xref: /openbmc/qemu/linux-user/syscall.c (revision c0cb8801)
1 /*
2  *  Linux syscalls
3  *
4  *  Copyright (c) 2003 Fabrice Bellard
5  *
6  *  This program is free software; you can redistribute it and/or modify
7  *  it under the terms of the GNU General Public License as published by
8  *  the Free Software Foundation; either version 2 of the License, or
9  *  (at your option) any later version.
10  *
11  *  This program is distributed in the hope that it will be useful,
12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14  *  GNU General Public License for more details.
15  *
16  *  You should have received a copy of the GNU General Public License
17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
18  */
19 #define _ATFILE_SOURCE
20 #include "qemu/osdep.h"
21 #include "qemu/cutils.h"
22 #include "qemu/path.h"
23 #include "qemu/memfd.h"
24 #include "qemu/queue.h"
25 #include <elf.h>
26 #include <endian.h>
27 #include <grp.h>
28 #include <sys/ipc.h>
29 #include <sys/msg.h>
30 #include <sys/wait.h>
31 #include <sys/mount.h>
32 #include <sys/file.h>
33 #include <sys/fsuid.h>
34 #include <sys/personality.h>
35 #include <sys/prctl.h>
36 #include <sys/resource.h>
37 #include <sys/swap.h>
38 #include <linux/capability.h>
39 #include <sched.h>
40 #include <sys/timex.h>
41 #include <sys/socket.h>
42 #include <linux/sockios.h>
43 #include <sys/un.h>
44 #include <sys/uio.h>
45 #include <poll.h>
46 #include <sys/times.h>
47 #include <sys/shm.h>
48 #include <sys/sem.h>
49 #include <sys/statfs.h>
50 #include <utime.h>
51 #include <sys/sysinfo.h>
52 #include <sys/signalfd.h>
53 //#include <sys/user.h>
54 #include <netinet/ip.h>
55 #include <netinet/tcp.h>
56 #include <linux/wireless.h>
57 #include <linux/icmp.h>
58 #include <linux/icmpv6.h>
59 #include <linux/errqueue.h>
60 #include <linux/random.h>
61 #ifdef CONFIG_TIMERFD
62 #include <sys/timerfd.h>
63 #endif
64 #ifdef CONFIG_EVENTFD
65 #include <sys/eventfd.h>
66 #endif
67 #ifdef CONFIG_EPOLL
68 #include <sys/epoll.h>
69 #endif
70 #ifdef CONFIG_ATTR
71 #include "qemu/xattr.h"
72 #endif
73 #ifdef CONFIG_SENDFILE
74 #include <sys/sendfile.h>
75 #endif
76 
77 #define termios host_termios
78 #define winsize host_winsize
79 #define termio host_termio
80 #define sgttyb host_sgttyb /* same as target */
81 #define tchars host_tchars /* same as target */
82 #define ltchars host_ltchars /* same as target */
83 
84 #include <linux/termios.h>
85 #include <linux/unistd.h>
86 #include <linux/cdrom.h>
87 #include <linux/hdreg.h>
88 #include <linux/soundcard.h>
89 #include <linux/kd.h>
90 #include <linux/mtio.h>
91 #include <linux/fs.h>
92 #include <linux/fd.h>
93 #if defined(CONFIG_FIEMAP)
94 #include <linux/fiemap.h>
95 #endif
96 #include <linux/fb.h>
97 #if defined(CONFIG_USBFS)
98 #include <linux/usbdevice_fs.h>
99 #include <linux/usb/ch9.h>
100 #endif
101 #include <linux/vt.h>
102 #include <linux/dm-ioctl.h>
103 #include <linux/reboot.h>
104 #include <linux/route.h>
105 #include <linux/filter.h>
106 #include <linux/blkpg.h>
107 #include <netpacket/packet.h>
108 #include <linux/netlink.h>
109 #include <linux/if_alg.h>
110 #include "linux_loop.h"
111 #include "uname.h"
112 
113 #include "qemu.h"
114 #include "qemu/guest-random.h"
115 #include "user/syscall-trace.h"
116 #include "qapi/error.h"
117 #include "fd-trans.h"
118 
119 #ifndef CLONE_IO
120 #define CLONE_IO                0x80000000      /* Clone io context */
121 #endif
122 
123 /* We can't directly call the host clone syscall, because this will
124  * badly confuse libc (breaking mutexes, for example). So we must
125  * divide clone flags into:
126  *  * flag combinations that look like pthread_create()
127  *  * flag combinations that look like fork()
128  *  * flags we can implement within QEMU itself
129  *  * flags we can't support and will return an error for
130  */
131 /* For thread creation, all these flags must be present; for
132  * fork, none must be present.
