cpu = ENV_GET_CPU(cpu_env);
7024     abi_long ret;
7025 #if defined(TARGET_NR_stat) || defined(TARGET_NR_stat64) \
7026     || defined(TARGET_NR_lstat) || defined(TARGET_NR_lstat64) \
7027     || defined(TARGET_NR_fstat) || defined(TARGET_NR_fstat64)
7028     struct stat st;
7029 #endif
7030 #if defined(TARGET_NR_statfs) || defined(TARGET_NR_statfs64) \
7031     || defined(TARGET_NR_fstatfs)
7032     struct statfs stfs;
7033 #endif
7034     void *p;
7035 
7036     switch(num) {
7037     case TARGET_NR_exit:
7038         /* In old applications this may be used to implement _exit(2).
7039            However in threaded applictions it is used for thread termination,
7040            and _exit_group is used for application termination.
7041            Do thread termination if we have more then one thread.  */
7042 
7043         if (block_signals()) {
7044             return -TARGET_ERESTARTSYS;
7045         }
7046 
7047         cpu_list_lock();
7048 
7049         if (CPU_NEXT(first_cpu)) {
7050             TaskState *ts;
7051 
7052             /* Remove the CPU from the list.  */
7053             QTAILQ_REMOVE_RCU(&cpus, cpu, node);
7054 
7055             cpu_list_unlock();
7056 
7057             ts = cpu->opaque;
7058             if (ts->child_tidptr) {
7059                 put_user_u32(0, ts->child_tidptr);
7060                 sys_futex(g2h(ts->child_tidptr), FUTEX_WAKE, INT_MAX,
7061                           NULL, NULL, 0);
7062             }
7063             thread_cpu = NULL;
7064             object_unref(OBJECT(cpu));
7065             g_free(ts);
7066             rcu_unregister_thread();
7067             pthread_exit(NULL);
7068         }
7069 
7070         cpu_list_unlock();
7071         preexit_cleanup(cpu_env, arg1);
7072         _exit(arg1);
7073         return 0; /* avoid warning */
7074     case TARGET_NR_read:
7075         if (arg2 == 0 && arg3 == 0) {
7076             return get_errno(safe_read(arg1, 0, 0));
7077         } else {
7078             if (!(p = lock_user(VERIFY_WRITE, arg2, arg3, 0)))
7079                 return -TARGET_EFAULT;
7080             ret = get_errno(safe_read(arg1, p, arg3));
7081             if (ret >= 0 &&
7082                 fd_trans_host_to_target_data(arg1)) {
7083                 ret = fd_trans_host_to_target_data(arg1)(p, ret);
7084             }
7085             unlock_user(p, arg2, ret);
7086         }
7087         return ret;
7088     case TARGET_NR_write:
7089         if (arg2 == 0 && arg3 == 0) {
7090             return get_errno(safe_write(arg1, 0, 0));
7091         }
7092         if (!(p = lock_user(VERIFY_READ, arg2, arg3, 1)))
7093             return -TARGET_EFAULT;
7094         if (fd_trans_target_to_host_data(arg1)) {
7095             void *copy = g_malloc(arg3);
7096             memcpy(copy, p, arg3);
7097             ret = fd_trans_target_to_host_data(arg1)(copy, arg3);
7098             if (ret >= 0) {
7099                 ret = get_errno(safe_write(arg1, copy, ret));
7100             }
7101             g_free(copy);
7102         } else {
7103             ret = get_errno(safe_write(arg1, p, arg3));
7104         }
7105         unlock_user(p, arg2, 0);
7106         return ret;
7107 
7108 #ifdef TARGET_NR_open
7109     case TARGET_NR_open:
7110         if (!(p = lock_user_string(arg1)))
7111             return -TARGET_EFAULT;
7112         ret = get_errno(do_openat(cpu_env, AT_FDCWD, p,
7113                                   target_to_host_bitmask(arg2, fcntl_flags_tbl),
7114                                   arg3));
7115         fd_trans_unregister(ret);
7116         unlock_user(p, arg1, 0);
7117         return ret;
7118 #endif
7119     case TARGET_NR_openat:
7120         if (!(p = lock_user_string(arg2)))
7121             return -TARGET_EFAULT;
7122         ret = get_errno(do_openat(cpu_env, arg1, p,
7123                                   target_to_host_bitmask(arg3, fcntl_flags_tbl),
7124                                   arg4));
7125         fd_trans_unregister(ret);
7126         unlock_user(p, arg2, 0);
7127         return ret;
7128 #if defined(TARGET_NR_name_to_handle_at) && defined(CONFIG_OPEN_BY_HANDLE)
7129     case TARGET_NR_name_to_handle_at:
7130         ret = do_name_to_handle_at(arg1, arg2, arg3, arg4, arg5);
7131         return ret;
7132 #endif
7133 #if defined(TARGET_NR_open_by_handle_at) && defined(CONFIG_OPEN_BY_HANDLE)
7134     case TARGET_NR_open_by_handle_at:
7135         ret = do_open_by_handle_at(arg1, arg2, arg3);
7136         fd_trans_unregister(ret);
7137         return ret;
7138 #endif
7139     case TARGET_NR_close:
7140         fd_trans_unregister(arg1);
7141         return get_errno(close(arg1));
7142 
7143     case TARGET_NR_brk:
7144         return do_brk(arg1);
7145 #ifdef TARGET_NR_fork
7146     case TARGET_NR_fork:
7147         return get_errno(do_fork(cpu_env, TARGET_SIGCHLD, 0, 0, 0, 0));
7148 #endif
7149 #ifdef TARGET_NR_waitpid
7150     case TARGET_NR_waitpid:
7151         {
7152             int status;
7153             ret = get_errno(safe_wait4(arg1, &status, arg3, 0));
7154             if (!is_error(ret) && arg2 && ret
7155                 && put_user_s32(host_to_target_waitstatus(status), arg2))
7156                 return -TARGET_EFAULT;
7157         }
7158         return ret;
7159 #endif
7160 #ifdef TARGET_NR_waitid
7161     case TARGET_NR_waitid:
7162         {
7163             siginfo_t info;
7164             info.si_pid = 0;
7165             ret = get_errno(safe_waitid(arg1, arg2, &info, arg4, NULL));
7166             if (!is_error(ret) && arg3 && info.si_pid != 0) {
7167                 if (!(p = lock_user(VERIFY_WRITE, arg3, sizeof(target_siginfo_t), 0)))
7168                     return -TARGET_EFAULT;
7169                 host_to_target_siginfo(p, &info);
7170                 unlock_user(p, arg3, sizeof(target_siginfo_t));
7171             }
7172         }
7173         return ret;
7174 #endif
7175 #ifdef TARGET_NR_creat /* not on alpha */
7176     case TARGET_NR_creat:
7177         if (!(p = lock_user_string(arg1)))
7178             return -TARGET_EFAULT;
7179         ret = get_errno(creat(p, arg2));
7180         fd_trans_unregister(ret);
7181         unlock_user(p, arg1, 0);
7182         return ret;
7183 #endif
7184 #ifdef TARGET_NR_link
7185     case TARGET_NR_link:
7186         {
7187             void * p2;
7188             p = lock_user_string(arg1);
7189             p2 = lock_user_string(arg2);
7190             if (!p || !p2)
7191                 ret = -TARGET_EFAULT;
7192             else
7193                 ret = get_errno(link(p, p2));
7194             unlock_user(p2, arg2, 0);
7195             unlock_user(p, arg1, 0);
7196         }
7197         return ret;
7198 #endif
7199 #if defined(TARGET_NR_linkat)
7200     case TARGET_NR_linkat:
7201         {
7202             void * p2 = NULL;
7203             if (!arg2 || !arg4)
7204                 return -TARGET_EFAULT;
7205             p  = lock_user_string(arg2);
7206             p2 = lock_user_string(arg4);
7207             if (!p || !p2)
7208                 ret = -TARGET_EFAULT;
7209             else
7210                 ret = get_errno(linkat(arg1, p, arg3, p2, arg5));
7211             unlock_user(p, arg2, 0);
7212             unlock_user(p2, arg4, 0);
7213         }
7214         return ret;
7215 #endif
7216 #ifdef TARGET_NR_unlink
7217     case TARGET_NR_unlink:
7218         if (!(p = lock_user_string(arg1)))
7219             return -TARGET_EFAULT;
7220         ret = get_errno(unlink(p));
7221         unlock_user(p, arg1, 0);
7222         return ret;
7223 #endif
7224 #if defined(TARGET_NR_unlinkat)
7225     case TARGET_NR_unlinkat:
7226         if (!(p = lock_user_string(arg2)))
7227             return -TARGET_EFAULT;
7228         ret = get_errno(unlinkat(arg1, p, arg3));
7229         unlock_user(p, arg2, 0);
7230         return ret;
7231 #endif
7232     case TARGET_NR_execve:
7233         {
7234             char **argp, **envp;
7235             int argc, envc;
7236             abi_ulong gp;
7237             abi_ulong guest_argp;
7238             abi_ulong guest_envp;
7239             abi_ulong addr;
7240             char **q;
7241             int total_size = 0;
7242 
7243             argc = 0;
7244             guest_argp = arg2;
7245             for (gp = guest_argp; gp; gp += sizeof(abi_ulong)) {
7246                 if (get_user_ual(addr, gp))
7247                     return -TARGET_EFAULT;
7248                 if (!addr)
7249                     break;
7250                 argc++;
7251             }
7252             envc = 0;
7253             guest_envp = arg3;
7254             for (gp = guest_envp; gp; gp += sizeof(abi_ulong)) {
7255                 if (get_user_ual(addr, gp))
7256                     return -TARGET_EFAULT;
7257                 if (!addr)
7258                     break;
7259                 envc++;
7260             }
7261 
7262             argp = g_new0(char *, argc + 1);
7263             envp = g_new0(char *, envc + 1);
7264 
7265             for (gp = guest_argp, q = argp; gp;
7266                   gp += sizeof(abi_ulong), q++) {
7267                 if (get_user_ual(addr, gp))
7268                     goto execve_efault;
7269                 if (!addr)
7270                     break;
7271                 if (!(*q = lock_user_string(addr)))
7272                     goto execve_efault;
7273                 total_size += strlen(*q) + 1;
7274             }
7275             *q = NULL;
7276 
7277             for (gp = guest_envp, q = envp; gp;
7278                   gp += sizeof(abi_ulong), q++) {
7279                 if (get_user_ual(addr, gp))
7280                     goto execve_efault;
7281                 if (!addr)
7282                     break;
7283                 if (!(*q = lock_user_string(addr)))
7284                     goto execve_efault;
7285                 total_size += strlen(*q) + 1;
7286             }
7287             *q = NULL;
7288 
7289             if (!(p = lock_user_string(arg1)))
7290                 goto execve_efault;
7291             /* Although execve() is not an interruptible syscall it is
7292              * a special case where we must use the safe_syscall wrapper:
7293              * if we allow a signal to happen before we make the host
7294              * syscall then we will 'lose' it, because at the point of
7295              * execve the process leaves QEMU's control. So we use the
7296              * safe syscall wrapper to ensure that we either take the
7297              * signal as a guest signal, or else it does not happen
7298              * before the execve completes and makes it the other
7299              * program's problem.
7300              */
7301             ret = get_errno(safe_execve(p, argp, envp));
7302             unlock_user(p, arg1, 0);
7303 
7304             goto execve_end;
7305 
7306         execve_efault:
7307             ret = -TARGET_EFAULT;
7308 
7309         execve_end:
7310             for (gp = guest_argp, q = argp; *q;
7311                   gp += sizeof(abi_ulong), q++) {
7312                 if (get_user_ual(addr, gp)
7313                     || !addr)
7314                     break;
7315                 unlock_user(*q, addr, 0);
7316             }
7317             for (gp = guest_envp, q = envp; *q;
7318                   gp += sizeof(abi_ulong), q++) {
7319                 if (get_user_ual(addr, gp)
7320                     || !addr)
7321                     break;
7322                 unlock_user(*q, addr, 0);
7323             }
7324 
7325             g_free(argp);
7326             g_free(envp);
7327         }
7328         return ret;
7329     case TARGET_NR_chdir:
7330         if (!(p = lock_user_string(arg1)))
7331             return -TARGET_EFAULT;
7332         ret = get_errno(chdir(p));
7333         unlock_user(p, arg1, 0);
7334         return ret;
7335 #ifdef TARGET_NR_time
7336     case TARGET_NR_time:
7337         {
7338             time_t host_time;
7339             ret = get_errno(time(&host_time));
7340             if (!is_error(ret)
7341                 && arg1
7342                 && put_user_sal(host_time, arg1))
7343                 return -TARGET_EFAULT;
7344         }
7345         return ret;
7346 #endif
7347 #ifdef TARGET_NR_mknod
7348     case TARGET_NR_mknod:
7349         if (!(p = lock_user_string(arg1)))
7350             return -TARGET_EFAULT;
7351         ret = get_errno(mknod(p, arg2, arg3));
7352         unlock_user(p, arg1, 0);
7353         return ret;
7354 #endif
7355 #if defined(TARGET_NR_mknodat)
7356     case TARGET_NR_mknodat:
7357         if (!(p = lock_user_string(arg2)))
7358             return -TARGET_EFAULT;
7359         ret = get_errno(mknodat(arg1, p, arg3, arg4));
7360         unlock_user(p, arg2, 0);
7361         return ret;
7362 #endif
7363 #ifdef TARGET_NR_chmod
7364     case TARGET_NR_chmod:
7365         if (!(p = lock_user_string(arg1)))
7366             return -TARGET_EFAULT;
7367         ret = get_errno(chmod(p, arg2));
7368         unlock_user(p, arg1, 0);
7369         return ret;
7370 #endif
7371 #ifdef TARGET_NR_lseek
7372     case TARGET_NR_lseek:
7373         return get_errno(lseek(arg1, arg2, arg3));
7374 #endif
7375 #if defined(TARGET_NR_getxpid) && defined(TARGET_ALPHA)
7376     /* Alpha specific */
7377     case TARGET_NR_getxpid:
7378         ((CPUAlphaState *)cpu_env)->ir[IR_A4] = getppid();
7379         return get_errno(getpid());
7380 #endif
7381 #ifdef TARGET_NR_getpid
7382     case TARGET_NR_getpid:
7383         return get_errno(getpid());
7384 #endif
7385     case TARGET_NR_mount:
7386         {
7387             /* need to look at the data field */
7388             void *p2, *p3;
7389 
7390             if (arg1) {
7391                 p = lock_user_string(arg1);
7392                 if (!p) {
7393                     return -TARGET_EFAULT;
7394                 }
7395             } else {
7396                 p = NULL;
7397             }
7398 
7399             p2 = lock_user_string(arg2);
7400             if (!p2) {
7401                 if (arg1) {
7402                     unlock_user(p, arg1, 0);
7403                 }
7404                 return -TARGET_EFAULT;
7405             }
7406 
7407             if (arg3) {
7408                 p3 = lock_user_string(arg3);
7409                 if (!p3) {
7410                     if (arg1) {
7411                         unlock_user(p, arg1, 0);
7412                     }
7413                     unlock_user(p2, arg2, 0);
7414                     return -TARGET_EFAULT;
7415                 }
7416             } else {
7417                 p3 = NULL;
7418             }
7419 
7420             /* FIXME - arg5 should be locked, but it isn't clear how to
7421              * do that since it's not guaranteed to be a NULL-terminated
7422              * string.
7423              */
7424             if (!arg5) {
7425                 ret = mount(p, p2, p3, (unsigned long)arg4, NULL);
7426             } else {
7427                 ret = mount(p, p2, p3, (unsigned long)arg4, g2h(arg5));
7428             }
7429             ret = get_errno(ret);
7430 
7431             if (arg1) {
7432                 unlock_user(p, arg1, 0);
7433             }
7434             unlock_user(p2, arg2, 0);
7435             if (arg3) {
7436                 unlock_user(p3, arg3, 0);
7437             }
7438         }
7439         return ret;
7440 #ifdef TARGET_NR_umount
7441     case TARGET_NR_umount:
7442         if (!(p = lock_user_string(arg1)))
7443             return -TARGET_EFAULT;
7444         ret = get_errno(umount(p));
7445         unlock_user(p, arg1, 0);
7446         return ret;
7447 #endif
7448 #ifdef TARGET_NR_stime /* not on alpha */
7449     case TARGET_NR_stime:
7450         {
7451             time_t host_time;
7452             if (get_user_sal(host_time, arg1))
7453                 return -TARGET_EFAULT;
7454             return get_errno(stime(&host_time));
7455         }
7456 #endif
7457 #ifdef TARGET_NR_alarm /* not on alpha */
7458     case TARGET_NR_alarm:
7459         return alarm(arg1);
7460 #endif
7461 #ifdef TARGET_NR_pause /* not on alpha */
7462     case TARGET_NR_pause:
7463         if (!block_signals()) {
7464             sigsuspend(&((TaskState *)cpu->opaque)->signal_mask);
7465         }
7466         return -TARGET_EINTR;
7467 #endif
7468 #ifdef TARGET_NR_utime
7469     case TARGET_NR_utime:
7470         {
7471             struct utimbuf tbuf, *host_tbuf;
7472             struct target_utimbuf *target_tbuf;
7473             if (arg2) {
7474                 if (!lock_user_struct(VERIFY_READ, target_tbuf, arg2, 1))
7475                     return -TARGET_EFAULT;
7476                 tbuf.actime = tswapal(target_tbuf->actime);
7477                 tbuf.modtime = tswapal(target_tbuf->modtime);
7478                 unlock_user_struct(target_tbuf, arg2, 0);
7479                 host_tbuf = &tbuf;
7480             } else {
7481                 host_tbuf = NULL;
7482             }
7483             if (!(p = lock_user_string(arg1)))
7484                 return -TARGET_EFAULT;
7485             ret = get_errno(utime(p, host_tbuf));
7486             unlock_user(p, arg1, 0);
7487         }
7488         return ret;
7489 #endif
7490 #ifdef TARGET_NR_utimes
7491     case TARGET_NR_utimes:
7492         {
7493             struct timeval *tvp, tv[2];
7494             if (arg2) {
7495                 if (copy_from_user_timeval(&tv[0], arg2)
7496                     || copy_from_user_timeval(&tv[1],
7497                                               arg2 + sizeof(struct target_timeval)))
7498                     return -TARGET_EFAULT;
7499                 tvp = tv;
7500             } else {
7501                 tvp = NULL;
7502             }
7503             if (!(p = lock_user_string(arg1)))
7504                 return -TARGET_EFAULT;
7505             ret = get_errno(utimes(p, tvp));
7506             unlock_user(p, arg1, 0);
7507         }
7508         return ret;
7509 #endif
7510 #if defined(TARGET_NR_futimesat)
7511     case TARGET_NR_futimesat:
7512         {
7513             struct timeval *tvp, tv[2];
7514             if (arg3) {
7515                 if (copy_from_user_timeval(&tv[0], arg3)
7516                     || copy_from_user_timeval(&tv[1],
7517                                               arg3 + sizeof(struct target_timeval)))
7518                     return -TARGET_EFAULT;
7519                 tvp = tv;
7520             } else {
7521                 tvp = NULL;
7522             }
7523             if (!(p = lock_user_string(arg2))) {
7524                 return -TARGET_EFAULT;
7525             }
7526             ret = get_errno(futimesat(arg1, path(p), tvp));
7527             unlock_user(p, arg2, 0);
7528         }
7529         return ret;
7530 #endif
7531 #ifdef TARGET_NR_access
7532     case TARGET_NR_access:
7533         if (!(p = lock_user_string(arg1))) {
7534             return -TARGET_EFAULT;
7535         }
7536         ret = get_errno(access(path(p), arg2));
7537         unlock_user(p, arg1, 0);
7538         return ret;
7539 #endif
7540 #if defined(TARGET_NR_faccessat) && defined(__NR_faccessat)
7541     case TARGET_NR_faccessat:
7542         if (!(p = lock_user_string(arg2))) {
7543             return -TARGET_EFAULT;
7544         }
7545         ret = get_errno(faccessat(arg1, p, arg3, 0));
7546         unlock_user(p, arg2, 0);
7547         return ret;
7548 #endif
7549 #ifdef TARGET_NR_nice /* not on alpha */
7550     case TARGET_NR_nice:
7551         return get_errno(nice(arg1));
7552 #endif
7553     case TARGET_NR_sync:
7554         sync();
7555         return 0;
7556 #if defined(TARGET_NR_syncfs) && defined(CONFIG_SYNCFS)
7557     case TARGET_NR_syncfs:
7558         return get_errno(syncfs(arg1));
7559 #endif
7560     case TARGET_NR_kill:
7561         return get_errno(safe_kill(arg1, target_to_host_signal(arg2)));
7562 #ifdef TARGET_NR_rename
7563     case TARGET_NR_rename:
7564         {
7565             void *p2;
7566             p = lock_user_string(arg1);
7567             p2 = lock_user_string(arg2);
7568             if (!p || !p2)
7569                 ret = -TARGET_EFAULT;
7570             else
7571                 ret = get_errno(rename(p, p2));
7572             unlock_user(p2, arg2, 0);
7573             unlock_user(p, arg1, 0);
7574         }
7575         return ret;
7576 #endif
7577 #if defined(TARGET_NR_renameat)
7578     case TARGET_NR_renameat:
7579         {
7580             void *p2;
7581             p  = lock_user_string(arg2);
7582             p2 = lock_user_string(arg4);
7583             if (!p || !p2)
7584                 ret = -TARGET_EFAULT;
7585             else
7586                 ret = get_errno(renameat(arg1, p, arg3, p2));
7587             unlock_user(p2, arg4, 0);
7588             unlock_user(p, arg2, 0);
7589         }
7590         return ret;
7591 #endif
7592 #if defined(TARGET_NR_renameat2)
7593     case TARGET_NR_renameat2:
7594         {
7595             void *p2;
7596             p  = lock_user_string(arg2);
7597             p2 = lock_user_string(arg4);
7598             if (!p || !p2) {
7599                 ret = -TARGET_EFAULT;
7600             } else {
7601                 ret = get_errno(sys_renameat2(arg1, p, arg3, p2, arg5));
7602             }
7603             unlock_user(p2, arg4, 0);
7604             unlock_user(p, arg2, 0);
7605         }
7606         return ret;
7607 #endif
7608 #ifdef TARGET_NR_mkdir
7609     case TARGET_NR_mkdir:
7610         if (!(p = lock_user_string(arg1)))
7611             return -TARGET_EFAULT;
7612         ret = get_errno(mkdir(p, arg2));
7613         unlock_user(p, arg1, 0);
7614         return ret;
7615 #endif
7616 #if defined(TARGET_NR_mkdirat)
7617     case TARGET_NR_mkdirat:
7618         if (!(p = lock_user_string(arg2)))
7619             return -TARGET_EFAULT;
7620         ret = get_errno(mkdirat(arg1, p, arg3));
7621         unlock_user(p, arg2, 0);
7622         return ret;
7623 #endif
7624 #ifdef TARGET_NR_rmdir
7625     case TARGET_NR_rmdir:
7626         if (!(p = lock_user_string(arg1)))
7627             return -TARGET_EFAULT;
7628         ret = get_errno(rmdir(p));
7629         unlock_user(p, arg1, 0);
7630         return ret;
7631 #endif
7632     case TARGET_NR_dup:
7633         ret = get_errno(dup(arg1));
7634         if (ret >= 0) {
7635             fd_trans_dup(arg1, ret);
7636         }
7637         return ret;
7638 #ifdef TARGET_NR_pipe
7639     case TARGET_NR_pipe:
7640         return do_pipe(cpu_env, arg1, 0, 0);
