xref: /openbmc/qemu/linux-user/syscall.c (revision 39164c13)
1 /*
2  *  Linux syscalls
3  *
4  *  Copyright (c) 2003 Fabrice Bellard
5  *
6  *  This program is free software; you can redistribute it and/or modify
7  *  it under the terms of the GNU General Public License as published by
8  *  the Free Software Foundation; either version 2 of the License, or
9  *  (at your option) any later version.
10  *
11  *  This program is distributed in the hope that it will be useful,
12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14  *  GNU General Public License for more details.
15  *
16  *  You should have received a copy of the GNU General Public License
17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
18  */
19 #define _ATFILE_SOURCE
20 #include "qemu/osdep.h"
21 #include "qemu/cutils.h"
22 #include "qemu/path.h"
23 #include <elf.h>
24 #include <endian.h>
25 #include <grp.h>
26 #include <sys/ipc.h>
27 #include <sys/msg.h>
28 #include <sys/wait.h>
29 #include <sys/mount.h>
30 #include <sys/file.h>
31 #include <sys/fsuid.h>
32 #include <sys/personality.h>
33 #include <sys/prctl.h>
34 #include <sys/resource.h>
35 #include <sys/swap.h>
36 #include <linux/capability.h>
37 #include <sched.h>
38 #include <sys/timex.h>
39 #ifdef __ia64__
40 int __clone2(int (*fn)(void *), void *child_stack_base,
41              size_t stack_size, int flags, void *arg, ...);
42 #endif
43 #include <sys/socket.h>
44 #include <sys/un.h>
45 #include <sys/uio.h>
46 #include <poll.h>
47 #include <sys/times.h>
48 #include <sys/shm.h>
49 #include <sys/sem.h>
50 #include <sys/statfs.h>
51 #include <time.h>
52 #include <utime.h>
53 #include <sys/sysinfo.h>
54 #include <sys/signalfd.h>
55 //#include <sys/user.h>
56 #include <netinet/ip.h>
57 #include <netinet/tcp.h>
58 #include <linux/wireless.h>
59 #include <linux/icmp.h>
60 #include <linux/icmpv6.h>
61 #include <linux/errqueue.h>
62 #include "qemu-common.h"
63 #ifdef CONFIG_TIMERFD
64 #include <sys/timerfd.h>
65 #endif
66 #ifdef TARGET_GPROF
67 #include <sys/gmon.h>
68 #endif
69 #ifdef CONFIG_EVENTFD
70 #include <sys/eventfd.h>
71 #endif
72 #ifdef CONFIG_EPOLL
73 #include <sys/epoll.h>
74 #endif
75 #ifdef CONFIG_ATTR
76 #include "qemu/xattr.h"
77 #endif
78 #ifdef CONFIG_SENDFILE
79 #include <sys/sendfile.h>
80 #endif
81 
82 #define termios host_termios
83 #define winsize host_winsize
84 #define termio host_termio
85 #define sgttyb host_sgttyb /* same as target */
86 #define tchars host_tchars /* same as target */
87 #define ltchars host_ltchars /* same as target */
88 
89 #include <linux/termios.h>
90 #include <linux/unistd.h>
91 #include <linux/cdrom.h>
92 #include <linux/hdreg.h>
93 #include <linux/soundcard.h>
94 #include <linux/kd.h>
95 #include <linux/mtio.h>
96 #include <linux/fs.h>
97 #if defined(CONFIG_FIEMAP)
98 #include <linux/fiemap.h>
99 #endif
100 #include <linux/fb.h>
101 #include <linux/vt.h>
102 #include <linux/dm-ioctl.h>
103 #include <linux/reboot.h>
104 #include <linux/route.h>
105 #include <linux/filter.h>
106 #include <linux/blkpg.h>
107 #include <netpacket/packet.h>
108 #include <linux/netlink.h>
109 #ifdef CONFIG_RTNETLINK
110 #include <linux/rtnetlink.h>
111 #include <linux/if_bridge.h>
112 #endif
113 #include <linux/audit.h>
114 #include "linux_loop.h"
115 #include "uname.h"
116 
117 #include "qemu.h"
118 
119 #ifndef CLONE_IO
120 #define CLONE_IO                0x80000000      /* Clone io context */
121 #endif
122 
123 /* We can't directly call the host clone syscall, because this will
124  * badly confuse libc (breaking mutexes, for example). So we must
125  * divide clone flags into:
126  *  * flag combinations that look like pthread_create()
127  *  * flag combinations that look like fork()
128  *  * flags we can implement within QEMU itself
129  *  * flags we can't support and will return an error for
130  */
131 /* For thread creation, all these flags must be present; for
132  * fork, none must be present.
133  */
134 #define CLONE_THREAD_FLAGS                              \
135     (CLONE_VM | CLONE_FS | CLONE_FILES |                \
136      CLONE_SIGHAND | CLONE_THREAD | CLONE_SYSVSEM)
137 
138 /* These flags are ignored:
139  * CLONE_DETACHED is now ignored by the kernel;
140  * CLONE_IO is just an optimisation hint to the I/O scheduler
141  */
142 #define CLONE_IGNORED_FLAGS                     \
143     (CLONE_DETACHED | CLONE_IO)
144 
145 /* Flags for fork which we can implement within QEMU itself */
146 #define CLONE_OPTIONAL_FORK_FLAGS               \
147     (CLONE_SETTLS | CLONE_PARENT_SETTID |       \
148      CLONE_CHILD_CLEARTID | CLONE_CHILD_SETTID)
149 
150 /* Flags for thread creation which we can implement within QEMU itself */
151 #define CLONE_OPTIONAL_THREAD_FLAGS                             \
152     (CLONE_SETTLS | CLONE_PARENT_SETTID |                       \
153      CLONE_CHILD_CLEARTID | CLONE_CHILD_SETTID | CLONE_PARENT)
154 
155 #define CLONE_INVALID_FORK_FLAGS                                        \
156     (~(CSIGNAL | CLONE_OPTIONAL_FORK_FLAGS | CLONE_IGNORED_FLAGS))
157 
158 #define CLONE_INVALID_THREAD_FLAGS                                      \
159     (~(CSIGNAL | CLONE_THREAD_FLAGS | CLONE_OPTIONAL_THREAD_FLAGS |     \
160        CLONE_IGNORED_FLAGS))
161 
162 /* CLONE_VFORK is special cased early in do_fork(). The other flag bits
163  * have almost all been allocated. We cannot support any of
164  * CLONE_NEWNS, CLONE_NEWCGROUP, CLONE_NEWUTS, CLONE_NEWIPC,
165  * CLONE_NEWUSER, CLONE_NEWPID, CLONE_NEWNET, CLONE_PTRACE, CLONE_UNTRACED.
166  * The checks against the invalid thread masks above will catch these.
167  * (The one remaining unallocated bit is 0x1000 which used to be CLONE_PID.)
168  */
169 
170 //#define DEBUG
171 /* Define DEBUG_ERESTARTSYS to force every syscall to be restarted
172  * once. This exercises the codepaths for restart.
173  */
174 //#define DEBUG_ERESTARTSYS
175 
176 //#include <linux/msdos_fs.h>
177 #define	VFAT_IOCTL_READDIR_BOTH		_IOR('r', 1, struct linux_dirent [2])
178 #define	VFAT_IOCTL_READDIR_SHORT	_IOR('r', 2, struct linux_dirent [2])
179 
180 #undef _syscall0
181 #undef _syscall1
182 #undef _syscall2
183 #undef _syscall3
184 #undef _syscall4
185 #undef _syscall5
186 #undef _syscall6
187 
188 #define _syscall0(type,name)		\
189 static type name (void)			\
190 {					\
191 	return syscall(__NR_##name);	\
192 }
193 
194 #define _syscall1(type,name,type1,arg1)		\
195 static type name (type1 arg1)			\
196 {						\
197 	return syscall(__NR_##name, arg1);	\
198 }
199 
200 #define _syscall2(type,name,type1,arg1,type2,arg2)	\
201 static type name (type1 arg1,type2 arg2)		\
202 {							\
203 	return syscall(__NR_##name, arg1, arg2);	\
204 }
205 
206 #define _syscall3(type,name,type1,arg1,type2,arg2,type3,arg3)	\
207 static type name (type1 arg1,type2 arg2,type3 arg3)		\
208 {								\
209 	return syscall(__NR_##name, arg1, arg2, arg3);		\
210 }
211 
212 #define _syscall4(type,name,type1,arg1,type2,arg2,type3,arg3,type4,arg4)	\
213 static type name (type1 arg1,type2 arg2,type3 arg3,type4 arg4)			\
214 {										\
215 	return syscall(__NR_##name, arg1, arg2, arg3, arg4);			\
216 }
217 
218 #define _syscall5(type,name,type1,arg1,type2,arg2,type3,arg3,type4,arg4,	\
219 		  type5,arg5)							\
220 static type name (type1 arg1,type2 arg2,type3 arg3,type4 arg4,type5 arg5)	\
221 {										\
222 	return syscall(__NR_##name, arg1, arg2, arg3, arg4, arg5);		\
223 }
224 
225 
226 #define _syscall6(type,name,type1,arg1,type2,arg2,type3,arg3,type4,arg4,	\
227 		  type5,arg5,type6,arg6)					\
228 static type name (type1 arg1,type2 arg2,type3 arg3,type4 arg4,type5 arg5,	\
229                   type6 arg6)							\
230 {										\
231 	return syscall(__NR_##name, arg1, arg2, arg3, arg4, arg5, arg6);	\
232 }
233 
234 
235 #define __NR_sys_uname __NR_uname
236 #define __NR_sys_getcwd1 __NR_getcwd
237 #define __NR_sys_getdents __NR_getdents
238 #define __NR_sys_getdents64 __NR_getdents64
239 #define __NR_sys_getpriority __NR_getpriority
240 #define __NR_sys_rt_sigqueueinfo __NR_rt_sigqueueinfo
241 #define __NR_sys_syslog __NR_syslog
242 #define __NR_sys_futex __NR_futex
243 #define __NR_sys_inotify_init __NR_inotify_init
244 #define __NR_sys_inotify_add_watch __NR_inotify_add_watch
245 #define __NR_sys_inotify_rm_watch __NR_inotify_rm_watch
246 
247 #if defined(__alpha__) || defined (__ia64__) || defined(__x86_64__) || \
248     defined(__s390x__)
249 #define __NR__llseek __NR_lseek
250 #endif
251 
252 /* Newer kernel ports have llseek() instead of _llseek() */
253 #if defined(TARGET_NR_llseek) && !defined(TARGET_NR__llseek)
254 #define TARGET_NR__llseek TARGET_NR_llseek
255 #endif
256 
257 #ifdef __NR_gettid
258 _syscall0(int, gettid)
259 #else
260 /* This is a replacement for the host gettid() and must return a host
261    errno. */
262 static int gettid(void) {
263     return -ENOSYS;
264 }
265 #endif
266 #if defined(TARGET_NR_getdents) && defined(__NR_getdents)
267 _syscall3(int, sys_getdents, uint, fd, struct linux_dirent *, dirp, uint, count);
268 #endif
269 #if !defined(__NR_getdents) || \
270     (defined(TARGET_NR_getdents64) && defined(__NR_getdents64))
271 _syscall3(int, sys_getdents64, uint, fd, struct linux_dirent64 *, dirp, uint, count);
272 #endif
273 #if defined(TARGET_NR__llseek) && defined(__NR_llseek)
274 _syscall5(int, _llseek,  uint,  fd, ulong, hi, ulong, lo,
275           loff_t *, res, uint, wh);
276 #endif
277 _syscall3(int,sys_rt_sigqueueinfo,int,pid,int,sig,siginfo_t *,uinfo)
278 _syscall3(int,sys_syslog,int,type,char*,bufp,int,len)
279 #ifdef __NR_exit_group
280 _syscall1(int,exit_group,int,error_code)
281 #endif
282 #if defined(TARGET_NR_set_tid_address) && defined(__NR_set_tid_address)
283 _syscall1(int,set_tid_address,int *,tidptr)
284 #endif
285 #if defined(TARGET_NR_futex) && defined(__NR_futex)
286 _syscall6(int,sys_futex,int *,uaddr,int,op,int,val,
287           const struct timespec *,timeout,int *,uaddr2,int,val3)
288 #endif
289 #define __NR_sys_sched_getaffinity __NR_sched_getaffinity
290 _syscall3(int, sys_sched_getaffinity, pid_t, pid, unsigned int, len,
291           unsigned long *, user_mask_ptr);
292 #define __NR_sys_sched_setaffinity __NR_sched_setaffinity
293 _syscall3(int, sys_sched_setaffinity, pid_t, pid, unsigned int, len,
294           unsigned long *, user_mask_ptr);
295 _syscall4(int, reboot, int, magic1, int, magic2, unsigned int, cmd,
296           void *, arg);
297 _syscall2(int, capget, struct __user_cap_header_struct *, header,
298           struct __user_cap_data_struct *, data);
299 _syscall2(int, capset, struct __user_cap_header_struct *, header,
300           struct __user_cap_data_struct *, data);
301 #if defined(TARGET_NR_ioprio_get) && defined(__NR_ioprio_get)
302 _syscall2(int, ioprio_get, int, which, int, who)
303 #endif
304 #if defined(TARGET_NR_ioprio_set) && defined(__NR_ioprio_set)
305 _syscall3(int, ioprio_set, int, which, int, who, int, ioprio)
306 #endif
307 #if defined(TARGET_NR_getrandom) && defined(__NR_getrandom)
308 _syscall3(int, getrandom, void *, buf, size_t, buflen, unsigned int, flags)
309 #endif
310 
311 #if defined(TARGET_NR_kcmp) && defined(__NR_kcmp)
312 _syscall5(int, kcmp, pid_t, pid1, pid_t, pid2, int, type,
313           unsigned long, idx1, unsigned long, idx2)
314 #endif
315 
316 static bitmask_transtbl fcntl_flags_tbl[] = {
317   { TARGET_O_ACCMODE,   TARGET_O_WRONLY,    O_ACCMODE,   O_WRONLY,    },
318   { TARGET_O_ACCMODE,   TARGET_O_RDWR,      O_ACCMODE,   O_RDWR,      },
319   { TARGET_O_CREAT,     TARGET_O_CREAT,     O_CREAT,     O_CREAT,     },
320   { TARGET_O_EXCL,      TARGET_O_EXCL,      O_EXCL,      O_EXCL,      },
321   { TARGET_O_NOCTTY,    TARGET_O_NOCTTY,    O_NOCTTY,    O_NOCTTY,    },
322   { TARGET_O_TRUNC,     TARGET_O_TRUNC,     O_TRUNC,     O_TRUNC,     },
323   { TARGET_O_APPEND,    TARGET_O_APPEND,    O_APPEND,    O_APPEND,    },
324   { TARGET_O_NONBLOCK,  TARGET_O_NONBLOCK,  O_NONBLOCK,  O_NONBLOCK,  },
325   { TARGET_O_SYNC,      TARGET_O_DSYNC,     O_SYNC,      O_DSYNC,     },
326   { TARGET_O_SYNC,      TARGET_O_SYNC,      O_SYNC,      O_SYNC,      },
327   { TARGET_FASYNC,      TARGET_FASYNC,      FASYNC,      FASYNC,      },
328   { TARGET_O_DIRECTORY, TARGET_O_DIRECTORY, O_DIRECTORY, O_DIRECTORY, },
329   { TARGET_O_NOFOLLOW,  TARGET_O_NOFOLLOW,  O_NOFOLLOW,  O_NOFOLLOW,  },
330 #if defined(O_DIRECT)
331   { TARGET_O_DIRECT,    TARGET_O_DIRECT,    O_DIRECT,    O_DIRECT,    },
332 #endif
333 #if defined(O_NOATIME)
334   { TARGET_O_NOATIME,   TARGET_O_NOATIME,   O_NOATIME,   O_NOATIME    },
335 #endif
336 #if defined(O_CLOEXEC)
337   { TARGET_O_CLOEXEC,   TARGET_O_CLOEXEC,   O_CLOEXEC,   O_CLOEXEC    },
338 #endif
339 #if defined(O_PATH)
340   { TARGET_O_PATH,      TARGET_O_PATH,      O_PATH,      O_PATH       },
341 #endif
342   /* Don't terminate the list prematurely on 64-bit host+guest.  */
343 #if TARGET_O_LARGEFILE != 0 || O_LARGEFILE != 0
344   { TARGET_O_LARGEFILE, TARGET_O_LARGEFILE, O_LARGEFILE, O_LARGEFILE, },
345 #endif
346   { 0, 0, 0, 0 }
347 };
348 
349 enum {
350     QEMU_IFLA_BR_UNSPEC,
351     QEMU_IFLA_BR_FORWARD_DELAY,
352     QEMU_IFLA_BR_HELLO_TIME,
353     QEMU_IFLA_BR_MAX_AGE,
354     QEMU_IFLA_BR_AGEING_TIME,
355     QEMU_IFLA_BR_STP_STATE,
356     QEMU_IFLA_BR_PRIORITY,
357     QEMU_IFLA_BR_VLAN_FILTERING,
358     QEMU_IFLA_BR_VLAN_PROTOCOL,
359     QEMU_IFLA_BR_GROUP_FWD_MASK,
360     QEMU_IFLA_BR_ROOT_ID,
361     QEMU_IFLA_BR_BRIDGE_ID,
362     QEMU_IFLA_BR_ROOT_PORT,
363     QEMU_IFLA_BR_ROOT_PATH_COST,
364     QEMU_IFLA_BR_TOPOLOGY_CHANGE,
365     QEMU_IFLA_BR_TOPOLOGY_CHANGE_DETECTED,
366     QEMU_IFLA_BR_HELLO_TIMER,
367     QEMU_IFLA_BR_TCN_TIMER,
368     QEMU_IFLA_BR_TOPOLOGY_CHANGE_TIMER,
369     QEMU_IFLA_BR_GC_TIMER,
370     QEMU_IFLA_BR_GROUP_ADDR,
371     QEMU_IFLA_BR_FDB_FLUSH,
372     QEMU_IFLA_BR_MCAST_ROUTER,
373     QEMU_IFLA_BR_MCAST_SNOOPING,
374     QEMU_IFLA_BR_MCAST_QUERY_USE_IFADDR,
375     QEMU_IFLA_BR_MCAST_QUERIER,
376     QEMU_IFLA_BR_MCAST_HASH_ELASTICITY,
377     QEMU_IFLA_BR_MCAST_HASH_MAX,
378     QEMU_IFLA_BR_MCAST_LAST_MEMBER_CNT,
379     QEMU_IFLA_BR_MCAST_STARTUP_QUERY_CNT,
380     QEMU_IFLA_BR_MCAST_LAST_MEMBER_INTVL,
381     QEMU_IFLA_BR_MCAST_MEMBERSHIP_INTVL,
382     QEMU_IFLA_BR_MCAST_QUERIER_INTVL,
383     QEMU_IFLA_BR_MCAST_QUERY_INTVL,
384     QEMU_IFLA_BR_MCAST_QUERY_RESPONSE_INTVL,
385     QEMU_IFLA_BR_MCAST_STARTUP_QUERY_INTVL,
386     QEMU_IFLA_BR_NF_CALL_IPTABLES,
387     QEMU_IFLA_BR_NF_CALL_IP6TABLES,
388     QEMU_IFLA_BR_NF_CALL_ARPTABLES,
389     QEMU_IFLA_BR_VLAN_DEFAULT_PVID,
390     QEMU_IFLA_BR_PAD,
391     QEMU_IFLA_BR_VLAN_STATS_ENABLED,
392     QEMU_IFLA_BR_MCAST_STATS_ENABLED,
393     QEMU___IFLA_BR_MAX,
394 };
395 
396 enum {
397     QEMU_IFLA_UNSPEC,
398     QEMU_IFLA_ADDRESS,
399     QEMU_IFLA_BROADCAST,
400     QEMU_IFLA_IFNAME,
401     QEMU_IFLA_MTU,
402     QEMU_IFLA_LINK,
403     QEMU_IFLA_QDISC,
404     QEMU_IFLA_STATS,
405     QEMU_IFLA_COST,
406     QEMU_IFLA_PRIORITY,
407     QEMU_IFLA_MASTER,
408     QEMU_IFLA_WIRELESS,
409     QEMU_IFLA_PROTINFO,
410     QEMU_IFLA_TXQLEN,
411     QEMU_IFLA_MAP,
412     QEMU_IFLA_WEIGHT,
413     QEMU_IFLA_OPERSTATE,
414     QEMU_IFLA_LINKMODE,
415     QEMU_IFLA_LINKINFO,
416     QEMU_IFLA_NET_NS_PID,
417     QEMU_IFLA_IFALIAS,
418     QEMU_IFLA_NUM_VF,
419     QEMU_IFLA_VFINFO_LIST,
420     QEMU_IFLA_STATS64,
421     QEMU_IFLA_VF_PORTS,
422     QEMU_IFLA_PORT_SELF,
423     QEMU_IFLA_AF_SPEC,
424     QEMU_IFLA_GROUP,
425     QEMU_IFLA_NET_NS_FD,
426     QEMU_IFLA_EXT_MASK,
427     QEMU_IFLA_PROMISCUITY,
428     QEMU_IFLA_NUM_TX_QUEUES,
429     QEMU_IFLA_NUM_RX_QUEUES,
430     QEMU_IFLA_CARRIER,
431     QEMU_IFLA_PHYS_PORT_ID,
432     QEMU_IFLA_CARRIER_CHANGES,
433     QEMU_IFLA_PHYS_SWITCH_ID,
434     QEMU_IFLA_LINK_NETNSID,
435     QEMU_IFLA_PHYS_PORT_NAME,
436     QEMU_IFLA_PROTO_DOWN,
437     QEMU_IFLA_GSO_MAX_SEGS,
438     QEMU_IFLA_GSO_MAX_SIZE,
439     QEMU_IFLA_PAD,
440     QEMU_IFLA_XDP,
441     QEMU___IFLA_MAX
442 };
443 
444 enum {
445     QEMU_IFLA_BRPORT_UNSPEC,
446     QEMU_IFLA_BRPORT_STATE,
447     QEMU_IFLA_BRPORT_PRIORITY,
448     QEMU_IFLA_BRPORT_COST,
449     QEMU_IFLA_BRPORT_MODE,
450     QEMU_IFLA_BRPORT_GUARD,
451     QEMU_IFLA_BRPORT_PROTECT,
452     QEMU_IFLA_BRPORT_FAST_LEAVE,
453     QEMU_IFLA_BRPORT_LEARNING,
454     QEMU_IFLA_BRPORT_UNICAST_FLOOD,
455     QEMU_IFLA_BRPORT_PROXYARP,
456     QEMU_IFLA_BRPORT_LEARNING_SYNC,
457     QEMU_IFLA_BRPORT_PROXYARP_WIFI,
458     QEMU_IFLA_BRPORT_ROOT_ID,
459     QEMU_IFLA_BRPORT_BRIDGE_ID,
460     QEMU_IFLA_BRPORT_DESIGNATED_PORT,
461     QEMU_IFLA_BRPORT_DESIGNATED_COST,
462     QEMU_IFLA_BRPORT_ID,
463     QEMU_IFLA_BRPORT_NO,
464     QEMU_IFLA_BRPORT_TOPOLOGY_CHANGE_ACK,
465     QEMU_IFLA_BRPORT_CONFIG_PENDING,
466     QEMU_IFLA_BRPORT_MESSAGE_AGE_TIMER,
467     QEMU_IFLA_BRPORT_FORWARD_DELAY_TIMER,
468     QEMU_IFLA_BRPORT_HOLD_TIMER,
469     QEMU_IFLA_BRPORT_FLUSH,
470     QEMU_IFLA_BRPORT_MULTICAST_ROUTER,
471     QEMU_IFLA_BRPORT_PAD,
472     QEMU___IFLA_BRPORT_MAX
473 };
474 
475 enum {
476     QEMU_IFLA_INFO_UNSPEC,
477     QEMU_IFLA_INFO_KIND,
478     QEMU_IFLA_INFO_DATA,
479     QEMU_IFLA_INFO_XSTATS,
480     QEMU_IFLA_INFO_SLAVE_KIND,
481     QEMU_IFLA_INFO_SLAVE_DATA,
482     QEMU___IFLA_INFO_MAX,
483 };
484 
485 enum {
486     QEMU_IFLA_INET_UNSPEC,
487     QEMU_IFLA_INET_CONF,
488     QEMU___IFLA_INET_MAX,
489 };
490 
491 enum {
492     QEMU_IFLA_INET6_UNSPEC,
493     QEMU_IFLA_INET6_FLAGS,
494     QEMU_IFLA_INET6_CONF,
495     QEMU_IFLA_INET6_STATS,
496     QEMU_IFLA_INET6_MCAST,
497     QEMU_IFLA_INET6_CACHEINFO,
498     QEMU_IFLA_INET6_ICMP6STATS,
499     QEMU_IFLA_INET6_TOKEN,
500     QEMU_IFLA_INET6_ADDR_GEN_MODE,
501     QEMU___IFLA_INET6_MAX
502 };
503 
504 typedef abi_long (*TargetFdDataFunc)(void *, size_t);
505 typedef abi_long (*TargetFdAddrFunc)(void *, abi_ulong, socklen_t);
506 typedef struct TargetFdTrans {
507     TargetFdDataFunc host_to_target_data;
508     TargetFdDataFunc target_to_host_data;
509     TargetFdAddrFunc target_to_host_addr;
510 } TargetFdTrans;
511 
512 static TargetFdTrans **target_fd_trans;
513 
514 static unsigned int target_fd_max;
515 
516 static TargetFdDataFunc fd_trans_target_to_host_data(int fd)
517 {
518     if (fd >= 0 && fd < target_fd_max && target_fd_trans[fd]) {
519         return target_fd_trans[fd]->target_to_host_data;
520     }
521     return NULL;
522 }
523 
524 static TargetFdDataFunc fd_trans_host_to_target_data(int fd)
525 {
526     if (fd >= 0 && fd < target_fd_max && target_fd_trans[fd]) {
527         return target_fd_trans[fd]->host_to_target_data;
528     }
529     return NULL;
530 }
531 
532 static TargetFdAddrFunc fd_trans_target_to_host_addr(int fd)
533 {
534     if (fd >= 0 && fd < target_fd_max && target_fd_trans[fd]) {
535         return target_fd_trans[fd]->target_to_host_addr;
536     }
537     return NULL;
538 }
539 
540 static void fd_trans_register(int fd, TargetFdTrans *trans)
541 {
542     unsigned int oldmax;
543 
544     if (fd >= target_fd_max) {
545         oldmax = target_fd_max;
546         target_fd_max = ((fd >> 6) + 1) << 6; /* by slice of 64 entries */
547         target_fd_trans = g_renew(TargetFdTrans *,
548                                   target_fd_trans, target_fd_max);
549         memset((void *)(target_fd_trans + oldmax), 0,
550                (target_fd_max - oldmax) * sizeof(TargetFdTrans *));
551     }
552     target_fd_trans[fd] = trans;
553 }
554 
555 static void fd_trans_unregister(int fd)
556 {
557     if (fd >= 0 && fd < target_fd_max) {
558         target_fd_trans[fd] = NULL;
559     }
560 }
561 
562 static void fd_trans_dup(int oldfd, int newfd)
563 {
564     fd_trans_unregister(newfd);
565     if (oldfd < target_fd_max && target_fd_trans[oldfd]) {
566         fd_trans_register(newfd, target_fd_trans[oldfd]);
567     }
568 }
569 
570 static int sys_getcwd1(char *buf, size_t size)
571 {
572   if (getcwd(buf, size) == NULL) {
573       /* getcwd() sets errno */
574       return (-1);
575   }
576   return strlen(buf)+1;
577 }
578 
579 #ifdef TARGET_NR_utimensat
580 #if defined(__NR_utimensat)
581 #define __NR_sys_utimensat __NR_utimensat
582 _syscall4(int,sys_utimensat,int,dirfd,const char *,pathname,
583           const struct timespec *,tsp,int,flags)
584 #else
585 static int sys_utimensat(int dirfd, const char *pathname,
586                          const struct timespec times[2], int flags)
587 {
588     errno = ENOSYS;
589     return -1;
590 }
591 #endif
592 #endif /* TARGET_NR_utimensat */
593 
594 #ifdef CONFIG_INOTIFY
595 #include <sys/inotify.h>
596 
597 #if defined(TARGET_NR_inotify_init) && defined(__NR_inotify_init)
598 static int sys_inotify_init(void)
599 {
600   return (inotify_init());
601 }
602 #endif
603 #if defined(TARGET_NR_inotify_add_watch) && defined(__NR_inotify_add_watch)
604 static int sys_inotify_add_watch(int fd,const char *pathname, int32_t mask)
605 {
606   return (inotify_add_watch(fd, pathname, mask));
607 }
608 #endif
609 #if defined(TARGET_NR_inotify_rm_watch) && defined(__NR_inotify_rm_watch)
610 static int sys_inotify_rm_watch(int fd, int32_t wd)
611 {
612   return (inotify_rm_watch(fd, wd));
613 }
614 #endif
615 #ifdef CONFIG_INOTIFY1
616 #if defined(TARGET_NR_inotify_init1) && defined(__NR_inotify_init1)
617 static int sys_inotify_init1(int flags)
618 {
619   return (inotify_init1(flags));
620 }
621 #endif
622 #endif
623 #else
624 /* Userspace can usually survive runtime without inotify */
625 #undef TARGET_NR_inotify_init
626 #undef TARGET_NR_inotify_init1
627 #undef TARGET_NR_inotify_add_watch
628 #undef TARGET_NR_inotify_rm_watch
629 #endif /* CONFIG_INOTIFY  */
630 
631 #if defined(TARGET_NR_prlimit64)
632 #ifndef __NR_prlimit64
633 # define __NR_prlimit64 -1
634 #endif
635 #define __NR_sys_prlimit64 __NR_prlimit64
636 /* The glibc rlimit structure may not be that used by the underlying syscall */
637 struct host_rlimit64 {
638     uint64_t rlim_cur;
639     uint64_t rlim_max;
640 };
641 _syscall4(int, sys_prlimit64, pid_t, pid, int, resource,
642           const struct host_rlimit64 *, new_limit,
643           struct host_rlimit64 *, old_limit)
644 #endif
645 
646 
647 #if defined(TARGET_NR_timer_create)
648 /* Maxiumum of 32 active POSIX timers allowed at any one time. */
649 static timer_t g_posix_timers[32] = { 0, } ;
650 
651 static inline int next_free_host_timer(void)
652 {
653     int k ;
654     /* FIXME: Does finding the next free slot require a lock? */
655     for (k = 0; k < ARRAY_SIZE(g_posix_timers); k++) {
656         if (g_posix_timers[k] == 0) {
657             g_posix_timers[k] = (timer_t) 1;
658             return k;
659         }
660     }
661     return -1;
662 }
663 #endif
664 
665 /* ARM EABI and MIPS expect 64bit types aligned even on pairs or registers */
666 #ifdef TARGET_ARM
667 static inline int regpairs_aligned(void *cpu_env) {
668     return ((((CPUARMState *)cpu_env)->eabi) == 1) ;
669 }
670 #elif defined(TARGET_MIPS) && (TARGET_ABI_BITS == 32)
671 static inline int regpairs_aligned(void *cpu_env) { return 1; }
672 #elif defined(TARGET_PPC) && !defined(TARGET_PPC64)
673 /* SysV AVI for PPC32 expects 64bit parameters to be passed on odd/even pairs
674  * of registers which translates to the same as ARM/MIPS, because we start with
675  * r3 as arg1 */
676 static inline int regpairs_aligned(void *cpu_env) { return 1; }
677 #else
678 static inline int regpairs_aligned(void *cpu_env) { return 0; }
679 #endif
680 
681 #define ERRNO_TABLE_SIZE 1200
682 
683 /* target_to_host_errno_table[] is initialized from
684  * host_to_target_errno_table[] in syscall_init(). */
685 static uint16_t target_to_host_errno_table[ERRNO_TABLE_SIZE] = {
686 };
687 
688 /*
689  * This list is the union of errno values overridden in asm-<arch>/errno.h
690  * minus the errnos that are not actually generic to all archs.
691  */
692 static uint16_t host_to_target_errno_table[ERRNO_TABLE_SIZE] = {
693     [EAGAIN]		= TARGET_EAGAIN,
694     [EIDRM]		= TARGET_EIDRM,
695     [ECHRNG]		= TARGET_ECHRNG,
696     [EL2NSYNC]		= TARGET_EL2NSYNC,
697     [EL3HLT]		= TARGET_EL3HLT,
698     [EL3RST]		= TARGET_EL3RST,
699     [ELNRNG]		= TARGET_ELNRNG,
700     [EUNATCH]		= TARGET_EUNATCH,
701     [ENOCSI]		= TARGET_ENOCSI,
702     [EL2HLT]		= TARGET_EL2HLT,
703     [EDEADLK]		= TARGET_EDEADLK,
704     [ENOLCK]		= TARGET_ENOLCK,
705     [EBADE]		= TARGET_EBADE,
706     [EBADR]		= TARGET_EBADR,
707     [EXFULL]		= TARGET_EXFULL,
708     [ENOANO]		= TARGET_ENOANO,
709     [EBADRQC]		= TARGET_EBADRQC,
710     [EBADSLT]		= TARGET_EBADSLT,
711     [EBFONT]		= TARGET_EBFONT,
712     [ENOSTR]		= TARGET_ENOSTR,
713     [ENODATA]		= TARGET_ENODATA,
714     [ETIME]		= TARGET_ETIME,
715     [ENOSR]		= TARGET_ENOSR,
716     [ENONET]		= TARGET_ENONET,
717     [ENOPKG]		= TARGET_ENOPKG,
718     [EREMOTE]		= TARGET_EREMOTE,
719     [ENOLINK]		= TARGET_ENOLINK,
720     [EADV]		= TARGET_EADV,
721     [ESRMNT]		= TARGET_ESRMNT,
722     [ECOMM]		= TARGET_ECOMM,
723     [EPROTO]		= TARGET_EPROTO,
724     [EDOTDOT]		= TARGET_EDOTDOT,
725     [EMULTIHOP]		= TARGET_EMULTIHOP,
726     [EBADMSG]		= TARGET_EBADMSG,
727     [ENAMETOOLONG]	= TARGET_ENAMETOOLONG,
728     [EOVERFLOW]		= TARGET_EOVERFLOW,
729     [ENOTUNIQ]		= TARGET_ENOTUNIQ,
730     [EBADFD]		= TARGET_EBADFD,
731     [EREMCHG]		= TARGET_EREMCHG,
732     [ELIBACC]		= TARGET_ELIBACC,
733     [ELIBBAD]		= TARGET_ELIBBAD,
734     [ELIBSCN]		= TARGET_ELIBSCN,
735     [ELIBMAX]		= TARGET_ELIBMAX,
736     [ELIBEXEC]		= TARGET_ELIBEXEC,
737     [EILSEQ]		= TARGET_EILSEQ,
738     [ENOSYS]		= TARGET_ENOSYS,
739     [ELOOP]		= TARGET_ELOOP,
740     [ERESTART]		= TARGET_ERESTART,
741     [ESTRPIPE]		= TARGET_ESTRPIPE,
742     [ENOTEMPTY]		= TARGET_ENOTEMPTY,
743     [EUSERS]		= TARGET_EUSERS,
744     [ENOTSOCK]		= TARGET_ENOTSOCK,
745     [EDESTADDRREQ]	= TARGET_EDESTADDRREQ,
746     [EMSGSIZE]		= TARGET_EMSGSIZE,
747     [EPROTOTYPE]	= TARGET_EPROTOTYPE,
748     [ENOPROTOOPT]	= TARGET_ENOPROTOOPT,
749     [EPROTONOSUPPORT]	= TARGET_EPROTONOSUPPORT,
750     [ESOCKTNOSUPPORT]	= TARGET_ESOCKTNOSUPPORT,
751     [EOPNOTSUPP]	= TARGET_EOPNOTSUPP,
752     [EPFNOSUPPORT]	= TARGET_EPFNOSUPPORT,
753     [EAFNOSUPPORT]	= TARGET_EAFNOSUPPORT,
754     [EADDRINUSE]	= TARGET_EADDRINUSE,
755     [EADDRNOTAVAIL]	= TARGET_EADDRNOTAVAIL,
756     [ENETDOWN]		= TARGET_ENETDOWN,
757     [ENETUNREACH]	= TARGET_ENETUNREACH,
758     [ENETRESET]		= TARGET_ENETRESET,
759     [ECONNABORTED]	= TARGET_ECONNABORTED,
760     [ECONNRESET]	= TARGET_ECONNRESET,
761     [ENOBUFS]		= TARGET_ENOBUFS,
762     [EISCONN]		= TARGET_EISCONN,
763     [ENOTCONN]		= TARGET_ENOTCONN,
764     [EUCLEAN]		= TARGET_EUCLEAN,
765     [ENOTNAM]		= TARGET_ENOTNAM,
766     [ENAVAIL]		= TARGET_ENAVAIL,
767     [EISNAM]		= TARGET_EISNAM,
768     [EREMOTEIO]		= TARGET_EREMOTEIO,
769     [EDQUOT]            = TARGET_EDQUOT,
770     [ESHUTDOWN]		= TARGET_ESHUTDOWN,
771     [ETOOMANYREFS]	= TARGET_ETOOMANYREFS,
772     [ETIMEDOUT]		= TARGET_ETIMEDOUT,
773     [ECONNREFUSED]	= TARGET_ECONNREFUSED,
774     [EHOSTDOWN]		= TARGET_EHOSTDOWN,
775     [EHOSTUNREACH]	= TARGET_EHOSTUNREACH,
776     [EALREADY]		= TARGET_EALREADY,
777     [EINPROGRESS]	= TARGET_EINPROGRESS,
778     [ESTALE]		= TARGET_ESTALE,
779     [ECANCELED]		= TARGET_ECANCELED,
780     [ENOMEDIUM]		= TARGET_ENOMEDIUM,
781     [EMEDIUMTYPE]	= TARGET_EMEDIUMTYPE,
782 #ifdef ENOKEY
783     [ENOKEY]		= TARGET_ENOKEY,
784 #endif
785 #ifdef EKEYEXPIRED
786     [EKEYEXPIRED]	= TARGET_EKEYEXPIRED,
787 #endif
788 #ifdef EKEYREVOKED
789     [EKEYREVOKED]	= TARGET_EKEYREVOKED,
790 #endif
791 #ifdef EKEYREJECTED
792     [EKEYREJECTED]	= TARGET_EKEYREJECTED,
793 #endif
794 #ifdef EOWNERDEAD
795     [EOWNERDEAD]	= TARGET_EOWNERDEAD,
796 #endif
797 #ifdef ENOTRECOVERABLE
798     [ENOTRECOVERABLE]	= TARGET_ENOTRECOVERABLE,
799 #endif
800 #ifdef ENOMSG
801     [ENOMSG]            = TARGET_ENOMSG,
802 #endif
803 #ifdef ERKFILL
804     [ERFKILL]           = TARGET_ERFKILL,
805 #endif
806 #ifdef EHWPOISON
807     [EHWPOISON]         = TARGET_EHWPOISON,
808 #endif
809 };
810 
811 static inline int host_to_target_errno(int err)
812 {
813     if (err >= 0 && err < ERRNO_TABLE_SIZE &&
814         host_to_target_errno_table[err]) {
815         return host_to_target_errno_table[err];
816     }
817     return err;
818 }
819 
820 static inline int target_to_host_errno(int err)
821 {
822     if (err >= 0 && err < ERRNO_TABLE_SIZE &&
823         target_to_host_errno_table[err]) {
824         return target_to_host_errno_table[err];
825     }
826     return err;
827 }
828 
829 static inline abi_long get_errno(abi_long ret)
830 {
831     if (ret == -1)
832         return -host_to_target_errno(errno);
833     else
834         return ret;
835 }
836 
837 static inline int is_error(abi_long ret)
838 {
839     return (abi_ulong)ret >= (abi_ulong)(-4096);
840 }
841 
842 const char *target_strerror(int err)
843 {
844     if (err == TARGET_ERESTARTSYS) {
845         return "To be restarted";
846     }
847     if (err == TARGET_QEMU_ESIGRETURN) {
848         return "Successful exit from sigreturn";
849     }
850 
851     if ((err >= ERRNO_TABLE_SIZE) || (err < 0)) {
852         return NULL;
853     }
854     return strerror(target_to_host_errno(err));
855 }
856 
857 #define safe_syscall0(type, name) \
858 static type safe_##name(void) \
859 { \
860     return safe_syscall(__NR_##name); \
861 }
862 
863 #define safe_syscall1(type, name, type1, arg1) \
864 static type safe_##name(type1 arg1) \
865 { \
866     return safe_syscall(__NR_##name, arg1); \
867 }
868 
869 #define safe_syscall2(type, name, type1, arg1, type2, arg2) \
870 static type safe_##name(type1 arg1, type2 arg2) \
871 { \
872     return safe_syscall(__NR_##name, arg1, arg2); \
873 }
874 
875 #define safe_syscall3(type, name, type1, arg1, type2, arg2, type3, arg3) \
876 static type safe_##name(type1 arg1, type2 arg2, type3 arg3) \
877 { \
878     return safe_syscall(__NR_##name, arg1, arg2, arg3); \
879 }
880 
881 #define safe_syscall4(type, name, type1, arg1, type2, arg2, type3, arg3, \
882     type4, arg4) \
883 static type safe_##name(type1 arg1, type2 arg2, type3 arg3, type4 arg4) \
884 { \
885     return safe_syscall(__NR_##name, arg1, arg2, arg3, arg4); \
886 }
887 
888 #define safe_syscall5(type, name, type1, arg1, type2, arg2, type3, arg3, \
889     type4, arg4, type5, arg5) \
890 static type safe_##name(type1 arg1, type2 arg2, type3 arg3, type4 arg4, \
891     type5 arg5) \
892 { \
893     return safe_syscall(__NR_##name, arg1, arg2, arg3, arg4, arg5); \
894 }
895 
896 #define safe_syscall6(type, name, type1, arg1, type2, arg2, type3, arg3, \
897     type4, arg4, type5, arg5, type6, arg6) \
898 static type safe_##name(type1 arg1, type2 arg2, type3 arg3, type4 arg4, \
899     type5 arg5, type6 arg6) \
900 { \
901     return safe_syscall(__NR_##name, arg1, arg2, arg3, arg4, arg5, arg6); \
902 }
903 
904 safe_syscall3(ssize_t, read, int, fd, void *, buff, size_t, count)
905 safe_syscall3(ssize_t, write, int, fd, const void *, buff, size_t, count)
906 safe_syscall4(int, openat, int, dirfd, const char *, pathname, \
907               int, flags, mode_t, mode)
908 safe_syscall4(pid_t, wait4, pid_t, pid, int *, status, int, options, \
909               struct rusage *, rusage)
910 safe_syscall5(int, waitid, idtype_t, idtype, id_t, id, siginfo_t *, infop, \
911               int, options, struct rusage *, rusage)
912 safe_syscall3(int, execve, const char *, filename, char **, argv, char **, envp)
913 safe_syscall6(int, pselect6, int, nfds, fd_set *, readfds, fd_set *, writefds, \
914               fd_set *, exceptfds, struct timespec *, timeout, void *, sig)
915 safe_syscall5(int, ppoll, struct pollfd *, ufds, unsigned int, nfds,
916               struct timespec *, tsp, const sigset_t *, sigmask,
917               size_t, sigsetsize)
918 safe_syscall6(int, epoll_pwait, int, epfd, struct epoll_event *, events,
919               int, maxevents, int, timeout, const sigset_t *, sigmask,
920               size_t, sigsetsize)
921 safe_syscall6(int,futex,int *,uaddr,int,op,int,val, \
922               const struct timespec *,timeout,int *,uaddr2,int,val3)
923 safe_syscall2(int, rt_sigsuspend, sigset_t *, newset, size_t, sigsetsize)
924 safe_syscall2(int, kill, pid_t, pid, int, sig)
925 safe_syscall2(int, tkill, int, tid, int, sig)
926 safe_syscall3(int, tgkill, int, tgid, int, pid, int, sig)
927 safe_syscall3(ssize_t, readv, int, fd, const struct iovec *, iov, int, iovcnt)
928 safe_syscall3(ssize_t, writev, int, fd, const struct iovec *, iov, int, iovcnt)
929 safe_syscall5(ssize_t, preadv, int, fd, const struct iovec *, iov, int, iovcnt,
930               unsigned long, pos_l, unsigned long, pos_h)
931 safe_syscall5(ssize_t, pwritev, int, fd, const struct iovec *, iov, int, iovcnt,
932               unsigned long, pos_l, unsigned long, pos_h)
933 safe_syscall3(int, connect, int, fd, const struct sockaddr *, addr,
934               socklen_t, addrlen)
935 safe_syscall6(ssize_t, sendto, int, fd, const void *, buf, size_t, len,
936               int, flags, const struct sockaddr *, addr, socklen_t, addrlen)
937 safe_syscall6(ssize_t, recvfrom, int, fd, void *, buf, size_t, len,
938               int, flags, struct sockaddr *, addr, socklen_t *, addrlen)
939 safe_syscall3(ssize_t, sendmsg, int, fd, const struct msghdr *, msg, int, flags)
940 safe_syscall3(ssize_t, recvmsg, int, fd, struct msghdr *, msg, int, flags)
941 safe_syscall2(int, flock, int, fd, int, operation)
942 safe_syscall4(int, rt_sigtimedwait, const sigset_t *, these, siginfo_t *, uinfo,
943               const struct timespec *, uts, size_t, sigsetsize)
944 safe_syscall4(int, accept4, int, fd, struct sockaddr *, addr, socklen_t *, len,
945               int, flags)
946 safe_syscall2(int, nanosleep, const struct timespec *, req,
947               struct timespec *, rem)
948 #ifdef TARGET_NR_clock_nanosleep
949 safe_syscall4(int, clock_nanosleep, const clockid_t, clock, int, flags,
950               const struct timespec *, req, struct timespec *, rem)
951 #endif
952 #ifdef __NR_msgsnd
953 safe_syscall4(int, msgsnd, int, msgid, const void *, msgp, size_t, sz,
954               int, flags)
955 safe_syscall5(int, msgrcv, int, msgid, void *, msgp, size_t, sz,
956               long, msgtype, int, flags)
957 safe_syscall4(int, semtimedop, int, semid, struct sembuf *, tsops,
958               unsigned, nsops, const struct timespec *, timeout)
959 #else
960 /* This host kernel architecture uses a single ipc syscall; fake up
961  * wrappers for the sub-operations to hide this implementation detail.
962  * Annoyingly we can't include linux/ipc.h to get the constant definitions
963  * for the call parameter because some structs in there conflict with the
964  * sys/ipc.h ones. So we just define them here, and rely on them being
965  * the same for all host architectures.
966  */
967 #define Q_SEMTIMEDOP 4
968 #define Q_MSGSND 11
969 #define Q_MSGRCV 12
970 #define Q_IPCCALL(VERSION, OP) ((VERSION) << 16 | (OP))
971 
972 safe_syscall6(int, ipc, int, call, long, first, long, second, long, third,
973               void *, ptr, long, fifth)
974 static int safe_msgsnd(int msgid, const void *msgp, size_t sz, int flags)
975 {
976     return safe_ipc(Q_IPCCALL(0, Q_MSGSND), msgid, sz, flags, (void *)msgp, 0);
977 }
978 static int safe_msgrcv(int msgid, void *msgp, size_t sz, long type, int flags)
979 {
980     return safe_ipc(Q_IPCCALL(1, Q_MSGRCV), msgid, sz, flags, msgp, type);
981 }
982 static int safe_semtimedop(int semid, struct sembuf *tsops, unsigned nsops,
983                            const struct timespec *timeout)
984 {
985     return safe_ipc(Q_IPCCALL(0, Q_SEMTIMEDOP), semid, nsops, 0, tsops,
986                     (long)timeout);
987 }
988 #endif
989 #if defined(TARGET_NR_mq_open) && defined(__NR_mq_open)
990 safe_syscall5(int, mq_timedsend, int, mqdes, const char *, msg_ptr,
991               size_t, len, unsigned, prio, const struct timespec *, timeout)
992 safe_syscall5(int, mq_timedreceive, int, mqdes, char *, msg_ptr,
993               size_t, len, unsigned *, prio, const struct timespec *, timeout)
994 #endif
995 /* We do ioctl like this rather than via safe_syscall3 to preserve the
996  * "third argument might be integer or pointer or not present" behaviour of
997  * the libc function.
998  */
999 #define safe_ioctl(...) safe_syscall(__NR_ioctl, __VA_ARGS__)
1000 /* Similarly for fcntl. Note that callers must always:
1001  *  pass the F_GETLK64 etc constants rather than the unsuffixed F_GETLK
1002  *  use the flock64 struct rather than unsuffixed flock
1003  * This will then work and use a 64-bit offset for both 32-bit and 64-bit hosts.
1004  */
1005 #ifdef __NR_fcntl64
1006 #define safe_fcntl(...) safe_syscall(__NR_fcntl64, __VA_ARGS__)
1007 #else
1008 #define safe_fcntl(...) safe_syscall(__NR_fcntl, __VA_ARGS__)
1009 #endif
1010 
1011 static inline int host_to_target_sock_type(int host_type)
1012 {
1013     int target_type;
1014 
1015     switch (host_type & 0xf /* SOCK_TYPE_MASK */) {
1016     case SOCK_DGRAM:
1017         target_type = TARGET_SOCK_DGRAM;
1018         break;
1019     case SOCK_STREAM:
1020         target_type = TARGET_SOCK_STREAM;
1021         break;
1022     default:
1023         target_type = host_type & 0xf /* SOCK_TYPE_MASK */;
1024         break;
1025     }
1026 
1027 #if defined(SOCK_CLOEXEC)
1028     if (host_type & SOCK_CLOEXEC) {
1029         target_type |= TARGET_SOCK_CLOEXEC;
1030     }
1031 #endif
1032 
1033 #if defined(SOCK_NONBLOCK)
1034     if (host_type & SOCK_NONBLOCK) {
1035         target_type |= TARGET_SOCK_NONBLOCK;
1036     }
1037 #endif
1038 
1039     return target_type;
1040 }
1041 
1042 static abi_ulong target_brk;
1043 static abi_ulong target_original_brk;
1044 static abi_ulong brk_page;
1045 
1046 void target_set_brk(abi_ulong new_brk)
1047 {
1048     target_original_brk = target_brk = HOST_PAGE_ALIGN(new_brk);
1049     brk_page = HOST_PAGE_ALIGN(target_brk);
1050 }
1051 
1052 //#define DEBUGF_BRK(message, args...) do { fprintf(stderr, (message), ## args); } while (0)
1053 #define DEBUGF_BRK(message, args...)
1054 
1055 /* do_brk() must return target values and target errnos. */
1056 abi_long do_brk(abi_ulong new_brk)
1057 {
1058     abi_long mapped_addr;
1059     abi_ulong new_alloc_size;
1060 
1061     DEBUGF_BRK("do_brk(" TARGET_ABI_FMT_lx ") -> ", new_brk);
1062 
1063     if (!new_brk) {
1064         DEBUGF_BRK(TARGET_ABI_FMT_lx " (!new_brk)\n", target_brk);
1065         return target_brk;
1066     }
1067     if (new_brk < target_original_brk) {
1068         DEBUGF_BRK(TARGET_ABI_FMT_lx " (new_brk < target_original_brk)\n",
1069                    target_brk);
1070         return target_brk;
1071     }
1072 
1073     /* If the new brk is less than the highest page reserved to the
1074      * target heap allocation, set it and we're almost done...  */
1075     if (new_brk <= brk_page) {
1076         /* Heap contents are initialized to zero, as for anonymous
1077          * mapped pages.  */
1078         if (new_brk > target_brk) {
1079             memset(g2h(target_brk), 0, new_brk - target_brk);
1080         }
1081 	target_brk = new_brk;
1082         DEBUGF_BRK(TARGET_ABI_FMT_lx " (new_brk <= brk_page)\n", target_brk);
1083     	return target_brk;
1084     }
1085 
1086     /* We need to allocate more memory after the brk... Note that
1087      * we don't use MAP_FIXED because that will map over the top of
1088      * any existing mapping (like the one with the host libc or qemu
1089      * itself); instead we treat "mapped but at wrong address" as
1090      * a failure and unmap again.
1091      */
1092     new_alloc_size = HOST_PAGE_ALIGN(new_brk - brk_page);
1093     mapped_addr = get_errno(target_mmap(brk_page, new_alloc_size,
1094                                         PROT_READ|PROT_WRITE,
1095                                         MAP_ANON|MAP_PRIVATE, 0, 0));
1096 
1097     if (mapped_addr == brk_page) {
1098         /* Heap contents are initialized to zero, as for anonymous
1099          * mapped pages.  Technically the new pages are already
1100          * initialized to zero since they *are* anonymous mapped
1101          * pages, however we have to take care with the contents that
1102          * come from the remaining part of the previous page: it may
1103          * contains garbage data due to a previous heap usage (grown
1104          * then shrunken).  */
1105         memset(g2h(target_brk), 0, brk_page - target_brk);
1106 
1107         target_brk = new_brk;
1108         brk_page = HOST_PAGE_ALIGN(target_brk);
1109         DEBUGF_BRK(TARGET_ABI_FMT_lx " (mapped_addr == brk_page)\n",
1110             target_brk);
1111         return target_brk;
1112     } else if (mapped_addr != -1) {
1113         /* Mapped but at wrong address, meaning there wasn't actually
1114          * enough space for this brk.
1115          */
1116         target_munmap(mapped_addr, new_alloc_size);
1117         mapped_addr = -1;
1118         DEBUGF_BRK(TARGET_ABI_FMT_lx " (mapped_addr != -1)\n", target_brk);
1119     }
1120     else {
1121         DEBUGF_BRK(TARGET_ABI_FMT_lx " (otherwise)\n", target_brk);
1122     }
1123 
1124 #if defined(TARGET_ALPHA)
1125     /* We (partially) emulate OSF/1 on Alpha, which requires we
1126        return a proper errno, not an unchanged brk value.  */
1127     return -TARGET_ENOMEM;
1128 #endif
1129     /* For everything else, return the previous break. */
1130     return target_brk;
1131 }
1132 
1133 static inline abi_long copy_from_user_fdset(fd_set *fds,
1134                                             abi_ulong target_fds_addr,
1135                                             int n)
1136 {
1137     int i, nw, j, k;
1138     abi_ulong b, *target_fds;
1139 
1140     nw = DIV_ROUND_UP(n, TARGET_ABI_BITS);
1141     if (!(target_fds = lock_user(VERIFY_READ,
1142                                  target_fds_addr,
1143                                  sizeof(abi_ulong) * nw,
1144                                  1)))
1145         return -TARGET_EFAULT;
1146 
1147     FD_ZERO(fds);
1148     k = 0;
1149     for (i = 0; i < nw; i++) {
1150         /* grab the abi_ulong */
1151         __get_user(b, &target_fds[i]);
1152         for (j = 0; j < TARGET_ABI_BITS; j++) {
1153             /* check the bit inside the abi_ulong */
1154             if ((b >> j) & 1)
1155                 FD_SET(k, fds);
1156             k++;
1157         }
1158     }
1159 
1160     unlock_user(target_fds, target_fds_addr, 0);
1161 
1162     return 0;
1163 }
1164 
1165 static inline abi_ulong copy_from_user_fdset_ptr(fd_set *fds, fd_set **fds_ptr,
1166                                                  abi_ulong target_fds_addr,
1167                                                  int n)
1168 {
1169     if (target_fds_addr) {
1170         if (copy_from_user_fdset(fds, target_fds_addr, n))
1171             return -TARGET_EFAULT;
1172         *fds_ptr = fds;
1173     } else {
1174         *fds_ptr = NULL;
1175     }
1176     return 0;
1177 }
1178 
1179 static inline abi_long copy_to_user_fdset(abi_ulong target_fds_addr,
1180                                           const fd_set *fds,
1181                                           int n)
1182 {
1183     int i, nw, j, k;
1184     abi_long v;
1185     abi_ulong *target_fds;
1186 
1187     nw = DIV_ROUND_UP(n, TARGET_ABI_BITS);
1188     if (!(target_fds = lock_user(VERIFY_WRITE,
1189                                  target_fds_addr,
1190                                  sizeof(abi_ulong) * nw,
1191                                  0)))
1192         return -TARGET_EFAULT;
1193 
1194     k = 0;
1195     for (i = 0; i < nw; i++) {
1196         v = 0;
1197         for (j = 0; j < TARGET_ABI_BITS; j++) {
1198             v |= ((abi_ulong)(FD_ISSET(k, fds) != 0) << j);
1199             k++;
1200         }
1201         __put_user(v, &target_fds[i]);
1202     }
1203 
1204     unlock_user(target_fds, target_fds_addr, sizeof(abi_ulong) * nw);
1205 
1206     return 0;
1207 }
1208 
1209 #if defined(__alpha__)
1210 #define HOST_HZ 1024
1211 #else
1212 #define HOST_HZ 100
1213 #endif
1214 
1215 static inline abi_long host_to_target_clock_t(long ticks)
1216 {
1217 #if HOST_HZ == TARGET_HZ
1218     return ticks;
1219 #else
1220     return ((int64_t)ticks * TARGET_HZ) / HOST_HZ;
1221 #endif
1222 }
1223 
1224 static inline abi_long host_to_target_rusage(abi_ulong target_addr,
1225                                              const struct rusage *rusage)
1226 {
1227     struct target_rusage *target_rusage;
1228 
1229     if (!lock_user_struct(VERIFY_WRITE, target_rusage, target_addr, 0))
1230         return -TARGET_EFAULT;
1231     target_rusage->ru_utime.tv_sec = tswapal(rusage->ru_utime.tv_sec);
1232     target_rusage->ru_utime.tv_usec = tswapal(rusage->ru_utime.tv_usec);
1233     target_rusage->ru_stime.tv_sec = tswapal(rusage->ru_stime.tv_sec);
1234     target_rusage->ru_stime.tv_usec = tswapal(rusage->ru_stime.tv_usec);
1235     target_rusage->ru_maxrss = tswapal(rusage->ru_maxrss);
1236     target_rusage->ru_ixrss = tswapal(rusage->ru_ixrss);
1237     target_rusage->ru_idrss = tswapal(rusage->ru_idrss);
1238     target_rusage->ru_isrss = tswapal(rusage->ru_isrss);
1239     target_rusage->ru_minflt = tswapal(rusage->ru_minflt);
1240     target_rusage->ru_majflt = tswapal(rusage->ru_majflt);
1241     target_rusage->ru_nswap = tswapal(rusage->ru_nswap);
1242     target_rusage->ru_inblock = tswapal(rusage->ru_inblock);
1243     target_rusage->ru_oublock = tswapal(rusage->ru_oublock);
1244     target_rusage->ru_msgsnd = tswapal(rusage->ru_msgsnd);
1245     target_rusage->ru_msgrcv = tswapal(rusage->ru_msgrcv);
1246     target_rusage->ru_nsignals = tswapal(rusage->ru_nsignals);
1247     target_rusage->ru_nvcsw = tswapal(rusage->ru_nvcsw);
1248     target_rusage->ru_nivcsw = tswapal(rusage->ru_nivcsw);
1249     unlock_user_struct(target_rusage, target_addr, 1);
1250 
1251     return 0;
1252 }
1253 
1254 static inline rlim_t target_to_host_rlim(abi_ulong target_rlim)
1255 {
1256     abi_ulong target_rlim_swap;
1257     rlim_t result;
1258 
1259     target_rlim_swap = tswapal(target_rlim);
1260     if (target_rlim_swap == TARGET_RLIM_INFINITY)
1261         return RLIM_INFINITY;
1262 
1263     result = target_rlim_swap;
1264     if (target_rlim_swap != (rlim_t)result)
1265         return RLIM_INFINITY;
1266 
1267     return result;
1268 }
1269 
1270 static inline abi_ulong host_to_target_rlim(rlim_t rlim)
1271 {
1272     abi_ulong target_rlim_swap;
1273     abi_ulong result;
1274 
1275     if (rlim == RLIM_INFINITY || rlim != (abi_long)rlim)
1276         target_rlim_swap = TARGET_RLIM_INFINITY;
1277     else
1278         target_rlim_swap = rlim;
1279     result = tswapal(target_rlim_swap);
1280 
1281     return result;
1282 }
1283 
1284 static inline int target_to_host_resource(int code)
1285 {
1286     switch (code) {
1287     case TARGET_RLIMIT_AS:
1288         return RLIMIT_AS;
1289     case TARGET_RLIMIT_CORE:
1290         return RLIMIT_CORE;
1291     case TARGET_RLIMIT_CPU:
1292         return RLIMIT_CPU;
1293     case TARGET_RLIMIT_DATA:
1294         return RLIMIT_DATA;
1295     case TARGET_RLIMIT_FSIZE:
1296         return RLIMIT_FSIZE;
1297     case TARGET_RLIMIT_LOCKS:
1298         return RLIMIT_LOCKS;
1299     case TARGET_RLIMIT_MEMLOCK:
1300         return RLIMIT_MEMLOCK;
1301     case TARGET_RLIMIT_MSGQUEUE:
1302         return RLIMIT_MSGQUEUE;
1303     case TARGET_RLIMIT_NICE:
1304         return RLIMIT_NICE;
1305     case TARGET_RLIMIT_NOFILE:
1306         return RLIMIT_NOFILE;
1307     case TARGET_RLIMIT_NPROC:
1308         return RLIMIT_NPROC;
1309     case TARGET_RLIMIT_RSS:
1310         return RLIMIT_RSS;
1311     case TARGET_RLIMIT_RTPRIO:
1312         return RLIMIT_RTPRIO;
1313     case TARGET_RLIMIT_SIGPENDING:
1314         return RLIMIT_SIGPENDING;
1315     case TARGET_RLIMIT_STACK:
1316         return RLIMIT_STACK;
1317     default:
1318         return code;
1319     }
1320 }
1321 
1322 static inline abi_long copy_from_user_timeval(struct timeval *tv,
1323                                               abi_ulong target_tv_addr)
1324 {
1325     struct target_timeval *target_tv;
1326 
1327     if (!lock_user_struct(VERIFY_READ, target_tv, target_tv_addr, 1))
1328         return -TARGET_EFAULT;
1329 
1330     __get_user(tv->tv_sec, &target_tv->tv_sec);
1331     __get_user(tv->tv_usec, &target_tv->tv_usec);
1332 
1333     unlock_user_struct(target_tv, target_tv_addr, 0);
1334 
1335     return 0;
1336 }
1337 
1338 static inline abi_long copy_to_user_timeval(abi_ulong target_tv_addr,
1339                                             const struct timeval *tv)
1340 {
1341     struct target_timeval *target_tv;
1342 
1343     if (!lock_user_struct(VERIFY_WRITE, target_tv, target_tv_addr, 0))
1344         return -TARGET_EFAULT;
1345 
1346     __put_user(tv->tv_sec, &target_tv->tv_sec);
1347     __put_user(tv->tv_usec, &target_tv->tv_usec);
1348 
1349     unlock_user_struct(target_tv, target_tv_addr, 1);
1350 
1351     return 0;
1352 }
1353 
1354 static inline abi_long copy_from_user_timezone(struct timezone *tz,
1355                                                abi_ulong target_tz_addr)
1356 {
1357     struct target_timezone *target_tz;
1358 
1359     if (!lock_user_struct(VERIFY_READ, target_tz, target_tz_addr, 1)) {
1360         return -TARGET_EFAULT;
1361     }
1362 
1363     __get_user(tz->tz_minuteswest, &target_tz->tz_minuteswest);
1364     __get_user(tz->tz_dsttime, &target_tz->tz_dsttime);
1365 
1366     unlock_user_struct(target_tz, target_tz_addr, 0);
1367 
1368     return 0;
1369 }
1370 
1371 #if defined(TARGET_NR_mq_open) && defined(__NR_mq_open)
1372 #include <mqueue.h>
1373 
1374 static inline abi_long copy_from_user_mq_attr(struct mq_attr *attr,
1375                                               abi_ulong target_mq_attr_addr)
1376 {
1377     struct target_mq_attr *target_mq_attr;
1378 
1379     if (!lock_user_struct(VERIFY_READ, target_mq_attr,
1380                           target_mq_attr_addr, 1))
1381         return -TARGET_EFAULT;
1382 
1383     __get_user(attr->mq_flags, &target_mq_attr->mq_flags);
1384     __get_user(attr->mq_maxmsg, &target_mq_attr->mq_maxmsg);
1385     __get_user(attr->mq_msgsize, &target_mq_attr->mq_msgsize);
1386     __get_user(attr->mq_curmsgs, &target_mq_attr->mq_curmsgs);
1387 
1388     unlock_user_struct(target_mq_attr, target_mq_attr_addr, 0);
1389 
1390     return 0;
1391 }
1392 
1393 static inline abi_long copy_to_user_mq_attr(abi_ulong target_mq_attr_addr,
1394                                             const struct mq_attr *attr)
1395 {
1396     struct target_mq_attr *target_mq_attr;
1397 
1398     if (!lock_user_struct(VERIFY_WRITE, target_mq_attr,
1399                           target_mq_attr_addr, 0))
1400         return -TARGET_EFAULT;
1401 
1402     __put_user(attr->mq_flags, &target_mq_attr->mq_flags);
1403     __put_user(attr->mq_maxmsg, &target_mq_attr->mq_maxmsg);
1404     __put_user(attr->mq_msgsize, &target_mq_attr->mq_msgsize);
1405     __put_user(attr->mq_curmsgs, &target_mq_attr->mq_curmsgs);
1406 
1407     unlock_user_struct(target_mq_attr, target_mq_attr_addr, 1);
1408 
1409     return 0;
1410 }
1411 #endif
1412 
1413 #if defined(TARGET_NR_select) || defined(TARGET_NR__newselect)
1414 /* do_select() must return target values and target errnos. */
1415 static abi_long do_select(int n,
1416                           abi_ulong rfd_addr, abi_ulong wfd_addr,
1417                           abi_ulong efd_addr, abi_ulong target_tv_addr)
1418 {
1419     fd_set rfds, wfds, efds;
1420     fd_set *rfds_ptr, *wfds_ptr, *efds_ptr;
1421     struct timeval tv;
1422     struct timespec ts, *ts_ptr;
1423     abi_long ret;
1424 
1425     ret = copy_from_user_fdset_ptr(&rfds, &rfds_ptr, rfd_addr, n);
1426     if (ret) {
1427         return ret;
1428     }
1429     ret = copy_from_user_fdset_ptr(&wfds, &wfds_ptr, wfd_addr, n);
1430     if (ret) {
1431         return ret;
1432     }
1433     ret = copy_from_user_fdset_ptr(&efds, &efds_ptr, efd_addr, n);
1434     if (ret) {
1435         return ret;
1436     }
1437 
1438     if (target_tv_addr) {
1439         if (copy_from_user_timeval(&tv, target_tv_addr))
1440             return -TARGET_EFAULT;
1441         ts.tv_sec = tv.tv_sec;
1442         ts.tv_nsec = tv.tv_usec * 1000;
1443         ts_ptr = &ts;
1444     } else {
1445         ts_ptr = NULL;
1446     }
1447 
1448     ret = get_errno(safe_pselect6(n, rfds_ptr, wfds_ptr, efds_ptr,
1449                                   ts_ptr, NULL));
1450 
1451     if (!is_error(ret)) {
1452         if (rfd_addr && copy_to_user_fdset(rfd_addr, &rfds, n))
1453             return -TARGET_EFAULT;
1454         if (wfd_addr && copy_to_user_fdset(wfd_addr, &wfds, n))
1455             return -TARGET_EFAULT;
1456         if (efd_addr && copy_to_user_fdset(efd_addr, &efds, n))
1457             return -TARGET_EFAULT;
1458 
1459         if (target_tv_addr) {
1460             tv.tv_sec = ts.tv_sec;
1461             tv.tv_usec = ts.tv_nsec / 1000;
1462             if (copy_to_user_timeval(target_tv_addr, &tv)) {
1463                 return -TARGET_EFAULT;
1464             }
1465         }
1466     }
1467 
1468     return ret;
1469 }
1470 
1471 #if defined(TARGET_WANT_OLD_SYS_SELECT)
1472 static abi_long do_old_select(abi_ulong arg1)
1473 {
1474     struct target_sel_arg_struct *sel;
1475     abi_ulong inp, outp, exp, tvp;
1476     long nsel;
1477 
1478     if (!lock_user_struct(VERIFY_READ, sel, arg1, 1)) {
1479         return -TARGET_EFAULT;
1480     }
1481 
1482     nsel = tswapal(sel->n);
1483     inp = tswapal(sel->inp);
1484     outp = tswapal(sel->outp);
1485     exp = tswapal(sel->exp);
1486     tvp = tswapal(sel->tvp);
1487 
1488     unlock_user_struct(sel, arg1, 0);
1489 
1490     return do_select(nsel, inp, outp, exp, tvp);
1491 }
1492 #endif
1493 #endif
1494 
1495 static abi_long do_pipe2(int host_pipe[], int flags)
1496 {
1497 #ifdef CONFIG_PIPE2
1498     return pipe2(host_pipe, flags);
1499 #else
1500     return -ENOSYS;
1501 #endif
1502 }
1503 
1504 static abi_long do_pipe(void *cpu_env, abi_ulong pipedes,
1505                         int flags, int is_pipe2)
1506 {
1507     int host_pipe[2];
1508     abi_long ret;
1509     ret = flags ? do_pipe2(host_pipe, flags) : pipe(host_pipe);
1510 
1511     if (is_error(ret))
1512         return get_errno(ret);
1513 
1514     /* Several targets have special calling conventions for the original
1515        pipe syscall, but didn't replicate this into the pipe2 syscall.  */
1516     if (!is_pipe2) {
1517 #if defined(TARGET_ALPHA)
1518         ((CPUAlphaState *)cpu_env)->ir[IR_A4] = host_pipe[1];
1519         return host_pipe[0];
1520 #elif defined(TARGET_MIPS)
1521         ((CPUMIPSState*)cpu_env)->active_tc.gpr[3] = host_pipe[1];
1522         return host_pipe[0];
1523 #elif defined(TARGET_SH4)
1524         ((CPUSH4State*)cpu_env)->gregs[1] = host_pipe[1];
1525         return host_pipe[0];
1526 #elif defined(TARGET_SPARC)
1527         ((CPUSPARCState*)cpu_env)->regwptr[1] = host_pipe[1];
1528         return host_pipe[0];
1529 #endif
1530     }
1531 
1532     if (put_user_s32(host_pipe[0], pipedes)
1533         || put_user_s32(host_pipe[1], pipedes + sizeof(host_pipe[0])))
1534         return -TARGET_EFAULT;
1535     return get_errno(ret);
1536 }
1537 
1538 static inline abi_long target_to_host_ip_mreq(struct ip_mreqn *mreqn,
1539                                               abi_ulong target_addr,
1540                                               socklen_t len)
1541 {
1542     struct target_ip_mreqn *target_smreqn;
1543 
1544     target_smreqn = lock_user(VERIFY_READ, target_addr, len, 1);
1545     if (!target_smreqn)
1546         return -TARGET_EFAULT;
1547     mreqn->imr_multiaddr.s_addr = target_smreqn->imr_multiaddr.s_addr;
1548     mreqn->imr_address.s_addr = target_smreqn->imr_address.s_addr;
1549     if (len == sizeof(struct target_ip_mreqn))
1550         mreqn->imr_ifindex = tswapal(target_smreqn->imr_ifindex);
1551     unlock_user(target_smreqn, target_addr, 0);
1552 
1553     return 0;
1554 }
1555 
1556 static inline abi_long target_to_host_sockaddr(int fd, struct sockaddr *addr,
1557                                                abi_ulong target_addr,
1558                                                socklen_t len)
1559 {
1560     const socklen_t unix_maxlen = sizeof (struct sockaddr_un);
1561     sa_family_t sa_family;
1562     struct target_sockaddr *target_saddr;
1563 
1564     if (fd_trans_target_to_host_addr(fd)) {
1565         return fd_trans_target_to_host_addr(fd)(addr, target_addr, len);
1566     }
1567 
1568     target_saddr = lock_user(VERIFY_READ, target_addr, len, 1);
1569     if (!target_saddr)
1570         return -TARGET_EFAULT;
1571 
1572     sa_family = tswap16(target_saddr->sa_family);
1573 
1574     /* Oops. The caller might send a incomplete sun_path; sun_path
1575      * must be terminated by \0 (see the manual page), but
1576      * unfortunately it is quite common to specify sockaddr_un
1577      * length as "strlen(x->sun_path)" while it should be
1578      * "strlen(...) + 1". We'll fix that here if needed.