133  */
134 #define CLONE_THREAD_FLAGS                              \
135     (CLONE_VM | CLONE_FS | CLONE_FILES |                \
136      CLONE_SIGHAND | CLONE_THREAD | CLONE_SYSVSEM)
137 
138 /* These flags are ignored:
139  * CLONE_DETACHED is now ignored by the kernel;
140  * CLONE_IO is just an optimisation hint to the I/O scheduler
141  */
142 #define CLONE_IGNORED_FLAGS                     \
143     (CLONE_DETACHED | CLONE_IO)
144 
145 /* Flags for fork which we can implement within QEMU itself */
146 #define CLONE_OPTIONAL_FORK_FLAGS               \
147     (CLONE_SETTLS | CLONE_PARENT_SETTID |       \
148      CLONE_CHILD_CLEARTID | CLONE_CHILD_SETTID)
149 
150 /* Flags for thread creation which we can implement within QEMU itself */
151 #define CLONE_OPTIONAL_THREAD_FLAGS                             \
152     (CLONE_SETTLS | CLONE_PARENT_SETTID |                       \
153      CLONE_CHILD_CLEARTID | CLONE_CHILD_SETTID | CLONE_PARENT)
154 
155 #define CLONE_INVALID_FORK_FLAGS                                        \
156     (~(CSIGNAL | CLONE_OPTIONAL_FORK_FLAGS | CLONE_IGNORED_FLAGS))
157 
158 #define CLONE_INVALID_THREAD_FLAGS                                      \
159     (~(CSIGNAL | CLONE_THREAD_FLAGS | CLONE_OPTIONAL_THREAD_FLAGS |     \
160        CLONE_IGNORED_FLAGS))
161 
162 /* CLONE_VFORK is special cased early in do_fork(). The other flag bits
163  * have almost all been allocated. We cannot support any of
164  * CLONE_NEWNS, CLONE_NEWCGROUP, CLONE_NEWUTS, CLONE_NEWIPC,
165  * CLONE_NEWUSER, CLONE_NEWPID, CLONE_NEWNET, CLONE_PTRACE, CLONE_UNTRACED.
166  * The checks against the invalid thread masks above will catch these.
167  * (The one remaining unallocated bit is 0x1000 which used to be CLONE_PID.)
168  */
169 
170 /* Define DEBUG_ERESTARTSYS to force every syscall to be restarted
171  * once. This exercises the codepaths for restart.
172  */
173 //#define DEBUG_ERESTARTSYS
174 
175 //#include <linux/msdos_fs.h>
176 #define	VFAT_IOCTL_READDIR_BOTH		_IOR('r', 1, struct linux_dirent [2])
177 #define	VFAT_IOCTL_READDIR_SHORT	_IOR('r', 2, struct linux_dirent [2])
178 
179 #undef _syscall0
180 #undef _syscall1
181 #undef _syscall2
182 #undef _syscall3
183 #undef _syscall4
184 #undef _syscall5
185 #undef _syscall6
186 
187 #define _syscall0(type,name)		\
188 static type name (void)			\
189 {					\
190 	return syscall(__NR_##name);	\
191 }
192 
193 #define _syscall1(type,name,type1,arg1)		\
194 static type name (type1 arg1)			\
195 {						\
196 	return syscall(__NR_##name, arg1);	\
197 }
198 
199 #define _syscall2(type,name,type1,arg1,type2,arg2)	\
200 static type name (type1 arg1,type2 arg2)		\
201 {							\
202 	return syscall(__NR_##name, arg1, arg2);	\
203 }
204 
205 #define _syscall3(type,name,type1,arg1,type2,arg2,type3,arg3)	\
206 static type name (type1 arg1,type2 arg2,type3 arg3)		\
207 {								\
208 	return syscall(__NR_##name, arg1, arg2, arg3);		\
209 }
210 
211 #define _syscall4(type,name,type1,arg1,type2,arg2,type3,arg3,type4,arg4)	\
212 static type name (type1 arg1,type2 arg2,type3 arg3,type4 arg4)			\
213 {										\
214 	return syscall(__NR_##name, arg1, arg2, arg3, arg4);			\
215 }
216 
217 #define _syscall5(type,name,type1,arg1,type2,arg2,type3,arg3,type4,arg4,	\