7641 #endif
7642 #ifdef TARGET_NR_pipe2
7643     case TARGET_NR_pipe2:
7644         return do_pipe(cpu_env, arg1,
7645                        target_to_host_bitmask(arg2, fcntl_flags_tbl), 1);
7646 #endif
7647     case TARGET_NR_times:
7648         {
7649             struct target_tms *tmsp;
7650             struct tms tms;
7651             ret = get_errno(times(&tms));
7652             if (arg1) {
7653                 tmsp = lock_user(VERIFY_WRITE, arg1, sizeof(struct target_tms), 0);
7654                 if (!tmsp)
7655                     return -TARGET_EFAULT;
7656                 tmsp->tms_utime = tswapal(host_to_target_clock_t(tms.tms_utime));
7657                 tmsp->tms_stime = tswapal(host_to_target_clock_t(tms.tms_stime));
7658                 tmsp->tms_cutime = tswapal(host_to_target_clock_t(tms.tms_cutime));
7659                 tmsp->tms_cstime = tswapal(host_to_target_clock_t(tms.tms_cstime));
7660             }
7661             if (!is_error(ret))
7662                 ret = host_to_target_clock_t(ret);
7663         }
7664         return ret;
7665     case TARGET_NR_acct:
7666         if (arg1 == 0) {
7667             ret = get_errno(acct(NULL));
7668         } else {
7669             if (!(p = lock_user_string(arg1))) {
7670                 return -TARGET_EFAULT;
7671             }
7672             ret = get_errno(acct(path(p)));
7673             unlock_user(p, arg1, 0);
7674         }
7675         return ret;
7676 #ifdef TARGET_NR_umount2
7677     case TARGET_NR_umount2:
7678         if (!(p = lock_user_string(arg1)))
7679             return -TARGET_EFAULT;
7680         ret = get_errno(umount2(p, arg2));
7681         unlock_user(p, arg1, 0);
7682         return ret;
7683 #endif
7684     case TARGET_NR_ioctl:
7685         return do_ioctl(arg1, arg2, arg3);
7686 #ifdef TARGET_NR_fcntl
7687     case TARGET_NR_fcntl:
7688         return do_fcntl(arg1, arg2, arg3);
7689 #endif
7690     case TARGET_NR_setpgid:
7691         return get_errno(setpgid(arg1, arg2));
7692     case TARGET_NR_umask:
7693         return get_errno(umask(arg1));
7694     case TARGET_NR_chroot:
7695         if (!(p = lock_user_string(arg1)))
7696             return -TARGET_EFAULT;
7697         ret = get_errno(chroot(p));
7698         unlock_user(p, arg1, 0);
7699         return ret;
7700 #ifdef TARGET_NR_dup2
7701     case TARGET_NR_dup2:
7702         ret = get_errno(dup2(arg1, arg2));
7703         if (ret >= 0) {
7704             fd_trans_dup(arg1, arg2);
7705         }
7706         return ret;
7707 #endif
7708 #if defined(CONFIG_DUP3) && defined(TARGET_NR_dup3)
7709     case TARGET_NR_dup3:
7710     {
7711         int host_flags;
7712 
7713         if ((arg3 & ~TARGET_O_CLOEXEC) != 0) {
7714             return -EINVAL;
7715         }
7716         host_flags = target_to_host_bitmask(arg3, fcntl_flags_tbl);
7717         ret = get_errno(dup3(arg1, arg2, host_flags));
7718         if (ret >= 0) {
7719             fd_trans_dup(arg1, arg2);
7720         }
7721         return ret;
7722     }
7723 #endif
7724 #ifdef TARGET_NR_getppid /* not on alpha */
7725     case TARGET_NR_getppid:
7726         return get_errno(getppid());
7727 #endif
7728 #ifdef TARGET_NR_getpgrp
7729     case TARGET_NR_getpgrp:
7730         return get_errno(getpgrp());
7731 #endif
7732     case TARGET_NR_setsid:
7733         return get_errno(setsid());
7734 #ifdef TARGET_NR_sigaction
7735     case TARGET_NR_sigaction:
7736         {
7737 #if defined(TARGET_ALPHA)
7738             struct target_sigaction act, oact, *pact = 0;
7739             struct target_old_sigaction *old_act;
7740             if (arg2) {
7741                 if (!lock_user_struct(VERIFY_READ, old_act, arg2, 1))
7742                     return -TARGET_EFAULT;
7743                 act._sa_handler = old_act->_sa_handler;
7744                 target_siginitset(&act.sa_mask, old_act->sa_mask);
7745                 act.sa_flags = old_act->sa_flags;
7746                 act.sa_restorer = 0;
7747                 unlock_user_struct(old_act, arg2, 0);
7748                 pact = &act;
7749             }
7750             ret = get_errno(do_sigaction(arg1, pact, &oact));
7751             if (!is_error(ret) && arg3) {
7752                 if (!lock_user_struct(VERIFY_WRITE, old_act, arg3, 0))
7753                     return -TARGET_EFAULT;
7754                 old_act->_sa_handler = oact._sa_handler;
7755                 old_act->sa_mask = oact.sa_mask.sig[0];
7756                 old_act->sa_flags = oact.sa_flags;
7757                 unlock_user_struct(old_act, arg3, 1);
7758             }
7759 #elif defined(TARGET_MIPS)
7760 	    struct target_sigaction act, oact, *pact, *old_act;
7761 
7762 	    if (arg2) {
7763                 if (!lock_user_struct(VERIFY_READ, old_act, arg2, 1))
7764                     return -TARGET_EFAULT;
7765 		act._sa_handler = old_act->_sa_handler;
7766 		target_siginitset(&act.sa_mask, old_act->sa_mask.sig[0]);
7767 		act.sa_flags = old_act->sa_flags;
7768 		unlock_user_struct(old_act, arg2, 0);
7769 		pact = &act;
7770 	    } else {
7771 		pact = NULL;
7772 	    }
7773 
7774 	    ret = get_errno(do_sigaction(arg1, pact, &oact));
7775 
7776 	    if (!is_error(ret) && arg3) {
7777                 if (!lock_user_struct(VERIFY_WRITE, old_act, arg3, 0))
7778                     return -TARGET_EFAULT;
7779 		old_act->_sa_handler = oact._sa_handler;
7780 		old_act->sa_flags = oact.sa_flags;
7781 		old_act->sa_mask.sig[0] = oact.sa_mask.sig[0];
7782 		old_act->sa_mask.sig[1] = 0;
7783 		old_act->sa_mask.sig[2] = 0;
7784 		old_act->sa_mask.sig[3] = 0;
7785 		unlock_user_struct(old_act, arg3, 1);
7786 	    }
7787 #else
7788             struct target_old_sigaction *old_act;
7789             struct target_sigaction act, oact, *pact;
7790             if (arg2) {
7791                 if (!lock_user_struct(VERIFY_READ, old_act, arg2, 1))
7792                     return -TARGET_EFAULT;
7793                 act._sa_handler = old_act->_sa_handler;
7794                 target_siginitset(&act.sa_mask, old_act->sa_mask);
7795                 act.sa_flags = old_act->sa_flags;
7796                 act.sa_restorer = old_act->sa_restorer;
7797 #ifdef TARGET_ARCH_HAS_KA_RESTORER
7798                 act.ka_restorer = 0;
7799 #endif
7800                 unlock_user_struct(old_act, arg2, 0);
7801                 pact = &act;
7802             } else {
7803                 pact = NULL;
7804             }
7805             ret = get_errno(do_sigaction(arg1, pact, &oact));
7806             if (!is_error(ret) && arg3) {
7807                 if (!lock_user_struct(VERIFY_WRITE, old_act, arg3, 0))
7808                     return -TARGET_EFAULT;
7809                 old_act->_sa_handler = oact._sa_handler;
7810                 old_act->sa_mask = oact.sa_mask.sig[0];
7811                 old_act->sa_flags = oact.sa_flags;
7812                 old_act->sa_restorer = oact.sa_restorer;
7813                 unlock_user_struct(old_act, arg3, 1);
7814             }
7815 #endif
7816         }
7817         return ret;
7818 #endif
7819     case TARGET_NR_rt_sigaction:
7820         {
7821 #if defined(TARGET_ALPHA)
7822             /* For Alpha and SPARC this is a 5 argument syscall, with
7823              * a 'restorer' parameter which must be copied into the
7824              * sa_restorer field of the sigaction struct.
7825              * For Alpha that 'restorer' is arg5; for SPARC it is arg4,
7826              * and arg5 is the sigsetsize.
7827              * Alpha also has a separate rt_sigaction struct that it uses
7828              * here; SPARC uses the usual sigaction struct.
7829              */
7830             struct target_rt_sigaction *rt_act;
7831             struct target_sigaction act, oact, *pact = 0;
7832 
7833             if (arg4 != sizeof(target_sigset_t)) {
7834                 return -TARGET_EINVAL;
7835             }
7836             if (arg2) {
7837                 if (!lock_user_struct(VERIFY_READ, rt_act, arg2, 1))
7838                     return -TARGET_EFAULT;
7839                 act._sa_handler = rt_act->_sa_handler;
7840                 act.sa_mask = rt_act->sa_mask;
7841                 act.sa_flags = rt_act->sa_flags;
7842                 act.sa_restorer = arg5;
7843                 unlock_user_struct(rt_act, arg2, 0);
7844                 pact = &act;
7845             }
7846             ret = get_errno(do_sigaction(arg1, pact, &oact));
7847             if (!is_error(ret) && arg3) {
7848                 if (!lock_user_struct(VERIFY_WRITE, rt_act, arg3, 0))
7849                     return -TARGET_EFAULT;
7850                 rt_act->_sa_handler = oact._sa_handler;
7851                 rt_act->sa_mask = oact.sa_mask;
7852                 rt_act->sa_flags = oact.sa_flags;
7853                 unlock_user_struct(rt_act, arg3, 1);
7854             }
7855 #else
7856 #ifdef TARGET_SPARC
7857             target_ulong restorer = arg4;
7858             target_ulong sigsetsize = arg5;
7859 #else
7860             target_ulong sigsetsize = arg4;
7861 #endif
7862             struct target_sigaction *act;
7863             struct target_sigaction *oact;
7864 
7865             if (sigsetsize != sizeof(target_sigset_t)) {
7866                 return -TARGET_EINVAL;
7867             }
7868             if (arg2) {
7869                 if (!lock_user_struct(VERIFY_READ, act, arg2, 1)) {
7870                     return -TARGET_EFAULT;
7871                 }
7872 #ifdef TARGET_ARCH_HAS_KA_RESTORER
7873                 act->ka_restorer = restorer;
7874 #endif
7875             } else {
7876                 act = NULL;
7877             }
7878             if (arg3) {
7879                 if (!lock_user_struct(VERIFY_WRITE, oact, arg3, 0)) {
7880                     ret = -TARGET_EFAULT;
7881                     goto rt_sigaction_fail;
7882                 }
7883             } else
7884                 oact = NULL;
7885             ret = get_errno(do_sigaction(arg1, act, oact));
7886 	rt_sigaction_fail:
7887             if (act)
7888                 unlock_user_struct(act, arg2, 0);
7889             if (oact)
7890                 unlock_user_struct(oact, arg3, 1);
7891 #endif
7892         }
7893         return ret;
7894 #ifdef TARGET_NR_sgetmask /* not on alpha */
7895     case TARGET_NR_sgetmask:
7896         {
7897             sigset_t cur_set;
7898             abi_ulong target_set;
7899             ret = do_sigprocmask(0, NULL, &cur_set);
7900             if (!ret) {
7901                 host_to_target_old_sigset(&target_set, &cur_set);
7902                 ret = target_set;
7903             }
7904         }
7905         return ret;
7906 #endif
7907 #ifdef TARGET_NR_ssetmask /* not on alpha */
7908     case TARGET_NR_ssetmask:
7909         {
7910             sigset_t set, oset;
7911             abi_ulong target_set = arg1;
7912             target_to_host_old_sigset(&set, &target_set);
7913             ret = do_sigprocmask(SIG_SETMASK, &set, &oset);
7914             if (!ret) {
7915                 host_to_target_old_sigset(&target_set, &oset);
7916                 ret = target_set;
7917             }
7918         }
7919         return ret;
7920 #endif
7921 #ifdef TARGET_NR_sigprocmask
7922     case TARGET_NR_sigprocmask:
7923         {
7924 #if defined(TARGET_ALPHA)
7925             sigset_t set, oldset;
7926             abi_ulong mask;
7927             int how;
7928 
7929             switch (arg1) {
7930             case TARGET_SIG_BLOCK:
7931                 how = SIG_BLOCK;
7932                 break;
7933             case TARGET_SIG_UNBLOCK:
7934                 how = SIG_UNBLOCK;
7935                 break;
7936             case TARGET_SIG_SETMASK:
7937                 how = SIG_SETMASK;
7938                 break;
7939             default:
7940                 return -TARGET_EINVAL;
7941             }
7942             mask = arg2;
7943             target_to_host_old_sigset(&set, &mask);
7944 
7945             ret = do_sigprocmask(how, &set, &oldset);
7946             if (!is_error(ret)) {
7947                 host_to_target_old_sigset(&mask, &oldset);
7948                 ret = mask;
7949                 ((CPUAlphaState *)cpu_env)->ir[IR_V0] = 0; /* force no error */
7950             }
7951 #else
7952             sigset_t set, oldset, *set_ptr;
7953             int how;
7954 
7955             if (arg2) {
7956                 switch (arg1) {
7957                 case TARGET_SIG_BLOCK:
7958                     how = SIG_BLOCK;
7959                     break;
7960                 case TARGET_SIG_UNBLOCK:
7961                     how = SIG_UNBLOCK;
7962                     break;
7963                 case TARGET_SIG_SETMASK:
7964                     how = SIG_SETMASK;
7965                     break;
7966                 default:
7967                     return -TARGET_EINVAL;
7968                 }
7969                 if (!(p = lock_user(VERIFY_READ, arg2, sizeof(target_sigset_t), 1)))
7970                     return -TARGET_EFAULT;
7971                 target_to_host_old_sigset(&set, p);
7972                 unlock_user(p, arg2, 0);
7973                 set_ptr = &set;
7974             } else {
7975                 how = 0;
7976                 set_ptr = NULL;
7977             }
7978             ret = do_sigprocmask(how, set_ptr, &oldset);
7979             if (!is_error(ret) && arg3) {
7980                 if (!(p = lock_user(VERIFY_WRITE, arg3, sizeof(target_sigset_t), 0)))
7981                     return -TARGET_EFAULT;
7982                 host_to_target_old_sigset(p, &oldset);
7983                 unlock_user(p, arg3, sizeof(target_sigset_t));
7984             }
7985 #endif
7986         }
7987         return ret;
7988 #endif
7989     case TARGET_NR_rt_sigprocmask:
7990         {
7991             int how = arg1;
7992             sigset_t set, oldset, *set_ptr;
7993 
7994             if (arg4 != sizeof(target_sigset_t)) {
7995                 return -TARGET_EINVAL;
7996             }
7997 
7998             if (arg2) {
7999                 switch(how) {
8000                 case TARGET_SIG_BLOCK:
8001                     how = SIG_BLOCK;
8002                     break;
8003                 case TARGET_SIG_UNBLOCK:
8004                     how = SIG_UNBLOCK;
8005                     break;
8006                 case TARGET_SIG_SETMASK:
8007                     how = SIG_SETMASK;
8008                     break;
8009                 default:
8010                     return -TARGET_EINVAL;
8011                 }
8012                 if (!(p = lock_user(VERIFY_READ, arg2, sizeof(target_sigset_t), 1)))
8013                     return -TARGET_EFAULT;
8014                 target_to_host_sigset(&set, p);
8015                 unlock_user(p, arg2, 0);
8016                 set_ptr = &set;
8017             } else {
8018                 how = 0;
8019                 set_ptr = NULL;
8020             }
8021             ret = do_sigprocmask(how, set_ptr, &oldset);
8022             if (!is_error(ret) && arg3) {
8023                 if (!(p = lock_user(VERIFY_WRITE, arg3, sizeof(target_sigset_t), 0)))
8024                     return -TARGET_EFAULT;
8025                 host_to_target_sigset(p, &oldset);
8026                 unlock_user(p, arg3, sizeof(target_sigset_t));
8027             }
8028         }
8029         return ret;
8030 #ifdef TARGET_NR_sigpending
8031     case TARGET_NR_sigpending:
8032         {
8033             sigset_t set;
8034             ret = get_errno(sigpending(&set));
8035             if (!is_error(ret)) {
8036                 if (!(p = lock_user(VERIFY_WRITE, arg1, sizeof(target_sigset_t), 0)))
8037                     return -TARGET_EFAULT;
8038                 host_to_target_old_sigset(p, &set);
8039                 unlock_user(p, arg1, sizeof(target_sigset_t));
8040             }
8041         }
8042         return ret;
8043 #endif
8044     case TARGET_NR_rt_sigpending:
8045         {
8046             sigset_t set;
8047 
8048             /* Yes, this check is >, not != like most. We follow the kernel's
8049              * logic and it does it like this because it implements
8050              * NR_sigpending through the same code path, and in that case
8051              * the old_sigset_t is smaller in size.
8052              */
8053             if (arg2 > sizeof(target_sigset_t)) {
8054                 return -TARGET_EINVAL;
8055             }
8056 
8057             ret = get_errno(sigpending(&set));
8058             if (!is_error(ret)) {
8059                 if (!(p = lock_user(VERIFY_WRITE, arg1, sizeof(target_sigset_t), 0)))
8060                     return -TARGET_EFAULT;
8061                 host_to_target_sigset(p, &set);
8062                 unlock_user(p, arg1, sizeof(target_sigset_t));
8063             }
8064         }
8065         return ret;
8066 #ifdef TARGET_NR_sigsuspend
8067     case TARGET_NR_sigsuspend:
8068         {
8069             TaskState *ts = cpu->opaque;
8070 #if defined(TARGET_ALPHA)
8071             abi_ulong mask = arg1;
8072             target_to_host_old_sigset(&ts->sigsuspend_mask, &mask);
8073 #else
8074             if (!(p = lock_user(VERIFY_READ, arg1, sizeof(target_sigset_t), 1)))
8075                 return -TARGET_EFAULT;
8076             target_to_host_old_sigset(&ts->sigsuspend_mask, p);
8077             unlock_user(p, arg1, 0);
8078 #endif
8079             ret = get_errno(safe_rt_sigsuspend(&ts->sigsuspend_mask,
8080                                                SIGSET_T_SIZE));
8081             if (ret != -TARGET_ERESTARTSYS) {
8082                 ts->in_sigsuspend = 1;
8083             }
8084         }
8085         return ret;
8086 #endif
8087     case TARGET_NR_rt_sigsuspend:
8088         {
8089             TaskState *ts = cpu->opaque;
8090 
8091             if (arg2 != sizeof(target_sigset_t)) {
8092                 return -TARGET_EINVAL;
8093             }
8094             if (!(p = lock_user(VERIFY_READ, arg1, sizeof(target_sigset_t), 1)))
8095                 return -TARGET_EFAULT;
8096             target_to_host_sigset(&ts->sigsuspend_mask, p);
8097             unlock_user(p, arg1, 0);
8098             ret = get_errno(safe_rt_sigsuspend(&ts->sigsuspend_mask,
8099                                                SIGSET_T_SIZE));
8100             if (ret != -TARGET_ERESTARTSYS) {
8101                 ts->in_sigsuspend = 1;
8102             }
8103         }
8104         return ret;
8105     case TARGET_NR_rt_sigtimedwait:
8106         {
8107             sigset_t set;
8108             struct timespec uts, *puts;
8109             siginfo_t uinfo;
8110 
8111             if (arg4 != sizeof(target_sigset_t)) {
8112                 return -TARGET_EINVAL;
8113             }
8114 
8115             if (!(p = lock_user(VERIFY_READ, arg1, sizeof(target_sigset_t), 1)))
8116                 return -TARGET_EFAULT;
8117             target_to_host_sigset(&set, p);
8118             unlock_user(p, arg1, 0);
8119             if (arg3) {
8120                 puts = &uts;
8121                 target_to_host_timespec(puts, arg3);
8122             } else {
8123                 puts = NULL;
8124             }
8125             ret = get_errno(safe_rt_sigtimedwait(&set, &uinfo, puts,
8126                                                  SIGSET_T_SIZE));
8127             if (!is_error(ret)) {
8128                 if (arg2) {
8129                     p = lock_user(VERIFY_WRITE, arg2, sizeof(target_siginfo_t),
8130                                   0);
8131                     if (!p) {
8132                         return -TARGET_EFAULT;
8133                     }
8134                     host_to_target_siginfo(p, &uinfo);
8135                     unlock_user(p, arg2, sizeof(target_siginfo_t));
8136                 }
8137                 ret = host_to_target_signal(ret);
8138             }
8139         }
8140         return ret;
8141     case TARGET_NR_rt_sigqueueinfo:
8142         {
8143             siginfo_t uinfo;
8144 
8145             p = lock_user(VERIFY_READ, arg3, sizeof(target_siginfo_t), 1);
8146             if (!p) {
8147                 return -TARGET_EFAULT;
8148             }
8149             target_to_host_siginfo(&uinfo, p);
8150             unlock_user(p, arg3, 0);
8151             ret = get_errno(sys_rt_sigqueueinfo(arg1, arg2, &uinfo));
8152         }
8153         return ret;
8154     case TARGET_NR_rt_tgsigqueueinfo:
8155         {
8156             siginfo_t uinfo;
8157 
8158             p = lock_user(VERIFY_READ, arg4, sizeof(target_siginfo_t), 1);
8159             if (!p) {
8160                 return -TARGET_EFAULT;
8161             }
8162             target_to_host_siginfo(&uinfo, p);
8163             unlock_user(p, arg4, 0);
8164             ret = get_errno(sys_rt_tgsigqueueinfo(arg1, arg2, arg3, &uinfo));
8165         }
8166         return ret;
8167 #ifdef TARGET_NR_sigreturn
8168     case TARGET_NR_sigreturn:
8169         if (block_signals()) {
8170             return -TARGET_ERESTARTSYS;
8171         }
8172         return do_sigreturn(cpu_env);
8173 #endif
8174     case TARGET_NR_rt_sigreturn:
8175         if (block_signals()) {
8176             return -TARGET_ERESTARTSYS;
8177         }
8178         return do_rt_sigreturn(cpu_env);
8179     case TARGET_NR_sethostname:
8180         if (!(p = lock_user_string(arg1)))
8181             return -TARGET_EFAULT;
8182         ret = get_errno(sethostname(p, arg2));
8183         unlock_user(p, arg1, 0);
8184         return ret;
8185 #ifdef TARGET_NR_setrlimit
8186     case TARGET_NR_setrlimit:
8187         {
8188             int resource = target_to_host_resource(arg1);
8189             struct target_rlimit *target_rlim;
8190             struct rlimit rlim;
8191             if (!lock_user_struct(VERIFY_READ, target_rlim, arg2, 1))
8192                 return -TARGET_EFAULT;
8193             rlim.rlim_cur = target_to_host_rlim(target_rlim->rlim_cur);
8194             rlim.rlim_max = target_to_host_rlim(target_rlim->rlim_max);
8195             unlock_user_struct(target_rlim, arg2, 0);
8196             /*
8197              * If we just passed through resource limit settings for memory then
8198              * they would also apply to QEMU's own allocations, and QEMU will
8199              * crash or hang or die if its allocations fail. Ideally we would
8200              * track the guest allocations in QEMU and apply the limits ourselves.
8201              * For now, just tell the guest the call succeeded but don't actually
8202              * limit anything.