1579      * Linux kernel has a similar feature.
1580      */
1581 
1582     if (sa_family == AF_UNIX) {
1583         if (len < unix_maxlen && len > 0) {
1584             char *cp = (char*)target_saddr;
1585 
1586             if ( cp[len-1] && !cp[len] )
1587                 len++;
1588         }
1589         if (len > unix_maxlen)
1590             len = unix_maxlen;
1591     }
1592 
1593     memcpy(addr, target_saddr, len);
1594     addr->sa_family = sa_family;
1595     if (sa_family == AF_NETLINK) {
1596         struct sockaddr_nl *nladdr;
1597 
1598         nladdr = (struct sockaddr_nl *)addr;
1599         nladdr->nl_pid = tswap32(nladdr->nl_pid);
1600         nladdr->nl_groups = tswap32(nladdr->nl_groups);
1601     } else if (sa_family == AF_PACKET) {
1602 	struct target_sockaddr_ll *lladdr;
1603 
1604 	lladdr = (struct target_sockaddr_ll *)addr;
1605 	lladdr->sll_ifindex = tswap32(lladdr->sll_ifindex);
1606 	lladdr->sll_hatype = tswap16(lladdr->sll_hatype);
1607     }
1608     unlock_user(target_saddr, target_addr, 0);
1609 
1610     return 0;
1611 }
1612 
1613 static inline abi_long host_to_target_sockaddr(abi_ulong target_addr,
1614                                                struct sockaddr *addr,
1615                                                socklen_t len)
1616 {
1617     struct target_sockaddr *target_saddr;
1618 
1619     if (len == 0) {
1620         return 0;
1621     }
1622 
1623     target_saddr = lock_user(VERIFY_WRITE, target_addr, len, 0);
1624     if (!target_saddr)
1625         return -TARGET_EFAULT;
1626     memcpy(target_saddr, addr, len);
1627     if (len >= offsetof(struct target_sockaddr, sa_family) +
1628         sizeof(target_saddr->sa_family)) {
1629         target_saddr->sa_family = tswap16(addr->sa_family);
1630     }
1631     if (addr->sa_family == AF_NETLINK && len >= sizeof(struct sockaddr_nl)) {
1632         struct sockaddr_nl *target_nl = (struct sockaddr_nl *)target_saddr;
1633         target_nl->nl_pid = tswap32(target_nl->nl_pid);
1634         target_nl->nl_groups = tswap32(target_nl->nl_groups);
1635     } else if (addr->sa_family == AF_PACKET) {
1636         struct sockaddr_ll *target_ll = (struct sockaddr_ll *)target_saddr;
1637         target_ll->sll_ifindex = tswap32(target_ll->sll_ifindex);
1638         target_ll->sll_hatype = tswap16(target_ll->sll_hatype);
1639     } else if (addr->sa_family == AF_INET6 &&
1640                len >= sizeof(struct target_sockaddr_in6)) {
1641         struct target_sockaddr_in6 *target_in6 =
1642                (struct target_sockaddr_in6 *)target_saddr;
1643         target_in6->sin6_scope_id = tswap16(target_in6->sin6_scope_id);
1644     }
1645     unlock_user(target_saddr, target_addr, len);
1646 
1647     return 0;
1648 }
1649 
1650 static inline abi_long target_to_host_cmsg(struct msghdr *msgh,
1651                                            struct target_msghdr *target_msgh)
1652 {
1653     struct cmsghdr *cmsg = CMSG_FIRSTHDR(msgh);
1654     abi_long msg_controllen;
1655     abi_ulong target_cmsg_addr;
1656     struct target_cmsghdr *target_cmsg, *target_cmsg_start;
1657     socklen_t space = 0;
1658 
1659     msg_controllen = tswapal(target_msgh->msg_controllen);
1660     if (msg_controllen < sizeof (struct target_cmsghdr))
1661         goto the_end;
1662     target_cmsg_addr = tswapal(target_msgh->msg_control);
1663     target_cmsg = lock_user(VERIFY_READ, target_cmsg_addr, msg_controllen, 1);
1664     target_cmsg_start = target_cmsg;
1665     if (!target_cmsg)
1666         return -TARGET_EFAULT;
1667 
1668     while (cmsg && target_cmsg) {
1669         void *data = CMSG_DATA(cmsg);
1670         void *target_data = TARGET_CMSG_DATA(target_cmsg);
1671 
1672         int len = tswapal(target_cmsg->cmsg_len)
1673                   - TARGET_CMSG_ALIGN(sizeof (struct target_cmsghdr));
1674 
1675         space += CMSG_SPACE(len);
1676         if (space > msgh->msg_controllen) {
1677             space -= CMSG_SPACE(len);
1678             /* This is a QEMU bug, since we allocated the payload
1679              * area ourselves (unlike overflow in host-to-target
1680              * conversion, which is just the guest giving us a buffer
1681              * that's too small). It can't happen for the payload types
1682              * we currently support; if it becomes an issue in future
1683              * we would need to improve our allocation strategy to
1684              * something more intelligent than "twice the size of the
1685              * target buffer we're reading from".
1686              */
1687             gemu_log("Host cmsg overflow\n");
1688             break;
1689         }
1690 
1691         if (tswap32(target_cmsg->cmsg_level) == TARGET_SOL_SOCKET) {
1692             cmsg->cmsg_level = SOL_SOCKET;
1693         } else {
1694             cmsg->cmsg_level = tswap32(target_cmsg->cmsg_level);
1695         }
1696         cmsg->cmsg_type = tswap32(target_cmsg->cmsg_type);
1697         cmsg->cmsg_len = CMSG_LEN(len);
1698 
1699         if (cmsg->cmsg_level == SOL_SOCKET && cmsg->cmsg_type == SCM_RIGHTS) {
1700             int *fd = (int *)data;
1701             int *target_fd = (int *)target_data;
1702             int i, numfds = len / sizeof(int);
1703 
1704             for (i = 0; i < numfds; i++) {
1705                 __get_user(fd[i], target_fd + i);
1706             }
1707         } else if (cmsg->cmsg_level == SOL_SOCKET
1708                &&  cmsg->cmsg_type == SCM_CREDENTIALS) {
1709             struct ucred *cred = (struct ucred *)data;
1710             struct target_ucred *target_cred =
1711                 (struct target_ucred *)target_data;
1712 
1713             __get_user(cred->pid, &target_cred->pid);
1714             __get_user(cred->uid, &target_cred->uid);
1715             __get_user(cred->gid, &target_cred->gid);
1716         } else {
1717             gemu_log("Unsupported ancillary data: %d/%d\n",
1718                                         cmsg->cmsg_level, cmsg->cmsg_type);
1719             memcpy(data, target_data, len);
1720         }
1721 
1722         cmsg = CMSG_NXTHDR(msgh, cmsg);
1723         target_cmsg = TARGET_CMSG_NXTHDR(target_msgh, target_cmsg,
1724                                          target_cmsg_start);
1725     }
1726     unlock_user(target_cmsg, target_cmsg_addr, 0);
1727  the_end:
1728     msgh->msg_controllen = space;
1729     return 0;
1730 }
1731 
1732 static inline abi_long host_to_target_cmsg(struct target_msghdr *target_msgh,
1733                                            struct msghdr *msgh)
1734 {
1735     struct cmsghdr *cmsg = CMSG_FIRSTHDR(msgh);
1736     abi_long msg_controllen;
1737     abi_ulong target_cmsg_addr;
1738     struct target_cmsghdr *target_cmsg, *target_cmsg_start;
1739     socklen_t space = 0;
1740 
1741     msg_controllen = tswapal(target_msgh->msg_controllen);
1742     if (msg_controllen < sizeof (struct target_cmsghdr))
1743         goto the_end;
1744     target_cmsg_addr = tswapal(target_msgh->msg_control);
1745     target_cmsg = lock_user(VERIFY_WRITE, target_cmsg_addr, msg_controllen, 0);
1746     target_cmsg_start = target_cmsg;
1747     if (!target_cmsg)
1748         return -TARGET_EFAULT;
1749 
1750     while (cmsg && target_cmsg) {
1751         void *data = CMSG_DATA(cmsg);
1752         void *target_data = TARGET_CMSG_DATA(target_cmsg);
1753 
1754         int len = cmsg->cmsg_len - CMSG_ALIGN(sizeof (struct cmsghdr));
1755         int tgt_len, tgt_space;
1756 
1757         /* We never copy a half-header but may copy half-data;
1758          * this is Linux's behaviour in put_cmsg(). Note that
1759          * truncation here is a guest problem (which we report
1760          * to the guest via the CTRUNC bit), unlike truncation
1761          * in target_to_host_cmsg, which is a QEMU bug.
1762          */
1763         if (msg_controllen < sizeof(struct cmsghdr)) {
1764             target_msgh->msg_flags |= tswap32(MSG_CTRUNC);
1765             break;
1766         }
1767 
1768         if (cmsg->cmsg_level == SOL_SOCKET) {
1769             target_cmsg->cmsg_level = tswap32(TARGET_SOL_SOCKET);
1770         } else {
1771             target_cmsg->cmsg_level = tswap32(cmsg->cmsg_level);
1772         }
1773         target_cmsg->cmsg_type = tswap32(cmsg->cmsg_type);
1774 
1775         tgt_len = TARGET_CMSG_LEN(len);
1776 
1777         /* Payload types which need a different size of payload on
1778          * the target must adjust tgt_len here.
1779          */
1780         switch (cmsg->cmsg_level) {
1781         case SOL_SOCKET:
1782             switch (cmsg->cmsg_type) {
1783             case SO_TIMESTAMP:
1784                 tgt_len = sizeof(struct target_timeval);
1785                 break;
1786             default:
1787                 break;
1788             }
1789         default:
1790             break;
1791         }
1792 
1793         if (msg_controllen < tgt_len) {
1794             target_msgh->msg_flags |= tswap32(MSG_CTRUNC);
1795             tgt_len = msg_controllen;
1796         }
1797 
1798         /* We must now copy-and-convert len bytes of payload
1799          * into tgt_len bytes of destination space. Bear in mind
1800          * that in both source and destination we may be dealing
1801          * with a truncated value!
1802          */
1803         switch (cmsg->cmsg_level) {
1804         case SOL_SOCKET:
1805             switch (cmsg->cmsg_type) {
1806             case SCM_RIGHTS:
1807             {
1808                 int *fd = (int *)data;
1809                 int *target_fd = (int *)target_data;
1810                 int i, numfds = tgt_len / sizeof(int);
1811 
1812                 for (i = 0; i < numfds; i++) {
1813                     __put_user(fd[i], target_fd + i);
1814                 }
1815                 break;
1816             }
1817             case SO_TIMESTAMP:
1818             {
1819                 struct timeval *tv = (struct timeval *)data;
1820                 struct target_timeval *target_tv =
1821                     (struct target_timeval *)target_data;
1822 
1823                 if (len != sizeof(struct timeval) ||
1824                     tgt_len != sizeof(struct target_timeval)) {
1825                     goto unimplemented;
1826                 }
1827 
1828                 /* copy struct timeval to target */
1829                 __put_user(tv->tv_sec, &target_tv->tv_sec);
1830                 __put_user(tv->tv_usec, &target_tv->tv_usec);
1831                 break;
1832             }
1833             case SCM_CREDENTIALS:
1834             {
1835                 struct ucred *cred = (struct ucred *)data;
1836                 struct target_ucred *target_cred =
1837                     (struct target_ucred *)target_data;
1838 
1839                 __put_user(cred->pid, &target_cred->pid);
1840                 __put_user(cred->uid, &target_cred->uid);
1841                 __put_user(cred->gid, &target_cred->gid);
1842                 break;
1843             }
1844             default:
1845                 goto unimplemented;
1846             }
1847             break;
1848 
1849         case SOL_IP:
1850             switch (cmsg->cmsg_type) {
1851             case IP_TTL:
1852             {
1853                 uint32_t *v = (uint32_t *)data;
1854                 uint32_t *t_int = (uint32_t *)target_data;
1855 
1856                 __put_user(*v, t_int);
1857                 break;
1858             }
1859             case IP_RECVERR:
1860             {
1861                 struct errhdr_t {
1862                    struct sock_extended_err ee;
1863                    struct sockaddr_in offender;
1864                 };
1865                 struct errhdr_t *errh = (struct errhdr_t *)data;
1866                 struct errhdr_t *target_errh =
1867                     (struct errhdr_t *)target_data;
1868 
1869                 __put_user(errh->ee.ee_errno, &target_errh->ee.ee_errno);
1870                 __put_user(errh->ee.ee_origin, &target_errh->ee.ee_origin);
1871                 __put_user(errh->ee.ee_type,  &target_errh->ee.ee_type);
1872                 __put_user(errh->ee.ee_code, &target_errh->ee.ee_code);
1873                 __put_user(errh->ee.ee_pad, &target_errh->ee.ee_pad);
1874                 __put_user(errh->ee.ee_info, &target_errh->ee.ee_info);
1875                 __put_user(errh->ee.ee_data, &target_errh->ee.ee_data);
1876                 host_to_target_sockaddr((unsigned long) &target_errh->offender,
1877                     (void *) &errh->offender, sizeof(errh->offender));
1878                 break;
1879             }
1880             default:
1881                 goto unimplemented;
1882             }
1883             break;
1884 
1885         case SOL_IPV6:
1886             switch (cmsg->cmsg_type) {
1887             case IPV6_HOPLIMIT:
1888             {
1889                 uint32_t *v = (uint32_t *)data;
1890                 uint32_t *t_int = (uint32_t *)target_data;
1891 
1892                 __put_user(*v, t_int);
1893                 break;
1894             }
1895             case IPV6_RECVERR:
1896             {
1897                 struct errhdr6_t {
1898                    struct sock_extended_err ee;
1899                    struct sockaddr_in6 offender;
1900                 };
1901                 struct errhdr6_t *errh = (struct errhdr6_t *)data;
1902                 struct errhdr6_t *target_errh =
1903                     (struct errhdr6_t *)target_data;
1904 
1905                 __put_user(errh->ee.ee_errno, &target_errh->ee.ee_errno);
1906                 __put_user(errh->ee.ee_origin, &target_errh->ee.ee_origin);
1907                 __put_user(errh->ee.ee_type,  &target_errh->ee.ee_type);
1908                 __put_user(errh->ee.ee_code, &target_errh->ee.ee_code);
1909                 __put_user(errh->ee.ee_pad, &target_errh->ee.ee_pad);
1910                 __put_user(errh->ee.ee_info, &target_errh->ee.ee_info);
1911                 __put_user(errh->ee.ee_data, &target_errh->ee.ee_data);
1912                 host_to_target_sockaddr((unsigned long) &target_errh->offender,
1913                     (void *) &errh->offender, sizeof(errh->offender));
1914                 break;
1915             }
1916             default:
1917                 goto unimplemented;
1918             }
1919             break;
1920 
1921         default:
1922         unimplemented:
1923             gemu_log("Unsupported ancillary data: %d/%d\n",
1924                                         cmsg->cmsg_level, cmsg->cmsg_type);
1925             memcpy(target_data, data, MIN(len, tgt_len));
1926             if (tgt_len > len) {
1927                 memset(target_data + len, 0, tgt_len - len);
1928             }
1929         }
1930 
1931         target_cmsg->cmsg_len = tswapal(tgt_len);
1932         tgt_space = TARGET_CMSG_SPACE(len);
1933         if (msg_controllen < tgt_space) {
1934             tgt_space = msg_controllen;
1935         }
1936         msg_controllen -= tgt_space;
1937         space += tgt_space;
1938         cmsg = CMSG_NXTHDR(msgh, cmsg);
1939         target_cmsg = TARGET_CMSG_NXTHDR(target_msgh, target_cmsg,
1940                                          target_cmsg_start);
1941     }
1942     unlock_user(target_cmsg, target_cmsg_addr, space);
1943  the_end:
1944     target_msgh->msg_controllen = tswapal(space);
1945     return 0;
1946 }
1947 
1948 static void tswap_nlmsghdr(struct nlmsghdr *nlh)
1949 {
1950     nlh->nlmsg_len = tswap32(nlh->nlmsg_len);
1951     nlh->nlmsg_type = tswap16(nlh->nlmsg_type);
1952     nlh->nlmsg_flags = tswap16(nlh->nlmsg_flags);
1953     nlh->nlmsg_seq = tswap32(nlh->nlmsg_seq);
1954     nlh->nlmsg_pid = tswap32(nlh->nlmsg_pid);
1955 }
1956 
1957 static abi_long host_to_target_for_each_nlmsg(struct nlmsghdr *nlh,
1958                                               size_t len,
1959                                               abi_long (*host_to_target_nlmsg)
1960                                                        (struct nlmsghdr *))
1961 {
1962     uint32_t nlmsg_len;
1963     abi_long ret;
1964 
1965     while (len > sizeof(struct nlmsghdr)) {
1966 
1967         nlmsg_len = nlh->nlmsg_len;
1968         if (nlmsg_len < sizeof(struct nlmsghdr) ||
1969             nlmsg_len > len) {
1970             break;
1971         }
1972 
1973         switch (nlh->nlmsg_type) {
1974         case NLMSG_DONE:
1975             tswap_nlmsghdr(nlh);
1976             return 0;
1977         case NLMSG_NOOP:
1978             break;
1979         case NLMSG_ERROR:
1980         {
1981             struct nlmsgerr *e = NLMSG_DATA(nlh);
1982             e->error = tswap32(e->error);
1983             tswap_nlmsghdr(&e->msg);
1984             tswap_nlmsghdr(nlh);
1985             return 0;
1986         }
1987         default:
1988             ret = host_to_target_nlmsg(nlh);
1989             if (ret < 0) {
1990                 tswap_nlmsghdr(nlh);
1991                 return ret;
1992             }
1993             break;
1994         }
1995         tswap_nlmsghdr(nlh);
1996         len -= NLMSG_ALIGN(nlmsg_len);
1997         nlh = (struct nlmsghdr *)(((char*)nlh) + NLMSG_ALIGN(nlmsg_len));
1998     }
1999     return 0;
2000 }
2001 
2002 static abi_long target_to_host_for_each_nlmsg(struct nlmsghdr *nlh,
2003                                               size_t len,
2004                                               abi_long (*target_to_host_nlmsg)
2005                                                        (struct nlmsghdr *))
2006 {
2007     int ret;
2008 
2009     while (len > sizeof(struct nlmsghdr)) {
2010         if (tswap32(nlh->nlmsg_len) < sizeof(struct nlmsghdr) ||
2011             tswap32(nlh->nlmsg_len) > len) {
2012             break;
2013         }
2014         tswap_nlmsghdr(nlh);
2015         switch (nlh->nlmsg_type) {
2016         case NLMSG_DONE:
2017             return 0;
2018         case NLMSG_NOOP:
2019             break;
2020         case NLMSG_ERROR:
2021         {
2022             struct nlmsgerr *e = NLMSG_DATA(nlh);
2023             e->error = tswap32(e->error);
2024             tswap_nlmsghdr(&e->msg);
2025             return 0;
2026         }
2027         default:
2028             ret = target_to_host_nlmsg(nlh);
2029             if (ret < 0) {
2030                 return ret;
2031             }
2032         }
2033         len -= NLMSG_ALIGN(nlh->nlmsg_len);
2034         nlh = (struct nlmsghdr *)(((char *)nlh) + NLMSG_ALIGN(nlh->nlmsg_len));
2035     }
2036     return 0;
2037 }
2038 
2039 #ifdef CONFIG_RTNETLINK
2040 static abi_long host_to_target_for_each_nlattr(struct nlattr *nlattr,
2041                                                size_t len, void *context,
2042                                                abi_long (*host_to_target_nlattr)
2043                                                         (struct nlattr *,
2044                                                          void *context))
2045 {
2046     unsigned short nla_len;
2047     abi_long ret;
2048 
2049     while (len > sizeof(struct nlattr)) {
2050         nla_len = nlattr->nla_len;
2051         if (nla_len < sizeof(struct nlattr) ||
2052             nla_len > len) {
2053             break;
2054         }
2055         ret = host_to_target_nlattr(nlattr, context);
2056         nlattr->nla_len = tswap16(nlattr->nla_len);
2057         nlattr->nla_type = tswap16(nlattr->nla_type);
2058         if (ret < 0) {
2059             return ret;
2060         }
2061         len -= NLA_ALIGN(nla_len);
2062         nlattr = (struct nlattr *)(((char *)nlattr) + NLA_ALIGN(nla_len));
2063     }
2064     return 0;
2065 }
2066 
2067 static abi_long host_to_target_for_each_rtattr(struct rtattr *rtattr,
2068                                                size_t len,
2069                                                abi_long (*host_to_target_rtattr)
2070                                                         (struct rtattr *))
2071 {
2072     unsigned short rta_len;
2073     abi_long ret;
2074 
2075     while (len > sizeof(struct rtattr)) {
2076         rta_len = rtattr->rta_len;
2077         if (rta_len < sizeof(struct rtattr) ||
2078             rta_len > len) {
2079             break;
2080         }
2081         ret = host_to_target_rtattr(rtattr);
2082         rtattr->rta_len = tswap16(rtattr->rta_len);
2083         rtattr->rta_type = tswap16(rtattr->rta_type);
2084         if (ret < 0) {
2085             return ret;
2086         }
2087         len -= RTA_ALIGN(rta_len);
2088         rtattr = (struct rtattr *)(((char *)rtattr) + RTA_ALIGN(rta_len));
2089     }
2090     return 0;
2091 }
2092 
2093 #define NLA_DATA(nla) ((void *)((char *)(nla)) + NLA_HDRLEN)
2094 
2095 static abi_long host_to_target_data_bridge_nlattr(struct nlattr *nlattr,
2096                                                   void *context)
2097 {
2098     uint16_t *u16;
2099     uint32_t *u32;
2100     uint64_t *u64;
2101 
2102     switch (nlattr->nla_type) {
2103     /* no data */
2104     case QEMU_IFLA_BR_FDB_FLUSH:
2105         break;
2106     /* binary */
2107     case QEMU_IFLA_BR_GROUP_ADDR:
2108         break;
2109     /* uint8_t */
2110     case QEMU_IFLA_BR_VLAN_FILTERING:
2111     case QEMU_IFLA_BR_TOPOLOGY_CHANGE:
2112     case QEMU_IFLA_BR_TOPOLOGY_CHANGE_DETECTED:
2113     case QEMU_IFLA_BR_MCAST_ROUTER:
2114     case QEMU_IFLA_BR_MCAST_SNOOPING:
2115     case QEMU_IFLA_BR_MCAST_QUERY_USE_IFADDR:
2116     case QEMU_IFLA_BR_MCAST_QUERIER:
2117     case QEMU_IFLA_BR_NF_CALL_IPTABLES:
2118     case QEMU_IFLA_BR_NF_CALL_IP6TABLES:
2119     case QEMU_IFLA_BR_NF_CALL_ARPTABLES:
2120         break;
2121     /* uint16_t */
2122     case QEMU_IFLA_BR_PRIORITY:
2123     case QEMU_IFLA_BR_VLAN_PROTOCOL:
2124     case QEMU_IFLA_BR_GROUP_FWD_MASK:
2125     case QEMU_IFLA_BR_ROOT_PORT:
2126     case QEMU_IFLA_BR_VLAN_DEFAULT_PVID:
2127         u16 = NLA_DATA(nlattr);
2128         *u16 = tswap16(*u16);
2129         break;
2130     /* uint32_t */
2131     case QEMU_IFLA_BR_FORWARD_DELAY:
2132     case QEMU_IFLA_BR_HELLO_TIME:
2133     case QEMU_IFLA_BR_MAX_AGE:
2134     case QEMU_IFLA_BR_AGEING_TIME:
2135     case QEMU_IFLA_BR_STP_STATE:
2136     case QEMU_IFLA_BR_ROOT_PATH_COST:
2137     case QEMU_IFLA_BR_MCAST_HASH_ELASTICITY:
2138     case QEMU_IFLA_BR_MCAST_HASH_MAX:
2139     case QEMU_IFLA_BR_MCAST_LAST_MEMBER_CNT:
2140     case QEMU_IFLA_BR_MCAST_STARTUP_QUERY_CNT:
2141         u32 = NLA_DATA(nlattr);
2142         *u32 = tswap32(*u32);
2143         break;
2144     /* uint64_t */
2145     case QEMU_IFLA_BR_HELLO_TIMER:
2146     case QEMU_IFLA_BR_TCN_TIMER:
2147     case QEMU_IFLA_BR_GC_TIMER:
2148     case QEMU_IFLA_BR_TOPOLOGY_CHANGE_TIMER:
2149     case QEMU_IFLA_BR_MCAST_LAST_MEMBER_INTVL:
2150     case QEMU_IFLA_BR_MCAST_MEMBERSHIP_INTVL:
2151     case QEMU_IFLA_BR_MCAST_QUERIER_INTVL:
2152     case QEMU_IFLA_BR_MCAST_QUERY_INTVL:
2153     case QEMU_IFLA_BR_MCAST_QUERY_RESPONSE_INTVL:
2154     case QEMU_IFLA_BR_MCAST_STARTUP_QUERY_INTVL:
2155         u64 = NLA_DATA(nlattr);
2156         *u64 = tswap64(*u64);
2157         break;
2158     /* ifla_bridge_id: uin8_t[] */
2159     case QEMU_IFLA_BR_ROOT_ID:
2160     case QEMU_IFLA_BR_BRIDGE_ID:
2161         break;
2162     default:
2163         gemu_log("Unknown QEMU_IFLA_BR type %d\n", nlattr->nla_type);
2164         break;
2165     }
2166     return 0;
2167 }
2168 
2169 static abi_long host_to_target_slave_data_bridge_nlattr(struct nlattr *nlattr,
2170                                                         void *context)
2171 {
2172     uint16_t *u16;
2173     uint32_t *u32;
2174     uint64_t *u64;
2175 
2176     switch (nlattr->nla_type) {
2177     /* uint8_t */
2178     case QEMU_IFLA_BRPORT_STATE:
2179     case QEMU_IFLA_BRPORT_MODE:
2180     case QEMU_IFLA_BRPORT_GUARD:
2181     case QEMU_IFLA_BRPORT_PROTECT:
2182     case QEMU_IFLA_BRPORT_FAST_LEAVE:
2183     case QEMU_IFLA_BRPORT_LEARNING:
2184     case QEMU_IFLA_BRPORT_UNICAST_FLOOD:
2185     case QEMU_IFLA_BRPORT_PROXYARP:
2186     case QEMU_IFLA_BRPORT_LEARNING_SYNC:
2187     case QEMU_IFLA_BRPORT_PROXYARP_WIFI:
2188     case QEMU_IFLA_BRPORT_TOPOLOGY_CHANGE_ACK:
2189     case QEMU_IFLA_BRPORT_CONFIG_PENDING:
2190     case QEMU_IFLA_BRPORT_MULTICAST_ROUTER:
2191         break;
2192     /* uint16_t */
2193     case QEMU_IFLA_BRPORT_PRIORITY:
2194     case QEMU_IFLA_BRPORT_DESIGNATED_PORT:
2195     case QEMU_IFLA_BRPORT_DESIGNATED_COST:
2196     case QEMU_IFLA_BRPORT_ID:
2197     case QEMU_IFLA_BRPORT_NO:
2198         u16 = NLA_DATA(nlattr);
2199         *u16 = tswap16(*u16);
2200         break;
2201     /* uin32_t */
2202     case QEMU_IFLA_BRPORT_COST:
2203         u32 = NLA_DATA(nlattr);
2204         *u32 = tswap32(*u32);
2205         break;
2206     /* uint64_t */
2207     case QEMU_IFLA_BRPORT_MESSAGE_AGE_TIMER:
2208     case QEMU_IFLA_BRPORT_FORWARD_DELAY_TIMER:
2209     case QEMU_IFLA_BRPORT_HOLD_TIMER:
2210         u64 = NLA_DATA(nlattr);
2211         *u64 = tswap64(*u64);
2212         break;
2213     /* ifla_bridge_id: uint8_t[] */
2214     case QEMU_IFLA_BRPORT_ROOT_ID:
2215     case QEMU_IFLA_BRPORT_BRIDGE_ID:
2216         break;
2217     default:
2218         gemu_log("Unknown QEMU_IFLA_BRPORT type %d\n", nlattr->nla_type);
2219         break;
2220     }
2221     return 0;
2222 }
2223 
2224 struct linkinfo_context {
2225     int len;
2226     char *name;
2227     int slave_len;
2228     char *slave_name;
2229 };
2230 
2231 static abi_long host_to_target_data_linkinfo_nlattr(struct nlattr *nlattr,
2232                                                     void *context)
2233 {
2234     struct linkinfo_context *li_context = context;
2235 
2236     switch (nlattr->nla_type) {
2237     /* string */
2238     case QEMU_IFLA_INFO_KIND:
2239         li_context->name = NLA_DATA(nlattr);
2240         li_context->len = nlattr->nla_len - NLA_HDRLEN;
2241         break;
2242     case QEMU_IFLA_INFO_SLAVE_KIND:
2243         li_context->slave_name = NLA_DATA(nlattr);
2244         li_context->slave_len = nlattr->nla_len - NLA_HDRLEN;
2245         break;
2246     /* stats */
2247     case QEMU_IFLA_INFO_XSTATS:
2248         /* FIXME: only used by CAN */
2249         break;
2250     /* nested */
2251     case QEMU_IFLA_INFO_DATA:
2252         if (strncmp(li_context->name, "bridge",
2253                     li_context->len) == 0) {
2254             return host_to_target_for_each_nlattr(NLA_DATA(nlattr),
2255                                                   nlattr->nla_len,
2256                                                   NULL,
2257                                              host_to_target_data_bridge_nlattr);
2258         } else {
2259             gemu_log("Unknown QEMU_IFLA_INFO_KIND %s\n", li_context->name);
2260         }
2261         break;
2262     case QEMU_IFLA_INFO_SLAVE_DATA:
2263         if (strncmp(li_context->slave_name, "bridge",
2264                     li_context->slave_len) == 0) {
2265             return host_to_target_for_each_nlattr(NLA_DATA(nlattr),
2266                                                   nlattr->nla_len,
2267                                                   NULL,
2268                                        host_to_target_slave_data_bridge_nlattr);
2269         } else {
2270             gemu_log("Unknown QEMU_IFLA_INFO_SLAVE_KIND %s\n",
2271                      li_context->slave_name);
2272         }
2273         break;
2274     default:
2275         gemu_log("Unknown host QEMU_IFLA_INFO type: %d\n", nlattr->nla_type);
2276         break;
2277     }
2278 
2279     return 0;
2280 }
2281 
2282 static abi_long host_to_target_data_inet_nlattr(struct nlattr *nlattr,
2283                                                 void *context)
2284 {
2285     uint32_t *u32;
2286     int i;
2287 
2288     switch (nlattr->nla_type) {
2289     case QEMU_IFLA_INET_CONF:
2290         u32 = NLA_DATA(nlattr);
2291         for (i = 0; i < (nlattr->nla_len - NLA_HDRLEN) / sizeof(*u32);
2292              i++) {
2293             u32[i] = tswap32(u32[i]);
2294         }
2295         break;
2296     default:
2297         gemu_log("Unknown host AF_INET type: %d\n", nlattr->nla_type);
2298     }
2299     return 0;
2300 }
2301 
2302 static abi_long host_to_target_data_inet6_nlattr(struct nlattr *nlattr,
2303                                                 void *context)
2304 {
2305     uint32_t *u32;
2306     uint64_t *u64;
2307     struct ifla_cacheinfo *ci;
2308     int i;
2309 
2310     switch (nlattr->nla_type) {
2311     /* binaries */
2312     case QEMU_IFLA_INET6_TOKEN:
2313         break;
2314     /* uint8_t */
2315     case QEMU_IFLA_INET6_ADDR_GEN_MODE:
2316         break;
2317     /* uint32_t */
2318     case QEMU_IFLA_INET6_FLAGS:
2319         u32 = NLA_DATA(nlattr);
2320         *u32 = tswap32(*u32);
2321         break;
2322     /* uint32_t[] */
2323     case QEMU_IFLA_INET6_CONF:
2324         u32 = NLA_DATA(nlattr);
2325         for (i = 0; i < (nlattr->nla_len - NLA_HDRLEN) / sizeof(*u32);
2326              i++) {
2327             u32[i] = tswap32(u32[i]);
2328         }
2329         break;
2330     /* ifla_cacheinfo */
2331     case QEMU_IFLA_INET6_CACHEINFO:
2332         ci = NLA_DATA(nlattr);
2333         ci->max_reasm_len = tswap32(ci->max_reasm_len);
2334         ci->tstamp = tswap32(ci->tstamp);
2335         ci->reachable_time = tswap32(ci->reachable_time);
2336         ci->retrans_time = tswap32(ci->retrans_time);
2337         break;
2338     /* uint64_t[] */
2339     case QEMU_IFLA_INET6_STATS:
2340     case QEMU_IFLA_INET6_ICMP6STATS:
2341         u64 = NLA_DATA(nlattr);
2342         for (i = 0; i < (nlattr->nla_len - NLA_HDRLEN) / sizeof(*u64);
2343              i++) {
2344             u64[i] = tswap64(u64[i]);
2345         }
2346         break;
2347     default:
2348         gemu_log("Unknown host AF_INET6 type: %d\n", nlattr->nla_type);
2349     }
2350     return 0;
2351 }
2352 
2353 static abi_long host_to_target_data_spec_nlattr(struct nlattr *nlattr,
2354                                                     void *context)
2355 {
2356     switch (nlattr->nla_type) {
2357     case AF_INET:
2358         return host_to_target_for_each_nlattr(NLA_DATA(nlattr), nlattr->nla_len,
2359                                               NULL,
2360                                              host_to_target_data_inet_nlattr);
2361     case AF_INET6:
2362         return host_to_target_for_each_nlattr(NLA_DATA(nlattr), nlattr->nla_len,
2363                                               NULL,
2364                                              host_to_target_data_inet6_nlattr);
2365     default:
2366         gemu_log("Unknown host AF_SPEC type: %d\n", nlattr->nla_type);
2367         break;
2368     }
2369     return 0;
2370 }
2371 
2372 static abi_long host_to_target_data_link_rtattr(struct rtattr *rtattr)
2373 {
2374     uint32_t *u32;
2375     struct rtnl_link_stats *st;
2376     struct rtnl_link_stats64 *st64;
2377     struct rtnl_link_ifmap *map;
2378     struct linkinfo_context li_context;
2379 
2380     switch (rtattr->rta_type) {
2381     /* binary stream */
2382     case QEMU_IFLA_ADDRESS:
2383     case QEMU_IFLA_BROADCAST:
2384     /* string */
2385     case QEMU_IFLA_IFNAME:
2386     case QEMU_IFLA_QDISC:
2387         break;
2388     /* uin8_t */
2389     case QEMU_IFLA_OPERSTATE:
2390     case QEMU_IFLA_LINKMODE:
2391     case QEMU_IFLA_CARRIER:
2392     case QEMU_IFLA_PROTO_DOWN:
2393         break;
2394     /* uint32_t */
2395     case QEMU_IFLA_MTU:
2396     case QEMU_IFLA_LINK:
2397     case QEMU_IFLA_WEIGHT:
2398     case QEMU_IFLA_TXQLEN:
2399     case QEMU_IFLA_CARRIER_CHANGES:
2400     case QEMU_IFLA_NUM_RX_QUEUES:
2401     case QEMU_IFLA_NUM_TX_QUEUES:
2402     case QEMU_IFLA_PROMISCUITY:
2403     case QEMU_IFLA_EXT_MASK:
2404     case QEMU_IFLA_LINK_NETNSID:
2405     case QEMU_IFLA_GROUP:
2406     case QEMU_IFLA_MASTER:
2407     case QEMU_IFLA_NUM_VF:
2408     case QEMU_IFLA_GSO_MAX_SEGS:
2409     case QEMU_IFLA_GSO_MAX_SIZE:
2410         u32 = RTA_DATA(rtattr);
2411         *u32 = tswap32(*u32);
2412         break;
2413     /* struct rtnl_link_stats */
2414     case QEMU_IFLA_STATS:
2415         st = RTA_DATA(rtattr);
2416         st->rx_packets = tswap32(st->rx_packets);
2417         st->tx_packets = tswap32(st->tx_packets);
2418         st->rx_bytes = tswap32(st->rx_bytes);
2419         st->tx_bytes = tswap32(st->tx_bytes);
2420         st->rx_errors = tswap32(st->rx_errors);
2421         st->tx_errors = tswap32(st->tx_errors);
2422         st->rx_dropped = tswap32(st->rx_dropped);
2423         st->tx_dropped = tswap32(st->tx_dropped);
2424         st->multicast = tswap32(st->multicast);
2425         st->collisions = tswap32(st->collisions);
2426 
2427         /* detailed rx_errors: */
2428         st->rx_length_errors = tswap32(st->rx_length_errors);
2429         st->rx_over_errors = tswap32(st->rx_over_errors);
2430         st->rx_crc_errors = tswap32(st->rx_crc_errors);
2431         st->rx_frame_errors = tswap32(st->rx_frame_errors);
2432         st->rx_fifo_errors = tswap32(st->rx_fifo_errors);
2433         st->rx_missed_errors = tswap32(st->rx_missed_errors);
2434 
2435         /* detailed tx_errors */
2436         st->tx_aborted_errors = tswap32(st->tx_aborted_errors);
2437         st->tx_carrier_errors = tswap32(st->tx_carrier_errors);
2438         st->tx_fifo_errors = tswap32(st->tx_fifo_errors);
2439         st->tx_heartbeat_errors = tswap32(st->tx_heartbeat_errors);
2440         st->tx_window_errors = tswap32(st->tx_window_errors);
2441 
2442         /* for cslip etc */
2443         st->rx_compressed = tswap32(st->rx_compressed);
2444         st->tx_compressed = tswap32(st->tx_compressed);
2445         break;
2446     /* struct rtnl_link_stats64 */
2447     case QEMU_IFLA_STATS64:
2448         st64 = RTA_DATA(rtattr);
2449         st64->rx_packets = tswap64(st64->rx_packets);
2450         st64->tx_packets = tswap64(st64->tx_packets);
2451         st64->rx_bytes = tswap64(st64->rx_bytes);
2452         st64->tx_bytes = tswap64(st64->tx_bytes);
2453         st64->rx_errors = tswap64(st64->rx_errors);
2454         st64->tx_errors = tswap64(st64->tx_errors);
2455         st64->rx_dropped = tswap64(st64->rx_dropped);
2456         st64->tx_dropped = tswap64(st64->tx_dropped);
2457         st64->multicast = tswap64(st64->multicast);
2458         st64->collisions = tswap64(st64->collisions);
2459 
2460         /* detailed rx_errors: */
2461         st64->rx_length_errors = tswap64(st64->rx_length_errors);
2462         st64->rx_over_errors = tswap64(st64->rx_over_errors);
2463         st64->rx_crc_errors = tswap64(st64->rx_crc_errors);
2464         st64->rx_frame_errors = tswap64(st64->rx_frame_errors);
2465         st64->rx_fifo_errors = tswap64(st64->rx_fifo_errors);
2466         st64->rx_missed_errors = tswap64(st64->rx_missed_errors);
2467 
2468         /* detailed tx_errors */
2469         st64->tx_aborted_errors = tswap64(st64->tx_aborted_errors);
2470         st64->tx_carrier_errors = tswap64(st64->tx_carrier_errors);
2471         st64->tx_fifo_errors = tswap64(st64->tx_fifo_errors);
2472         st64->tx_heartbeat_errors = tswap64(st64->tx_heartbeat_errors);
2473         st64->tx_window_errors = tswap64(st64->tx_window_errors);
2474 
2475         /* for cslip etc */
2476         st64->rx_compressed = tswap64(st64->rx_compressed);
2477         st64->tx_compressed = tswap64(st64->tx_compressed);
2478         break;
2479     /* struct rtnl_link_ifmap */
2480     case QEMU_IFLA_MAP:
2481         map = RTA_DATA(rtattr);
2482         map->mem_start = tswap64(map->mem_start);
2483         map->mem_end = tswap64(map->mem_end);
2484         map->base_addr = tswap64(map->base_addr);
2485         map->irq = tswap16(map->irq);
2486         break;
2487     /* nested */
2488     case QEMU_IFLA_LINKINFO:
2489         memset(&li_context, 0, sizeof(li_context));
2490         return host_to_target_for_each_nlattr(RTA_DATA(rtattr), rtattr->rta_len,
2491                                               &li_context,
2492                                            host_to_target_data_linkinfo_nlattr);
2493     case QEMU_IFLA_AF_SPEC:
2494         return host_to_target_for_each_nlattr(RTA_DATA(rtattr), rtattr->rta_len,
2495                                               NULL,
2496                                              host_to_target_data_spec_nlattr);
2497     default:
2498         gemu_log("Unknown host QEMU_IFLA type: %d\n", rtattr->rta_type);
2499         break;
2500     }
2501     return 0;
2502 }
2503 
2504 static abi_long host_to_target_data_addr_rtattr(struct rtattr *rtattr)
2505 {
2506     uint32_t *u32;
2507     struct ifa_cacheinfo *ci;
2508 
2509     switch (rtattr->rta_type) {
2510     /* binary: depends on family type */
2511     case IFA_ADDRESS:
2512     case IFA_LOCAL:
2513         break;
2514     /* string */
2515     case IFA_LABEL:
2516         break;
2517     /* u32 */
2518     case IFA_FLAGS:
2519     case IFA_BROADCAST:
2520         u32 = RTA_DATA(rtattr);
2521         *u32 = tswap32(*u32);
2522         break;
2523     /* struct ifa_cacheinfo */
2524     case IFA_CACHEINFO:
2525         ci = RTA_DATA(rtattr);
2526         ci->ifa_prefered = tswap32(ci->ifa_prefered);
2527         ci->ifa_valid = tswap32(ci->ifa_valid);
2528         ci->cstamp = tswap32(ci->cstamp);
2529         ci->tstamp = tswap32(ci->tstamp);
2530         break;
2531     default:
2532         gemu_log("Unknown host IFA type: %d\n", rtattr->rta_type);
2533         break;
2534     }
2535     return 0;
2536 }
2537 
2538 static abi_long host_to_target_data_route_rtattr(struct rtattr *rtattr)
2539 {
2540     uint32_t *u32;
2541     switch (rtattr->rta_type) {
2542     /* binary: depends on family type */
2543     case RTA_GATEWAY:
2544     case RTA_DST:
2545     case RTA_PREFSRC:
2546         break;
2547     /* u32 */
2548     case RTA_PRIORITY:
2549     case RTA_TABLE:
2550     case RTA_OIF:
2551         u32 = RTA_DATA(rtattr);
2552         *u32 = tswap32(*u32);
2553         break;
2554     default:
2555         gemu_log("Unknown host RTA type: %d\n", rtattr->rta_type);
2556         break;
2557     }
2558     return 0;
2559 }
2560 
2561 static abi_long host_to_target_link_rtattr(struct rtattr *rtattr,
2562                                          uint32_t rtattr_len)
2563 {
2564     return host_to_target_for_each_rtattr(rtattr, rtattr_len,
2565                                           host_to_target_data_link_rtattr);
2566 }
2567 
2568 static abi_long host_to_target_addr_rtattr(struct rtattr *rtattr,
2569                                          uint32_t rtattr_len)
2570 {
2571     return host_to_target_for_each_rtattr(rtattr, rtattr_len,
2572                                           host_to_target_data_addr_rtattr);
2573 }
2574 
2575 static abi_long host_to_target_route_rtattr(struct rtattr *rtattr,
2576                                          uint32_t rtattr_len)
2577 {
2578     return host_to_target_for_each_rtattr(rtattr, rtattr_len,
2579                                           host_to_target_data_route_rtattr);
2580 }
2581 
2582 static abi_long host_to_target_data_route(struct nlmsghdr *nlh)
2583 {
2584     uint32_t nlmsg_len;
2585     struct ifinfomsg *ifi;
2586     struct ifaddrmsg *ifa;
2587     struct rtmsg *rtm;
2588 
2589     nlmsg_len = nlh->nlmsg_len;
2590     switch (nlh->nlmsg_type) {
2591     case RTM_NEWLINK:
2592     case RTM_DELLINK:
2593     case RTM_GETLINK:
2594         if (nlh->nlmsg_len >= NLMSG_LENGTH(sizeof(*ifi))) {
2595             ifi = NLMSG_DATA(nlh);
2596             ifi->ifi_type = tswap16(ifi->ifi_type);
2597             ifi->ifi_index = tswap32(ifi->ifi_index);
2598             ifi->ifi_flags = tswap32(ifi->ifi_flags);
2599             ifi->ifi_change = tswap32(ifi->ifi_change);
2600             host_to_target_link_rtattr(IFLA_RTA(ifi),
2601                                        nlmsg_len - NLMSG_LENGTH(sizeof(*ifi)));
2602         }
2603         break;
2604     case RTM_NEWADDR:
2605     case RTM_DELADDR:
2606     case RTM_GETADDR:
2607         if (nlh->nlmsg_len >= NLMSG_LENGTH(sizeof(*ifa))) {
2608             ifa = NLMSG_DATA(nlh);
2609             ifa->ifa_index = tswap32(ifa->ifa_index);
2610             host_to_target_addr_rtattr(IFA_RTA(ifa),
2611                                        nlmsg_len - NLMSG_LENGTH(sizeof(*ifa)));
2612         }
2613         break;
2614     case RTM_NEWROUTE:
2615     case RTM_DELROUTE:
2616     case RTM_GETROUTE:
2617         if (nlh->nlmsg_len >= NLMSG_LENGTH(sizeof(*rtm))) {
2618             rtm = NLMSG_DATA(nlh);
2619             rtm->rtm_flags = tswap32(rtm->rtm_flags);
2620             host_to_target_route_rtattr(RTM_RTA(rtm),
2621                                         nlmsg_len - NLMSG_LENGTH(sizeof(*rtm)));
2622         }
2623         break;
2624     default:
2625         return -TARGET_EINVAL;
2626     }
2627     return 0;
2628 }
2629 
2630 static inline abi_long host_to_target_nlmsg_route(struct nlmsghdr *nlh,
2631                                                   size_t len)
2632 {
2633     return host_to_target_for_each_nlmsg(nlh, len, host_to_target_data_route);
2634 }
2635 
2636 static abi_long target_to_host_for_each_rtattr(struct rtattr *rtattr,
2637                                                size_t len,
2638                                                abi_long (*target_to_host_rtattr)
2639                                                         (struct rtattr *))
2640 {
2641     abi_long ret;
2642 
2643     while (len >= sizeof(struct rtattr)) {
2644         if (tswap16(rtattr->rta_len) < sizeof(struct rtattr) ||
2645             tswap16(rtattr->rta_len) > len) {
2646             break;
2647         }
2648         rtattr->rta_len = tswap16(rtattr->rta_len);
2649         rtattr->rta_type = tswap16(rtattr->rta_type);
2650         ret = target_to_host_rtattr(rtattr);
2651         if (ret < 0) {
2652             return ret;
2653         }
2654         len -= RTA_ALIGN(rtattr->rta_len);
2655         rtattr = (struct rtattr *)(((char *)rtattr) +
2656                  RTA_ALIGN(rtattr->rta_len));
2657     }
2658     return 0;
2659 }
2660 
2661 static abi_long target_to_host_data_link_rtattr(struct rtattr *rtattr)
2662 {
2663     switch (rtattr->rta_type) {
2664     default:
2665         gemu_log("Unknown target QEMU_IFLA type: %d\n", rtattr->rta_type);
2666         break;
2667     }
2668     return 0;
2669 }
2670 
2671 static abi_long target_to_host_data_addr_rtattr(struct rtattr *rtattr)
2672 {
2673     switch (rtattr->rta_type) {
2674     /* binary: depends on family type */
2675     case IFA_LOCAL:
2676     case IFA_ADDRESS:
2677         break;
2678     default:
2679         gemu_log("Unknown target IFA type: %d\n", rtattr->rta_type);
2680         break;
2681     }
2682     return 0;
2683 }
2684 
2685 static abi_long target_to_host_data_route_rtattr(struct rtattr *rtattr)
2686 {
2687     uint32_t *u32;
2688     switch (rtattr->rta_type) {
2689     /* binary: depends on family type */
2690     case RTA_DST:
2691     case RTA_SRC:
2692     case RTA_GATEWAY:
2693         break;
2694     /* u32 */
2695     case RTA_PRIORITY:
2696     case RTA_OIF:
2697         u32 = RTA_DATA(rtattr);
2698         *u32 = tswap32(*u32);
2699         break;
2700     default:
2701         gemu_log("Unknown target RTA type: %d\n", rtattr->rta_type);
2702         break;
2703     }
2704     return 0;
2705 }
2706 
2707 static void target_to_host_link_rtattr(struct rtattr *rtattr,
2708                                        uint32_t rtattr_len)
2709 {
2710     target_to_host_for_each_rtattr(rtattr, rtattr_len,
2711                                    target_to_host_data_link_rtattr);
2712 }
2713 
2714 static void target_to_host_addr_rtattr(struct rtattr *rtattr,
2715                                      uint32_t rtattr_len)
2716 {
2717     target_to_host_for_each_rtattr(rtattr, rtattr_len,
2718                                    target_to_host_data_addr_rtattr);
2719 }
2720 
2721 static void target_to_host_route_rtattr(struct rtattr *rtattr,
2722                                      uint32_t rtattr_len)
2723 {
2724     target_to_host_for_each_rtattr(rtattr, rtattr_len,
2725                                    target_to_host_data_route_rtattr);
2726 }
2727 
2728 static abi_long target_to_host_data_route(struct nlmsghdr *nlh)
2729 {
2730     struct ifinfomsg *ifi;
2731     struct ifaddrmsg *ifa;
2732     struct rtmsg *rtm;
2733 
2734     switch (nlh->nlmsg_type) {
2735     case RTM_GETLINK:
2736         break;
2737     case RTM_NEWLINK:
2738     case RTM_DELLINK:
2739         if (nlh->nlmsg_len >= NLMSG_LENGTH(sizeof(*ifi))) {
2740             ifi = NLMSG_DATA(nlh);
2741             ifi->ifi_type = tswap16(ifi->ifi_type);
2742             ifi->ifi_index = tswap32(ifi->ifi_index);
2743             ifi->ifi_flags = tswap32(ifi->ifi_flags);
2744             ifi->ifi_change = tswap32(ifi->ifi_change);
2745             target_to_host_link_rtattr(IFLA_RTA(ifi), nlh->nlmsg_len -
2746                                        NLMSG_LENGTH(sizeof(*ifi)));
2747         }
2748         break;
2749     case RTM_GETADDR:
2750     case RTM_NEWADDR:
2751     case RTM_DELADDR:
2752         if (nlh->nlmsg_len >= NLMSG_LENGTH(sizeof(*ifa))) {
2753             ifa = NLMSG_DATA(nlh);
2754             ifa->ifa_index = tswap32(ifa->ifa_index);
2755             target_to_host_addr_rtattr(IFA_RTA(ifa), nlh->nlmsg_len -
2756                                        NLMSG_LENGTH(sizeof(*ifa)));
2757         }
2758         break;
2759     case RTM_GETROUTE:
2760         break;
2761     case RTM_NEWROUTE:
2762     case RTM_DELROUTE:
2763         if (nlh->nlmsg_len >= NLMSG_LENGTH(sizeof(*rtm))) {
2764             rtm = NLMSG_DATA(nlh);
2765             rtm->rtm_flags = tswap32(rtm->rtm_flags);
2766             target_to_host_route_rtattr(RTM_RTA(rtm), nlh->nlmsg_len -
2767                                         NLMSG_LENGTH(sizeof(*rtm)));
2768         }
2769         break;
2770     default:
2771         return -TARGET_EOPNOTSUPP;
2772     }
2773     return 0;
2774 }
2775 
2776 static abi_long target_to_host_nlmsg_route(struct nlmsghdr *nlh, size_t len)
2777 {
2778     return target_to_host_for_each_nlmsg(nlh, len, target_to_host_data_route);
2779 }
2780 #endif /* CONFIG_RTNETLINK */
2781 
2782 static abi_long host_to_target_data_audit(struct nlmsghdr *nlh)
2783 {
2784     switch (nlh->nlmsg_type) {
2785     default:
2786         gemu_log("Unknown host audit message type %d\n",
2787                  nlh->nlmsg_type);
2788         return -TARGET_EINVAL;
2789     }
2790     return 0;
2791 }
2792 
2793 static inline abi_long host_to_target_nlmsg_audit(struct nlmsghdr *nlh,
2794                                                   size_t len)
2795 {
2796     return host_to_target_for_each_nlmsg(nlh, len, host_to_target_data_audit);
2797 }
2798 
2799 static abi_long target_to_host_data_audit(struct nlmsghdr *nlh)
2800 {
2801     switch (nlh->nlmsg_type) {
2802     case AUDIT_USER:
2803     case AUDIT_FIRST_USER_MSG ... AUDIT_LAST_USER_MSG:
2804     case AUDIT_FIRST_USER_MSG2 ... AUDIT_LAST_USER_MSG2:
2805         break;
2806     default:
2807         gemu_log("Unknown target audit message type %d\n",
2808                  nlh->nlmsg_type);
2809         return -TARGET_EINVAL;
2810     }
2811 
2812     return 0;
2813 }
2814 
2815 static abi_long target_to_host_nlmsg_audit(struct nlmsghdr *nlh, size_t len)
2816 {
2817     return target_to_host_for_each_nlmsg(nlh, len, target_to_host_data_audit);
2818 }
2819 
2820 /* do_setsockopt() Must return target values and target errnos. */
2821 static abi_long do_setsockopt(int sockfd, int level, int optname,
2822                               abi_ulong optval_addr, socklen_t optlen)
2823 {
2824     abi_long ret;
2825     int val;
2826     struct ip_mreqn *ip_mreq;
2827     struct ip_mreq_source *ip_mreq_source;
2828 
2829     switch(level) {
2830     case SOL_TCP:
2831         /* TCP options all take an 'int' value.  */
2832         if (optlen < sizeof(uint32_t))
2833             return -TARGET_EINVAL;
2834 
2835         if (get_user_u32(val, optval_addr))
2836             return -TARGET_EFAULT;
2837         ret = get_errno(setsockopt(sockfd, level, optname, &val, sizeof(val)));
2838         break;
2839     case SOL_IP:
2840         switch(optname) {
2841         case IP_TOS:
2842         case IP_TTL:
2843         case IP_HDRINCL:
2844         case IP_ROUTER_ALERT:
2845         case IP_RECVOPTS:
2846         case IP_RETOPTS:
2847         case IP_PKTINFO:
2848         case IP_MTU_DISCOVER:
2849         case IP_RECVERR:
2850         case IP_RECVTTL:
2851         case IP_RECVTOS:
2852 #ifdef IP_FREEBIND
2853         case IP_FREEBIND:
2854 #endif
2855         case IP_MULTICAST_TTL:
2856         case IP_MULTICAST_LOOP:
2857             val = 0;
2858             if (optlen >= sizeof(uint32_t)) {
2859                 if (get_user_u32(val, optval_addr))
2860                     return -TARGET_EFAULT;
2861             } else if (optlen >= 1) {
2862                 if (get_user_u8(val, optval_addr))
2863                     return -TARGET_EFAULT;
2864             }
2865             ret = get_errno(setsockopt(sockfd, level, optname, &val, sizeof(val)));
2866             break;
2867         case IP_ADD_MEMBERSHIP:
2868         case IP_DROP_MEMBERSHIP:
2869             if (optlen < sizeof (struct target_ip_mreq) ||
2870                 optlen > sizeof (struct target_ip_mreqn))
2871                 return -TARGET_EINVAL;
2872 
2873             ip_mreq = (struct ip_mreqn *) alloca(optlen);
2874             target_to_host_ip_mreq(ip_mreq, optval_addr, optlen);
2875             ret = get_errno(setsockopt(sockfd, level, optname, ip_mreq, optlen));
2876             break;
2877 
2878         case IP_BLOCK_SOURCE:
2879         case IP_UNBLOCK_SOURCE:
2880         case IP_ADD_SOURCE_MEMBERSHIP:
2881         case IP_DROP_SOURCE_MEMBERSHIP:
2882             if (optlen != sizeof (struct target_ip_mreq_source))
2883                 return -TARGET_EINVAL;
2884 
2885             ip_mreq_source = lock_user(VERIFY_READ, optval_addr, optlen, 1);
2886             ret = get_errno(setsockopt(sockfd, level, optname, ip_mreq_source, optlen));
2887             unlock_user (ip_mreq_source, optval_addr, 0);
2888             break;
2889 
2890         default:
2891             goto unimplemented;
2892         }
2893         break;
2894     case SOL_IPV6:
2895         switch (optname) {
2896         case IPV6_MTU_DISCOVER:
2897         case IPV6_MTU:
2898         case IPV6_V6ONLY:
2899         case IPV6_RECVPKTINFO:
2900         case IPV6_UNICAST_HOPS:
2901         case IPV6_RECVERR:
2902         case IPV6_RECVHOPLIMIT:
2903         case IPV6_2292HOPLIMIT:
2904         case IPV6_CHECKSUM:
2905             val = 0;
2906             if (optlen < sizeof(uint32_t)) {
2907                 return -TARGET_EINVAL;
2908             }
2909             if (get_user_u32(val, optval_addr)) {
2910                 return -TARGET_EFAULT;
2911             }
2912             ret = get_errno(setsockopt(sockfd, level, optname,
2913                                        &val, sizeof(val)));
2914             break;
2915         case IPV6_PKTINFO:
2916         {
2917             struct in6_pktinfo pki;
2918 
2919             if (optlen < sizeof(pki)) {
2920                 return -TARGET_EINVAL;
2921             }
2922 
2923             if (copy_from_user(&pki, optval_addr, sizeof(pki))) {
2924                 return -TARGET_EFAULT;
2925             }
2926 
2927             pki.ipi6_ifindex = tswap32(pki.ipi6_ifindex);
2928 
2929             ret = get_errno(setsockopt(sockfd, level, optname,
2930                                        &pki, sizeof(pki)));
2931             break;
2932         }
2933         default:
2934             goto unimplemented;
2935         }
2936         break;
2937     case SOL_ICMPV6:
2938         switch (optname) {
2939         case ICMPV6_FILTER:
2940         {
2941             struct icmp6_filter icmp6f;
2942 
2943             if (optlen > sizeof(icmp6f)) {
2944                 optlen = sizeof(icmp6f);
2945             }
2946 
2947             if (copy_from_user(&icmp6f, optval_addr, optlen)) {
2948                 return -TARGET_EFAULT;
2949             }
2950 
2951             for (val = 0; val < 8; val++) {
2952                 icmp6f.data[val] = tswap32(icmp6f.data[val]);
2953             }
2954 
2955             ret = get_errno(setsockopt(sockfd, level, optname,
2956                                        &icmp6f, optlen));
2957             break;
2958         }
2959         default:
2960             goto unimplemented;
2961         }
2962         break;
2963     case SOL_RAW:
2964         switch (optname) {
2965         case ICMP_FILTER:
2966         case IPV6_CHECKSUM:
2967             /* those take an u32 value */
2968             if (optlen < sizeof(uint32_t)) {
2969                 return -TARGET_EINVAL;
2970             }
2971 
2972             if (get_user_u32(val, optval_addr)) {
2973                 return -TARGET_EFAULT;
2974             }
2975             ret = get_errno(setsockopt(sockfd, level, optname,
2976                                        &val, sizeof(val)));
2977             break;
2978 
2979         default:
2980             goto unimplemented;
2981         }
2982         break;
2983     case TARGET_SOL_SOCKET:
2984         switch (optname) {
2985         case TARGET_SO_RCVTIMEO:
2986         {
2987                 struct timeval tv;
2988 
2989                 optname = SO_RCVTIMEO;
2990 
2991 set_timeout:
2992                 if (optlen != sizeof(struct target_timeval)) {
2993                     return -TARGET_EINVAL;
2994                 }
2995 
2996                 if (copy_from_user_timeval(&tv, optval_addr)) {
2997                     return -TARGET_EFAULT;
2998                 }
2999 
3000                 ret = get_errno(setsockopt(sockfd, SOL_SOCKET, optname,
3001                                 &tv, sizeof(tv)));
3002                 return ret;
3003         }
3004         case TARGET_SO_SNDTIMEO:
3005                 optname = SO_SNDTIMEO;
3006                 goto set_timeout;
3007         case TARGET_SO_ATTACH_FILTER:
3008         {
3009                 struct target_sock_fprog *tfprog;
3010                 struct target_sock_filter *tfilter;
3011                 struct sock_fprog fprog;
3012                 struct sock_filter *filter;
3013                 int i;
3014 
3015                 if (optlen != sizeof(*tfprog)) {
3016                     return -TARGET_EINVAL;
3017                 }
3018                 if (!lock_user_struct(VERIFY_READ, tfprog, optval_addr, 0)) {
3019                     return -TARGET_EFAULT;
3020                 }
3021                 if (!lock_user_struct(VERIFY_READ, tfilter,
3022                                       tswapal(tfprog->filter), 0)) {
3023                     unlock_user_struct(tfprog, optval_addr, 1);
3024                     return -TARGET_EFAULT;
3025                 }
3026 
3027                 fprog.len = tswap16(tfprog->len);
3028                 filter = g_try_new(struct sock_filter, fprog.len);
3029                 if (filter == NULL) {
3030                     unlock_user_struct(tfilter, tfprog->filter, 1);
3031                     unlock_user_struct(tfprog, optval_addr, 1);
3032                     return -TARGET_ENOMEM;
3033                 }
3034                 for (i = 0; i < fprog.len; i++) {
3035                     filter[i].code = tswap16(tfilter[i].code);
3036                     filter[i].jt = tfilter[i].jt;
3037                     filter[i].jf = tfilter[i].jf;
3038                     filter[i].k = tswap32(tfilter[i].k);
3039                 }
3040                 fprog.filter = filter;
3041 
3042                 ret = get_errno(setsockopt(sockfd, SOL_SOCKET,
3043                                 SO_ATTACH_FILTER, &fprog, sizeof(fprog)));
3044                 g_free(filter);
3045 
3046                 unlock_user_struct(tfilter, tfprog->filter, 1);
3047                 unlock_user_struct(tfprog, optval_addr, 1);
3048                 return ret;
3049         }
3050 	case TARGET_SO_BINDTODEVICE:
3051 	{
3052 		char *dev_ifname, *addr_ifname;
3053 
3054 		if (optlen > IFNAMSIZ - 1) {
3055 		    optlen = IFNAMSIZ - 1;
3056 		}
3057 		dev_ifname = lock_user(VERIFY_READ, optval_addr, optlen, 1);
3058 		if (!dev_ifname) {
3059 		    return -TARGET_EFAULT;
3060 		}
3061 		optname = SO_BINDTODEVICE;
3062 		addr_ifname = alloca(IFNAMSIZ);
3063 		memcpy(addr_ifname, dev_ifname, optlen);
3064 		addr_ifname[optlen] = 0;
3065 		ret = get_errno(setsockopt(sockfd, SOL_SOCKET, optname,
3066                                            addr_ifname, optlen));
3067 		unlock_user (dev_ifname, optval_addr, 0);
3068 		return ret;
3069 	}
3070             /* Options with 'int' argument.  */
3071         case TARGET_SO_DEBUG:
3072 		optname = SO_DEBUG;
3073 		break;
3074         case TARGET_SO_REUSEADDR:
3075 		optname = SO_REUSEADDR;
3076 		break;
3077         case TARGET_SO_TYPE:
3078 		optname = SO_TYPE;
3079 		break;
3080         case TARGET_SO_ERROR:
3081 		optname = SO_ERROR;
3082 		break;
3083         case TARGET_SO_DONTROUTE:
3084 		optname = SO_DONTROUTE;
3085 		break;
3086         case TARGET_SO_BROADCAST:
3087 		optname = SO_BROADCAST;
3088 		break;
3089         case TARGET_SO_SNDBUF:
3090 		optname = SO_SNDBUF;
3091 		break;
3092         case TARGET_SO_SNDBUFFORCE:
3093                 optname = SO_SNDBUFFORCE;
3094                 break;
3095         case TARGET_SO_RCVBUF:
3096 		optname = SO_RCVBUF;
3097 		break;
3098         case TARGET_SO_RCVBUFFORCE:
3099                 optname = SO_RCVBUFFORCE;
3100                 break;
3101         case TARGET_SO_KEEPALIVE:
3102 		optname = SO_KEEPALIVE;
3103 		break;
3104         case TARGET_SO_OOBINLINE:
3105 		optname = SO_OOBINLINE;
3106 		break;
3107         case TARGET_SO_NO_CHECK:
3108 		optname = SO_NO_CHECK;
3109 		break;
3110         case TARGET_SO_PRIORITY:
3111 		optname = SO_PRIORITY;
3112 		break;
3113 #ifdef SO_BSDCOMPAT
3114         case TARGET_SO_BSDCOMPAT:
3115 		optname = SO_BSDCOMPAT;
3116 		break;
3117 #endif
3118         case TARGET_SO_PASSCRED:
3119 		optname = SO_PASSCRED;
3120 		break;
3121         case TARGET_SO_PASSSEC:
3122                 optname = SO_PASSSEC;
3123                 break;
3124         case TARGET_SO_TIMESTAMP:
3125 		optname = SO_TIMESTAMP;
3126 		break;
3127         case TARGET_SO_RCVLOWAT:
3128 		optname = SO_RCVLOWAT;
3129 		break;
3130             break;
3131         default:
3132             goto unimplemented;
3133         }
3134 	if (optlen < sizeof(uint32_t))
3135             return -TARGET_EINVAL;
3136 
3137 	if (get_user_u32(val, optval_addr))
3138             return -TARGET_EFAULT;
3139 	ret = get_errno(setsockopt(sockfd, SOL_SOCKET, optname, &val, sizeof(val)));
3140         break;
3141     default:
3142     unimplemented:
3143         gemu_log("Unsupported setsockopt level=%d optname=%d\n", level, optname);
3144         ret = -TARGET_ENOPROTOOPT;
3145     }
3146     return ret;
3147 }
3148 
3149 /* do_getsockopt() Must return target values and target errnos. */
3150 static abi_long do_getsockopt(int sockfd, int level, int optname,