218 		  type5,arg5)							\
219 static type name (type1 arg1,type2 arg2,type3 arg3,type4 arg4,type5 arg5)	\
220 {										\
221 	return syscall(__NR_##name, arg1, arg2, arg3, arg4, arg5);		\
222 }
223 
224 
225 #define _syscall6(type,name,type1,arg1,type2,arg2,type3,arg3,type4,arg4,	\
226 		  type5,arg5,type6,arg6)					\
227 static type name (type1 arg1,type2 arg2,type3 arg3,type4 arg4,type5 arg5,	\
228                   type6 arg6)							\
229 {										\
230 	return syscall(__NR_##name, arg1, arg2, arg3, arg4, arg5, arg6);	\
231 }
232 
233 
234 #define __NR_sys_uname __NR_uname
235 #define __NR_sys_getcwd1 __NR_getcwd
236 #define __NR_sys_getdents __NR_getdents
237 #define __NR_sys_getdents64 __NR_getdents64
238 #define __NR_sys_getpriority __NR_getpriority
239 #define __NR_sys_rt_sigqueueinfo __NR_rt_sigqueueinfo
240 #define __NR_sys_rt_tgsigqueueinfo __NR_rt_tgsigqueueinfo
241 #define __NR_sys_syslog __NR_syslog
242 #define __NR_sys_futex __NR_futex
243 #define __NR_sys_inotify_init __NR_inotify_init
244 #define __NR_sys_inotify_add_watch __NR_inotify_add_watch
245 #define __NR_sys_inotify_rm_watch __NR_inotify_rm_watch
246 #define __NR_sys_statx __NR_statx
247 
248 #if defined(__alpha__) || defined(__x86_64__) || defined(__s390x__)
249 #define __NR__llseek __NR_lseek
250 #endif
251 
252 /* Newer kernel ports have llseek() instead of _llseek() */
253 #if defined(TARGET_NR_llseek) && !defined(TARGET_NR__llseek)
254 #define TARGET_NR__llseek TARGET_NR_llseek
255 #endif
256 
257 #define __NR_sys_gettid __NR_gettid
258 _syscall0(int, sys_gettid)
259 
260 /* For the 64-bit guest on 32-bit host case we must emulate
261  * getdents using getdents64, because otherwise the host
262  * might hand us back more dirent records than we can fit
263  * into the guest buffer after structure format conversion.
264  * Otherwise we emulate getdents with getdents if the host has it.
265  */
266 #if defined(__NR_getdents) && HOST_LONG_BITS >= TARGET_ABI_BITS
267 #define EMULATE_GETDENTS_WITH_GETDENTS
268 #endif
269 
270 #if defined(TARGET_NR_getdents) && defined(EMULATE_GETDENTS_WITH_GETDENTS)
271 _syscall3(int, sys_getdents, uint, fd, struct linux_dirent *, dirp, uint, count);
272 #endif
273 #if (defined(TARGET_NR_getdents) && \
274       !defined(EMULATE_GETDENTS_WITH_GETDENTS)) || \
275     (defined(TARGET_NR_getdents64) && defined(__NR_getdents64))
276 _syscall3(int, sys_getdents64, uint, fd, struct linux_dirent64 *, dirp, uint, count);
277 #endif
278 #if defined(TARGET_NR__llseek) && defined(__NR_llseek)
279 _syscall5(int, _llseek,  uint,  fd, ulong, hi, ulong, lo,
280           loff_t *, res, uint, wh);
281 #endif
282 _syscall3(int, sys_rt_sigqueueinfo, pid_t, pid, int, sig, siginfo_t *, uinfo)
283 _syscall4(int, sys_rt_tgsigqueueinfo, pid_t, pid, pid_t, tid, int, sig,
284           siginfo_t *, uinfo)
285 _syscall3(int,sys_syslog,int,type,char*,bufp,int,len)
286 #ifdef __NR_exit_group
287 _syscall1(int,exit_group,int,error_code)
288 #endif
289 #if defined(TARGET_NR_set_tid_address) && defined(__NR_set_tid_address)
290 _syscall1(int,set_tid_address,int *,tidptr)
291 #endif
292 #if defined(TARGET_NR_futex) && defined(__NR_futex)
293 _syscall6(int,sys_futex,int *,uaddr,int,op,int,val,
294           const struct timespec *,timeout,int *,uaddr2,int,val3)