8203              */
8204             if (resource != RLIMIT_AS &&
8205                 resource != RLIMIT_DATA &&
8206                 resource != RLIMIT_STACK) {
8207                 return get_errno(setrlimit(resource, &rlim));
8208             } else {
8209                 return 0;
8210             }
8211         }
8212 #endif
8213 #ifdef TARGET_NR_getrlimit
8214     case TARGET_NR_getrlimit:
8215         {
8216             int resource = target_to_host_resource(arg1);
8217             struct target_rlimit *target_rlim;
8218             struct rlimit rlim;
8219 
8220             ret = get_errno(getrlimit(resource, &rlim));
8221             if (!is_error(ret)) {
8222                 if (!lock_user_struct(VERIFY_WRITE, target_rlim, arg2, 0))
8223                     return -TARGET_EFAULT;
8224                 target_rlim->rlim_cur = host_to_target_rlim(rlim.rlim_cur);
8225                 target_rlim->rlim_max = host_to_target_rlim(rlim.rlim_max);
8226                 unlock_user_struct(target_rlim, arg2, 1);
8227             }
8228         }
8229         return ret;
8230 #endif
8231     case TARGET_NR_getrusage:
8232         {
8233             struct rusage rusage;
8234             ret = get_errno(getrusage(arg1, &rusage));
8235             if (!is_error(ret)) {
8236                 ret = host_to_target_rusage(arg2, &rusage);
8237             }
8238         }
8239         return ret;
8240     case TARGET_NR_gettimeofday:
8241         {
8242             struct timeval tv;
8243             ret = get_errno(gettimeofday(&tv, NULL));
8244             if (!is_error(ret)) {
8245                 if (copy_to_user_timeval(arg1, &tv))
8246                     return -TARGET_EFAULT;
8247             }
8248         }
8249         return ret;
8250     case TARGET_NR_settimeofday:
8251         {
8252             struct timeval tv, *ptv = NULL;
8253             struct timezone tz, *ptz = NULL;
8254 
8255             if (arg1) {
8256                 if (copy_from_user_timeval(&tv, arg1)) {
8257                     return -TARGET_EFAULT;
8258                 }
8259                 ptv = &tv;
8260             }
8261 
8262             if (arg2) {
8263                 if (copy_from_user_timezone(&tz, arg2)) {
8264                     return -TARGET_EFAULT;
8265                 }
8266                 ptz = &tz;
8267             }
8268 
8269             return get_errno(settimeofday(ptv, ptz));
8270         }
8271 #if defined(TARGET_NR_select)
8272     case TARGET_NR_select:
8273 #if defined(TARGET_WANT_NI_OLD_SELECT)
8274         /* some architectures used to have old_select here
8275          * but now ENOSYS it.
8276          */
8277         ret = -TARGET_ENOSYS;
8278 #elif defined(TARGET_WANT_OLD_SYS_SELECT)
8279         ret = do_old_select(arg1);
8280 #else
8281         ret = do_select(arg1, arg2, arg3, arg4, arg5);
8282 #endif
8283         return ret;
8284 #endif
8285 #ifdef TARGET_NR_pselect6
8286     case TARGET_NR_pselect6:
8287         {
8288             abi_long rfd_addr, wfd_addr, efd_addr, n, ts_addr;
8289             fd_set rfds, wfds, efds;
8290             fd_set *rfds_ptr, *wfds_ptr, *efds_ptr;
8291             struct timespec ts, *ts_ptr;
8292 
8293             /*
8294              * The 6th arg is actually two args smashed together,
8295              * so we cannot use the C library.
8296              */
8297             sigset_t set;
8298             struct {
8299                 sigset_t *set;
8300                 size_t size;
8301             } sig, *sig_ptr;
8302 
8303             abi_ulong arg_sigset, arg_sigsize, *arg7;
8304             target_sigset_t *target_sigset;
8305 
8306             n = arg1;
8307             rfd_addr = arg2;
8308             wfd_addr = arg3;
8309             efd_addr = arg4;
8310             ts_addr = arg5;
8311 
8312             ret = copy_from_user_fdset_ptr(&rfds, &rfds_ptr, rfd_addr, n);
8313             if (ret) {
8314                 return ret;
8315             }
8316             ret = copy_from_user_fdset_ptr(&wfds, &wfds_ptr, wfd_addr, n);
8317             if (ret) {
8318                 return ret;
8319             }
8320             ret = copy_from_user_fdset_ptr(&efds, &efds_ptr, efd_addr, n);
8321             if (ret) {
8322                 return ret;
8323             }
8324 
8325             /*
8326              * This takes a timespec, and not a timeval, so we cannot
8327              * use the do_select() helper ...
8328              */
8329             if (ts_addr) {
8330                 if (target_to_host_timespec(&ts, ts_addr)) {
8331                     return -TARGET_EFAULT;
8332                 }
8333                 ts_ptr = &ts;
8334             } else {
8335                 ts_ptr = NULL;
8336             }
8337 
8338             /* Extract the two packed args for the sigset */
8339             if (arg6) {
8340                 sig_ptr = &sig;
8341                 sig.size = SIGSET_T_SIZE;
8342 
8343                 arg7 = lock_user(VERIFY_READ, arg6, sizeof(*arg7) * 2, 1);
8344                 if (!arg7) {
8345                     return -TARGET_EFAULT;
8346                 }
8347                 arg_sigset = tswapal(arg7[0]);
8348                 arg_sigsize = tswapal(arg7[1]);
8349                 unlock_user(arg7, arg6, 0);
8350 
8351                 if (arg_sigset) {
8352                     sig.set = &set;
8353                     if (arg_sigsize != sizeof(*target_sigset)) {
8354                         /* Like the kernel, we enforce correct size sigsets */
8355                         return -TARGET_EINVAL;
8356                     }
8357                     target_sigset = lock_user(VERIFY_READ, arg_sigset,
8358                                               sizeof(*target_sigset), 1);
8359                     if (!target_sigset) {
8360                         return -TARGET_EFAULT;
8361                     }
8362                     target_to_host_sigset(&set, target_sigset);
8363                     unlock_user(target_sigset, arg_sigset, 0);
8364                 } else {
8365                     sig.set = NULL;
8366                 }
8367             } else {
8368                 sig_ptr = NULL;
8369             }
8370 
8371             ret = get_errno(safe_pselect6(n, rfds_ptr, wfds_ptr, efds_ptr,
8372                                           ts_ptr, sig_ptr));
8373 
8374             if (!is_error(ret)) {
8375                 if (rfd_addr && copy_to_user_fdset(rfd_addr, &rfds, n))
8376                     return -TARGET_EFAULT;
8377                 if (wfd_addr && copy_to_user_fdset(wfd_addr, &wfds, n))
8378                     return -TARGET_EFAULT;
8379                 if (efd_addr && copy_to_user_fdset(efd_addr, &efds, n))
8380                     return -TARGET_EFAULT;
8381 
8382                 if (ts_addr && host_to_target_timespec(ts_addr, &ts))
8383                     return -TARGET_EFAULT;
8384             }
8385         }
8386         return ret;
8387 #endif
8388 #ifdef TARGET_NR_symlink
8389     case TARGET_NR_symlink:
8390         {
8391             void *p2;
8392             p = lock_user_string(arg1);
8393             p2 = lock_user_string(arg2);
8394             if (!p || !p2)
8395                 ret = -TARGET_EFAULT;
8396             else
8397                 ret = get_errno(symlink(p, p2));
8398             unlock_user(p2, arg2, 0);
8399             unlock_user(p, arg1, 0);
8400         }
8401         return ret;
8402 #endif
8403 #if defined(TARGET_NR_symlinkat)
8404     case TARGET_NR_symlinkat:
8405         {
8406             void *p2;
8407             p  = lock_user_string(arg1);
8408             p2 = lock_user_string(arg3);
8409             if (!p || !p2)
8410                 ret = -TARGET_EFAULT;
8411             else
8412                 ret = get_errno(symlinkat(p, arg2, p2));
8413             unlock_user(p2, arg3, 0);
8414             unlock_user(p, arg1, 0);
8415         }
8416         return ret;
8417 #endif
8418 #ifdef TARGET_NR_readlink
8419     case TARGET_NR_readlink:
8420         {
8421             void *p2;
8422             p = lock_user_string(arg1);
8423             p2 = lock_user(VERIFY_WRITE, arg2, arg3, 0);
8424             if (!p || !p2) {
8425                 ret = -TARGET_EFAULT;
8426             } else if (!arg3) {
8427                 /* Short circuit this for the magic exe check. */
8428                 ret = -TARGET_EINVAL;
8429             } else if (is_proc_myself((const char *)p, "exe")) {
8430                 char real[PATH_MAX], *temp;
8431                 temp = realpath(exec_path, real);
8432                 /* Return value is # of bytes that we wrote to the buffer. */
8433                 if (temp == NULL) {
8434                     ret = get_errno(-1);
8435                 } else {
8436                     /* Don't worry about sign mismatch as earlier mapping
8437                      * logic would have thrown a bad address error. */
8438                     ret = MIN(strlen(real), arg3);
8439                     /* We cannot NUL terminate the string. */
8440                     memcpy(p2, real, ret);
8441                 }
8442             } else {
8443                 ret = get_errno(readlink(path(p), p2, arg3));
8444             }
8445             unlock_user(p2, arg2, ret);
8446             unlock_user(p, arg1, 0);
8447         }
8448         return ret;
8449 #endif
8450 #if defined(TARGET_NR_readlinkat)
8451     case TARGET_NR_readlinkat:
8452         {
8453             void *p2;
8454             p  = lock_user_string(arg2);
8455             p2 = lock_user(VERIFY_WRITE, arg3, arg4, 0);
8456             if (!p || !p2) {
8457                 ret = -TARGET_EFAULT;
8458             } else if (is_proc_myself((const char *)p, "exe")) {
8459                 char real[PATH_MAX], *temp;
8460                 temp = realpath(exec_path, real);
8461                 ret = temp == NULL ? get_errno(-1) : strlen(real) ;
8462                 snprintf((char *)p2, arg4, "%s", real);
8463             } else {
8464                 ret = get_errno(readlinkat(arg1, path(p), p2, arg4));
8465             }
8466             unlock_user(p2, arg3, ret);
8467             unlock_user(p, arg2, 0);
8468         }
8469         return ret;
8470 #endif
8471 #ifdef TARGET_NR_swapon
8472     case TARGET_NR_swapon:
8473         if (!(p = lock_user_string(arg1)))
8474             return -TARGET_EFAULT;
8475         ret = get_errno(swapon(p, arg2));
8476         unlock_user(p, arg1, 0);
8477         return ret;
8478 #endif
8479     case TARGET_NR_reboot:
8480         if (arg3 == LINUX_REBOOT_CMD_RESTART2) {
8481            /* arg4 must be ignored in all other cases */
8482            p = lock_user_string(arg4);
8483            if (!p) {
8484                return -TARGET_EFAULT;
8485            }
8486            ret = get_errno(reboot(arg1, arg2, arg3, p));
8487            unlock_user(p, arg4, 0);
8488         } else {
8489            ret = get_errno(reboot(arg1, arg2, arg3, NULL));
8490         }
8491         return ret;
8492 #ifdef TARGET_NR_mmap
8493     case TARGET_NR_mmap:
8494 #if (defined(TARGET_I386) && defined(TARGET_ABI32)) || \
8495     (defined(TARGET_ARM) && defined(TARGET_ABI32)) || \
8496     defined(TARGET_M68K) || defined(TARGET_CRIS) || defined(TARGET_MICROBLAZE) \
8497     || defined(TARGET_S390X)
8498         {
8499             abi_ulong *v;
8500             abi_ulong v1, v2, v3, v4, v5, v6;
8501             if (!(v = lock_user(VERIFY_READ, arg1, 6 * sizeof(abi_ulong), 1)))
8502                 return -TARGET_EFAULT;
8503             v1 = tswapal(v[0]);
8504             v2 = tswapal(v[1]);
8505             v3 = tswapal(v[2]);
8506             v4 = tswapal(v[3]);
8507             v5 = tswapal(v[4]);
8508             v6 = tswapal(v[5]);
8509             unlock_user(v, arg1, 0);
8510             ret = get_errno(target_mmap(v1, v2, v3,
8511                                         target_to_host_bitmask(v4, mmap_flags_tbl),
8512                                         v5, v6));
8513         }
8514 #else
8515         ret = get_errno(target_mmap(arg1, arg2, arg3,
8516                                     target_to_host_bitmask(arg4, mmap_flags_tbl),
8517                                     arg5,
8518                                     arg6));
8519 #endif
8520         return ret;
8521 #endif
8522 #ifdef TARGET_NR_mmap2
8523     case TARGET_NR_mmap2:
8524 #ifndef MMAP_SHIFT
8525 #define MMAP_SHIFT 12
8526 #endif
8527         ret = target_mmap(arg1, arg2, arg3,
8528                           target_to_host_bitmask(arg4, mmap_flags_tbl),
8529                           arg5, arg6 << MMAP_SHIFT);
8530         return get_errno(ret);
8531 #endif
8532     case TARGET_NR_munmap:
8533         return get_errno(target_munmap(arg1, arg2));
8534     case TARGET_NR_mprotect:
8535         {
8536             TaskState *ts = cpu->opaque;
8537             /* Special hack to detect libc making the stack executable.  */
8538             if ((arg3 & PROT_GROWSDOWN)
8539                 && arg1 >= ts->info->stack_limit
8540                 && arg1 <= ts->info->start_stack) {
8541                 arg3 &= ~PROT_GROWSDOWN;
8542                 arg2 = arg2 + arg1 - ts->info->stack_limit;
8543                 arg1 = ts->info->stack_limit;
8544             }
8545         }
8546         return get_errno(target_mprotect(arg1, arg2, arg3));
8547 #ifdef TARGET_NR_mremap
8548     case TARGET_NR_mremap:
8549         return get_errno(target_mremap(arg1, arg2, arg3, arg4, arg5));
8550 #endif
8551         /* ??? msync/mlock/munlock are broken for softmmu.  */
8552 #ifdef TARGET_NR_msync
8553     case TARGET_NR_msync:
8554         return get_errno(msync(g2h(arg1), arg2, arg3));
8555 #endif
8556 #ifdef TARGET_NR_mlock
8557     case TARGET_NR_mlock:
8558         return get_errno(mlock(g2h(arg1), arg2));
8559 #endif
8560 #ifdef TARGET_NR_munlock
8561     case TARGET_NR_munlock:
8562         return get_errno(munlock(g2h(arg1), arg2));
8563 #endif
8564 #ifdef TARGET_NR_mlockall
8565     case TARGET_NR_mlockall:
8566         return get_errno(mlockall(target_to_host_mlockall_arg(arg1)));
8567 #endif
8568 #ifdef TARGET_NR_munlockall
8569     case TARGET_NR_munlockall:
8570         return get_errno(munlockall());
8571 #endif
8572 #ifdef TARGET_NR_truncate
8573     case TARGET_NR_truncate:
8574         if (!(p = lock_user_string(arg1)))
8575             return -TARGET_EFAULT;
8576         ret = get_errno(truncate(p, arg2));
8577         unlock_user(p, arg1, 0);
8578         return ret;
8579 #endif
8580 #ifdef TARGET_NR_ftruncate
8581     case TARGET_NR_ftruncate:
8582         return get_errno(ftruncate(arg1, arg2));
8583 #endif
8584     case TARGET_NR_fchmod:
8585         return get_errno(fchmod(arg1, arg2));
8586 #if defined(TARGET_NR_fchmodat)
8587     case TARGET_NR_fchmodat:
8588         if (!(p = lock_user_string(arg2)))
8589             return -TARGET_EFAULT;
8590         ret = get_errno(fchmodat(arg1, p, arg3, 0));
8591         unlock_user(p, arg2, 0);
8592         return ret;
8593 #endif
8594     case TARGET_NR_getpriority:
8595         /* Note that negative values are valid for getpriority, so we must
8596            differentiate based on errno settings.  */
8597         errno = 0;
8598         ret = getpriority(arg1, arg2);
8599         if (ret == -1 && errno != 0) {
8600             return -host_to_target_errno(errno);
8601         }
8602 #ifdef TARGET_ALPHA
8603         /* Return value is the unbiased priority.  Signal no error.  */
8604         ((CPUAlphaState *)cpu_env)->ir[IR_V0] = 0;
8605 #else
8606         /* Return value is a biased priority to avoid negative numbers.  */
8607         ret = 20 - ret;
8608 #endif
8609         return ret;
8610     case TARGET_NR_setpriority:
8611         return get_errno(setpriority(arg1, arg2, arg3));
8612 #ifdef TARGET_NR_statfs
8613     case TARGET_NR_statfs:
8614         if (!(p = lock_user_string(arg1))) {
8615             return -TARGET_EFAULT;
8616         }
8617         ret = get_errno(statfs(path(p), &stfs));
8618         unlock_user(p, arg1, 0);
8619     convert_statfs:
8620         if (!is_error(ret)) {
8621             struct target_statfs *target_stfs;
8622 
8623             if (!lock_user_struct(VERIFY_WRITE, target_stfs, arg2, 0))
8624                 return -TARGET_EFAULT;
8625             __put_user(stfs.f_type, &target_stfs->f_type);
8626             __put_user(stfs.f_bsize, &target_stfs->f_bsize);
8627             __put_user(stfs.f_blocks, &target_stfs->f_blocks);
8628             __put_user(stfs.f_bfree, &target_stfs->f_bfree);
8629             __put_user(stfs.f_bavail, &target_stfs->f_bavail);
8630             __put_user(stfs.f_files, &target_stfs->f_files);
8631             __put_user(stfs.f_ffree, &target_stfs->f_ffree);
8632             __put_user(stfs.f_fsid.__val[0], &target_stfs->f_fsid.val[0]);
8633             __put_user(stfs.f_fsid.__val[1], &target_stfs->f_fsid.val[1]);
8634             __put_user(stfs.f_namelen, &target_stfs->f_namelen);
8635             __put_user(stfs.f_frsize, &target_stfs->f_frsize);
8636 #ifdef _STATFS_F_FLAGS
8637             __put_user(stfs.f_flags, &target_stfs->f_flags);
8638 #else
8639             __put_user(0, &target_stfs->f_flags);
8640 #endif
8641             memset(target_stfs->f_spare, 0, sizeof(target_stfs->f_spare));
8642             unlock_user_struct(target_stfs, arg2, 1);
8643         }
8644         return ret;
8645 #endif
8646 #ifdef TARGET_NR_fstatfs
8647     case TARGET_NR_fstatfs:
8648         ret = get_errno(fstatfs(arg1, &stfs));
8649         goto convert_statfs;
8650 #endif
8651 #ifdef TARGET_NR_statfs64
8652     case TARGET_NR_statfs64:
8653         if (!(p = lock_user_string(arg1))) {
8654             return -TARGET_EFAULT;
8655         }
8656         ret = get_errno(statfs(path(p), &stfs));
8657         unlock_user(p, arg1, 0);
8658     convert_statfs64:
8659         if (!is_error(ret)) {
8660             struct target_statfs64 *target_stfs;
8661 
8662             if (!lock_user_struct(VERIFY_WRITE, target_stfs, arg3, 0))
8663                 return -TARGET_EFAULT;
8664             __put_user(stfs.f_type, &target_stfs->f_type);
8665             __put_user(stfs.f_bsize, &target_stfs->f_bsize);
8666             __put_user(stfs.f_blocks, &target_stfs->f_blocks);
8667             __put_user(stfs.f_bfree, &target_stfs->f_bfree);
8668             __put_user(stfs.f_bavail, &target_stfs->f_bavail);
8669             __put_user(stfs.f_files, &target_stfs->f_files);
8670             __put_user(stfs.f_ffree, &target_stfs->f_ffree);
8671             __put_user(stfs.f_fsid.__val[0], &target_stfs->f_fsid.val[0]);
8672             __put_user(stfs.f_fsid.__val[1], &target_stfs->f_fsid.val[1]);
8673             __put_user(stfs.f_namelen, &target_stfs->f_namelen);
8674             __put_user(stfs.f_frsize, &target_stfs->f_frsize);
8675             memset(target_stfs->f_spare, 0, sizeof(target_stfs->f_spare));
8676             unlock_user_struct(target_stfs, arg3, 1);
8677         }
8678         return ret;
8679     case TARGET_NR_fstatfs64:
8680         ret = get_errno(fstatfs(arg1, &stfs));
8681         goto convert_statfs64;
8682 #endif
8683 #ifdef TARGET_NR_socketcall
8684     case TARGET_NR_socketcall:
8685         return do_socketcall(arg1, arg2);
8686 #endif
8687 #ifdef TARGET_NR_accept
8688     case TARGET_NR_accept:
8689         return do_accept4(arg1, arg2, arg3, 0);
8690 #endif
8691 #ifdef TARGET_NR_accept4
8692     case TARGET_NR_accept4:
8693         return do_accept4(arg1, arg2, arg3, arg4);
8694 #endif
8695 #ifdef TARGET_NR_bind
8696     case TARGET_NR_bind:
8697         return do_bind(arg1, arg2, arg3);
8698 #endif
8699 #ifdef TARGET_NR_connect
8700     case TARGET_NR_connect:
8701         return do_connect(arg1, arg2, arg3);
8702 #endif
8703 #ifdef TARGET_NR_getpeername
8704     case TARGET_NR_getpeername:
8705         return do_getpeername(arg1, arg2, arg3);
8706 #endif
8707 #ifdef TARGET_NR_getsockname
8708     case TARGET_NR_getsockname:
8709         return do_getsockname(arg1, arg2, arg3);
8710 #endif
8711 #ifdef TARGET_NR_getsockopt
8712     case TARGET_NR_getsockopt:
8713         return do_getsockopt(arg1, arg2, arg3, arg4, arg5);
8714 #endif
8715 #ifdef TARGET_NR_listen
8716     case TARGET_NR_listen:
8717         return get_errno(listen(arg1, arg2));
8718 #endif
8719 #ifdef TARGET_NR_recv
8720     case TARGET_NR_recv:
8721         return do_recvfrom(arg1, arg2, arg3, arg4, 0, 0);
8722 #endif
8723 #ifdef TARGET_NR_recvfrom
8724     case TARGET_NR_recvfrom:
8725         return do_recvfrom(arg1, arg2, arg3, arg4, arg5, arg6);
8726 #endif
8727 #ifdef TARGET_NR_recvmsg
8728     case TARGET_NR_recvmsg:
8729         return do_sendrecvmsg(arg1, arg2, arg3, 0);
8730 #endif
8731 #ifdef TARGET_NR_send
8732     case TARGET_NR_send:
8733         return do_sendto(arg1, arg2, arg3, arg4, 0, 0);
8734 #endif
8735 #ifdef TARGET_NR_sendmsg
8736     case TARGET_NR_sendmsg:
8737         return do_sendrecvmsg(arg1, arg2, arg3, 1);
8738 #endif
8739 #ifdef TARGET_NR_sendmmsg
8740     case TARGET_NR_sendmmsg:
8741         return do_sendrecvmmsg(arg1, arg2, arg3, arg4, 1);
8742     case TARGET_NR_recvmmsg:
8743         return do_sendrecvmmsg(arg1, arg2, arg3, arg4, 0);
8744 #endif
8745 #ifdef TARGET_NR_sendto
8746     case TARGET_NR_sendto:
8747         return do_sendto(arg1, arg2, arg3, arg4, arg5, arg6);
8748 #endif
8749 #ifdef TARGET_NR_shutdown
8750     case TARGET_NR_shutdown:
8751         return get_errno(shutdown(arg1, arg2));
8752 #endif
8753 #if defined(TARGET_NR_getrandom) && defined(__NR_getrandom)
8754     case TARGET_NR_getrandom:
8755         p = lock_user(VERIFY_WRITE, arg1, arg2, 0);
8756         if (!p) {
8757             return -TARGET_EFAULT;
8758         }
8759         ret = get_errno(getrandom(p, arg2, arg3));
8760         unlock_user(p, arg1, ret);
8761         return ret;
8762 #endif
8763 #ifdef TARGET_NR_socket
8764     case TARGET_NR_socket:
8765         return do_socket(arg1, arg2, arg3);
8766 #endif
8767 #ifdef TARGET_NR_socketpair
8768     case TARGET_NR_socketpair:
8769         return do_socketpair(arg1, arg2, arg3, arg4);
8770 #endif
8771 #ifdef TARGET_NR_setsockopt
8772     case TARGET_NR_setsockopt:
8773         return do_setsockopt(arg1, arg2, arg3, arg4, (socklen_t) arg5);
8774 #endif
8775 #if defined(TARGET_NR_syslog)
8776     case TARGET_NR_syslog:
8777         {
8778             int len = arg2;
8779 
8780             switch (arg1) {
8781             case TARGET_SYSLOG_ACTION_CLOSE:         /* Close log */
8782             case TARGET_SYSLOG_ACTION_OPEN:          /* Open log */
8783             case TARGET_SYSLOG_ACTION_CLEAR:         /* Clear ring buffer */
8784             case TARGET_SYSLOG_ACTION_CONSOLE_OFF:   /* Disable logging */
8785             case TARGET_SYSLOG_ACTION_CONSOLE_ON:    /* Enable logging */
8786             case TARGET_SYSLOG_ACTION_CONSOLE_LEVEL: /* Set messages level */
8787             case TARGET_SYSLOG_ACTION_SIZE_UNREAD:   /* Number of chars */
8788             case TARGET_SYSLOG_ACTION_SIZE_BUFFER:   /* Size of the buffer */
8789                 return get_errno(sys_syslog((int)arg1, NULL, (int)arg3));
8790             case TARGET_SYSLOG_ACTION_READ:          /* Read from log */
8791             case TARGET_SYSLOG_ACTION_READ_CLEAR:    /* Read/clear msgs */
8792             case TARGET_SYSLOG_ACTION_READ_ALL:      /* Read last messages */
8793                 {
8794                     if (len < 0) {
8795                         return -TARGET_EINVAL;
8796                     }
8797                     if (len == 0) {
8798                         return 0;
8799                     }
8800                     p = lock_user(VERIFY_WRITE, arg2, arg3, 0);
8801                     if (!p) {
8802                         return -TARGET_EFAULT;
8803                     }
8804                     ret = get_errno(sys_syslog((int)arg1, p, (int)arg3));
8805                     unlock_user(p, arg2, arg3);
8806                 }
8807                 return ret;
8808             default:
8809                 return -TARGET_EINVAL;
8810             }
8811         }
8812         break;
8813 #endif
8814     case TARGET_NR_setitimer:
8815         {
8816             struct itimerval value, ovalue, *pvalue;
8817 
8818             if (arg2) {
8819                 pvalue = &value;
8820                 if (copy_from_user_timeval(&pvalue->it_interval, arg2)
8821                     || copy_from_user_timeval(&pvalue->it_value,
8822                                               arg2 + sizeof(struct target_timeval)))
8823                     return -TARGET_EFAULT;
8824             } else {
8825                 pvalue = NULL;
8826             }
8827             ret = get_errno(setitimer(arg1, pvalue, &ovalue));
8828             if (!is_error(ret) && arg3) {
8829                 if (copy_to_user_timeval(arg3,
8830                                          &ovalue.it_interval)
8831                     || copy_to_user_timeval(arg3 + sizeof(struct target_timeval),
8832                                             &ovalue.it_value))
8833                     return -TARGET_EFAULT;
8834             }
8835         }
8836         return ret;
8837     case TARGET_NR_getitimer:
8838         {
8839             struct itimerval value;
8840 
8841             ret = get_errno(getitimer(arg1, &value));
8842             if (!is_error(ret) && arg2) {
8843                 if (copy_to_user_timeval(arg2,
8844                                          &value.it_interval)
8845                     || copy_to_user_timeval(arg2 + sizeof(struct target_timeval),
8846                                             &value.it_value))
8847                     return -TARGET_EFAULT;
8848             }
8849         }
8850         return ret;
8851 #ifdef TARGET_NR_stat
8852     case TARGET_NR_stat:
8853         if (!(p = lock_user_string(arg1))) {
8854             return -TARGET_EFAULT;
8855         }
8856         ret = get_errno(stat(path(p), &st));
8857         unlock_user(p, arg1, 0);
8858         goto do_stat;
8859 #endif
8860 #ifdef TARGET_NR_lstat
8861     case TARGET_NR_lstat:
8862         if (!(p = lock_user_string(arg1))) {
8863             return -TARGET_EFAULT;
8864         }
8865         ret = get_errno(lstat(path(p), &st));
8866         unlock_user(p, arg1, 0);
8867         goto do_stat;
8868 #endif
8869 #ifdef TARGET_NR_fstat
8870     case TARGET_NR_fstat:
8871         {
8872             ret = get_errno(fstat(arg1, &st));
8873 #if defined(TARGET_NR_stat) || defined(TARGET_NR_lstat)
8874         do_stat:
8875 #endif
8876             if (!is_error(ret)) {
8877                 struct target_stat *target_st;
8878 
8879                 if (!lock_user_struct(VERIFY_WRITE, target_st, arg2, 0))
8880                     return -TARGET_EFAULT;
8881                 memset(target_st, 0, sizeof(*target_st));
8882                 __put_user(st.st_dev, &target_st->st_dev);
8883                 __put_user(st.st_ino, &target_st->st_ino);
8884                 __put_user(st.st_mode, &target_st->st_mode);
8885                 __put_user(st.st_uid, &target_st->st_uid);
8886                 __put_user(st.st_gid, &target_st->st_gid);
8887                 __put_user(st.st_nlink, &target_st->st_nlink);
8888                 __put_user(st.st_rdev, &target_st->st_rdev);
8889                 __put_user(st.st_size, &target_st->st_size);
8890                 __put_user(st.st_blksize, &target_st->st_blksize);
8891                 __put_user(st.st_blocks, &target_st->st_blocks);
8892                 __put_user(st.st_atime, &target_st->target_st_atime);
8893                 __put_user(st.st_mtime, &target_st->target_st_mtime);
8894                 __put_user(st.st_ctime, &target_st->target_st_ctime);
8895                 unlock_user_struct(target_st, arg2, 1);
8896             }
8897         }
8898         return ret;
8899 #endif
8900     case TARGET_NR_vhangup:
8901         return get_errno(vhangup());
8902 #ifdef TARGET_NR_syscall
8903     case TARGET_NR_syscall:
8904         return do_syscall(cpu_env, arg1 & 0xffff, arg2, arg3, arg4, arg5,
8905                           arg6, arg7, arg8, 0);
8906 #endif
8907     case TARGET_NR_wait4:
8908         {
8909             int status;
8910             abi_long status_ptr = arg2;
8911             struct rusage rusage, *rusage_ptr;
8912             abi_ulong target_rusage = arg4;
8913             abi_long rusage_err;
8914             if (target_rusage)
8915                 rusage_ptr = &rusage;
8916             else
8917                 rusage_ptr = NULL;
8918             ret = get_errno(safe_wait4(arg1, &status, arg3, rusage_ptr));
8919             if (!is_error(ret)) {
8920                 if (status_ptr && ret) {
8921                     status = host_to_target_waitstatus(status);
8922                     if (put_user_s32(status, status_ptr))
8923                         return -TARGET_EFAULT;
8924                 }
8925                 if (target_rusage) {
8926                     rusage_err = host_to_target_rusage(target_rusage, &rusage);
8927                     if (rusage_err) {
8928                         ret = rusage_err;
8929                     }
8930                 }
8931             }
8932         }
8933         return ret;
8934 #ifdef TARGET_NR_swapoff
8935     case TARGET_NR_swapoff:
8936         if (!(p = lock_user_string(arg1)))
8937             return -TARGET_EFAULT;
8938         ret = get_errno(swapoff(p));
8939         unlock_user(p, arg1, 0);
8940         return ret;
8941 #endif
8942     case TARGET_NR_sysinfo:
8943         {
8944             struct target_sysinfo *target_value;
8945             struct sysinfo value;
8946             ret = get_errno(sysinfo(&value));
8947             if (!is_error(ret) && arg1)
8948             {
8949                 if (!lock_user_struct(VERIFY_WRITE, target_value, arg1, 0))
8950                     return -TARGET_EFAULT;
8951                 __put_user(value.uptime, &target_value->uptime);
8952                 __put_user(value.loads[0], &target_value->loads[0]);
8953                 __put_user(value.loads[1], &target_value->loads[1]);
8954                 __put_user(value.loads[2], &target_value->loads[2]);
8955                 __put_user(value.totalram, &target_value->totalram);
8956                 __put_user(value.freeram, &target_value->freeram);
8957                 __put_user(value.sharedram, &target_value->sharedram);
8958                 __put_user(value.bufferram, &target_value->bufferram);
8959                 __put_user(value.totalswap, &target_value->totalswap);
8960                 __put_user(value.freeswap, &target_value->freeswap);
8961                 __put_user(value.procs, &target_value->procs);
8962                 __put_user(value.totalhigh, &target_value->totalhigh);
8963                 __put_user(value.freehigh, &target_value->freehigh);
8964                 __put_user(value.mem_unit, &target_value->mem_unit);
8965                 unlock_user_struct(target_value, arg1, 1);
8966             }
8967         }
8968         return ret;
8969 #ifdef TARGET_NR_ipc
8970     case TARGET_NR_ipc:
8971         return do_ipc(cpu_env, arg1, arg2, arg3, arg4, arg5, arg6);
8972 #endif
8973 #ifdef TARGET_NR_semget
8974     case TARGET_NR_semget:
8975         return get_errno(semget(arg1, arg2, arg3));
8976 #endif
8977 #ifdef TARGET_NR_semop
8978     case TARGET_NR_semop:
8979         return do_semop(arg1, arg2, arg3);
8980 #endif
8981 #ifdef TARGET_NR_semctl
8982     case TARGET_NR_semctl:
8983         return do_semctl(arg1, arg2, arg3, arg4);
8984 #endif
8985 #ifdef TARGET_NR_msgctl
8986     case TARGET_NR_msgctl:
8987         return do_msgctl(arg1, arg2, arg3);
8988 #endif
8989 #ifdef TARGET_NR_msgget
8990     case TARGET_NR_msgget:
8991         return get_errno(msgget(arg1, arg2));
8992 #endif
8993 #ifdef TARGET_NR_msgrcv
8994     case TARGET_NR_msgrcv:
8995         return do_msgrcv(arg1, arg2, arg3, arg4, arg5);
8996 #endif
8997 #ifdef TARGET_NR_msgsnd
8998     case TARGET_NR_msgsnd:
8999         return do_msgsnd(arg1, arg2, arg3, arg4);
9000 #endif
9001 #ifdef TARGET_NR_shmget
9002     case TARGET_NR_shmget:
9003         return get_errno(shmget(arg1, arg2, arg3));
9004 #endif
9005 #ifdef TARGET_NR_shmctl
9006     case TARGET_NR_shmctl:
9007         return do_shmctl(arg1, arg2, arg3);
9008 #endif
9009 #ifdef TARGET_NR_shmat
9010     case TARGET_NR_shmat:
9011         return do_shmat(cpu_env, arg1, arg2, arg3);
9012 #endif
9013 #ifdef TARGET_NR_shmdt
9014     case TARGET_NR_shmdt:
9015         return do_shmdt(arg1);
9016 #endif
9017     case TARGET_NR_fsync:
9018         return get_errno(fsync(arg1));
9019     case TARGET_NR_clone:
9020         /* Linux manages to have three different orderings for its
9021          * arguments to clone(); the BACKWARDS and BACKWARDS2 defines
9022          * match the kernel's CONFIG_CLONE_* settings.
9023          * Microblaze is further special in that it uses a sixth
9024          * implicit argument to clone for the TLS pointer.
9025          */
9026 #if defined(TARGET_MICROBLAZE)
9027         ret = get_errno(do_fork(cpu_env, arg1, arg2, arg4, arg6, arg5));
9028 #elif defined(TARGET_CLONE_BACKWARDS)
9029         ret = get_errno(do_fork(cpu_env, arg1, arg2, arg3, arg4, arg5));
9030 #elif defined(TARGET_CLONE_BACKWARDS2)
9031         ret = get_errno(do_fork(cpu_env, arg2, arg1, arg3, arg5, arg4));
9032 #else
9033         ret = get_errno(do_fork(cpu_env, arg1, arg2, arg3, arg5, arg4));
9034 #endif
9035         return ret;
9036 #ifdef __NR_exit_group
9037         /* new thread calls */
9038     case TARGET_NR_exit_group:
9039         preexit_cleanup(cpu_env, arg1);
9040         return get_errno(exit_group(arg1));
9041 #endif
9042     case TARGET_NR_setdomainname:
9043         if (!(p = lock_user_string(arg1)))
9044             return -TARGET_EFAULT;
9045         ret = get_errno(setdomainname(p, arg2));
9046         unlock_user(p, arg1, 0);
9047         return ret;
9048     case TARGET_NR_uname:
9049         /* no need to transcode because we use the linux syscall */
9050         {
9051             struct new_utsname * buf;
9052 
9053             if (!lock_user_struct(VERIFY_WRITE, buf, arg1, 0))
9054                 return -TARGET_EFAULT;
9055             ret = get_errno(sys_uname(buf));
9056             if (!is_error(ret)) {
9057                 /* Overwrite the native machine name with whatever is being
9058                    emulated. */
9059                 g_strlcpy(buf->machine, cpu_to_uname_machine(cpu_env),
9060                           sizeof(buf->machine));
9061                 /* Allow the user to override the reported release.  */
9062                 if (qemu_uname_release && *qemu_uname_release) {
9063                     g_strlcpy(buf->release, qemu_uname_release,
9064                               sizeof(buf->release));
9065                 }
9066             }
9067             unlock_user_struct(buf, arg1, 1);
9068         }
9069         return ret;
9070 #ifdef TARGET_I386
9071     case TARGET_NR_modify_ldt:
9072         return do_modify_ldt(cpu_env, arg1, arg2, arg3);
9073 #if !defined(TARGET_X86_64)
9074     case TARGET_NR_vm86:
9075         return do_vm86(cpu_env, arg1, arg2);
9076 #endif
9077 #endif
9078     case TARGET_NR_adjtimex:
9079         {
9080             struct timex host_buf;
9081 
9082             if (target_to_host_timex(&host_buf, arg1) != 0) {
9083                 return -TARGET_EFAULT;
9084             }
9085             ret = get_errno(adjtimex(&host_buf));
9086             if (!is_error(ret)) {
9087                 if (host_to_target_timex(arg1, &host_buf) != 0) {
9088                     return -TARGET_EFAULT;
9089                 }
9090             }
9091         }
9092         return ret;
9093 #if defined(TARGET_NR_clock_adjtime) && defined(CONFIG_CLOCK_ADJTIME)
9094     case TARGET_NR_clock_adjtime:
9095         {
9096             struct timex htx, *phtx = &htx;
9097 
9098             if (target_to_host_timex(phtx, arg2) != 0) {
9099                 return -TARGET_EFAULT;
9100             }
9101             ret = get_errno(clock_adjtime(arg1, phtx));
9102             if (!is_error(ret) && phtx) {
9103                 if (host_to_target_timex(arg2, phtx) != 0) {
9104                     return -TARGET_EFAULT;
9105                 }
9106             }
9107         }
9108         return ret;
9109 #endif
9110     case TARGET_NR_getpgid:
9111         return get_errno(getpgid(arg1));
9112     case TARGET_NR_fchdir:
9113         return get_errno(fchdir(arg1));
9114     case TARGET_NR_personality:
9115         return get_errno(personality(arg1));
9116 #ifdef TARGET_NR__llseek /* Not on alpha */
9117     case TARGET_NR__llseek:
9118         {
9119             int64_t res;
9120 #if !defined(__NR_llseek)
9121             res = lseek(arg1, ((uint64_t)arg2 << 32) | (abi_ulong)arg3, arg5);
9122             if (res == -1) {
9123                 ret = get_errno(res);
9124             } else {
9125                 ret = 0;
9126             }
9127 #else
9128             ret = get_errno(_llseek(arg1, arg2, arg3, &res, arg5));
9129 #endif
9130             if ((ret == 0) && put_user_s64(res, arg4)) {
9131                 return -TARGET_EFAULT;
9132             }
9133         }
9134         return ret;
9135 #endif
9136 #ifdef TARGET_NR_getdents
9137     case TARGET_NR_getdents:
9138 #ifdef EMULATE_GETDENTS_WITH_GETDENTS
9139 #if TARGET_ABI_BITS == 32 && HOST_LONG_BITS == 64
9140         {
9141             struct target_dirent *target_dirp;
9142             struct linux_dirent *dirp;
9143             abi_long count = arg3;
9144 
9145             dirp = g_try_malloc(count);
9146             if (!dirp) {
9147                 return -TARGET_ENOMEM;
9148             }
9149 
9150             ret = get_errno(sys_getdents(arg1, dirp, count));
9151             if (!is_error(ret)) {
9152                 struct linux_dirent *de;
9153 		struct target_dirent *tde;
9154                 int len = ret;
9155                 int reclen, treclen;
9156 		int count1, tnamelen;
9157 
9158 		count1 = 0;
9159                 de = dirp;
9160                 if (!(target_dirp = lock_user(VERIFY_WRITE, arg2, count, 0)))
9161                     return -TARGET_EFAULT;
9162 		tde = target_dirp;
9163                 while (len > 0) {
9164                     reclen = de->d_reclen;
9165                     tnamelen = reclen - offsetof(struct linux_dirent, d_name);
9166                     assert(tnamelen >= 0);
9167                     treclen = tnamelen + offsetof(struct target_dirent, d_name);
9168                     assert(count1 + treclen <= count);
9169                     tde->d_reclen = tswap16(treclen);
9170                     tde->d_ino = tswapal(de->d_ino);
9171                     tde->d_off = tswapal(de->d_off);
9172                     memcpy(tde->d_name, de->d_name, tnamelen);
9173                     de = (struct linux_dirent *)((char *)de + reclen);
9174                     len -= reclen;
9175                     tde = (struct target_dirent *)((char *)tde + treclen);
9176 		    count1 += treclen;
9177                 }
9178 		ret = count1;
9179                 unlock_user(target_dirp, arg2, ret);
9180             }
9181             g_free(dirp);
9182         }
9183 #else
9184         {
9185             struct linux_dirent *dirp;
9186             abi_long count = arg3;
9187 
9188             if (!(dirp = lock_user(VERIFY_WRITE, arg2, count, 0)))
9189                 return -TARGET_EFAULT;
9190             ret = get_errno(sys_getdents(arg1, dirp, count));
9191             if (!is_error(ret)) {
9192                 struct linux_dirent *de;
9193                 int len = ret;
9194                 int reclen;
9195                 de = dirp;
9196                 while (len > 0) {
9197                     reclen = de->d_reclen;
9198                     if (reclen > len)
9199                         break;
9200                     de->d_reclen = tswap16(reclen);
9201                     tswapls(&de->d_ino);
9202                     tswapls(&de->d_off);
9203                     de = (struct linux_dirent *)((char *)de + reclen);
9204                     len -= reclen;
9205                 }
9206             }
9207             unlock_user(dirp, arg2, ret);
9208         }
9209 #endif
9210 #else
9211         /* Implement getdents in terms of getdents64 */
9212         {
9213             struct linux_dirent64 *dirp;
9214             abi_long count = arg3;
9215 
9216             dirp = lock_user(VERIFY_WRITE, arg2, count, 0);
9217             if (!dirp) {
9218                 return -TARGET_EFAULT;
9219             }
9220             ret = get_errno(sys_getdents64(arg1, dirp, count));
9221             if (!is_error(ret)) {
9222                 /* Convert the dirent64 structs to target dirent.  We do this
9223                  * in-place, since we can guarantee that a target_dirent is no
9224                  * larger than a dirent64; however this means we have to be
9225                  * careful to read everything before writing in the new format.