3151                               abi_ulong optval_addr, abi_ulong optlen)
3152 {
3153     abi_long ret;
3154     int len, val;
3155     socklen_t lv;
3156 
3157     switch(level) {
3158     case TARGET_SOL_SOCKET:
3159         level = SOL_SOCKET;
3160         switch (optname) {
3161         /* These don't just return a single integer */
3162         case TARGET_SO_LINGER:
3163         case TARGET_SO_RCVTIMEO:
3164         case TARGET_SO_SNDTIMEO:
3165         case TARGET_SO_PEERNAME:
3166             goto unimplemented;
3167         case TARGET_SO_PEERCRED: {
3168             struct ucred cr;
3169             socklen_t crlen;
3170             struct target_ucred *tcr;
3171 
3172             if (get_user_u32(len, optlen)) {
3173                 return -TARGET_EFAULT;
3174             }
3175             if (len < 0) {
3176                 return -TARGET_EINVAL;
3177             }
3178 
3179             crlen = sizeof(cr);
3180             ret = get_errno(getsockopt(sockfd, level, SO_PEERCRED,
3181                                        &cr, &crlen));
3182             if (ret < 0) {
3183                 return ret;
3184             }
3185             if (len > crlen) {
3186                 len = crlen;
3187             }
3188             if (!lock_user_struct(VERIFY_WRITE, tcr, optval_addr, 0)) {
3189                 return -TARGET_EFAULT;
3190             }
3191             __put_user(cr.pid, &tcr->pid);
3192             __put_user(cr.uid, &tcr->uid);
3193             __put_user(cr.gid, &tcr->gid);
3194             unlock_user_struct(tcr, optval_addr, 1);
3195             if (put_user_u32(len, optlen)) {
3196                 return -TARGET_EFAULT;
3197             }
3198             break;
3199         }
3200         /* Options with 'int' argument.  */
3201         case TARGET_SO_DEBUG:
3202             optname = SO_DEBUG;
3203             goto int_case;
3204         case TARGET_SO_REUSEADDR:
3205             optname = SO_REUSEADDR;
3206             goto int_case;
3207         case TARGET_SO_TYPE:
3208             optname = SO_TYPE;
3209             goto int_case;
3210         case TARGET_SO_ERROR:
3211             optname = SO_ERROR;
3212             goto int_case;
3213         case TARGET_SO_DONTROUTE:
3214             optname = SO_DONTROUTE;
3215             goto int_case;
3216         case TARGET_SO_BROADCAST:
3217             optname = SO_BROADCAST;
3218             goto int_case;
3219         case TARGET_SO_SNDBUF:
3220             optname = SO_SNDBUF;
3221             goto int_case;
3222         case TARGET_SO_RCVBUF:
3223             optname = SO_RCVBUF;
3224             goto int_case;
3225         case TARGET_SO_KEEPALIVE:
3226             optname = SO_KEEPALIVE;
3227             goto int_case;
3228         case TARGET_SO_OOBINLINE:
3229             optname = SO_OOBINLINE;
3230             goto int_case;
3231         case TARGET_SO_NO_CHECK:
3232             optname = SO_NO_CHECK;
3233             goto int_case;
3234         case TARGET_SO_PRIORITY:
3235             optname = SO_PRIORITY;
3236             goto int_case;
3237 #ifdef SO_BSDCOMPAT
3238         case TARGET_SO_BSDCOMPAT:
3239             optname = SO_BSDCOMPAT;
3240             goto int_case;
3241 #endif
3242         case TARGET_SO_PASSCRED:
3243             optname = SO_PASSCRED;
3244             goto int_case;
3245         case TARGET_SO_TIMESTAMP:
3246             optname = SO_TIMESTAMP;
3247             goto int_case;
3248         case TARGET_SO_RCVLOWAT:
3249             optname = SO_RCVLOWAT;
3250             goto int_case;
3251         case TARGET_SO_ACCEPTCONN:
3252             optname = SO_ACCEPTCONN;
3253             goto int_case;
3254         default:
3255             goto int_case;
3256         }
3257         break;
3258     case SOL_TCP:
3259         /* TCP options all take an 'int' value.  */
3260     int_case:
3261         if (get_user_u32(len, optlen))
3262             return -TARGET_EFAULT;
3263         if (len < 0)
3264             return -TARGET_EINVAL;
3265         lv = sizeof(lv);
3266         ret = get_errno(getsockopt(sockfd, level, optname, &val, &lv));
3267         if (ret < 0)
3268             return ret;
3269         if (optname == SO_TYPE) {
3270             val = host_to_target_sock_type(val);
3271         }
3272         if (len > lv)
3273             len = lv;
3274         if (len == 4) {
3275             if (put_user_u32(val, optval_addr))
3276                 return -TARGET_EFAULT;
3277         } else {
3278             if (put_user_u8(val, optval_addr))
3279                 return -TARGET_EFAULT;
3280         }
3281         if (put_user_u32(len, optlen))
3282             return -TARGET_EFAULT;
3283         break;
3284     case SOL_IP:
3285         switch(optname) {
3286         case IP_TOS:
3287         case IP_TTL:
3288         case IP_HDRINCL:
3289         case IP_ROUTER_ALERT:
3290         case IP_RECVOPTS:
3291         case IP_RETOPTS:
3292         case IP_PKTINFO:
3293         case IP_MTU_DISCOVER:
3294         case IP_RECVERR:
3295         case IP_RECVTOS:
3296 #ifdef IP_FREEBIND
3297         case IP_FREEBIND:
3298 #endif
3299         case IP_MULTICAST_TTL:
3300         case IP_MULTICAST_LOOP:
3301             if (get_user_u32(len, optlen))
3302                 return -TARGET_EFAULT;
3303             if (len < 0)
3304                 return -TARGET_EINVAL;
3305             lv = sizeof(lv);
3306             ret = get_errno(getsockopt(sockfd, level, optname, &val, &lv));
3307             if (ret < 0)
3308                 return ret;
3309             if (len < sizeof(int) && len > 0 && val >= 0 && val < 255) {
3310                 len = 1;
3311                 if (put_user_u32(len, optlen)
3312                     || put_user_u8(val, optval_addr))
3313                     return -TARGET_EFAULT;
3314             } else {
3315                 if (len > sizeof(int))
3316                     len = sizeof(int);
3317                 if (put_user_u32(len, optlen)
3318                     || put_user_u32(val, optval_addr))
3319                     return -TARGET_EFAULT;
3320             }
3321             break;
3322         default:
3323             ret = -TARGET_ENOPROTOOPT;
3324             break;
3325         }
3326         break;
3327     default:
3328     unimplemented:
3329         gemu_log("getsockopt level=%d optname=%d not yet supported\n",
3330                  level, optname);
3331         ret = -TARGET_EOPNOTSUPP;
3332         break;
3333     }
3334     return ret;
3335 }
3336 
3337 static struct iovec *lock_iovec(int type, abi_ulong target_addr,
3338                                 abi_ulong count, int copy)
3339 {
3340     struct target_iovec *target_vec;
3341     struct iovec *vec;
3342     abi_ulong total_len, max_len;
3343     int i;
3344     int err = 0;
3345     bool bad_address = false;
3346 
3347     if (count == 0) {
3348         errno = 0;
3349         return NULL;
3350     }
3351     if (count > IOV_MAX) {
3352         errno = EINVAL;
3353         return NULL;
3354     }
3355 
3356     vec = g_try_new0(struct iovec, count);
3357     if (vec == NULL) {
3358         errno = ENOMEM;
3359         return NULL;
3360     }
3361 
3362     target_vec = lock_user(VERIFY_READ, target_addr,
3363                            count * sizeof(struct target_iovec), 1);
3364     if (target_vec == NULL) {
3365         err = EFAULT;
3366         goto fail2;
3367     }
3368 
3369     /* ??? If host page size > target page size, this will result in a
3370        value larger than what we can actually support.  */
3371     max_len = 0x7fffffff & TARGET_PAGE_MASK;
3372     total_len = 0;
3373 
3374     for (i = 0; i < count; i++) {
3375         abi_ulong base = tswapal(target_vec[i].iov_base);
3376         abi_long len = tswapal(target_vec[i].iov_len);
3377 
3378         if (len < 0) {
3379             err = EINVAL;
3380             goto fail;
3381         } else if (len == 0) {
3382             /* Zero length pointer is ignored.  */
3383             vec[i].iov_base = 0;
3384         } else {
3385             vec[i].iov_base = lock_user(type, base, len, copy);
3386             /* If the first buffer pointer is bad, this is a fault.  But
3387              * subsequent bad buffers will result in a partial write; this
3388              * is realized by filling the vector with null pointers and
3389              * zero lengths. */
3390             if (!vec[i].iov_base) {
3391                 if (i == 0) {
3392                     err = EFAULT;
3393                     goto fail;
3394                 } else {
3395                     bad_address = true;
3396                 }
3397             }
3398             if (bad_address) {
3399                 len = 0;
3400             }
3401             if (len > max_len - total_len) {
3402                 len = max_len - total_len;
3403             }
3404         }
3405         vec[i].iov_len = len;
3406         total_len += len;
3407     }
3408 
3409     unlock_user(target_vec, target_addr, 0);
3410     return vec;
3411 
3412  fail:
3413     while (--i >= 0) {
3414         if (tswapal(target_vec[i].iov_len) > 0) {
3415             unlock_user(vec[i].iov_base, tswapal(target_vec[i].iov_base), 0);
3416         }
3417     }
3418     unlock_user(target_vec, target_addr, 0);
3419  fail2:
3420     g_free(vec);
3421     errno = err;
3422     return NULL;
3423 }
3424 
3425 static void unlock_iovec(struct iovec *vec, abi_ulong target_addr,
3426                          abi_ulong count, int copy)
3427 {
3428     struct target_iovec *target_vec;
3429     int i;
3430 
3431     target_vec = lock_user(VERIFY_READ, target_addr,
3432                            count * sizeof(struct target_iovec), 1);
3433     if (target_vec) {
3434         for (i = 0; i < count; i++) {
3435             abi_ulong base = tswapal(target_vec[i].iov_base);
3436             abi_long len = tswapal(target_vec[i].iov_len);
3437             if (len < 0) {
3438                 break;
3439             }
3440             unlock_user(vec[i].iov_base, base, copy ? vec[i].iov_len : 0);
3441         }
3442         unlock_user(target_vec, target_addr, 0);
3443     }
3444 
3445     g_free(vec);
3446 }
3447 
3448 static inline int target_to_host_sock_type(int *type)
3449 {
3450     int host_type = 0;
3451     int target_type = *type;
3452 
3453     switch (target_type & TARGET_SOCK_TYPE_MASK) {
3454     case TARGET_SOCK_DGRAM:
3455         host_type = SOCK_DGRAM;
3456         break;
3457     case TARGET_SOCK_STREAM:
3458         host_type = SOCK_STREAM;
3459         break;
3460     default:
3461         host_type = target_type & TARGET_SOCK_TYPE_MASK;
3462         break;
3463     }
3464     if (target_type & TARGET_SOCK_CLOEXEC) {
3465 #if defined(SOCK_CLOEXEC)
3466         host_type |= SOCK_CLOEXEC;
3467 #else
3468         return -TARGET_EINVAL;
3469 #endif
3470     }
3471     if (target_type & TARGET_SOCK_NONBLOCK) {
3472 #if defined(SOCK_NONBLOCK)
3473         host_type |= SOCK_NONBLOCK;
3474 #elif !defined(O_NONBLOCK)
3475         return -TARGET_EINVAL;
3476 #endif
3477     }
3478     *type = host_type;
3479     return 0;
3480 }
3481 
3482 /* Try to emulate socket type flags after socket creation.  */
3483 static int sock_flags_fixup(int fd, int target_type)
3484 {
3485 #if !defined(SOCK_NONBLOCK) && defined(O_NONBLOCK)
3486     if (target_type & TARGET_SOCK_NONBLOCK) {
3487         int flags = fcntl(fd, F_GETFL);
3488         if (fcntl(fd, F_SETFL, O_NONBLOCK | flags) == -1) {
3489             close(fd);
3490             return -TARGET_EINVAL;
3491         }
3492     }
3493 #endif
3494     return fd;
3495 }
3496 
3497 static abi_long packet_target_to_host_sockaddr(void *host_addr,
3498                                                abi_ulong target_addr,
3499                                                socklen_t len)
3500 {
3501     struct sockaddr *addr = host_addr;
3502     struct target_sockaddr *target_saddr;
3503 
3504     target_saddr = lock_user(VERIFY_READ, target_addr, len, 1);
3505     if (!target_saddr) {
3506         return -TARGET_EFAULT;
3507     }
3508 
3509     memcpy(addr, target_saddr, len);
3510     addr->sa_family = tswap16(target_saddr->sa_family);
3511     /* spkt_protocol is big-endian */
3512 
3513     unlock_user(target_saddr, target_addr, 0);
3514     return 0;
3515 }
3516 
3517 static TargetFdTrans target_packet_trans = {
3518     .target_to_host_addr = packet_target_to_host_sockaddr,
3519 };
3520 
3521 #ifdef CONFIG_RTNETLINK
3522 static abi_long netlink_route_target_to_host(void *buf, size_t len)
3523 {
3524     abi_long ret;
3525 
3526     ret = target_to_host_nlmsg_route(buf, len);
3527     if (ret < 0) {
3528         return ret;
3529     }
3530 
3531     return len;
3532 }
3533 
3534 static abi_long netlink_route_host_to_target(void *buf, size_t len)
3535 {
3536     abi_long ret;
3537 
3538     ret = host_to_target_nlmsg_route(buf, len);
3539     if (ret < 0) {
3540         return ret;
3541     }
3542 
3543     return len;
3544 }
3545 
3546 static TargetFdTrans target_netlink_route_trans = {
3547     .target_to_host_data = netlink_route_target_to_host,
3548     .host_to_target_data = netlink_route_host_to_target,
3549 };
3550 #endif /* CONFIG_RTNETLINK */
3551 
3552 static abi_long netlink_audit_target_to_host(void *buf, size_t len)
3553 {
3554     abi_long ret;
3555 
3556     ret = target_to_host_nlmsg_audit(buf, len);
3557     if (ret < 0) {
3558         return ret;
3559     }
3560 
3561     return len;
3562 }
3563 
3564 static abi_long netlink_audit_host_to_target(void *buf, size_t len)
3565 {
3566     abi_long ret;
3567 
3568     ret = host_to_target_nlmsg_audit(buf, len);
3569     if (ret < 0) {
3570         return ret;
3571     }
3572 
3573     return len;
3574 }
3575 
3576 static TargetFdTrans target_netlink_audit_trans = {
3577     .target_to_host_data = netlink_audit_target_to_host,
3578     .host_to_target_data = netlink_audit_host_to_target,
3579 };
3580 
3581 /* do_socket() Must return target values and target errnos. */
3582 static abi_long do_socket(int domain, int type, int protocol)
3583 {
3584     int target_type = type;
3585     int ret;
3586 
3587     ret = target_to_host_sock_type(&type);
3588     if (ret) {
3589         return ret;
3590     }
3591 
3592     if (domain == PF_NETLINK && !(
3593 #ifdef CONFIG_RTNETLINK
3594          protocol == NETLINK_ROUTE ||
3595 #endif
3596          protocol == NETLINK_KOBJECT_UEVENT ||
3597          protocol == NETLINK_AUDIT)) {
3598         return -EPFNOSUPPORT;
3599     }
3600 
3601     if (domain == AF_PACKET ||
3602         (domain == AF_INET && type == SOCK_PACKET)) {
3603         protocol = tswap16(protocol);
3604     }
3605 
3606     ret = get_errno(socket(domain, type, protocol));
3607     if (ret >= 0) {
3608         ret = sock_flags_fixup(ret, target_type);
3609         if (type == SOCK_PACKET) {
3610             /* Manage an obsolete case :
3611              * if socket type is SOCK_PACKET, bind by name
3612              */
3613             fd_trans_register(ret, &target_packet_trans);
3614         } else if (domain == PF_NETLINK) {
3615             switch (protocol) {
3616 #ifdef CONFIG_RTNETLINK
3617             case NETLINK_ROUTE:
3618                 fd_trans_register(ret, &target_netlink_route_trans);
3619                 break;
3620 #endif
3621             case NETLINK_KOBJECT_UEVENT:
3622                 /* nothing to do: messages are strings */
3623                 break;
3624             case NETLINK_AUDIT:
3625                 fd_trans_register(ret, &target_netlink_audit_trans);
3626                 break;
3627             default:
3628                 g_assert_not_reached();
3629             }
3630         }
3631     }
3632     return ret;
3633 }
3634 
3635 /* do_bind() Must return target values and target errnos. */
3636 static abi_long do_bind(int sockfd, abi_ulong target_addr,
3637                         socklen_t addrlen)
3638 {
3639     void *addr;
3640     abi_long ret;
3641 
3642     if ((int)addrlen < 0) {
3643         return -TARGET_EINVAL;
3644     }
3645 
3646     addr = alloca(addrlen+1);
3647 
3648     ret = target_to_host_sockaddr(sockfd, addr, target_addr, addrlen);
3649     if (ret)
3650         return ret;
3651 
3652     return get_errno(bind(sockfd, addr, addrlen));
3653 }
3654 
3655 /* do_connect() Must return target values and target errnos. */
3656 static abi_long do_connect(int sockfd, abi_ulong target_addr,
3657                            socklen_t addrlen)
3658 {
3659     void *addr;
3660     abi_long ret;
3661 
3662     if ((int)addrlen < 0) {
3663         return -TARGET_EINVAL;
3664     }
3665 
3666     addr = alloca(addrlen+1);
3667 
3668     ret = target_to_host_sockaddr(sockfd, addr, target_addr, addrlen);
3669     if (ret)
3670         return ret;
3671 
3672     return get_errno(safe_connect(sockfd, addr, addrlen));
3673 }
3674 
3675 /* do_sendrecvmsg_locked() Must return target values and target errnos. */
3676 static abi_long do_sendrecvmsg_locked(int fd, struct target_msghdr *msgp,
3677                                       int flags, int send)
3678 {
3679     abi_long ret, len;
3680     struct msghdr msg;
3681     abi_ulong count;
3682     struct iovec *vec;
3683     abi_ulong target_vec;
3684 
3685     if (msgp->msg_name) {
3686         msg.msg_namelen = tswap32(msgp->msg_namelen);
3687         msg.msg_name = alloca(msg.msg_namelen+1);
3688         ret = target_to_host_sockaddr(fd, msg.msg_name,
3689                                       tswapal(msgp->msg_name),
3690                                       msg.msg_namelen);
3691         if (ret == -TARGET_EFAULT) {
3692             /* For connected sockets msg_name and msg_namelen must
3693              * be ignored, so returning EFAULT immediately is wrong.
3694              * Instead, pass a bad msg_name to the host kernel, and
3695              * let it decide whether to return EFAULT or not.
3696              */
3697             msg.msg_name = (void *)-1;
3698         } else if (ret) {
3699             goto out2;
3700         }
3701     } else {
3702         msg.msg_name = NULL;
3703         msg.msg_namelen = 0;
3704     }
3705     msg.msg_controllen = 2 * tswapal(msgp->msg_controllen);
3706     msg.msg_control = alloca(msg.msg_controllen);
3707     msg.msg_flags = tswap32(msgp->msg_flags);
3708 
3709     count = tswapal(msgp->msg_iovlen);
3710     target_vec = tswapal(msgp->msg_iov);
3711 
3712     if (count > IOV_MAX) {
3713         /* sendrcvmsg returns a different errno for this condition than
3714          * readv/writev, so we must catch it here before lock_iovec() does.
3715          */
3716         ret = -TARGET_EMSGSIZE;
3717         goto out2;
3718     }
3719 
3720     vec = lock_iovec(send ? VERIFY_READ : VERIFY_WRITE,
3721                      target_vec, count, send);
3722     if (vec == NULL) {
3723         ret = -host_to_target_errno(errno);
3724         goto out2;
3725     }
3726     msg.msg_iovlen = count;
3727     msg.msg_iov = vec;
3728 
3729     if (send) {
3730         if (fd_trans_target_to_host_data(fd)) {
3731             void *host_msg;
3732 
3733             host_msg = g_malloc(msg.msg_iov->iov_len);
3734             memcpy(host_msg, msg.msg_iov->iov_base, msg.msg_iov->iov_len);
3735             ret = fd_trans_target_to_host_data(fd)(host_msg,
3736                                                    msg.msg_iov->iov_len);
3737             if (ret >= 0) {
3738                 msg.msg_iov->iov_base = host_msg;
3739                 ret = get_errno(safe_sendmsg(fd, &msg, flags));
3740             }
3741             g_free(host_msg);
3742         } else {
3743             ret = target_to_host_cmsg(&msg, msgp);
3744             if (ret == 0) {
3745                 ret = get_errno(safe_sendmsg(fd, &msg, flags));
3746             }
3747         }
3748     } else {
3749         ret = get_errno(safe_recvmsg(fd, &msg, flags));
3750         if (!is_error(ret)) {
3751             len = ret;
3752             if (fd_trans_host_to_target_data(fd)) {
3753                 ret = fd_trans_host_to_target_data(fd)(msg.msg_iov->iov_base,
3754                                                        len);
3755             } else {
3756                 ret = host_to_target_cmsg(msgp, &msg);
3757             }
3758             if (!is_error(ret)) {
3759                 msgp->msg_namelen = tswap32(msg.msg_namelen);
3760                 if (msg.msg_name != NULL && msg.msg_name != (void *)-1) {
3761                     ret = host_to_target_sockaddr(tswapal(msgp->msg_name),
3762                                     msg.msg_name, msg.msg_namelen);
3763                     if (ret) {
3764                         goto out;
3765                     }
3766                 }
3767 
3768                 ret = len;
3769             }
3770         }
3771     }
3772 
3773 out:
3774     unlock_iovec(vec, target_vec, count, !send);
3775 out2:
3776     return ret;
3777 }
3778 
3779 static abi_long do_sendrecvmsg(int fd, abi_ulong target_msg,
3780                                int flags, int send)
3781 {
3782     abi_long ret;
3783     struct target_msghdr *msgp;
3784 
3785     if (!lock_user_struct(send ? VERIFY_READ : VERIFY_WRITE,
3786                           msgp,
3787                           target_msg,
3788                           send ? 1 : 0)) {
3789         return -TARGET_EFAULT;
3790     }
3791     ret = do_sendrecvmsg_locked(fd, msgp, flags, send);
3792     unlock_user_struct(msgp, target_msg, send ? 0 : 1);
3793     return ret;
3794 }
3795 
3796 /* We don't rely on the C library to have sendmmsg/recvmmsg support,
3797  * so it might not have this *mmsg-specific flag either.
3798  */
3799 #ifndef MSG_WAITFORONE
3800 #define MSG_WAITFORONE 0x10000
3801 #endif
3802 
3803 static abi_long do_sendrecvmmsg(int fd, abi_ulong target_msgvec,
3804                                 unsigned int vlen, unsigned int flags,
3805                                 int send)
3806 {
3807     struct target_mmsghdr *mmsgp;
3808     abi_long ret = 0;
3809     int i;
3810 
3811     if (vlen > UIO_MAXIOV) {
3812         vlen = UIO_MAXIOV;
3813     }
3814 
3815     mmsgp = lock_user(VERIFY_WRITE, target_msgvec, sizeof(*mmsgp) * vlen, 1);
3816     if (!mmsgp) {
3817         return -TARGET_EFAULT;
3818     }
3819 
3820     for (i = 0; i < vlen; i++) {
3821         ret = do_sendrecvmsg_locked(fd, &mmsgp[i].msg_hdr, flags, send);
3822         if (is_error(ret)) {
3823             break;
3824         }
3825         mmsgp[i].msg_len = tswap32(ret);
3826         /* MSG_WAITFORONE turns on MSG_DONTWAIT after one packet */
3827         if (flags & MSG_WAITFORONE) {
3828             flags |= MSG_DONTWAIT;
3829         }
3830     }
3831 
3832     unlock_user(mmsgp, target_msgvec, sizeof(*mmsgp) * i);
3833 
3834     /* Return number of datagrams sent if we sent any at all;
3835      * otherwise return the error.
3836      */
3837     if (i) {
3838         return i;
3839     }
3840     return ret;
3841 }
3842 
3843 /* do_accept4() Must return target values and target errnos. */
3844 static abi_long do_accept4(int fd, abi_ulong target_addr,
3845                            abi_ulong target_addrlen_addr, int flags)
3846 {
3847     socklen_t addrlen;
3848     void *addr;
3849     abi_long ret;
3850     int host_flags;
3851 
3852     host_flags = target_to_host_bitmask(flags, fcntl_flags_tbl);
3853 
3854     if (target_addr == 0) {
3855         return get_errno(safe_accept4(fd, NULL, NULL, host_flags));
3856     }
3857 
3858     /* linux returns EINVAL if addrlen pointer is invalid */
3859     if (get_user_u32(addrlen, target_addrlen_addr))
3860         return -TARGET_EINVAL;
3861 
3862     if ((int)addrlen < 0) {
3863         return -TARGET_EINVAL;
3864     }
3865 
3866     if (!access_ok(VERIFY_WRITE, target_addr, addrlen))
3867         return -TARGET_EINVAL;
3868 
3869     addr = alloca(addrlen);
3870 
3871     ret = get_errno(safe_accept4(fd, addr, &addrlen, host_flags));
3872     if (!is_error(ret)) {
3873         host_to_target_sockaddr(target_addr, addr, addrlen);
3874         if (put_user_u32(addrlen, target_addrlen_addr))
3875             ret = -TARGET_EFAULT;
3876     }
3877     return ret;
3878 }
3879 
3880 /* do_getpeername() Must return target values and target errnos. */
3881 static abi_long do_getpeername(int fd, abi_ulong target_addr,
3882                                abi_ulong target_addrlen_addr)
3883 {
3884     socklen_t addrlen;
3885     void *addr;
3886     abi_long ret;
3887 
3888     if (get_user_u32(addrlen, target_addrlen_addr))
3889         return -TARGET_EFAULT;
3890 
3891     if ((int)addrlen < 0) {
3892         return -TARGET_EINVAL;
3893     }
3894 
3895     if (!access_ok(VERIFY_WRITE, target_addr, addrlen))
3896         return -TARGET_EFAULT;
3897 
3898     addr = alloca(addrlen);
3899 
3900     ret = get_errno(getpeername(fd, addr, &addrlen));
3901     if (!is_error(ret)) {
3902         host_to_target_sockaddr(target_addr, addr, addrlen);
3903         if (put_user_u32(addrlen, target_addrlen_addr))
3904             ret = -TARGET_EFAULT;
3905     }
3906     return ret;
3907 }
3908 
3909 /* do_getsockname() Must return target values and target errnos. */
3910 static abi_long do_getsockname(int fd, abi_ulong target_addr,
3911                                abi_ulong target_addrlen_addr)
3912 {
3913     socklen_t addrlen;
3914     void *addr;
3915     abi_long ret;
3916 
3917     if (get_user_u32(addrlen, target_addrlen_addr))
3918         return -TARGET_EFAULT;
3919 
3920     if ((int)addrlen < 0) {
3921         return -TARGET_EINVAL;
3922     }
3923 
3924     if (!access_ok(VERIFY_WRITE, target_addr, addrlen))
3925         return -TARGET_EFAULT;
3926 
3927     addr = alloca(addrlen);
3928 
3929     ret = get_errno(getsockname(fd, addr, &addrlen));
3930     if (!is_error(ret)) {
3931         host_to_target_sockaddr(target_addr, addr, addrlen);
3932         if (put_user_u32(addrlen, target_addrlen_addr))
3933             ret = -TARGET_EFAULT;
3934     }
3935     return ret;
3936 }
3937 
3938 /* do_socketpair() Must return target values and target errnos. */
3939 static abi_long do_socketpair(int domain, int type, int protocol,
3940                               abi_ulong target_tab_addr)
3941 {
3942     int tab[2];
3943     abi_long ret;
3944 
3945     target_to_host_sock_type(&type);
3946 
3947     ret = get_errno(socketpair(domain, type, protocol, tab));
3948     if (!is_error(ret)) {
3949         if (put_user_s32(tab[0], target_tab_addr)
3950             || put_user_s32(tab[1], target_tab_addr + sizeof(tab[0])))
3951             ret = -TARGET_EFAULT;
3952     }
3953     return ret;
3954 }
3955 
3956 /* do_sendto() Must return target values and target errnos. */
3957 static abi_long do_sendto(int fd, abi_ulong msg, size_t len, int flags,
3958                           abi_ulong target_addr, socklen_t addrlen)
3959 {
3960     void *addr;
3961     void *host_msg;
3962     void *copy_msg = NULL;
3963     abi_long ret;
3964 
3965     if ((int)addrlen < 0) {
3966         return -TARGET_EINVAL;
3967     }
3968 
3969     host_msg = lock_user(VERIFY_READ, msg, len, 1);
3970     if (!host_msg)
3971         return -TARGET_EFAULT;
3972     if (fd_trans_target_to_host_data(fd)) {
3973         copy_msg = host_msg;
3974         host_msg = g_malloc(len);
3975         memcpy(host_msg, copy_msg, len);
3976         ret = fd_trans_target_to_host_data(fd)(host_msg, len);
3977         if (ret < 0) {
3978             goto fail;
3979         }
3980     }
3981     if (target_addr) {
3982         addr = alloca(addrlen+1);
3983         ret = target_to_host_sockaddr(fd, addr, target_addr, addrlen);
3984         if (ret) {
3985             goto fail;
3986         }
3987         ret = get_errno(safe_sendto(fd, host_msg, len, flags, addr, addrlen));
3988     } else {
3989         ret = get_errno(safe_sendto(fd, host_msg, len, flags, NULL, 0));
3990     }
3991 fail:
3992     if (copy_msg) {
3993         g_free(host_msg);
3994         host_msg = copy_msg;
3995     }
3996     unlock_user(host_msg, msg, 0);
3997     return ret;
3998 }
3999 
4000 /* do_recvfrom() Must return target values and target errnos. */
4001 static abi_long do_recvfrom(int fd, abi_ulong msg, size_t len, int flags,
4002                             abi_ulong target_addr,
4003                             abi_ulong target_addrlen)
4004 {
4005     socklen_t addrlen;
4006     void *addr;
4007     void *host_msg;
4008     abi_long ret;
4009 
4010     host_msg = lock_user(VERIFY_WRITE, msg, len, 0);
4011     if (!host_msg)
4012         return -TARGET_EFAULT;
4013     if (target_addr) {
4014         if (get_user_u32(addrlen, target_addrlen)) {
4015             ret = -TARGET_EFAULT;
4016             goto fail;
4017         }
4018         if ((int)addrlen < 0) {
4019             ret = -TARGET_EINVAL;
4020             goto fail;
4021         }
4022         addr = alloca(addrlen);
4023         ret = get_errno(safe_recvfrom(fd, host_msg, len, flags,
4024                                       addr, &addrlen));
4025     } else {
4026         addr = NULL; /* To keep compiler quiet.  */
4027         ret = get_errno(safe_recvfrom(fd, host_msg, len, flags, NULL, 0));
4028     }
4029     if (!is_error(ret)) {
4030         if (fd_trans_host_to_target_data(fd)) {
4031             ret = fd_trans_host_to_target_data(fd)(host_msg, ret);
4032         }
4033         if (target_addr) {
4034             host_to_target_sockaddr(target_addr, addr, addrlen);
4035             if (put_user_u32(addrlen, target_addrlen)) {
4036                 ret = -TARGET_EFAULT;
4037                 goto fail;
4038             }
4039         }
4040         unlock_user(host_msg, msg, len);
4041     } else {
4042 fail:
4043         unlock_user(host_msg, msg, 0);
4044     }
4045     return ret;
4046 }
4047 
4048 #ifdef TARGET_NR_socketcall
4049 /* do_socketcall() must return target values and target errnos. */
4050 static abi_long do_socketcall(int num, abi_ulong vptr)
4051 {
4052     static const unsigned nargs[] = { /* number of arguments per operation */
4053         [TARGET_SYS_SOCKET] = 3,      /* domain, type, protocol */
4054         [TARGET_SYS_BIND] = 3,        /* fd, addr, addrlen */
4055         [TARGET_SYS_CONNECT] = 3,     /* fd, addr, addrlen */
4056         [TARGET_SYS_LISTEN] = 2,      /* fd, backlog */
4057         [TARGET_SYS_ACCEPT] = 3,      /* fd, addr, addrlen */
4058         [TARGET_SYS_GETSOCKNAME] = 3, /* fd, addr, addrlen */
4059         [TARGET_SYS_GETPEERNAME] = 3, /* fd, addr, addrlen */
4060         [TARGET_SYS_SOCKETPAIR] = 4,  /* domain, type, protocol, tab */
4061         [TARGET_SYS_SEND] = 4,        /* fd, msg, len, flags */
4062         [TARGET_SYS_RECV] = 4,        /* fd, msg, len, flags */
4063         [TARGET_SYS_SENDTO] = 6,      /* fd, msg, len, flags, addr, addrlen */
4064         [TARGET_SYS_RECVFROM] = 6,    /* fd, msg, len, flags, addr, addrlen */
4065         [TARGET_SYS_SHUTDOWN] = 2,    /* fd, how */
4066         [TARGET_SYS_SETSOCKOPT] = 5,  /* fd, level, optname, optval, optlen */
4067         [TARGET_SYS_GETSOCKOPT] = 5,  /* fd, level, optname, optval, optlen */
4068         [TARGET_SYS_SENDMSG] = 3,     /* fd, msg, flags */
4069         [TARGET_SYS_RECVMSG] = 3,     /* fd, msg, flags */
4070         [TARGET_SYS_ACCEPT4] = 4,     /* fd, addr, addrlen, flags */
4071         [TARGET_SYS_RECVMMSG] = 4,    /* fd, msgvec, vlen, flags */
4072         [TARGET_SYS_SENDMMSG] = 4,    /* fd, msgvec, vlen, flags */
4073     };
4074     abi_long a[6]; /* max 6 args */
4075     unsigned i;
4076 
4077     /* check the range of the first argument num */
4078     /* (TARGET_SYS_SENDMMSG is the highest among TARGET_SYS_xxx) */
4079     if (num < 1 || num > TARGET_SYS_SENDMMSG) {
4080         return -TARGET_EINVAL;
4081     }
4082     /* ensure we have space for args */
4083     if (nargs[num] > ARRAY_SIZE(a)) {
4084         return -TARGET_EINVAL;
4085     }
4086     /* collect the arguments in a[] according to nargs[] */
4087     for (i = 0; i < nargs[num]; ++i) {
4088         if (get_user_ual(a[i], vptr + i * sizeof(abi_long)) != 0) {
4089             return -TARGET_EFAULT;
4090         }
4091     }
4092     /* now when we have the args, invoke the appropriate underlying function */
4093     switch (num) {
4094     case TARGET_SYS_SOCKET: /* domain, type, protocol */
4095         return do_socket(a[0], a[1], a[2]);
4096     case TARGET_SYS_BIND: /* sockfd, addr, addrlen */
4097         return do_bind(a[0], a[1], a[2]);
4098     case TARGET_SYS_CONNECT: /* sockfd, addr, addrlen */
4099         return do_connect(a[0], a[1], a[2]);
4100     case TARGET_SYS_LISTEN: /* sockfd, backlog */
4101         return get_errno(listen(a[0], a[1]));
4102     case TARGET_SYS_ACCEPT: /* sockfd, addr, addrlen */
4103         return do_accept4(a[0], a[1], a[2], 0);
4104     case TARGET_SYS_GETSOCKNAME: /* sockfd, addr, addrlen */
4105         return do_getsockname(a[0], a[1], a[2]);
4106     case TARGET_SYS_GETPEERNAME: /* sockfd, addr, addrlen */
4107         return do_getpeername(a[0], a[1], a[2]);
4108     case TARGET_SYS_SOCKETPAIR: /* domain, type, protocol, tab */
4109         return do_socketpair(a[0], a[1], a[2], a[3]);
4110     case TARGET_SYS_SEND: /* sockfd, msg, len, flags */
4111         return do_sendto(a[0], a[1], a[2], a[3], 0, 0);
4112     case TARGET_SYS_RECV: /* sockfd, msg, len, flags */
4113         return do_recvfrom(a[0], a[1], a[2], a[3], 0, 0);
4114     case TARGET_SYS_SENDTO: /* sockfd, msg, len, flags, addr, addrlen */
4115         return do_sendto(a[0], a[1], a[2], a[3], a[4], a[5]);
4116     case TARGET_SYS_RECVFROM: /* sockfd, msg, len, flags, addr, addrlen */
4117         return do_recvfrom(a[0], a[1], a[2], a[3], a[4], a[5]);
4118     case TARGET_SYS_SHUTDOWN: /* sockfd, how */
4119         return get_errno(shutdown(a[0], a[1]));
4120     case TARGET_SYS_SETSOCKOPT: /* sockfd, level, optname, optval, optlen */
4121         return do_setsockopt(a[0], a[1], a[2], a[3], a[4]);
4122     case TARGET_SYS_GETSOCKOPT: /* sockfd, level, optname, optval, optlen */
4123         return do_getsockopt(a[0], a[1], a[2], a[3], a[4]);
4124     case TARGET_SYS_SENDMSG: /* sockfd, msg, flags */
4125         return do_sendrecvmsg(a[0], a[1], a[2], 1);
4126     case TARGET_SYS_RECVMSG: /* sockfd, msg, flags */
4127         return do_sendrecvmsg(a[0], a[1], a[2], 0);
4128     case TARGET_SYS_ACCEPT4: /* sockfd, addr, addrlen, flags */
4129         return do_accept4(a[0], a[1], a[2], a[3]);
4130     case TARGET_SYS_RECVMMSG: /* sockfd, msgvec, vlen, flags */
4131         return do_sendrecvmmsg(a[0], a[1], a[2], a[3], 0);
4132     case TARGET_SYS_SENDMMSG: /* sockfd, msgvec, vlen, flags */
4133         return do_sendrecvmmsg(a[0], a[1], a[2], a[3], 1);
4134     default:
4135         gemu_log("Unsupported socketcall: %d\n", num);
4136         return -TARGET_EINVAL;
4137     }
4138 }
4139 #endif
4140 
4141 #define N_SHM_REGIONS	32
4142 
4143 static struct shm_region {
4144     abi_ulong start;
4145     abi_ulong size;
4146     bool in_use;
4147 } shm_regions[N_SHM_REGIONS];
4148 
4149 #ifndef TARGET_SEMID64_DS
4150 /* asm-generic version of this struct */
4151 struct target_semid64_ds
4152 {
4153   struct target_ipc_perm sem_perm;
4154   abi_ulong sem_otime;
4155 #if TARGET_ABI_BITS == 32
4156   abi_ulong __unused1;
4157 #endif
4158   abi_ulong sem_ctime;
4159 #if TARGET_ABI_BITS == 32
4160   abi_ulong __unused2;
4161 #endif
4162   abi_ulong sem_nsems;
4163   abi_ulong __unused3;
4164   abi_ulong __unused4;
4165 };
4166 #endif
4167 
4168 static inline abi_long target_to_host_ipc_perm(struct ipc_perm *host_ip,
4169                                                abi_ulong target_addr)
4170 {
4171     struct target_ipc_perm *target_ip;
4172     struct target_semid64_ds *target_sd;
4173 
4174     if (!lock_user_struct(VERIFY_READ, target_sd, target_addr, 1))
4175         return -TARGET_EFAULT;
4176     target_ip = &(target_sd->sem_perm);
4177     host_ip->__key = tswap32(target_ip->__key);
4178     host_ip->uid = tswap32(target_ip->uid);
4179     host_ip->gid = tswap32(target_ip->gid);
4180     host_ip->cuid = tswap32(target_ip->cuid);
4181     host_ip->cgid = tswap32(target_ip->cgid);
4182 #if defined(TARGET_ALPHA) || defined(TARGET_MIPS) || defined(TARGET_PPC)
4183     host_ip->mode = tswap32(target_ip->mode);
4184 #else
4185     host_ip->mode = tswap16(target_ip->mode);
4186 #endif
4187 #if defined(TARGET_PPC)
4188     host_ip->__seq = tswap32(target_ip->__seq);
4189 #else
4190     host_ip->__seq = tswap16(target_ip->__seq);
4191 #endif
4192     unlock_user_struct(target_sd, target_addr, 0);
4193     return 0;
4194 }
4195 
4196 static inline abi_long host_to_target_ipc_perm(abi_ulong target_addr,
4197                                                struct ipc_perm *host_ip)
4198 {
4199     struct target_ipc_perm *target_ip;
4200     struct target_semid64_ds *target_sd;
4201 
4202     if (!lock_user_struct(VERIFY_WRITE, target_sd, target_addr, 0))
4203         return -TARGET_EFAULT;
4204     target_ip = &(target_sd->sem_perm);
4205     target_ip->__key = tswap32(host_ip->__key);
4206     target_ip->uid = tswap32(host_ip->uid);
4207     target_ip->gid = tswap32(host_ip->gid);
4208     target_ip->cuid = tswap32(host_ip->cuid);
4209     target_ip->cgid = tswap32(host_ip->cgid);
4210 #if defined(TARGET_ALPHA) || defined(TARGET_MIPS) || defined(TARGET_PPC)
4211     target_ip->mode = tswap32(host_ip->mode);
4212 #else
4213     target_ip->mode = tswap16(host_ip->mode);
4214 #endif
4215 #if defined(TARGET_PPC)
4216     target_ip->__seq = tswap32(host_ip->__seq);
4217 #else
4218     target_ip->__seq = tswap16(host_ip->__seq);
4219 #endif
4220     unlock_user_struct(target_sd, target_addr, 1);
4221     return 0;
4222 }
4223 
4224 static inline abi_long target_to_host_semid_ds(struct semid_ds *host_sd,
4225                                                abi_ulong target_addr)
4226 {
4227     struct target_semid64_ds *target_sd;
4228 
4229     if (!lock_user_struct(VERIFY_READ, target_sd, target_addr, 1))
4230         return -TARGET_EFAULT;
4231     if (target_to_host_ipc_perm(&(host_sd->sem_perm),target_addr))
4232         return -TARGET_EFAULT;
4233     host_sd->sem_nsems = tswapal(target_sd->sem_nsems);
4234     host_sd->sem_otime = tswapal(target_sd->sem_otime);
4235     host_sd->sem_ctime = tswapal(target_sd->sem_ctime);
4236     unlock_user_struct(target_sd, target_addr, 0);
4237     return 0;
4238 }
4239 
4240 static inline abi_long host_to_target_semid_ds(abi_ulong target_addr,
4241                                                struct semid_ds *host_sd)
4242 {
4243     struct target_semid64_ds *target_sd;
4244 
4245     if (!lock_user_struct(VERIFY_WRITE, target_sd, target_addr, 0))
4246         return -TARGET_EFAULT;
4247     if (host_to_target_ipc_perm(target_addr,&(host_sd->sem_perm)))
4248         return -TARGET_EFAULT;
4249     target_sd->sem_nsems = tswapal(host_sd->sem_nsems);
4250     target_sd->sem_otime = tswapal(host_sd->sem_otime);
4251     target_sd->sem_ctime = tswapal(host_sd->sem_ctime);
4252     unlock_user_struct(target_sd, target_addr, 1);
4253     return 0;
4254 }
4255 
4256 struct target_seminfo {
4257     int semmap;
4258     int semmni;
4259     int semmns;
4260     int semmnu;
4261     int semmsl;
4262     int semopm;
4263     int semume;
4264     int semusz;
4265     int semvmx;
4266     int semaem;
4267 };
4268 
4269 static inline abi_long host_to_target_seminfo(abi_ulong target_addr,
4270                                               struct seminfo *host_seminfo)
4271 {
4272     struct target_seminfo *target_seminfo;
4273     if (!lock_user_struct(VERIFY_WRITE, target_seminfo, target_addr, 0))
4274         return -TARGET_EFAULT;
4275     __put_user(host_seminfo->semmap, &target_seminfo->semmap);
4276     __put_user(host_seminfo->semmni, &target_seminfo->semmni);
4277     __put_user(host_seminfo->semmns, &target_seminfo->semmns);
4278     __put_user(host_seminfo->semmnu, &target_seminfo->semmnu);
4279     __put_user(host_seminfo->semmsl, &target_seminfo->semmsl);
4280     __put_user(host_seminfo->semopm, &target_seminfo->semopm);
4281     __put_user(host_seminfo->semume, &target_seminfo->semume);
4282     __put_user(host_seminfo->semusz, &target_seminfo->semusz);
4283     __put_user(host_seminfo->semvmx, &target_seminfo->semvmx);
4284     __put_user(host_seminfo->semaem, &target_seminfo->semaem);
4285     unlock_user_struct(target_seminfo, target_addr, 1);
4286     return 0;
4287 }
4288 
4289 union semun {
4290 	int val;
4291 	struct semid_ds *buf;
4292 	unsigned short *array;
4293 	struct seminfo *__buf;
4294 };
4295 
4296 union target_semun {
4297 	int val;
4298 	abi_ulong buf;
4299 	abi_ulong array;
4300 	abi_ulong __buf;
4301 };
4302 
4303 static inline abi_long target_to_host_semarray(int semid, unsigned short **host_array,
4304                                                abi_ulong target_addr)
4305 {
4306     int nsems;
4307     unsigned short *array;
4308     union semun semun;
4309     struct semid_ds semid_ds;
4310     int i, ret;
4311 
4312     semun.buf = &semid_ds;
4313 
4314     ret = semctl(semid, 0, IPC_STAT, semun);
4315     if (ret == -1)
4316         return get_errno(ret);
4317 
4318     nsems = semid_ds.sem_nsems;
4319 
4320     *host_array = g_try_new(unsigned short, nsems);
4321     if (!*host_array) {
4322         return -TARGET_ENOMEM;
4323     }
4324     array = lock_user(VERIFY_READ, target_addr,
4325                       nsems*sizeof(unsigned short), 1);
4326     if (!array) {
4327         g_free(*host_array);
4328         return -TARGET_EFAULT;
4329     }
4330 
4331     for(i=0; i<nsems; i++) {
4332         __get_user((*host_array)[i], &array[i]);
4333     }
4334     unlock_user(array, target_addr, 0);
4335 
4336     return 0;
4337 }
4338 
4339 static inline abi_long host_to_target_semarray(int semid, abi_ulong target_addr,
4340                                                unsigned short **host_array)
4341 {
4342     int nsems;
4343     unsigned short *array;
4344     union semun semun;
4345     struct semid_ds semid_ds;
4346     int i, ret;
4347 
4348     semun.buf = &semid_ds;
4349 
4350     ret = semctl(semid, 0, IPC_STAT, semun);
4351     if (ret == -1)
4352         return get_errno(ret);
4353 
4354     nsems = semid_ds.sem_nsems;
4355 
4356     array = lock_user(VERIFY_WRITE, target_addr,
4357                       nsems*sizeof(unsigned short), 0);
4358     if (!array)
4359         return -TARGET_EFAULT;
4360 
4361     for(i=0; i<nsems; i++) {
4362         __put_user((*host_array)[i], &array[i]);
4363     }
4364     g_free(*host_array);
4365     unlock_user(array, target_addr, 1);
4366 
4367     return 0;
4368 }
4369 
4370 static inline abi_long do_semctl(int semid, int semnum, int cmd,
4371                                  abi_ulong target_arg)
4372 {
4373     union target_semun target_su = { .buf = target_arg };
4374     union semun arg;
4375     struct semid_ds dsarg;
4376     unsigned short *array = NULL;
4377     struct seminfo seminfo;
4378     abi_long ret = -TARGET_EINVAL;
4379     abi_long err;
4380     cmd &= 0xff;
4381 
4382     switch( cmd ) {
4383 	case GETVAL:
4384 	case SETVAL:
4385             /* In 64 bit cross-endian situations, we will erroneously pick up
4386              * the wrong half of the union for the "val" element.  To rectify
4387              * this, the entire 8-byte structure is byteswapped, followed by
4388 	     * a swap of the 4 byte val field. In other cases, the data is
4389 	     * already in proper host byte order. */
4390 	    if (sizeof(target_su.val) != (sizeof(target_su.buf))) {
4391 		target_su.buf = tswapal(target_su.buf);
4392 		arg.val = tswap32(target_su.val);
4393 	    } else {
4394 		arg.val = target_su.val;
4395 	    }
4396             ret = get_errno(semctl(semid, semnum, cmd, arg));
4397             break;
4398 	case GETALL:
4399 	case SETALL:
4400             err = target_to_host_semarray(semid, &array, target_su.array);
4401             if (err)
4402                 return err;
4403             arg.array = array;
4404             ret = get_errno(semctl(semid, semnum, cmd, arg));
4405             err = host_to_target_semarray(semid, target_su.array, &array);
4406             if (err)
4407                 return err;
4408             break;
4409 	case IPC_STAT:
4410 	case IPC_SET:
4411 	case SEM_STAT:
4412             err = target_to_host_semid_ds(&dsarg, target_su.buf);
4413             if (err)
4414                 return err;
4415             arg.buf = &dsarg;
4416             ret = get_errno(semctl(semid, semnum, cmd, arg));
4417             err = host_to_target_semid_ds(target_su.buf, &dsarg);
4418             if (err)
4419                 return err;
4420             break;
4421 	case IPC_INFO:
4422 	case SEM_INFO:
4423             arg.__buf = &seminfo;
4424             ret = get_errno(semctl(semid, semnum, cmd, arg));
4425             err = host_to_target_seminfo(target_su.__buf, &seminfo);
4426             if (err)
4427                 return err;
4428             break;
4429 	case IPC_RMID:
4430 	case GETPID:
4431 	case GETNCNT:
4432 	case GETZCNT:
4433             ret = get_errno(semctl(semid, semnum, cmd, NULL));
4434             break;
4435     }
4436 
4437     return ret;
4438 }
4439 
4440 struct target_sembuf {
4441     unsigned short sem_num;
4442     short sem_op;
4443     short sem_flg;
4444 };
4445 
4446 static inline abi_long target_to_host_sembuf(struct sembuf *host_sembuf,
4447                                              abi_ulong target_addr,
4448                                              unsigned nsops)
4449 {
4450     struct target_sembuf *target_sembuf;
4451     int i;
4452 
4453     target_sembuf = lock_user(VERIFY_READ, target_addr,
4454                               nsops*sizeof(struct target_sembuf), 1);
4455     if (!target_sembuf)
4456         return -TARGET_EFAULT;
4457 
4458     for(i=0; i<nsops; i++) {
4459         __get_user(host_sembuf[i].sem_num, &target_sembuf[i].sem_num);
4460         __get_user(host_sembuf[i].sem_op, &target_sembuf[i].sem_op);
4461         __get_user(host_sembuf[i].sem_flg, &target_sembuf[i].sem_flg);
4462     }
4463 
4464     unlock_user(target_sembuf, target_addr, 0);
4465 
4466     return 0;
4467 }
4468 
4469 static inline abi_long do_semop(int semid, abi_long ptr, unsigned nsops)
4470 {
4471     struct sembuf sops[nsops];
4472 
4473     if (target_to_host_sembuf(sops, ptr, nsops))
4474         return -TARGET_EFAULT;
4475 
4476     return get_errno(safe_semtimedop(semid, sops, nsops, NULL));
4477 }
4478 
4479 struct target_msqid_ds
4480 {
4481     struct target_ipc_perm msg_perm;
4482     abi_ulong msg_stime;
4483 #if TARGET_ABI_BITS == 32
4484     abi_ulong __unused1;
4485 #endif
4486     abi_ulong msg_rtime;
4487 #if TARGET_ABI_BITS == 32
4488     abi_ulong __unused2;
4489 #endif
4490     abi_ulong msg_ctime;
4491 #if TARGET_ABI_BITS == 32
4492     abi_ulong __unused3;
4493 #endif
4494     abi_ulong __msg_cbytes;
4495     abi_ulong msg_qnum;
4496     abi_ulong msg_qbytes;
4497     abi_ulong msg_lspid;
4498     abi_ulong msg_lrpid;
4499     abi_ulong __unused4;
4500     abi_ulong __unused5;
4501 };
4502 
4503 static inline abi_long target_to_host_msqid_ds(struct msqid_ds *host_md,
4504                                                abi_ulong target_addr)
4505 {
4506     struct target_msqid_ds *target_md;
4507 
4508     if (!lock_user_struct(VERIFY_READ, target_md, target_addr, 1))
4509         return -TARGET_EFAULT;
4510     if (target_to_host_ipc_perm(&(host_md->msg_perm),target_addr))
4511         return -TARGET_EFAULT;
4512     host_md->msg_stime = tswapal(target_md->msg_stime);
4513     host_md->msg_rtime = tswapal(target_md->msg_rtime);
4514     host_md->msg_ctime = tswapal(target_md->msg_ctime);
4515     host_md->__msg_cbytes = tswapal(target_md->__msg_cbytes);
4516     host_md->msg_qnum = tswapal(target_md->msg_qnum);
4517     host_md->msg_qbytes = tswapal(target_md->msg_qbytes);
4518     host_md->msg_lspid = tswapal(target_md->msg_lspid);
4519     host_md->msg_lrpid = tswapal(target_md->msg_lrpid);
4520     unlock_user_struct(target_md, target_addr, 0);
4521     return 0;
4522 }
4523 
4524 static inline abi_long host_to_target_msqid_ds(abi_ulong target_addr,
4525                                                struct msqid_ds *host_md)
4526 {
4527     struct target_msqid_ds *target_md;
4528 
4529     if (!lock_user_struct(VERIFY_WRITE, target_md, target_addr, 0))
4530         return -TARGET_EFAULT;
4531     if (host_to_target_ipc_perm(target_addr,&(host_md->msg_perm)))
4532         return -TARGET_EFAULT;
4533     target_md->msg_stime = tswapal(host_md->msg_stime);
4534     target_md->msg_rtime = tswapal(host_md->msg_rtime);
4535     target_md->msg_ctime = tswapal(host_md->msg_ctime);
4536     target_md->__msg_cbytes = tswapal(host_md->__msg_cbytes);
4537     target_md->msg_qnum = tswapal(host_md->msg_qnum);
4538     target_md->msg_qbytes = tswapal(host_md->msg_qbytes);
4539     target_md->msg_lspid = tswapal(host_md->msg_lspid);
4540     target_md->msg_lrpid = tswapal(host_md->msg_lrpid);
4541     unlock_user_struct(target_md, target_addr, 1);
4542     return 0;
4543 }
4544 
4545 struct target_msginfo {
4546     int msgpool;
4547     int msgmap;
4548     int msgmax;
4549     int msgmnb;
4550     int msgmni;
4551     int msgssz;
4552     int msgtql;
4553     unsigned short int msgseg;
4554 };
4555 
4556 static inline abi_long host_to_target_msginfo(abi_ulong target_addr,
4557                                               struct msginfo *host_msginfo)
4558 {
4559     struct target_msginfo *target_msginfo;
4560     if (!lock_user_struct(VERIFY_WRITE, target_msginfo, target_addr, 0))
4561         return -TARGET_EFAULT;
4562     __put_user(host_msginfo->msgpool, &target_msginfo->msgpool);
4563     __put_user(host_msginfo->msgmap, &target_msginfo->msgmap);
4564     __put_user(host_msginfo->msgmax, &target_msginfo->msgmax);
4565     __put_user(host_msginfo->msgmnb, &target_msginfo->msgmnb);
4566     __put_user(host_msginfo->msgmni, &target_msginfo->msgmni);
4567     __put_user(host_msginfo->msgssz, &target_msginfo->msgssz);
4568     __put_user(host_msginfo->msgtql, &target_msginfo->msgtql);
4569     __put_user(host_msginfo->msgseg, &target_msginfo->msgseg);
4570     unlock_user_struct(target_msginfo, target_addr, 1);
4571     return 0;
4572 }
4573 
4574 static inline abi_long do_msgctl(int msgid, int cmd, abi_long ptr)
4575 {
4576     struct msqid_ds dsarg;
4577     struct msginfo msginfo;
4578     abi_long ret = -TARGET_EINVAL;
4579 
4580     cmd &= 0xff;
4581 
4582     switch (cmd) {
4583     case IPC_STAT:
4584     case IPC_SET:
4585     case MSG_STAT:
4586         if (target_to_host_msqid_ds(&dsarg,ptr))
4587             return -TARGET_EFAULT;
4588         ret = get_errno(msgctl(msgid, cmd, &dsarg));
4589         if (host_to_target_msqid_ds(ptr,&dsarg))
4590             return -TARGET_EFAULT;
4591         break;
4592     case IPC_RMID:
4593         ret = get_errno(msgctl(msgid, cmd, NULL));
4594         break;
4595     case IPC_INFO:
4596     case MSG_INFO:
4597         ret = get_errno(msgctl(msgid, cmd, (struct msqid_ds *)&msginfo));
4598         if (host_to_target_msginfo(ptr, &msginfo))
4599             return -TARGET_EFAULT;
4600         break;
4601     }
4602 
4603     return ret;
4604 }
4605 
4606 struct target_msgbuf {
4607     abi_long mtype;
4608     char	mtext[1];
4609 };
4610 
4611 static inline abi_long do_msgsnd(int msqid, abi_long msgp,
4612                                  ssize_t msgsz, int msgflg)
4613 {
4614     struct target_msgbuf *target_mb;
4615     struct msgbuf *host_mb;
4616     abi_long ret = 0;
4617 
4618     if (msgsz < 0) {
4619         return -TARGET_EINVAL;
4620     }
4621 
4622     if (!lock_user_struct(VERIFY_READ, target_mb, msgp, 0))
4623         return -TARGET_EFAULT;
4624     host_mb = g_try_malloc(msgsz + sizeof(long));
4625     if (!host_mb) {
4626         unlock_user_struct(target_mb, msgp, 0);
4627         return -TARGET_ENOMEM;
4628     }
4629     host_mb->mtype = (abi_long) tswapal(target_mb->mtype);
4630     memcpy(host_mb->mtext, target_mb->mtext, msgsz);
4631     ret = get_errno(safe_msgsnd(msqid, host_mb, msgsz, msgflg));
4632     g_free(host_mb);
4633     unlock_user_struct(target_mb, msgp, 0);
4634 
4635     return ret;
4636 }
4637 
4638 static inline abi_long do_msgrcv(int msqid, abi_long msgp,
4639                                  ssize_t msgsz, abi_long msgtyp,
4640                                  int msgflg)
4641 {
4642     struct target_msgbuf *target_mb;
4643     char *target_mtext;
4644     struct msgbuf *host_mb;
4645     abi_long ret = 0;
4646 
4647     if (msgsz < 0) {
4648         return -TARGET_EINVAL;
4649     }
4650 
4651     if (!lock_user_struct(VERIFY_WRITE, target_mb, msgp, 0))
4652         return -TARGET_EFAULT;
4653 
4654     host_mb = g_try_malloc(msgsz + sizeof(long));
4655     if (!host_mb) {
4656         ret = -TARGET_ENOMEM;
4657         goto end;
4658     }
4659     ret = get_errno(safe_msgrcv(msqid, host_mb, msgsz, msgtyp, msgflg));
4660 
4661     if (ret > 0) {
4662         abi_ulong target_mtext_addr = msgp + sizeof(abi_ulong);
4663         target_mtext = lock_user(VERIFY_WRITE, target_mtext_addr, ret, 0);
4664         if (!target_mtext) {
4665             ret = -TARGET_EFAULT;
4666             goto end;
4667         }
4668         memcpy(target_mb->mtext, host_mb->mtext, ret);
4669         unlock_user(target_mtext, target_mtext_addr, ret);
4670     }
4671 
4672     target_mb->mtype = tswapal(host_mb->mtype);
4673 
4674 end:
4675     if (target_mb)
4676         unlock_user_struct(target_mb, msgp, 1);
4677     g_free(host_mb);
4678     return ret;
4679 }
4680 
4681 static inline abi_long target_to_host_shmid_ds(struct shmid_ds *host_sd,
4682                                                abi_ulong target_addr)
4683 {
4684     struct target_shmid_ds *target_sd;
4685 
4686     if (!lock_user_struct(VERIFY_READ, target_sd, target_addr, 1))
4687         return -TARGET_EFAULT;
4688     if (target_to_host_ipc_perm(&(host_sd->shm_perm), target_addr))
4689         return -TARGET_EFAULT;
4690     __get_user(host_sd->shm_segsz, &target_sd->shm_segsz);
4691     __get_user(host_sd->shm_atime, &target_sd->shm_atime);
4692     __get_user(host_sd->shm_dtime, &target_sd->shm_dtime);
4693     __get_user(host_sd->shm_ctime, &target_sd->shm_ctime);
4694     __get_user(host_sd->shm_cpid, &target_sd->shm_cpid);
4695     __get_user(host_sd->shm_lpid, &target_sd->shm_lpid);
4696     __get_user(host_sd->shm_nattch, &target_sd->shm_nattch);
4697     unlock_user_struct(target_sd, target_addr, 0);
4698     return 0;
4699 }
4700 
4701 static inline abi_long host_to_target_shmid_ds(abi_ulong target_addr,
4702                                                struct shmid_ds *host_sd)
4703 {
4704     struct target_shmid_ds *target_sd;
4705 
4706     if (!lock_user_struct(VERIFY_WRITE, target_sd, target_addr, 0))
4707         return -TARGET_EFAULT;
4708     if (host_to_target_ipc_perm(target_addr, &(host_sd->shm_perm)))
4709         return -TARGET_EFAULT;
4710     __put_user(host_sd->shm_segsz, &target_sd->shm_segsz);
4711     __put_user(host_sd->shm_atime, &target_sd->shm_atime);
4712     __put_user(host_sd->shm_dtime, &target_sd->shm_dtime);
4713     __put_user(host_sd->shm_ctime, &target_sd->shm_ctime);
4714     __put_user(host_sd->shm_cpid, &target_sd->shm_cpid);
4715     __put_user(host_sd->shm_lpid, &target_sd->shm_lpid);
4716     __put_user(host_sd->shm_nattch, &target_sd->shm_nattch);
4717     unlock_user_struct(target_sd, target_addr, 1);
4718     return 0;
4719 }
4720 
4721 struct  target_shminfo {
4722     abi_ulong shmmax;
4723     abi_ulong shmmin;
4724     abi_ulong shmmni;
4725     abi_ulong shmseg;
4726     abi_ulong shmall;
4727 };
4728 
4729 static inline abi_long host_to_target_shminfo(abi_ulong target_addr,
4730                                               struct shminfo *host_shminfo)
4731 {
4732     struct target_shminfo *target_shminfo;
4733     if (!lock_user_struct(VERIFY_WRITE, target_shminfo, target_addr, 0))
4734         return -TARGET_EFAULT;
4735     __put_user(host_shminfo->shmmax, &target_shminfo->shmmax);
4736     __put_user(host_shminfo->shmmin, &target_shminfo->shmmin);
4737     __put_user(host_shminfo->shmmni, &target_shminfo->shmmni);
4738     __put_user(host_shminfo->shmseg, &target_shminfo->shmseg);
4739     __put_user(host_shminfo->shmall, &target_shminfo->shmall);
4740     unlock_user_struct(target_shminfo, target_addr, 1);
4741     return 0;
4742 }
4743 
4744 struct target_shm_info {
4745     int used_ids;
4746     abi_ulong shm_tot;
4747     abi_ulong shm_rss;
4748     abi_ulong shm_swp;
4749     abi_ulong swap_attempts;
4750     abi_ulong swap_successes;
4751 };
4752 
4753 static inline abi_long host_to_target_shm_info(abi_ulong target_addr,
4754                                                struct shm_info *host_shm_info)
4755 {
4756     struct target_shm_info *target_shm_info;
4757     if (!lock_user_struct(VERIFY_WRITE, target_shm_info, target_addr, 0))
4758         return -TARGET_EFAULT;
4759     __put_user(host_shm_info->used_ids, &target_shm_info->used_ids);
4760     __put_user(host_shm_info->shm_tot, &target_shm_info->shm_tot);
4761     __put_user(host_shm_info->shm_rss, &target_shm_info->shm_rss);
4762     __put_user(host_shm_info->shm_swp, &target_shm_info->shm_swp);
4763     __put_user(host_shm_info->swap_attempts, &target_shm_info->swap_attempts);
4764     __put_user(host_shm_info->swap_successes, &target_shm_info->swap_successes);
4765     unlock_user_struct(target_shm_info, target_addr, 1);
4766     return 0;
4767 }
4768 
4769 static inline abi_long do_shmctl(int shmid, int cmd, abi_long buf)
4770 {
4771     struct shmid_ds dsarg;
4772     struct shminfo shminfo;
4773     struct shm_info shm_info;
4774     abi_long ret = -TARGET_EINVAL;
4775 
4776     cmd &= 0xff;
4777 
4778     switch(cmd) {
4779     case IPC_STAT:
4780     case IPC_SET:
4781     case SHM_STAT:
4782         if (target_to_host_shmid_ds(&dsarg, buf))
4783             return -TARGET_EFAULT;
4784         ret = get_errno(shmctl(shmid, cmd, &dsarg));
4785         if (host_to_target_shmid_ds(buf, &dsarg))
4786             return -TARGET_EFAULT;
4787         break;
4788     case IPC_INFO:
4789         ret = get_errno(shmctl(shmid, cmd, (struct shmid_ds *)&shminfo));
4790         if (host_to_target_shminfo(buf, &shminfo))
4791             return -TARGET_EFAULT;
4792         break;
4793     case SHM_INFO:
4794         ret = get_errno(shmctl(shmid, cmd, (struct shmid_ds *)&shm_info));
4795         if (host_to_target_shm_info(buf, &shm_info))
4796             return -TARGET_EFAULT;
4797         break;
4798     case IPC_RMID:
4799     case SHM_LOCK:
4800     case SHM_UNLOCK:
4801         ret = get_errno(shmctl(shmid, cmd, NULL));
4802         break;
4803     }
4804 
4805     return ret;
4806 }
4807 
4808 #ifndef TARGET_FORCE_SHMLBA
4809 /* For most architectures, SHMLBA is the same as the page size;
4810  * some architectures have larger values, in which case they should
4811  * define TARGET_FORCE_SHMLBA and provide a target_shmlba() function.