295 #endif
296 #define __NR_sys_sched_getaffinity __NR_sched_getaffinity
297 _syscall3(int, sys_sched_getaffinity, pid_t, pid, unsigned int, len,
298           unsigned long *, user_mask_ptr);
299 #define __NR_sys_sched_setaffinity __NR_sched_setaffinity
300 _syscall3(int, sys_sched_setaffinity, pid_t, pid, unsigned int, len,
301           unsigned long *, user_mask_ptr);
302 #define __NR_sys_getcpu __NR_getcpu
303 _syscall3(int, sys_getcpu, unsigned *, cpu, unsigned *, node, void *, tcache);
304 _syscall4(int, reboot, int, magic1, int, magic2, unsigned int, cmd,
305           void *, arg);
306 _syscall2(int, capget, struct __user_cap_header_struct *, header,
307           struct __user_cap_data_struct *, data);
308 _syscall2(int, capset, struct __user_cap_header_struct *, header,
309           struct __user_cap_data_struct *, data);
310 #if defined(TARGET_NR_ioprio_get) && defined(__NR_ioprio_get)
311 _syscall2(int, ioprio_get, int, which, int, who)
312 #endif
313 #if defined(TARGET_NR_ioprio_set) && defined(__NR_ioprio_set)
314 _syscall3(int, ioprio_set, int, which, int, who, int, ioprio)
315 #endif
316 #if defined(TARGET_NR_getrandom) && defined(__NR_getrandom)
317 _syscall3(int, getrandom, void *, buf, size_t, buflen, unsigned int, flags)
318 #endif
319 
320 #if defined(TARGET_NR_kcmp) && defined(__NR_kcmp)
321 _syscall5(int, kcmp, pid_t, pid1, pid_t, pid2, int, type,
322           unsigned long, idx1, unsigned long, idx2)
323 #endif
324 
325 /*
326  * It is assumed that struct statx is architecture independent.
327  */
328 #if defined(TARGET_NR_statx) && defined(__NR_statx)
329 _syscall5(int, sys_statx, int, dirfd, const char *, pathname, int, flags,
330           unsigned int, mask, struct target_statx *, statxbuf)
331 #endif
332 
333 static bitmask_transtbl fcntl_flags_tbl[] = {
334   { TARGET_O_ACCMODE,   TARGET_O_WRONLY,    O_ACCMODE,   O_WRONLY,    },
335   { TARGET_O_ACCMODE,   TARGET_O_RDWR,      O_ACCMODE,   O_RDWR,      },
336   { TARGET_O_CREAT,     TARGET_O_CREAT,     O_CREAT,     O_CREAT,     },
337   { TARGET_O_EXCL,      TARGET_O_EXCL,      O_EXCL,      O_EXCL,      },
338   { TARGET_O_NOCTTY,    TARGET_O_NOCTTY,    O_NOCTTY,    O_NOCTTY,    },
339   { TARGET_O_TRUNC,     TARGET_O_TRUNC,     O_TRUNC,     O_TRUNC,     },
340   { TARGET_O_APPEND,    TARGET_O_APPEND,    O_APPEND,    O_APPEND,    },
341   { TARGET_O_NONBLOCK,  TARGET_O_NONBLOCK,  O_NONBLOCK,  O_NONBLOCK,  },
342   { TARGET_O_SYNC,      TARGET_O_DSYNC,     O_SYNC,      O_DSYNC,     },
343   { TARGET_O_SYNC,      TARGET_O_SYNC,      O_SYNC,      O_SYNC,      },
344   { TARGET_FASYNC,      TARGET_FASYNC,      FASYNC,      FASYNC,      },
345   { TARGET_O_DIRECTORY, TARGET_O_DIRECTORY, O_DIRECTORY, O_DIRECTORY, },
346   { TARGET_O_NOFOLLOW,  TARGET_O_NOFOLLOW,  O_NOFOLLOW,  O_NOFOLLOW,  },
347 #if defined(O_DIRECT)
348   { TARGET_O_DIRECT,    TARGET_O_DIRECT,    O_DIRECT,    O_DIRECT,    },
349 #endif
350 #if defined(O_NOATIME)
351   { TARGET_O_NOATIME,   TARGET_O_NOATIME,   O_NOATIME,   O_NOATIME    },
352 #endif
353 #if defined(O_CLOEXEC)
354   { TARGET_O_CLOEXEC,   TARGET_O_CLOEXEC,   O_CLOEXEC,   O_CLOEXEC    },
355 #endif
356 #if defined(O_PATH)
357   { TARGET_O_PATH,      TARGET_O_PATH,      O_PATH,      O_PATH       },