9226                  */
9227                 struct linux_dirent64 *de;
9228                 struct target_dirent *tde;
9229                 int len = ret;
9230                 int tlen = 0;
9231 
9232                 de = dirp;
9233                 tde = (struct target_dirent *)dirp;
9234                 while (len > 0) {
9235                     int namelen, treclen;
9236                     int reclen = de->d_reclen;
9237                     uint64_t ino = de->d_ino;
9238                     int64_t off = de->d_off;
9239                     uint8_t type = de->d_type;
9240 
9241                     namelen = strlen(de->d_name);
9242                     treclen = offsetof(struct target_dirent, d_name)
9243                         + namelen + 2;
9244                     treclen = QEMU_ALIGN_UP(treclen, sizeof(abi_long));
9245 
9246                     memmove(tde->d_name, de->d_name, namelen + 1);
9247                     tde->d_ino = tswapal(ino);
9248                     tde->d_off = tswapal(off);
9249                     tde->d_reclen = tswap16(treclen);
9250                     /* The target_dirent type is in what was formerly a padding
9251                      * byte at the end of the structure:
9252                      */
9253                     *(((char *)tde) + treclen - 1) = type;
9254 
9255                     de = (struct linux_dirent64 *)((char *)de + reclen);
9256                     tde = (struct target_dirent *)((char *)tde + treclen);
9257                     len -= reclen;
9258                     tlen += treclen;
9259                 }
9260                 ret = tlen;
9261             }
9262             unlock_user(dirp, arg2, ret);
9263         }
9264 #endif
9265         return ret;
9266 #endif /* TARGET_NR_getdents */
9267 #if defined(TARGET_NR_getdents64) && defined(__NR_getdents64)
9268     case TARGET_NR_getdents64:
9269         {
9270             struct linux_dirent64 *dirp;
9271             abi_long count = arg3;
9272             if (!(dirp = lock_user(VERIFY_WRITE, arg2, count, 0)))
9273                 return -TARGET_EFAULT;
9274             ret = get_errno(sys_getdents64(arg1, dirp, count));
9275             if (!is_error(ret)) {
9276                 struct linux_dirent64 *de;
9277                 int len = ret;
9278                 int reclen;
9279                 de = dirp;
9280                 while (len > 0) {
9281                     reclen = de->d_reclen;
9282                     if (reclen > len)
9283                         break;
9284                     de->d_reclen = tswap16(reclen);
9285                     tswap64s((uint64_t *)&de->d_ino);
9286                     tswap64s((uint64_t *)&de->d_off);
9287                     de = (struct linux_dirent64 *)((char *)de + reclen);
9288                     len -= reclen;
9289                 }
9290             }
9291             unlock_user(dirp, arg2, ret);
9292         }
9293         return ret;
9294 #endif /* TARGET_NR_getdents64 */
9295 #if defined(TARGET_NR__newselect)
9296     case TARGET_NR__newselect:
9297         return do_select(arg1, arg2, arg3, arg4, arg5);
9298 #endif
9299 #if defined(TARGET_NR_poll) || defined(TARGET_NR_ppoll)
9300 # ifdef TARGET_NR_poll
9301     case TARGET_NR_poll:
9302 # endif
9303 # ifdef TARGET_NR_ppoll
9304     case TARGET_NR_ppoll:
9305 # endif
9306         {
9307             struct target_pollfd *target_pfd;
9308             unsigned int nfds = arg2;
9309             struct pollfd *pfd;
9310             unsigned int i;
9311 
9312             pfd = NULL;
9313             target_pfd = NULL;
9314             if (nfds) {
9315                 if (nfds > (INT_MAX / sizeof(struct target_pollfd))) {
9316                     return -TARGET_EINVAL;
9317                 }
9318 
9319                 target_pfd = lock_user(VERIFY_WRITE, arg1,
9320                                        sizeof(struct target_pollfd) * nfds, 1);
9321                 if (!target_pfd) {
9322                     return -TARGET_EFAULT;
9323                 }
9324 
9325                 pfd = alloca(sizeof(struct pollfd) * nfds);
9326                 for (i = 0; i < nfds; i++) {
9327                     pfd[i].fd = tswap32(target_pfd[i].fd);
9328                     pfd[i].events = tswap16(target_pfd[i].events);
9329                 }
9330             }
9331 
9332             switch (num) {
9333 # ifdef TARGET_NR_ppoll
9334             case TARGET_NR_ppoll:
9335             {
9336                 struct timespec _timeout_ts, *timeout_ts = &_timeout_ts;
9337                 target_sigset_t *target_set;
9338                 sigset_t _set, *set = &_set;
9339 
9340                 if (arg3) {
9341                     if (target_to_host_timespec(timeout_ts, arg3)) {
9342                         unlock_user(target_pfd, arg1, 0);
9343                         return -TARGET_EFAULT;
9344                     }
9345                 } else {
9346                     timeout_ts = NULL;
9347                 }
9348 
9349                 if (arg4) {
9350                     if (arg5 != sizeof(target_sigset_t)) {
9351                         unlock_user(target_pfd, arg1, 0);
9352                         return -TARGET_EINVAL;
9353                     }
9354 
9355                     target_set = lock_user(VERIFY_READ, arg4, sizeof(target_sigset_t), 1);
9356                     if (!target_set) {
9357                         unlock_user(target_pfd, arg1, 0);
9358                         return -TARGET_EFAULT;
9359                     }
9360                     target_to_host_sigset(set, target_set);
9361                 } else {
9362                     set = NULL;
9363                 }
9364 
9365                 ret = get_errno(safe_ppoll(pfd, nfds, timeout_ts,
9366                                            set, SIGSET_T_SIZE));
9367 
9368                 if (!is_error(ret) && arg3) {
9369                     host_to_target_timespec(arg3, timeout_ts);
9370                 }
9371                 if (arg4) {
9372                     unlock_user(target_set, arg4, 0);
9373                 }
9374                 break;
9375             }
9376 # endif
9377 # ifdef TARGET_NR_poll
9378             case TARGET_NR_poll:
9379             {
9380                 struct timespec ts, *pts;
9381 
9382                 if (arg3 >= 0) {
9383                     /* Convert ms to secs, ns */
9384                     ts.tv_sec = arg3 / 1000;
9385                     ts.tv_nsec = (arg3 % 1000) * 1000000LL;
9386                     pts = &ts;
9387                 } else {
9388                     /* -ve poll() timeout means "infinite" */
9389                     pts = NULL;
9390                 }
9391                 ret = get_errno(safe_ppoll(pfd, nfds, pts, NULL, 0));
9392                 break;
9393             }
9394 # endif
9395             default:
9396                 g_assert_not_reached();
9397             }
9398 
9399             if (!is_error(ret)) {
9400                 for(i = 0; i < nfds; i++) {
9401                     target_pfd[i].revents = tswap16(pfd[i].revents);
9402                 }
9403             }
9404             unlock_user(target_pfd, arg1, sizeof(struct target_pollfd) * nfds);
9405         }
9406         return ret;
9407 #endif
9408     case TARGET_NR_flock:
9409         /* NOTE: the flock constant seems to be the same for every
9410            Linux platform */
9411         return get_errno(safe_flock(arg1, arg2));
9412     case TARGET_NR_readv:
9413         {
9414             struct iovec *vec = lock_iovec(VERIFY_WRITE, arg2, arg3, 0);
9415             if (vec != NULL) {
9416                 ret = get_errno(safe_readv(arg1, vec, arg3));
9417                 unlock_iovec(vec, arg2, arg3, 1);
9418             } else {
9419                 ret = -host_to_target_errno(errno);
9420             }
9421         }
9422         return ret;
9423     case TARGET_NR_writev:
9424         {
9425             struct iovec *vec = lock_iovec(VERIFY_READ, arg2, arg3, 1);
9426             if (vec != NULL) {
9427                 ret = get_errno(safe_writev(arg1, vec, arg3));
9428                 unlock_iovec(vec, arg2, arg3, 0);
9429             } else {
9430                 ret = -host_to_target_errno(errno);
9431             }
9432         }
9433         return ret;
9434 #if defined(TARGET_NR_preadv)
9435     case TARGET_NR_preadv:
9436         {
9437             struct iovec *vec = lock_iovec(VERIFY_WRITE, arg2, arg3, 0);
9438             if (vec != NULL) {
9439                 unsigned long low, high;
9440 
9441                 target_to_host_low_high(arg4, arg5, &low, &high);
9442                 ret = get_errno(safe_preadv(arg1, vec, arg3, low, high));
9443                 unlock_iovec(vec, arg2, arg3, 1);
9444             } else {
9445                 ret = -host_to_target_errno(errno);
9446            }
9447         }
9448         return ret;
9449 #endif
9450 #if defined(TARGET_NR_pwritev)
9451     case TARGET_NR_pwritev:
9452         {
9453             struct iovec *vec = lock_iovec(VERIFY_READ, arg2, arg3, 1);
9454             if (vec != NULL) {
9455                 unsigned long low, high;
9456 
9457                 target_to_host_low_high(arg4, arg5, &low, &high);
9458                 ret = get_errno(safe_pwritev(arg1, vec, arg3, low, high));
9459                 unlock_iovec(vec, arg2, arg3, 0);
9460             } else {
9461                 ret = -host_to_target_errno(errno);
9462            }
9463         }
9464         return ret;
9465 #endif
9466     case TARGET_NR_getsid:
9467         return get_errno(getsid(arg1));
9468 #if defined(TARGET_NR_fdatasync) /* Not on alpha (osf_datasync ?) */
9469     case TARGET_NR_fdatasync:
9470         return get_errno(fdatasync(arg1));
9471 #endif
9472 #ifdef TARGET_NR__sysctl
9473     case TARGET_NR__sysctl:
9474         /* We don't implement this, but ENOTDIR is always a safe
9475            return value. */
9476         return -TARGET_ENOTDIR;
9477 #endif
9478     case TARGET_NR_sched_getaffinity:
9479         {
9480             unsigned int mask_size;
9481             unsigned long *mask;
9482 
9483             /*
9484              * sched_getaffinity needs multiples of ulong, so need to take
9485              * care of mismatches between target ulong and host ulong sizes.
9486              */
9487             if (arg2 & (sizeof(abi_ulong) - 1)) {
9488                 return -TARGET_EINVAL;
9489             }
9490             mask_size = (arg2 + (sizeof(*mask) - 1)) & ~(sizeof(*mask) - 1);
9491 
9492             mask = alloca(mask_size);
9493             memset(mask, 0, mask_size);
9494             ret = get_errno(sys_sched_getaffinity(arg1, mask_size, mask));
9495 
9496             if (!is_error(ret)) {
9497                 if (ret > arg2) {
9498                     /* More data returned than the caller's buffer will fit.
9499                      * This only happens if sizeof(abi_long) < sizeof(long)
9500                      * and the caller passed us a buffer holding an odd number
9501                      * of abi_longs. If the host kernel is actually using the
9502                      * extra 4 bytes then fail EINVAL; otherwise we can just
9503                      * ignore them and only copy the interesting part.
9504                      */
9505                     int numcpus = sysconf(_SC_NPROCESSORS_CONF);
9506                     if (numcpus > arg2 * 8) {
9507                         return -TARGET_EINVAL;
9508                     }
9509                     ret = arg2;
9510                 }
9511 
9512                 if (host_to_target_cpu_mask(mask, mask_size, arg3, ret)) {
9513                     return -TARGET_EFAULT;
9514                 }
9515             }
9516         }
9517         return ret;
9518     case TARGET_NR_sched_setaffinity:
9519         {
9520             unsigned int mask_size;
9521             unsigned long *mask;
9522 
9523             /*
9524              * sched_setaffinity needs multiples of ulong, so need to take
9525              * care of mismatches between target ulong and host ulong sizes.
9526              */
9527             if (arg2 & (sizeof(abi_ulong) - 1)) {
9528                 return -TARGET_EINVAL;
9529             }
9530             mask_size = (arg2 + (sizeof(*mask) - 1)) & ~(sizeof(*mask) - 1);
9531             mask = alloca(mask_size);
9532 
9533             ret = target_to_host_cpu_mask(mask, mask_size, arg3, arg2);
9534             if (ret) {
9535                 return ret;
9536             }
9537 
9538             return get_errno(sys_sched_setaffinity(arg1, mask_size, mask));
9539         }
9540     case TARGET_NR_getcpu:
9541         {
9542             unsigned cpu, node;
9543             ret = get_errno(sys_getcpu(arg1 ? &cpu : NULL,
9544                                        arg2 ? &node : NULL,
9545                                        NULL));
9546             if (is_error(ret)) {
9547                 return ret;
9548             }
9549             if (arg1 && put_user_u32(cpu, arg1)) {
9550                 return -TARGET_EFAULT;
9551             }
9552             if (arg2 && put_user_u32(node, arg2)) {
9553                 return -TARGET_EFAULT;
9554             }
9555         }
9556         return ret;
9557     case TARGET_NR_sched_setparam:
9558         {
9559             struct sched_param *target_schp;
9560             struct sched_param schp;
9561 
9562             if (arg2 == 0) {
9563                 return -TARGET_EINVAL;
9564             }
9565             if (!lock_user_struct(VERIFY_READ, target_schp, arg2, 1))
9566                 return -TARGET_EFAULT;
9567             schp.sched_priority = tswap32(target_schp->sched_priority);
9568             unlock_user_struct(target_schp, arg2, 0);
9569             return get_errno(sched_setparam(arg1, &schp));
9570         }
9571     case TARGET_NR_sched_getparam:
9572         {
9573             struct sched_param *target_schp;
9574             struct sched_param schp;
9575 
9576             if (arg2 == 0) {
9577                 return -TARGET_EINVAL;
9578             }
9579             ret = get_errno(sched_getparam(arg1, &schp));
9580             if (!is_error(ret)) {
9581                 if (!lock_user_struct(VERIFY_WRITE, target_schp, arg2, 0))
9582                     return -TARGET_EFAULT;
9583                 target_schp->sched_priority = tswap32(schp.sched_priority);
9584                 unlock_user_struct(target_schp, arg2, 1);
9585             }
9586         }
9587         return ret;
9588     case TARGET_NR_sched_setscheduler:
9589         {
9590             struct sched_param *target_schp;
9591             struct sched_param schp;
9592             if (arg3 == 0) {
9593                 return -TARGET_EINVAL;
9594             }
9595             if (!lock_user_struct(VERIFY_READ, target_schp, arg3, 1))
9596                 return -TARGET_EFAULT;
9597             schp.sched_priority = tswap32(target_schp->sched_priority);
9598             unlock_user_struct(target_schp, arg3, 0);
9599             return get_errno(sched_setscheduler(arg1, arg2, &schp));
9600         }
9601     case TARGET_NR_sched_getscheduler:
9602         return get_errno(sched_getscheduler(arg1));
9603     case TARGET_NR_sched_yield:
9604         return get_errno(sched_yield());
9605     case TARGET_NR_sched_get_priority_max:
9606         return get_errno(sched_get_priority_max(arg1));
9607     case TARGET_NR_sched_get_priority_min:
9608         return get_errno(sched_get_priority_min(arg1));
9609     case TARGET_NR_sched_rr_get_interval:
9610         {
9611             struct timespec ts;
9612             ret = get_errno(sched_rr_get_interval(arg1, &ts));
9613             if (!is_error(ret)) {
9614                 ret = host_to_target_timespec(arg2, &ts);
9615             }
9616         }
9617         return ret;
9618     case TARGET_NR_nanosleep:
9619         {
9620             struct timespec req, rem;
9621             target_to_host_timespec(&req, arg1);
9622             ret = get_errno(safe_nanosleep(&req, &rem));
9623             if (is_error(ret) && arg2) {
9624                 host_to_target_timespec(arg2, &rem);
9625             }
9626         }
9627         return ret;
9628     case TARGET_NR_prctl:
9629         switch (arg1) {
9630         case PR_GET_PDEATHSIG:
9631         {
9632             int deathsig;
9633             ret = get_errno(prctl(arg1, &deathsig, arg3, arg4, arg5));
9634             if (!is_error(ret) && arg2
9635                 && put_user_ual(deathsig, arg2)) {
9636                 return -TARGET_EFAULT;
9637             }
9638             return ret;
9639         }
9640 #ifdef PR_GET_NAME
9641         case PR_GET_NAME:
9642         {
9643             void *name = lock_user(VERIFY_WRITE, arg2, 16, 1);
9644             if (!name) {
9645                 return -TARGET_EFAULT;
9646             }
9647             ret = get_errno(prctl(arg1, (unsigned long)name,
9648                                   arg3, arg4, arg5));
9649             unlock_user(name, arg2, 16);
9650             return ret;
9651         }
9652         case PR_SET_NAME:
9653         {
9654             void *name = lock_user(VERIFY_READ, arg2, 16, 1);
9655             if (!name) {
9656                 return -TARGET_EFAULT;
9657             }
9658             ret = get_errno(prctl(arg1, (unsigned long)name,
9659                                   arg3, arg4, arg5));
9660             unlock_user(name, arg2, 0);
9661             return ret;
9662         }
9663 #endif
9664 #ifdef TARGET_MIPS
9665         case TARGET_PR_GET_FP_MODE:
9666         {
9667             CPUMIPSState *env = ((CPUMIPSState *)cpu_env);
9668             ret = 0;
9669             if (env->CP0_Status & (1 << CP0St_FR)) {
9670                 ret |= TARGET_PR_FP_MODE_FR;
9671             }
9672             if (env->CP0_Config5 & (1 << CP0C5_FRE)) {
9673                 ret |= TARGET_PR_FP_MODE_FRE;
9674             }
9675             return ret;
9676         }
9677         case TARGET_PR_SET_FP_MODE:
9678         {
9679             CPUMIPSState *env = ((CPUMIPSState *)cpu_env);
9680             bool old_fr = env->CP0_Status & (1 << CP0St_FR);
9681             bool old_fre = env->CP0_Config5 & (1 << CP0C5_FRE);
9682             bool new_fr = arg2 & TARGET_PR_FP_MODE_FR;
9683             bool new_fre = arg2 & TARGET_PR_FP_MODE_FRE;
9684 
9685             const unsigned int known_bits = TARGET_PR_FP_MODE_FR |
9686                                             TARGET_PR_FP_MODE_FRE;
9687 
9688             /* If nothing to change, return right away, successfully.  */
9689             if (old_fr == new_fr && old_fre == new_fre) {
9690                 return 0;
9691             }
9692             /* Check the value is valid */
9693             if (arg2 & ~known_bits) {
9694                 return -TARGET_EOPNOTSUPP;
9695             }
9696             /* Setting FRE without FR is not supported.  */
9697             if (new_fre && !new_fr) {
9698                 return -TARGET_EOPNOTSUPP;
9699             }
9700             if (new_fr && !(env->active_fpu.fcr0 & (1 << FCR0_F64))) {
9701                 /* FR1 is not supported */
9702                 return -TARGET_EOPNOTSUPP;
9703             }
9704             if (!new_fr && (env->active_fpu.fcr0 & (1 << FCR0_F64))
9705                 && !(env->CP0_Status_rw_bitmask & (1 << CP0St_FR))) {
9706                 /* cannot set FR=0 */
9707                 return -TARGET_EOPNOTSUPP;
9708             }
9709             if (new_fre && !(env->active_fpu.fcr0 & (1 << FCR0_FREP))) {
9710                 /* Cannot set FRE=1 */
9711                 return -TARGET_EOPNOTSUPP;
9712             }
9713 
9714             int i;
9715             fpr_t *fpr = env->active_fpu.fpr;
9716             for (i = 0; i < 32 ; i += 2) {
9717                 if (!old_fr && new_fr) {
9718                     fpr[i].w[!FP_ENDIAN_IDX] = fpr[i + 1].w[FP_ENDIAN_IDX];
9719                 } else if (old_fr && !new_fr) {
9720                     fpr[i + 1].w[FP_ENDIAN_IDX] = fpr[i].w[!FP_ENDIAN_IDX];
9721                 }
9722             }
9723 
9724             if (new_fr) {
9725                 env->CP0_Status |= (1 << CP0St_FR);
9726                 env->hflags |= MIPS_HFLAG_F64;
9727             } else {
9728                 env->CP0_Status &= ~(1 << CP0St_FR);
9729                 env->hflags &= ~MIPS_HFLAG_F64;
9730             }
9731             if (new_fre) {
9732                 env->CP0_Config5 |= (1 << CP0C5_FRE);
9733                 if (env->active_fpu.fcr0 & (1 << FCR0_FREP)) {
9734                     env->hflags |= MIPS_HFLAG_FRE;
9735                 }
9736             } else {
9737                 env->CP0_Config5 &= ~(1 << CP0C5_FRE);
9738                 env->hflags &= ~MIPS_HFLAG_FRE;
9739             }
9740 
9741             return 0;
9742         }
9743 #endif /* MIPS */
9744 #ifdef TARGET_AARCH64
9745         case TARGET_PR_SVE_SET_VL:
9746             /*
9747              * We cannot support either PR_SVE_SET_VL_ONEXEC or
9748              * PR_SVE_VL_INHERIT.  Note the kernel definition
9749              * of sve_vl_valid allows for VQ=512, i.e. VL=8192,
9750              * even though the current architectural maximum is VQ=16.