4812  * This corresponds to the kernel arch code defining __ARCH_FORCE_SHMLBA
4813  * and defining its own value for SHMLBA.
4814  *
4815  * The kernel also permits SHMLBA to be set by the architecture to a
4816  * value larger than the page size without setting __ARCH_FORCE_SHMLBA;
4817  * this means that addresses are rounded to the large size if
4818  * SHM_RND is set but addresses not aligned to that size are not rejected
4819  * as long as they are at least page-aligned. Since the only architecture
4820  * which uses this is ia64 this code doesn't provide for that oddity.
4821  */
4822 static inline abi_ulong target_shmlba(CPUArchState *cpu_env)
4823 {
4824     return TARGET_PAGE_SIZE;
4825 }
4826 #endif
4827 
4828 static inline abi_ulong do_shmat(CPUArchState *cpu_env,
4829                                  int shmid, abi_ulong shmaddr, int shmflg)
4830 {
4831     abi_long raddr;
4832     void *host_raddr;
4833     struct shmid_ds shm_info;
4834     int i,ret;
4835     abi_ulong shmlba;
4836 
4837     /* find out the length of the shared memory segment */
4838     ret = get_errno(shmctl(shmid, IPC_STAT, &shm_info));
4839     if (is_error(ret)) {
4840         /* can't get length, bail out */
4841         return ret;
4842     }
4843 
4844     shmlba = target_shmlba(cpu_env);
4845 
4846     if (shmaddr & (shmlba - 1)) {
4847         if (shmflg & SHM_RND) {
4848             shmaddr &= ~(shmlba - 1);
4849         } else {
4850             return -TARGET_EINVAL;
4851         }
4852     }
4853 
4854     mmap_lock();
4855 
4856     if (shmaddr)
4857         host_raddr = shmat(shmid, (void *)g2h(shmaddr), shmflg);
4858     else {
4859         abi_ulong mmap_start;
4860 
4861         mmap_start = mmap_find_vma(0, shm_info.shm_segsz);
4862 
4863         if (mmap_start == -1) {
4864             errno = ENOMEM;
4865             host_raddr = (void *)-1;
4866         } else
4867             host_raddr = shmat(shmid, g2h(mmap_start), shmflg | SHM_REMAP);
4868     }
4869 
4870     if (host_raddr == (void *)-1) {
4871         mmap_unlock();
4872         return get_errno((long)host_raddr);
4873     }
4874     raddr=h2g((unsigned long)host_raddr);
4875 
4876     page_set_flags(raddr, raddr + shm_info.shm_segsz,
4877                    PAGE_VALID | PAGE_READ |
4878                    ((shmflg & SHM_RDONLY)? 0 : PAGE_WRITE));
4879 
4880     for (i = 0; i < N_SHM_REGIONS; i++) {
4881         if (!shm_regions[i].in_use) {
4882             shm_regions[i].in_use = true;
4883             shm_regions[i].start = raddr;
4884             shm_regions[i].size = shm_info.shm_segsz;
4885             break;
4886         }
4887     }
4888 
4889     mmap_unlock();
4890     return raddr;
4891 
4892 }
4893 
4894 static inline abi_long do_shmdt(abi_ulong shmaddr)
4895 {
4896     int i;
4897 
4898     for (i = 0; i < N_SHM_REGIONS; ++i) {
4899         if (shm_regions[i].in_use && shm_regions[i].start == shmaddr) {
4900             shm_regions[i].in_use = false;
4901             page_set_flags(shmaddr, shmaddr + shm_regions[i].size, 0);
4902             break;
4903         }
4904     }
4905 
4906     return get_errno(shmdt(g2h(shmaddr)));
4907 }
4908 
4909 #ifdef TARGET_NR_ipc
4910 /* ??? This only works with linear mappings.  */
4911 /* do_ipc() must return target values and target errnos. */
4912 static abi_long do_ipc(CPUArchState *cpu_env,
4913                        unsigned int call, abi_long first,
4914                        abi_long second, abi_long third,
4915                        abi_long ptr, abi_long fifth)
4916 {
4917     int version;
4918     abi_long ret = 0;
4919 
4920     version = call >> 16;
4921     call &= 0xffff;
4922 
4923     switch (call) {
4924     case IPCOP_semop:
4925         ret = do_semop(first, ptr, second);
4926         break;
4927 
4928     case IPCOP_semget:
4929         ret = get_errno(semget(first, second, third));
4930         break;
4931 
4932     case IPCOP_semctl: {
4933         /* The semun argument to semctl is passed by value, so dereference the
4934          * ptr argument. */
4935         abi_ulong atptr;
4936         get_user_ual(atptr, ptr);
4937         ret = do_semctl(first, second, third, atptr);
4938         break;
4939     }
4940 
4941     case IPCOP_msgget:
4942         ret = get_errno(msgget(first, second));
4943         break;
4944 
4945     case IPCOP_msgsnd:
4946         ret = do_msgsnd(first, ptr, second, third);
4947         break;
4948 
4949     case IPCOP_msgctl:
4950         ret = do_msgctl(first, second, ptr);
4951         break;
4952 
4953     case IPCOP_msgrcv:
4954         switch (version) {
4955         case 0:
4956             {
4957                 struct target_ipc_kludge {
4958                     abi_long msgp;
4959                     abi_long msgtyp;
4960                 } *tmp;
4961 
4962                 if (!lock_user_struct(VERIFY_READ, tmp, ptr, 1)) {
4963                     ret = -TARGET_EFAULT;
4964                     break;
4965                 }
4966 
4967                 ret = do_msgrcv(first, tswapal(tmp->msgp), second, tswapal(tmp->msgtyp), third);
4968 
4969                 unlock_user_struct(tmp, ptr, 0);
4970                 break;
4971             }
4972         default:
4973             ret = do_msgrcv(first, ptr, second, fifth, third);
4974         }
4975         break;
4976 
4977     case IPCOP_shmat:
4978         switch (version) {
4979         default:
4980         {
4981             abi_ulong raddr;
4982             raddr = do_shmat(cpu_env, first, ptr, second);
4983             if (is_error(raddr))
4984                 return get_errno(raddr);
4985             if (put_user_ual(raddr, third))
4986                 return -TARGET_EFAULT;
4987             break;
4988         }
4989         case 1:
4990             ret = -TARGET_EINVAL;
4991             break;
4992         }
4993 	break;
4994     case IPCOP_shmdt:
4995         ret = do_shmdt(ptr);
4996 	break;
4997 
4998     case IPCOP_shmget:
4999 	/* IPC_* flag values are the same on all linux platforms */
5000 	ret = get_errno(shmget(first, second, third));
5001 	break;
5002 
5003 	/* IPC_* and SHM_* command values are the same on all linux platforms */
5004     case IPCOP_shmctl:
5005         ret = do_shmctl(first, second, ptr);
5006         break;
5007     default:
5008 	gemu_log("Unsupported ipc call: %d (version %d)\n", call, version);
5009 	ret = -TARGET_ENOSYS;
5010 	break;
5011     }
5012     return ret;
5013 }
5014 #endif
5015 
5016 /* kernel structure types definitions */
5017 
5018 #define STRUCT(name, ...) STRUCT_ ## name,
5019 #define STRUCT_SPECIAL(name) STRUCT_ ## name,
5020 enum {
5021 #include "syscall_types.h"
5022 STRUCT_MAX
5023 };
5024 #undef STRUCT
5025 #undef STRUCT_SPECIAL
5026 
5027 #define STRUCT(name, ...) static const argtype struct_ ## name ## _def[] = {  __VA_ARGS__, TYPE_NULL };
5028 #define STRUCT_SPECIAL(name)
5029 #include "syscall_types.h"
5030 #undef STRUCT
5031 #undef STRUCT_SPECIAL
5032 
5033 typedef struct IOCTLEntry IOCTLEntry;
5034 
5035 typedef abi_long do_ioctl_fn(const IOCTLEntry *ie, uint8_t *buf_temp,
5036                              int fd, int cmd, abi_long arg);
5037 
5038 struct IOCTLEntry {
5039     int target_cmd;
5040     unsigned int host_cmd;
5041     const char *name;
5042     int access;
5043     do_ioctl_fn *do_ioctl;
5044     const argtype arg_type[5];
5045 };
5046 
5047 #define IOC_R 0x0001
5048 #define IOC_W 0x0002
5049 #define IOC_RW (IOC_R | IOC_W)
5050 
5051 #define MAX_STRUCT_SIZE 4096
5052 
5053 #ifdef CONFIG_FIEMAP
5054 /* So fiemap access checks don't overflow on 32 bit systems.
5055  * This is very slightly smaller than the limit imposed by
5056  * the underlying kernel.
5057  */
5058 #define FIEMAP_MAX_EXTENTS ((UINT_MAX - sizeof(struct fiemap))  \
5059                             / sizeof(struct fiemap_extent))
5060 
5061 static abi_long do_ioctl_fs_ioc_fiemap(const IOCTLEntry *ie, uint8_t *buf_temp,
5062                                        int fd, int cmd, abi_long arg)
5063 {
5064     /* The parameter for this ioctl is a struct fiemap followed
5065      * by an array of struct fiemap_extent whose size is set
5066      * in fiemap->fm_extent_count. The array is filled in by the
5067      * ioctl.
5068      */
5069     int target_size_in, target_size_out;
5070     struct fiemap *fm;
5071     const argtype *arg_type = ie->arg_type;
5072     const argtype extent_arg_type[] = { MK_STRUCT(STRUCT_fiemap_extent) };
5073     void *argptr, *p;
5074     abi_long ret;
5075     int i, extent_size = thunk_type_size(extent_arg_type, 0);
5076     uint32_t outbufsz;
5077     int free_fm = 0;
5078 
5079     assert(arg_type[0] == TYPE_PTR);
5080     assert(ie->access == IOC_RW);
5081     arg_type++;
5082     target_size_in = thunk_type_size(arg_type, 0);
5083     argptr = lock_user(VERIFY_READ, arg, target_size_in, 1);
5084     if (!argptr) {
5085         return -TARGET_EFAULT;
5086     }
5087     thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
5088     unlock_user(argptr, arg, 0);
5089     fm = (struct fiemap *)buf_temp;
5090     if (fm->fm_extent_count > FIEMAP_MAX_EXTENTS) {
5091         return -TARGET_EINVAL;
5092     }
5093 
5094     outbufsz = sizeof (*fm) +
5095         (sizeof(struct fiemap_extent) * fm->fm_extent_count);
5096 
5097     if (outbufsz > MAX_STRUCT_SIZE) {
5098         /* We can't fit all the extents into the fixed size buffer.
5099          * Allocate one that is large enough and use it instead.
5100          */
5101         fm = g_try_malloc(outbufsz);
5102         if (!fm) {
5103             return -TARGET_ENOMEM;
5104         }
5105         memcpy(fm, buf_temp, sizeof(struct fiemap));
5106         free_fm = 1;
5107     }
5108     ret = get_errno(safe_ioctl(fd, ie->host_cmd, fm));
5109     if (!is_error(ret)) {
5110         target_size_out = target_size_in;
5111         /* An extent_count of 0 means we were only counting the extents
5112          * so there are no structs to copy
5113          */
5114         if (fm->fm_extent_count != 0) {
5115             target_size_out += fm->fm_mapped_extents * extent_size;
5116         }
5117         argptr = lock_user(VERIFY_WRITE, arg, target_size_out, 0);
5118         if (!argptr) {
5119             ret = -TARGET_EFAULT;
5120         } else {
5121             /* Convert the struct fiemap */
5122             thunk_convert(argptr, fm, arg_type, THUNK_TARGET);
5123             if (fm->fm_extent_count != 0) {
5124                 p = argptr + target_size_in;
5125                 /* ...and then all the struct fiemap_extents */
5126                 for (i = 0; i < fm->fm_mapped_extents; i++) {
5127                     thunk_convert(p, &fm->fm_extents[i], extent_arg_type,
5128                                   THUNK_TARGET);
5129                     p += extent_size;
5130                 }
5131             }
5132             unlock_user(argptr, arg, target_size_out);
5133         }
5134     }
5135     if (free_fm) {
5136         g_free(fm);
5137     }
5138     return ret;
5139 }
5140 #endif
5141 
5142 static abi_long do_ioctl_ifconf(const IOCTLEntry *ie, uint8_t *buf_temp,
5143                                 int fd, int cmd, abi_long arg)
5144 {
5145     const argtype *arg_type = ie->arg_type;
5146     int target_size;
5147     void *argptr;
5148     int ret;
5149     struct ifconf *host_ifconf;
5150     uint32_t outbufsz;
5151     const argtype ifreq_arg_type[] = { MK_STRUCT(STRUCT_sockaddr_ifreq) };
5152     int target_ifreq_size;
5153     int nb_ifreq;
5154     int free_buf = 0;
5155     int i;
5156     int target_ifc_len;
5157     abi_long target_ifc_buf;
5158     int host_ifc_len;
5159     char *host_ifc_buf;
5160 
5161     assert(arg_type[0] == TYPE_PTR);
5162     assert(ie->access == IOC_RW);
5163 
5164     arg_type++;
5165     target_size = thunk_type_size(arg_type, 0);
5166 
5167     argptr = lock_user(VERIFY_READ, arg, target_size, 1);
5168     if (!argptr)
5169         return -TARGET_EFAULT;
5170     thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
5171     unlock_user(argptr, arg, 0);
5172 
5173     host_ifconf = (struct ifconf *)(unsigned long)buf_temp;
5174     target_ifc_len = host_ifconf->ifc_len;
5175     target_ifc_buf = (abi_long)(unsigned long)host_ifconf->ifc_buf;
5176 
5177     target_ifreq_size = thunk_type_size(ifreq_arg_type, 0);
5178     nb_ifreq = target_ifc_len / target_ifreq_size;
5179     host_ifc_len = nb_ifreq * sizeof(struct ifreq);
5180 
5181     outbufsz = sizeof(*host_ifconf) + host_ifc_len;
5182     if (outbufsz > MAX_STRUCT_SIZE) {
5183         /* We can't fit all the extents into the fixed size buffer.
5184          * Allocate one that is large enough and use it instead.
5185          */
5186         host_ifconf = malloc(outbufsz);
5187         if (!host_ifconf) {
5188             return -TARGET_ENOMEM;
5189         }
5190         memcpy(host_ifconf, buf_temp, sizeof(*host_ifconf));
5191         free_buf = 1;
5192     }
5193     host_ifc_buf = (char*)host_ifconf + sizeof(*host_ifconf);
5194 
5195     host_ifconf->ifc_len = host_ifc_len;
5196     host_ifconf->ifc_buf = host_ifc_buf;
5197 
5198     ret = get_errno(safe_ioctl(fd, ie->host_cmd, host_ifconf));
5199     if (!is_error(ret)) {
5200 	/* convert host ifc_len to target ifc_len */
5201 
5202         nb_ifreq = host_ifconf->ifc_len / sizeof(struct ifreq);
5203         target_ifc_len = nb_ifreq * target_ifreq_size;
5204         host_ifconf->ifc_len = target_ifc_len;
5205 
5206 	/* restore target ifc_buf */
5207 
5208         host_ifconf->ifc_buf = (char *)(unsigned long)target_ifc_buf;
5209 
5210 	/* copy struct ifconf to target user */
5211 
5212         argptr = lock_user(VERIFY_WRITE, arg, target_size, 0);
5213         if (!argptr)
5214             return -TARGET_EFAULT;
5215         thunk_convert(argptr, host_ifconf, arg_type, THUNK_TARGET);
5216         unlock_user(argptr, arg, target_size);
5217 
5218 	/* copy ifreq[] to target user */
5219 
5220         argptr = lock_user(VERIFY_WRITE, target_ifc_buf, target_ifc_len, 0);
5221         for (i = 0; i < nb_ifreq ; i++) {
5222             thunk_convert(argptr + i * target_ifreq_size,
5223                           host_ifc_buf + i * sizeof(struct ifreq),
5224                           ifreq_arg_type, THUNK_TARGET);
5225         }
5226         unlock_user(argptr, target_ifc_buf, target_ifc_len);
5227     }
5228 
5229     if (free_buf) {
5230         free(host_ifconf);
5231     }
5232 
5233     return ret;
5234 }
5235 
5236 static abi_long do_ioctl_dm(const IOCTLEntry *ie, uint8_t *buf_temp, int fd,
5237                             int cmd, abi_long arg)
5238 {
5239     void *argptr;
5240     struct dm_ioctl *host_dm;
5241     abi_long guest_data;
5242     uint32_t guest_data_size;
5243     int target_size;
5244     const argtype *arg_type = ie->arg_type;
5245     abi_long ret;
5246     void *big_buf = NULL;
5247     char *host_data;
5248 
5249     arg_type++;
5250     target_size = thunk_type_size(arg_type, 0);
5251     argptr = lock_user(VERIFY_READ, arg, target_size, 1);
5252     if (!argptr) {
5253         ret = -TARGET_EFAULT;
5254         goto out;
5255     }
5256     thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
5257     unlock_user(argptr, arg, 0);
5258 
5259     /* buf_temp is too small, so fetch things into a bigger buffer */
5260     big_buf = g_malloc0(((struct dm_ioctl*)buf_temp)->data_size * 2);
5261     memcpy(big_buf, buf_temp, target_size);
5262     buf_temp = big_buf;
5263     host_dm = big_buf;
5264 
5265     guest_data = arg + host_dm->data_start;
5266     if ((guest_data - arg) < 0) {
5267         ret = -TARGET_EINVAL;
5268         goto out;
5269     }
5270     guest_data_size = host_dm->data_size - host_dm->data_start;
5271     host_data = (char*)host_dm + host_dm->data_start;
5272 
5273     argptr = lock_user(VERIFY_READ, guest_data, guest_data_size, 1);
5274     if (!argptr) {
5275         ret = -TARGET_EFAULT;
5276         goto out;
5277     }
5278 
5279     switch (ie->host_cmd) {
5280     case DM_REMOVE_ALL:
5281     case DM_LIST_DEVICES:
5282     case DM_DEV_CREATE:
5283     case DM_DEV_REMOVE:
5284     case DM_DEV_SUSPEND:
5285     case DM_DEV_STATUS:
5286     case DM_DEV_WAIT:
5287     case DM_TABLE_STATUS:
5288     case DM_TABLE_CLEAR:
5289     case DM_TABLE_DEPS:
5290     case DM_LIST_VERSIONS:
5291         /* no input data */
5292         break;
5293     case DM_DEV_RENAME:
5294     case DM_DEV_SET_GEOMETRY:
5295         /* data contains only strings */
5296         memcpy(host_data, argptr, guest_data_size);
5297         break;
5298     case DM_TARGET_MSG:
5299         memcpy(host_data, argptr, guest_data_size);
5300         *(uint64_t*)host_data = tswap64(*(uint64_t*)argptr);
5301         break;
5302     case DM_TABLE_LOAD:
5303     {
5304         void *gspec = argptr;
5305         void *cur_data = host_data;
5306         const argtype arg_type[] = { MK_STRUCT(STRUCT_dm_target_spec) };
5307         int spec_size = thunk_type_size(arg_type, 0);
5308         int i;
5309 
5310         for (i = 0; i < host_dm->target_count; i++) {
5311             struct dm_target_spec *spec = cur_data;
5312             uint32_t next;
5313             int slen;
5314 
5315             thunk_convert(spec, gspec, arg_type, THUNK_HOST);
5316             slen = strlen((char*)gspec + spec_size) + 1;
5317             next = spec->next;
5318             spec->next = sizeof(*spec) + slen;
5319             strcpy((char*)&spec[1], gspec + spec_size);
5320             gspec += next;
5321             cur_data += spec->next;
5322         }
5323         break;
5324     }
5325     default:
5326         ret = -TARGET_EINVAL;
5327         unlock_user(argptr, guest_data, 0);
5328         goto out;
5329     }
5330     unlock_user(argptr, guest_data, 0);
5331 
5332     ret = get_errno(safe_ioctl(fd, ie->host_cmd, buf_temp));
5333     if (!is_error(ret)) {
5334         guest_data = arg + host_dm->data_start;
5335         guest_data_size = host_dm->data_size - host_dm->data_start;
5336         argptr = lock_user(VERIFY_WRITE, guest_data, guest_data_size, 0);
5337         switch (ie->host_cmd) {
5338         case DM_REMOVE_ALL:
5339         case DM_DEV_CREATE:
5340         case DM_DEV_REMOVE:
5341         case DM_DEV_RENAME:
5342         case DM_DEV_SUSPEND:
5343         case DM_DEV_STATUS:
5344         case DM_TABLE_LOAD:
5345         case DM_TABLE_CLEAR:
5346         case DM_TARGET_MSG:
5347         case DM_DEV_SET_GEOMETRY:
5348             /* no return data */
5349             break;
5350         case DM_LIST_DEVICES:
5351         {
5352             struct dm_name_list *nl = (void*)host_dm + host_dm->data_start;
5353             uint32_t remaining_data = guest_data_size;
5354             void *cur_data = argptr;
5355             const argtype arg_type[] = { MK_STRUCT(STRUCT_dm_name_list) };
5356             int nl_size = 12; /* can't use thunk_size due to alignment */
5357 
5358             while (1) {
5359                 uint32_t next = nl->next;
5360                 if (next) {
5361                     nl->next = nl_size + (strlen(nl->name) + 1);
5362                 }
5363                 if (remaining_data < nl->next) {
5364                     host_dm->flags |= DM_BUFFER_FULL_FLAG;
5365                     break;
5366                 }
5367                 thunk_convert(cur_data, nl, arg_type, THUNK_TARGET);
5368                 strcpy(cur_data + nl_size, nl->name);
5369                 cur_data += nl->next;
5370                 remaining_data -= nl->next;
5371                 if (!next) {
5372                     break;
5373                 }
5374                 nl = (void*)nl + next;
5375             }
5376             break;
5377         }
5378         case DM_DEV_WAIT:
5379         case DM_TABLE_STATUS:
5380         {
5381             struct dm_target_spec *spec = (void*)host_dm + host_dm->data_start;
5382             void *cur_data = argptr;
5383             const argtype arg_type[] = { MK_STRUCT(STRUCT_dm_target_spec) };
5384             int spec_size = thunk_type_size(arg_type, 0);
5385             int i;
5386 
5387             for (i = 0; i < host_dm->target_count; i++) {
5388                 uint32_t next = spec->next;
5389                 int slen = strlen((char*)&spec[1]) + 1;
5390                 spec->next = (cur_data - argptr) + spec_size + slen;
5391                 if (guest_data_size < spec->next) {
5392                     host_dm->flags |= DM_BUFFER_FULL_FLAG;
5393                     break;
5394                 }
5395                 thunk_convert(cur_data, spec, arg_type, THUNK_TARGET);
5396                 strcpy(cur_data + spec_size, (char*)&spec[1]);
5397                 cur_data = argptr + spec->next;
5398                 spec = (void*)host_dm + host_dm->data_start + next;
5399             }
5400             break;
5401         }
5402         case DM_TABLE_DEPS:
5403         {
5404             void *hdata = (void*)host_dm + host_dm->data_start;
5405             int count = *(uint32_t*)hdata;
5406             uint64_t *hdev = hdata + 8;
5407             uint64_t *gdev = argptr + 8;
5408             int i;
5409 
5410             *(uint32_t*)argptr = tswap32(count);
5411             for (i = 0; i < count; i++) {
5412                 *gdev = tswap64(*hdev);
5413                 gdev++;
5414                 hdev++;
5415             }
5416             break;
5417         }
5418         case DM_LIST_VERSIONS:
5419         {
5420             struct dm_target_versions *vers = (void*)host_dm + host_dm->data_start;
5421             uint32_t remaining_data = guest_data_size;
5422             void *cur_data = argptr;
5423             const argtype arg_type[] = { MK_STRUCT(STRUCT_dm_target_versions) };
5424             int vers_size = thunk_type_size(arg_type, 0);
5425 
5426             while (1) {
5427                 uint32_t next = vers->next;
5428                 if (next) {
5429                     vers->next = vers_size + (strlen(vers->name) + 1);
5430                 }
5431                 if (remaining_data < vers->next) {
5432                     host_dm->flags |= DM_BUFFER_FULL_FLAG;
5433                     break;
5434                 }
5435                 thunk_convert(cur_data, vers, arg_type, THUNK_TARGET);
5436                 strcpy(cur_data + vers_size, vers->name);
5437                 cur_data += vers->next;
5438                 remaining_data -= vers->next;
5439                 if (!next) {
5440                     break;
5441                 }
5442                 vers = (void*)vers + next;
5443             }
5444             break;
5445         }
5446         default:
5447             unlock_user(argptr, guest_data, 0);
5448             ret = -TARGET_EINVAL;
5449             goto out;
5450         }
5451         unlock_user(argptr, guest_data, guest_data_size);
5452 
5453         argptr = lock_user(VERIFY_WRITE, arg, target_size, 0);
5454         if (!argptr) {
5455             ret = -TARGET_EFAULT;
5456             goto out;
5457         }
5458         thunk_convert(argptr, buf_temp, arg_type, THUNK_TARGET);
5459         unlock_user(argptr, arg, target_size);
5460     }
5461 out:
5462     g_free(big_buf);
5463     return ret;
5464 }
5465 
5466 static abi_long do_ioctl_blkpg(const IOCTLEntry *ie, uint8_t *buf_temp, int fd,
5467                                int cmd, abi_long arg)
5468 {
5469     void *argptr;
5470     int target_size;
5471     const argtype *arg_type = ie->arg_type;
5472     const argtype part_arg_type[] = { MK_STRUCT(STRUCT_blkpg_partition) };
5473     abi_long ret;
5474 
5475     struct blkpg_ioctl_arg *host_blkpg = (void*)buf_temp;
5476     struct blkpg_partition host_part;
5477 
5478     /* Read and convert blkpg */
5479     arg_type++;
5480     target_size = thunk_type_size(arg_type, 0);
5481     argptr = lock_user(VERIFY_READ, arg, target_size, 1);
5482     if (!argptr) {
5483         ret = -TARGET_EFAULT;
5484         goto out;
5485     }
5486     thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
5487     unlock_user(argptr, arg, 0);
5488 
5489     switch (host_blkpg->op) {
5490     case BLKPG_ADD_PARTITION:
5491     case BLKPG_DEL_PARTITION:
5492         /* payload is struct blkpg_partition */
5493         break;
5494     default:
5495         /* Unknown opcode */
5496         ret = -TARGET_EINVAL;
5497         goto out;
5498     }
5499 
5500     /* Read and convert blkpg->data */
5501     arg = (abi_long)(uintptr_t)host_blkpg->data;
5502     target_size = thunk_type_size(part_arg_type, 0);
5503     argptr = lock_user(VERIFY_READ, arg, target_size, 1);
5504     if (!argptr) {
5505         ret = -TARGET_EFAULT;
5506         goto out;
5507     }
5508     thunk_convert(&host_part, argptr, part_arg_type, THUNK_HOST);
5509     unlock_user(argptr, arg, 0);
5510 
5511     /* Swizzle the data pointer to our local copy and call! */
5512     host_blkpg->data = &host_part;
5513     ret = get_errno(safe_ioctl(fd, ie->host_cmd, host_blkpg));
5514 
5515 out:
5516     return ret;
5517 }
5518 
5519 static abi_long do_ioctl_rt(const IOCTLEntry *ie, uint8_t *buf_temp,
5520                                 int fd, int cmd, abi_long arg)
5521 {
5522     const argtype *arg_type = ie->arg_type;
5523     const StructEntry *se;
5524     const argtype *field_types;
5525     const int *dst_offsets, *src_offsets;
5526     int target_size;
5527     void *argptr;
5528     abi_ulong *target_rt_dev_ptr;
5529     unsigned long *host_rt_dev_ptr;
5530     abi_long ret;
5531     int i;
5532 
5533     assert(ie->access == IOC_W);
5534     assert(*arg_type == TYPE_PTR);
5535     arg_type++;
5536     assert(*arg_type == TYPE_STRUCT);
5537     target_size = thunk_type_size(arg_type, 0);
5538     argptr = lock_user(VERIFY_READ, arg, target_size, 1);
5539     if (!argptr) {
5540         return -TARGET_EFAULT;
5541     }
5542     arg_type++;
5543     assert(*arg_type == (int)STRUCT_rtentry);
5544     se = struct_entries + *arg_type++;
5545     assert(se->convert[0] == NULL);
5546     /* convert struct here to be able to catch rt_dev string */
5547     field_types = se->field_types;
5548     dst_offsets = se->field_offsets[THUNK_HOST];
5549     src_offsets = se->field_offsets[THUNK_TARGET];
5550     for (i = 0; i < se->nb_fields; i++) {
5551         if (dst_offsets[i] == offsetof(struct rtentry, rt_dev)) {
5552             assert(*field_types == TYPE_PTRVOID);
5553             target_rt_dev_ptr = (abi_ulong *)(argptr + src_offsets[i]);
5554             host_rt_dev_ptr = (unsigned long *)(buf_temp + dst_offsets[i]);
5555             if (*target_rt_dev_ptr != 0) {
5556                 *host_rt_dev_ptr = (unsigned long)lock_user_string(
5557                                                   tswapal(*target_rt_dev_ptr));
5558                 if (!*host_rt_dev_ptr) {
5559                     unlock_user(argptr, arg, 0);
5560                     return -TARGET_EFAULT;
5561                 }
5562             } else {
5563                 *host_rt_dev_ptr = 0;
5564             }
5565             field_types++;
5566             continue;
5567         }
5568         field_types = thunk_convert(buf_temp + dst_offsets[i],
5569                                     argptr + src_offsets[i],
5570                                     field_types, THUNK_HOST);
5571     }
5572     unlock_user(argptr, arg, 0);
5573 
5574     ret = get_errno(safe_ioctl(fd, ie->host_cmd, buf_temp));
5575     if (*host_rt_dev_ptr != 0) {
5576         unlock_user((void *)*host_rt_dev_ptr,
5577                     *target_rt_dev_ptr, 0);
5578     }
5579     return ret;
5580 }
5581 
5582 static abi_long do_ioctl_kdsigaccept(const IOCTLEntry *ie, uint8_t *buf_temp,
5583                                      int fd, int cmd, abi_long arg)
5584 {
5585     int sig = target_to_host_signal(arg);
5586     return get_errno(safe_ioctl(fd, ie->host_cmd, sig));
5587 }
5588 
5589 static IOCTLEntry ioctl_entries[] = {
5590 #define IOCTL(cmd, access, ...) \
5591     { TARGET_ ## cmd, cmd, #cmd, access, 0, {  __VA_ARGS__ } },
5592 #define IOCTL_SPECIAL(cmd, access, dofn, ...)                      \
5593     { TARGET_ ## cmd, cmd, #cmd, access, dofn, {  __VA_ARGS__ } },
5594 #define IOCTL_IGNORE(cmd) \
5595     { TARGET_ ## cmd, 0, #cmd },
5596 #include "ioctls.h"
5597     { 0, 0, },
5598 };
5599 
5600 /* ??? Implement proper locking for ioctls.  */
5601 /* do_ioctl() Must return target values and target errnos. */
5602 static abi_long do_ioctl(int fd, int cmd, abi_long arg)
5603 {
5604     const IOCTLEntry *ie;
5605     const argtype *arg_type;
5606     abi_long ret;
5607     uint8_t buf_temp[MAX_STRUCT_SIZE];
5608     int target_size;
5609     void *argptr;
5610 
5611     ie = ioctl_entries;
5612     for(;;) {
5613         if (ie->target_cmd == 0) {
5614             gemu_log("Unsupported ioctl: cmd=0x%04lx\n", (long)cmd);
5615             return -TARGET_ENOSYS;
5616         }
5617         if (ie->target_cmd == cmd)
5618             break;
5619         ie++;
5620     }
5621     arg_type = ie->arg_type;
5622 #if defined(DEBUG)
5623     gemu_log("ioctl: cmd=0x%04lx (%s)\n", (long)cmd, ie->name);
5624 #endif
5625     if (ie->do_ioctl) {
5626         return ie->do_ioctl(ie, buf_temp, fd, cmd, arg);
5627     } else if (!ie->host_cmd) {
5628         /* Some architectures define BSD ioctls in their headers
5629            that are not implemented in Linux.  */
5630         return -TARGET_ENOSYS;
5631     }
5632 
5633     switch(arg_type[0]) {
5634     case TYPE_NULL:
5635         /* no argument */
5636         ret = get_errno(safe_ioctl(fd, ie->host_cmd));
5637         break;
5638     case TYPE_PTRVOID:
5639     case TYPE_INT:
5640         ret = get_errno(safe_ioctl(fd, ie->host_cmd, arg));
5641         break;
5642     case TYPE_PTR:
5643         arg_type++;
5644         target_size = thunk_type_size(arg_type, 0);
5645         switch(ie->access) {
5646         case IOC_R:
5647             ret = get_errno(safe_ioctl(fd, ie->host_cmd, buf_temp));
5648             if (!is_error(ret)) {
5649                 argptr = lock_user(VERIFY_WRITE, arg, target_size, 0);
5650                 if (!argptr)
5651                     return -TARGET_EFAULT;
5652                 thunk_convert(argptr, buf_temp, arg_type, THUNK_TARGET);
5653                 unlock_user(argptr, arg, target_size);
5654             }
5655             break;
5656         case IOC_W:
5657             argptr = lock_user(VERIFY_READ, arg, target_size, 1);
5658             if (!argptr)
5659                 return -TARGET_EFAULT;
5660             thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
5661             unlock_user(argptr, arg, 0);
5662             ret = get_errno(safe_ioctl(fd, ie->host_cmd, buf_temp));
5663             break;
5664         default:
5665         case IOC_RW:
5666             argptr = lock_user(VERIFY_READ, arg, target_size, 1);
5667             if (!argptr)
5668                 return -TARGET_EFAULT;
5669             thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
5670             unlock_user(argptr, arg, 0);
5671             ret = get_errno(safe_ioctl(fd, ie->host_cmd, buf_temp));
5672             if (!is_error(ret)) {
5673                 argptr = lock_user(VERIFY_WRITE, arg, target_size, 0);
5674                 if (!argptr)
5675                     return -TARGET_EFAULT;
5676                 thunk_convert(argptr, buf_temp, arg_type, THUNK_TARGET);
5677                 unlock_user(argptr, arg, target_size);
5678             }
5679             break;
5680         }
5681         break;
5682     default:
5683         gemu_log("Unsupported ioctl type: cmd=0x%04lx type=%d\n",
5684                  (long)cmd, arg_type[0]);
5685         ret = -TARGET_ENOSYS;
5686         break;
5687     }
5688     return ret;
5689 }
5690 
5691 static const bitmask_transtbl iflag_tbl[] = {
5692         { TARGET_IGNBRK, TARGET_IGNBRK, IGNBRK, IGNBRK },
5693         { TARGET_BRKINT, TARGET_BRKINT, BRKINT, BRKINT },
5694         { TARGET_IGNPAR, TARGET_IGNPAR, IGNPAR, IGNPAR },
5695         { TARGET_PARMRK, TARGET_PARMRK, PARMRK, PARMRK },
5696         { TARGET_INPCK, TARGET_INPCK, INPCK, INPCK },
5697         { TARGET_ISTRIP, TARGET_ISTRIP, ISTRIP, ISTRIP },
5698         { TARGET_INLCR, TARGET_INLCR, INLCR, INLCR },
5699         { TARGET_IGNCR, TARGET_IGNCR, IGNCR, IGNCR },
5700         { TARGET_ICRNL, TARGET_ICRNL, ICRNL, ICRNL },
5701         { TARGET_IUCLC, TARGET_IUCLC, IUCLC, IUCLC },
5702         { TARGET_IXON, TARGET_IXON, IXON, IXON },
5703         { TARGET_IXANY, TARGET_IXANY, IXANY, IXANY },
5704         { TARGET_IXOFF, TARGET_IXOFF, IXOFF, IXOFF },
5705         { TARGET_IMAXBEL, TARGET_IMAXBEL, IMAXBEL, IMAXBEL },
5706         { 0, 0, 0, 0 }
5707 };
5708 
5709 static const bitmask_transtbl oflag_tbl[] = {
5710 	{ TARGET_OPOST, TARGET_OPOST, OPOST, OPOST },
5711 	{ TARGET_OLCUC, TARGET_OLCUC, OLCUC, OLCUC },
5712 	{ TARGET_ONLCR, TARGET_ONLCR, ONLCR, ONLCR },
5713 	{ TARGET_OCRNL, TARGET_OCRNL, OCRNL, OCRNL },
5714 	{ TARGET_ONOCR, TARGET_ONOCR, ONOCR, ONOCR },
5715 	{ TARGET_ONLRET, TARGET_ONLRET, ONLRET, ONLRET },
5716 	{ TARGET_OFILL, TARGET_OFILL, OFILL, OFILL },
5717 	{ TARGET_OFDEL, TARGET_OFDEL, OFDEL, OFDEL },
5718 	{ TARGET_NLDLY, TARGET_NL0, NLDLY, NL0 },
5719 	{ TARGET_NLDLY, TARGET_NL1, NLDLY, NL1 },
5720 	{ TARGET_CRDLY, TARGET_CR0, CRDLY, CR0 },
5721 	{ TARGET_CRDLY, TARGET_CR1, CRDLY, CR1 },
5722 	{ TARGET_CRDLY, TARGET_CR2, CRDLY, CR2 },
5723 	{ TARGET_CRDLY, TARGET_CR3, CRDLY, CR3 },
5724 	{ TARGET_TABDLY, TARGET_TAB0, TABDLY, TAB0 },
5725 	{ TARGET_TABDLY, TARGET_TAB1, TABDLY, TAB1 },
5726 	{ TARGET_TABDLY, TARGET_TAB2, TABDLY, TAB2 },
5727 	{ TARGET_TABDLY, TARGET_TAB3, TABDLY, TAB3 },
5728 	{ TARGET_BSDLY, TARGET_BS0, BSDLY, BS0 },
5729 	{ TARGET_BSDLY, TARGET_BS1, BSDLY, BS1 },
5730 	{ TARGET_VTDLY, TARGET_VT0, VTDLY, VT0 },
5731 	{ TARGET_VTDLY, TARGET_VT1, VTDLY, VT1 },
5732 	{ TARGET_FFDLY, TARGET_FF0, FFDLY, FF0 },
5733 	{ TARGET_FFDLY, TARGET_FF1, FFDLY, FF1 },
5734 	{ 0, 0, 0, 0 }
5735 };
5736 
5737 static const bitmask_transtbl cflag_tbl[] = {
5738 	{ TARGET_CBAUD, TARGET_B0, CBAUD, B0 },
5739 	{ TARGET_CBAUD, TARGET_B50, CBAUD, B50 },
5740 	{ TARGET_CBAUD, TARGET_B75, CBAUD, B75 },
5741 	{ TARGET_CBAUD, TARGET_B110, CBAUD, B110 },
5742 	{ TARGET_CBAUD, TARGET_B134, CBAUD, B134 },
5743 	{ TARGET_CBAUD, TARGET_B150, CBAUD, B150 },
5744 	{ TARGET_CBAUD, TARGET_B200, CBAUD, B200 },
5745 	{ TARGET_CBAUD, TARGET_B300, CBAUD, B300 },
5746 	{ TARGET_CBAUD, TARGET_B600, CBAUD, B600 },
5747 	{ TARGET_CBAUD, TARGET_B1200, CBAUD, B1200 },
5748 	{ TARGET_CBAUD, TARGET_B1800, CBAUD, B1800 },
5749 	{ TARGET_CBAUD, TARGET_B2400, CBAUD, B2400 },
5750 	{ TARGET_CBAUD, TARGET_B4800, CBAUD, B4800 },
5751 	{ TARGET_CBAUD, TARGET_B9600, CBAUD, B9600 },
5752 	{ TARGET_CBAUD, TARGET_B19200, CBAUD, B19200 },
5753 	{ TARGET_CBAUD, TARGET_B38400, CBAUD, B38400 },
5754 	{ TARGET_CBAUD, TARGET_B57600, CBAUD, B57600 },
5755 	{ TARGET_CBAUD, TARGET_B115200, CBAUD, B115200 },
5756 	{ TARGET_CBAUD, TARGET_B230400, CBAUD, B230400 },
5757 	{ TARGET_CBAUD, TARGET_B460800, CBAUD, B460800 },
5758 	{ TARGET_CSIZE, TARGET_CS5, CSIZE, CS5 },
5759 	{ TARGET_CSIZE, TARGET_CS6, CSIZE, CS6 },
5760 	{ TARGET_CSIZE, TARGET_CS7, CSIZE, CS7 },
5761 	{ TARGET_CSIZE, TARGET_CS8, CSIZE, CS8 },
5762 	{ TARGET_CSTOPB, TARGET_CSTOPB, CSTOPB, CSTOPB },
5763 	{ TARGET_CREAD, TARGET_CREAD, CREAD, CREAD },
5764 	{ TARGET_PARENB, TARGET_PARENB, PARENB, PARENB },
5765 	{ TARGET_PARODD, TARGET_PARODD, PARODD, PARODD },
5766 	{ TARGET_HUPCL, TARGET_HUPCL, HUPCL, HUPCL },
5767 	{ TARGET_CLOCAL, TARGET_CLOCAL, CLOCAL, CLOCAL },
5768 	{ TARGET_CRTSCTS, TARGET_CRTSCTS, CRTSCTS, CRTSCTS },
5769 	{ 0, 0, 0, 0 }
5770 };
5771 
5772 static const bitmask_transtbl lflag_tbl[] = {
5773 	{ TARGET_ISIG, TARGET_ISIG, ISIG, ISIG },
5774 	{ TARGET_ICANON, TARGET_ICANON, ICANON, ICANON },
5775 	{ TARGET_XCASE, TARGET_XCASE, XCASE, XCASE },
5776 	{ TARGET_ECHO, TARGET_ECHO, ECHO, ECHO },
5777 	{ TARGET_ECHOE, TARGET_ECHOE, ECHOE, ECHOE },
5778 	{ TARGET_ECHOK, TARGET_ECHOK, ECHOK, ECHOK },
5779 	{ TARGET_ECHONL, TARGET_ECHONL, ECHONL, ECHONL },
5780 	{ TARGET_NOFLSH, TARGET_NOFLSH, NOFLSH, NOFLSH },
5781 	{ TARGET_TOSTOP, TARGET_TOSTOP, TOSTOP, TOSTOP },
5782 	{ TARGET_ECHOCTL, TARGET_ECHOCTL, ECHOCTL, ECHOCTL },
5783 	{ TARGET_ECHOPRT, TARGET_ECHOPRT, ECHOPRT, ECHOPRT },
5784 	{ TARGET_ECHOKE, TARGET_ECHOKE, ECHOKE, ECHOKE },
5785 	{ TARGET_FLUSHO, TARGET_FLUSHO, FLUSHO, FLUSHO },
5786 	{ TARGET_PENDIN, TARGET_PENDIN, PENDIN, PENDIN },
5787 	{ TARGET_IEXTEN, TARGET_IEXTEN, IEXTEN, IEXTEN },
5788 	{ 0, 0, 0, 0 }
5789 };
5790 
5791 static void target_to_host_termios (void *dst, const void *src)
5792 {
5793     struct host_termios *host = dst;
5794     const struct target_termios *target = src;
5795 
5796     host->c_iflag =
5797         target_to_host_bitmask(tswap32(target->c_iflag), iflag_tbl);
5798     host->c_oflag =
5799         target_to_host_bitmask(tswap32(target->c_oflag), oflag_tbl);
5800     host->c_cflag =
5801         target_to_host_bitmask(tswap32(target->c_cflag), cflag_tbl);
5802     host->c_lflag =
5803         target_to_host_bitmask(tswap32(target->c_lflag), lflag_tbl);
5804     host->c_line = target->c_line;
5805 
5806     memset(host->c_cc, 0, sizeof(host->c_cc));
5807     host->c_cc[VINTR] = target->c_cc[TARGET_VINTR];
5808     host->c_cc[VQUIT] = target->c_cc[TARGET_VQUIT];
5809     host->c_cc[VERASE] = target->c_cc[TARGET_VERASE];
5810     host->c_cc[VKILL] = target->c_cc[TARGET_VKILL];
5811     host->c_cc[VEOF] = target->c_cc[TARGET_VEOF];
5812     host->c_cc[VTIME] = target->c_cc[TARGET_VTIME];
5813     host->c_cc[VMIN] = target->c_cc[TARGET_VMIN];
5814     host->c_cc[VSWTC] = target->c_cc[TARGET_VSWTC];
5815     host->c_cc[VSTART] = target->c_cc[TARGET_VSTART];
5816     host->c_cc[VSTOP] = target->c_cc[TARGET_VSTOP];
5817     host->c_cc[VSUSP] = target->c_cc[TARGET_VSUSP];
5818     host->c_cc[VEOL] = target->c_cc[TARGET_VEOL];
5819     host->c_cc[VREPRINT] = target->c_cc[TARGET_VREPRINT];
5820     host->c_cc[VDISCARD] = target->c_cc[TARGET_VDISCARD];
5821     host->c_cc[VWERASE] = target->c_cc[TARGET_VWERASE];
5822     host->c_cc[VLNEXT] = target->c_cc[TARGET_VLNEXT];
5823     host->c_cc[VEOL2] = target->c_cc[TARGET_VEOL2];
5824 }
5825 
5826 static void host_to_target_termios (void *dst, const void *src)
5827 {
5828     struct target_termios *target = dst;
5829     const struct host_termios *host = src;
5830 
5831     target->c_iflag =
5832         tswap32(host_to_target_bitmask(host->c_iflag, iflag_tbl));
5833     target->c_oflag =
5834         tswap32(host_to_target_bitmask(host->c_oflag, oflag_tbl));
5835     target->c_cflag =
5836         tswap32(host_to_target_bitmask(host->c_cflag, cflag_tbl));
5837     target->c_lflag =
5838         tswap32(host_to_target_bitmask(host->c_lflag, lflag_tbl));
5839     target->c_line = host->c_line;
5840 
5841     memset(target->c_cc, 0, sizeof(target->c_cc));
5842     target->c_cc[TARGET_VINTR] = host->c_cc[VINTR];
5843     target->c_cc[TARGET_VQUIT] = host->c_cc[VQUIT];
5844     target->c_cc[TARGET_VERASE] = host->c_cc[VERASE];
5845     target->c_cc[TARGET_VKILL] = host->c_cc[VKILL];
5846     target->c_cc[TARGET_VEOF] = host->c_cc[VEOF];
5847     target->c_cc[TARGET_VTIME] = host->c_cc[VTIME];
5848     target->c_cc[TARGET_VMIN] = host->c_cc[VMIN];
5849     target->c_cc[TARGET_VSWTC] = host->c_cc[VSWTC];
5850     target->c_cc[TARGET_VSTART] = host->c_cc[VSTART];
5851     target->c_cc[TARGET_VSTOP] = host->c_cc[VSTOP];
5852     target->c_cc[TARGET_VSUSP] = host->c_cc[VSUSP];
5853     target->c_cc[TARGET_VEOL] = host->c_cc[VEOL];
5854     target->c_cc[TARGET_VREPRINT] = host->c_cc[VREPRINT];
5855     target->c_cc[TARGET_VDISCARD] = host->c_cc[VDISCARD];
5856     target->c_cc[TARGET_VWERASE] = host->c_cc[VWERASE];
5857     target->c_cc[TARGET_VLNEXT] = host->c_cc[VLNEXT];
5858     target->c_cc[TARGET_VEOL2] = host->c_cc[VEOL2];
5859 }
5860 
5861 static const StructEntry struct_termios_def = {
5862     .convert = { host_to_target_termios, target_to_host_termios },
5863     .size = { sizeof(struct target_termios), sizeof(struct host_termios) },
5864     .align = { __alignof__(struct target_termios), __alignof__(struct host_termios) },
5865 };
5866 
5867 static bitmask_transtbl mmap_flags_tbl[] = {
5868 	{ TARGET_MAP_SHARED, TARGET_MAP_SHARED, MAP_SHARED, MAP_SHARED },
5869 	{ TARGET_MAP_PRIVATE, TARGET_MAP_PRIVATE, MAP_PRIVATE, MAP_PRIVATE },
5870 	{ TARGET_MAP_FIXED, TARGET_MAP_FIXED, MAP_FIXED, MAP_FIXED },
5871 	{ TARGET_MAP_ANONYMOUS, TARGET_MAP_ANONYMOUS, MAP_ANONYMOUS, MAP_ANONYMOUS },
5872 	{ TARGET_MAP_GROWSDOWN, TARGET_MAP_GROWSDOWN, MAP_GROWSDOWN, MAP_GROWSDOWN },
5873 	{ TARGET_MAP_DENYWRITE, TARGET_MAP_DENYWRITE, MAP_DENYWRITE, MAP_DENYWRITE },
5874 	{ TARGET_MAP_EXECUTABLE, TARGET_MAP_EXECUTABLE, MAP_EXECUTABLE, MAP_EXECUTABLE },
5875 	{ TARGET_MAP_LOCKED, TARGET_MAP_LOCKED, MAP_LOCKED, MAP_LOCKED },
5876         { TARGET_MAP_NORESERVE, TARGET_MAP_NORESERVE, MAP_NORESERVE,
5877           MAP_NORESERVE },
5878 	{ 0, 0, 0, 0 }
5879 };
5880 
5881 #if defined(TARGET_I386)
5882 
5883 /* NOTE: there is really one LDT for all the threads */
5884 static uint8_t *ldt_table;
5885 
5886 static abi_long read_ldt(abi_ulong ptr, unsigned long bytecount)
5887 {
5888     int size;
5889     void *p;
5890 
5891     if (!ldt_table)
5892         return 0;
5893     size = TARGET_LDT_ENTRIES * TARGET_LDT_ENTRY_SIZE;
5894     if (size > bytecount)
5895         size = bytecount;
5896     p = lock_user(VERIFY_WRITE, ptr, size, 0);
5897     if (!p)
5898         return -TARGET_EFAULT;
5899     /* ??? Should this by byteswapped?  */
5900     memcpy(p, ldt_table, size);
5901     unlock_user(p, ptr, size);
5902     return size;
5903 }
5904 
5905 /* XXX: add locking support */
5906 static abi_long write_ldt(CPUX86State *env,
5907                           abi_ulong ptr, unsigned long bytecount, int oldmode)
5908 {
5909     struct target_modify_ldt_ldt_s ldt_info;
5910     struct target_modify_ldt_ldt_s *target_ldt_info;
5911     int seg_32bit, contents, read_exec_only, limit_in_pages;
5912     int seg_not_present, useable, lm;
5913     uint32_t *lp, entry_1, entry_2;
5914 
5915     if (bytecount != sizeof(ldt_info))
5916         return -TARGET_EINVAL;
5917     if (!lock_user_struct(VERIFY_READ, target_ldt_info, ptr, 1))
5918         return -TARGET_EFAULT;
5919     ldt_info.entry_number = tswap32(target_ldt_info->entry_number);
5920     ldt_info.base_addr = tswapal(target_ldt_info->base_addr);
5921     ldt_info.limit = tswap32(target_ldt_info->limit);
5922     ldt_info.flags = tswap32(target_ldt_info->flags);
5923     unlock_user_struct(target_ldt_info, ptr, 0);
5924 
5925     if (ldt_info.entry_number >= TARGET_LDT_ENTRIES)
5926         return -TARGET_EINVAL;
5927     seg_32bit = ldt_info.flags & 1;
5928     contents = (ldt_info.flags >> 1) & 3;
5929     read_exec_only = (ldt_info.flags >> 3) & 1;
5930     limit_in_pages = (ldt_info.flags >> 4) & 1;
5931     seg_not_present = (ldt_info.flags >> 5) & 1;
5932     useable = (ldt_info.flags >> 6) & 1;
5933 #ifdef TARGET_ABI32
5934     lm = 0;
5935 #else
5936     lm = (ldt_info.flags >> 7) & 1;
5937 #endif
5938     if (contents == 3) {
5939         if (oldmode)
5940             return -TARGET_EINVAL;
5941         if (seg_not_present == 0)
5942             return -TARGET_EINVAL;
5943     }
5944     /* allocate the LDT */
5945     if (!ldt_table) {
5946         env->ldt.base = target_mmap(0,
5947                                     TARGET_LDT_ENTRIES * TARGET_LDT_ENTRY_SIZE,
5948                                     PROT_READ|PROT_WRITE,
5949                                     MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);
5950         if (env->ldt.base == -1)
5951             return -TARGET_ENOMEM;
5952         memset(g2h(env->ldt.base), 0,
5953                TARGET_LDT_ENTRIES * TARGET_LDT_ENTRY_SIZE);
5954         env->ldt.limit = 0xffff;
5955         ldt_table = g2h(env->ldt.base);
5956     }
5957 
5958     /* NOTE: same code as Linux kernel */
5959     /* Allow LDTs to be cleared by the user. */
5960     if (ldt_info.base_addr == 0 && ldt_info.limit == 0) {
5961         if (oldmode ||
5962             (contents == 0		&&
5963              read_exec_only == 1	&&
5964              seg_32bit == 0		&&
5965              limit_in_pages == 0	&&
5966              seg_not_present == 1	&&
5967              useable == 0 )) {
5968             entry_1 = 0;
5969             entry_2 = 0;
5970             goto install;
5971         }
5972     }
5973 
5974     entry_1 = ((ldt_info.base_addr & 0x0000ffff) << 16) |
5975         (ldt_info.limit & 0x0ffff);
5976     entry_2 = (ldt_info.base_addr & 0xff000000) |
5977         ((ldt_info.base_addr & 0x00ff0000) >> 16) |
5978         (ldt_info.limit & 0xf0000) |
5979         ((read_exec_only ^ 1) << 9) |
5980         (contents << 10) |
5981         ((seg_not_present ^ 1) << 15) |
5982         (seg_32bit << 22) |
5983         (limit_in_pages << 23) |
5984         (lm << 21) |
5985         0x7000;
5986     if (!oldmode)
5987         entry_2 |= (useable << 20);
5988 
5989     /* Install the new entry ...  */
5990 install:
5991     lp = (uint32_t *)(ldt_table + (ldt_info.entry_number << 3));
5992     lp[0] = tswap32(entry_1);
5993     lp[1] = tswap32(entry_2);
5994     return 0;
5995 }
5996 
5997 /* specific and weird i386 syscalls */
5998 static abi_long do_modify_ldt(CPUX86State *env, int func, abi_ulong ptr,
5999                               unsigned long bytecount)
6000 {
6001     abi_long ret;
6002 
6003     switch (func) {
6004     case 0:
6005         ret = read_ldt(ptr, bytecount);
6006         break;
6007     case 1:
6008         ret = write_ldt(env, ptr, bytecount, 1);
6009         break;
6010     case 0x11:
6011         ret = write_ldt(env, ptr, bytecount, 0);
6012         break;
6013     default:
6014         ret = -TARGET_ENOSYS;
6015         break;
6016     }
6017     return ret;
6018 }
6019 
6020 #if defined(TARGET_I386) && defined(TARGET_ABI32)
6021 abi_long do_set_thread_area(CPUX86State *env, abi_ulong ptr)
6022 {
6023     uint64_t *gdt_table = g2h(env->gdt.base);
6024     struct target_modify_ldt_ldt_s ldt_info;
6025     struct target_modify_ldt_ldt_s *target_ldt_info;
6026     int seg_32bit, contents, read_exec_only, limit_in_pages;
6027     int seg_not_present, useable, lm;
6028     uint32_t *lp, entry_1, entry_2;
6029     int i;
6030 
6031     lock_user_struct(VERIFY_WRITE, target_ldt_info, ptr, 1);
6032     if (!target_ldt_info)
6033         return -TARGET_EFAULT;
6034     ldt_info.entry_number = tswap32(target_ldt_info->entry_number);
6035     ldt_info.base_addr = tswapal(target_ldt_info->base_addr);
6036     ldt_info.limit = tswap32(target_ldt_info->limit);
6037     ldt_info.flags = tswap32(target_ldt_info->flags);
6038     if (ldt_info.entry_number == -1) {
6039         for (i=TARGET_GDT_ENTRY_TLS_MIN; i<=TARGET_GDT_ENTRY_TLS_MAX; i++) {
6040             if (gdt_table[i] == 0) {
6041                 ldt_info.entry_number = i;
6042                 target_ldt_info->entry_number = tswap32(i);
6043                 break;
6044             }
6045         }
6046     }
6047     unlock_user_struct(target_ldt_info, ptr, 1);
6048 
6049     if (ldt_info.entry_number < TARGET_GDT_ENTRY_TLS_MIN ||
6050         ldt_info.entry_number > TARGET_GDT_ENTRY_TLS_MAX)
6051            return -TARGET_EINVAL;
6052     seg_32bit = ldt_info.flags & 1;
6053     contents = (ldt_info.flags >> 1) & 3;
6054     read_exec_only = (ldt_info.flags >> 3) & 1;
6055     limit_in_pages = (ldt_info.flags >> 4) & 1;
6056     seg_not_present = (ldt_info.flags >> 5) & 1;
6057     useable = (ldt_info.flags >> 6) & 1;
6058 #ifdef TARGET_ABI32
6059     lm = 0;
6060 #else
6061     lm = (ldt_info.flags >> 7) & 1;
6062 #endif
6063 
6064     if (contents == 3) {
6065         if (seg_not_present == 0)
6066             return -TARGET_EINVAL;
6067     }
6068 
6069     /* NOTE: same code as Linux kernel */
6070     /* Allow LDTs to be cleared by the user. */
6071     if (ldt_info.base_addr == 0 && ldt_info.limit == 0) {
6072         if ((contents == 0             &&
6073              read_exec_only == 1       &&
6074              seg_32bit == 0            &&
6075              limit_in_pages == 0       &&
6076              seg_not_present == 1      &&
6077              useable == 0 )) {
6078             entry_1 = 0;
6079             entry_2 = 0;
6080             goto install;
6081         }
6082     }
6083 
6084     entry_1 = ((ldt_info.base_addr & 0x0000ffff) << 16) |
6085         (ldt_info.limit & 0x0ffff);
6086     entry_2 = (ldt_info.base_addr & 0xff000000) |
6087         ((ldt_info.base_addr & 0x00ff0000) >> 16) |
6088         (ldt_info.limit & 0xf0000) |
6089         ((read_exec_only ^ 1) << 9) |
6090         (contents << 10) |
6091         ((seg_not_present ^ 1) << 15) |
6092         (seg_32bit << 22) |
6093         (limit_in_pages << 23) |
6094         (useable << 20) |
6095         (lm << 21) |
6096         0x7000;
6097 
6098     /* Install the new entry ...  */
6099 install:
6100     lp = (uint32_t *)(gdt_table + ldt_info.entry_number);
6101     lp[0] = tswap32(entry_1);
6102     lp[1] = tswap32(entry_2);
6103     return 0;
6104 }
6105 
6106 static abi_long do_get_thread_area(CPUX86State *env, abi_ulong ptr)
6107 {
6108     struct target_modify_ldt_ldt_s *target_ldt_info;
6109     uint64_t *gdt_table = g2h(env->gdt.base);
6110     uint32_t base_addr, limit, flags;
6111     int seg_32bit, contents, read_exec_only, limit_in_pages, idx;
6112     int seg_not_present, useable, lm;
6113     uint32_t *lp, entry_1, entry_2;
6114 
6115     lock_user_struct(VERIFY_WRITE, target_ldt_info, ptr, 1);
6116     if (!target_ldt_info)
6117         return -TARGET_EFAULT;
6118     idx = tswap32(target_ldt_info->entry_number);
6119     if (idx < TARGET_GDT_ENTRY_TLS_MIN ||
6120         idx > TARGET_GDT_ENTRY_TLS_MAX) {
6121         unlock_user_struct(target_ldt_info, ptr, 1);
6122         return -TARGET_EINVAL;
6123     }
6124     lp = (uint32_t *)(gdt_table + idx);
6125     entry_1 = tswap32(lp[0]);
6126     entry_2 = tswap32(lp[1]);
6127 
6128     read_exec_only = ((entry_2 >> 9) & 1) ^ 1;
6129     contents = (entry_2 >> 10) & 3;
6130     seg_not_present = ((entry_2 >> 15) & 1) ^ 1;
6131     seg_32bit = (entry_2 >> 22) & 1;
6132     limit_in_pages = (entry_2 >> 23) & 1;
6133     useable = (entry_2 >> 20) & 1;
6134 #ifdef TARGET_ABI32
6135     lm = 0;
6136 #else
6137     lm = (entry_2 >> 21) & 1;
6138 #endif
6139     flags = (seg_32bit << 0) | (contents << 1) |
6140         (read_exec_only << 3) | (limit_in_pages << 4) |
6141         (seg_not_present << 5) | (useable << 6) | (lm << 7);
6142     limit = (entry_1 & 0xffff) | (entry_2  & 0xf0000);
6143     base_addr = (entry_1 >> 16) |
6144         (entry_2 & 0xff000000) |
6145         ((entry_2 & 0xff) << 16);
6146     target_ldt_info->base_addr = tswapal(base_addr);
6147     target_ldt_info->limit = tswap32(limit);
6148     target_ldt_info->flags = tswap32(flags);
6149     unlock_user_struct(target_ldt_info, ptr, 1);
6150     return 0;
6151 }
6152 #endif /* TARGET_I386 && TARGET_ABI32 */
6153 
6154 #ifndef TARGET_ABI32
6155 abi_long do_arch_prctl(CPUX86State *env, int code, abi_ulong addr)
6156 {
6157     abi_long ret = 0;
6158     abi_ulong val;
6159     int idx;
6160 
6161     switch(code) {
6162     case TARGET_ARCH_SET_GS:
6163     case TARGET_ARCH_SET_FS:
6164         if (code == TARGET_ARCH_SET_GS)
6165             idx = R_GS;
6166         else
6167             idx = R_FS;
6168         cpu_x86_load_seg(env, idx, 0);
6169         env->segs[idx].base = addr;
6170         break;
6171     case TARGET_ARCH_GET_GS:
6172     case TARGET_ARCH_GET_FS:
6173         if (code == TARGET_ARCH_GET_GS)
6174             idx = R_GS;
6175         else
6176             idx = R_FS;
6177         val = env->segs[idx].base;
6178         if (put_user(val, addr, abi_ulong))
6179             ret = -TARGET_EFAULT;
6180         break;
6181     default:
6182         ret = -TARGET_EINVAL;
6183         break;
6184     }
6185     return ret;
6186 }
6187 #endif
6188 
6189 #endif /* defined(TARGET_I386) */
6190 
6191 #define NEW_STACK_SIZE 0x40000
6192 
6193 
6194 static pthread_mutex_t clone_lock = PTHREAD_MUTEX_INITIALIZER;
6195 typedef struct {
6196     CPUArchState *env;
6197     pthread_mutex_t mutex;
6198     pthread_cond_t cond;
6199     pthread_t thread;
6200     uint32_t tid;
6201     abi_ulong child_tidptr;
6202     abi_ulong parent_tidptr;
6203     sigset_t sigmask;
6204 } new_thread_info;
6205 
6206 static void *clone_func(void *arg)
6207 {
6208     new_thread_info *info = arg;
6209     CPUArchState *env;
6210     CPUState *cpu;
6211     TaskState *ts;
6212 
6213     rcu_register_thread();
6214     env = info->env;
6215     cpu = ENV_GET_CPU(env);
6216     thread_cpu = cpu;
6217     ts = (TaskState *)cpu->opaque;
6218     info->tid = gettid();
6219     cpu->host_tid = info->tid;
6220     task_settid(ts);
6221     if (info->child_tidptr)
6222         put_user_u32(info->tid, info->child_tidptr);
6223     if (info->parent_tidptr)
6224         put_user_u32(info->tid, info->parent_tidptr);
6225     /* Enable signals.  */
6226     sigprocmask(SIG_SETMASK, &info->sigmask, NULL);
6227     /* Signal to the parent that we're ready.  */
6228     pthread_mutex_lock(&info->mutex);
6229     pthread_cond_broadcast(&info->cond);
6230     pthread_mutex_unlock(&info->mutex);
6231     /* Wait until the parent has finshed initializing the tls state.  */
6232     pthread_mutex_lock(&clone_lock);
6233     pthread_mutex_unlock(&clone_lock);
6234     cpu_loop(env);
6235     /* never exits */
6236     return NULL;
6237 }
6238 
6239 /* do_fork() Must return host values and target errnos (unlike most
6240    do_*() functions). */
6241 static int do_fork(CPUArchState *env, unsigned int flags, abi_ulong newsp,
6242                    abi_ulong parent_tidptr, target_ulong newtls,
6243                    abi_ulong child_tidptr)
6244 {
6245     CPUState *cpu = ENV_GET_CPU(env);
6246     int ret;
6247     TaskState *ts;
6248     CPUState *new_cpu;
6249     CPUArchState *new_env;
6250     sigset_t sigmask;
6251 
6252     flags &= ~CLONE_IGNORED_FLAGS;
6253 
6254     /* Emulate vfork() with fork() */
6255     if (flags & CLONE_VFORK)
6256         flags &= ~(CLONE_VFORK | CLONE_VM);
6257 
6258     if (flags & CLONE_VM) {
6259         TaskState *parent_ts = (TaskState *)cpu->opaque;
6260         new_thread_info info;
6261         pthread_attr_t attr;
6262 
6263         if (((flags & CLONE_THREAD_FLAGS) != CLONE_THREAD_FLAGS) ||
6264             (flags & CLONE_INVALID_THREAD_FLAGS)) {
6265             return -TARGET_EINVAL;
6266         }
6267 
6268         ts = g_new0(TaskState, 1);
6269         init_task_state(ts);
6270         /* we create a new CPU instance. */
6271         new_env = cpu_copy(env);
6272         /* Init regs that differ from the parent.  */
6273         cpu_clone_regs(new_env, newsp);
6274         new_cpu = ENV_GET_CPU(new_env);
6275         new_cpu->opaque = ts;
6276         ts->bprm = parent_ts->bprm;
6277         ts->info = parent_ts->info;
6278         ts->signal_mask = parent_ts->signal_mask;
6279 
6280         if (flags & CLONE_CHILD_CLEARTID) {
6281             ts->child_tidptr = child_tidptr;
6282         }
6283 
6284         if (flags & CLONE_SETTLS) {
6285             cpu_set_tls (new_env, newtls);
6286         }
6287 
6288         /* Grab a mutex so that thread setup appears atomic.  */
6289         pthread_mutex_lock(&clone_lock);
6290 
6291         memset(&info, 0, sizeof(info));
6292         pthread_mutex_init(&info.mutex, NULL);
6293         pthread_mutex_lock(&info.mutex);
6294         pthread_cond_init(&info.cond, NULL);
6295         info.env = new_env;
6296         if (flags & CLONE_CHILD_SETTID) {
6297             info.child_tidptr = child_tidptr;
6298         }
6299         if (flags & CLONE_PARENT_SETTID) {
6300             info.parent_tidptr = parent_tidptr;
6301         }
6302 
6303         ret = pthread_attr_init(&attr);
6304         ret = pthread_attr_setstacksize(&attr, NEW_STACK_SIZE);
6305         ret = pthread_attr_setdetachstate(&attr, PTHREAD_CREATE_DETACHED);
6306         /* It is not safe to deliver signals until the child has finished
6307            initializing, so temporarily block all signals.  */
6308         sigfillset(&sigmask);
6309         sigprocmask(SIG_BLOCK, &sigmask, &info.sigmask);
6310 
6311         /* If this is our first additional thread, we need to ensure we
6312          * generate code for parallel execution and flush old translations.
6313          */
6314         if (!parallel_cpus) {
6315             parallel_cpus = true;
6316             tb_flush(cpu);
6317         }
6318 
6319         ret = pthread_create(&info.thread, &attr, clone_func, &info);
6320         /* TODO: Free new CPU state if thread creation failed.  */
6321 
6322         sigprocmask(SIG_SETMASK, &info.sigmask, NULL);
6323         pthread_attr_destroy(&attr);
6324         if (ret == 0) {
6325             /* Wait for the child to initialize.  */
6326             pthread_cond_wait(&info.cond, &info.mutex);
6327             ret = info.tid;
6328         } else {
6329             ret = -1;
6330         }
6331         pthread_mutex_unlock(&info.mutex);
6332         pthread_cond_destroy(&info.cond);
6333         pthread_mutex_destroy(&info.mutex);
6334         pthread_mutex_unlock(&clone_lock);
6335     } else {
6336         /* if no CLONE_VM, we consider it is a fork */
6337         if (flags & CLONE_INVALID_FORK_FLAGS) {
6338             return -TARGET_EINVAL;
6339         }
6340 
6341         /* We can't support custom termination signals */
6342         if ((flags & CSIGNAL) != TARGET_SIGCHLD) {
6343             return -TARGET_EINVAL;
6344         }
6345 
6346         if (block_signals()) {
6347             return -TARGET_ERESTARTSYS;
6348         }
6349 
6350         fork_start();
6351         ret = fork();
6352         if (ret == 0) {
6353             /* Child Process.  */
6354             rcu_after_fork();
6355             cpu_clone_regs(env, newsp);
6356             fork_end(1);
6357             /* There is a race condition here.  The parent process could
6358                theoretically read the TID in the child process before the child
6359                tid is set.  This would require using either ptrace
6360                (not implemented) or having *_tidptr to point at a shared memory
6361                mapping.  We can't repeat the spinlock hack used above because
6362                the child process gets its own copy of the lock.  */
6363             if (flags & CLONE_CHILD_SETTID)
6364                 put_user_u32(gettid(), child_tidptr);
6365             if (flags & CLONE_PARENT_SETTID)
6366                 put_user_u32(gettid(), parent_tidptr);
6367             ts = (TaskState *)cpu->opaque;
6368             if (flags & CLONE_SETTLS)
6369                 cpu_set_tls (env, newtls);
6370             if (flags & CLONE_CHILD_CLEARTID)
6371                 ts->child_tidptr = child_tidptr;
6372         } else {
6373             fork_end(0);
6374         }
6375     }
6376     return ret;
6377 }
6378 
6379 /* warning : doesn't handle linux specific flags... */
6380 static int target_to_host_fcntl_cmd(int cmd)
6381 {
6382     switch(cmd) {
6383 	case TARGET_F_DUPFD:
6384 	case TARGET_F_GETFD:
6385 	case TARGET_F_SETFD:
6386 	case TARGET_F_GETFL:
6387 	case TARGET_F_SETFL:
6388             return cmd;
6389         case TARGET_F_GETLK:
6390             return F_GETLK64;
6391         case TARGET_F_SETLK:
6392             return F_SETLK64;
6393         case TARGET_F_SETLKW:
6394             return F_SETLKW64;
6395 	case TARGET_F_GETOWN:
6396 	    return F_GETOWN;
6397 	case TARGET_F_SETOWN:
6398 	    return F_SETOWN;
6399 	case TARGET_F_GETSIG:
6400 	    return F_GETSIG;
6401 	case TARGET_F_SETSIG:
6402 	    return F_SETSIG;
6403 #if TARGET_ABI_BITS == 32
6404         case TARGET_F_GETLK64:
6405 	    return F_GETLK64;
6406 	case TARGET_F_SETLK64:
6407 	    return F_SETLK64;
6408 	case TARGET_F_SETLKW64:
6409 	    return F_SETLKW64;
6410 #endif
6411         case TARGET_F_SETLEASE:
6412             return F_SETLEASE;
6413         case TARGET_F_GETLEASE:
6414             return F_GETLEASE;
6415 #ifdef F_DUPFD_CLOEXEC
6416         case TARGET_F_DUPFD_CLOEXEC:
6417             return F_DUPFD_CLOEXEC;
6418 #endif
6419         case TARGET_F_NOTIFY:
6420             return F_NOTIFY;
6421 #ifdef F_GETOWN_EX
6422 	case TARGET_F_GETOWN_EX:
6423 	    return F_GETOWN_EX;
6424 #endif
6425 #ifdef F_SETOWN_EX
6426 	case TARGET_F_SETOWN_EX:
6427 	    return F_SETOWN_EX;
6428 #endif
6429 #ifdef F_SETPIPE_SZ
6430         case TARGET_F_SETPIPE_SZ:
6431             return F_SETPIPE_SZ;
6432         case TARGET_F_GETPIPE_SZ:
6433             return F_GETPIPE_SZ;
6434 #endif
6435 	default:
6436             return -TARGET_EINVAL;
6437     }
6438     return -TARGET_EINVAL;
6439 }
6440 
6441 #define TRANSTBL_CONVERT(a) { -1, TARGET_##a, -1, a }
6442 static const bitmask_transtbl flock_tbl[] = {
6443     TRANSTBL_CONVERT(F_RDLCK),
6444     TRANSTBL_CONVERT(F_WRLCK),
6445     TRANSTBL_CONVERT(F_UNLCK),
6446     TRANSTBL_CONVERT(F_EXLCK),
6447     TRANSTBL_CONVERT(F_SHLCK),
6448     { 0, 0, 0, 0 }
6449 };
6450 
6451 static inline abi_long copy_from_user_flock(struct flock64 *fl,
6452                                             abi_ulong target_flock_addr)
6453 {
6454     struct target_flock *target_fl;
6455     short l_type;
6456 
6457     if (!lock_user_struct(VERIFY_READ, target_fl, target_flock_addr, 1)) {
6458         return -TARGET_EFAULT;
6459     }
6460 
6461     __get_user(l_type, &target_fl->l_type);
6462     fl->l_type = target_to_host_bitmask(l_type, flock_tbl);
6463     __get_user(fl->l_whence, &target_fl->l_whence);
6464     __get_user(fl->l_start, &target_fl->l_start);
6465     __get_user(fl->l_len, &target_fl->l_len);
6466     __get_user(fl->l_pid, &target_fl->l_pid);
6467     unlock_user_struct(target_fl, target_flock_addr, 0);
6468     return 0;
6469 }
6470 
6471 static inline abi_long copy_to_user_flock(abi_ulong target_flock_addr,
6472                                           const struct flock64 *fl)
6473 {
6474     struct target_flock *target_fl;
6475     short l_type;
6476 
6477     if (!lock_user_struct(VERIFY_WRITE, target_fl, target_flock_addr, 0)) {
6478         return -TARGET_EFAULT;
6479     }
6480 
6481     l_type = host_to_target_bitmask(fl->l_type, flock_tbl);
6482     __put_user(l_type, &target_fl->l_type);
6483     __put_user(fl->l_whence, &target_fl->l_whence);
6484     __put_user(fl->l_start, &target_fl->l_start);
6485     __put_user(fl->l_len, &target_fl->l_len);
6486     __put_user(fl->l_pid, &target_fl->l_pid);
6487     unlock_user_struct(target_fl, target_flock_addr, 1);
6488     return 0;
6489 }
6490 
6491 typedef abi_long from_flock64_fn(struct flock64 *fl, abi_ulong target_addr);
6492 typedef abi_long to_flock64_fn(abi_ulong target_addr, const struct flock64 *fl);
6493 
6494 #if defined(TARGET_ARM) && TARGET_ABI_BITS == 32
6495 static inline abi_long copy_from_user_eabi_flock64(struct flock64 *fl,
6496                                                    abi_ulong target_flock_addr)
6497 {
6498     struct target_eabi_flock64 *target_fl;
6499     short l_type;
6500 
6501     if (!lock_user_struct(VERIFY_READ, target_fl, target_flock_addr, 1)) {
6502         return -TARGET_EFAULT;
6503     }
6504 
6505     __get_user(l_type, &target_fl->l_type);
6506     fl->l_type = target_to_host_bitmask(l_type, flock_tbl);
6507     __get_user(fl->l_whence, &target_fl->l_whence);
6508     __get_user(fl->l_start, &target_fl->l_start);
6509     __get_user(fl->l_len, &target_fl->l_len);
6510     __get_user(fl->l_pid, &target_fl->l_pid);
6511     unlock_user_struct(target_fl, target_flock_addr, 0);
6512     return 0;
6513 }
6514 
6515 static inline abi_long copy_to_user_eabi_flock64(abi_ulong target_flock_addr,
6516                                                  const struct flock64 *fl)
6517 {
6518     struct target_eabi_flock64 *target_fl;
6519     short l_type;
6520 
6521     if (!lock_user_struct(VERIFY_WRITE, target_fl, target_flock_addr, 0)) {
6522         return -TARGET_EFAULT;
6523     }
6524 
6525     l_type = host_to_target_bitmask(fl->l_type, flock_tbl);
6526     __put_user(l_type, &target_fl->l_type);
6527     __put_user(fl->l_whence, &target_fl->l_whence);
6528     __put_user(fl->l_start, &target_fl->l_start);
6529     __put_user(fl->l_len, &target_fl->l_len);
6530     __put_user(fl->l_pid, &target_fl->l_pid);
6531     unlock_user_struct(target_fl, target_flock_addr, 1);
6532     return 0;
6533 }
6534 #endif
6535 
6536 static inline abi_long copy_from_user_flock64(struct flock64 *fl,
6537                                               abi_ulong target_flock_addr)
6538 {
6539     struct target_flock64 *target_fl;
6540     short l_type;
6541 
6542     if (!lock_user_struct(VERIFY_READ, target_fl, target_flock_addr, 1)) {
6543         return -TARGET_EFAULT;
6544     }
6545 
6546     __get_user(l_type, &target_fl->l_type);
6547     fl->l_type = target_to_host_bitmask(l_type, flock_tbl);
6548     __get_user(fl->l_whence, &target_fl->l_whence);
6549     __get_user(fl->l_start, &target_fl->l_start);
6550     __get_user(fl->l_len, &target_fl->l_len);
6551     __get_user(fl->l_pid, &target_fl->l_pid);
6552     unlock_user_struct(target_fl, target_flock_addr, 0);
6553     return 0;
6554 }
6555 
6556 static inline abi_long copy_to_user_flock64(abi_ulong target_flock_addr,
6557                                             const struct flock64 *fl)
6558 {
6559     struct target_flock64 *target_fl;
6560     short l_type;
6561 
6562     if (!lock_user_struct(VERIFY_WRITE, target_fl, target_flock_addr, 0)) {
6563         return -TARGET_EFAULT;
6564     }
6565 
6566     l_type = host_to_target_bitmask(fl->l_type, flock_tbl);
6567     __put_user(l_type, &target_fl->l_type);
6568     __put_user(fl->l_whence, &target_fl->l_whence);
6569     __put_user(fl->l_start, &target_fl->l_start);
6570     __put_user(fl->l_len, &target_fl->l_len);
6571     __put_user(fl->l_pid, &target_fl->l_pid);
6572     unlock_user_struct(target_fl, target_flock_addr, 1);
6573     return 0;
6574 }
6575 
6576 static abi_long do_fcntl(int fd, int cmd, abi_ulong arg)
6577 {
6578     struct flock64 fl64;
6579 #ifdef F_GETOWN_EX
6580     struct f_owner_ex fox;
6581     struct target_f_owner_ex *target_fox;
6582 #endif
6583     abi_long ret;
6584     int host_cmd = target_to_host_fcntl_cmd(cmd);
6585 
6586     if (host_cmd == -TARGET_EINVAL)
6587 	    return host_cmd;
6588 
6589     switch(cmd) {
6590     case TARGET_F_GETLK:
6591         ret = copy_from_user_flock(&fl64, arg);
6592         if (ret) {
6593             return ret;
6594         }
6595         ret = get_errno(safe_fcntl(fd, host_cmd, &fl64));
6596         if (ret == 0) {
6597             ret = copy_to_user_flock(arg, &fl64);
6598         }
6599         break;
6600 
6601     case TARGET_F_SETLK:
6602     case TARGET_F_SETLKW:
6603         ret = copy_from_user_flock(&fl64, arg);
6604         if (ret) {
6605             return ret;
6606         }
6607         ret = get_errno(safe_fcntl(fd, host_cmd, &fl64));
6608         break;
6609 
6610     case TARGET_F_GETLK64:
6611         ret = copy_from_user_flock64(&fl64, arg);
6612         if (ret) {
6613             return ret;
6614         }
6615         ret = get_errno(safe_fcntl(fd, host_cmd, &fl64));
6616         if (ret == 0) {
6617             ret = copy_to_user_flock64(arg, &fl64);
6618         }
6619         break;
6620     case TARGET_F_SETLK64:
6621     case TARGET_F_SETLKW64:
6622         ret = copy_from_user_flock64(&fl64, arg);
6623         if (ret) {
6624             return ret;
6625         }
6626         ret = get_errno(safe_fcntl(fd, host_cmd, &fl64));
6627         break;
6628 
6629     case TARGET_F_GETFL:
6630         ret = get_errno(safe_fcntl(fd, host_cmd, arg));
6631         if (ret >= 0) {
6632             ret = host_to_target_bitmask(ret, fcntl_flags_tbl);
6633         }
6634         break;
6635 
6636     case TARGET_F_SETFL:
6637         ret = get_errno(safe_fcntl(fd, host_cmd,
6638                                    target_to_host_bitmask(arg,
6639                                                           fcntl_flags_tbl)));
6640         break;
6641 
6642 #ifdef F_GETOWN_EX
6643     case TARGET_F_GETOWN_EX:
6644         ret = get_errno(safe_fcntl(fd, host_cmd, &fox));
6645         if (ret >= 0) {
6646             if (!lock_user_struct(VERIFY_WRITE, target_fox, arg, 0))
6647                 return -TARGET_EFAULT;
6648             target_fox->type = tswap32(fox.type);
6649             target_fox->pid = tswap32(fox.pid);
6650             unlock_user_struct(target_fox, arg, 1);
6651         }
6652         break;
6653 #endif
6654 
6655 #ifdef F_SETOWN_EX
6656     case TARGET_F_SETOWN_EX:
6657         if (!lock_user_struct(VERIFY_READ, target_fox, arg, 1))
6658             return -TARGET_EFAULT;
6659         fox.type = tswap32(target_fox->type);
6660         fox.pid = tswap32(target_fox->pid);
6661         unlock_user_struct(target_fox, arg, 0);
6662         ret = get_errno(safe_fcntl(fd, host_cmd, &fox));
6663         break;
6664 #endif
6665 
6666     case TARGET_F_SETOWN:
6667     case TARGET_F_GETOWN:
6668     case TARGET_F_SETSIG:
6669     case TARGET_F_GETSIG:
6670     case TARGET_F_SETLEASE:
6671     case TARGET_F_GETLEASE:
6672     case TARGET_F_SETPIPE_SZ:
6673     case TARGET_F_GETPIPE_SZ:
6674         ret = get_errno(safe_fcntl(fd, host_cmd, arg));
6675         break;
6676 
6677     default:
6678         ret = get_errno(safe_fcntl(fd, cmd, arg));
6679         break;
6680     }
6681     return ret;
6682 }
6683 
6684 #ifdef USE_UID16
6685 
6686 static inline int high2lowuid(int uid)
6687 {
6688     if (uid > 65535)
6689         return 65534;
6690     else
6691         return uid;
6692 }
6693 
6694 static inline int high2lowgid(int gid)
6695 {
6696     if (gid > 65535)
6697         return 65534;
6698     else
6699         return gid;
6700 }
6701 
6702 static inline int low2highuid(int uid)
6703 {
6704     if ((int16_t)uid == -1)
6705         return -1;
6706     else
6707         return uid;
6708 }
6709 
6710 static inline int low2highgid(int gid)
6711 {
6712     if ((int16_t)gid == -1)
6713         return -1;
6714     else
6715         return gid;
6716 }
6717 static inline int tswapid(int id)
6718 {
6719     return tswap16(id);
6720 }
6721 
6722 #define put_user_id(x, gaddr) put_user_u16(x, gaddr)
6723 
6724 #else /* !USE_UID16 */
6725 static inline int high2lowuid(int uid)
6726 {
6727     return uid;
6728 }
6729 static inline int high2lowgid(int gid)
6730 {
6731     return gid;
6732 }
6733 static inline int low2highuid(int uid)
6734 {
6735     return uid;
6736 }
6737 static inline int low2highgid(int gid)
6738 {
6739     return gid;
6740 }
6741 static inline int tswapid(int id)
6742 {
6743     return tswap32(id);
6744 }
6745 
6746 #define put_user_id(x, gaddr) put_user_u32(x, gaddr)
6747 
6748 #endif /* USE_UID16 */
6749 
6750 /* We must do direct syscalls for setting UID/GID, because we want to
6751  * implement the Linux system call semantics of "change only for this thread",
6752  * not the libc/POSIX semantics of "change for all threads in process".
6753  * (See http://ewontfix.com/17/ for more details.)
6754  * We use the 32-bit version of the syscalls if present; if it is not
6755  * then either the host architecture supports 32-bit UIDs natively with
6756  * the standard syscall, or the 16-bit UID is the best we can do.
6757  */
6758 #ifdef __NR_setuid32
6759 #define __NR_sys_setuid __NR_setuid32
6760 #else
6761 #define __NR_sys_setuid __NR_setuid
6762 #endif
6763 #ifdef __NR_setgid32
6764 #define __NR_sys_setgid __NR_setgid32
6765 #else
6766 #define __NR_sys_setgid __NR_setgid
6767 #endif
6768 #ifdef __NR_setresuid32
6769 #define __NR_sys_setresuid __NR_setresuid32
6770 #else
6771 #define __NR_sys_setresuid __NR_setresuid
6772 #endif
6773 #ifdef __NR_setresgid32
6774 #define __NR_sys_setresgid __NR_setresgid32
6775 #else
6776 #define __NR_sys_setresgid __NR_setresgid
6777 #endif
6778 
6779 _syscall1(int, sys_setuid, uid_t, uid)
6780 _syscall1(int, sys_setgid, gid_t, gid)
6781 _syscall3(int, sys_setresuid, uid_t, ruid, uid_t, euid, uid_t, suid)
6782 _syscall3(int, sys_setresgid, gid_t, rgid, gid_t, egid, gid_t, sgid)
6783 
6784 void syscall_init(void)
6785 {
6786     IOCTLEntry *ie;
6787     const argtype *arg_type;
6788     int size;
6789     int i;
6790 
6791     thunk_init(STRUCT_MAX);
6792 
6793 #define STRUCT(name, ...) thunk_register_struct(STRUCT_ ## name, #name, struct_ ## name ## _def);
6794 #define STRUCT_SPECIAL(name) thunk_register_struct_direct(STRUCT_ ## name, #name, &struct_ ## name ## _def);
6795 #include "syscall_types.h"
6796 #undef STRUCT
6797 #undef STRUCT_SPECIAL
6798 
6799     /* Build target_to_host_errno_table[] table from
6800      * host_to_target_errno_table[]. */
6801     for (i = 0; i < ERRNO_TABLE_SIZE; i++) {
6802         target_to_host_errno_table[host_to_target_errno_table[i]] = i;
6803     }
6804 
6805     /* we patch the ioctl size if necessary. We rely on the fact that
6806        no ioctl has all the bits at '1' in the size field */
6807     ie = ioctl_entries;
6808     while (ie->target_cmd != 0) {
6809         if (((ie->target_cmd >> TARGET_IOC_SIZESHIFT) & TARGET_IOC_SIZEMASK) ==
6810             TARGET_IOC_SIZEMASK) {
6811             arg_type = ie->arg_type;
6812             if (arg_type[0] != TYPE_PTR) {
6813                 fprintf(stderr, "cannot patch size for ioctl 0x%x\n",
6814                         ie->target_cmd);
6815                 exit(1);
6816             }
6817             arg_type++;
6818             size = thunk_type_size(arg_type, 0);
6819             ie->target_cmd = (ie->target_cmd &
6820                               ~(TARGET_IOC_SIZEMASK << TARGET_IOC_SIZESHIFT)) |
6821                 (size << TARGET_IOC_SIZESHIFT);
6822         }
6823 
6824         /* automatic consistency check if same arch */
6825 #if (defined(__i386__) && defined(TARGET_I386) && defined(TARGET_ABI32)) || \
6826     (defined(__x86_64__) && defined(TARGET_X86_64))
6827         if (unlikely(ie->target_cmd != ie->host_cmd)) {
6828             fprintf(stderr, "ERROR: ioctl(%s): target=0x%x host=0x%x\n",
6829                     ie->name, ie->target_cmd, ie->host_cmd);
6830         }
6831 #endif
6832         ie++;
6833     }
6834 }
6835 
6836 #if TARGET_ABI_BITS == 32
6837 static inline uint64_t target_offset64(uint32_t word0, uint32_t word1)
6838 {
6839 #ifdef TARGET_WORDS_BIGENDIAN
6840     return ((uint64_t)word0 << 32) | word1;
6841 #else
6842     return ((uint64_t)word1 << 32) | word0;
6843 #endif
6844 }
6845 #else /* TARGET_ABI_BITS == 32 */
6846 static inline uint64_t target_offset64(uint64_t word0, uint64_t word1)
6847 {
6848     return word0;
6849 }
6850 #endif /* TARGET_ABI_BITS != 32 */
6851 
6852 #ifdef TARGET_NR_truncate64
6853 static inline abi_long target_truncate64(void *cpu_env, const char *arg1,
6854                                          abi_long arg2,
6855                                          abi_long arg3,
6856                                          abi_long arg4)
6857 {
6858     if (regpairs_aligned(cpu_env)) {
6859         arg2 = arg3;
6860         arg3 = arg4;
6861     }
6862     return get_errno(truncate64(arg1, target_offset64(arg2, arg3)));
6863 }
6864 #endif
6865 
6866 #ifdef TARGET_NR_ftruncate64
6867 static inline abi_long target_ftruncate64(void *cpu_env, abi_long arg1,
6868                                           abi_long arg2,
6869                                           abi_long arg3,
6870                                           abi_long arg4)
6871 {
6872     if (regpairs_aligned(cpu_env)) {
6873         arg2 = arg3;
6874         arg3 = arg4;
6875     }
6876     return get_errno(ftruncate64(arg1, target_offset64(arg2, arg3)));
6877 }
6878 #endif
6879 
6880 static inline abi_long target_to_host_timespec(struct timespec *host_ts,
6881                                                abi_ulong target_addr)
6882 {
6883     struct target_timespec *target_ts;
6884 
6885     if (!lock_user_struct(VERIFY_READ, target_ts, target_addr, 1))
6886         return -TARGET_EFAULT;
6887     __get_user(host_ts->tv_sec, &target_ts->tv_sec);
6888     __get_user(host_ts->tv_nsec, &target_ts->tv_nsec);
6889     unlock_user_struct(target_ts, target_addr, 0);
6890     return 0;
6891 }
6892 
6893 static inline abi_long host_to_target_timespec(abi_ulong target_addr,
6894                                                struct timespec *host_ts)
6895 {
6896     struct target_timespec *target_ts;
6897 
6898     if (!lock_user_struct(VERIFY_WRITE, target_ts, target_addr, 0))
6899         return -TARGET_EFAULT;
6900     __put_user(host_ts->tv_sec, &target_ts->tv_sec);
6901     __put_user(host_ts->tv_nsec, &target_ts->tv_nsec);
6902     unlock_user_struct(target_ts, target_addr, 1);
6903     return 0;
6904 }
6905 
6906 static inline abi_long target_to_host_itimerspec(struct itimerspec *host_itspec,
6907                                                  abi_ulong target_addr)
6908 {
6909     struct target_itimerspec *target_itspec;
6910 
6911     if (!lock_user_struct(VERIFY_READ, target_itspec, target_addr, 1)) {
6912         return -TARGET_EFAULT;
6913     }
6914 
6915     host_itspec->it_interval.tv_sec =
6916                             tswapal(target_itspec->it_interval.tv_sec);
6917     host_itspec->it_interval.tv_nsec =
6918                             tswapal(target_itspec->it_interval.tv_nsec);
6919     host_itspec->it_value.tv_sec = tswapal(target_itspec->it_value.tv_sec);
6920     host_itspec->it_value.tv_nsec = tswapal(target_itspec->it_value.tv_nsec);
6921 
6922     unlock_user_struct(target_itspec, target_addr, 1);
6923     return 0;
6924 }
6925 
6926 static inline abi_long host_to_target_itimerspec(abi_ulong target_addr,
6927                                                struct itimerspec *host_its)
6928 {
6929     struct target_itimerspec *target_itspec;
6930 
6931     if (!lock_user_struct(VERIFY_WRITE, target_itspec, target_addr, 0)) {
6932         return -TARGET_EFAULT;
6933     }
6934 
6935     target_itspec->it_interval.tv_sec = tswapal(host_its->it_interval.tv_sec);
6936     target_itspec->it_interval.tv_nsec = tswapal(host_its->it_interval.tv_nsec);
6937 
6938     target_itspec->it_value.tv_sec = tswapal(host_its->it_value.tv_sec);
6939     target_itspec->it_value.tv_nsec = tswapal(host_its->it_value.tv_nsec);
6940 
6941     unlock_user_struct(target_itspec, target_addr, 0);
6942     return 0;
6943 }
6944 
6945 static inline abi_long target_to_host_timex(struct timex *host_tx,
6946                                             abi_long target_addr)
6947 {
6948     struct target_timex *target_tx;
6949 
6950     if (!lock_user_struct(VERIFY_READ, target_tx, target_addr, 1)) {
6951         return -TARGET_EFAULT;
6952     }
6953 
6954     __get_user(host_tx->modes, &target_tx->modes);
6955     __get_user(host_tx->offset, &target_tx->offset);
6956     __get_user(host_tx->freq, &target_tx->freq);
6957     __get_user(host_tx->maxerror, &target_tx->maxerror);
6958     __get_user(host_tx->esterror, &target_tx->esterror);
6959     __get_user(host_tx->status, &target_tx->status);
6960     __get_user(host_tx->constant, &target_tx->constant);
6961     __get_user(host_tx->precision, &target_tx->precision);
6962     __get_user(host_tx->tolerance, &target_tx->tolerance);
6963     __get_user(host_tx->time.tv_sec, &target_tx->time.tv_sec);
6964     __get_user(host_tx->time.tv_usec, &target_tx->time.tv_usec);
6965     __get_user(host_tx->tick, &target_tx->tick);
6966     __get_user(host_tx->ppsfreq, &target_tx->ppsfreq);
6967     __get_user(host_tx->jitter, &target_tx->jitter);
6968     __get_user(host_tx->shift, &target_tx->shift);
6969     __get_user(host_tx->stabil, &target_tx->stabil);
6970     __get_user(host_tx->jitcnt, &target_tx->jitcnt);
6971     __get_user(host_tx->calcnt, &target_tx->calcnt);
6972     __get_user(host_tx->errcnt, &target_tx->errcnt);
6973     __get_user(host_tx->stbcnt, &target_tx->stbcnt);
6974     __get_user(host_tx->tai, &target_tx->tai);
6975 
6976     unlock_user_struct(target_tx, target_addr, 0);
6977     return 0;
6978 }
6979 
6980 static inline abi_long host_to_target_timex(abi_long target_addr,
6981                                             struct timex *host_tx)
6982 {
6983     struct target_timex *target_tx;
6984 
6985     if (!lock_user_struct(VERIFY_WRITE, target_tx, target_addr, 0)) {
6986         return -TARGET_EFAULT;
6987     }
6988 
6989     __put_user(host_tx->modes, &target_tx->modes);
6990     __put_user(host_tx->offset, &target_tx->offset);
6991     __put_user(host_tx->freq, &target_tx->freq);
6992     __put_user(host_tx->maxerror, &target_tx->maxerror);
6993     __put_user(host_tx->esterror, &target_tx->esterror);
6994     __put_user(host_tx->status, &target_tx->status);
6995     __put_user(host_tx->constant, &target_tx->constant);
6996     __put_user(host_tx->precision, &target_tx->precision);
6997     __put_user(host_tx->tolerance, &target_tx->tolerance);
6998     __put_user(host_tx->time.tv_sec, &target_tx->time.tv_sec);
6999     __put_user(host_tx->time.tv_usec, &target_tx->time.tv_usec);
7000     __put_user(host_tx->tick, &target_tx->tick);
7001     __put_user(host_tx->ppsfreq, &target_tx->ppsfreq);
7002     __put_user(host_tx->jitter, &target_tx->jitter);
7003     __put_user(host_tx->shift, &target_tx->shift);
7004     __put_user(host_tx->stabil, &target_tx->stabil);
7005     __put_user(host_tx->jitcnt, &target_tx->jitcnt);
7006     __put_user(host_tx->calcnt, &target_tx->calcnt);
7007     __put_user(host_tx->errcnt, &target_tx->errcnt);
7008     __put_user(host_tx->stbcnt, &target_tx->stbcnt);
7009     __put_user(host_tx->tai, &target_tx->tai);
7010 
7011     unlock_user_struct(target_tx, target_addr, 1);
7012     return 0;
7013 }
7014 
7015 
7016 static inline abi_long target_to_host_sigevent(struct sigevent *host_sevp,
7017                                                abi_ulong target_addr)
7018 {
7019     struct target_sigevent *target_sevp;
7020 
7021     if (!lock_user_struct(VERIFY_READ, target_sevp, target_addr, 1)) {
7022         return -TARGET_EFAULT;
7023     }
7024 
7025     /* This union is awkward on 64 bit systems because it has a 32 bit
7026      * integer and a pointer in it; we follow the conversion approach
7027      * used for handling sigval types in signal.c so the guest should get
7028      * the correct value back even if we did a 64 bit byteswap and it's
7029      * using the 32 bit integer.
7030      */
7031     host_sevp->sigev_value.sival_ptr =
7032         (void *)(uintptr_t)tswapal(target_sevp->sigev_value.sival_ptr);
7033     host_sevp->sigev_signo =
7034         target_to_host_signal(tswap32(target_sevp->sigev_signo));
7035     host_sevp->sigev_notify = tswap32(target_sevp->sigev_notify);
7036     host_sevp->_sigev_un._tid = tswap32(target_sevp->_sigev_un._tid);
7037 
7038     unlock_user_struct(target_sevp, target_addr, 1);
7039     return 0;
7040 }
7041 
7042 #if defined(TARGET_NR_mlockall)
7043 static inline int target_to_host_mlockall_arg(int arg)
7044 {
7045     int result = 0;
7046 
7047     if (arg & TARGET_MLOCKALL_MCL_CURRENT) {
7048         result |= MCL_CURRENT;
7049     }
7050     if (arg & TARGET_MLOCKALL_MCL_FUTURE) {
7051         result |= MCL_FUTURE;
7052     }
7053     return result;
7054 }
7055 #endif
7056 
7057 static inline abi_long host_to_target_stat64(void *cpu_env,
7058                                              abi_ulong target_addr,
7059                                              struct stat *host_st)
7060 {
7061 #if defined(TARGET_ARM) && defined(TARGET_ABI32)
7062     if (((CPUARMState *)cpu_env)->eabi) {
7063         struct target_eabi_stat64 *target_st;
7064 
7065         if (!lock_user_struct(VERIFY_WRITE, target_st, target_addr, 0))
7066             return -TARGET_EFAULT;
7067         memset(target_st, 0, sizeof(struct target_eabi_stat64));
7068         __put_user(host_st->st_dev, &target_st->st_dev);
7069         __put_user(host_st->st_ino, &target_st->st_ino);
7070 #ifdef TARGET_STAT64_HAS_BROKEN_ST_INO
7071         __put_user(host_st->st_ino, &target_st->__st_ino);
7072 #endif
7073         __put_user(host_st->st_mode, &target_st->st_mode);
7074         __put_user(host_st->st_nlink, &target_st->st_nlink);
7075         __put_user(host_st->st_uid, &target_st->st_uid);
7076         __put_user(host_st->st_gid, &target_st->st_gid);
7077         __put_user(host_st->st_rdev, &target_st->st_rdev);
7078         __put_user(host_st->st_size, &target_st->st_size);
7079         __put_user(host_st->st_blksize, &target_st->st_blksize);
7080         __put_user(host_st->st_blocks, &target_st->st_blocks);
7081         __put_user(host_st->st_atime, &target_st->target_st_atime);
7082         __put_user(host_st->st_mtime, &target_st->target_st_mtime);
7083         __put_user(host_st->st_ctime, &target_st->target_st_ctime);
7084         unlock_user_struct(target_st, target_addr, 1);
7085     } else
7086 #endif
7087     {
7088 #if defined(TARGET_HAS_STRUCT_STAT64)
7089         struct target_stat64 *target_st;
7090 #else
7091         struct target_stat *target_st;
7092 #endif
7093 
7094         if (!lock_user_struct(VERIFY_WRITE, target_st, target_addr, 0))
7095             return -TARGET_EFAULT;
7096         memset(target_st, 0, sizeof(*target_st));
7097         __put_user(host_st->st_dev, &target_st->st_dev);
7098         __put_user(host_st->st_ino, &target_st->st_ino);
7099 #ifdef TARGET_STAT64_HAS_BROKEN_ST_INO
7100         __put_user(host_st->st_ino, &target_st->__st_ino);
7101 #endif
7102         __put_user(host_st->st_mode, &target_st->st_mode);
7103         __put_user(host_st->st_nlink, &target_st->st_nlink);
7104         __put_user(host_st->st_uid, &target_st->st_uid);
7105         __put_user(host_st->st_gid, &target_st->st_gid);
7106         __put_user(host_st->st_rdev, &target_st->st_rdev);
7107         /* XXX: better use of kernel struct */
7108         __put_user(host_st->st_size, &target_st->st_size);
7109         __put_user(host_st->st_blksize, &target_st->st_blksize);
7110         __put_user(host_st->st_blocks, &target_st->st_blocks);
7111         __put_user(host_st->st_atime, &target_st->target_st_atime);
7112         __put_user(host_st->st_mtime, &target_st->target_st_mtime);
7113         __put_user(host_st->st_ctime, &target_st->target_st_ctime);
7114         unlock_user_struct(target_st, target_addr, 1);
7115     }
7116 
7117     return 0;
7118 }
7119 
7120 /* ??? Using host futex calls even when target atomic operations
7121    are not really atomic probably breaks things.  However implementing
7122    futexes locally would make futexes shared between multiple processes
7123    tricky.  However they're probably useless because guest atomic
7124    operations won't work either.  */
7125 static int do_futex(target_ulong uaddr, int op, int val, target_ulong timeout,
7126                     target_ulong uaddr2, int val3)
7127 {
7128     struct timespec ts, *pts;
7129     int base_op;
7130 
7131     /* ??? We assume FUTEX_* constants are the same on both host
7132        and target.  */
7133 #ifdef FUTEX_CMD_MASK
7134     base_op = op & FUTEX_CMD_MASK;
7135 #else
7136     base_op = op;
7137 #endif
7138     switch (base_op) {
7139     case FUTEX_WAIT:
7140     case FUTEX_WAIT_BITSET:
7141         if (timeout) {
7142             pts = &ts;
7143             target_to_host_timespec(pts, timeout);
7144         } else {
7145             pts = NULL;
7146         }
7147         return get_errno(safe_futex(g2h(uaddr), op, tswap32(val),
7148                          pts, NULL, val3));
7149     case FUTEX_WAKE:
7150         return get_errno(safe_futex(g2h(uaddr), op, val, NULL, NULL, 0));
7151     case FUTEX_FD:
7152         return get_errno(safe_futex(g2h(uaddr), op, val, NULL, NULL, 0));
7153     case FUTEX_REQUEUE:
7154     case FUTEX_CMP_REQUEUE:
7155     case FUTEX_WAKE_OP:
7156         /* For FUTEX_REQUEUE, FUTEX_CMP_REQUEUE, and FUTEX_WAKE_OP, the
7157            TIMEOUT parameter is interpreted as a uint32_t by the kernel.
7158            But the prototype takes a `struct timespec *'; insert casts
7159            to satisfy the compiler.  We do not need to tswap TIMEOUT
7160            since it's not compared to guest memory.  */
7161         pts = (struct timespec *)(uintptr_t) timeout;
7162         return get_errno(safe_futex(g2h(uaddr), op, val, pts,
7163                                     g2h(uaddr2),
7164                                     (base_op == FUTEX_CMP_REQUEUE
7165                                      ? tswap32(val3)
7166                                      : val3)));
7167     default:
7168         return -TARGET_ENOSYS;
7169     }
7170 }
7171 #if defined(TARGET_NR_name_to_handle_at) && defined(CONFIG_OPEN_BY_HANDLE)
7172 static abi_long do_name_to_handle_at(abi_long dirfd, abi_long pathname,
7173                                      abi_long handle, abi_long mount_id,
7174                                      abi_long flags)
7175 {
7176     struct file_handle *target_fh;
7177     struct file_handle *fh;
7178     int mid = 0;
7179     abi_long ret;
7180     char *name;
7181     unsigned int size, total_size;
7182 
7183     if (get_user_s32(size, handle)) {
7184         return -TARGET_EFAULT;
7185     }
7186 
7187     name = lock_user_string(pathname);
7188     if (!name) {
7189         return -TARGET_EFAULT;
7190     }
7191 
7192     total_size = sizeof(struct file_handle) + size;
7193     target_fh = lock_user(VERIFY_WRITE, handle, total_size, 0);
7194     if (!target_fh) {
7195         unlock_user(name, pathname, 0);
7196         return -TARGET_EFAULT;
7197     }
7198 
7199     fh = g_malloc0(total_size);
7200     fh->handle_bytes = size;
7201 
7202     ret = get_errno(name_to_handle_at(dirfd, path(name), fh, &mid, flags));
7203     unlock_user(name, pathname, 0);
7204 
7205     /* man name_to_handle_at(2):
7206      * Other than the use of the handle_bytes field, the caller should treat
7207      * the file_handle structure as an opaque data type
7208      */
7209 
7210     memcpy(target_fh, fh, total_size);
7211     target_fh->handle_bytes = tswap32(fh->handle_bytes);
7212     target_fh->handle_type = tswap32(fh->handle_type);
7213     g_free(fh);
7214     unlock_user(target_fh, handle, total_size);
7215 
7216     if (put_user_s32(mid, mount_id)) {
7217         return -TARGET_EFAULT;
7218     }
7219 
7220     return ret;
7221 
7222 }
7223 #endif
7224 
7225 #if defined(TARGET_NR_open_by_handle_at) && defined(CONFIG_OPEN_BY_HANDLE)
7226 static abi_long do_open_by_handle_at(abi_long mount_fd, abi_long handle,
7227                                      abi_long flags)
7228 {
7229     struct file_handle *target_fh;
7230     struct file_handle *fh;
7231     unsigned int size, total_size;
7232     abi_long ret;
7233 
7234     if (get_user_s32(size, handle)) {
7235         return -TARGET_EFAULT;
7236     }
7237 
7238     total_size = sizeof(struct file_handle) + size;
7239     target_fh = lock_user(VERIFY_READ, handle, total_size, 1);
7240     if (!target_fh) {
7241         return -TARGET_EFAULT;
7242     }
7243 
7244     fh = g_memdup(target_fh, total_size);
7245     fh->handle_bytes = size;
7246     fh->handle_type = tswap32(target_fh->handle_type);
7247 
7248     ret = get_errno(open_by_handle_at(mount_fd, fh,
7249                     target_to_host_bitmask(flags, fcntl_flags_tbl)));
7250 
7251     g_free(fh);
7252 
7253     unlock_user(target_fh, handle, total_size);
7254 
7255     return ret;
7256 }
7257 #endif
7258 
7259 #if defined(TARGET_NR_signalfd) || defined(TARGET_NR_signalfd4)
7260 
7261 /* signalfd siginfo conversion */
7262 
7263 static void
7264 host_to_target_signalfd_siginfo(struct signalfd_siginfo *tinfo,
7265                                 const struct signalfd_siginfo *info)
7266 {
7267     int sig = host_to_target_signal(info->ssi_signo);
7268 
7269     /* linux/signalfd.h defines a ssi_addr_lsb
7270      * not defined in sys/signalfd.h but used by some kernels
7271      */
7272 
7273 #ifdef BUS_MCEERR_AO
7274     if (tinfo->ssi_signo == SIGBUS &&
7275         (tinfo->ssi_code == BUS_MCEERR_AR ||
7276          tinfo->ssi_code == BUS_MCEERR_AO)) {
7277         uint16_t *ssi_addr_lsb = (uint16_t *)(&info->ssi_addr + 1);
7278         uint16_t *tssi_addr_lsb = (uint16_t *)(&tinfo->ssi_addr + 1);
7279         *tssi_addr_lsb = tswap16(*ssi_addr_lsb);
7280     }
7281 #endif
7282 
7283     tinfo->ssi_signo = tswap32(sig);
7284     tinfo->ssi_errno = tswap32(tinfo->ssi_errno);
7285     tinfo->ssi_code = tswap32(info->ssi_code);
7286     tinfo->ssi_pid = tswap32(info->ssi_pid);
7287     tinfo->ssi_uid = tswap32(info->ssi_uid);
7288     tinfo->ssi_fd = tswap32(info->ssi_fd);
7289     tinfo->ssi_tid = tswap32(info->ssi_tid);
7290     tinfo->ssi_band = tswap32(info->ssi_band);
7291     tinfo->ssi_overrun = tswap32(info->ssi_overrun);
7292     tinfo->ssi_trapno = tswap32(info->ssi_trapno);
7293     tinfo->ssi_status = tswap32(info->ssi_status);
7294     tinfo->ssi_int = tswap32(info->ssi_int);
7295     tinfo->ssi_ptr = tswap64(info->ssi_ptr);
7296     tinfo->ssi_utime = tswap64(info->ssi_utime);
7297     tinfo->ssi_stime = tswap64(info->ssi_stime);
7298     tinfo->ssi_addr = tswap64(info->ssi_addr);
7299 }
7300 
7301 static abi_long host_to_target_data_signalfd(void *buf, size_t len)
7302 {
7303     int i;
7304 
7305     for (i = 0; i < len; i += sizeof(struct signalfd_siginfo)) {
7306         host_to_target_signalfd_siginfo(buf + i, buf + i);
7307     }
7308 
7309     return len;
7310 }
7311 
7312 static TargetFdTrans target_signalfd_trans = {
7313     .host_to_target_data = host_to_target_data_signalfd,
7314 };
7315 
7316 static abi_long do_signalfd4(int fd, abi_long mask, int flags)
7317 {
7318     int host_flags;
7319     target_sigset_t *target_mask;
7320     sigset_t host_mask;
7321     abi_long ret;
7322 
7323     if (flags & ~(TARGET_O_NONBLOCK | TARGET_O_CLOEXEC)) {
7324         return -TARGET_EINVAL;
7325     }
7326     if (!lock_user_struct(VERIFY_READ, target_mask, mask, 1)) {
7327         return -TARGET_EFAULT;
7328     }
7329 
7330     target_to_host_sigset(&host_mask, target_mask);
7331 
7332     host_flags = target_to_host_bitmask(flags, fcntl_flags_tbl);
7333 
7334     ret = get_errno(signalfd(fd, &host_mask, host_flags));
7335     if (ret >= 0) {
7336         fd_trans_register(ret, &target_signalfd_trans);
7337     }
7338 
7339     unlock_user_struct(target_mask, mask, 0);
7340 
7341     return ret;
7342 }
7343 #endif
7344 
7345 /* Map host to target signal numbers for the wait family of syscalls.