9751              */
9752             ret = -TARGET_EINVAL;
9753             if (cpu_isar_feature(aa64_sve, arm_env_get_cpu(cpu_env))
9754                 && arg2 >= 0 && arg2 <= 512 * 16 && !(arg2 & 15)) {
9755                 CPUARMState *env = cpu_env;
9756                 ARMCPU *cpu = arm_env_get_cpu(env);
9757                 uint32_t vq, old_vq;
9758 
9759                 old_vq = (env->vfp.zcr_el[1] & 0xf) + 1;
9760                 vq = MAX(arg2 / 16, 1);
9761                 vq = MIN(vq, cpu->sve_max_vq);
9762 
9763                 if (vq < old_vq) {
9764                     aarch64_sve_narrow_vq(env, vq);
9765                 }
9766                 env->vfp.zcr_el[1] = vq - 1;
9767                 ret = vq * 16;
9768             }
9769             return ret;
9770         case TARGET_PR_SVE_GET_VL:
9771             ret = -TARGET_EINVAL;
9772             {
9773                 ARMCPU *cpu = arm_env_get_cpu(cpu_env);
9774                 if (cpu_isar_feature(aa64_sve, cpu)) {
9775                     ret = ((cpu->env.vfp.zcr_el[1] & 0xf) + 1) * 16;
9776                 }
9777             }
9778             return ret;
9779         case TARGET_PR_PAC_RESET_KEYS:
9780             {
9781                 CPUARMState *env = cpu_env;
9782                 ARMCPU *cpu = arm_env_get_cpu(env);
9783 
9784                 if (arg3 || arg4 || arg5) {
9785                     return -TARGET_EINVAL;
9786                 }
9787                 if (cpu_isar_feature(aa64_pauth, cpu)) {
9788                     int all = (TARGET_PR_PAC_APIAKEY | TARGET_PR_PAC_APIBKEY |
9789                                TARGET_PR_PAC_APDAKEY | TARGET_PR_PAC_APDBKEY |
9790                                TARGET_PR_PAC_APGAKEY);
9791                     if (arg2 == 0) {
9792                         arg2 = all;
9793                     } else if (arg2 & ~all) {
9794                         return -TARGET_EINVAL;
9795                     }
9796                     if (arg2 & TARGET_PR_PAC_APIAKEY) {
9797                         arm_init_pauth_key(&env->apia_key);
9798                     }
9799                     if (arg2 & TARGET_PR_PAC_APIBKEY) {
9800                         arm_init_pauth_key(&env->apib_key);
9801                     }
9802                     if (arg2 & TARGET_PR_PAC_APDAKEY) {
9803                         arm_init_pauth_key(&env->apda_key);
9804                     }
9805                     if (arg2 & TARGET_PR_PAC_APDBKEY) {
9806                         arm_init_pauth_key(&env->apdb_key);
9807                     }
9808                     if (arg2 & TARGET_PR_PAC_APGAKEY) {
9809                         arm_init_pauth_key(&env->apga_key);
9810                     }
9811                     return 0;
9812                 }
9813             }
9814             return -TARGET_EINVAL;
9815 #endif /* AARCH64 */
9816         case PR_GET_SECCOMP:
9817         case PR_SET_SECCOMP:
9818             /* Disable seccomp to prevent the target disabling syscalls we
9819              * need. */
9820             return -TARGET_EINVAL;
9821         default:
9822             /* Most prctl options have no pointer arguments */
9823             return get_errno(prctl(arg1, arg2, arg3, arg4, arg5));
9824         }
9825         break;
9826 #ifdef TARGET_NR_arch_prctl
9827     case TARGET_NR_arch_prctl:
9828 #if defined(TARGET_I386) && !defined(TARGET_ABI32)
9829         return do_arch_prctl(cpu_env, arg1, arg2);
9830 #else
9831 #error unreachable
9832 #endif
9833 #endif
9834 #ifdef TARGET_NR_pread64
9835     case TARGET_NR_pread64:
9836         if (regpairs_aligned(cpu_env, num)) {
9837             arg4 = arg5;
9838             arg5 = arg6;
9839         }
9840         if (arg2 == 0 && arg3 == 0) {
9841             /* Special-case NULL buffer and zero length, which should succeed */
9842             p = 0;
9843         } else {
9844             p = lock_user(VERIFY_WRITE, arg2, arg3, 0);
9845             if (!p) {
9846                 return -TARGET_EFAULT;
9847             }
9848         }
9849         ret = get_errno(pread64(arg1, p, arg3, target_offset64(arg4, arg5)));
9850         unlock_user(p, arg2, ret);
9851         return ret;
9852     case TARGET_NR_pwrite64:
9853         if (regpairs_aligned(cpu_env, num)) {
9854             arg4 = arg5;
9855             arg5 = arg6;
9856         }
9857         if (arg2 == 0 && arg3 == 0) {
9858             /* Special-case NULL buffer and zero length, which should succeed */
9859             p = 0;
9860         } else {
9861             p = lock_user(VERIFY_READ, arg2, arg3, 1);
9862             if (!p) {
9863                 return -TARGET_EFAULT;
9864             }
9865         }
9866         ret = get_errno(pwrite64(arg1, p, arg3, target_offset64(arg4, arg5)));
9867         unlock_user(p, arg2, 0);
9868         return ret;
9869 #endif
9870     case TARGET_NR_getcwd:
9871         if (!(p = lock_user(VERIFY_WRITE, arg1, arg2, 0)))
9872             return -TARGET_EFAULT;
9873         ret = get_errno(sys_getcwd1(p, arg2));
9874         unlock_user(p, arg1, ret);
9875         return ret;
9876     case TARGET_NR_capget:
9877     case TARGET_NR_capset:
9878     {
9879         struct target_user_cap_header *target_header;
9880         struct target_user_cap_data *target_data = NULL;
9881         struct __user_cap_header_struct header;
9882         struct __user_cap_data_struct data[2];
9883         struct __user_cap_data_struct *dataptr = NULL;
9884         int i, target_datalen;
9885         int data_items = 1;
9886 
9887         if (!lock_user_struct(VERIFY_WRITE, target_header, arg1, 1)) {
9888             return -TARGET_EFAULT;
9889         }
9890         header.version = tswap32(target_header->version);
9891         header.pid = tswap32(target_header->pid);
9892 
9893         if (header.version != _LINUX_CAPABILITY_VERSION) {
9894             /* Version 2 and up takes pointer to two user_data structs */
9895             data_items = 2;
9896         }
9897 
9898         target_datalen = sizeof(*target_data) * data_items;
9899 
9900         if (arg2) {
9901             if (num == TARGET_NR_capget) {
9902                 target_data = lock_user(VERIFY_WRITE, arg2, target_datalen, 0);
9903             } else {
9904                 target_data = lock_user(VERIFY_READ, arg2, target_datalen, 1);
9905             }
9906             if (!target_data) {
9907                 unlock_user_struct(target_header, arg1, 0);
9908                 return -TARGET_EFAULT;
9909             }
9910 
9911             if (num == TARGET_NR_capset) {
9912                 for (i = 0; i < data_items; i++) {
9913                     data[i].effective = tswap32(target_data[i].effective);
9914                     data[i].permitted = tswap32(target_data[i].permitted);
9915                     data[i].inheritable = tswap32(target_data[i].inheritable);
9916                 }
9917             }
9918 
9919             dataptr = data;
9920         }
9921 
9922         if (num == TARGET_NR_capget) {
9923             ret = get_errno(capget(&header, dataptr));
9924         } else {
9925             ret = get_errno(capset(&header, dataptr));
9926         }
9927 
9928         /* The kernel always updates version for both capget and capset */
9929         target_header->version = tswap32(header.version);
9930         unlock_user_struct(target_header, arg1, 1);
9931 
9932         if (arg2) {
9933             if (num == TARGET_NR_capget) {
9934                 for (i = 0; i < data_items; i++) {
9935                     target_data[i].effective = tswap32(data[i].effective);
9936                     target_data[i].permitted = tswap32(data[i].permitted);
9937                     target_data[i].inheritable = tswap32(data[i].inheritable);
9938                 }
9939                 unlock_user(target_data, arg2, target_datalen);
9940             } else {
9941                 unlock_user(target_data, arg2, 0);
9942             }
9943         }
9944         return ret;
9945     }
9946     case TARGET_NR_sigaltstack:
9947         return do_sigaltstack(arg1, arg2,
9948                               get_sp_from_cpustate((CPUArchState *)cpu_env));
9949 
9950 #ifdef CONFIG_SENDFILE
9951 #ifdef TARGET_NR_sendfile
9952     case TARGET_NR_sendfile:
9953     {
9954         off_t *offp = NULL;
9955         off_t off;
9956         if (arg3) {
9957             ret = get_user_sal(off, arg3);
9958             if (is_error(ret)) {
9959                 return ret;
9960             }
9961             offp = &off;
9962         }
9963         ret = get_errno(sendfile(arg1, arg2, offp, arg4));
9964         if (!is_error(ret) && arg3) {
9965             abi_long ret2 = put_user_sal(off, arg3);
9966             if (is_error(ret2)) {
9967                 ret = ret2;
9968             }
9969         }
9970         return ret;
9971     }
9972 #endif
9973 #ifdef TARGET_NR_sendfile64
9974     case TARGET_NR_sendfile64:
9975     {
9976         off_t *offp = NULL;
9977         off_t off;
9978         if (arg3) {
9979             ret = get_user_s64(off, arg3);
9980             if (is_error(ret)) {
9981                 return ret;
9982             }
9983             offp = &off;
9984         }
9985         ret = get_errno(sendfile(arg1, arg2, offp, arg4));
9986         if (!is_error(ret) && arg3) {
9987             abi_long ret2 = put_user_s64(off, arg3);
9988             if (is_error(ret2)) {
9989                 ret = ret2;
9990             }
9991         }
9992         return ret;
9993     }
9994 #endif
9995 #endif
9996 #ifdef TARGET_NR_vfork
9997     case TARGET_NR_vfork:
9998         return get_errno(do_fork(cpu_env,
9999                          CLONE_VFORK | CLONE_VM | TARGET_SIGCHLD,
10000                          0, 0, 0, 0));
10001 #endif
10002 #ifdef TARGET_NR_ugetrlimit
10003     case TARGET_NR_ugetrlimit:
10004     {
10005 	struct rlimit rlim;
10006 	int resource = target_to_host_resource(arg1);
10007 	ret = get_errno(getrlimit(resource, &rlim));
10008 	if (!is_error(ret)) {
10009 	    struct target_rlimit *target_rlim;
10010             if (!lock_user_struct(VERIFY_WRITE, target_rlim, arg2, 0))
10011                 return -TARGET_EFAULT;
10012 	    target_rlim->rlim_cur = host_to_target_rlim(rlim.rlim_cur);
10013 	    target_rlim->rlim_max = host_to_target_rlim(rlim.rlim_max);
10014             unlock_user_struct(target_rlim, arg2, 1);
10015 	}
10016         return ret;
10017     }
10018 #endif
10019 #ifdef TARGET_NR_truncate64
10020     case TARGET_NR_truncate64:
10021         if (!(p = lock_user_string(arg1)))
10022             return -TARGET_EFAULT;
10023 	ret = target_truncate64(cpu_env, p, arg2, arg3, arg4);
10024         unlock_user(p, arg1, 0);
10025         return ret;
10026 #endif
10027 #ifdef TARGET_NR_ftruncate64
10028     case TARGET_NR_ftruncate64:
10029         return target_ftruncate64(cpu_env, arg1, arg2, arg3, arg4);
10030 #endif
10031 #ifdef TARGET_NR_stat64
10032     case TARGET_NR_stat64:
10033         if (!(p = lock_user_string(arg1))) {
10034             return -TARGET_EFAULT;
10035         }
10036         ret = get_errno(stat(path(p), &st));
10037         unlock_user(p, arg1, 0);
10038         if (!is_error(ret))
10039             ret = host_to_target_stat64(cpu_env, arg2, &st);
10040         return ret;
10041 #endif
10042 #ifdef TARGET_NR_lstat64
10043     case TARGET_NR_lstat64:
10044         if (!(p = lock_user_string(arg1))) {
10045             return -TARGET_EFAULT;
10046         }
10047         ret = get_errno(lstat(path(p), &st));
10048         unlock_user(p, arg1, 0);
10049         if (!is_error(ret))
10050             ret = host_to_target_stat64(cpu_env, arg2, &st);
10051         return ret;
10052 #endif
10053 #ifdef TARGET_NR_fstat64
10054     case TARGET_NR_fstat64:
10055         ret = get_errno(fstat(arg1, &st));
10056         if (!is_error(ret))
10057             ret = host_to_target_stat64(cpu_env, arg2, &st);
10058         return ret;
10059 #endif
10060 #if (defined(TARGET_NR_fstatat64) || defined(TARGET_NR_newfstatat))
10061 #ifdef TARGET_NR_fstatat64
10062     case TARGET_NR_fstatat64:
10063 #endif
10064 #ifdef TARGET_NR_newfstatat
10065     case TARGET_NR_newfstatat:
10066 #endif
10067         if (!(p = lock_user_string(arg2))) {
10068             return -TARGET_EFAULT;
10069         }
10070         ret = get_errno(fstatat(arg1, path(p), &st, arg4));
10071         unlock_user(p, arg2, 0);
10072         if (!is_error(ret))
10073             ret = host_to_target_stat64(cpu_env, arg3, &st);
10074         return ret;
10075 #endif
10076 #ifdef TARGET_NR_lchown
10077     case TARGET_NR_lchown:
10078         if (!(p = lock_user_string(arg1)))
10079             return -TARGET_EFAULT;
10080         ret = get_errno(lchown(p, low2highuid(arg2), low2highgid(arg3)));
10081         unlock_user(p, arg1, 0);
10082         return ret;
10083 #endif
10084 #ifdef TARGET_NR_getuid
10085     case TARGET_NR_getuid:
10086         return get_errno(high2lowuid(getuid()));
10087 #endif
10088 #ifdef TARGET_NR_getgid
10089     case TARGET_NR_getgid:
10090         return get_errno(high2lowgid(getgid()));
10091 #endif
10092 #ifdef TARGET_NR_geteuid
10093     case TARGET_NR_geteuid:
10094         return get_errno(high2lowuid(geteuid()));
10095 #endif
10096 #ifdef TARGET_NR_getegid
10097     case TARGET_NR_getegid:
10098         return get_errno(high2lowgid(getegid()));
10099 #endif
10100     case TARGET_NR_setreuid:
10101         return get_errno(setreuid(low2highuid(arg1), low2highuid(arg2)));
10102     case TARGET_NR_setregid:
10103         return get_errno(setregid(low2highgid(arg1), low2highgid(arg2)));
10104     case TARGET_NR_getgroups:
10105         {
10106             int gidsetsize = arg1;
10107             target_id *target_grouplist;
10108             gid_t *grouplist;
10109             int i;
10110 
10111             grouplist = alloca(gidsetsize * sizeof(gid_t));
10112             ret = get_errno(getgroups(gidsetsize, grouplist));
10113             if (gidsetsize == 0)
10114                 return ret;
10115             if (!is_error(ret)) {
10116                 target_grouplist = lock_user(VERIFY_WRITE, arg2, gidsetsize * sizeof(target_id), 0);
10117                 if (!target_grouplist)
10118                     return -TARGET_EFAULT;
10119                 for(i = 0;i < ret; i++)
10120                     target_grouplist[i] = tswapid(high2lowgid(grouplist[i]));
10121                 unlock_user(target_grouplist, arg2, gidsetsize * sizeof(target_id));
10122             }
10123         }
10124         return ret;
10125     case TARGET_NR_setgroups:
10126         {
10127             int gidsetsize = arg1;
10128             target_id *target_grouplist;
10129             gid_t *grouplist = NULL;
10130             int i;
10131             if (gidsetsize) {
10132                 grouplist = alloca(gidsetsize * sizeof(gid_t));
10133                 target_grouplist = lock_user(VERIFY_READ, arg2, gidsetsize * sizeof(target_id), 1);
10134                 if (!target_grouplist) {
10135                     return -TARGET_EFAULT;
10136                 }
10137                 for (i = 0; i < gidsetsize; i++) {
10138                     grouplist[i] = low2highgid(tswapid(target_grouplist[i]));
10139                 }
10140                 unlock_user(target_grouplist, arg2, 0);
10141             }
10142             return get_errno(setgroups(gidsetsize, grouplist));
10143         }
10144     case TARGET_NR_fchown:
10145         return get_errno(fchown(arg1, low2highuid(arg2), low2highgid(arg3)));
10146 #if defined(TARGET_NR_fchownat)
10147     case TARGET_NR_fchownat:
10148         if (!(p = lock_user_string(arg2)))
10149             return -TARGET_EFAULT;
10150         ret = get_errno(fchownat(arg1, p, low2highuid(arg3),
10151                                  low2highgid(arg4), arg5));
10152         unlock_user(p, arg2, 0);
10153         return ret;
10154 #endif
10155 #ifdef TARGET_NR_setresuid
10156     case TARGET_NR_setresuid:
10157         return get_errno(sys_setresuid(low2highuid(arg1),
10158                                        low2highuid(arg2),
10159                                        low2highuid(arg3)));
10160 #endif
10161 #ifdef TARGET_NR_getresuid
10162     case TARGET_NR_getresuid:
10163         {
10164             uid_t ruid, euid, suid;
10165             ret = get_errno(getresuid(&ruid, &euid, &suid));
10166             if (!is_error(ret)) {
10167                 if (put_user_id(high2lowuid(ruid), arg1)
10168                     || put_user_id(high2lowuid(euid), arg2)
10169                     || put_user_id(high2lowuid(suid), arg3))
10170                     return -TARGET_EFAULT;
10171             }
10172         }
10173         return ret;
10174 #endif
10175 #ifdef TARGET_NR_getresgid
10176     case TARGET_NR_setresgid:
10177         return get_errno(sys_setresgid(low2highgid(arg1),
10178                                        low2highgid(arg2),
10179                                        low2highgid(arg3)));
10180 #endif
10181 #ifdef TARGET_NR_getresgid
10182     case TARGET_NR_getresgid:
10183         {
10184             gid_t rgid, egid, sgid;
10185             ret = get_errno(getresgid(&rgid, &egid, &sgid));
10186             if (!is_error(ret)) {
10187                 if (put_user_id(high2lowgid(rgid), arg1)
10188                     || put_user_id(high2lowgid(egid), arg2)
10189                     || put_user_id(high2lowgid(sgid), arg3))
10190                     return -TARGET_EFAULT;
10191             }
10192         }
10193         return ret;
10194 #endif
10195 #ifdef TARGET_NR_chown
10196     case TARGET_NR_chown:
10197         if (!(p = lock_user_string(arg1)))
10198             return -TARGET_EFAULT;
10199         ret = get_errno(chown(p, low2highuid(arg2), low2highgid(arg3)));
10200         unlock_user(p, arg1, 0);
10201         return ret;
10202 #endif
10203     case TARGET_NR_setuid:
10204         return get_errno(sys_setuid(low2highuid(arg1)));
10205     case TARGET_NR_setgid:
10206         return get_errno(sys_setgid(low2highgid(arg1)));
10207     case TARGET_NR_setfsuid:
10208         return get_errno(setfsuid(arg1));
10209     case TARGET_NR_setfsgid:
10210         return get_errno(setfsgid(arg1));
10211 
10212 #ifdef TARGET_NR_lchown32
10213     case TARGET_NR_lchown32:
10214         if (!(p = lock_user_string(arg1)))
10215             return -TARGET_EFAULT;
10216         ret = get_errno(lchown(p, arg2, arg3));
10217         unlock_user(p, arg1, 0);
10218         return ret;
10219 #endif
10220 #ifdef TARGET_NR_getuid32
10221     case TARGET_NR_getuid32:
10222         return get_errno(getuid());
10223 #endif
10224 
10225 #if defined(TARGET_NR_getxuid) && defined(TARGET_ALPHA)
10226    /* Alpha specific */
10227     case TARGET_NR_getxuid:
10228          {
10229             uid_t euid;
10230             euid=geteuid();
10231             ((CPUAlphaState *)cpu_env)->ir[IR_A4]=euid;
10232          }
10233         return get_errno(getuid());
10234 #endif
10235 #if defined(TARGET_NR_getxgid) && defined(TARGET_ALPHA)
10236    /* Alpha specific */
10237     case TARGET_NR_getxgid:
10238          {
10239             uid_t egid;
10240             egid=getegid();
10241             ((CPUAlphaState *)cpu_env)->ir[IR_A4]=egid;
10242          }
10243         return get_errno(getgid());
10244 #endif
10245 #if defined(TARGET_NR_osf_getsysinfo) && defined(TARGET_ALPHA)
10246     /* Alpha specific */
10247     case TARGET_NR_osf_getsysinfo:
10248         ret = -TARGET_EOPNOTSUPP;
10249         switch (arg1) {
10250           case TARGET_GSI_IEEE_FP_CONTROL:
10251             {
10252                 uint64_t fpcr = cpu_alpha_load_fpcr(cpu_env);
10253                 uint64_t swcr = ((CPUAlphaState *)cpu_env)->swcr;
10254 
10255                 swcr &= ~SWCR_STATUS_MASK;
10256                 swcr |= (fpcr >> 35) & SWCR_STATUS_MASK;
10257 
10258                 if (put_user_u64 (swcr, arg2))
10259                         return -TARGET_EFAULT;
10260                 ret = 0;
10261             }
10262             break;
10263 
10264           /* case GSI_IEEE_STATE_AT_SIGNAL:
10265              -- Not implemented in linux kernel.
10266              case GSI_UACPROC:
10267              -- Retrieves current unaligned access state; not much used.
10268              case GSI_PROC_TYPE:
10269              -- Retrieves implver information; surely not used.
10270              case GSI_GET_HWRPB:
10271              -- Grabs a copy of the HWRPB; surely not used.
10272           */
10273         }
10274         return ret;
10275 #endif
10276 #if defined(TARGET_NR_osf_setsysinfo) && defined(TARGET_ALPHA)
10277     /* Alpha specific */
10278     case TARGET_NR_osf_setsysinfo:
10279         ret = -TARGET_EOPNOTSUPP;
10280         switch (arg1) {
10281           case TARGET_SSI_IEEE_FP_CONTROL:
10282             {
10283                 uint64_t swcr, fpcr;
10284 
10285                 if (get_user_u64 (swcr, arg2)) {
10286                     return -TARGET_EFAULT;
10287                 }
10288 
10289                 /*
10290                  * The kernel calls swcr_update_status to update the
10291                  * status bits from the fpcr at every point that it
10292                  * could be queried.  Therefore, we store the status
10293                  * bits only in FPCR.
10294                  */
10295                 ((CPUAlphaState *)cpu_env)->swcr
10296                     = swcr & (SWCR_TRAP_ENABLE_MASK | SWCR_MAP_MASK);
10297 
10298                 fpcr = cpu_alpha_load_fpcr(cpu_env);
10299                 fpcr &= ((uint64_t)FPCR_DYN_MASK << 32);
10300                 fpcr |= alpha_ieee_swcr_to_fpcr(swcr);
10301                 cpu_alpha_store_fpcr(cpu_env, fpcr);
10302                 ret = 0;
10303             }
10304             break;
10305 
10306           case TARGET_SSI_IEEE_RAISE_EXCEPTION:
10307             {
10308                 uint64_t exc, fpcr, fex;
10309 
10310                 if (get_user_u64(exc, arg2)) {
10311                     return -TARGET_EFAULT;
10312                 }
10313                 exc &= SWCR_STATUS_MASK;
10314                 fpcr = cpu_alpha_load_fpcr(cpu_env);
10315 
10316                 /* Old exceptions are not signaled.  */
10317                 fex = alpha_ieee_fpcr_to_swcr(fpcr);
10318                 fex = exc & ~fex;
10319                 fex >>= SWCR_STATUS_TO_EXCSUM_SHIFT;
10320                 fex &= ((CPUArchState *)cpu_env)->swcr;
10321 
10322                 /* Update the hardware fpcr.  */
10323                 fpcr |= alpha_ieee_swcr_to_fpcr(exc);
10324                 cpu_alpha_store_fpcr(cpu_env, fpcr);
10325 
10326                 if (fex) {
10327                     int si_code = TARGET_FPE_FLTUNK;
10328                     target_siginfo_t info;
10329 
10330                     if (fex & SWCR_TRAP_ENABLE_DNO) {
10331                         si_code = TARGET_FPE_FLTUND;
10332                     }
10333                     if (fex & SWCR_TRAP_ENABLE_INE) {
10334                         si_code = TARGET_FPE_FLTRES;
10335                     }
10336                     if (fex & SWCR_TRAP_ENABLE_UNF) {
10337                         si_code = TARGET_FPE_FLTUND;
10338                     }
10339                     if (fex & SWCR_TRAP_ENABLE_OVF) {
10340                         si_code = TARGET_FPE_FLTOVF;
10341                     }
10342                     if (fex & SWCR_TRAP_ENABLE_DZE) {
10343                         si_code = TARGET_FPE_FLTDIV;
10344                     }
10345                     if (fex & SWCR_TRAP_ENABLE_INV) {
10346                         si_code = TARGET_FPE_FLTINV;
10347                     }
10348 
10349                     info.si_signo = SIGFPE;
10350                     info.si_errno = 0;
10351                     info.si_code = si_code;
10352                     info._sifields._sigfault._addr
10353                         = ((CPUArchState *)cpu_env)->pc;
10354                     queue_signal((CPUArchState *)cpu_env, info.si_signo,
10355                                  QEMU_SI_FAULT, &info);
10356                 }
10357                 ret = 0;
10358             }
10359             break;
10360 
10361           /* case SSI_NVPAIRS:
10362              -- Used with SSIN_UACPROC to enable unaligned accesses.
10363              case SSI_IEEE_STATE_AT_SIGNAL:
10364              case SSI_IEEE_IGNORE_STATE_AT_SIGNAL:
10365              -- Not implemented in linux kernel
10366           */
10367         }
10368         return ret;
10369 #endif
10370 #ifdef TARGET_NR_osf_sigprocmask
10371     /* Alpha specific.  */
10372     case TARGET_NR_osf_sigprocmask:
10373         {
10374             abi_ulong mask;
10375             int how;
10376             sigset_t set, oldset;
10377 
10378             switch(arg1) {
10379             case TARGET_SIG_BLOCK:
10380                 how = SIG_BLOCK;
10381                 break;
10382             case TARGET_SIG_UNBLOCK:
10383                 how = SIG_UNBLOCK;
10384                 break;
10385             case TARGET_SIG_SETMASK:
10386                 how = SIG_SETMASK;
10387                 break;
10388             default:
10389                 return -TARGET_EINVAL;
10390             }
10391             mask = arg2;
10392             target_to_host_old_sigset(&set, &mask);
10393             ret = do_sigprocmask(how, &set, &oldset);
10394             if (!ret) {
10395                 host_to_target_old_sigset(&mask, &oldset);
10396                 ret = mask;
10397             }
10398         }
10399         return ret;
10400 #endif
10401 
10402 #ifdef TARGET_NR_getgid32
10403     case TARGET_NR_getgid32:
10404         return get_errno(getgid());
10405 #endif
10406 #ifdef TARGET_NR_geteuid32
10407     case TARGET_NR_geteuid32:
10408         return get_errno(geteuid());
10409 #endif
10410 #ifdef TARGET_NR_getegid32
10411     case TARGET_NR_getegid32:
10412         return get_errno(getegid());
10413 #endif
10414 #ifdef TARGET_NR_setreuid32
10415     case TARGET_NR_setreuid32:
10416         return get_errno(setreuid(arg1, arg2));
10417 #endif
10418 #ifdef TARGET_NR_setregid32
10419     case TARGET_NR_setregid32:
10420         return get_errno(setregid(arg1, arg2));
10421 #endif
10422 #ifdef TARGET_NR_getgroups32
10423     case TARGET_NR_getgroups32:
10424         {
10425             int gidsetsize = arg1;
10426             uint32_t *target_grouplist;
10427             gid_t *grouplist;
10428             int i;
10429 
10430             grouplist = alloca(gidsetsize * sizeof(gid_t));
10431             ret = get_errno(getgroups(gidsetsize, grouplist));
10432             if (gidsetsize == 0)
10433                 return ret;
10434             if (!is_error(ret)) {
10435                 target_grouplist = lock_user(VERIFY_WRITE, arg2, gidsetsize * 4, 0);
10436                 if (!target_grouplist) {
10437                     return -TARGET_EFAULT;
10438                 }
10439                 for(i = 0;i < ret; i++)
10440                     target_grouplist[i] = tswap32(grouplist[i]);
10441                 unlock_user(target_grouplist, arg2, gidsetsize * 4);
10442             }
10443         }
10444         return ret;
10445 #endif
10446 #ifdef TARGET_NR_setgroups32
10447     case TARGET_NR_setgroups32:
10448         {
10449             int gidsetsize = arg1;
10450             uint32_t *target_grouplist;
10451             gid_t *grouplist;
10452             int i;
10453 
10454             grouplist = alloca(gidsetsize * sizeof(gid_t));
10455             target_grouplist = lock_user(VERIFY_READ, arg2, gidsetsize * 4, 1);
10456             if (!target_grouplist) {
10457                 return -TARGET_EFAULT;
10458             }
10459             for(i = 0;i < gidsetsize; i++)
10460                 grouplist[i] = tswap32(target_grouplist[i]);
10461             unlock_user(target_grouplist, arg2, 0);
10462             return get_errno(setgroups(gidsetsize, grouplist));
10463         }
10464 #endif
10465 #ifdef TARGET_NR_fchown32
10466     case TARGET_NR_fchown32:
10467         return get_errno(fchown(arg1, arg2, arg3));
10468 #endif
10469 #ifdef TARGET_NR_setresuid32
10470     case TARGET_NR_setresuid32:
10471         return get_errno(sys_setresuid(arg1, arg2, arg3));
10472 #endif
10473 #ifdef TARGET_NR_getresuid32
10474     case TARGET_NR_getresuid32:
10475         {
10476             uid_t ruid, euid, suid;
10477             ret = get_errno(getresuid(&ruid, &euid, &suid));
10478             if (!is_error(ret)) {
10479                 if (put_user_u32(ruid, arg1)
10480                     || put_user_u32(euid, arg2)
10481                     || put_user_u32(suid, arg3))
10482                     return -TARGET_EFAULT;
10483             }
10484         }
10485         return ret;
10486 #endif
10487 #ifdef TARGET_NR_setresgid32
10488     case TARGET_NR_setresgid32:
10489         return get_errno(sys_setresgid(arg1, arg2, arg3));
10490 #endif
10491 #ifdef TARGET_NR_getresgid32
10492     case TARGET_NR_getresgid32:
10493         {
10494             gid_t rgid, egid, sgid;
10495             ret = get_errno(getresgid(&rgid, &egid, &sgid));
10496             if (!is_error(ret)) {
10497                 if (put_user_u32(rgid, arg1)
10498                     || put_user_u32(egid, arg2)
10499                     || put_user_u32(sgid, arg3))
10500                     return -TARGET_EFAULT;
10501             }
10502         }
10503         return ret;
10504 #endif
10505 #ifdef TARGET_NR_chown32
10506     case TARGET_NR_chown32:
10507         if (!(p = lock_user_string(arg1)))
10508             return -TARGET_EFAULT;
10509         ret = get_errno(chown(p, arg2, arg3));
10510         unlock_user(p, arg1, 0);
10511         return ret;
10512 #endif
10513 #ifdef TARGET_NR_setuid32
10514     case TARGET_NR_setuid32:
10515         return get_errno(sys_setuid(arg1));
10516 #endif
10517 #ifdef TARGET_NR_setgid32
10518     case TARGET_NR_setgid32:
10519         return get_errno(sys_setgid(arg1));
10520 #endif
10521 #ifdef TARGET_NR_setfsuid32
10522     case TARGET_NR_setfsuid32:
10523         return get_errno(setfsuid(arg1));
10524 #endif
10525 #ifdef TARGET_NR_setfsgid32
10526     case TARGET_NR_setfsgid32:
10527         return get_errno(setfsgid(arg1));
10528 #endif
10529 #ifdef TARGET_NR_mincore
10530     case TARGET_NR_mincore:
10531         {
10532             void *a = lock_user(VERIFY_READ, arg1, arg2, 0);
10533             if (!a) {
10534                 return -TARGET_ENOMEM;
10535             }
10536             p = lock_user_string(arg3);
10537             if (!p) {
10538                 ret = -TARGET_EFAULT;
10539             } else {
10540                 ret = get_errno(mincore(a, arg2, p));
10541                 unlock_user(p, arg3, ret);
10542             }
10543             unlock_user(a, arg1, 0);
10544         }
10545         return ret;
10546 #endif
10547 #ifdef TARGET_NR_arm_fadvise64_64
10548     case TARGET_NR_arm_fadvise64_64:
10549         /* arm_fadvise64_64 looks like fadvise64_64 but
10550          * with different argument order: fd, advice, offset, len
10551          * rather than the usual fd, offset, len, advice.