7346    Assume all other status bits are the same.  */
7347 int host_to_target_waitstatus(int status)
7348 {
7349     if (WIFSIGNALED(status)) {
7350         return host_to_target_signal(WTERMSIG(status)) | (status & ~0x7f);
7351     }
7352     if (WIFSTOPPED(status)) {
7353         return (host_to_target_signal(WSTOPSIG(status)) << 8)
7354                | (status & 0xff);
7355     }
7356     return status;
7357 }
7358 
7359 static int open_self_cmdline(void *cpu_env, int fd)
7360 {
7361     int fd_orig = -1;
7362     bool word_skipped = false;
7363 
7364     fd_orig = open("/proc/self/cmdline", O_RDONLY);
7365     if (fd_orig < 0) {
7366         return fd_orig;
7367     }
7368 
7369     while (true) {
7370         ssize_t nb_read;
7371         char buf[128];
7372         char *cp_buf = buf;
7373 
7374         nb_read = read(fd_orig, buf, sizeof(buf));
7375         if (nb_read < 0) {
7376             int e = errno;
7377             fd_orig = close(fd_orig);
7378             errno = e;
7379             return -1;
7380         } else if (nb_read == 0) {
7381             break;
7382         }
7383 
7384         if (!word_skipped) {
7385             /* Skip the first string, which is the path to qemu-*-static
7386                instead of the actual command. */
7387             cp_buf = memchr(buf, 0, nb_read);
7388             if (cp_buf) {
7389                 /* Null byte found, skip one string */
7390                 cp_buf++;
7391                 nb_read -= cp_buf - buf;
7392                 word_skipped = true;
7393             }
7394         }
7395 
7396         if (word_skipped) {
7397             if (write(fd, cp_buf, nb_read) != nb_read) {
7398                 int e = errno;
7399                 close(fd_orig);
7400                 errno = e;
7401                 return -1;
7402             }
7403         }
7404     }
7405 
7406     return close(fd_orig);
7407 }
7408 
7409 static int open_self_maps(void *cpu_env, int fd)
7410 {
7411     CPUState *cpu = ENV_GET_CPU((CPUArchState *)cpu_env);
7412     TaskState *ts = cpu->opaque;
7413     FILE *fp;
7414     char *line = NULL;
7415     size_t len = 0;
7416     ssize_t read;
7417 
7418     fp = fopen("/proc/self/maps", "r");
7419     if (fp == NULL) {
7420         return -1;
7421     }
7422 
7423     while ((read = getline(&line, &len, fp)) != -1) {
7424         int fields, dev_maj, dev_min, inode;
7425         uint64_t min, max, offset;
7426         char flag_r, flag_w, flag_x, flag_p;
7427         char path[512] = "";
7428         fields = sscanf(line, "%"PRIx64"-%"PRIx64" %c%c%c%c %"PRIx64" %x:%x %d"
7429                         " %512s", &min, &max, &flag_r, &flag_w, &flag_x,
7430                         &flag_p, &offset, &dev_maj, &dev_min, &inode, path);
7431 
7432         if ((fields < 10) || (fields > 11)) {
7433             continue;
7434         }
7435         if (h2g_valid(min)) {
7436             int flags = page_get_flags(h2g(min));
7437             max = h2g_valid(max - 1) ? max : (uintptr_t)g2h(GUEST_ADDR_MAX);
7438             if (page_check_range(h2g(min), max - min, flags) == -1) {
7439                 continue;
7440             }
7441             if (h2g(min) == ts->info->stack_limit) {
7442                 pstrcpy(path, sizeof(path), "      [stack]");
7443             }
7444             dprintf(fd, TARGET_ABI_FMT_lx "-" TARGET_ABI_FMT_lx
7445                     " %c%c%c%c %08" PRIx64 " %02x:%02x %d %s%s\n",
7446                     h2g(min), h2g(max - 1) + 1, flag_r, flag_w,
7447                     flag_x, flag_p, offset, dev_maj, dev_min, inode,
7448                     path[0] ? "         " : "", path);
7449         }
7450     }
7451 
7452     free(line);
7453     fclose(fp);
7454 
7455     return 0;
7456 }
7457 
7458 static int open_self_stat(void *cpu_env, int fd)
7459 {
7460     CPUState *cpu = ENV_GET_CPU((CPUArchState *)cpu_env);
7461     TaskState *ts = cpu->opaque;
7462     abi_ulong start_stack = ts->info->start_stack;
7463     int i;
7464 
7465     for (i = 0; i < 44; i++) {
7466       char buf[128];
7467       int len;
7468       uint64_t val = 0;
7469 
7470       if (i == 0) {
7471         /* pid */
7472         val = getpid();
7473         snprintf(buf, sizeof(buf), "%"PRId64 " ", val);
7474       } else if (i == 1) {
7475         /* app name */
7476         snprintf(buf, sizeof(buf), "(%s) ", ts->bprm->argv[0]);
7477       } else if (i == 27) {
7478         /* stack bottom */
7479         val = start_stack;
7480         snprintf(buf, sizeof(buf), "%"PRId64 " ", val);
7481       } else {
7482         /* for the rest, there is MasterCard */
7483         snprintf(buf, sizeof(buf), "0%c", i == 43 ? '\n' : ' ');
7484       }
7485 
7486       len = strlen(buf);
7487       if (write(fd, buf, len) != len) {
7488           return -1;
7489       }
7490     }
7491 
7492     return 0;
7493 }
7494 
7495 static int open_self_auxv(void *cpu_env, int fd)
7496 {
7497     CPUState *cpu = ENV_GET_CPU((CPUArchState *)cpu_env);
7498     TaskState *ts = cpu->opaque;
7499     abi_ulong auxv = ts->info->saved_auxv;
7500     abi_ulong len = ts->info->auxv_len;
7501     char *ptr;
7502 
7503     /*
7504      * Auxiliary vector is stored in target process stack.
7505      * read in whole auxv vector and copy it to file
7506      */
7507     ptr = lock_user(VERIFY_READ, auxv, len, 0);
7508     if (ptr != NULL) {
7509         while (len > 0) {
7510             ssize_t r;
7511             r = write(fd, ptr, len);
7512             if (r <= 0) {
7513                 break;
7514             }
7515             len -= r;
7516             ptr += r;
7517         }
7518         lseek(fd, 0, SEEK_SET);
7519         unlock_user(ptr, auxv, len);
7520     }
7521 
7522     return 0;
7523 }
7524 
7525 static int is_proc_myself(const char *filename, const char *entry)
7526 {
7527     if (!strncmp(filename, "/proc/", strlen("/proc/"))) {
7528         filename += strlen("/proc/");
7529         if (!strncmp(filename, "self/", strlen("self/"))) {
7530             filename += strlen("self/");
7531         } else if (*filename >= '1' && *filename <= '9') {
7532             char myself[80];
7533             snprintf(myself, sizeof(myself), "%d/", getpid());
7534             if (!strncmp(filename, myself, strlen(myself))) {
7535                 filename += strlen(myself);
7536             } else {
7537                 return 0;
7538             }
7539         } else {
7540             return 0;
7541         }
7542         if (!strcmp(filename, entry)) {
7543             return 1;
7544         }
7545     }
7546     return 0;
7547 }
7548 
7549 #if defined(HOST_WORDS_BIGENDIAN) != defined(TARGET_WORDS_BIGENDIAN)
7550 static int is_proc(const char *filename, const char *entry)
7551 {
7552     return strcmp(filename, entry) == 0;
7553 }
7554 
7555 static int open_net_route(void *cpu_env, int fd)
7556 {
7557     FILE *fp;
7558     char *line = NULL;
7559     size_t len = 0;
7560     ssize_t read;
7561 
7562     fp = fopen("/proc/net/route", "r");
7563     if (fp == NULL) {
7564         return -1;
7565     }
7566 
7567     /* read header */
7568 
7569     read = getline(&line, &len, fp);
7570     dprintf(fd, "%s", line);
7571 
7572     /* read routes */
7573 
7574     while ((read = getline(&line, &len, fp)) != -1) {
7575         char iface[16];
7576         uint32_t dest, gw, mask;
7577         unsigned int flags, refcnt, use, metric, mtu, window, irtt;
7578         sscanf(line, "%s\t%08x\t%08x\t%04x\t%d\t%d\t%d\t%08x\t%d\t%u\t%u\n",
7579                      iface, &dest, &gw, &flags, &refcnt, &use, &metric,
7580                      &mask, &mtu, &window, &irtt);
7581         dprintf(fd, "%s\t%08x\t%08x\t%04x\t%d\t%d\t%d\t%08x\t%d\t%u\t%u\n",
7582                 iface, tswap32(dest), tswap32(gw), flags, refcnt, use,
7583                 metric, tswap32(mask), mtu, window, irtt);
7584     }
7585 
7586     free(line);
7587     fclose(fp);
7588 
7589     return 0;
7590 }
7591 #endif
7592 
7593 static int do_openat(void *cpu_env, int dirfd, const char *pathname, int flags, mode_t mode)
7594 {
7595     struct fake_open {
7596         const char *filename;
7597         int (*fill)(void *cpu_env, int fd);
7598         int (*cmp)(const char *s1, const char *s2);
7599     };
7600     const struct fake_open *fake_open;
7601     static const struct fake_open fakes[] = {
7602         { "maps", open_self_maps, is_proc_myself },
7603         { "stat", open_self_stat, is_proc_myself },
7604         { "auxv", open_self_auxv, is_proc_myself },
7605         { "cmdline", open_self_cmdline, is_proc_myself },
7606 #if defined(HOST_WORDS_BIGENDIAN) != defined(TARGET_WORDS_BIGENDIAN)
7607         { "/proc/net/route", open_net_route, is_proc },
7608 #endif
7609         { NULL, NULL, NULL }
7610     };
7611 
7612     if (is_proc_myself(pathname, "exe")) {
7613         int execfd = qemu_getauxval(AT_EXECFD);
7614         return execfd ? execfd : safe_openat(dirfd, exec_path, flags, mode);
7615     }
7616 
7617     for (fake_open = fakes; fake_open->filename; fake_open++) {
7618         if (fake_open->cmp(pathname, fake_open->filename)) {
7619             break;
7620         }
7621     }
7622 
7623     if (fake_open->filename) {
7624         const char *tmpdir;
7625         char filename[PATH_MAX];
7626         int fd, r;
7627 
7628         /* create temporary file to map stat to */
7629         tmpdir = getenv("TMPDIR");
7630         if (!tmpdir)
7631             tmpdir = "/tmp";
7632         snprintf(filename, sizeof(filename), "%s/qemu-open.XXXXXX", tmpdir);
7633         fd = mkstemp(filename);
7634         if (fd < 0) {
7635             return fd;
7636         }
7637         unlink(filename);
7638 
7639         if ((r = fake_open->fill(cpu_env, fd))) {
7640             int e = errno;
7641             close(fd);
7642             errno = e;
7643             return r;
7644         }
7645         lseek(fd, 0, SEEK_SET);
7646 
7647         return fd;
7648     }
7649 
7650     return safe_openat(dirfd, path(pathname), flags, mode);
7651 }
7652 
7653 #define TIMER_MAGIC 0x0caf0000
7654 #define TIMER_MAGIC_MASK 0xffff0000
7655 
7656 /* Convert QEMU provided timer ID back to internal 16bit index format */
7657 static target_timer_t get_timer_id(abi_long arg)
7658 {
7659     target_timer_t timerid = arg;
7660 
7661     if ((timerid & TIMER_MAGIC_MASK) != TIMER_MAGIC) {
7662         return -TARGET_EINVAL;
7663     }
7664 
7665     timerid &= 0xffff;
7666 
7667     if (timerid >= ARRAY_SIZE(g_posix_timers)) {
7668         return -TARGET_EINVAL;
7669     }
7670 
7671     return timerid;
7672 }
7673 
7674 /* do_syscall() should always have a single exit point at the end so
7675    that actions, such as logging of syscall results, can be performed.
7676    All errnos that do_syscall() returns must be -TARGET_<errcode>. */
7677 abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
7678                     abi_long arg2, abi_long arg3, abi_long arg4,
7679                     abi_long arg5, abi_long arg6, abi_long arg7,
7680                     abi_long arg8)
7681 {
7682     CPUState *cpu = ENV_GET_CPU(cpu_env);
7683     abi_long ret;
7684     struct stat st;
7685     struct statfs stfs;
7686     void *p;
7687 
7688 #if defined(DEBUG_ERESTARTSYS)
7689     /* Debug-only code for exercising the syscall-restart code paths
7690      * in the per-architecture cpu main loops: restart every syscall
7691      * the guest makes once before letting it through.
7692      */
7693     {
7694         static int flag;
7695 
7696         flag = !flag;
7697         if (flag) {
7698             return -TARGET_ERESTARTSYS;
7699         }
7700     }
7701 #endif
7702 
7703 #ifdef DEBUG
7704     gemu_log("syscall %d", num);
7705 #endif
7706     trace_guest_user_syscall(cpu, num, arg1, arg2, arg3, arg4, arg5, arg6, arg7, arg8);
7707     if(do_strace)
7708         print_syscall(num, arg1, arg2, arg3, arg4, arg5, arg6);
7709 
7710     switch(num) {
7711     case TARGET_NR_exit:
7712         /* In old applications this may be used to implement _exit(2).
7713            However in threaded applictions it is used for thread termination,
7714            and _exit_group is used for application termination.
7715            Do thread termination if we have more then one thread.  */
7716 
7717         if (block_signals()) {
7718             ret = -TARGET_ERESTARTSYS;
7719             break;
7720         }
7721 
7722         cpu_list_lock();
7723 
7724         if (CPU_NEXT(first_cpu)) {
7725             TaskState *ts;
7726 
7727             /* Remove the CPU from the list.  */
7728             QTAILQ_REMOVE(&cpus, cpu, node);
7729 
7730             cpu_list_unlock();
7731 
7732             ts = cpu->opaque;
7733             if (ts->child_tidptr) {
7734                 put_user_u32(0, ts->child_tidptr);
7735                 sys_futex(g2h(ts->child_tidptr), FUTEX_WAKE, INT_MAX,
7736                           NULL, NULL, 0);
7737             }
7738             thread_cpu = NULL;
7739             object_unref(OBJECT(cpu));
7740             g_free(ts);
7741             rcu_unregister_thread();
7742             pthread_exit(NULL);
7743         }
7744 
7745         cpu_list_unlock();
7746 #ifdef TARGET_GPROF
7747         _mcleanup();
7748 #endif
7749         gdb_exit(cpu_env, arg1);
7750         _exit(arg1);
7751         ret = 0; /* avoid warning */
7752         break;
7753     case TARGET_NR_read:
7754         if (arg3 == 0)
7755             ret = 0;
7756         else {
7757             if (!(p = lock_user(VERIFY_WRITE, arg2, arg3, 0)))
7758                 goto efault;
7759             ret = get_errno(safe_read(arg1, p, arg3));
7760             if (ret >= 0 &&
7761                 fd_trans_host_to_target_data(arg1)) {
7762                 ret = fd_trans_host_to_target_data(arg1)(p, ret);
7763             }
7764             unlock_user(p, arg2, ret);
7765         }
7766         break;
7767     case TARGET_NR_write:
7768         if (!(p = lock_user(VERIFY_READ, arg2, arg3, 1)))
7769             goto efault;
7770         ret = get_errno(safe_write(arg1, p, arg3));
7771         unlock_user(p, arg2, 0);
7772         break;
7773 #ifdef TARGET_NR_open
7774     case TARGET_NR_open:
7775         if (!(p = lock_user_string(arg1)))
7776             goto efault;
7777         ret = get_errno(do_openat(cpu_env, AT_FDCWD, p,
7778                                   target_to_host_bitmask(arg2, fcntl_flags_tbl),
7779                                   arg3));
7780         fd_trans_unregister(ret);
7781         unlock_user(p, arg1, 0);
7782         break;
7783 #endif
7784     case TARGET_NR_openat:
7785         if (!(p = lock_user_string(arg2)))
7786             goto efault;
7787         ret = get_errno(do_openat(cpu_env, arg1, p,
7788                                   target_to_host_bitmask(arg3, fcntl_flags_tbl),
7789                                   arg4));
7790         fd_trans_unregister(ret);
7791         unlock_user(p, arg2, 0);
7792         break;
7793 #if defined(TARGET_NR_name_to_handle_at) && defined(CONFIG_OPEN_BY_HANDLE)
7794     case TARGET_NR_name_to_handle_at:
7795         ret = do_name_to_handle_at(arg1, arg2, arg3, arg4, arg5);
7796         break;
7797 #endif
7798 #if defined(TARGET_NR_open_by_handle_at) && defined(CONFIG_OPEN_BY_HANDLE)
7799     case TARGET_NR_open_by_handle_at:
7800         ret = do_open_by_handle_at(arg1, arg2, arg3);
7801         fd_trans_unregister(ret);
7802         break;
7803 #endif
7804     case TARGET_NR_close:
7805         fd_trans_unregister(arg1);
7806         ret = get_errno(close(arg1));
7807         break;
7808     case TARGET_NR_brk:
7809         ret = do_brk(arg1);
7810         break;
7811 #ifdef TARGET_NR_fork
7812     case TARGET_NR_fork:
7813         ret = get_errno(do_fork(cpu_env, TARGET_SIGCHLD, 0, 0, 0, 0));
7814         break;
7815 #endif
7816 #ifdef TARGET_NR_waitpid
7817     case TARGET_NR_waitpid:
7818         {
7819             int status;
7820             ret = get_errno(safe_wait4(arg1, &status, arg3, 0));
7821             if (!is_error(ret) && arg2 && ret
7822                 && put_user_s32(host_to_target_waitstatus(status), arg2))
7823                 goto efault;
7824         }
7825         break;
7826 #endif
7827 #ifdef TARGET_NR_waitid
7828     case TARGET_NR_waitid:
7829         {
7830             siginfo_t info;
7831             info.si_pid = 0;
7832             ret = get_errno(safe_waitid(arg1, arg2, &info, arg4, NULL));
7833             if (!is_error(ret) && arg3 && info.si_pid != 0) {
7834                 if (!(p = lock_user(VERIFY_WRITE, arg3, sizeof(target_siginfo_t), 0)))
7835                     goto efault;
7836                 host_to_target_siginfo(p, &info);
7837                 unlock_user(p, arg3, sizeof(target_siginfo_t));
7838             }
7839         }
7840         break;
7841 #endif
7842 #ifdef TARGET_NR_creat /* not on alpha */
7843     case TARGET_NR_creat:
7844         if (!(p = lock_user_string(arg1)))
7845             goto efault;
7846         ret = get_errno(creat(p, arg2));
7847         fd_trans_unregister(ret);
7848         unlock_user(p, arg1, 0);
7849         break;
7850 #endif
7851 #ifdef TARGET_NR_link
7852     case TARGET_NR_link:
7853         {
7854             void * p2;
7855             p = lock_user_string(arg1);
7856             p2 = lock_user_string(arg2);
7857             if (!p || !p2)
7858                 ret = -TARGET_EFAULT;
7859             else
7860                 ret = get_errno(link(p, p2));
7861             unlock_user(p2, arg2, 0);
7862             unlock_user(p, arg1, 0);
7863         }
7864         break;
7865 #endif
7866 #if defined(TARGET_NR_linkat)
7867     case TARGET_NR_linkat:
7868         {
7869             void * p2 = NULL;
7870             if (!arg2 || !arg4)
7871                 goto efault;
7872             p  = lock_user_string(arg2);
7873             p2 = lock_user_string(arg4);
7874             if (!p || !p2)
7875                 ret = -TARGET_EFAULT;
7876             else
7877                 ret = get_errno(linkat(arg1, p, arg3, p2, arg5));
7878             unlock_user(p, arg2, 0);
7879             unlock_user(p2, arg4, 0);
7880         }
7881         break;
7882 #endif
7883 #ifdef TARGET_NR_unlink
7884     case TARGET_NR_unlink:
7885         if (!(p = lock_user_string(arg1)))
7886             goto efault;
7887         ret = get_errno(unlink(p));
7888         unlock_user(p, arg1, 0);
7889         break;
7890 #endif
7891 #if defined(TARGET_NR_unlinkat)
7892     case TARGET_NR_unlinkat:
7893         if (!(p = lock_user_string(arg2)))
7894             goto efault;
7895         ret = get_errno(unlinkat(arg1, p, arg3));
7896         unlock_user(p, arg2, 0);
7897         break;
7898 #endif
7899     case TARGET_NR_execve:
7900         {
7901             char **argp, **envp;
7902             int argc, envc;
7903             abi_ulong gp;
7904             abi_ulong guest_argp;
7905             abi_ulong guest_envp;
7906             abi_ulong addr;
7907             char **q;
7908             int total_size = 0;
7909 
7910             argc = 0;
7911             guest_argp = arg2;
7912             for (gp = guest_argp; gp; gp += sizeof(abi_ulong)) {
7913                 if (get_user_ual(addr, gp))
7914                     goto efault;
7915                 if (!addr)
7916                     break;
7917                 argc++;
7918             }
7919             envc = 0;
7920             guest_envp = arg3;
7921             for (gp = guest_envp; gp; gp += sizeof(abi_ulong)) {
7922                 if (get_user_ual(addr, gp))
7923                     goto efault;
7924                 if (!addr)
7925                     break;
7926                 envc++;
7927             }
7928 
7929             argp = alloca((argc + 1) * sizeof(void *));
7930             envp = alloca((envc + 1) * sizeof(void *));
7931 
7932             for (gp = guest_argp, q = argp; gp;
7933                   gp += sizeof(abi_ulong), q++) {
7934                 if (get_user_ual(addr, gp))
7935                     goto execve_efault;
7936                 if (!addr)
7937                     break;
7938                 if (!(*q = lock_user_string(addr)))
7939                     goto execve_efault;
7940                 total_size += strlen(*q) + 1;
7941             }
7942             *q = NULL;
7943 
7944             for (gp = guest_envp, q = envp; gp;
7945                   gp += sizeof(abi_ulong), q++) {
7946                 if (get_user_ual(addr, gp))
7947                     goto execve_efault;
7948                 if (!addr)
7949                     break;
7950                 if (!(*q = lock_user_string(addr)))
7951                     goto execve_efault;
7952                 total_size += strlen(*q) + 1;
7953             }
7954             *q = NULL;
7955 
7956             if (!(p = lock_user_string(arg1)))
7957                 goto execve_efault;
7958             /* Although execve() is not an interruptible syscall it is
7959              * a special case where we must use the safe_syscall wrapper:
7960              * if we allow a signal to happen before we make the host
7961              * syscall then we will 'lose' it, because at the point of
7962              * execve the process leaves QEMU's control. So we use the
7963              * safe syscall wrapper to ensure that we either take the
7964              * signal as a guest signal, or else it does not happen
7965              * before the execve completes and makes it the other
7966              * program's problem.
7967              */
7968             ret = get_errno(safe_execve(p, argp, envp));
7969             unlock_user(p, arg1, 0);
7970 
7971             goto execve_end;
7972 
7973         execve_efault:
7974             ret = -TARGET_EFAULT;
7975 
7976         execve_end:
7977             for (gp = guest_argp, q = argp; *q;
7978                   gp += sizeof(abi_ulong), q++) {
7979                 if (get_user_ual(addr, gp)
7980                     || !addr)
7981                     break;
7982                 unlock_user(*q, addr, 0);
7983             }
7984             for (gp = guest_envp, q = envp; *q;
7985                   gp += sizeof(abi_ulong), q++) {
7986                 if (get_user_ual(addr, gp)
7987                     || !addr)
7988                     break;
7989                 unlock_user(*q, addr, 0);
7990             }
7991         }
7992         break;
7993     case TARGET_NR_chdir:
7994         if (!(p = lock_user_string(arg1)))
7995             goto efault;
7996         ret = get_errno(chdir(p));
7997         unlock_user(p, arg1, 0);
7998         break;
7999 #ifdef TARGET_NR_time
8000     case TARGET_NR_time:
8001         {
8002             time_t host_time;
8003             ret = get_errno(time(&host_time));
8004             if (!is_error(ret)
8005                 && arg1
8006                 && put_user_sal(host_time, arg1))
8007                 goto efault;
8008         }
8009         break;
8010 #endif
8011 #ifdef TARGET_NR_mknod
8012     case TARGET_NR_mknod:
8013         if (!(p = lock_user_string(arg1)))
8014             goto efault;
8015         ret = get_errno(mknod(p, arg2, arg3));
8016         unlock_user(p, arg1, 0);
8017         break;
8018 #endif
8019 #if defined(TARGET_NR_mknodat)
8020     case TARGET_NR_mknodat:
8021         if (!(p = lock_user_string(arg2)))
8022             goto efault;
8023         ret = get_errno(mknodat(arg1, p, arg3, arg4));
8024         unlock_user(p, arg2, 0);
8025         break;
8026 #endif
8027 #ifdef TARGET_NR_chmod
8028     case TARGET_NR_chmod:
8029         if (!(p = lock_user_string(arg1)))
8030             goto efault;
8031         ret = get_errno(chmod(p, arg2));
8032         unlock_user(p, arg1, 0);
8033         break;
8034 #endif
8035 #ifdef TARGET_NR_break
8036     case TARGET_NR_break:
8037         goto unimplemented;
8038 #endif
8039 #ifdef TARGET_NR_oldstat
8040     case TARGET_NR_oldstat:
8041         goto unimplemented;
8042 #endif
8043     case TARGET_NR_lseek:
8044         ret = get_errno(lseek(arg1, arg2, arg3));
8045         break;
8046 #if defined(TARGET_NR_getxpid) && defined(TARGET_ALPHA)
8047     /* Alpha specific */
8048     case TARGET_NR_getxpid:
8049         ((CPUAlphaState *)cpu_env)->ir[IR_A4] = getppid();
8050         ret = get_errno(getpid());
8051         break;
8052 #endif
8053 #ifdef TARGET_NR_getpid
8054     case TARGET_NR_getpid:
8055         ret = get_errno(getpid());
8056         break;
8057 #endif
8058     case TARGET_NR_mount:
8059         {
8060             /* need to look at the data field */
8061             void *p2, *p3;
8062 
8063             if (arg1) {
8064                 p = lock_user_string(arg1);
8065                 if (!p) {
8066                     goto efault;
8067                 }
8068             } else {
8069                 p = NULL;
8070             }
8071 
8072             p2 = lock_user_string(arg2);
8073             if (!p2) {
8074                 if (arg1) {
8075                     unlock_user(p, arg1, 0);
8076                 }
8077                 goto efault;
8078             }
8079 
8080             if (arg3) {
8081                 p3 = lock_user_string(arg3);
8082                 if (!p3) {
8083                     if (arg1) {
8084                         unlock_user(p, arg1, 0);
8085                     }
8086                     unlock_user(p2, arg2, 0);
8087                     goto efault;
8088                 }
8089             } else {
8090                 p3 = NULL;
8091             }
8092 
8093             /* FIXME - arg5 should be locked, but it isn't clear how to
8094              * do that since it's not guaranteed to be a NULL-terminated
8095              * string.
8096              */
8097             if (!arg5) {
8098                 ret = mount(p, p2, p3, (unsigned long)arg4, NULL);
8099             } else {
8100                 ret = mount(p, p2, p3, (unsigned long)arg4, g2h(arg5));
8101             }
8102             ret = get_errno(ret);
8103 
8104             if (arg1) {
8105                 unlock_user(p, arg1, 0);
8106             }
8107             unlock_user(p2, arg2, 0);
8108             if (arg3) {
8109                 unlock_user(p3, arg3, 0);
8110             }
8111         }
8112         break;
8113 #ifdef TARGET_NR_umount
8114     case TARGET_NR_umount:
8115         if (!(p = lock_user_string(arg1)))
8116             goto efault;
8117         ret = get_errno(umount(p));
8118         unlock_user(p, arg1, 0);
8119         break;
8120 #endif
8121 #ifdef TARGET_NR_stime /* not on alpha */
8122     case TARGET_NR_stime:
8123         {
8124             time_t host_time;
8125             if (get_user_sal(host_time, arg1))
8126                 goto efault;
8127             ret = get_errno(stime(&host_time));
8128         }
8129         break;
8130 #endif
8131     case TARGET_NR_ptrace:
8132         goto unimplemented;
8133 #ifdef TARGET_NR_alarm /* not on alpha */
8134     case TARGET_NR_alarm:
8135         ret = alarm(arg1);
8136         break;
8137 #endif
8138 #ifdef TARGET_NR_oldfstat
8139     case TARGET_NR_oldfstat:
8140         goto unimplemented;
8141 #endif
8142 #ifdef TARGET_NR_pause /* not on alpha */
8143     case TARGET_NR_pause:
8144         if (!block_signals()) {
8145             sigsuspend(&((TaskState *)cpu->opaque)->signal_mask);
8146         }
8147         ret = -TARGET_EINTR;
8148         break;
8149 #endif
8150 #ifdef TARGET_NR_utime
8151     case TARGET_NR_utime:
8152         {
8153             struct utimbuf tbuf, *host_tbuf;
8154             struct target_utimbuf *target_tbuf;
8155             if (arg2) {
8156                 if (!lock_user_struct(VERIFY_READ, target_tbuf, arg2, 1))
8157                     goto efault;
8158                 tbuf.actime = tswapal(target_tbuf->actime);
8159                 tbuf.modtime = tswapal(target_tbuf->modtime);
8160                 unlock_user_struct(target_tbuf, arg2, 0);
8161                 host_tbuf = &tbuf;
8162             } else {
8163                 host_tbuf = NULL;
8164             }
8165             if (!(p = lock_user_string(arg1)))
8166                 goto efault;
8167             ret = get_errno(utime(p, host_tbuf));
8168             unlock_user(p, arg1, 0);
8169         }
8170         break;
8171 #endif
8172 #ifdef TARGET_NR_utimes
8173     case TARGET_NR_utimes:
8174         {
8175             struct timeval *tvp, tv[2];
8176             if (arg2) {
8177                 if (copy_from_user_timeval(&tv[0], arg2)
8178                     || copy_from_user_timeval(&tv[1],
8179                                               arg2 + sizeof(struct target_timeval)))
8180                     goto efault;
8181                 tvp = tv;
8182             } else {
8183                 tvp = NULL;
8184             }
8185             if (!(p = lock_user_string(arg1)))
8186                 goto efault;
8187             ret = get_errno(utimes(p, tvp));
8188             unlock_user(p, arg1, 0);
8189         }
8190         break;
8191 #endif
8192 #if defined(TARGET_NR_futimesat)
8193     case TARGET_NR_futimesat:
8194         {
8195             struct timeval *tvp, tv[2];
8196             if (arg3) {
8197                 if (copy_from_user_timeval(&tv[0], arg3)
8198                     || copy_from_user_timeval(&tv[1],
8199                                               arg3 + sizeof(struct target_timeval)))
8200                     goto efault;
8201                 tvp = tv;
8202             } else {
8203                 tvp = NULL;
8204             }
8205             if (!(p = lock_user_string(arg2)))
8206                 goto efault;
8207             ret = get_errno(futimesat(arg1, path(p), tvp));
8208             unlock_user(p, arg2, 0);
8209         }
8210         break;
8211 #endif
8212 #ifdef TARGET_NR_stty
8213     case TARGET_NR_stty:
8214         goto unimplemented;
8215 #endif
8216 #ifdef TARGET_NR_gtty
8217     case TARGET_NR_gtty:
8218         goto unimplemented;
8219 #endif
8220 #ifdef TARGET_NR_access
8221     case TARGET_NR_access:
8222         if (!(p = lock_user_string(arg1)))
8223             goto efault;
8224         ret = get_errno(access(path(p), arg2));
8225         unlock_user(p, arg1, 0);
8226         break;
8227 #endif
8228 #if defined(TARGET_NR_faccessat) && defined(__NR_faccessat)
8229     case TARGET_NR_faccessat:
8230         if (!(p = lock_user_string(arg2)))
8231             goto efault;
8232         ret = get_errno(faccessat(arg1, p, arg3, 0));
8233         unlock_user(p, arg2, 0);
8234         break;
8235 #endif
8236 #ifdef TARGET_NR_nice /* not on alpha */
8237     case TARGET_NR_nice:
8238         ret = get_errno(nice(arg1));
8239         break;
8240 #endif
8241 #ifdef TARGET_NR_ftime
8242     case TARGET_NR_ftime:
8243         goto unimplemented;
8244 #endif
8245     case TARGET_NR_sync:
8246         sync();
8247         ret = 0;
8248         break;
8249 #if defined(TARGET_NR_syncfs) && defined(CONFIG_SYNCFS)
8250     case TARGET_NR_syncfs:
8251         ret = get_errno(syncfs(arg1));
8252         break;
8253 #endif
8254     case TARGET_NR_kill:
8255         ret = get_errno(safe_kill(arg1, target_to_host_signal(arg2)));
8256         break;
8257 #ifdef TARGET_NR_rename
8258     case TARGET_NR_rename:
8259         {
8260             void *p2;
8261             p = lock_user_string(arg1);
8262             p2 = lock_user_string(arg2);
8263             if (!p || !p2)
8264                 ret = -TARGET_EFAULT;
8265             else
8266                 ret = get_errno(rename(p, p2));
8267             unlock_user(p2, arg2, 0);
8268             unlock_user(p, arg1, 0);
8269         }
8270         break;
8271 #endif
8272 #if defined(TARGET_NR_renameat)
8273     case TARGET_NR_renameat:
8274         {
8275             void *p2;
8276             p  = lock_user_string(arg2);
8277             p2 = lock_user_string(arg4);
8278             if (!p || !p2)
8279                 ret = -TARGET_EFAULT;
8280             else
8281                 ret = get_errno(renameat(arg1, p, arg3, p2));
8282             unlock_user(p2, arg4, 0);
8283             unlock_user(p, arg2, 0);
8284         }
8285         break;
8286 #endif
8287 #ifdef TARGET_NR_mkdir
8288     case TARGET_NR_mkdir:
8289         if (!(p = lock_user_string(arg1)))
8290             goto efault;
8291         ret = get_errno(mkdir(p, arg2));
8292         unlock_user(p, arg1, 0);
8293         break;
8294 #endif
8295 #if defined(TARGET_NR_mkdirat)
8296     case TARGET_NR_mkdirat:
8297         if (!(p = lock_user_string(arg2)))
8298             goto efault;
8299         ret = get_errno(mkdirat(arg1, p, arg3));
8300         unlock_user(p, arg2, 0);
8301         break;
8302 #endif
8303 #ifdef TARGET_NR_rmdir
8304     case TARGET_NR_rmdir:
8305         if (!(p = lock_user_string(arg1)))
8306             goto efault;
8307         ret = get_errno(rmdir(p));
8308         unlock_user(p, arg1, 0);
8309         break;
8310 #endif
8311     case TARGET_NR_dup:
8312         ret = get_errno(dup(arg1));
8313         if (ret >= 0) {
8314             fd_trans_dup(arg1, ret);
8315         }
8316         break;
8317 #ifdef TARGET_NR_pipe
8318     case TARGET_NR_pipe:
8319         ret = do_pipe(cpu_env, arg1, 0, 0);
8320         break;
8321 #endif
8322 #ifdef TARGET_NR_pipe2
8323     case TARGET_NR_pipe2:
8324         ret = do_pipe(cpu_env, arg1,
8325                       target_to_host_bitmask(arg2, fcntl_flags_tbl), 1);
8326         break;
8327 #endif
8328     case TARGET_NR_times:
8329         {
8330             struct target_tms *tmsp;
8331             struct tms tms;
8332             ret = get_errno(times(&tms));
8333             if (arg1) {
8334                 tmsp = lock_user(VERIFY_WRITE, arg1, sizeof(struct target_tms), 0);
8335                 if (!tmsp)
8336                     goto efault;
8337                 tmsp->tms_utime = tswapal(host_to_target_clock_t(tms.tms_utime));
8338                 tmsp->tms_stime = tswapal(host_to_target_clock_t(tms.tms_stime));
8339                 tmsp->tms_cutime = tswapal(host_to_target_clock_t(tms.tms_cutime));
8340                 tmsp->tms_cstime = tswapal(host_to_target_clock_t(tms.tms_cstime));
8341             }
8342             if (!is_error(ret))
8343                 ret = host_to_target_clock_t(ret);
8344         }
8345         break;
8346 #ifdef TARGET_NR_prof
8347     case TARGET_NR_prof:
8348         goto unimplemented;
8349 #endif
8350 #ifdef TARGET_NR_signal
8351     case TARGET_NR_signal:
8352         goto unimplemented;
8353 #endif
8354     case TARGET_NR_acct:
8355         if (arg1 == 0) {
8356             ret = get_errno(acct(NULL));
8357         } else {
8358             if (!(p = lock_user_string(arg1)))
8359                 goto efault;
8360             ret = get_errno(acct(path(p)));
8361             unlock_user(p, arg1, 0);
8362         }
8363         break;
8364 #ifdef TARGET_NR_umount2
8365     case TARGET_NR_umount2:
8366         if (!(p = lock_user_string(arg1)))
8367             goto efault;
8368         ret = get_errno(umount2(p, arg2));
8369         unlock_user(p, arg1, 0);
8370         break;
8371 #endif
8372 #ifdef TARGET_NR_lock
8373     case TARGET_NR_lock:
8374         goto unimplemented;
8375 #endif
8376     case TARGET_NR_ioctl:
8377         ret = do_ioctl(arg1, arg2, arg3);
8378         break;
8379     case TARGET_NR_fcntl:
8380         ret = do_fcntl(arg1, arg2, arg3);
8381         break;
8382 #ifdef TARGET_NR_mpx
8383     case TARGET_NR_mpx:
8384         goto unimplemented;
8385 #endif
8386     case TARGET_NR_setpgid:
8387         ret = get_errno(setpgid(arg1, arg2));
8388         break;
8389 #ifdef TARGET_NR_ulimit
8390     case TARGET_NR_ulimit:
8391         goto unimplemented;
8392 #endif
8393 #ifdef TARGET_NR_oldolduname
8394     case TARGET_NR_oldolduname:
8395         goto unimplemented;
8396 #endif
8397     case TARGET_NR_umask:
8398         ret = get_errno(umask(arg1));
8399         break;
8400     case TARGET_NR_chroot:
8401         if (!(p = lock_user_string(arg1)))
8402             goto efault;
8403         ret = get_errno(chroot(p));
8404         unlock_user(p, arg1, 0);
8405         break;
8406 #ifdef TARGET_NR_ustat
8407     case TARGET_NR_ustat:
8408         goto unimplemented;
8409 #endif
8410 #ifdef TARGET_NR_dup2
8411     case TARGET_NR_dup2:
8412         ret = get_errno(dup2(arg1, arg2));
8413         if (ret >= 0) {
8414             fd_trans_dup(arg1, arg2);
8415         }
8416         break;
8417 #endif
8418 #if defined(CONFIG_DUP3) && defined(TARGET_NR_dup3)
8419     case TARGET_NR_dup3:
8420         ret = get_errno(dup3(arg1, arg2, arg3));
8421         if (ret >= 0) {
8422             fd_trans_dup(arg1, arg2);
8423         }
8424         break;
8425 #endif
8426 #ifdef TARGET_NR_getppid /* not on alpha */
8427     case TARGET_NR_getppid:
8428         ret = get_errno(getppid());
8429         break;
8430 #endif
8431 #ifdef TARGET_NR_getpgrp
8432     case TARGET_NR_getpgrp:
8433         ret = get_errno(getpgrp());
8434         break;
8435 #endif
8436     case TARGET_NR_setsid:
8437         ret = get_errno(setsid());
8438         break;
8439 #ifdef TARGET_NR_sigaction
8440     case TARGET_NR_sigaction:
8441         {
8442 #if defined(TARGET_ALPHA)
8443             struct target_sigaction act, oact, *pact = 0;
8444             struct target_old_sigaction *old_act;
8445             if (arg2) {
8446                 if (!lock_user_struct(VERIFY_READ, old_act, arg2, 1))
8447                     goto efault;
8448                 act._sa_handler = old_act->_sa_handler;
8449                 target_siginitset(&act.sa_mask, old_act->sa_mask);
8450                 act.sa_flags = old_act->sa_flags;
8451                 act.sa_restorer = 0;
8452                 unlock_user_struct(old_act, arg2, 0);
8453                 pact = &act;
8454             }
8455             ret = get_errno(do_sigaction(arg1, pact, &oact));
8456             if (!is_error(ret) && arg3) {
8457                 if (!lock_user_struct(VERIFY_WRITE, old_act, arg3, 0))
8458                     goto efault;
8459                 old_act->_sa_handler = oact._sa_handler;
8460                 old_act->sa_mask = oact.sa_mask.sig[0];
8461                 old_act->sa_flags = oact.sa_flags;
8462                 unlock_user_struct(old_act, arg3, 1);
8463             }
8464 #elif defined(TARGET_MIPS)
8465 	    struct target_sigaction act, oact, *pact, *old_act;
8466 
8467 	    if (arg2) {
8468                 if (!lock_user_struct(VERIFY_READ, old_act, arg2, 1))
8469                     goto efault;
8470 		act._sa_handler = old_act->_sa_handler;
8471 		target_siginitset(&act.sa_mask, old_act->sa_mask.sig[0]);
8472 		act.sa_flags = old_act->sa_flags;
8473 		unlock_user_struct(old_act, arg2, 0);
8474 		pact = &act;
8475 	    } else {
8476 		pact = NULL;
8477 	    }
8478 
8479 	    ret = get_errno(do_sigaction(arg1, pact, &oact));
8480 
8481 	    if (!is_error(ret) && arg3) {
8482                 if (!lock_user_struct(VERIFY_WRITE, old_act, arg3, 0))
8483                     goto efault;
8484 		old_act->_sa_handler = oact._sa_handler;
8485 		old_act->sa_flags = oact.sa_flags;
8486 		old_act->sa_mask.sig[0] = oact.sa_mask.sig[0];
8487 		old_act->sa_mask.sig[1] = 0;
8488 		old_act->sa_mask.sig[2] = 0;
8489 		old_act->sa_mask.sig[3] = 0;
8490 		unlock_user_struct(old_act, arg3, 1);
8491 	    }
8492 #else
8493             struct target_old_sigaction *old_act;
8494             struct target_sigaction act, oact, *pact;
8495             if (arg2) {
8496                 if (!lock_user_struct(VERIFY_READ, old_act, arg2, 1))
8497                     goto efault;
8498                 act._sa_handler = old_act->_sa_handler;
8499                 target_siginitset(&act.sa_mask, old_act->sa_mask);
8500                 act.sa_flags = old_act->sa_flags;
8501                 act.sa_restorer = old_act->sa_restorer;
8502                 unlock_user_struct(old_act, arg2, 0);
8503                 pact = &act;
8504             } else {
8505                 pact = NULL;
8506             }
8507             ret = get_errno(do_sigaction(arg1, pact, &oact));
8508             if (!is_error(ret) && arg3) {
8509                 if (!lock_user_struct(VERIFY_WRITE, old_act, arg3, 0))
8510                     goto efault;
8511                 old_act->_sa_handler = oact._sa_handler;
8512                 old_act->sa_mask = oact.sa_mask.sig[0];
8513                 old_act->sa_flags = oact.sa_flags;
8514                 old_act->sa_restorer = oact.sa_restorer;
8515                 unlock_user_struct(old_act, arg3, 1);
8516             }
8517 #endif
8518         }
8519         break;
8520 #endif
8521     case TARGET_NR_rt_sigaction:
8522         {
8523 #if defined(TARGET_ALPHA)
8524             struct target_sigaction act, oact, *pact = 0;
8525             struct target_rt_sigaction *rt_act;
8526 
8527             if (arg4 != sizeof(target_sigset_t)) {
8528                 ret = -TARGET_EINVAL;
8529                 break;
8530             }
8531             if (arg2) {
8532                 if (!lock_user_struct(VERIFY_READ, rt_act, arg2, 1))
8533                     goto efault;
8534                 act._sa_handler = rt_act->_sa_handler;
8535                 act.sa_mask = rt_act->sa_mask;
8536                 act.sa_flags = rt_act->sa_flags;
8537                 act.sa_restorer = arg5;
8538                 unlock_user_struct(rt_act, arg2, 0);
8539                 pact = &act;
8540             }
8541             ret = get_errno(do_sigaction(arg1, pact, &oact));
8542             if (!is_error(ret) && arg3) {
8543                 if (!lock_user_struct(VERIFY_WRITE, rt_act, arg3, 0))
8544                     goto efault;
8545                 rt_act->_sa_handler = oact._sa_handler;
8546                 rt_act->sa_mask = oact.sa_mask;
8547                 rt_act->sa_flags = oact.sa_flags;
8548                 unlock_user_struct(rt_act, arg3, 1);
8549             }
8550 #else
8551             struct target_sigaction *act;
8552             struct target_sigaction *oact;
8553 
8554             if (arg4 != sizeof(target_sigset_t)) {
8555                 ret = -TARGET_EINVAL;
8556                 break;
8557             }
8558             if (arg2) {
8559                 if (!lock_user_struct(VERIFY_READ, act, arg2, 1))
8560                     goto efault;
8561             } else
8562                 act = NULL;
8563             if (arg3) {
8564                 if (!lock_user_struct(VERIFY_WRITE, oact, arg3, 0)) {
8565                     ret = -TARGET_EFAULT;
8566                     goto rt_sigaction_fail;
8567                 }
8568             } else
8569                 oact = NULL;
8570             ret = get_errno(do_sigaction(arg1, act, oact));
8571 	rt_sigaction_fail:
8572             if (act)
8573                 unlock_user_struct(act, arg2, 0);
8574             if (oact)
8575                 unlock_user_struct(oact, arg3, 1);
8576 #endif
8577         }
8578         break;
8579 #ifdef TARGET_NR_sgetmask /* not on alpha */
8580     case TARGET_NR_sgetmask:
8581         {
8582             sigset_t cur_set;
8583             abi_ulong target_set;
8584             ret = do_sigprocmask(0, NULL, &cur_set);
8585             if (!ret) {
8586                 host_to_target_old_sigset(&target_set, &cur_set);
8587                 ret = target_set;
8588             }
8589         }
8590         break;
8591 #endif
8592 #ifdef TARGET_NR_ssetmask /* not on alpha */
8593     case TARGET_NR_ssetmask:
8594         {
8595             sigset_t set, oset, cur_set;
8596             abi_ulong target_set = arg1;
8597             /* We only have one word of the new mask so we must read
8598              * the rest of it with do_sigprocmask() and OR in this word.
8599              * We are guaranteed that a do_sigprocmask() that only queries
8600              * the signal mask will not fail.
8601              */
8602             ret = do_sigprocmask(0, NULL, &cur_set);
8603             assert(!ret);
8604             target_to_host_old_sigset(&set, &target_set);
8605             sigorset(&set, &set, &cur_set);
8606             ret = do_sigprocmask(SIG_SETMASK, &set, &oset);
8607             if (!ret) {
8608                 host_to_target_old_sigset(&target_set, &oset);
8609                 ret = target_set;
8610             }
8611         }
8612         break;
8613 #endif
8614 #ifdef TARGET_NR_sigprocmask
8615     case TARGET_NR_sigprocmask:
8616         {
8617 #if defined(TARGET_ALPHA)
8618             sigset_t set, oldset;
8619             abi_ulong mask;
8620             int how;
8621 
8622             switch (arg1) {
8623             case TARGET_SIG_BLOCK:
8624                 how = SIG_BLOCK;
8625                 break;
8626             case TARGET_SIG_UNBLOCK:
8627                 how = SIG_UNBLOCK;
8628                 break;
8629             case TARGET_SIG_SETMASK:
8630                 how = SIG_SETMASK;
8631                 break;
8632             default:
8633                 ret = -TARGET_EINVAL;
8634                 goto fail;
8635             }
8636             mask = arg2;
8637             target_to_host_old_sigset(&set, &mask);
8638 
8639             ret = do_sigprocmask(how, &set, &oldset);
8640             if (!is_error(ret)) {
8641                 host_to_target_old_sigset(&mask, &oldset);
8642                 ret = mask;
8643                 ((CPUAlphaState *)cpu_env)->ir[IR_V0] = 0; /* force no error */
8644             }
8645 #else
8646             sigset_t set, oldset, *set_ptr;
8647             int how;
8648 
8649             if (arg2) {
8650                 switch (arg1) {
8651                 case TARGET_SIG_BLOCK:
8652                     how = SIG_BLOCK;
8653                     break;
8654                 case TARGET_SIG_UNBLOCK:
8655                     how = SIG_UNBLOCK;
8656                     break;
8657                 case TARGET_SIG_SETMASK:
8658                     how = SIG_SETMASK;
8659                     break;
8660                 default:
8661                     ret = -TARGET_EINVAL;
8662                     goto fail;
8663                 }
8664                 if (!(p = lock_user(VERIFY_READ, arg2, sizeof(target_sigset_t), 1)))
8665                     goto efault;
8666                 target_to_host_old_sigset(&set, p);
8667                 unlock_user(p, arg2, 0);
8668                 set_ptr = &set;
8669             } else {
8670                 how = 0;
8671                 set_ptr = NULL;
8672             }
8673             ret = do_sigprocmask(how, set_ptr, &oldset);
8674             if (!is_error(ret) && arg3) {
8675                 if (!(p = lock_user(VERIFY_WRITE, arg3, sizeof(target_sigset_t), 0)))
8676                     goto efault;
8677                 host_to_target_old_sigset(p, &oldset);
8678                 unlock_user(p, arg3, sizeof(target_sigset_t));
8679             }
8680 #endif
8681         }
8682         break;
8683 #endif
8684     case TARGET_NR_rt_sigprocmask:
8685         {
8686             int how = arg1;
8687             sigset_t set, oldset, *set_ptr;
8688 
8689             if (arg4 != sizeof(target_sigset_t)) {
8690                 ret = -TARGET_EINVAL;
8691                 break;
8692             }
8693 
8694             if (arg2) {
8695                 switch(how) {
8696                 case TARGET_SIG_BLOCK:
8697                     how = SIG_BLOCK;
8698                     break;
8699                 case TARGET_SIG_UNBLOCK:
8700                     how = SIG_UNBLOCK;
8701                     break;
8702                 case TARGET_SIG_SETMASK:
8703                     how = SIG_SETMASK;
8704                     break;
8705                 default:
8706                     ret = -TARGET_EINVAL;
8707                     goto fail;
8708                 }
8709                 if (!(p = lock_user(VERIFY_READ, arg2, sizeof(target_sigset_t), 1)))
8710                     goto efault;
8711                 target_to_host_sigset(&set, p);
8712                 unlock_user(p, arg2, 0);
8713                 set_ptr = &set;
8714             } else {
8715                 how = 0;
8716                 set_ptr = NULL;
8717             }
8718             ret = do_sigprocmask(how, set_ptr, &oldset);
8719             if (!is_error(ret) && arg3) {
8720                 if (!(p = lock_user(VERIFY_WRITE, arg3, sizeof(target_sigset_t), 0)))
8721                     goto efault;
8722                 host_to_target_sigset(p, &oldset);
8723                 unlock_user(p, arg3, sizeof(target_sigset_t));
8724             }
8725         }
8726         break;
8727 #ifdef TARGET_NR_sigpending
8728     case TARGET_NR_sigpending:
8729         {
8730             sigset_t set;
8731             ret = get_errno(sigpending(&set));
8732             if (!is_error(ret)) {
8733                 if (!(p = lock_user(VERIFY_WRITE, arg1, sizeof(target_sigset_t), 0)))
8734                     goto efault;
8735                 host_to_target_old_sigset(p, &set);
8736                 unlock_user(p, arg1, sizeof(target_sigset_t));
8737             }
8738         }
8739         break;
8740 #endif
8741     case TARGET_NR_rt_sigpending:
8742         {
8743             sigset_t set;
8744 
8745             /* Yes, this check is >, not != like most. We follow the kernel's
8746              * logic and it does it like this because it implements
8747              * NR_sigpending through the same code path, and in that case
8748              * the old_sigset_t is smaller in size.
8749              */
8750             if (arg2 > sizeof(target_sigset_t)) {
8751                 ret = -TARGET_EINVAL;
8752                 break;
8753             }
8754 
8755             ret = get_errno(sigpending(&set));
8756             if (!is_error(ret)) {
8757                 if (!(p = lock_user(VERIFY_WRITE, arg1, sizeof(target_sigset_t), 0)))
8758                     goto efault;
8759                 host_to_target_sigset(p, &set);
8760                 unlock_user(p, arg1, sizeof(target_sigset_t));
8761             }
8762         }
8763         break;
8764 #ifdef TARGET_NR_sigsuspend
8765     case TARGET_NR_sigsuspend:
8766         {
8767             TaskState *ts = cpu->opaque;
8768 #if defined(TARGET_ALPHA)
8769             abi_ulong mask = arg1;
8770             target_to_host_old_sigset(&ts->sigsuspend_mask, &mask);
8771 #else
8772             if (!(p = lock_user(VERIFY_READ, arg1, sizeof(target_sigset_t), 1)))
8773                 goto efault;
8774             target_to_host_old_sigset(&ts->sigsuspend_mask, p);
8775             unlock_user(p, arg1, 0);
8776 #endif
8777             ret = get_errno(safe_rt_sigsuspend(&ts->sigsuspend_mask,
8778                                                SIGSET_T_SIZE));
8779             if (ret != -TARGET_ERESTARTSYS) {
8780                 ts->in_sigsuspend = 1;
8781             }
8782         }
8783         break;
8784 #endif
8785     case TARGET_NR_rt_sigsuspend:
8786         {
8787             TaskState *ts = cpu->opaque;
8788 
8789             if (arg2 != sizeof(target_sigset_t)) {
8790                 ret = -TARGET_EINVAL;
8791                 break;
8792             }
8793             if (!(p = lock_user(VERIFY_READ, arg1, sizeof(target_sigset_t), 1)))
8794                 goto efault;
8795             target_to_host_sigset(&ts->sigsuspend_mask, p);
8796             unlock_user(p, arg1, 0);
8797             ret = get_errno(safe_rt_sigsuspend(&ts->sigsuspend_mask,
8798                                                SIGSET_T_SIZE));
8799             if (ret != -TARGET_ERESTARTSYS) {
8800                 ts->in_sigsuspend = 1;
8801             }
8802         }
8803         break;
8804     case TARGET_NR_rt_sigtimedwait:
8805         {
8806             sigset_t set;
8807             struct timespec uts, *puts;
8808             siginfo_t uinfo;
8809 
8810             if (arg4 != sizeof(target_sigset_t)) {
8811                 ret = -TARGET_EINVAL;
8812                 break;
8813             }
8814 
8815             if (!(p = lock_user(VERIFY_READ, arg1, sizeof(target_sigset_t), 1)))
8816                 goto efault;
8817             target_to_host_sigset(&set, p);
8818             unlock_user(p, arg1, 0);
8819             if (arg3) {
8820                 puts = &uts;
8821                 target_to_host_timespec(puts, arg3);
8822             } else {
8823                 puts = NULL;
8824             }
8825             ret = get_errno(safe_rt_sigtimedwait(&set, &uinfo, puts,
8826                                                  SIGSET_T_SIZE));
8827             if (!is_error(ret)) {
8828                 if (arg2) {
8829                     p = lock_user(VERIFY_WRITE, arg2, sizeof(target_siginfo_t),
8830                                   0);
8831                     if (!p) {
8832                         goto efault;
8833                     }
8834                     host_to_target_siginfo(p, &uinfo);
8835                     unlock_user(p, arg2, sizeof(target_siginfo_t));
8836                 }
8837                 ret = host_to_target_signal(ret);
8838             }
8839         }
8840         break;
8841     case TARGET_NR_rt_sigqueueinfo:
8842         {
8843             siginfo_t uinfo;
8844 
8845             p = lock_user(VERIFY_READ, arg3, sizeof(target_siginfo_t), 1);
8846             if (!p) {
8847                 goto efault;
8848             }
8849             target_to_host_siginfo(&uinfo, p);
8850             unlock_user(p, arg1, 0);
8851             ret = get_errno(sys_rt_sigqueueinfo(arg1, arg2, &uinfo));
8852         }
8853         break;
8854 #ifdef TARGET_NR_sigreturn
8855     case TARGET_NR_sigreturn:
8856         if (block_signals()) {
8857             ret = -TARGET_ERESTARTSYS;
8858         } else {
8859             ret = do_sigreturn(cpu_env);
8860         }
8861         break;
8862 #endif
8863     case TARGET_NR_rt_sigreturn:
8864         if (block_signals()) {
8865             ret = -TARGET_ERESTARTSYS;
8866         } else {
8867             ret = do_rt_sigreturn(cpu_env);
8868         }
8869         break;
8870     case TARGET_NR_sethostname:
8871         if (!(p = lock_user_string(arg1)))
8872             goto efault;
8873         ret = get_errno(sethostname(p, arg2));
8874         unlock_user(p, arg1, 0);
8875         break;
8876     case TARGET_NR_setrlimit:
8877         {
8878             int resource = target_to_host_resource(arg1);
8879             struct target_rlimit *target_rlim;
8880             struct rlimit rlim;
8881             if (!lock_user_struct(VERIFY_READ, target_rlim, arg2, 1))
8882                 goto efault;
8883             rlim.rlim_cur = target_to_host_rlim(target_rlim->rlim_cur);
8884             rlim.rlim_max = target_to_host_rlim(target_rlim->rlim_max);
8885             unlock_user_struct(target_rlim, arg2, 0);
8886             ret = get_errno(setrlimit(resource, &rlim));
8887         }
8888         break;
8889     case TARGET_NR_getrlimit:
8890         {
8891             int resource = target_to_host_resource(arg1);
8892             struct target_rlimit *target_rlim;
8893             struct rlimit rlim;
8894 
8895             ret = get_errno(getrlimit(resource, &rlim));
8896             if (!is_error(ret)) {
8897                 if (!lock_user_struct(VERIFY_WRITE, target_rlim, arg2, 0))
8898                     goto efault;
8899                 target_rlim->rlim_cur = host_to_target_rlim(rlim.rlim_cur);
8900                 target_rlim->rlim_max = host_to_target_rlim(rlim.rlim_max);
8901                 unlock_user_struct(target_rlim, arg2, 1);
8902             }
8903         }
8904         break;
8905     case TARGET_NR_getrusage:
8906         {
8907             struct rusage rusage;
8908             ret = get_errno(getrusage(arg1, &rusage));
8909             if (!is_error(ret)) {
8910                 ret = host_to_target_rusage(arg2, &rusage);
8911             }
8912         }
8913         break;
8914     case TARGET_NR_gettimeofday:
8915         {
8916             struct timeval tv;
8917             ret = get_errno(gettimeofday(&tv, NULL));
8918             if (!is_error(ret)) {
8919                 if (copy_to_user_timeval(arg1, &tv))
8920                     goto efault;
8921             }
8922         }
8923         break;
8924     case TARGET_NR_settimeofday:
8925         {
8926             struct timeval tv, *ptv = NULL;
8927             struct timezone tz, *ptz = NULL;
8928 
8929             if (arg1) {
8930                 if (copy_from_user_timeval(&tv, arg1)) {
8931                     goto efault;
8932                 }
8933                 ptv = &tv;
8934             }
8935 
8936             if (arg2) {
8937                 if (copy_from_user_timezone(&tz, arg2)) {
8938                     goto efault;
8939                 }
8940                 ptz = &tz;
8941             }
8942 
8943             ret = get_errno(settimeofday(ptv, ptz));
8944         }
8945         break;
8946 #if defined(TARGET_NR_select)
8947     case TARGET_NR_select:
8948 #if defined(TARGET_WANT_NI_OLD_SELECT)
8949         /* some architectures used to have old_select here
8950          * but now ENOSYS it.
8951          */
8952         ret = -TARGET_ENOSYS;
8953 #elif defined(TARGET_WANT_OLD_SYS_SELECT)
8954         ret = do_old_select(arg1);
8955 #else
8956         ret = do_select(arg1, arg2, arg3, arg4, arg5);
8957 #endif
8958         break;
8959 #endif
8960 #ifdef TARGET_NR_pselect6
8961     case TARGET_NR_pselect6:
8962         {
8963             abi_long rfd_addr, wfd_addr, efd_addr, n, ts_addr;
8964             fd_set rfds, wfds, efds;
8965             fd_set *rfds_ptr, *wfds_ptr, *efds_ptr;
8966             struct timespec ts, *ts_ptr;
8967 
8968             /*
8969              * The 6th arg is actually two args smashed together,
8970              * so we cannot use the C library.
8971              */
8972             sigset_t set;
8973             struct {
8974                 sigset_t *set;
8975                 size_t size;
8976             } sig, *sig_ptr;
8977 
8978             abi_ulong arg_sigset, arg_sigsize, *arg7;
8979             target_sigset_t *target_sigset;
8980 
8981             n = arg1;
8982             rfd_addr = arg2;
8983             wfd_addr = arg3;
8984             efd_addr = arg4;
8985             ts_addr = arg5;
8986 
8987             ret = copy_from_user_fdset_ptr(&rfds, &rfds_ptr, rfd_addr, n);
8988             if (ret) {
8989                 goto fail;
8990             }
8991             ret = copy_from_user_fdset_ptr(&wfds, &wfds_ptr, wfd_addr, n);
8992             if (ret) {
8993                 goto fail;
8994             }
8995             ret = copy_from_user_fdset_ptr(&efds, &efds_ptr, efd_addr, n);
8996             if (ret) {
8997                 goto fail;
8998             }
8999 
9000             /*
9001              * This takes a timespec, and not a timeval, so we cannot
9002              * use the do_select() helper ...