10552          * Note that offset and len are both 64-bit so appear as
10553          * pairs of 32-bit registers.
10554          */
10555         ret = posix_fadvise(arg1, target_offset64(arg3, arg4),
10556                             target_offset64(arg5, arg6), arg2);
10557         return -host_to_target_errno(ret);
10558 #endif
10559 
10560 #if TARGET_ABI_BITS == 32
10561 
10562 #ifdef TARGET_NR_fadvise64_64
10563     case TARGET_NR_fadvise64_64:
10564 #if defined(TARGET_PPC) || defined(TARGET_XTENSA)
10565         /* 6 args: fd, advice, offset (high, low), len (high, low) */
10566         ret = arg2;
10567         arg2 = arg3;
10568         arg3 = arg4;
10569         arg4 = arg5;
10570         arg5 = arg6;
10571         arg6 = ret;
10572 #else
10573         /* 6 args: fd, offset (high, low), len (high, low), advice */
10574         if (regpairs_aligned(cpu_env, num)) {
10575             /* offset is in (3,4), len in (5,6) and advice in 7 */
10576             arg2 = arg3;
10577             arg3 = arg4;
10578             arg4 = arg5;
10579             arg5 = arg6;
10580             arg6 = arg7;
10581         }
10582 #endif
10583         ret = posix_fadvise(arg1, target_offset64(arg2, arg3),
10584                             target_offset64(arg4, arg5), arg6);
10585         return -host_to_target_errno(ret);
10586 #endif
10587 
10588 #ifdef TARGET_NR_fadvise64
10589     case TARGET_NR_fadvise64:
10590         /* 5 args: fd, offset (high, low), len, advice */
10591         if (regpairs_aligned(cpu_env, num)) {
10592             /* offset is in (3,4), len in 5 and advice in 6 */
10593             arg2 = arg3;
10594             arg3 = arg4;
10595             arg4 = arg5;
10596             arg5 = arg6;
10597         }
10598         ret = posix_fadvise(arg1, target_offset64(arg2, arg3), arg4, arg5);
10599         return -host_to_target_errno(ret);
10600 #endif
10601 
10602 #else /* not a 32-bit ABI */
10603 #if defined(TARGET_NR_fadvise64_64) || defined(TARGET_NR_fadvise64)
10604 #ifdef TARGET_NR_fadvise64_64
10605     case TARGET_NR_fadvise64_64:
10606 #endif
10607 #ifdef TARGET_NR_fadvise64
10608     case TARGET_NR_fadvise64:
10609 #endif
10610 #ifdef TARGET_S390X
10611         switch (arg4) {
10612         case 4: arg4 = POSIX_FADV_NOREUSE + 1; break; /* make sure it's an invalid value */
10613         case 5: arg4 = POSIX_FADV_NOREUSE + 2; break; /* ditto */
10614         case 6: arg4 = POSIX_FADV_DONTNEED; break;
10615         case 7: arg4 = POSIX_FADV_NOREUSE; break;
10616         default: break;
10617         }
10618 #endif
10619         return -host_to_target_errno(posix_fadvise(arg1, arg2, arg3, arg4));
10620 #endif
10621 #endif /* end of 64-bit ABI fadvise handling */
10622 
10623 #ifdef TARGET_NR_madvise
10624     case TARGET_NR_madvise:
10625         /* A straight passthrough may not be safe because qemu sometimes
10626            turns private file-backed mappings into anonymous mappings.
10627            This will break MADV_DONTNEED.
10628            This is a hint, so ignoring and returning success is ok.  */
10629         return 0;
10630 #endif
10631 #if TARGET_ABI_BITS == 32
10632     case TARGET_NR_fcntl64:
10633     {
10634 	int cmd;
10635 	struct flock64 fl;
10636         from_flock64_fn *copyfrom = copy_from_user_flock64;
10637         to_flock64_fn *copyto = copy_to_user_flock64;
10638 
10639 #ifdef TARGET_ARM
10640         if (!((CPUARMState *)cpu_env)->eabi) {
10641             copyfrom = copy_from_user_oabi_flock64;
10642             copyto = copy_to_user_oabi_flock64;
10643         }
10644 #endif
10645 
10646 	cmd = target_to_host_fcntl_cmd(arg2);
10647         if (cmd == -TARGET_EINVAL) {
10648             return cmd;
10649         }
10650 
10651         switch(arg2) {
10652         case TARGET_F_GETLK64:
10653             ret = copyfrom(&fl, arg3);
10654             if (ret) {
10655                 break;
10656             }
10657             ret = get_errno(safe_fcntl(arg1, cmd, &fl));
10658             if (ret == 0) {
10659                 ret = copyto(arg3, &fl);
10660             }
10661 	    break;
10662 
10663         case TARGET_F_SETLK64:
10664         case TARGET_F_SETLKW64:
10665             ret = copyfrom(&fl, arg3);
10666             if (ret) {
10667                 break;
10668             }
10669             ret = get_errno(safe_fcntl(arg1, cmd, &fl));
10670 	    break;
10671         default:
10672             ret = do_fcntl(arg1, arg2, arg3);
10673             break;
10674         }
10675         return ret;
10676     }
10677 #endif
10678 #ifdef TARGET_NR_cacheflush
10679     case TARGET_NR_cacheflush:
10680         /* self-modifying code is handled automatically, so nothing needed */
10681         return 0;
10682 #endif
10683 #ifdef TARGET_NR_getpagesize
10684     case TARGET_NR_getpagesize:
10685         return TARGET_PAGE_SIZE;
10686 #endif
10687     case TARGET_NR_gettid:
10688         return get_errno(sys_gettid());
10689 #ifdef TARGET_NR_readahead
10690     case TARGET_NR_readahead:
10691 #if TARGET_ABI_BITS == 32
10692         if (regpairs_aligned(cpu_env, num)) {
10693             arg2 = arg3;
10694             arg3 = arg4;
10695             arg4 = arg5;
10696         }
10697         ret = get_errno(readahead(arg1, target_offset64(arg2, arg3) , arg4));
10698 #else
10699         ret = get_errno(readahead(arg1, arg2, arg3));
10700 #endif
10701         return ret;
10702 #endif
10703 #ifdef CONFIG_ATTR
10704 #ifdef TARGET_NR_setxattr
10705     case TARGET_NR_listxattr:
10706     case TARGET_NR_llistxattr:
10707     {
10708         void *p, *b = 0;
10709         if (arg2) {
10710             b = lock_user(VERIFY_WRITE, arg2, arg3, 0);
10711             if (!b) {
10712                 return -TARGET_EFAULT;
10713             }
10714         }
10715         p = lock_user_string(arg1);
10716         if (p) {
10717             if (num == TARGET_NR_listxattr) {
10718                 ret = get_errno(listxattr(p, b, arg3));
10719             } else {
10720                 ret = get_errno(llistxattr(p, b, arg3));
10721             }
10722         } else {
10723             ret = -TARGET_EFAULT;
10724         }
10725         unlock_user(p, arg1, 0);
10726         unlock_user(b, arg2, arg3);
10727         return ret;
10728     }
10729     case TARGET_NR_flistxattr:
10730     {
10731         void *b = 0;
10732         if (arg2) {
10733             b = lock_user(VERIFY_WRITE, arg2, arg3, 0);
10734             if (!b) {
10735                 return -TARGET_EFAULT;
10736             }
10737         }
10738         ret = get_errno(flistxattr(arg1, b, arg3));
10739         unlock_user(b, arg2, arg3);
10740         return ret;
10741     }
10742     case TARGET_NR_setxattr:
10743     case TARGET_NR_lsetxattr:
10744         {
10745             void *p, *n, *v = 0;
10746             if (arg3) {
10747                 v = lock_user(VERIFY_READ, arg3, arg4, 1);
10748                 if (!v) {
10749                     return -TARGET_EFAULT;
10750                 }
10751             }
10752             p = lock_user_string(arg1);
10753             n = lock_user_string(arg2);
10754             if (p && n) {
10755                 if (num == TARGET_NR_setxattr) {
10756                     ret = get_errno(setxattr(p, n, v, arg4, arg5));
10757                 } else {
10758                     ret = get_errno(lsetxattr(p, n, v, arg4, arg5));
10759                 }
10760             } else {
10761                 ret = -TARGET_EFAULT;
10762             }
10763             unlock_user(p, arg1, 0);
10764             unlock_user(n, arg2, 0);
10765             unlock_user(v, arg3, 0);
10766         }
10767         return ret;
10768     case TARGET_NR_fsetxattr:
10769         {
10770             void *n, *v = 0;
10771             if (arg3) {
10772                 v = lock_user(VERIFY_READ, arg3, arg4, 1);
10773                 if (!v) {
10774                     return -TARGET_EFAULT;
10775                 }
10776             }
10777             n = lock_user_string(arg2);
10778             if (n) {
10779                 ret = get_errno(fsetxattr(arg1, n, v, arg4, arg5));
10780             } else {
10781                 ret = -TARGET_EFAULT;
10782             }
10783             unlock_user(n, arg2, 0);
10784             unlock_user(v, arg3, 0);
10785         }
10786         return ret;
10787     case TARGET_NR_getxattr:
10788     case TARGET_NR_lgetxattr:
10789         {
10790             void *p, *n, *v = 0;
10791             if (arg3) {
10792                 v = lock_user(VERIFY_WRITE, arg3, arg4, 0);
10793                 if (!v) {
10794                     return -TARGET_EFAULT;
10795                 }
10796             }
10797             p = lock_user_string(arg1);
10798             n = lock_user_string(arg2);
10799             if (p && n) {
10800                 if (num == TARGET_NR_getxattr) {
10801                     ret = get_errno(getxattr(p, n, v, arg4));
10802                 } else {
10803                     ret = get_errno(lgetxattr(p, n, v, arg4));
10804                 }
10805             } else {
10806                 ret = -TARGET_EFAULT;
10807             }
10808             unlock_user(p, arg1, 0);
10809             unlock_user(n, arg2, 0);
10810             unlock_user(v, arg3, arg4);
10811         }
10812         return ret;
10813     case TARGET_NR_fgetxattr:
10814         {
10815             void *n, *v = 0;
10816             if (arg3) {
10817                 v = lock_user(VERIFY_WRITE, arg3, arg4, 0);
10818                 if (!v) {
10819                     return -TARGET_EFAULT;
10820                 }
10821             }
10822             n = lock_user_string(arg2);
10823             if (n) {
10824                 ret = get_errno(fgetxattr(arg1, n, v, arg4));
10825             } else {
10826                 ret = -TARGET_EFAULT;
10827             }
10828             unlock_user(n, arg2, 0);
10829             unlock_user(v, arg3, arg4);
10830         }
10831         return ret;
10832     case TARGET_NR_removexattr:
10833     case TARGET_NR_lremovexattr:
10834         {
10835             void *p, *n;
10836             p = lock_user_string(arg1);
10837             n = lock_user_string(arg2);
10838             if (p && n) {
10839                 if (num == TARGET_NR_removexattr) {
10840                     ret = get_errno(removexattr(p, n));
10841                 } else {
10842                     ret = get_errno(lremovexattr(p, n));
10843                 }
10844             } else {
10845                 ret = -TARGET_EFAULT;
10846             }
10847             unlock_user(p, arg1, 0);
10848             unlock_user(n, arg2, 0);
10849         }
10850         return ret;
10851     case TARGET_NR_fremovexattr:
10852         {
10853             void *n;
10854             n = lock_user_string(arg2);
10855             if (n) {
10856                 ret = get_errno(fremovexattr(arg1, n));
10857             } else {
10858                 ret = -TARGET_EFAULT;
10859             }
10860             unlock_user(n, arg2, 0);
10861         }
10862         return ret;
10863 #endif
10864 #endif /* CONFIG_ATTR */
10865 #ifdef TARGET_NR_set_thread_area
10866     case TARGET_NR_set_thread_area:
10867 #if defined(TARGET_MIPS)
10868       ((CPUMIPSState *) cpu_env)->active_tc.CP0_UserLocal = arg1;
10869       return 0;
10870 #elif defined(TARGET_CRIS)
10871       if (arg1 & 0xff)
10872           ret = -TARGET_EINVAL;
10873       else {
10874           ((CPUCRISState *) cpu_env)->pregs[PR_PID] = arg1;
10875           ret = 0;
10876       }
10877       return ret;
10878 #elif defined(TARGET_I386) && defined(TARGET_ABI32)
10879       return do_set_thread_area(cpu_env, arg1);
10880 #elif defined(TARGET_M68K)
10881       {
10882           TaskState *ts = cpu->opaque;
10883           ts->tp_value = arg1;
10884           return 0;
10885       }
10886 #else
10887       return -TARGET_ENOSYS;
10888 #endif
10889 #endif
10890 #ifdef TARGET_NR_get_thread_area
10891     case TARGET_NR_get_thread_area:
10892 #if defined(TARGET_I386) && defined(TARGET_ABI32)
10893         return do_get_thread_area(cpu_env, arg1);
10894 #elif defined(TARGET_M68K)
10895         {
10896             TaskState *ts = cpu->opaque;
10897             return ts->tp_value;
10898         }
10899 #else
10900         return -TARGET_ENOSYS;
10901 #endif
10902 #endif
10903 #ifdef TARGET_NR_getdomainname
10904     case TARGET_NR_getdomainname:
10905         return -TARGET_ENOSYS;
10906 #endif
10907 
10908 #ifdef TARGET_NR_clock_settime
10909     case TARGET_NR_clock_settime:
10910     {
10911         struct timespec ts;
10912 
10913         ret = target_to_host_timespec(&ts, arg2);
10914         if (!is_error(ret)) {
10915             ret = get_errno(clock_settime(arg1, &ts));
10916         }
10917         return ret;
10918     }
10919 #endif
10920 #ifdef TARGET_NR_clock_gettime
10921     case TARGET_NR_clock_gettime:
10922     {
10923         struct timespec ts;
10924         ret = get_errno(clock_gettime(arg1, &ts));
10925         if (!is_error(ret)) {
10926             ret = host_to_target_timespec(arg2, &ts);
10927         }
10928         return ret;
10929     }
10930 #endif
10931 #ifdef TARGET_NR_clock_getres
10932     case TARGET_NR_clock_getres:
10933     {
10934         struct timespec ts;
10935         ret = get_errno(clock_getres(arg1, &ts));
10936         if (!is_error(ret)) {
10937             host_to_target_timespec(arg2, &ts);
10938         }
10939         return ret;
10940     }
10941 #endif
10942 #ifdef TARGET_NR_clock_nanosleep
10943     case TARGET_NR_clock_nanosleep:
10944     {
10945         struct timespec ts;
10946         target_to_host_timespec(&ts, arg3);
10947         ret = get_errno(safe_clock_nanosleep(arg1, arg2,
10948                                              &ts, arg4 ? &ts : NULL));
10949         if (arg4)
10950             host_to_target_timespec(arg4, &ts);
10951 
10952 #if defined(TARGET_PPC)
10953         /* clock_nanosleep is odd in that it returns positive errno values.
10954          * On PPC, CR0 bit 3 should be set in such a situation. */
10955         if (ret && ret != -TARGET_ERESTARTSYS) {
10956             ((CPUPPCState *)cpu_env)->crf[0] |= 1;
10957         }
10958 #endif
10959         return ret;
10960     }
10961 #endif
10962 
10963 #if defined(TARGET_NR_set_tid_address) && defined(__NR_set_tid_address)
10964     case TARGET_NR_set_tid_address:
10965         return get_errno(set_tid_address((int *)g2h(arg1)));
10966 #endif
10967 
10968     case TARGET_NR_tkill:
10969         return get_errno(safe_tkill((int)arg1, target_to_host_signal(arg2)));
10970 
10971     case TARGET_NR_tgkill:
10972         return get_errno(safe_tgkill((int)arg1, (int)arg2,
10973                          target_to_host_signal(arg3)));
10974 
10975 #ifdef TARGET_NR_set_robust_list
10976     case TARGET_NR_set_robust_list:
10977     case TARGET_NR_get_robust_list:
10978         /* The ABI for supporting robust futexes has userspace pass
10979          * the kernel a pointer to a linked list which is updated by
10980          * userspace after the syscall; the list is walked by the kernel
10981          * when the thread exits. Since the linked list in QEMU guest
10982          * memory isn't a valid linked list for the host and we have
10983          * no way to reliably intercept the thread-death event, we can't
10984          * support these. Silently return ENOSYS so that guest userspace
10985          * falls back to a non-robust futex implementation (which should
10986          * be OK except in the corner case of the guest crashing while
10987          * holding a mutex that is shared with another process via
10988          * shared memory).