9003              */
9004             if (ts_addr) {
9005                 if (target_to_host_timespec(&ts, ts_addr)) {
9006                     goto efault;
9007                 }
9008                 ts_ptr = &ts;
9009             } else {
9010                 ts_ptr = NULL;
9011             }
9012 
9013             /* Extract the two packed args for the sigset */
9014             if (arg6) {
9015                 sig_ptr = &sig;
9016                 sig.size = SIGSET_T_SIZE;
9017 
9018                 arg7 = lock_user(VERIFY_READ, arg6, sizeof(*arg7) * 2, 1);
9019                 if (!arg7) {
9020                     goto efault;
9021                 }
9022                 arg_sigset = tswapal(arg7[0]);
9023                 arg_sigsize = tswapal(arg7[1]);
9024                 unlock_user(arg7, arg6, 0);
9025 
9026                 if (arg_sigset) {
9027                     sig.set = &set;
9028                     if (arg_sigsize != sizeof(*target_sigset)) {
9029                         /* Like the kernel, we enforce correct size sigsets */
9030                         ret = -TARGET_EINVAL;
9031                         goto fail;
9032                     }
9033                     target_sigset = lock_user(VERIFY_READ, arg_sigset,
9034                                               sizeof(*target_sigset), 1);
9035                     if (!target_sigset) {
9036                         goto efault;
9037                     }
9038                     target_to_host_sigset(&set, target_sigset);
9039                     unlock_user(target_sigset, arg_sigset, 0);
9040                 } else {
9041                     sig.set = NULL;
9042                 }
9043             } else {
9044                 sig_ptr = NULL;
9045             }
9046 
9047             ret = get_errno(safe_pselect6(n, rfds_ptr, wfds_ptr, efds_ptr,
9048                                           ts_ptr, sig_ptr));
9049 
9050             if (!is_error(ret)) {
9051                 if (rfd_addr && copy_to_user_fdset(rfd_addr, &rfds, n))
9052                     goto efault;
9053                 if (wfd_addr && copy_to_user_fdset(wfd_addr, &wfds, n))
9054                     goto efault;
9055                 if (efd_addr && copy_to_user_fdset(efd_addr, &efds, n))
9056                     goto efault;
9057 
9058                 if (ts_addr && host_to_target_timespec(ts_addr, &ts))
9059                     goto efault;
9060             }
9061         }
9062         break;
9063 #endif
9064 #ifdef TARGET_NR_symlink
9065     case TARGET_NR_symlink:
9066         {
9067             void *p2;
9068             p = lock_user_string(arg1);
9069             p2 = lock_user_string(arg2);
9070             if (!p || !p2)
9071                 ret = -TARGET_EFAULT;
9072             else
9073                 ret = get_errno(symlink(p, p2));
9074             unlock_user(p2, arg2, 0);
9075             unlock_user(p, arg1, 0);
9076         }
9077         break;
9078 #endif
9079 #if defined(TARGET_NR_symlinkat)
9080     case TARGET_NR_symlinkat:
9081         {
9082             void *p2;
9083             p  = lock_user_string(arg1);
9084             p2 = lock_user_string(arg3);
9085             if (!p || !p2)
9086                 ret = -TARGET_EFAULT;
9087             else
9088                 ret = get_errno(symlinkat(p, arg2, p2));
9089             unlock_user(p2, arg3, 0);
9090             unlock_user(p, arg1, 0);
9091         }
9092         break;
9093 #endif
9094 #ifdef TARGET_NR_oldlstat
9095     case TARGET_NR_oldlstat:
9096         goto unimplemented;
9097 #endif
9098 #ifdef TARGET_NR_readlink
9099     case TARGET_NR_readlink:
9100         {
9101             void *p2;
9102             p = lock_user_string(arg1);
9103             p2 = lock_user(VERIFY_WRITE, arg2, arg3, 0);
9104             if (!p || !p2) {
9105                 ret = -TARGET_EFAULT;
9106             } else if (!arg3) {
9107                 /* Short circuit this for the magic exe check. */
9108                 ret = -TARGET_EINVAL;
9109             } else if (is_proc_myself((const char *)p, "exe")) {
9110                 char real[PATH_MAX], *temp;
9111                 temp = realpath(exec_path, real);
9112                 /* Return value is # of bytes that we wrote to the buffer. */
9113                 if (temp == NULL) {
9114                     ret = get_errno(-1);
9115                 } else {
9116                     /* Don't worry about sign mismatch as earlier mapping
9117                      * logic would have thrown a bad address error. */
9118                     ret = MIN(strlen(real), arg3);
9119                     /* We cannot NUL terminate the string. */
9120                     memcpy(p2, real, ret);
9121                 }
9122             } else {
9123                 ret = get_errno(readlink(path(p), p2, arg3));
9124             }
9125             unlock_user(p2, arg2, ret);
9126             unlock_user(p, arg1, 0);
9127         }
9128         break;
9129 #endif
9130 #if defined(TARGET_NR_readlinkat)
9131     case TARGET_NR_readlinkat:
9132         {
9133             void *p2;
9134             p  = lock_user_string(arg2);
9135             p2 = lock_user(VERIFY_WRITE, arg3, arg4, 0);
9136             if (!p || !p2) {
9137                 ret = -TARGET_EFAULT;
9138             } else if (is_proc_myself((const char *)p, "exe")) {
9139                 char real[PATH_MAX], *temp;
9140                 temp = realpath(exec_path, real);
9141                 ret = temp == NULL ? get_errno(-1) : strlen(real) ;
9142                 snprintf((char *)p2, arg4, "%s", real);
9143             } else {
9144                 ret = get_errno(readlinkat(arg1, path(p), p2, arg4));
9145             }
9146             unlock_user(p2, arg3, ret);
9147             unlock_user(p, arg2, 0);
9148         }
9149         break;
9150 #endif
9151 #ifdef TARGET_NR_uselib
9152     case TARGET_NR_uselib:
9153         goto unimplemented;
9154 #endif
9155 #ifdef TARGET_NR_swapon
9156     case TARGET_NR_swapon:
9157         if (!(p = lock_user_string(arg1)))
9158             goto efault;
9159         ret = get_errno(swapon(p, arg2));
9160         unlock_user(p, arg1, 0);
9161         break;
9162 #endif
9163     case TARGET_NR_reboot:
9164         if (arg3 == LINUX_REBOOT_CMD_RESTART2) {
9165            /* arg4 must be ignored in all other cases */
9166            p = lock_user_string(arg4);
9167            if (!p) {
9168               goto efault;
9169            }
9170            ret = get_errno(reboot(arg1, arg2, arg3, p));
9171            unlock_user(p, arg4, 0);
9172         } else {
9173            ret = get_errno(reboot(arg1, arg2, arg3, NULL));
9174         }
9175         break;
9176 #ifdef TARGET_NR_readdir
9177     case TARGET_NR_readdir:
9178         goto unimplemented;
9179 #endif
9180 #ifdef TARGET_NR_mmap
9181     case TARGET_NR_mmap:
9182 #if (defined(TARGET_I386) && defined(TARGET_ABI32)) || \
9183     (defined(TARGET_ARM) && defined(TARGET_ABI32)) || \
9184     defined(TARGET_M68K) || defined(TARGET_CRIS) || defined(TARGET_MICROBLAZE) \
9185     || defined(TARGET_S390X)
9186         {
9187             abi_ulong *v;
9188             abi_ulong v1, v2, v3, v4, v5, v6;
9189             if (!(v = lock_user(VERIFY_READ, arg1, 6 * sizeof(abi_ulong), 1)))
9190                 goto efault;
9191             v1 = tswapal(v[0]);
9192             v2 = tswapal(v[1]);
9193             v3 = tswapal(v[2]);
9194             v4 = tswapal(v[3]);
9195             v5 = tswapal(v[4]);
9196             v6 = tswapal(v[5]);
9197             unlock_user(v, arg1, 0);
9198             ret = get_errno(target_mmap(v1, v2, v3,
9199                                         target_to_host_bitmask(v4, mmap_flags_tbl),
9200                                         v5, v6));
9201         }
9202 #else
9203         ret = get_errno(target_mmap(arg1, arg2, arg3,
9204                                     target_to_host_bitmask(arg4, mmap_flags_tbl),
9205                                     arg5,
9206                                     arg6));
9207 #endif
9208         break;
9209 #endif
9210 #ifdef TARGET_NR_mmap2
9211     case TARGET_NR_mmap2:
9212 #ifndef MMAP_SHIFT
9213 #define MMAP_SHIFT 12
9214 #endif
9215         ret = get_errno(target_mmap(arg1, arg2, arg3,
9216                                     target_to_host_bitmask(arg4, mmap_flags_tbl),
9217                                     arg5,
9218                                     arg6 << MMAP_SHIFT));
9219         break;
9220 #endif
9221     case TARGET_NR_munmap:
9222         ret = get_errno(target_munmap(arg1, arg2));
9223         break;
9224     case TARGET_NR_mprotect:
9225         {
9226             TaskState *ts = cpu->opaque;
9227             /* Special hack to detect libc making the stack executable.  */
9228             if ((arg3 & PROT_GROWSDOWN)
9229                 && arg1 >= ts->info->stack_limit
9230                 && arg1 <= ts->info->start_stack) {
9231                 arg3 &= ~PROT_GROWSDOWN;
9232                 arg2 = arg2 + arg1 - ts->info->stack_limit;
9233                 arg1 = ts->info->stack_limit;
9234             }
9235         }
9236         ret = get_errno(target_mprotect(arg1, arg2, arg3));
9237         break;
9238 #ifdef TARGET_NR_mremap
9239     case TARGET_NR_mremap:
9240         ret = get_errno(target_mremap(arg1, arg2, arg3, arg4, arg5));
9241         break;
9242 #endif
9243         /* ??? msync/mlock/munlock are broken for softmmu.  */
9244 #ifdef TARGET_NR_msync
9245     case TARGET_NR_msync:
9246         ret = get_errno(msync(g2h(arg1), arg2, arg3));
9247         break;
9248 #endif
9249 #ifdef TARGET_NR_mlock
9250     case TARGET_NR_mlock:
9251         ret = get_errno(mlock(g2h(arg1), arg2));
9252         break;
9253 #endif
9254 #ifdef TARGET_NR_munlock
9255     case TARGET_NR_munlock:
9256         ret = get_errno(munlock(g2h(arg1), arg2));
9257         break;
9258 #endif
9259 #ifdef TARGET_NR_mlockall
9260     case TARGET_NR_mlockall:
9261         ret = get_errno(mlockall(target_to_host_mlockall_arg(arg1)));
9262         break;
9263 #endif
9264 #ifdef TARGET_NR_munlockall
9265     case TARGET_NR_munlockall:
9266         ret = get_errno(munlockall());
9267         break;
9268 #endif
9269     case TARGET_NR_truncate:
9270         if (!(p = lock_user_string(arg1)))
9271             goto efault;
9272         ret = get_errno(truncate(p, arg2));
9273         unlock_user(p, arg1, 0);
9274         break;
9275     case TARGET_NR_ftruncate:
9276         ret = get_errno(ftruncate(arg1, arg2));
9277         break;
9278     case TARGET_NR_fchmod:
9279         ret = get_errno(fchmod(arg1, arg2));
9280         break;
9281 #if defined(TARGET_NR_fchmodat)
9282     case TARGET_NR_fchmodat:
9283         if (!(p = lock_user_string(arg2)))
9284             goto efault;
9285         ret = get_errno(fchmodat(arg1, p, arg3, 0));
9286         unlock_user(p, arg2, 0);
9287         break;
9288 #endif
9289     case TARGET_NR_getpriority:
9290         /* Note that negative values are valid for getpriority, so we must
9291            differentiate based on errno settings.  */
9292         errno = 0;
9293         ret = getpriority(arg1, arg2);
9294         if (ret == -1 && errno != 0) {
9295             ret = -host_to_target_errno(errno);
9296             break;
9297         }
9298 #ifdef TARGET_ALPHA
9299         /* Return value is the unbiased priority.  Signal no error.  */
9300         ((CPUAlphaState *)cpu_env)->ir[IR_V0] = 0;
9301 #else
9302         /* Return value is a biased priority to avoid negative numbers.  */
9303         ret = 20 - ret;
9304 #endif
9305         break;
9306     case TARGET_NR_setpriority:
9307         ret = get_errno(setpriority(arg1, arg2, arg3));
9308         break;
9309 #ifdef TARGET_NR_profil
9310     case TARGET_NR_profil:
9311         goto unimplemented;
9312 #endif
9313     case TARGET_NR_statfs:
9314         if (!(p = lock_user_string(arg1)))
9315             goto efault;
9316         ret = get_errno(statfs(path(p), &stfs));
9317         unlock_user(p, arg1, 0);
9318     convert_statfs:
9319         if (!is_error(ret)) {
9320             struct target_statfs *target_stfs;
9321 
9322             if (!lock_user_struct(VERIFY_WRITE, target_stfs, arg2, 0))
9323                 goto efault;
9324             __put_user(stfs.f_type, &target_stfs->f_type);
9325             __put_user(stfs.f_bsize, &target_stfs->f_bsize);
9326             __put_user(stfs.f_blocks, &target_stfs->f_blocks);
9327             __put_user(stfs.f_bfree, &target_stfs->f_bfree);
9328             __put_user(stfs.f_bavail, &target_stfs->f_bavail);
9329             __put_user(stfs.f_files, &target_stfs->f_files);
9330             __put_user(stfs.f_ffree, &target_stfs->f_ffree);
9331             __put_user(stfs.f_fsid.__val[0], &target_stfs->f_fsid.val[0]);
9332             __put_user(stfs.f_fsid.__val[1], &target_stfs->f_fsid.val[1]);
9333             __put_user(stfs.f_namelen, &target_stfs->f_namelen);
9334             __put_user(stfs.f_frsize, &target_stfs->f_frsize);
9335             memset(target_stfs->f_spare, 0, sizeof(target_stfs->f_spare));
9336             unlock_user_struct(target_stfs, arg2, 1);
9337         }
9338         break;
9339     case TARGET_NR_fstatfs:
9340         ret = get_errno(fstatfs(arg1, &stfs));
9341         goto convert_statfs;
9342 #ifdef TARGET_NR_statfs64
9343     case TARGET_NR_statfs64:
9344         if (!(p = lock_user_string(arg1)))
9345             goto efault;
9346         ret = get_errno(statfs(path(p), &stfs));
9347         unlock_user(p, arg1, 0);
9348     convert_statfs64:
9349         if (!is_error(ret)) {
9350             struct target_statfs64 *target_stfs;
9351 
9352             if (!lock_user_struct(VERIFY_WRITE, target_stfs, arg3, 0))
9353                 goto efault;
9354             __put_user(stfs.f_type, &target_stfs->f_type);
9355             __put_user(stfs.f_bsize, &target_stfs->f_bsize);
9356             __put_user(stfs.f_blocks, &target_stfs->f_blocks);
9357             __put_user(stfs.f_bfree, &target_stfs->f_bfree);
9358             __put_user(stfs.f_bavail, &target_stfs->f_bavail);
9359             __put_user(stfs.f_files, &target_stfs->f_files);
9360             __put_user(stfs.f_ffree, &target_stfs->f_ffree);
9361             __put_user(stfs.f_fsid.__val[0], &target_stfs->f_fsid.val[0]);
9362             __put_user(stfs.f_fsid.__val[1], &target_stfs->f_fsid.val[1]);
9363             __put_user(stfs.f_namelen, &target_stfs->f_namelen);
9364             __put_user(stfs.f_frsize, &target_stfs->f_frsize);
9365             memset(target_stfs->f_spare, 0, sizeof(target_stfs->f_spare));
9366             unlock_user_struct(target_stfs, arg3, 1);
9367         }
9368         break;
9369     case TARGET_NR_fstatfs64:
9370         ret = get_errno(fstatfs(arg1, &stfs));
9371         goto convert_statfs64;
9372 #endif
9373 #ifdef TARGET_NR_ioperm
9374     case TARGET_NR_ioperm:
9375         goto unimplemented;
9376 #endif
9377 #ifdef TARGET_NR_socketcall
9378     case TARGET_NR_socketcall:
9379         ret = do_socketcall(arg1, arg2);
9380         break;
9381 #endif
9382 #ifdef TARGET_NR_accept
9383     case TARGET_NR_accept:
9384         ret = do_accept4(arg1, arg2, arg3, 0);
9385         break;
9386 #endif
9387 #ifdef TARGET_NR_accept4
9388     case TARGET_NR_accept4:
9389         ret = do_accept4(arg1, arg2, arg3, arg4);
9390         break;
9391 #endif
9392 #ifdef TARGET_NR_bind
9393     case TARGET_NR_bind:
9394         ret = do_bind(arg1, arg2, arg3);
9395         break;
9396 #endif
9397 #ifdef TARGET_NR_connect
9398     case TARGET_NR_connect:
9399         ret = do_connect(arg1, arg2, arg3);
9400         break;
9401 #endif
9402 #ifdef TARGET_NR_getpeername
9403     case TARGET_NR_getpeername:
9404         ret = do_getpeername(arg1, arg2, arg3);
9405         break;
9406 #endif
9407 #ifdef TARGET_NR_getsockname
9408     case TARGET_NR_getsockname:
9409         ret = do_getsockname(arg1, arg2, arg3);
9410         break;
9411 #endif
9412 #ifdef TARGET_NR_getsockopt
9413     case TARGET_NR_getsockopt:
9414         ret = do_getsockopt(arg1, arg2, arg3, arg4, arg5);
9415         break;
9416 #endif
9417 #ifdef TARGET_NR_listen
9418     case TARGET_NR_listen:
9419         ret = get_errno(listen(arg1, arg2));
9420         break;
9421 #endif
9422 #ifdef TARGET_NR_recv
9423     case TARGET_NR_recv:
9424         ret = do_recvfrom(arg1, arg2, arg3, arg4, 0, 0);
9425         break;
9426 #endif
9427 #ifdef TARGET_NR_recvfrom
9428     case TARGET_NR_recvfrom:
9429         ret = do_recvfrom(arg1, arg2, arg3, arg4, arg5, arg6);
9430         break;
9431 #endif
9432 #ifdef TARGET_NR_recvmsg
9433     case TARGET_NR_recvmsg:
9434         ret = do_sendrecvmsg(arg1, arg2, arg3, 0);
9435         break;
9436 #endif
9437 #ifdef TARGET_NR_send
9438     case TARGET_NR_send:
9439         ret = do_sendto(arg1, arg2, arg3, arg4, 0, 0);
9440         break;
9441 #endif
9442 #ifdef TARGET_NR_sendmsg
9443     case TARGET_NR_sendmsg:
9444         ret = do_sendrecvmsg(arg1, arg2, arg3, 1);
9445         break;
9446 #endif
9447 #ifdef TARGET_NR_sendmmsg
9448     case TARGET_NR_sendmmsg:
9449         ret = do_sendrecvmmsg(arg1, arg2, arg3, arg4, 1);
9450         break;
9451     case TARGET_NR_recvmmsg:
9452         ret = do_sendrecvmmsg(arg1, arg2, arg3, arg4, 0);
9453         break;
9454 #endif
9455 #ifdef TARGET_NR_sendto
9456     case TARGET_NR_sendto:
9457         ret = do_sendto(arg1, arg2, arg3, arg4, arg5, arg6);
9458         break;
9459 #endif
9460 #ifdef TARGET_NR_shutdown
9461     case TARGET_NR_shutdown:
9462         ret = get_errno(shutdown(arg1, arg2));
9463         break;
9464 #endif
9465 #if defined(TARGET_NR_getrandom) && defined(__NR_getrandom)
9466     case TARGET_NR_getrandom:
9467         p = lock_user(VERIFY_WRITE, arg1, arg2, 0);
9468         if (!p) {
9469             goto efault;
9470         }
9471         ret = get_errno(getrandom(p, arg2, arg3));
9472         unlock_user(p, arg1, ret);
9473         break;
9474 #endif
9475 #ifdef TARGET_NR_socket
9476     case TARGET_NR_socket:
9477         ret = do_socket(arg1, arg2, arg3);
9478         break;
9479 #endif
9480 #ifdef TARGET_NR_socketpair
9481     case TARGET_NR_socketpair:
9482         ret = do_socketpair(arg1, arg2, arg3, arg4);
9483         break;
9484 #endif
9485 #ifdef TARGET_NR_setsockopt
9486     case TARGET_NR_setsockopt:
9487         ret = do_setsockopt(arg1, arg2, arg3, arg4, (socklen_t) arg5);
9488         break;
9489 #endif
9490 #if defined(TARGET_NR_syslog)
9491     case TARGET_NR_syslog:
9492         {
9493             int len = arg2;
9494 
9495             switch (arg1) {
9496             case TARGET_SYSLOG_ACTION_CLOSE:         /* Close log */
9497             case TARGET_SYSLOG_ACTION_OPEN:          /* Open log */
9498             case TARGET_SYSLOG_ACTION_CLEAR:         /* Clear ring buffer */
9499             case TARGET_SYSLOG_ACTION_CONSOLE_OFF:   /* Disable logging */
9500             case TARGET_SYSLOG_ACTION_CONSOLE_ON:    /* Enable logging */
9501             case TARGET_SYSLOG_ACTION_CONSOLE_LEVEL: /* Set messages level */
9502             case TARGET_SYSLOG_ACTION_SIZE_UNREAD:   /* Number of chars */
9503             case TARGET_SYSLOG_ACTION_SIZE_BUFFER:   /* Size of the buffer */
9504                 {
9505                     ret = get_errno(sys_syslog((int)arg1, NULL, (int)arg3));
9506                 }
9507                 break;
9508             case TARGET_SYSLOG_ACTION_READ:          /* Read from log */
9509             case TARGET_SYSLOG_ACTION_READ_CLEAR:    /* Read/clear msgs */
9510             case TARGET_SYSLOG_ACTION_READ_ALL:      /* Read last messages */
9511                 {
9512                     ret = -TARGET_EINVAL;
9513                     if (len < 0) {
9514                         goto fail;
9515                     }
9516                     ret = 0;
9517                     if (len == 0) {
9518                         break;
9519                     }
9520                     p = lock_user(VERIFY_WRITE, arg2, arg3, 0);
9521                     if (!p) {
9522                         ret = -TARGET_EFAULT;
9523                         goto fail;
9524                     }
9525                     ret = get_errno(sys_syslog((int)arg1, p, (int)arg3));
9526                     unlock_user(p, arg2, arg3);
9527                 }
9528                 break;
9529             default:
9530                 ret = -EINVAL;
9531                 break;
9532             }
9533         }
9534         break;
9535 #endif
9536     case TARGET_NR_setitimer:
9537         {
9538             struct itimerval value, ovalue, *pvalue;
9539 
9540             if (arg2) {
9541                 pvalue = &value;
9542                 if (copy_from_user_timeval(&pvalue->it_interval, arg2)
9543                     || copy_from_user_timeval(&pvalue->it_value,
9544                                               arg2 + sizeof(struct target_timeval)))
9545                     goto efault;
9546             } else {
9547                 pvalue = NULL;
9548             }
9549             ret = get_errno(setitimer(arg1, pvalue, &ovalue));
9550             if (!is_error(ret) && arg3) {
9551                 if (copy_to_user_timeval(arg3,
9552                                          &ovalue.it_interval)
9553                     || copy_to_user_timeval(arg3 + sizeof(struct target_timeval),
9554                                             &ovalue.it_value))
9555                     goto efault;
9556             }
9557         }
9558         break;
9559     case TARGET_NR_getitimer:
9560         {
9561             struct itimerval value;
9562 
9563             ret = get_errno(getitimer(arg1, &value));
9564             if (!is_error(ret) && arg2) {
9565                 if (copy_to_user_timeval(arg2,
9566                                          &value.it_interval)
9567                     || copy_to_user_timeval(arg2 + sizeof(struct target_timeval),
9568                                             &value.it_value))
9569                     goto efault;
9570             }
9571         }
9572         break;
9573 #ifdef TARGET_NR_stat
9574     case TARGET_NR_stat:
9575         if (!(p = lock_user_string(arg1)))
9576             goto efault;
9577         ret = get_errno(stat(path(p), &st));
9578         unlock_user(p, arg1, 0);
9579         goto do_stat;
9580 #endif
9581 #ifdef TARGET_NR_lstat
9582     case TARGET_NR_lstat:
9583         if (!(p = lock_user_string(arg1)))
9584             goto efault;
9585         ret = get_errno(lstat(path(p), &st));
9586         unlock_user(p, arg1, 0);
9587         goto do_stat;
9588 #endif
9589     case TARGET_NR_fstat:
9590         {
9591             ret = get_errno(fstat(arg1, &st));
9592 #if defined(TARGET_NR_stat) || defined(TARGET_NR_lstat)
9593         do_stat:
9594 #endif
9595             if (!is_error(ret)) {
9596                 struct target_stat *target_st;
9597 
9598                 if (!lock_user_struct(VERIFY_WRITE, target_st, arg2, 0))
9599                     goto efault;
9600                 memset(target_st, 0, sizeof(*target_st));
9601                 __put_user(st.st_dev, &target_st->st_dev);
9602                 __put_user(st.st_ino, &target_st->st_ino);
9603                 __put_user(st.st_mode, &target_st->st_mode);
9604                 __put_user(st.st_uid, &target_st->st_uid);
9605                 __put_user(st.st_gid, &target_st->st_gid);
9606                 __put_user(st.st_nlink, &target_st->st_nlink);
9607                 __put_user(st.st_rdev, &target_st->st_rdev);
9608                 __put_user(st.st_size, &target_st->st_size);
9609                 __put_user(st.st_blksize, &target_st->st_blksize);
9610                 __put_user(st.st_blocks, &target_st->st_blocks);
9611                 __put_user(st.st_atime, &target_st->target_st_atime);
9612                 __put_user(st.st_mtime, &target_st->target_st_mtime);
9613                 __put_user(st.st_ctime, &target_st->target_st_ctime);
9614                 unlock_user_struct(target_st, arg2, 1);
9615             }
9616         }
9617         break;
9618 #ifdef TARGET_NR_olduname
9619     case TARGET_NR_olduname:
9620         goto unimplemented;
9621 #endif
9622 #ifdef TARGET_NR_iopl
9623     case TARGET_NR_iopl:
9624         goto unimplemented;
9625 #endif
9626     case TARGET_NR_vhangup:
9627         ret = get_errno(vhangup());
9628         break;
9629 #ifdef TARGET_NR_idle
9630     case TARGET_NR_idle:
9631         goto unimplemented;
9632 #endif
9633 #ifdef TARGET_NR_syscall
9634     case TARGET_NR_syscall:
9635         ret = do_syscall(cpu_env, arg1 & 0xffff, arg2, arg3, arg4, arg5,
9636                          arg6, arg7, arg8, 0);
9637         break;
9638 #endif
9639     case TARGET_NR_wait4:
9640         {
9641             int status;
9642             abi_long status_ptr = arg2;
9643             struct rusage rusage, *rusage_ptr;
9644             abi_ulong target_rusage = arg4;
9645             abi_long rusage_err;
9646             if (target_rusage)
9647                 rusage_ptr = &rusage;
9648             else
9649                 rusage_ptr = NULL;
9650             ret = get_errno(safe_wait4(arg1, &status, arg3, rusage_ptr));
9651             if (!is_error(ret)) {
9652                 if (status_ptr && ret) {
9653                     status = host_to_target_waitstatus(status);
9654                     if (put_user_s32(status, status_ptr))
9655                         goto efault;
9656                 }
9657                 if (target_rusage) {
9658                     rusage_err = host_to_target_rusage(target_rusage, &rusage);
9659                     if (rusage_err) {
9660                         ret = rusage_err;
9661                     }
9662                 }
9663             }
9664         }
9665         break;
9666 #ifdef TARGET_NR_swapoff
9667     case TARGET_NR_swapoff:
9668         if (!(p = lock_user_string(arg1)))
9669             goto efault;
9670         ret = get_errno(swapoff(p));
9671         unlock_user(p, arg1, 0);
9672         break;
9673 #endif
9674     case TARGET_NR_sysinfo:
9675         {
9676             struct target_sysinfo *target_value;
9677             struct sysinfo value;
9678             ret = get_errno(sysinfo(&value));
9679             if (!is_error(ret) && arg1)
9680             {
9681                 if (!lock_user_struct(VERIFY_WRITE, target_value, arg1, 0))
9682                     goto efault;
9683                 __put_user(value.uptime, &target_value->uptime);
9684                 __put_user(value.loads[0], &target_value->loads[0]);
9685                 __put_user(value.loads[1], &target_value->loads[1]);
9686                 __put_user(value.loads[2], &target_value->loads[2]);
9687                 __put_user(value.totalram, &target_value->totalram);
9688                 __put_user(value.freeram, &target_value->freeram);
9689                 __put_user(value.sharedram, &target_value->sharedram);
9690                 __put_user(value.bufferram, &target_value->bufferram);
9691                 __put_user(value.totalswap, &target_value->totalswap);
9692                 __put_user(value.freeswap, &target_value->freeswap);
9693                 __put_user(value.procs, &target_value->procs);
9694                 __put_user(value.totalhigh, &target_value->totalhigh);
9695                 __put_user(value.freehigh, &target_value->freehigh);
9696                 __put_user(value.mem_unit, &target_value->mem_unit);
9697                 unlock_user_struct(target_value, arg1, 1);
9698             }
9699         }
9700         break;
9701 #ifdef TARGET_NR_ipc
9702     case TARGET_NR_ipc:
9703         ret = do_ipc(cpu_env, arg1, arg2, arg3, arg4, arg5, arg6);
9704         break;
9705 #endif
9706 #ifdef TARGET_NR_semget
9707     case TARGET_NR_semget:
9708         ret = get_errno(semget(arg1, arg2, arg3));
9709         break;
9710 #endif
9711 #ifdef TARGET_NR_semop
9712     case TARGET_NR_semop:
9713         ret = do_semop(arg1, arg2, arg3);
9714         break;
9715 #endif
9716 #ifdef TARGET_NR_semctl
9717     case TARGET_NR_semctl:
9718         ret = do_semctl(arg1, arg2, arg3, arg4);
9719         break;
9720 #endif
9721 #ifdef TARGET_NR_msgctl
9722     case TARGET_NR_msgctl:
9723         ret = do_msgctl(arg1, arg2, arg3);
9724         break;
9725 #endif
9726 #ifdef TARGET_NR_msgget
9727     case TARGET_NR_msgget:
9728         ret = get_errno(msgget(arg1, arg2));
9729         break;
9730 #endif
9731 #ifdef TARGET_NR_msgrcv
9732     case TARGET_NR_msgrcv:
9733         ret = do_msgrcv(arg1, arg2, arg3, arg4, arg5);
9734         break;
9735 #endif
9736 #ifdef TARGET_NR_msgsnd
9737     case TARGET_NR_msgsnd:
9738         ret = do_msgsnd(arg1, arg2, arg3, arg4);
9739         break;
9740 #endif
9741 #ifdef TARGET_NR_shmget
9742     case TARGET_NR_shmget:
9743         ret = get_errno(shmget(arg1, arg2, arg3));
9744         break;
9745 #endif
9746 #ifdef TARGET_NR_shmctl
9747     case TARGET_NR_shmctl:
9748         ret = do_shmctl(arg1, arg2, arg3);
9749         break;
9750 #endif
9751 #ifdef TARGET_NR_shmat
9752     case TARGET_NR_shmat:
9753         ret = do_shmat(cpu_env, arg1, arg2, arg3);
9754         break;
9755 #endif
9756 #ifdef TARGET_NR_shmdt
9757     case TARGET_NR_shmdt:
9758         ret = do_shmdt(arg1);
9759         break;
9760 #endif
9761     case TARGET_NR_fsync:
9762         ret = get_errno(fsync(arg1));
9763         break;
9764     case TARGET_NR_clone:
9765         /* Linux manages to have three different orderings for its
9766          * arguments to clone(); the BACKWARDS and BACKWARDS2 defines
9767          * match the kernel's CONFIG_CLONE_* settings.
9768          * Microblaze is further special in that it uses a sixth
9769          * implicit argument to clone for the TLS pointer.
9770          */
9771 #if defined(TARGET_MICROBLAZE)
9772         ret = get_errno(do_fork(cpu_env, arg1, arg2, arg4, arg6, arg5));
9773 #elif defined(TARGET_CLONE_BACKWARDS)
9774         ret = get_errno(do_fork(cpu_env, arg1, arg2, arg3, arg4, arg5));
9775 #elif defined(TARGET_CLONE_BACKWARDS2)
9776         ret = get_errno(do_fork(cpu_env, arg2, arg1, arg3, arg5, arg4));
9777 #else
9778         ret = get_errno(do_fork(cpu_env, arg1, arg2, arg3, arg5, arg4));
9779 #endif
9780         break;
9781 #ifdef __NR_exit_group
9782         /* new thread calls */
9783     case TARGET_NR_exit_group:
9784 #ifdef TARGET_GPROF
9785         _mcleanup();
9786 #endif
9787         gdb_exit(cpu_env, arg1);
9788         ret = get_errno(exit_group(arg1));
9789         break;
9790 #endif
9791     case TARGET_NR_setdomainname:
9792         if (!(p = lock_user_string(arg1)))
9793             goto efault;
9794         ret = get_errno(setdomainname(p, arg2));
9795         unlock_user(p, arg1, 0);
9796         break;
9797     case TARGET_NR_uname:
9798         /* no need to transcode because we use the linux syscall */
9799         {
9800             struct new_utsname * buf;
9801 
9802             if (!lock_user_struct(VERIFY_WRITE, buf, arg1, 0))
9803                 goto efault;
9804             ret = get_errno(sys_uname(buf));
9805             if (!is_error(ret)) {
9806                 /* Overwrite the native machine name with whatever is being
9807                    emulated. */
9808                 strcpy (buf->machine, cpu_to_uname_machine(cpu_env));
9809                 /* Allow the user to override the reported release.  */
9810                 if (qemu_uname_release && *qemu_uname_release) {
9811                     g_strlcpy(buf->release, qemu_uname_release,
9812                               sizeof(buf->release));
9813                 }
9814             }
9815             unlock_user_struct(buf, arg1, 1);
9816         }
9817         break;
9818 #ifdef TARGET_I386
9819     case TARGET_NR_modify_ldt:
9820         ret = do_modify_ldt(cpu_env, arg1, arg2, arg3);
9821         break;
9822 #if !defined(TARGET_X86_64)
9823     case TARGET_NR_vm86old:
9824         goto unimplemented;
9825     case TARGET_NR_vm86:
9826         ret = do_vm86(cpu_env, arg1, arg2);
9827         break;
9828 #endif
9829 #endif
9830     case TARGET_NR_adjtimex:
9831         {
9832             struct timex host_buf;
9833 
9834             if (target_to_host_timex(&host_buf, arg1) != 0) {
9835                 goto efault;
9836             }
9837             ret = get_errno(adjtimex(&host_buf));
9838             if (!is_error(ret)) {
9839                 if (host_to_target_timex(arg1, &host_buf) != 0) {
9840                     goto efault;
9841                 }
9842             }
9843         }
9844         break;
9845 #if defined(TARGET_NR_clock_adjtime) && defined(CONFIG_CLOCK_ADJTIME)
9846     case TARGET_NR_clock_adjtime:
9847         {
9848             struct timex htx, *phtx = &htx;
9849 
9850             if (target_to_host_timex(phtx, arg2) != 0) {
9851                 goto efault;
9852             }
9853             ret = get_errno(clock_adjtime(arg1, phtx));
9854             if (!is_error(ret) && phtx) {
9855                 if (host_to_target_timex(arg2, phtx) != 0) {
9856                     goto efault;
9857                 }
9858             }
9859         }
9860         break;
9861 #endif
9862 #ifdef TARGET_NR_create_module
9863     case TARGET_NR_create_module:
9864 #endif
9865     case TARGET_NR_init_module:
9866     case TARGET_NR_delete_module:
9867 #ifdef TARGET_NR_get_kernel_syms
9868     case TARGET_NR_get_kernel_syms:
9869 #endif
9870         goto unimplemented;
9871     case TARGET_NR_quotactl:
9872         goto unimplemented;
9873     case TARGET_NR_getpgid:
9874         ret = get_errno(getpgid(arg1));
9875         break;
9876     case TARGET_NR_fchdir:
9877         ret = get_errno(fchdir(arg1));
9878         break;
9879 #ifdef TARGET_NR_bdflush /* not on x86_64 */
9880     case TARGET_NR_bdflush:
9881         goto unimplemented;
9882 #endif
9883 #ifdef TARGET_NR_sysfs
9884     case TARGET_NR_sysfs:
9885         goto unimplemented;
9886 #endif
9887     case TARGET_NR_personality:
9888         ret = get_errno(personality(arg1));
9889         break;
9890 #ifdef TARGET_NR_afs_syscall
9891     case TARGET_NR_afs_syscall:
9892         goto unimplemented;
9893 #endif
9894 #ifdef TARGET_NR__llseek /* Not on alpha */
9895     case TARGET_NR__llseek:
9896         {
9897             int64_t res;
9898 #if !defined(__NR_llseek)
9899             res = lseek(arg1, ((uint64_t)arg2 << 32) | (abi_ulong)arg3, arg5);
9900             if (res == -1) {
9901                 ret = get_errno(res);
9902             } else {
9903                 ret = 0;
9904             }
9905 #else
9906             ret = get_errno(_llseek(arg1, arg2, arg3, &res, arg5));
9907 #endif
9908             if ((ret == 0) && put_user_s64(res, arg4)) {
9909                 goto efault;
9910             }
9911         }
9912         break;
9913 #endif
9914 #ifdef TARGET_NR_getdents
9915     case TARGET_NR_getdents:
9916 #ifdef __NR_getdents
9917 #if TARGET_ABI_BITS == 32 && HOST_LONG_BITS == 64
9918         {
9919             struct target_dirent *target_dirp;
9920             struct linux_dirent *dirp;
9921             abi_long count = arg3;
9922 
9923             dirp = g_try_malloc(count);
9924             if (!dirp) {
9925                 ret = -TARGET_ENOMEM;
9926                 goto fail;
9927             }
9928 
9929             ret = get_errno(sys_getdents(arg1, dirp, count));
9930             if (!is_error(ret)) {
9931                 struct linux_dirent *de;
9932 		struct target_dirent *tde;
9933                 int len = ret;
9934                 int reclen, treclen;
9935 		int count1, tnamelen;
9936 
9937 		count1 = 0;
9938                 de = dirp;
9939                 if (!(target_dirp = lock_user(VERIFY_WRITE, arg2, count, 0)))
9940                     goto efault;
9941 		tde = target_dirp;
9942                 while (len > 0) {
9943                     reclen = de->d_reclen;
9944                     tnamelen = reclen - offsetof(struct linux_dirent, d_name);
9945                     assert(tnamelen >= 0);
9946                     treclen = tnamelen + offsetof(struct target_dirent, d_name);
9947                     assert(count1 + treclen <= count);
9948                     tde->d_reclen = tswap16(treclen);
9949                     tde->d_ino = tswapal(de->d_ino);
9950                     tde->d_off = tswapal(de->d_off);
9951                     memcpy(tde->d_name, de->d_name, tnamelen);
9952                     de = (struct linux_dirent *)((char *)de + reclen);
9953                     len -= reclen;
9954                     tde = (struct target_dirent *)((char *)tde + treclen);
9955 		    count1 += treclen;
9956                 }
9957 		ret = count1;
9958                 unlock_user(target_dirp, arg2, ret);
9959             }
9960             g_free(dirp);
9961         }
9962 #else
9963         {
9964             struct linux_dirent *dirp;
9965             abi_long count = arg3;
9966 
9967             if (!(dirp = lock_user(VERIFY_WRITE, arg2, count, 0)))
9968                 goto efault;
9969             ret = get_errno(sys_getdents(arg1, dirp, count));
9970             if (!is_error(ret)) {
9971                 struct linux_dirent *de;
9972                 int len = ret;
9973                 int reclen;
9974                 de = dirp;
9975                 while (len > 0) {
9976                     reclen = de->d_reclen;
9977                     if (reclen > len)
9978                         break;
9979                     de->d_reclen = tswap16(reclen);
9980                     tswapls(&de->d_ino);
9981                     tswapls(&de->d_off);
9982                     de = (struct linux_dirent *)((char *)de + reclen);
9983                     len -= reclen;
9984                 }
9985             }
9986             unlock_user(dirp, arg2, ret);
9987         }
9988 #endif
9989 #else
9990         /* Implement getdents in terms of getdents64 */
9991         {
9992             struct linux_dirent64 *dirp;
9993             abi_long count = arg3;
9994 
9995             dirp = lock_user(VERIFY_WRITE, arg2, count, 0);
9996             if (!dirp) {
9997                 goto efault;
9998             }
9999             ret = get_errno(sys_getdents64(arg1, dirp, count));
10000             if (!is_error(ret)) {
10001                 /* Convert the dirent64 structs to target dirent.  We do this
10002                  * in-place, since we can guarantee that a target_dirent is no
10003                  * larger than a dirent64; however this means we have to be
10004                  * careful to read everything before writing in the new format.
10005                  */
10006                 struct linux_dirent64 *de;
10007                 struct target_dirent *tde;
10008                 int len = ret;
10009                 int tlen = 0;
10010 
10011                 de = dirp;
10012                 tde = (struct target_dirent *)dirp;
10013                 while (len > 0) {
10014                     int namelen, treclen;
10015                     int reclen = de->d_reclen;
10016                     uint64_t ino = de->d_ino;
10017                     int64_t off = de->d_off;
10018                     uint8_t type = de->d_type;
10019 
10020                     namelen = strlen(de->d_name);
10021                     treclen = offsetof(struct target_dirent, d_name)
10022                         + namelen + 2;
10023                     treclen = QEMU_ALIGN_UP(treclen, sizeof(abi_long));
10024 
10025                     memmove(tde->d_name, de->d_name, namelen + 1);
10026                     tde->d_ino = tswapal(ino);
10027                     tde->d_off = tswapal(off);
10028                     tde->d_reclen = tswap16(treclen);
10029                     /* The target_dirent type is in what was formerly a padding
10030                      * byte at the end of the structure:
10031                      */
10032                     *(((char *)tde) + treclen - 1) = type;
10033 
10034                     de = (struct linux_dirent64 *)((char *)de + reclen);
10035                     tde = (struct target_dirent *)((char *)tde + treclen);
10036                     len -= reclen;
10037                     tlen += treclen;
10038                 }
10039                 ret = tlen;
10040             }
10041             unlock_user(dirp, arg2, ret);
10042         }
10043 #endif
10044         break;
10045 #endif /* TARGET_NR_getdents */
10046 #if defined(TARGET_NR_getdents64) && defined(__NR_getdents64)
10047     case TARGET_NR_getdents64:
10048         {
10049             struct linux_dirent64 *dirp;
10050             abi_long count = arg3;
10051             if (!(dirp = lock_user(VERIFY_WRITE, arg2, count, 0)))
10052                 goto efault;
10053             ret = get_errno(sys_getdents64(arg1, dirp, count));
10054             if (!is_error(ret)) {
10055                 struct linux_dirent64 *de;
10056                 int len = ret;
10057                 int reclen;
10058                 de = dirp;
10059                 while (len > 0) {
10060                     reclen = de->d_reclen;
10061                     if (reclen > len)
10062                         break;
10063                     de->d_reclen = tswap16(reclen);
10064                     tswap64s((uint64_t *)&de->d_ino);
10065                     tswap64s((uint64_t *)&de->d_off);
10066                     de = (struct linux_dirent64 *)((char *)de + reclen);
10067                     len -= reclen;
10068                 }
10069             }
10070             unlock_user(dirp, arg2, ret);
10071         }
10072         break;
10073 #endif /* TARGET_NR_getdents64 */
10074 #if defined(TARGET_NR__newselect)
10075     case TARGET_NR__newselect:
10076         ret = do_select(arg1, arg2, arg3, arg4, arg5);
10077         break;
10078 #endif
10079 #if defined(TARGET_NR_poll) || defined(TARGET_NR_ppoll)
10080 # ifdef TARGET_NR_poll
10081     case TARGET_NR_poll:
10082 # endif
10083 # ifdef TARGET_NR_ppoll
10084     case TARGET_NR_ppoll:
10085 # endif
10086         {
10087             struct target_pollfd *target_pfd;
10088             unsigned int nfds = arg2;
10089             struct pollfd *pfd;
10090             unsigned int i;
10091 
10092             pfd = NULL;
10093             target_pfd = NULL;
10094             if (nfds) {
10095                 if (nfds > (INT_MAX / sizeof(struct target_pollfd))) {
10096                     ret = -TARGET_EINVAL;
10097                     break;
10098                 }
10099 
10100                 target_pfd = lock_user(VERIFY_WRITE, arg1,
10101                                        sizeof(struct target_pollfd) * nfds, 1);
10102                 if (!target_pfd) {
10103                     goto efault;
10104                 }
10105 
10106                 pfd = alloca(sizeof(struct pollfd) * nfds);
10107                 for (i = 0; i < nfds; i++) {
10108                     pfd[i].fd = tswap32(target_pfd[i].fd);
10109                     pfd[i].events = tswap16(target_pfd[i].events);
10110                 }
10111             }
10112 
10113             switch (num) {
10114 # ifdef TARGET_NR_ppoll
10115             case TARGET_NR_ppoll:
10116             {
10117                 struct timespec _timeout_ts, *timeout_ts = &_timeout_ts;
10118                 target_sigset_t *target_set;
10119                 sigset_t _set, *set = &_set;
10120 
10121                 if (arg3) {
10122                     if (target_to_host_timespec(timeout_ts, arg3)) {
10123                         unlock_user(target_pfd, arg1, 0);
10124                         goto efault;
10125                     }
10126                 } else {
10127                     timeout_ts = NULL;
10128                 }
10129 
10130                 if (arg4) {
10131                     if (arg5 != sizeof(target_sigset_t)) {
10132                         unlock_user(target_pfd, arg1, 0);
10133                         ret = -TARGET_EINVAL;
10134                         break;
10135                     }
10136 
10137                     target_set = lock_user(VERIFY_READ, arg4, sizeof(target_sigset_t), 1);
10138                     if (!target_set) {
10139                         unlock_user(target_pfd, arg1, 0);
10140                         goto efault;
10141                     }
10142                     target_to_host_sigset(set, target_set);
10143                 } else {
10144                     set = NULL;
10145                 }
10146 
10147                 ret = get_errno(safe_ppoll(pfd, nfds, timeout_ts,
10148                                            set, SIGSET_T_SIZE));
10149 
10150                 if (!is_error(ret) && arg3) {
10151                     host_to_target_timespec(arg3, timeout_ts);
10152                 }
10153                 if (arg4) {
10154                     unlock_user(target_set, arg4, 0);
10155                 }
10156                 break;
10157             }
10158 # endif
10159 # ifdef TARGET_NR_poll
10160             case TARGET_NR_poll:
10161             {
10162                 struct timespec ts, *pts;
10163 
10164                 if (arg3 >= 0) {
10165                     /* Convert ms to secs, ns */
10166                     ts.tv_sec = arg3 / 1000;
10167                     ts.tv_nsec = (arg3 % 1000) * 1000000LL;
10168                     pts = &ts;
10169                 } else {
10170                     /* -ve poll() timeout means "infinite" */
10171                     pts = NULL;
10172                 }
10173                 ret = get_errno(safe_ppoll(pfd, nfds, pts, NULL, 0));
10174                 break;
10175             }
10176 # endif
10177             default:
10178                 g_assert_not_reached();
10179             }
10180 
10181             if (!is_error(ret)) {
10182                 for(i = 0; i < nfds; i++) {
10183                     target_pfd[i].revents = tswap16(pfd[i].revents);
10184                 }
10185             }
10186             unlock_user(target_pfd, arg1, sizeof(struct target_pollfd) * nfds);
10187         }
10188         break;
10189 #endif
10190     case TARGET_NR_flock:
10191         /* NOTE: the flock constant seems to be the same for every
10192            Linux platform */
10193         ret = get_errno(safe_flock(arg1, arg2));
10194         break;
10195     case TARGET_NR_readv:
10196         {
10197             struct iovec *vec = lock_iovec(VERIFY_WRITE, arg2, arg3, 0);
10198             if (vec != NULL) {
10199                 ret = get_errno(safe_readv(arg1, vec, arg3));
10200                 unlock_iovec(vec, arg2, arg3, 1);
10201             } else {
10202                 ret = -host_to_target_errno(errno);
10203             }
10204         }
10205         break;
10206     case TARGET_NR_writev:
10207         {
10208             struct iovec *vec = lock_iovec(VERIFY_READ, arg2, arg3, 1);
10209             if (vec != NULL) {
10210                 ret = get_errno(safe_writev(arg1, vec, arg3));
10211                 unlock_iovec(vec, arg2, arg3, 0);
10212             } else {
10213                 ret = -host_to_target_errno(errno);
10214             }
10215         }
10216         break;
10217 #if defined(TARGET_NR_preadv)
10218     case TARGET_NR_preadv:
10219         {
10220             struct iovec *vec = lock_iovec(VERIFY_WRITE, arg2, arg3, 0);
10221             if (vec != NULL) {
10222                 ret = get_errno(safe_preadv(arg1, vec, arg3, arg4, arg5));
10223                 unlock_iovec(vec, arg2, arg3, 1);
10224             } else {
10225                 ret = -host_to_target_errno(errno);
10226            }
10227         }
10228         break;
10229 #endif
10230 #if defined(TARGET_NR_pwritev)
10231     case TARGET_NR_pwritev:
10232         {
10233             struct iovec *vec = lock_iovec(VERIFY_READ, arg2, arg3, 1);
10234             if (vec != NULL) {
10235                 ret = get_errno(safe_pwritev(arg1, vec, arg3, arg4, arg5));
10236                 unlock_iovec(vec, arg2, arg3, 0);
10237             } else {
10238                 ret = -host_to_target_errno(errno);
10239            }
10240         }
10241         break;
10242 #endif
10243     case TARGET_NR_getsid:
10244         ret = get_errno(getsid(arg1));
10245         break;
10246 #if defined(TARGET_NR_fdatasync) /* Not on alpha (osf_datasync ?) */
10247     case TARGET_NR_fdatasync:
10248         ret = get_errno(fdatasync(arg1));
10249         break;
10250 #endif
10251 #ifdef TARGET_NR__sysctl
10252     case TARGET_NR__sysctl:
10253         /* We don't implement this, but ENOTDIR is always a safe
10254            return value. */
10255         ret = -TARGET_ENOTDIR;
10256         break;
10257 #endif
10258     case TARGET_NR_sched_getaffinity:
10259         {
10260             unsigned int mask_size;
10261             unsigned long *mask;
10262 
10263             /*
10264              * sched_getaffinity needs multiples of ulong, so need to take
10265              * care of mismatches between target ulong and host ulong sizes.
10266              */
10267             if (arg2 & (sizeof(abi_ulong) - 1)) {
10268                 ret = -TARGET_EINVAL;
10269                 break;
10270             }
10271             mask_size = (arg2 + (sizeof(*mask) - 1)) & ~(sizeof(*mask) - 1);
10272 
10273             mask = alloca(mask_size);
10274             ret = get_errno(sys_sched_getaffinity(arg1, mask_size, mask));
10275 
10276             if (!is_error(ret)) {
10277                 if (ret > arg2) {
10278                     /* More data returned than the caller's buffer will fit.
10279                      * This only happens if sizeof(abi_long) < sizeof(long)
10280                      * and the caller passed us a buffer holding an odd number
10281                      * of abi_longs. If the host kernel is actually using the
10282                      * extra 4 bytes then fail EINVAL; otherwise we can just
10283                      * ignore them and only copy the interesting part.
10284                      */
10285                     int numcpus = sysconf(_SC_NPROCESSORS_CONF);
10286                     if (numcpus > arg2 * 8) {
10287                         ret = -TARGET_EINVAL;
10288                         break;
10289                     }
10290                     ret = arg2;
10291                 }
10292 
10293                 if (copy_to_user(arg3, mask, ret)) {
10294                     goto efault;
10295                 }
10296             }
10297         }
10298         break;
10299     case TARGET_NR_sched_setaffinity:
10300         {
10301             unsigned int mask_size;
10302             unsigned long *mask;
10303 
10304             /*
10305              * sched_setaffinity needs multiples of ulong, so need to take
10306              * care of mismatches between target ulong and host ulong sizes.
10307              */
10308             if (arg2 & (sizeof(abi_ulong) - 1)) {
10309                 ret = -TARGET_EINVAL;
10310                 break;
10311             }
10312             mask_size = (arg2 + (sizeof(*mask) - 1)) & ~(sizeof(*mask) - 1);
10313 
10314             mask = alloca(mask_size);
10315             if (!lock_user_struct(VERIFY_READ, p, arg3, 1)) {
10316                 goto efault;
10317             }
10318             memcpy(mask, p, arg2);
10319             unlock_user_struct(p, arg2, 0);
10320 
10321             ret = get_errno(sys_sched_setaffinity(arg1, mask_size, mask));
10322         }
10323         break;
10324     case TARGET_NR_sched_setparam:
10325         {
10326             struct sched_param *target_schp;
10327             struct sched_param schp;
10328 
10329             if (arg2 == 0) {
10330                 return -TARGET_EINVAL;
10331             }
10332             if (!lock_user_struct(VERIFY_READ, target_schp, arg2, 1))
10333                 goto efault;
10334             schp.sched_priority = tswap32(target_schp->sched_priority);
10335             unlock_user_struct(target_schp, arg2, 0);
10336             ret = get_errno(sched_setparam(arg1, &schp));
10337         }
10338         break;
10339     case TARGET_NR_sched_getparam:
10340         {
10341             struct sched_param *target_schp;
10342             struct sched_param schp;
10343 
10344             if (arg2 == 0) {
10345                 return -TARGET_EINVAL;
10346             }
10347             ret = get_errno(sched_getparam(arg1, &schp));
10348             if (!is_error(ret)) {
10349                 if (!lock_user_struct(VERIFY_WRITE, target_schp, arg2, 0))
10350                     goto efault;
10351                 target_schp->sched_priority = tswap32(schp.sched_priority);
10352                 unlock_user_struct(target_schp, arg2, 1);
10353             }
10354         }
10355         break;
10356     case TARGET_NR_sched_setscheduler:
10357         {
10358             struct sched_param *target_schp;
10359             struct sched_param schp;
10360             if (arg3 == 0) {
10361                 return -TARGET_EINVAL;
10362             }
10363             if (!lock_user_struct(VERIFY_READ, target_schp, arg3, 1))
10364                 goto efault;
10365             schp.sched_priority = tswap32(target_schp->sched_priority);
10366             unlock_user_struct(target_schp, arg3, 0);
10367             ret = get_errno(sched_setscheduler(arg1, arg2, &schp));
10368         }
10369         break;
10370     case TARGET_NR_sched_getscheduler:
10371         ret = get_errno(sched_getscheduler(arg1));
10372         break;
10373     case TARGET_NR_sched_yield:
10374         ret = get_errno(sched_yield());
10375         break;
10376     case TARGET_NR_sched_get_priority_max:
10377         ret = get_errno(sched_get_priority_max(arg1));
10378         break;
10379     case TARGET_NR_sched_get_priority_min:
10380         ret = get_errno(sched_get_priority_min(arg1));
10381         break;
10382     case TARGET_NR_sched_rr_get_interval:
10383         {
10384             struct timespec ts;
10385             ret = get_errno(sched_rr_get_interval(arg1, &ts));
10386             if (!is_error(ret)) {
10387                 ret = host_to_target_timespec(arg2, &ts);
10388             }
10389         }
10390         break;
10391     case TARGET_NR_nanosleep:
10392         {
10393             struct timespec req, rem;
10394             target_to_host_timespec(&req, arg1);
10395             ret = get_errno(safe_nanosleep(&req, &rem));
10396             if (is_error(ret) && arg2) {
10397                 host_to_target_timespec(arg2, &rem);
10398             }
10399         }
10400         break;
10401 #ifdef TARGET_NR_query_module
10402     case TARGET_NR_query_module:
10403         goto unimplemented;
10404 #endif
10405 #ifdef TARGET_NR_nfsservctl
10406     case TARGET_NR_nfsservctl:
10407         goto unimplemented;
10408 #endif
10409     case TARGET_NR_prctl:
10410         switch (arg1) {
10411         case PR_GET_PDEATHSIG:
10412         {
10413             int deathsig;
10414             ret = get_errno(prctl(arg1, &deathsig, arg3, arg4, arg5));
10415             if (!is_error(ret) && arg2
10416                 && put_user_ual(deathsig, arg2)) {
10417                 goto efault;
10418             }
10419             break;
10420         }
10421 #ifdef PR_GET_NAME
10422         case PR_GET_NAME:
10423         {
10424             void *name = lock_user(VERIFY_WRITE, arg2, 16, 1);
10425             if (!name) {
10426                 goto efault;
10427             }
10428             ret = get_errno(prctl(arg1, (unsigned long)name,
10429                                   arg3, arg4, arg5));
10430             unlock_user(name, arg2, 16);
10431             break;
10432         }
10433         case PR_SET_NAME:
10434         {
10435             void *name = lock_user(VERIFY_READ, arg2, 16, 1);
10436             if (!name) {
10437                 goto efault;
10438             }
10439             ret = get_errno(prctl(arg1, (unsigned long)name,
10440                                   arg3, arg4, arg5));
10441             unlock_user(name, arg2, 0);
10442             break;
10443         }
10444 #endif
10445         default:
10446             /* Most prctl options have no pointer arguments */
10447             ret = get_errno(prctl(arg1, arg2, arg3, arg4, arg5));
10448             break;
10449         }
10450         break;
10451 #ifdef TARGET_NR_arch_prctl
10452     case TARGET_NR_arch_prctl:
10453 #if defined(TARGET_I386) && !defined(TARGET_ABI32)
10454         ret = do_arch_prctl(cpu_env, arg1, arg2);
10455         break;
10456 #else
10457         goto unimplemented;
10458 #endif
10459 #endif
10460 #ifdef TARGET_NR_pread64
10461     case TARGET_NR_pread64:
10462         if (regpairs_aligned(cpu_env)) {
10463             arg4 = arg5;
10464             arg5 = arg6;
10465         }
10466         if (!(p = lock_user(VERIFY_WRITE, arg2, arg3, 0)))
10467             goto efault;
10468         ret = get_errno(pread64(arg1, p, arg3, target_offset64(arg4, arg5)));
10469         unlock_user(p, arg2, ret);
10470         break;
10471     case TARGET_NR_pwrite64:
10472         if (regpairs_aligned(cpu_env)) {
10473             arg4 = arg5;
10474             arg5 = arg6;
10475         }
10476         if (!(p = lock_user(VERIFY_READ, arg2, arg3, 1)))
10477             goto efault;
10478         ret = get_errno(pwrite64(arg1, p, arg3, target_offset64(arg4, arg5)));
10479         unlock_user(p, arg2, 0);
10480         break;
10481 #endif
10482     case TARGET_NR_getcwd:
10483         if (!(p = lock_user(VERIFY_WRITE, arg1, arg2, 0)))
10484             goto efault;
10485         ret = get_errno(sys_getcwd1(p, arg2));
10486         unlock_user(p, arg1, ret);
10487         break;
10488     case TARGET_NR_capget:
10489     case TARGET_NR_capset:
10490     {
10491         struct target_user_cap_header *target_header;
10492         struct target_user_cap_data *target_data = NULL;
10493         struct __user_cap_header_struct header;
10494         struct __user_cap_data_struct data[2];
10495         struct __user_cap_data_struct *dataptr = NULL;
10496         int i, target_datalen;
10497         int data_items = 1;
10498 
10499         if (!lock_user_struct(VERIFY_WRITE, target_header, arg1, 1)) {
10500             goto efault;
10501         }
10502         header.version = tswap32(target_header->version);
10503         header.pid = tswap32(target_header->pid);
10504 
10505         if (header.version != _LINUX_CAPABILITY_VERSION) {
10506             /* Version 2 and up takes pointer to two user_data structs */
10507             data_items = 2;
10508         }
10509 
10510         target_datalen = sizeof(*target_data) * data_items;
10511 
10512         if (arg2) {
10513             if (num == TARGET_NR_capget) {
10514                 target_data = lock_user(VERIFY_WRITE, arg2, target_datalen, 0);
10515             } else {
10516                 target_data = lock_user(VERIFY_READ, arg2, target_datalen, 1);
10517             }
10518             if (!target_data) {
10519                 unlock_user_struct(target_header, arg1, 0);
10520                 goto efault;
10521             }
10522 
10523             if (num == TARGET_NR_capset) {
10524                 for (i = 0; i < data_items; i++) {
10525                     data[i].effective = tswap32(target_data[i].effective);
10526                     data[i].permitted = tswap32(target_data[i].permitted);
10527                     data[i].inheritable = tswap32(target_data[i].inheritable);
10528                 }
10529             }
10530 
10531             dataptr = data;
10532         }
10533 
10534         if (num == TARGET_NR_capget) {
10535             ret = get_errno(capget(&header, dataptr));
10536         } else {
10537             ret = get_errno(capset(&header, dataptr));
10538         }
10539 
10540         /* The kernel always updates version for both capget and capset */
10541         target_header->version = tswap32(header.version);
10542         unlock_user_struct(target_header, arg1, 1);
10543 
10544         if (arg2) {
10545             if (num == TARGET_NR_capget) {
10546                 for (i = 0; i < data_items; i++) {
10547                     target_data[i].effective = tswap32(data[i].effective);
10548                     target_data[i].permitted = tswap32(data[i].permitted);
10549                     target_data[i].inheritable = tswap32(data[i].inheritable);
10550                 }
10551                 unlock_user(target_data, arg2, target_datalen);
10552             } else {
10553                 unlock_user(target_data, arg2, 0);
10554             }
10555         }
10556         break;
10557     }
10558     case TARGET_NR_sigaltstack:
10559         ret = do_sigaltstack(arg1, arg2, get_sp_from_cpustate((CPUArchState *)cpu_env));
10560         break;
10561 
10562 #ifdef CONFIG_SENDFILE
10563     case TARGET_NR_sendfile:
10564     {
10565         off_t *offp = NULL;
10566         off_t off;
10567         if (arg3) {
10568             ret = get_user_sal(off, arg3);
10569             if (is_error(ret)) {
10570                 break;
10571             }
10572             offp = &off;
10573         }
10574         ret = get_errno(sendfile(arg1, arg2, offp, arg4));
10575         if (!is_error(ret) && arg3) {
10576             abi_long ret2 = put_user_sal(off, arg3);
10577             if (is_error(ret2)) {
10578                 ret = ret2;
10579             }
10580         }
10581         break;
10582     }
10583 #ifdef TARGET_NR_sendfile64
10584     case TARGET_NR_sendfile64:
10585     {
10586         off_t *offp = NULL;
10587         off_t off;
10588         if (arg3) {
10589             ret = get_user_s64(off, arg3);
10590             if (is_error(ret)) {
10591                 break;
10592             }
10593             offp = &off;
10594         }
10595         ret = get_errno(sendfile(arg1, arg2, offp, arg4));
10596         if (!is_error(ret) && arg3) {
10597             abi_long ret2 = put_user_s64(off, arg3);
10598             if (is_error(ret2)) {
10599                 ret = ret2;
10600             }
10601         }
10602         break;
10603     }
10604 #endif
10605 #else
10606     case TARGET_NR_sendfile:
10607 #ifdef TARGET_NR_sendfile64
10608     case TARGET_NR_sendfile64:
10609 #endif
10610         goto unimplemented;
10611 #endif
10612 
10613 #ifdef TARGET_NR_getpmsg
10614     case TARGET_NR_getpmsg:
10615         goto unimplemented;
10616 #endif
10617 #ifdef TARGET_NR_putpmsg
10618     case TARGET_NR_putpmsg:
10619         goto unimplemented;
10620 #endif
10621 #ifdef TARGET_NR_vfork
10622     case TARGET_NR_vfork:
10623         ret = get_errno(do_fork(cpu_env,
10624                         CLONE_VFORK | CLONE_VM | TARGET_SIGCHLD,
10625                         0, 0, 0, 0));
10626         break;
10627 #endif
10628 #ifdef TARGET_NR_ugetrlimit
10629     case TARGET_NR_ugetrlimit:
10630     {
10631 	struct rlimit rlim;
10632 	int resource = target_to_host_resource(arg1);
10633 	ret = get_errno(getrlimit(resource, &rlim));
10634 	if (!is_error(ret)) {
10635 	    struct target_rlimit *target_rlim;
10636             if (!lock_user_struct(VERIFY_WRITE, target_rlim, arg2, 0))
10637                 goto efault;
10638 	    target_rlim->rlim_cur = host_to_target_rlim(rlim.rlim_cur);
10639 	    target_rlim->rlim_max = host_to_target_rlim(rlim.rlim_max);
10640             unlock_user_struct(target_rlim, arg2, 1);
10641 	}
10642 	break;
10643     }
10644 #endif
10645 #ifdef TARGET_NR_truncate64
10646     case TARGET_NR_truncate64:
10647         if (!(p = lock_user_string(arg1)))
10648             goto efault;
10649 	ret = target_truncate64(cpu_env, p, arg2, arg3, arg4);
10650         unlock_user(p, arg1, 0);
10651 	break;
10652 #endif
10653 #ifdef TARGET_NR_ftruncate64
10654     case TARGET_NR_ftruncate64:
10655 	ret = target_ftruncate64(cpu_env, arg1, arg2, arg3, arg4);
10656 	break;
10657 #endif
10658 #ifdef TARGET_NR_stat64
10659     case TARGET_NR_stat64:
10660         if (!(p = lock_user_string(arg1)))
10661             goto efault;
10662         ret = get_errno(stat(path(p), &st));
10663         unlock_user(p, arg1, 0);
10664         if (!is_error(ret))
10665             ret = host_to_target_stat64(cpu_env, arg2, &st);
10666         break;
10667 #endif
10668 #ifdef TARGET_NR_lstat64
10669     case TARGET_NR_lstat64:
10670         if (!(p = lock_user_string(arg1)))
10671             goto efault;
10672         ret = get_errno(lstat(path(p), &st));
10673         unlock_user(p, arg1, 0);
10674         if (!is_error(ret))
10675             ret = host_to_target_stat64(cpu_env, arg2, &st);
10676         break;
10677 #endif
10678 #ifdef TARGET_NR_fstat64
10679     case TARGET_NR_fstat64:
10680         ret = get_errno(fstat(arg1, &st));
10681         if (!is_error(ret))
10682             ret = host_to_target_stat64(cpu_env, arg2, &st);
10683         break;
10684 #endif
10685 #if (defined(TARGET_NR_fstatat64) || defined(TARGET_NR_newfstatat))
10686 #ifdef TARGET_NR_fstatat64
10687     case TARGET_NR_fstatat64:
10688 #endif
10689 #ifdef TARGET_NR_newfstatat
10690     case TARGET_NR_newfstatat:
10691 #endif
10692         if (!(p = lock_user_string(arg2)))
10693             goto efault;
10694         ret = get_errno(fstatat(arg1, path(p), &st, arg4));
10695         if (!is_error(ret))
10696             ret = host_to_target_stat64(cpu_env, arg3, &st);
10697         break;
10698 #endif
10699 #ifdef TARGET_NR_lchown
10700     case TARGET_NR_lchown:
10701         if (!(p = lock_user_string(arg1)))
10702             goto efault;
10703         ret = get_errno(lchown(p, low2highuid(arg2), low2highgid(arg3)));
10704         unlock_user(p, arg1, 0);
10705         break;
10706 #endif
10707 #ifdef TARGET_NR_getuid
10708     case TARGET_NR_getuid:
10709         ret = get_errno(high2lowuid(getuid()));
10710         break;
10711 #endif
10712 #ifdef TARGET_NR_getgid
10713     case TARGET_NR_getgid:
10714         ret = get_errno(high2lowgid(getgid()));
10715         break;
10716 #endif
10717 #ifdef TARGET_NR_geteuid
10718     case TARGET_NR_geteuid:
10719         ret = get_errno(high2lowuid(geteuid()));
10720         break;
10721 #endif
10722 #ifdef TARGET_NR_getegid
10723     case TARGET_NR_getegid:
10724         ret = get_errno(high2lowgid(getegid()));
10725         break;
10726 #endif
10727     case TARGET_NR_setreuid:
10728         ret = get_errno(setreuid(low2highuid(arg1), low2highuid(arg2)));
10729         break;
10730     case TARGET_NR_setregid:
10731         ret = get_errno(setregid(low2highgid(arg1), low2highgid(arg2)));
10732         break;
10733     case TARGET_NR_getgroups:
10734         {
10735             int gidsetsize = arg1;
10736             target_id *target_grouplist;
10737             gid_t *grouplist;
10738             int i;
10739 
10740             grouplist = alloca(gidsetsize * sizeof(gid_t));
10741             ret = get_errno(getgroups(gidsetsize, grouplist));
10742             if (gidsetsize == 0)
10743                 break;
10744             if (!is_error(ret)) {
10745                 target_grouplist = lock_user(VERIFY_WRITE, arg2, gidsetsize * sizeof(target_id), 0);
10746                 if (!target_grouplist)
10747                     goto efault;
10748                 for(i = 0;i < ret; i++)
10749                     target_grouplist[i] = tswapid(high2lowgid(grouplist[i]));
10750                 unlock_user(target_grouplist, arg2, gidsetsize * sizeof(target_id));
10751             }
10752         }
10753         break;
10754     case TARGET_NR_setgroups:
10755         {
10756             int gidsetsize = arg1;
10757             target_id *target_grouplist;
10758             gid_t *grouplist = NULL;
10759             int i;
10760             if (gidsetsize) {
10761                 grouplist = alloca(gidsetsize * sizeof(gid_t));
10762                 target_grouplist = lock_user(VERIFY_READ, arg2, gidsetsize * sizeof(target_id), 1);
10763                 if (!target_grouplist) {
10764                     ret = -TARGET_EFAULT;
10765                     goto fail;
10766                 }
10767                 for (i = 0; i < gidsetsize; i++) {
10768                     grouplist[i] = low2highgid(tswapid(target_grouplist[i]));
10769                 }
10770                 unlock_user(target_grouplist, arg2, 0);
10771             }
10772             ret = get_errno(setgroups(gidsetsize, grouplist));
10773         }
10774         break;
10775     case TARGET_NR_fchown:
10776         ret = get_errno(fchown(arg1, low2highuid(arg2), low2highgid(arg3)));
10777         break;
10778 #if defined(TARGET_NR_fchownat)
10779     case TARGET_NR_fchownat:
10780         if (!(p = lock_user_string(arg2)))
10781             goto efault;
10782         ret = get_errno(fchownat(arg1, p, low2highuid(arg3),
10783                                  low2highgid(arg4), arg5));
10784         unlock_user(p, arg2, 0);
10785         break;
10786 #endif
10787 #ifdef TARGET_NR_setresuid
10788     case TARGET_NR_setresuid:
10789         ret = get_errno(sys_setresuid(low2highuid(arg1),
10790                                       low2highuid(arg2),
10791                                       low2highuid(arg3)));
10792         break;
10793 #endif
10794 #ifdef TARGET_NR_getresuid
10795     case TARGET_NR_getresuid:
10796         {
10797             uid_t ruid, euid, suid;
10798             ret = get_errno(getresuid(&ruid, &euid, &suid));
10799             if (!is_error(ret)) {
10800                 if (put_user_id(high2lowuid(ruid), arg1)
10801                     || put_user_id(high2lowuid(euid), arg2)
10802                     || put_user_id(high2lowuid(suid), arg3))
10803                     goto efault;
10804             }
10805         }
10806         break;
10807 #endif
10808 #ifdef TARGET_NR_getresgid
10809     case TARGET_NR_setresgid:
10810         ret = get_errno(sys_setresgid(low2highgid(arg1),
10811                                       low2highgid(arg2),
10812                                       low2highgid(arg3)));
10813         break;
10814 #endif
10815 #ifdef TARGET_NR_getresgid
10816     case TARGET_NR_getresgid:
10817         {
10818             gid_t rgid, egid, sgid;
10819             ret = get_errno(getresgid(&rgid, &egid, &sgid));
10820             if (!is_error(ret)) {
10821                 if (put_user_id(high2lowgid(rgid), arg1)
10822                     || put_user_id(high2lowgid(egid), arg2)
10823                     || put_user_id(high2lowgid(sgid), arg3))
10824                     goto efault;
10825             }
10826         }
10827         break;
10828 #endif
10829 #ifdef TARGET_NR_chown
10830     case TARGET_NR_chown:
10831         if (!(p = lock_user_string(arg1)))
10832             goto efault;
10833         ret = get_errno(chown(p, low2highuid(arg2), low2highgid(arg3)));
10834         unlock_user(p, arg1, 0);
10835         break;
10836 #endif
10837     case TARGET_NR_setuid:
10838         ret = get_errno(sys_setuid(low2highuid(arg1)));
10839         break;
10840     case TARGET_NR_setgid:
10841         ret = get_errno(sys_setgid(low2highgid(arg1)));
10842         break;
10843     case TARGET_NR_setfsuid:
10844         ret = get_errno(setfsuid(arg1));
10845         break;
10846     case TARGET_NR_setfsgid:
10847         ret = get_errno(setfsgid(arg1));
10848         break;
10849 
10850 #ifdef TARGET_NR_lchown32
10851     case TARGET_NR_lchown32:
10852         if (!(p = lock_user_string(arg1)))
10853             goto efault;
10854         ret = get_errno(lchown(p, arg2, arg3));
10855         unlock_user(p, arg1, 0);
10856         break;
10857 #endif
10858 #ifdef TARGET_NR_getuid32
10859     case TARGET_NR_getuid32:
10860         ret = get_errno(getuid());
10861         break;
10862 #endif
10863 
10864 #if defined(TARGET_NR_getxuid) && defined(TARGET_ALPHA)
10865    /* Alpha specific */
10866     case TARGET_NR_getxuid:
10867          {
10868             uid_t euid;
10869             euid=geteuid();
10870             ((CPUAlphaState *)cpu_env)->ir[IR_A4]=euid;
10871          }
10872         ret = get_errno(getuid());
10873         break;
10874 #endif
10875 #if defined(TARGET_NR_getxgid) && defined(TARGET_ALPHA)
10876    /* Alpha specific */
10877     case TARGET_NR_getxgid:
10878          {
10879             uid_t egid;
10880             egid=getegid();
10881             ((CPUAlphaState *)cpu_env)->ir[IR_A4]=egid;
10882          }
10883         ret = get_errno(getgid());
10884         break;
10885 #endif
10886 #if defined(TARGET_NR_osf_getsysinfo) && defined(TARGET_ALPHA)
10887     /* Alpha specific */
10888     case TARGET_NR_osf_getsysinfo:
10889         ret = -TARGET_EOPNOTSUPP;
10890         switch (arg1) {
10891           case TARGET_GSI_IEEE_FP_CONTROL:
10892             {
10893                 uint64_t swcr, fpcr = cpu_alpha_load_fpcr (cpu_env);
10894 
10895                 /* Copied from linux ieee_fpcr_to_swcr.  */
10896                 swcr = (fpcr >> 35) & SWCR_STATUS_MASK;
10897                 swcr |= (fpcr >> 36) & SWCR_MAP_DMZ;
10898                 swcr |= (~fpcr >> 48) & (SWCR_TRAP_ENABLE_INV
10899                                         | SWCR_TRAP_ENABLE_DZE
10900                                         | SWCR_TRAP_ENABLE_OVF);
10901                 swcr |= (~fpcr >> 57) & (SWCR_TRAP_ENABLE_UNF
10902                                         | SWCR_TRAP_ENABLE_INE);
10903                 swcr |= (fpcr >> 47) & SWCR_MAP_UMZ;
10904                 swcr |= (~fpcr >> 41) & SWCR_TRAP_ENABLE_DNO;
10905 
10906                 if (put_user_u64 (swcr, arg2))
10907                         goto efault;
10908                 ret = 0;
10909             }
10910             break;
10911 
10912           /* case GSI_IEEE_STATE_AT_SIGNAL:
10913              -- Not implemented in linux kernel.
10914              case GSI_UACPROC:
10915              -- Retrieves current unaligned access state; not much used.
10916              case GSI_PROC_TYPE:
10917              -- Retrieves implver information; surely not used.
10918              case GSI_GET_HWRPB:
10919              -- Grabs a copy of the HWRPB; surely not used.
10920           */
10921         }
10922         break;
10923 #endif
10924 #if defined(TARGET_NR_osf_setsysinfo) && defined(TARGET_ALPHA)
10925     /* Alpha specific */
10926     case TARGET_NR_osf_setsysinfo:
10927         ret = -TARGET_EOPNOTSUPP;
10928         switch (arg1) {
10929           case TARGET_SSI_IEEE_FP_CONTROL:
10930             {
10931                 uint64_t swcr, fpcr, orig_fpcr;
10932 
10933                 if (get_user_u64 (swcr, arg2)) {
10934                     goto efault;
10935                 }
10936                 orig_fpcr = cpu_alpha_load_fpcr(cpu_env);
10937                 fpcr = orig_fpcr & FPCR_DYN_MASK;
10938 
10939                 /* Copied from linux ieee_swcr_to_fpcr.  */
10940                 fpcr |= (swcr & SWCR_STATUS_MASK) << 35;
10941                 fpcr |= (swcr & SWCR_MAP_DMZ) << 36;
10942                 fpcr |= (~swcr & (SWCR_TRAP_ENABLE_INV
10943                                   | SWCR_TRAP_ENABLE_DZE
10944                                   | SWCR_TRAP_ENABLE_OVF)) << 48;
10945                 fpcr |= (~swcr & (SWCR_TRAP_ENABLE_UNF
10946                                   | SWCR_TRAP_ENABLE_INE)) << 57;
10947                 fpcr |= (swcr & SWCR_MAP_UMZ ? FPCR_UNDZ | FPCR_UNFD : 0);
10948                 fpcr |= (~swcr & SWCR_TRAP_ENABLE_DNO) << 41;
10949 
10950                 cpu_alpha_store_fpcr(cpu_env, fpcr);
10951                 ret = 0;
10952             }
10953             break;
10954 
10955           case TARGET_SSI_IEEE_RAISE_EXCEPTION:
10956             {
10957                 uint64_t exc, fpcr, orig_fpcr;
10958                 int si_code;
10959 
10960                 if (get_user_u64(exc, arg2)) {
10961                     goto efault;
10962                 }
10963 
10964                 orig_fpcr = cpu_alpha_load_fpcr(cpu_env);
10965 
10966                 /* We only add to the exception status here.  */
10967                 fpcr = orig_fpcr | ((exc & SWCR_STATUS_MASK) << 35);
10968 
10969                 cpu_alpha_store_fpcr(cpu_env, fpcr);
10970                 ret = 0;
10971 
10972                 /* Old exceptions are not signaled.  */
10973                 fpcr &= ~(orig_fpcr & FPCR_STATUS_MASK);
10974 
10975                 /* If any exceptions set by this call,
10976                    and are unmasked, send a signal.  */
10977                 si_code = 0;
10978                 if ((fpcr & (FPCR_INE | FPCR_INED)) == FPCR_INE) {
10979                     si_code = TARGET_FPE_FLTRES;
10980                 }
10981                 if ((fpcr & (FPCR_UNF | FPCR_UNFD)) == FPCR_UNF) {
10982                     si_code = TARGET_FPE_FLTUND;
10983                 }
10984                 if ((fpcr & (FPCR_OVF | FPCR_OVFD)) == FPCR_OVF) {
10985                     si_code = TARGET_FPE_FLTOVF;
10986                 }
10987                 if ((fpcr & (FPCR_DZE | FPCR_DZED)) == FPCR_DZE) {
10988                     si_code = TARGET_FPE_FLTDIV;
10989                 }
10990                 if ((fpcr & (FPCR_INV | FPCR_INVD)) == FPCR_INV) {
10991                     si_code = TARGET_FPE_FLTINV;
10992                 }
10993                 if (si_code != 0) {
10994                     target_siginfo_t info;
10995                     info.si_signo = SIGFPE;
10996                     info.si_errno = 0;
10997                     info.si_code = si_code;
10998                     info._sifields._sigfault._addr
10999                         = ((CPUArchState *)cpu_env)->pc;
11000                     queue_signal((CPUArchState *)cpu_env, info.si_signo,
11001                                  QEMU_SI_FAULT, &info);
11002                 }
11003             }
11004             break;
11005 
11006           /* case SSI_NVPAIRS:
11007              -- Used with SSIN_UACPROC to enable unaligned accesses.
11008              case SSI_IEEE_STATE_AT_SIGNAL:
11009              case SSI_IEEE_IGNORE_STATE_AT_SIGNAL:
11010              -- Not implemented in linux kernel
11011           */
11012         }
11013         break;
11014 #endif
11015 #ifdef TARGET_NR_osf_sigprocmask
11016     /* Alpha specific.  */
11017     case TARGET_NR_osf_sigprocmask:
11018         {
11019             abi_ulong mask;
11020             int how;
11021             sigset_t set, oldset;
11022 
11023             switch(arg1) {
11024             case TARGET_SIG_BLOCK:
11025                 how = SIG_BLOCK;
11026                 break;
11027             case TARGET_SIG_UNBLOCK:
11028                 how = SIG_UNBLOCK;
11029                 break;
11030             case TARGET_SIG_SETMASK:
11031                 how = SIG_SETMASK;
11032                 break;
11033             default:
11034                 ret = -TARGET_EINVAL;
11035                 goto fail;
11036             }
11037             mask = arg2;
11038             target_to_host_old_sigset(&set, &mask);
11039             ret = do_sigprocmask(how, &set, &oldset);
11040             if (!ret) {
11041                 host_to_target_old_sigset(&mask, &oldset);
11042                 ret = mask;
11043             }
11044         }
11045         break;
11046 #endif
11047 
11048 #ifdef TARGET_NR_getgid32
11049     case TARGET_NR_getgid32:
11050         ret = get_errno(getgid());
11051         break;
11052 #endif
11053 #ifdef TARGET_NR_geteuid32
11054     case TARGET_NR_geteuid32:
11055         ret = get_errno(geteuid());
11056         break;
11057 #endif
11058 #ifdef TARGET_NR_getegid32
11059     case TARGET_NR_getegid32:
11060         ret = get_errno(getegid());
11061         break;
11062 #endif
11063 #ifdef TARGET_NR_setreuid32
11064     case TARGET_NR_setreuid32:
11065         ret = get_errno(setreuid(arg1, arg2));
11066         break;
11067 #endif
11068 #ifdef TARGET_NR_setregid32
11069     case TARGET_NR_setregid32:
11070         ret = get_errno(setregid(arg1, arg2));
11071         break;
11072 #endif
11073 #ifdef TARGET_NR_getgroups32
11074     case TARGET_NR_getgroups32:
11075         {
11076             int gidsetsize = arg1;
11077             uint32_t *target_grouplist;
11078             gid_t *grouplist;
11079             int i;
11080 
11081             grouplist = alloca(gidsetsize * sizeof(gid_t));
11082             ret = get_errno(getgroups(gidsetsize, grouplist));
11083             if (gidsetsize == 0)
11084                 break;
11085             if (!is_error(ret)) {
11086                 target_grouplist = lock_user(VERIFY_WRITE, arg2, gidsetsize * 4, 0);
11087                 if (!target_grouplist) {
11088                     ret = -TARGET_EFAULT;
11089                     goto fail;
11090                 }
11091                 for(i = 0;i < ret; i++)
11092                     target_grouplist[i] = tswap32(grouplist[i]);
11093                 unlock_user(target_grouplist, arg2, gidsetsize * 4);
11094             }
11095         }
11096         break;
11097 #endif
11098 #ifdef TARGET_NR_setgroups32
11099     case TARGET_NR_setgroups32:
11100         {
11101             int gidsetsize = arg1;
11102             uint32_t *target_grouplist;
11103             gid_t *grouplist;
11104             int i;
11105 
11106             grouplist = alloca(gidsetsize * sizeof(gid_t));
11107             target_grouplist = lock_user(VERIFY_READ, arg2, gidsetsize * 4, 1);
11108             if (!target_grouplist) {
11109                 ret = -TARGET_EFAULT;
11110                 goto fail;
11111             }
11112             for(i = 0;i < gidsetsize; i++)
11113                 grouplist[i] = tswap32(target_grouplist[i]);
11114             unlock_user(target_grouplist, arg2, 0);
11115             ret = get_errno(setgroups(gidsetsize, grouplist));
11116         }
11117         break;
11118 #endif
11119 #ifdef TARGET_NR_fchown32
11120     case TARGET_NR_fchown32:
11121         ret = get_errno(fchown(arg1, arg2, arg3));
11122         break;
11123 #endif
11124 #ifdef TARGET_NR_setresuid32
11125     case TARGET_NR_setresuid32:
11126         ret = get_errno(sys_setresuid(arg1, arg2, arg3));
11127         break;
11128 #endif
11129 #ifdef TARGET_NR_getresuid32
11130     case TARGET_NR_getresuid32:
11131         {
11132             uid_t ruid, euid, suid;
11133             ret = get_errno(getresuid(&ruid, &euid, &suid));
11134             if (!is_error(ret)) {
11135                 if (put_user_u32(ruid, arg1)
11136                     || put_user_u32(euid, arg2)
11137                     || put_user_u32(suid, arg3))
11138                     goto efault;
11139             }
11140         }
11141         break;
11142 #endif
11143 #ifdef TARGET_NR_setresgid32
11144     case TARGET_NR_setresgid32:
11145         ret = get_errno(sys_setresgid(arg1, arg2, arg3));
11146         break;
11147 #endif
11148 #ifdef TARGET_NR_getresgid32
11149     case TARGET_NR_getresgid32:
11150         {
11151             gid_t rgid, egid, sgid;
11152             ret = get_errno(getresgid(&rgid, &egid, &sgid));
11153             if (!is_error(ret)) {
11154                 if (put_user_u32(rgid, arg1)
11155                     || put_user_u32(egid, arg2)
11156                     || put_user_u32(sgid, arg3))
11157                     goto efault;
11158             }
11159         }
11160         break;
11161 #endif
11162 #ifdef TARGET_NR_chown32
11163     case TARGET_NR_chown32:
11164         if (!(p = lock_user_string(arg1)))
11165             goto efault;
11166         ret = get_errno(chown(p, arg2, arg3));
11167         unlock_user(p, arg1, 0);
11168         break;
11169 #endif
11170 #ifdef TARGET_NR_setuid32
11171     case TARGET_NR_setuid32:
11172         ret = get_errno(sys_setuid(arg1));
11173         break;
11174 #endif
11175 #ifdef TARGET_NR_setgid32
11176     case TARGET_NR_setgid32:
11177         ret = get_errno(sys_setgid(arg1));
11178         break;
11179 #endif
11180 #ifdef TARGET_NR_setfsuid32
11181     case TARGET_NR_setfsuid32:
11182         ret = get_errno(setfsuid(arg1));
11183         break;
11184 #endif
11185 #ifdef TARGET_NR_setfsgid32
11186     case TARGET_NR_setfsgid32:
11187         ret = get_errno(setfsgid(arg1));
11188         break;
11189 #endif
11190 
11191     case TARGET_NR_pivot_root:
11192         goto unimplemented;
11193 #ifdef TARGET_NR_mincore
11194     case TARGET_NR_mincore:
11195         {
11196             void *a;
11197             ret = -TARGET_ENOMEM;
11198             a = lock_user(VERIFY_READ, arg1, arg2, 0);
11199             if (!a) {
11200                 goto fail;
11201             }
11202             ret = -TARGET_EFAULT;
11203             p = lock_user_string(arg3);
11204             if (!p) {
11205                 goto mincore_fail;
11206             }
11207             ret = get_errno(mincore(a, arg2, p));
11208             unlock_user(p, arg3, ret);
11209             mincore_fail:
11210             unlock_user(a, arg1, 0);
11211         }
11212         break;
11213 #endif
11214 #ifdef TARGET_NR_arm_fadvise64_64
11215     case TARGET_NR_arm_fadvise64_64:
11216         /* arm_fadvise64_64 looks like fadvise64_64 but
11217          * with different argument order: fd, advice, offset, len
11218          * rather than the usual fd, offset, len, advice.
11219          * Note that offset and len are both 64-bit so appear as
11220          * pairs of 32-bit registers.
11221          */
11222         ret = posix_fadvise(arg1, target_offset64(arg3, arg4),
11223                             target_offset64(arg5, arg6), arg2);
11224         ret = -host_to_target_errno(ret);
11225         break;
11226 #endif
11227 
11228 #if TARGET_ABI_BITS == 32
11229 
11230 #ifdef TARGET_NR_fadvise64_64
11231     case TARGET_NR_fadvise64_64:
11232         /* 6 args: fd, offset (high, low), len (high, low), advice */
11233         if (regpairs_aligned(cpu_env)) {
11234             /* offset is in (3,4), len in (5,6) and advice in 7 */
11235             arg2 = arg3;
11236             arg3 = arg4;
11237             arg4 = arg5;
11238             arg5 = arg6;
11239             arg6 = arg7;
11240         }
11241         ret = -host_to_target_errno(posix_fadvise(arg1,
11242                                                   target_offset64(arg2, arg3),
11243                                                   target_offset64(arg4, arg5),
11244                                                   arg6));
11245         break;
11246 #endif
11247 
11248 #ifdef TARGET_NR_fadvise64
11249     case TARGET_NR_fadvise64:
11250         /* 5 args: fd, offset (high, low), len, advice */
11251         if (regpairs_aligned(cpu_env)) {
11252             /* offset is in (3,4), len in 5 and advice in 6 */
11253             arg2 = arg3;
11254             arg3 = arg4;
11255             arg4 = arg5;
11256             arg5 = arg6;
11257         }
11258         ret = -host_to_target_errno(posix_fadvise(arg1,
11259                                                   target_offset64(arg2, arg3),
11260                                                   arg4, arg5));
11261         break;
11262 #endif
11263 
11264 #else /* not a 32-bit ABI */
11265 #if defined(TARGET_NR_fadvise64_64) || defined(TARGET_NR_fadvise64)
11266 #ifdef TARGET_NR_fadvise64_64
11267     case TARGET_NR_fadvise64_64:
11268 #endif
11269 #ifdef TARGET_NR_fadvise64
11270     case TARGET_NR_fadvise64:
11271 #endif
11272 #ifdef TARGET_S390X
11273         switch (arg4) {
11274         case 4: arg4 = POSIX_FADV_NOREUSE + 1; break; /* make sure it's an invalid value */
11275         case 5: arg4 = POSIX_FADV_NOREUSE + 2; break; /* ditto */
11276         case 6: arg4 = POSIX_FADV_DONTNEED; break;
11277         case 7: arg4 = POSIX_FADV_NOREUSE; break;
11278         default: break;
11279         }
11280 #endif
11281         ret = -host_to_target_errno(posix_fadvise(arg1, arg2, arg3, arg4));
11282         break;
11283 #endif
11284 #endif /* end of 64-bit ABI fadvise handling */
11285 
11286 #ifdef TARGET_NR_madvise
11287     case TARGET_NR_madvise:
11288         /* A straight passthrough may not be safe because qemu sometimes
11289            turns private file-backed mappings into anonymous mappings.
11290            This will break MADV_DONTNEED.
11291            This is a hint, so ignoring and returning success is ok.  */
11292         ret = get_errno(0);
11293         break;
11294 #endif
11295 #if TARGET_ABI_BITS == 32
11296     case TARGET_NR_fcntl64:
11297     {
11298 	int cmd;
11299 	struct flock64 fl;
11300         from_flock64_fn *copyfrom = copy_from_user_flock64;
11301         to_flock64_fn *copyto = copy_to_user_flock64;
11302 
11303 #ifdef TARGET_ARM
11304         if (((CPUARMState *)cpu_env)->eabi) {
11305             copyfrom = copy_from_user_eabi_flock64;
11306             copyto = copy_to_user_eabi_flock64;
11307         }
11308 #endif
11309 
11310 	cmd = target_to_host_fcntl_cmd(arg2);
11311         if (cmd == -TARGET_EINVAL) {
11312             ret = cmd;
11313             break;
11314         }
11315 
11316         switch(arg2) {
11317         case TARGET_F_GETLK64:
11318             ret = copyfrom(&fl, arg3);
11319             if (ret) {
11320                 break;
11321             }
11322             ret = get_errno(fcntl(arg1, cmd, &fl));
11323             if (ret == 0) {
11324                 ret = copyto(arg3, &fl);
11325             }
11326 	    break;
11327 
11328         case TARGET_F_SETLK64:
11329         case TARGET_F_SETLKW64:
11330             ret = copyfrom(&fl, arg3);
11331             if (ret) {
11332                 break;
11333             }
11334             ret = get_errno(safe_fcntl(arg1, cmd, &fl));
11335 	    break;
11336         default:
11337             ret = do_fcntl(arg1, arg2, arg3);
11338             break;
11339         }
11340 	break;
11341     }
11342 #endif
11343 #ifdef TARGET_NR_cacheflush
11344     case TARGET_NR_cacheflush:
11345         /* self-modifying code is handled automatically, so nothing needed */
11346         ret = 0;
11347         break;
11348 #endif
11349 #ifdef TARGET_NR_security
11350     case TARGET_NR_security:
11351         goto unimplemented;
11352 #endif
11353 #ifdef TARGET_NR_getpagesize
11354     case TARGET_NR_getpagesize:
11355         ret = TARGET_PAGE_SIZE;
11356         break;
11357 #endif
11358     case TARGET_NR_gettid:
11359         ret = get_errno(gettid());
11360         break;
11361 #ifdef TARGET_NR_readahead
11362     case TARGET_NR_readahead:
11363 #if TARGET_ABI_BITS == 32
11364         if (regpairs_aligned(cpu_env)) {
11365             arg2 = arg3;
11366             arg3 = arg4;
11367             arg4 = arg5;
11368         }
11369         ret = get_errno(readahead(arg1, target_offset64(arg2, arg3) , arg4));
11370 #else
11371         ret = get_errno(readahead(arg1, arg2, arg3));
11372 #endif
11373         break;
11374 #endif
11375 #ifdef CONFIG_ATTR
11376 #ifdef TARGET_NR_setxattr
11377     case TARGET_NR_listxattr:
11378     case TARGET_NR_llistxattr:
11379     {
11380         void *p, *b = 0;
11381         if (arg2) {
11382             b = lock_user(VERIFY_WRITE, arg2, arg3, 0);
11383             if (!b) {
11384                 ret = -TARGET_EFAULT;
11385                 break;
11386             }
11387         }
11388         p = lock_user_string(arg1);
11389         if (p) {
11390             if (num == TARGET_NR_listxattr) {
11391                 ret = get_errno(listxattr(p, b, arg3));
11392             } else {
11393                 ret = get_errno(llistxattr(p, b, arg3));
11394             }
11395         } else {
11396             ret = -TARGET_EFAULT;
11397         }
11398         unlock_user(p, arg1, 0);
11399         unlock_user(b, arg2, arg3);
11400         break;
11401     }
11402     case TARGET_NR_flistxattr:
11403     {
11404         void *b = 0;
11405         if (arg2) {
11406             b = lock_user(VERIFY_WRITE, arg2, arg3, 0);
11407             if (!b) {
11408                 ret = -TARGET_EFAULT;
11409                 break;
11410             }
11411         }
11412         ret = get_errno(flistxattr(arg1, b, arg3));
11413         unlock_user(b, arg2, arg3);
11414         break;
11415     }
11416     case TARGET_NR_setxattr:
11417     case TARGET_NR_lsetxattr:
11418         {
11419             void *p, *n, *v = 0;
11420             if (arg3) {
11421                 v = lock_user(VERIFY_READ, arg3, arg4, 1);
11422                 if (!v) {
11423                     ret = -TARGET_EFAULT;
11424                     break;
11425                 }
11426             }
11427             p = lock_user_string(arg1);
11428             n = lock_user_string(arg2);
11429             if (p && n) {
11430                 if (num == TARGET_NR_setxattr) {
11431                     ret = get_errno(setxattr(p, n, v, arg4, arg5));
11432                 } else {
11433                     ret = get_errno(lsetxattr(p, n, v, arg4, arg5));
11434                 }
11435             } else {
11436                 ret = -TARGET_EFAULT;
11437             }
11438             unlock_user(p, arg1, 0);
11439             unlock_user(n, arg2, 0);
11440             unlock_user(v, arg3, 0);
11441         }
11442         break;
11443     case TARGET_NR_fsetxattr:
11444         {
11445             void *n, *v = 0;
11446             if (arg3) {
11447                 v = lock_user(VERIFY_READ, arg3, arg4, 1);
11448                 if (!v) {
11449                     ret = -TARGET_EFAULT;
11450                     break;
11451                 }
11452             }
11453             n = lock_user_string(arg2);
11454             if (n) {
11455                 ret = get_errno(fsetxattr(arg1, n, v, arg4, arg5));
11456             } else {
11457                 ret = -TARGET_EFAULT;
11458             }
11459             unlock_user(n, arg2, 0);
11460             unlock_user(v, arg3, 0);
11461         }
11462         break;
11463     case TARGET_NR_getxattr:
11464     case TARGET_NR_lgetxattr:
11465         {
11466             void *p, *n, *v = 0;
11467             if (arg3) {
11468                 v = lock_user(VERIFY_WRITE, arg3, arg4, 0);
11469                 if (!v) {
11470                     ret = -TARGET_EFAULT;
11471                     break;
11472                 }
11473             }
11474             p = lock_user_string(arg1);
11475             n = lock_user_string(arg2);
11476             if (p && n) {
11477                 if (num == TARGET_NR_getxattr) {
11478                     ret = get_errno(getxattr(p, n, v, arg4));
11479                 } else {
11480                     ret = get_errno(lgetxattr(p, n, v, arg4));
11481                 }
11482             } else {
11483                 ret = -TARGET_EFAULT;
11484             }
11485             unlock_user(p, arg1, 0);
11486             unlock_user(n, arg2, 0);
11487             unlock_user(v, arg3, arg4);
11488         }
11489         break;
11490     case TARGET_NR_fgetxattr:
11491         {
11492             void *n, *v = 0;
11493             if (arg3) {
11494                 v = lock_user(VERIFY_WRITE, arg3, arg4, 0);
11495                 if (!v) {
11496                     ret = -TARGET_EFAULT;
11497                     break;
11498                 }
11499             }
11500             n = lock_user_string(arg2);
11501             if (n) {
11502                 ret = get_errno(fgetxattr(arg1, n, v, arg4));
11503             } else {
11504                 ret = -TARGET_EFAULT;
11505             }
11506             unlock_user(n, arg2, 0);
11507             unlock_user(v, arg3, arg4);
11508         }
11509         break;
11510     case TARGET_NR_removexattr:
11511     case TARGET_NR_lremovexattr:
11512         {
11513             void *p, *n;
11514             p = lock_user_string(arg1);
11515             n = lock_user_string(arg2);
11516             if (p && n) {
11517                 if (num == TARGET_NR_removexattr) {
11518                     ret = get_errno(removexattr(p, n));
11519                 } else {
11520                     ret = get_errno(lremovexattr(p, n));
11521                 }
11522             } else {
11523                 ret = -TARGET_EFAULT;
11524             }
11525             unlock_user(p, arg1, 0);
11526             unlock_user(n, arg2, 0);
11527         }
11528         break;
11529     case TARGET_NR_fremovexattr:
11530         {
11531             void *n;
11532             n = lock_user_string(arg2);
11533             if (n) {
11534                 ret = get_errno(fremovexattr(arg1, n));
11535             } else {
11536                 ret = -TARGET_EFAULT;
11537             }
11538             unlock_user(n, arg2, 0);
11539         }
11540         break;
11541 #endif
11542 #endif /* CONFIG_ATTR */
11543 #ifdef TARGET_NR_set_thread_area
11544     case TARGET_NR_set_thread_area:
11545 #if defined(TARGET_MIPS)
11546       ((CPUMIPSState *) cpu_env)->active_tc.CP0_UserLocal = arg1;
11547       ret = 0;
11548       break;
11549 #elif defined(TARGET_CRIS)
11550       if (arg1 & 0xff)
11551           ret = -TARGET_EINVAL;
11552       else {
11553           ((CPUCRISState *) cpu_env)->pregs[PR_PID] = arg1;
11554           ret = 0;
11555       }
11556       break;
11557 #elif defined(TARGET_I386) && defined(TARGET_ABI32)
11558       ret = do_set_thread_area(cpu_env, arg1);
11559       break;
11560 #elif defined(TARGET_M68K)
11561       {
11562           TaskState *ts = cpu->opaque;
11563           ts->tp_value = arg1;
11564           ret = 0;
11565           break;
11566       }
11567 #else
11568       goto unimplemented_nowarn;
11569 #endif
11570 #endif
11571 #ifdef TARGET_NR_get_thread_area
11572     case TARGET_NR_get_thread_area:
11573 #if defined(TARGET_I386) && defined(TARGET_ABI32)
11574         ret = do_get_thread_area(cpu_env, arg1);
11575         break;
11576 #elif defined(TARGET_M68K)
11577         {
11578             TaskState *ts = cpu->opaque;
11579             ret = ts->tp_value;
11580             break;
11581         }
11582 #else
11583         goto unimplemented_nowarn;
11584 #endif
11585 #endif
11586 #ifdef TARGET_NR_getdomainname
11587     case TARGET_NR_getdomainname:
11588         goto unimplemented_nowarn;
11589 #endif
11590 
11591 #ifdef TARGET_NR_clock_gettime
11592     case TARGET_NR_clock_gettime:
11593     {
11594         struct timespec ts;
11595         ret = get_errno(clock_gettime(arg1, &ts));
11596         if (!is_error(ret)) {
11597             host_to_target_timespec(arg2, &ts);
11598         }
11599         break;
11600     }
11601 #endif
11602 #ifdef TARGET_NR_clock_getres
11603     case TARGET_NR_clock_getres:
11604     {
11605         struct timespec ts;
11606         ret = get_errno(clock_getres(arg1, &ts));
11607         if (!is_error(ret)) {
11608             host_to_target_timespec(arg2, &ts);
11609         }
11610         break;
11611     }
11612 #endif
11613 #ifdef TARGET_NR_clock_nanosleep
11614     case TARGET_NR_clock_nanosleep:
11615     {
11616         struct timespec ts;
11617         target_to_host_timespec(&ts, arg3);
11618         ret = get_errno(safe_clock_nanosleep(arg1, arg2,
11619                                              &ts, arg4 ? &ts : NULL));
11620         if (arg4)
11621             host_to_target_timespec(arg4, &ts);
11622 
11623 #if defined(TARGET_PPC)
11624         /* clock_nanosleep is odd in that it returns positive errno values.
11625          * On PPC, CR0 bit 3 should be set in such a situation. */
11626         if (ret && ret != -TARGET_ERESTARTSYS) {
11627             ((CPUPPCState *)cpu_env)->crf[0] |= 1;
11628         }
11629 #endif
11630         break;
11631     }
11632 #endif
11633 
11634 #if defined(TARGET_NR_set_tid_address) && defined(__NR_set_tid_address)
11635     case TARGET_NR_set_tid_address:
11636         ret = get_errno(set_tid_address((int *)g2h(arg1)));
11637         break;
11638 #endif
11639 
11640     case TARGET_NR_tkill:
11641         ret = get_errno(safe_tkill((int)arg1, target_to_host_signal(arg2)));
11642         break;
11643 
11644     case TARGET_NR_tgkill:
11645         ret = get_errno(safe_tgkill((int)arg1, (int)arg2,
11646                         target_to_host_signal(arg3)));
11647         break;
11648 
11649 #ifdef TARGET_NR_set_robust_list
11650     case TARGET_NR_set_robust_list:
11651     case TARGET_NR_get_robust_list:
11652         /* The ABI for supporting robust futexes has userspace pass
11653          * the kernel a pointer to a linked list which is updated by
11654          * userspace after the syscall; the list is walked by the kernel
11655          * when the thread exits. Since the linked list in QEMU guest
11656          * memory isn't a valid linked list for the host and we have
11657          * no way to reliably intercept the thread-death event, we can't
11658          * support these. Silently return ENOSYS so that guest userspace
11659          * falls back to a non-robust futex implementation (which should
11660          * be OK except in the corner case of the guest crashing while
11661          * holding a mutex that is shared with another process via
11662          * shared memory).
11663          */
11664         goto unimplemented_nowarn;
11665 #endif
11666 
11667 #if defined(TARGET_NR_utimensat)
11668     case TARGET_NR_utimensat:
11669         {
11670             struct timespec *tsp, ts[2];
11671             if (!arg3) {
11672                 tsp = NULL;
11673             } else {
11674                 target_to_host_timespec(ts, arg3);
11675                 target_to_host_timespec(ts+1, arg3+sizeof(struct target_timespec));
11676                 tsp = ts;
11677             }
11678             if (!arg2)
11679                 ret = get_errno(sys_utimensat(arg1, NULL, tsp, arg4));
11680             else {
11681                 if (!(p = lock_user_string(arg2))) {
11682                     ret = -TARGET_EFAULT;
11683                     goto fail;
11684                 }
11685                 ret = get_errno(sys_utimensat(arg1, path(p), tsp, arg4));
11686                 unlock_user(p, arg2, 0);
11687             }
11688         }
11689 	break;
11690 #endif
11691     case TARGET_NR_futex:
11692         ret = do_futex(arg1, arg2, arg3, arg4, arg5, arg6);
11693         break;
11694 #if defined(TARGET_NR_inotify_init) && defined(__NR_inotify_init)
11695     case TARGET_NR_inotify_init:
11696         ret = get_errno(sys_inotify_init());
11697         break;
11698 #endif
11699 #ifdef CONFIG_INOTIFY1
11700 #if defined(TARGET_NR_inotify_init1) && defined(__NR_inotify_init1)
11701     case TARGET_NR_inotify_init1:
11702         ret = get_errno(sys_inotify_init1(target_to_host_bitmask(arg1,
11703                                           fcntl_flags_tbl)));
11704         break;
11705 #endif
11706 #endif
11707 #if defined(TARGET_NR_inotify_add_watch) && defined(__NR_inotify_add_watch)
11708     case TARGET_NR_inotify_add_watch:
11709         p = lock_user_string(arg2);
11710         ret = get_errno(sys_inotify_add_watch(arg1, path(p), arg3));
11711         unlock_user(p, arg2, 0);
11712         break;
11713 #endif
11714 #if defined(TARGET_NR_inotify_rm_watch) && defined(__NR_inotify_rm_watch)
11715     case TARGET_NR_inotify_rm_watch:
11716         ret = get_errno(sys_inotify_rm_watch(arg1, arg2));
11717         break;
11718 #endif
11719 
11720 #if defined(TARGET_NR_mq_open) && defined(__NR_mq_open)
11721     case TARGET_NR_mq_open:
11722         {
11723             struct mq_attr posix_mq_attr;
11724             struct mq_attr *pposix_mq_attr;
11725             int host_flags;
11726 
11727             host_flags = target_to_host_bitmask(arg2, fcntl_flags_tbl);
11728             pposix_mq_attr = NULL;
11729             if (arg4) {
11730                 if (copy_from_user_mq_attr(&posix_mq_attr, arg4) != 0) {
11731                     goto efault;
11732                 }
11733                 pposix_mq_attr = &posix_mq_attr;
11734             }
11735             p = lock_user_string(arg1 - 1);
11736             if (!p) {
11737                 goto efault;
11738             }
11739             ret = get_errno(mq_open(p, host_flags, arg3, pposix_mq_attr));
11740             unlock_user (p, arg1, 0);
11741         }
11742         break;
11743 
11744     case TARGET_NR_mq_unlink:
11745         p = lock_user_string(arg1 - 1);
11746         if (!p) {
11747             ret = -TARGET_EFAULT;
11748             break;
11749         }
11750         ret = get_errno(mq_unlink(p));
11751         unlock_user (p, arg1, 0);
11752         break;
11753 
11754     case TARGET_NR_mq_timedsend:
11755         {
11756             struct timespec ts;
11757 
11758             p = lock_user (VERIFY_READ, arg2, arg3, 1);
11759             if (arg5 != 0) {
11760                 target_to_host_timespec(&ts, arg5);
11761                 ret = get_errno(safe_mq_timedsend(arg1, p, arg3, arg4, &ts));
11762                 host_to_target_timespec(arg5, &ts);
11763             } else {
11764                 ret = get_errno(safe_mq_timedsend(arg1, p, arg3, arg4, NULL));
11765             }
11766             unlock_user (p, arg2, arg3);
11767         }
11768         break;
11769 
11770     case TARGET_NR_mq_timedreceive:
11771         {
11772             struct timespec ts;
11773             unsigned int prio;
11774 
11775             p = lock_user (VERIFY_READ, arg2, arg3, 1);
11776             if (arg5 != 0) {
11777                 target_to_host_timespec(&ts, arg5);
11778                 ret = get_errno(safe_mq_timedreceive(arg1, p, arg3,
11779                                                      &prio, &ts));
11780                 host_to_target_timespec(arg5, &ts);
11781             } else {
11782                 ret = get_errno(safe_mq_timedreceive(arg1, p, arg3,
11783                                                      &prio, NULL));
11784             }
11785             unlock_user (p, arg2, arg3);
11786             if (arg4 != 0)
11787                 put_user_u32(prio, arg4);
11788         }
11789         break;
11790 
11791     /* Not implemented for now... */
11792 /*     case TARGET_NR_mq_notify: */
11793 /*         break; */
11794 
11795     case TARGET_NR_mq_getsetattr:
11796         {
11797             struct mq_attr posix_mq_attr_in, posix_mq_attr_out;
11798             ret = 0;
11799             if (arg3 != 0) {
11800                 ret = mq_getattr(arg1, &posix_mq_attr_out);
11801                 copy_to_user_mq_attr(arg3, &posix_mq_attr_out);
11802             }
11803             if (arg2 != 0) {
11804                 copy_from_user_mq_attr(&posix_mq_attr_in, arg2);
11805                 ret |= mq_setattr(arg1, &posix_mq_attr_in, &posix_mq_attr_out);
11806             }
11807 
11808         }
11809         break;
11810 #endif
11811 
11812 #ifdef CONFIG_SPLICE
11813 #ifdef TARGET_NR_tee
11814     case TARGET_NR_tee:
11815         {
11816             ret = get_errno(tee(arg1,arg2,arg3,arg4));
11817         }
11818         break;
11819 #endif
11820 #ifdef TARGET_NR_splice
11821     case TARGET_NR_splice:
11822         {
11823             loff_t loff_in, loff_out;
11824             loff_t *ploff_in = NULL, *ploff_out = NULL;
11825             if (arg2) {
11826                 if (get_user_u64(loff_in, arg2)) {
11827                     goto efault;
11828                 }
11829                 ploff_in = &loff_in;
11830             }
11831             if (arg4) {
11832                 if (get_user_u64(loff_out, arg4)) {
11833                     goto efault;
11834                 }
11835                 ploff_out = &loff_out;
11836             }
11837             ret = get_errno(splice(arg1, ploff_in, arg3, ploff_out, arg5, arg6));
11838             if (arg2) {
11839                 if (put_user_u64(loff_in, arg2)) {
11840                     goto efault;
11841                 }
11842             }
11843             if (arg4) {
11844                 if (put_user_u64(loff_out, arg4)) {
11845                     goto efault;
11846                 }
11847             }
11848         }
11849         break;
11850 #endif
11851 #ifdef TARGET_NR_vmsplice
11852 	case TARGET_NR_vmsplice:
11853         {
11854             struct iovec *vec = lock_iovec(VERIFY_READ, arg2, arg3, 1);
11855             if (vec != NULL) {
11856                 ret = get_errno(vmsplice(arg1, vec, arg3, arg4));
11857                 unlock_iovec(vec, arg2, arg3, 0);
11858             } else {
11859                 ret = -host_to_target_errno(errno);
11860             }
11861         }
11862         break;
11863 #endif
11864 #endif /* CONFIG_SPLICE */
11865 #ifdef CONFIG_EVENTFD
11866 #if defined(TARGET_NR_eventfd)
11867     case TARGET_NR_eventfd:
11868         ret = get_errno(eventfd(arg1, 0));
11869         fd_trans_unregister(ret);
11870         break;
11871 #endif
11872 #if defined(TARGET_NR_eventfd2)
11873     case TARGET_NR_eventfd2:
11874     {
11875         int host_flags = arg2 & (~(TARGET_O_NONBLOCK | TARGET_O_CLOEXEC));
11876         if (arg2 & TARGET_O_NONBLOCK) {
11877             host_flags |= O_NONBLOCK;
11878         }
11879         if (arg2 & TARGET_O_CLOEXEC) {
11880             host_flags |= O_CLOEXEC;
11881         }
11882         ret = get_errno(eventfd(arg1, host_flags));
11883         fd_trans_unregister(ret);
11884         break;
11885     }
11886 #endif
11887 #endif /* CONFIG_EVENTFD  */
11888 #if defined(CONFIG_FALLOCATE) && defined(TARGET_NR_fallocate)
11889     case TARGET_NR_fallocate:
11890 #if TARGET_ABI_BITS == 32
11891         ret = get_errno(fallocate(arg1, arg2, target_offset64(arg3, arg4),
11892                                   target_offset64(arg5, arg6)));
11893 #else
11894         ret = get_errno(fallocate(arg1, arg2, arg3, arg4));
11895 #endif
11896         break;
11897 #endif
11898 #if defined(CONFIG_SYNC_FILE_RANGE)
11899 #if defined(TARGET_NR_sync_file_range)
11900     case TARGET_NR_sync_file_range:
11901 #if TARGET_ABI_BITS == 32
11902 #if defined(TARGET_MIPS)
11903         ret = get_errno(sync_file_range(arg1, target_offset64(arg3, arg4),
11904                                         target_offset64(arg5, arg6), arg7));
11905 #else
11906         ret = get_errno(sync_file_range(arg1, target_offset64(arg2, arg3),
11907                                         target_offset64(arg4, arg5), arg6));
11908 #endif /* !TARGET_MIPS */
11909 #else
11910         ret = get_errno(sync_file_range(arg1, arg2, arg3, arg4));
11911 #endif
11912         break;
11913 #endif
11914 #if defined(TARGET_NR_sync_file_range2)
11915     case TARGET_NR_sync_file_range2:
11916         /* This is like sync_file_range but the arguments are reordered */
11917 #if TARGET_ABI_BITS == 32
11918         ret = get_errno(sync_file_range(arg1, target_offset64(arg3, arg4),
11919                                         target_offset64(arg5, arg6), arg2));
11920 #else
11921         ret = get_errno(sync_file_range(arg1, arg3, arg4, arg2));
11922 #endif
11923         break;
11924 #endif
11925 #endif
11926 #if defined(TARGET_NR_signalfd4)
11927     case TARGET_NR_signalfd4:
11928         ret = do_signalfd4(arg1, arg2, arg4);
11929         break;
11930 #endif
11931 #if defined(TARGET_NR_signalfd)
11932     case TARGET_NR_signalfd:
11933         ret = do_signalfd4(arg1, arg2, 0);
11934         break;
11935 #endif
11936 #if defined(CONFIG_EPOLL)
11937 #if defined(TARGET_NR_epoll_create)
11938     case TARGET_NR_epoll_create:
11939         ret = get_errno(epoll_create(arg1));
11940         break;
11941 #endif
11942 #if defined(TARGET_NR_epoll_create1) && defined(CONFIG_EPOLL_CREATE1)
11943     case TARGET_NR_epoll_create1:
11944         ret = get_errno(epoll_create1(arg1));
11945         break;
11946 #endif
11947 #if defined(TARGET_NR_epoll_ctl)
11948     case TARGET_NR_epoll_ctl:
11949     {
11950         struct epoll_event ep;
11951         struct epoll_event *epp = 0;
11952         if (arg4) {
11953             struct target_epoll_event *target_ep;
11954             if (!lock_user_struct(VERIFY_READ, target_ep, arg4, 1)) {
11955                 goto efault;
11956             }
11957             ep.events = tswap32(target_ep->events);
11958             /* The epoll_data_t union is just opaque data to the kernel,
11959              * so we transfer all 64 bits across and need not worry what
11960              * actual data type it is.
11961              */
11962             ep.data.u64 = tswap64(target_ep->data.u64);
11963             unlock_user_struct(target_ep, arg4, 0);
11964             epp = &ep;
11965         }
11966         ret = get_errno(epoll_ctl(arg1, arg2, arg3, epp));
11967         break;
11968     }
11969 #endif
11970 
11971 #if defined(TARGET_NR_epoll_wait) || defined(TARGET_NR_epoll_pwait)
11972 #if defined(TARGET_NR_epoll_wait)
11973     case TARGET_NR_epoll_wait:
11974 #endif
11975 #if defined(TARGET_NR_epoll_pwait)
11976     case TARGET_NR_epoll_pwait:
11977 #endif
11978     {
11979         struct target_epoll_event *target_ep;
11980         struct epoll_event *ep;
11981         int epfd = arg1;
11982         int maxevents = arg3;
11983         int timeout = arg4;
11984 
11985         if (maxevents <= 0 || maxevents > TARGET_EP_MAX_EVENTS) {
11986             ret = -TARGET_EINVAL;
11987             break;
11988         }
11989 
11990         target_ep = lock_user(VERIFY_WRITE, arg2,
11991                               maxevents * sizeof(struct target_epoll_event), 1);
11992         if (!target_ep) {
11993             goto efault;
11994         }
11995 
11996         ep = g_try_new(struct epoll_event, maxevents);
11997         if (!ep) {
11998             unlock_user(target_ep, arg2, 0);
11999             ret = -TARGET_ENOMEM;
12000             break;
12001         }
12002 
12003         switch (num) {
12004 #if defined(TARGET_NR_epoll_pwait)
12005         case TARGET_NR_epoll_pwait:
12006         {
12007             target_sigset_t *target_set;
12008             sigset_t _set, *set = &_set;
12009 
12010             if (arg5) {
12011                 if (arg6 != sizeof(target_sigset_t)) {
12012                     ret = -TARGET_EINVAL;
12013                     break;
12014                 }
12015 
12016                 target_set = lock_user(VERIFY_READ, arg5,
12017                                        sizeof(target_sigset_t), 1);
12018                 if (!target_set) {
12019                     ret = -TARGET_EFAULT;
12020                     break;
12021                 }
12022                 target_to_host_sigset(set, target_set);
12023                 unlock_user(target_set, arg5, 0);
12024             } else {
12025                 set = NULL;
12026             }
12027 
12028             ret = get_errno(safe_epoll_pwait(epfd, ep, maxevents, timeout,
12029                                              set, SIGSET_T_SIZE));
12030             break;
12031         }
12032 #endif
12033 #if defined(TARGET_NR_epoll_wait)
12034         case TARGET_NR_epoll_wait:
12035             ret = get_errno(safe_epoll_pwait(epfd, ep, maxevents, timeout,
12036                                              NULL, 0));
12037             break;
12038 #endif
12039         default:
12040             ret = -TARGET_ENOSYS;
12041         }
12042         if (!is_error(ret)) {
12043             int i;
12044             for (i = 0; i < ret; i++) {
12045                 target_ep[i].events = tswap32(ep[i].events);
12046                 target_ep[i].data.u64 = tswap64(ep[i].data.u64);
12047             }
12048             unlock_user(target_ep, arg2,
12049                         ret * sizeof(struct target_epoll_event));
12050         } else {
12051             unlock_user(target_ep, arg2, 0);
12052         }
12053         g_free(ep);
12054         break;
12055     }
12056 #endif
12057 #endif
12058 #ifdef TARGET_NR_prlimit64
12059     case TARGET_NR_prlimit64:
12060     {
12061         /* args: pid, resource number, ptr to new rlimit, ptr to old rlimit */
12062         struct target_rlimit64 *target_rnew, *target_rold;
12063         struct host_rlimit64 rnew, rold, *rnewp = 0;
12064         int resource = target_to_host_resource(arg2);
12065         if (arg3) {
12066             if (!lock_user_struct(VERIFY_READ, target_rnew, arg3, 1)) {
12067                 goto efault;
12068             }
12069             rnew.rlim_cur = tswap64(target_rnew->rlim_cur);
12070             rnew.rlim_max = tswap64(target_rnew->rlim_max);
12071             unlock_user_struct(target_rnew, arg3, 0);
12072             rnewp = &rnew;
12073         }
12074 
12075         ret = get_errno(sys_prlimit64(arg1, resource, rnewp, arg4 ? &rold : 0));
12076         if (!is_error(ret) && arg4) {
12077             if (!lock_user_struct(VERIFY_WRITE, target_rold, arg4, 1)) {
12078                 goto efault;
12079             }
12080             target_rold->rlim_cur = tswap64(rold.rlim_cur);
12081             target_rold->rlim_max = tswap64(rold.rlim_max);
12082             unlock_user_struct(target_rold, arg4, 1);
12083         }
12084         break;
12085     }
12086 #endif
12087 #ifdef TARGET_NR_gethostname
12088     case TARGET_NR_gethostname:
12089     {
12090         char *name = lock_user(VERIFY_WRITE, arg1, arg2, 0);
12091         if (name) {
12092             ret = get_errno(gethostname(name, arg2));
12093             unlock_user(name, arg1, arg2);
12094         } else {
12095             ret = -TARGET_EFAULT;
12096         }
12097         break;
12098     }
12099 #endif
12100 #ifdef TARGET_NR_atomic_cmpxchg_32
12101     case TARGET_NR_atomic_cmpxchg_32:
12102     {
12103         /* should use start_exclusive from main.c */
12104         abi_ulong mem_value;
12105         if (get_user_u32(mem_value, arg6)) {
12106             target_siginfo_t info;
12107             info.si_signo = SIGSEGV;
12108             info.si_errno = 0;
12109             info.si_code = TARGET_SEGV_MAPERR;
12110             info._sifields._sigfault._addr = arg6;
12111             queue_signal((CPUArchState *)cpu_env, info.si_signo,
12112                          QEMU_SI_FAULT, &info);
12113             ret = 0xdeadbeef;
12114 
12115         }
12116         if (mem_value == arg2)
12117             put_user_u32(arg1, arg6);
12118         ret = mem_value;
12119         break;
12120     }
12121 #endif
12122 #ifdef TARGET_NR_atomic_barrier
12123     case TARGET_NR_atomic_barrier:
12124     {
12125         /* Like the kernel implementation and the qemu arm barrier, no-op this? */
12126         ret = 0;
12127         break;
12128     }
12129 #endif
12130 
12131 #ifdef TARGET_NR_timer_create
12132     case TARGET_NR_timer_create:
12133     {
12134         /* args: clockid_t clockid, struct sigevent *sevp, timer_t *timerid */
12135 
12136         struct sigevent host_sevp = { {0}, }, *phost_sevp = NULL;
12137 
12138         int clkid = arg1;
12139         int timer_index = next_free_host_timer();
12140 
12141         if (timer_index < 0) {
12142             ret = -TARGET_EAGAIN;
12143         } else {
12144             timer_t *phtimer = g_posix_timers  + timer_index;
12145 
12146             if (arg2) {
12147                 phost_sevp = &host_sevp;
12148                 ret = target_to_host_sigevent(phost_sevp, arg2);
12149                 if (ret != 0) {
12150                     break;
12151                 }
12152             }
12153 
12154             ret = get_errno(timer_create(clkid, phost_sevp, phtimer));
12155             if (ret) {
12156                 phtimer = NULL;
12157             } else {
12158                 if (put_user(TIMER_MAGIC | timer_index, arg3, target_timer_t)) {
12159                     goto efault;
12160                 }
12161             }
12162         }
12163         break;
12164     }
12165 #endif
12166 
12167 #ifdef TARGET_NR_timer_settime
12168     case TARGET_NR_timer_settime:
12169     {
12170         /* args: timer_t timerid, int flags, const struct itimerspec *new_value,
12171          * struct itimerspec * old_value */
12172         target_timer_t timerid = get_timer_id(arg1);
12173 
12174         if (timerid < 0) {
12175             ret = timerid;
12176         } else if (arg3 == 0) {
12177             ret = -TARGET_EINVAL;
12178         } else {
12179             timer_t htimer = g_posix_timers[timerid];
12180             struct itimerspec hspec_new = {{0},}, hspec_old = {{0},};
12181 
12182             if (target_to_host_itimerspec(&hspec_new, arg3)) {
12183                 goto efault;
12184             }
12185             ret = get_errno(
12186                           timer_settime(htimer, arg2, &hspec_new, &hspec_old));
12187             if (arg4 && host_to_target_itimerspec(arg4, &hspec_old)) {
12188                 goto efault;
12189             }
12190         }
12191         break;
12192     }
12193 #endif
12194 
12195 #ifdef TARGET_NR_timer_gettime
12196     case TARGET_NR_timer_gettime:
12197     {
12198         /* args: timer_t timerid, struct itimerspec *curr_value */
12199         target_timer_t timerid = get_timer_id(arg1);
12200 
12201         if (timerid < 0) {
12202             ret = timerid;
12203         } else if (!arg2) {
12204             ret = -TARGET_EFAULT;
12205         } else {
12206             timer_t htimer = g_posix_timers[timerid];
12207             struct itimerspec hspec;
12208             ret = get_errno(timer_gettime(htimer, &hspec));
12209 
12210             if (host_to_target_itimerspec(arg2, &hspec)) {
12211                 ret = -TARGET_EFAULT;
12212             }
12213         }
12214         break;
12215     }
12216 #endif
12217 
12218 #ifdef TARGET_NR_timer_getoverrun
12219     case TARGET_NR_timer_getoverrun:
12220     {
12221         /* args: timer_t timerid */
12222         target_timer_t timerid = get_timer_id(arg1);
12223 
12224         if (timerid < 0) {
12225             ret = timerid;
12226         } else {
12227             timer_t htimer = g_posix_timers[timerid];
12228             ret = get_errno(timer_getoverrun(htimer));
12229         }
12230         fd_trans_unregister(ret);
12231         break;
12232     }
12233 #endif
12234 
12235 #ifdef TARGET_NR_timer_delete
12236     case TARGET_NR_timer_delete:
12237     {
12238         /* args: timer_t timerid */
12239         target_timer_t timerid = get_timer_id(arg1);
12240 
12241         if (timerid < 0) {
12242             ret = timerid;
12243         } else {
12244             timer_t htimer = g_posix_timers[timerid];
12245             ret = get_errno(timer_delete(htimer));
12246             g_posix_timers[timerid] = 0;
12247         }
12248         break;
12249     }
12250 #endif
12251 
12252 #if defined(TARGET_NR_timerfd_create) && defined(CONFIG_TIMERFD)
12253     case TARGET_NR_timerfd_create:
12254         ret = get_errno(timerfd_create(arg1,
12255                 target_to_host_bitmask(arg2, fcntl_flags_tbl)));
12256         break;
12257 #endif
12258 
12259 #if defined(TARGET_NR_timerfd_gettime) && defined(CONFIG_TIMERFD)
12260     case TARGET_NR_timerfd_gettime:
12261         {
12262             struct itimerspec its_curr;
12263 
12264             ret = get_errno(timerfd_gettime(arg1, &its_curr));
12265 
12266             if (arg2 && host_to_target_itimerspec(arg2, &its_curr)) {
12267                 goto efault;
12268             }
12269         }
12270         break;
12271 #endif
12272 
12273 #if defined(TARGET_NR_timerfd_settime) && defined(CONFIG_TIMERFD)
12274     case TARGET_NR_timerfd_settime:
12275         {
12276             struct itimerspec its_new, its_old, *p_new;
12277 
12278             if (arg3) {
12279                 if (target_to_host_itimerspec(&its_new, arg3)) {
12280                     goto efault;
12281                 }
12282                 p_new = &its_new;
12283             } else {
12284                 p_new = NULL;
12285             }
12286 
12287             ret = get_errno(timerfd_settime(arg1, arg2, p_new, &its_old));
12288 
12289             if (arg4 && host_to_target_itimerspec(arg4, &its_old)) {
12290                 goto efault;
12291             }
12292         }
12293         break;
12294 #endif
12295 
12296 #if defined(TARGET_NR_ioprio_get) && defined(__NR_ioprio_get)
12297     case TARGET_NR_ioprio_get:
12298         ret = get_errno(ioprio_get(arg1, arg2));
12299         break;
12300 #endif
12301 
12302 #if defined(TARGET_NR_ioprio_set) && defined(__NR_ioprio_set)
12303     case TARGET_NR_ioprio_set:
12304         ret = get_errno(ioprio_set(arg1, arg2, arg3));
12305         break;
12306 #endif
12307 
12308 #if defined(TARGET_NR_setns) && defined(CONFIG_SETNS)
12309     case TARGET_NR_setns:
12310         ret = get_errno(setns(arg1, arg2));
12311         break;
12312 #endif
12313 #if defined(TARGET_NR_unshare) && defined(CONFIG_SETNS)
12314     case TARGET_NR_unshare:
12315         ret = get_errno(unshare(arg1));
12316         break;
12317 #endif
12318 #if defined(TARGET_NR_kcmp) && defined(__NR_kcmp)
12319     case TARGET_NR_kcmp:
12320         ret = get_errno(kcmp(arg1, arg2, arg3, arg4, arg5));
12321         break;
12322 #endif
12323 
12324     default:
12325     unimplemented:
12326         gemu_log("qemu: Unsupported syscall: %d\n", num);
12327 #if defined(TARGET_NR_setxattr) || defined(TARGET_NR_get_thread_area) || defined(TARGET_NR_getdomainname) || defined(TARGET_NR_set_robust_list)
12328     unimplemented_nowarn:
12329 #endif
12330         ret = -TARGET_ENOSYS;
12331         break;
12332     }
12333 fail:
12334 #ifdef DEBUG
12335     gemu_log(" = " TARGET_ABI_FMT_ld "\n", ret);
12336 #endif
12337     if(do_strace)
12338         print_syscall_ret(num, ret);
12339     trace_guest_user_syscall_ret(cpu, num, ret);
12340     return ret;
12341 efault:
12342     ret = -TARGET_EFAULT;
12343     goto fail;
12344 }
12345