10989          */
10990         return -TARGET_ENOSYS;
10991 #endif
10992 
10993 #if defined(TARGET_NR_utimensat)
10994     case TARGET_NR_utimensat:
10995         {
10996             struct timespec *tsp, ts[2];
10997             if (!arg3) {
10998                 tsp = NULL;
10999             } else {
11000                 target_to_host_timespec(ts, arg3);
11001                 target_to_host_timespec(ts+1, arg3+sizeof(struct target_timespec));
11002                 tsp = ts;
11003             }
11004             if (!arg2)
11005                 ret = get_errno(sys_utimensat(arg1, NULL, tsp, arg4));
11006             else {
11007                 if (!(p = lock_user_string(arg2))) {
11008                     return -TARGET_EFAULT;
11009                 }
11010                 ret = get_errno(sys_utimensat(arg1, path(p), tsp, arg4));
11011                 unlock_user(p, arg2, 0);
11012             }
11013         }
11014         return ret;
11015 #endif
11016     case TARGET_NR_futex:
11017         return do_futex(arg1, arg2, arg3, arg4, arg5, arg6);
11018 #if defined(TARGET_NR_inotify_init) && defined(__NR_inotify_init)
11019     case TARGET_NR_inotify_init:
11020         ret = get_errno(sys_inotify_init());
11021         if (ret >= 0) {
11022             fd_trans_register(ret, &target_inotify_trans);
11023         }
11024         return ret;
11025 #endif
11026 #ifdef CONFIG_INOTIFY1
11027 #if defined(TARGET_NR_inotify_init1) && defined(__NR_inotify_init1)
11028     case TARGET_NR_inotify_init1:
11029         ret = get_errno(sys_inotify_init1(target_to_host_bitmask(arg1,
11030                                           fcntl_flags_tbl)));
11031         if (ret >= 0) {
11032             fd_trans_register(ret, &target_inotify_trans);
11033         }
11034         return ret;
11035 #endif
11036 #endif
11037 #if defined(TARGET_NR_inotify_add_watch) && defined(__NR_inotify_add_watch)
11038     case TARGET_NR_inotify_add_watch:
11039         p = lock_user_string(arg2);
11040         ret = get_errno(sys_inotify_add_watch(arg1, path(p), arg3));
11041         unlock_user(p, arg2, 0);
11042         return ret;
11043 #endif
11044 #if defined(TARGET_NR_inotify_rm_watch) && defined(__NR_inotify_rm_watch)
11045     case TARGET_NR_inotify_rm_watch:
11046         return get_errno(sys_inotify_rm_watch(arg1, arg2));
11047 #endif
11048 
11049 #if defined(TARGET_NR_mq_open) && defined(__NR_mq_open)
11050     case TARGET_NR_mq_open:
11051         {
11052             struct mq_attr posix_mq_attr;
11053             struct mq_attr *pposix_mq_attr;
11054             int host_flags;
11055 
11056             host_flags = target_to_host_bitmask(arg2, fcntl_flags_tbl);
11057             pposix_mq_attr = NULL;
11058             if (arg4) {
11059                 if (copy_from_user_mq_attr(&posix_mq_attr, arg4) != 0) {
11060                     return -TARGET_EFAULT;
11061                 }
11062                 pposix_mq_attr = &posix_mq_attr;
11063             }
11064             p = lock_user_string(arg1 - 1);
11065             if (!p) {
11066                 return -TARGET_EFAULT;
11067             }
11068             ret = get_errno(mq_open(p, host_flags, arg3, pposix_mq_attr));
11069             unlock_user (p, arg1, 0);
11070         }
11071         return ret;
11072 
11073     case TARGET_NR_mq_unlink:
11074         p = lock_user_string(arg1 - 1);
11075         if (!p) {
11076             return -TARGET_EFAULT;
11077         }
11078         ret = get_errno(mq_unlink(p));
11079         unlock_user (p, arg1, 0);
11080         return ret;
11081 
11082     case TARGET_NR_mq_timedsend:
11083         {
11084             struct timespec ts;
11085 
11086             p = lock_user (VERIFY_READ, arg2, arg3, 1);
11087             if (arg5 != 0) {
11088                 target_to_host_timespec(&ts, arg5);
11089                 ret = get_errno(safe_mq_timedsend(arg1, p, arg3, arg4, &ts));
11090                 host_to_target_timespec(arg5, &ts);
11091             } else {
11092                 ret = get_errno(safe_mq_timedsend(arg1, p, arg3, arg4, NULL));
11093             }
11094             unlock_user (p, arg2, arg3);
11095         }
11096         return ret;
11097 
11098     case TARGET_NR_mq_timedreceive:
11099         {
11100             struct timespec ts;
11101             unsigned int prio;
11102 
11103             p = lock_user (VERIFY_READ, arg2, arg3, 1);
11104             if (arg5 != 0) {
11105                 target_to_host_timespec(&ts, arg5);
11106                 ret = get_errno(safe_mq_timedreceive(arg1, p, arg3,
11107                                                      &prio, &ts));
11108                 host_to_target_timespec(arg5, &ts);
11109             } else {
11110                 ret = get_errno(safe_mq_timedreceive(arg1, p, arg3,
11111                                                      &prio, NULL));
11112             }
11113             unlock_user (p, arg2, arg3);
11114             if (arg4 != 0)
11115                 put_user_u32(prio, arg4);
11116         }
11117         return ret;
11118 
11119     /* Not implemented for now... */
11120 /*     case TARGET_NR_mq_notify: */
11121 /*         break; */
11122 
11123     case TARGET_NR_mq_getsetattr:
11124         {
11125             struct mq_attr posix_mq_attr_in, posix_mq_attr_out;
11126             ret = 0;
11127             if (arg2 != 0) {
11128                 copy_from_user_mq_attr(&posix_mq_attr_in, arg2);
11129                 ret = get_errno(mq_setattr(arg1, &posix_mq_attr_in,
11130                                            &posix_mq_attr_out));
11131             } else if (arg3 != 0) {
11132                 ret = get_errno(mq_getattr(arg1, &posix_mq_attr_out));
11133             }
11134             if (ret == 0 && arg3 != 0) {
11135                 copy_to_user_mq_attr(arg3, &posix_mq_attr_out);
11136             }
11137         }
11138         return ret;
11139 #endif
11140 
11141 #ifdef CONFIG_SPLICE
11142 #ifdef TARGET_NR_tee
11143     case TARGET_NR_tee:
11144         {
11145             ret = get_errno(tee(arg1,arg2,arg3,arg4));
11146         }
11147         return ret;
11148 #endif
11149 #ifdef TARGET_NR_splice
11150     case TARGET_NR_splice:
11151         {
11152             loff_t loff_in, loff_out;
11153             loff_t *ploff_in = NULL, *ploff_out = NULL;
11154             if (arg2) {
11155                 if (get_user_u64(loff_in, arg2)) {
11156                     return -TARGET_EFAULT;
11157                 }
11158                 ploff_in = &loff_in;
11159             }
11160             if (arg4) {
11161                 if (get_user_u64(loff_out, arg4)) {
11162                     return -TARGET_EFAULT;
11163                 }
11164                 ploff_out = &loff_out;
11165             }
11166             ret = get_errno(splice(arg1, ploff_in, arg3, ploff_out, arg5, arg6));
11167             if (arg2) {
11168                 if (put_user_u64(loff_in, arg2)) {
11169                     return -TARGET_EFAULT;
11170                 }
11171             }
11172             if (arg4) {
11173                 if (put_user_u64(loff_out, arg4)) {
11174                     return -TARGET_EFAULT;
11175                 }
11176             }
11177         }
11178         return ret;
11179 #endif
11180 #ifdef TARGET_NR_vmsplice
11181 	case TARGET_NR_vmsplice:
11182         {
11183             struct iovec *vec = lock_iovec(VERIFY_READ, arg2, arg3, 1);
11184             if (vec != NULL) {
11185                 ret = get_errno(vmsplice(arg1, vec, arg3, arg4));
11186                 unlock_iovec(vec, arg2, arg3, 0);
11187             } else {
11188                 ret = -host_to_target_errno(errno);
11189             }
11190         }
11191         return ret;
11192 #endif
11193 #endif /* CONFIG_SPLICE */
11194 #ifdef CONFIG_EVENTFD
11195 #if defined(TARGET_NR_eventfd)
11196     case TARGET_NR_eventfd:
11197         ret = get_errno(eventfd(arg1, 0));
11198         if (ret >= 0) {
11199             fd_trans_register(ret, &target_eventfd_trans);
11200         }
11201         return ret;
11202 #endif
11203 #if defined(TARGET_NR_eventfd2)
11204     case TARGET_NR_eventfd2:
11205     {
11206         int host_flags = arg2 & (~(TARGET_O_NONBLOCK | TARGET_O_CLOEXEC));
11207         if (arg2 & TARGET_O_NONBLOCK) {
11208             host_flags |= O_NONBLOCK;
11209         }
11210         if (arg2 & TARGET_O_CLOEXEC) {
11211             host_flags |= O_CLOEXEC;
11212         }
11213         ret = get_errno(eventfd(arg1, host_flags));
11214         if (ret >= 0) {
11215             fd_trans_register(ret, &target_eventfd_trans);
11216         }
11217         return ret;
11218     }
11219 #endif
11220 #endif /* CONFIG_EVENTFD  */
11221 #if defined(CONFIG_FALLOCATE) && defined(TARGET_NR_fallocate)
11222     case TARGET_NR_fallocate:
11223 #if TARGET_ABI_BITS == 32
11224         ret = get_errno(fallocate(arg1, arg2, target_offset64(arg3, arg4),
11225                                   target_offset64(arg5, arg6)));
11226 #else
11227         ret = get_errno(fallocate(arg1, arg2, arg3, arg4));
11228 #endif
11229         return ret;
11230 #endif
11231 #if defined(CONFIG_SYNC_FILE_RANGE)
11232 #if defined(TARGET_NR_sync_file_range)
11233     case TARGET_NR_sync_file_range:
11234 #if TARGET_ABI_BITS == 32
11235 #if defined(TARGET_MIPS)
11236         ret = get_errno(sync_file_range(arg1, target_offset64(arg3, arg4),
11237                                         target_offset64(arg5, arg6), arg7));
11238 #else
11239         ret = get_errno(sync_file_range(arg1, target_offset64(arg2, arg3),
11240                                         target_offset64(arg4, arg5), arg6));
11241 #endif /* !TARGET_MIPS */
11242 #else
11243         ret = get_errno(sync_file_range(arg1, arg2, arg3, arg4));
11244 #endif
11245         return ret;
11246 #endif
11247 #if defined(TARGET_NR_sync_file_range2)
11248     case TARGET_NR_sync_file_range2:
11249         /* This is like sync_file_range but the arguments are reordered */
11250 #if TARGET_ABI_BITS == 32
11251         ret = get_errno(sync_file_range(arg1, target_offset64(arg3, arg4),
11252                                         target_offset64(arg5, arg6), arg2));
11253 #else
11254         ret = get_errno(sync_file_range(arg1, arg3, arg4, arg2));
11255 #endif
11256         return ret;
11257 #endif
11258 #endif
11259 #if defined(TARGET_NR_signalfd4)
11260     case TARGET_NR_signalfd4:
11261         return do_signalfd4(arg1, arg2, arg4);
11262 #endif
11263 #if defined(TARGET_NR_signalfd)
11264     case TARGET_NR_signalfd:
11265         return do_signalfd4(arg1, arg2, 0);
11266 #endif
11267 #if defined(CONFIG_EPOLL)
11268 #if defined(TARGET_NR_epoll_create)
11269     case TARGET_NR_epoll_create:
11270         return get_errno(epoll_create(arg1));
11271 #endif
11272 #if defined(TARGET_NR_epoll_create1) && defined(CONFIG_EPOLL_CREATE1)
11273     case TARGET_NR_epoll_create1:
11274         return get_errno(epoll_create1(arg1));
11275 #endif
11276 #if defined(TARGET_NR_epoll_ctl)
11277     case TARGET_NR_epoll_ctl:
11278     {
11279         struct epoll_event ep;
11280         struct epoll_event *epp = 0;
11281         if (arg4) {
11282             struct target_epoll_event *target_ep;
11283             if (!lock_user_struct(VERIFY_READ, target_ep, arg4, 1)) {
11284                 return -TARGET_EFAULT;
11285             }
11286             ep.events = tswap32(target_ep->events);
11287             /* The epoll_data_t union is just opaque data to the kernel,
11288              * so we transfer all 64 bits across and need not worry what
11289              * actual data type it is.
11290              */
11291             ep.data.u64 = tswap64(target_ep->data.u64);
11292             unlock_user_struct(target_ep, arg4, 0);
11293             epp = &ep;
11294         }
11295         return get_errno(epoll_ctl(arg1, arg2, arg3, epp));
11296     }
11297 #endif
11298 
11299 #if defined(TARGET_NR_epoll_wait) || defined(TARGET_NR_epoll_pwait)
11300 #if defined(TARGET_NR_epoll_wait)
11301     case TARGET_NR_epoll_wait:
11302 #endif
11303 #if defined(TARGET_NR_epoll_pwait)
11304     case TARGET_NR_epoll_pwait:
11305 #endif
11306     {
11307         struct target_epoll_event *target_ep;
11308         struct epoll_event *ep;
11309         int epfd = arg1;
11310         int maxevents = arg3;
11311         int timeout = arg4;
11312 
11313         if (maxevents <= 0 || maxevents > TARGET_EP_MAX_EVENTS) {
11314             return -TARGET_EINVAL;
11315         }
11316 
11317         target_ep = lock_user(VERIFY_WRITE, arg2,
11318                               maxevents * sizeof(struct target_epoll_event), 1);
11319         if (!target_ep) {
11320             return -TARGET_EFAULT;
11321         }
11322 
11323         ep = g_try_new(struct epoll_event, maxevents);
11324         if (!ep) {
11325             unlock_user(target_ep, arg2, 0);
11326             return -TARGET_ENOMEM;
11327         }
11328 
11329         switch (num) {
11330 #if defined(TARGET_NR_epoll_pwait)
11331         case TARGET_NR_epoll_pwait:
11332         {
11333             target_sigset_t *target_set;
11334             sigset_t _set, *set = &_set;
11335 
11336             if (arg5) {
11337                 if (arg6 != sizeof(target_sigset_t)) {
11338                     ret = -TARGET_EINVAL;
11339                     break;
11340                 }
11341 
11342                 target_set = lock_user(VERIFY_READ, arg5,
11343                                        sizeof(target_sigset_t), 1);
11344                 if (!target_set) {
11345                     ret = -TARGET_EFAULT;
11346                     break;
11347                 }
11348                 target_to_host_sigset(set, target_set);
11349                 unlock_user(target_set, arg5, 0);
11350             } else {
11351                 set = NULL;
11352             }
11353 
11354             ret = get_errno(safe_epoll_pwait(epfd, ep, maxevents, timeout,
11355                                              set, SIGSET_T_SIZE));
11356             break;
11357         }
11358 #endif
11359 #if defined(TARGET_NR_epoll_wait)
11360         case TARGET_NR_epoll_wait:
11361             ret = get_errno(safe_epoll_pwait(epfd, ep, maxevents, timeout,
11362                                              NULL, 0));
11363             break;
11364 #endif
11365         default:
11366             ret = -TARGET_ENOSYS;
11367         }
11368         if (!is_error(ret)) {
11369             int i;
11370             for (i = 0; i < ret; i++) {
11371                 target_ep[i].events = tswap32(ep[i].events);
11372                 target_ep[i].data.u64 = tswap64(ep[i].data.u64);
11373             }
11374             unlock_user(target_ep, arg2,
11375                         ret * sizeof(struct target_epoll_event));
11376         } else {
11377             unlock_user(target_ep, arg2, 0);
11378         }
11379         g_free(ep);
11380         return ret;
11381     }
11382 #endif
11383 #endif
11384 #ifdef TARGET_NR_prlimit64
11385     case TARGET_NR_prlimit64:
11386     {
11387         /* args: pid, resource number, ptr to new rlimit, ptr to old rlimit */
11388         struct target_rlimit64 *target_rnew, *target_rold;
11389         struct host_rlimit64 rnew, rold, *rnewp = 0;
11390         int resource = target_to_host_resource(arg2);
11391         if (arg3) {
11392             if (!lock_user_struct(VERIFY_READ, target_rnew, arg3, 1)) {
11393                 return -TARGET_EFAULT;
11394             }
11395             rnew.rlim_cur = tswap64(target_rnew->rlim_cur);
11396             rnew.rlim_max = tswap64(target_rnew->rlim_max);
11397             unlock_user_struct(target_rnew, arg3, 0);
11398             rnewp = &rnew;
11399         }
11400 
11401         ret = get_errno(sys_prlimit64(arg1, resource, rnewp, arg4 ? &rold : 0));
11402         if (!is_error(ret) && arg4) {
11403             if (!lock_user_struct(VERIFY_WRITE, target_rold, arg4, 1)) {
11404                 return -TARGET_EFAULT;
11405             }
11406             target_rold->rlim_cur = tswap64(rold.rlim_cur);
11407             target_rold->rlim_max = tswap64(rold.rlim_max);
11408             unlock_user_struct(target_rold, arg4, 1);
11409         }
11410         return ret;
11411     }
11412 #endif
11413 #ifdef TARGET_NR_gethostname
11414     case TARGET_NR_gethostname:
11415     {
11416         char *name = lock_user(VERIFY_WRITE, arg1, arg2, 0);
11417         if (name) {
11418             ret = get_errno(gethostname(name, arg2));
11419             unlock_user(name, arg1, arg2);
11420         } else {
11421             ret = -TARGET_EFAULT;
11422         }
11423         return ret;
11424     }
11425 #endif
11426 #ifdef TARGET_NR_atomic_cmpxchg_32
11427     case TARGET_NR_atomic_cmpxchg_32:
11428     {
11429         /* should use start_exclusive from main.c */
11430         abi_ulong mem_value;
11431         if (get_user_u32(mem_value, arg6)) {
11432             target_siginfo_t info;
11433             info.si_signo = SIGSEGV;
11434             info.si_errno = 0;
11435             info.si_code = TARGET_SEGV_MAPERR;
11436             info._sifields._sigfault._addr = arg6;
11437             queue_signal((CPUArchState *)cpu_env, info.si_signo,
11438                          QEMU_SI_FAULT, &info);
11439             ret = 0xdeadbeef;
11440 
11441         }
11442         if (mem_value == arg2)
11443             put_user_u32(arg1, arg6);
11444         return mem_value;
11445     }
11446 #endif
11447 #ifdef TARGET_NR_atomic_barrier
11448     case TARGET_NR_atomic_barrier:
11449         /* Like the kernel implementation and the
11450            qemu arm barrier, no-op this? */
11451         return 0;
11452 #endif
11453 
11454 #ifdef TARGET_NR_timer_create
11455     case TARGET_NR_timer_create:
11456     {
11457         /* args: clockid_t clockid, struct sigevent *sevp, timer_t *timerid */
11458 
11459         struct sigevent host_sevp = { {0}, }, *phost_sevp = NULL;
11460 
11461         int clkid = arg1;
11462         int timer_index = next_free_host_timer();
11463 
11464         if (timer_index < 0) {
11465             ret = -TARGET_EAGAIN;
11466         } else {
11467             timer_t *phtimer = g_posix_timers  + timer_index;
11468 
11469             if (arg2) {
11470                 phost_sevp = &host_sevp;
11471                 ret = target_to_host_sigevent(phost_sevp, arg2);
11472                 if (ret != 0) {
11473                     return ret;
11474                 }
11475             }
11476 
11477             ret = get_errno(timer_create(clkid, phost_sevp, phtimer));
11478             if (ret) {
11479                 phtimer = NULL;
11480             } else {
11481                 if (put_user(TIMER_MAGIC | timer_index, arg3, target_timer_t)) {
11482                     return -TARGET_EFAULT;
11483                 }
11484             }
11485         }
11486         return ret;
11487     }
11488 #endif
11489 
11490 #ifdef TARGET_NR_timer_settime
11491     case TARGET_NR_timer_settime:
11492     {
11493         /* args: timer_t timerid, int flags, const struct itimerspec *new_value,
11494          * struct itimerspec * old_value */
11495         target_timer_t timerid = get_timer_id(arg1);
11496 
11497         if (timerid < 0) {
11498             ret = timerid;
11499         } else if (arg3 == 0) {
11500             ret = -TARGET_EINVAL;
11501         } else {
11502             timer_t htimer = g_posix_timers[timerid];
11503             struct itimerspec hspec_new = {{0},}, hspec_old = {{0},};
11504 
11505             if (target_to_host_itimerspec(&hspec_new, arg3)) {
11506                 return -TARGET_EFAULT;
11507             }
11508             ret = get_errno(
11509                           timer_settime(htimer, arg2, &hspec_new, &hspec_old));
11510             if (arg4 && host_to_target_itimerspec(arg4, &hspec_old)) {
11511                 return -TARGET_EFAULT;
11512             }
11513         }
11514         return ret;
11515     }
11516 #endif
11517 
11518 #ifdef TARGET_NR_timer_gettime
11519     case TARGET_NR_timer_gettime:
11520     {
11521         /* args: timer_t timerid, struct itimerspec *curr_value */
11522         target_timer_t timerid = get_timer_id(arg1);
11523 
11524         if (timerid < 0) {
11525             ret = timerid;
11526         } else if (!arg2) {
11527             ret = -TARGET_EFAULT;
11528         } else {
11529             timer_t htimer = g_posix_timers[timerid];
11530             struct itimerspec hspec;
11531             ret = get_errno(timer_gettime(htimer, &hspec));
11532 
11533             if (host_to_target_itimerspec(arg2, &hspec)) {
11534                 ret = -TARGET_EFAULT;
11535             }
11536         }
11537         return ret;
11538     }
11539 #endif
11540 
11541 #ifdef TARGET_NR_timer_getoverrun
11542     case TARGET_NR_timer_getoverrun:
11543     {
11544         /* args: timer_t timerid */
11545         target_timer_t timerid = get_timer_id(arg1);
11546 
11547         if (timerid < 0) {
11548             ret = timerid;
11549         } else {
11550             timer_t htimer = g_posix_timers[timerid];
11551             ret = get_errno(timer_getoverrun(htimer));
11552         }
11553         fd_trans_unregister(ret);
11554         return ret;
11555     }
11556 #endif
11557 
11558 #ifdef TARGET_NR_timer_delete
11559     case TARGET_NR_timer_delete:
11560     {
11561         /* args: timer_t timerid */
11562         target_timer_t timerid = get_timer_id(arg1);
11563 
11564         if (timerid < 0) {
11565             ret = timerid;
11566         } else {
11567             timer_t htimer = g_posix_timers[timerid];
11568             ret = get_errno(timer_delete(htimer));
11569             g_posix_timers[timerid] = 0;
11570         }
11571         return ret;
11572     }
11573 #endif
11574 
11575 #if defined(TARGET_NR_timerfd_create) && defined(CONFIG_TIMERFD)
11576     case TARGET_NR_timerfd_create:
11577         return get_errno(timerfd_create(arg1,
11578                           target_to_host_bitmask(arg2, fcntl_flags_tbl)));
11579 #endif
11580 
11581 #if defined(TARGET_NR_timerfd_gettime) && defined(CONFIG_TIMERFD)
11582     case TARGET_NR_timerfd_gettime:
11583         {
11584             struct itimerspec its_curr;
11585 
11586             ret = get_errno(timerfd_gettime(arg1, &its_curr));
11587 
11588             if (arg2 && host_to_target_itimerspec(arg2, &its_curr)) {
11589                 return -TARGET_EFAULT;
11590             }
11591         }
11592         return ret;
11593 #endif
11594 
11595 #if defined(TARGET_NR_timerfd_settime) && defined(CONFIG_TIMERFD)
11596     case TARGET_NR_timerfd_settime:
11597         {
11598             struct itimerspec its_new, its_old, *p_new;
11599 
11600             if (arg3) {
11601                 if (target_to_host_itimerspec(&its_new, arg3)) {
11602                     return -TARGET_EFAULT;
11603                 }
11604                 p_new = &its_new;
11605             } else {
11606                 p_new = NULL;
11607             }
11608 
11609             ret = get_errno(timerfd_settime(arg1, arg2, p_new, &its_old));
11610 
11611             if (arg4 && host_to_target_itimerspec(arg4, &its_old)) {
11612                 return -TARGET_EFAULT;
11613             }
11614         }
11615         return ret;
11616 #endif
11617 
11618 #if defined(TARGET_NR_ioprio_get) && defined(__NR_ioprio_get)
11619     case TARGET_NR_ioprio_get:
11620         return get_errno(ioprio_get(arg1, arg2));
11621 #endif
11622 
11623 #if defined(TARGET_NR_ioprio_set) && defined(__NR_ioprio_set)
11624     case TARGET_NR_ioprio_set:
11625         return get_errno(ioprio_set(arg1, arg2, arg3));
11626 #endif
11627 
11628 #if defined(TARGET_NR_setns) && defined(CONFIG_SETNS)
11629     case TARGET_NR_setns:
11630         return get_errno(setns(arg1, arg2));
11631 #endif
11632 #if defined(TARGET_NR_unshare) && defined(CONFIG_SETNS)
11633     case TARGET_NR_unshare:
11634         return get_errno(unshare(arg1));
11635 #endif
11636 #if defined(TARGET_NR_kcmp) && defined(__NR_kcmp)
11637     case TARGET_NR_kcmp:
11638         return get_errno(kcmp(arg1, arg2, arg3, arg4, arg5));
11639 #endif
11640 #ifdef TARGET_NR_swapcontext
11641     case TARGET_NR_swapcontext:
11642         /* PowerPC specific.  */
11643         return do_swapcontext(cpu_env, arg1, arg2, arg3);
11644 #endif
11645 
11646     default:
11647         qemu_log_mask(LOG_UNIMP, "Unsupported syscall: %d\n", num);
11648         return -TARGET_ENOSYS;
11649     }
11650     return ret;
11651 }
11652 
11653 abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
11654                     abi_long arg2, abi_long arg3, abi_long arg4,
11655                     abi_long arg5, abi_long arg6, abi_long arg7,
11656                     abi_long arg8)
11657 {
11658     CPUState *cpu = ENV_GET_CPU(cpu_env);
11659     abi_long ret;
11660 
11661 #ifdef DEBUG_ERESTARTSYS
11662     /* Debug-only code for exercising the syscall-restart code paths
11663      * in the per-architecture cpu main loops: restart every syscall
11664      * the guest makes once before letting it through.
11665      */
11666     {
11667         static bool flag;
11668         flag = !flag;
11669         if (flag) {
11670             return -TARGET_ERESTARTSYS;
11671         }
11672     }
11673 #endif
11674 
11675     trace_guest_user_syscall(cpu, num, arg1, arg2, arg3, arg4,
11676                              arg5, arg6, arg7, arg8);
11677 
11678     if (unlikely(do_strace)) {
11679         print_syscall(num, arg1, arg2, arg3, arg4, arg5, arg6);
11680         ret = do_syscall1(cpu_env, num, arg1, arg2, arg3, arg4,
11681                           arg5, arg6, arg7, arg8);
11682         print_syscall_ret(num, ret);
11683     } else {
11684         ret = do_syscall1(cpu_env, num, arg1, arg2, arg3, arg4,
11685                           arg5, arg6, arg7, arg8);
11686     }
11687 
11688     trace_guest_user_syscall_ret(cpu, num, ret);
11689     return ret;
11690 }
11691