358 #endif
359 #if defined(O_TMPFILE)
360   { TARGET_O_TMPFILE,   TARGET_O_TMPFILE,   O_TMPFILE,   O_TMPFILE    },
361 #endif
362   /* Don't terminate the list prematurely on 64-bit host+guest.  */
363 #if TARGET_O_LARGEFILE != 0 || O_LARGEFILE != 0
364   { TARGET_O_LARGEFILE, TARGET_O_LARGEFILE, O_LARGEFILE, O_LARGEFILE, },
365 #endif
366   { 0, 0, 0, 0 }
367 };
368 
369 static int sys_getcwd1(char *buf, size_t size)
370 {
371   if (getcwd(buf, size) == NULL) {
372       /* getcwd() sets errno */
373       return (-1);
374   }
375   return strlen(buf)+1;
376 }
377 
378 #ifdef TARGET_NR_utimensat
379 #if defined(__NR_utimensat)
380 #define __NR_sys_utimensat __NR_utimensat
381 _syscall4(int,sys_utimensat,int,dirfd,const char *,pathname,
382           const struct timespec *,tsp,int,flags)
383 #else
384 static int sys_utimensat(int dirfd, const char *pathname,
385                          const struct timespec times[2], int flags)
386 {
387     errno = ENOSYS;
388     return -1;
389 }
390 #endif
391 #endif /* TARGET_NR_utimensat */
392 
393 #ifdef TARGET_NR_renameat2
394 #if defined(__NR_renameat2)
395 #define __NR_sys_renameat2 __NR_renameat2
396 _syscall5(int, sys_renameat2, int, oldfd, const char *, old, int, newfd,
397           const char *, new, unsigned int, flags)
398 #else
399 static int sys_renameat2(int oldfd, const char *old,
400                          int newfd, const char *new, int flags)
401 {
402     if (flags == 0) {
403         return renameat(oldfd, old, newfd, new);
404     }
405     errno = ENOSYS;
406     return -1;
407 }
408 #endif
409 #endif /* TARGET_NR_renameat2 */
410 
411 #ifdef CONFIG_INOTIFY
412 #include <sys/inotify.h>
413 
414 #if defined(TARGET_NR_inotify_init) && defined(__NR_inotify_init)
415 static int sys_inotify_init(void)
416 {
417   return (inotify_init());
418 }
419 #endif
420 #if defined(TARGET_NR_inotify_add_watch) && defined(__NR_inotify_add_watch)
421 static int sys_inotify_add_watch(int fd,const char *pathname, int32_t mask)
422 {
423   return (inotify_add_watch(fd, pathname, mask));
424 }
425 #endif
426 #if defined(TARGET_NR_inotify_rm_watch) && defined(__NR_inotify_rm_watch)
427 static int sys_inotify_rm_watch(int fd, int32_t wd)
428 {
429   return (inotify_rm_watch(fd, wd));
430 }
431 #endif
432 #ifdef CONFIG_INOTIFY1
433 #if defined(TARGET_NR_inotify_init1) && defined(__NR_inotify_init1)
434 static int sys_inotify_init1(int flags)
435 {
436   return (inotify_init1(flags));
437 }
438 #endif
439 #endif
440 #else
441 /* Userspace can usually survive runtime without inotify */
442 #undef TARGET_NR_inotify_init
443 #undef TARGET_NR_inotify_init1
444 #undef TARGET_NR_inotify_add_watch
445 #undef TARGET_NR_inotify_rm_watch
446 #endif /* CONFIG_INOTIFY  */
447 
448 #if defined(TARGET_NR_prlimit64)
449 #ifndef __NR_prlimit64
450 # define __NR_prlimit64 -1
451 #endif
452 #define __NR_sys_prlimit64 __NR_prlimit64
453 /* The glibc rlimit structure may not be that used by the underlying syscall */
454 struct host_rlimit64 {
455     uint64_t rlim_cur;
456     uint64_t rlim_max;
457 };
458 _syscall4(int, sys_prlimit64, pid_t, pid, int, resource,
459           const struct host_rlimit64 *, new_limit,
460           struct host_rlimit64 *, old_limit)
461 #endif
462 
463 
464 #if defined(TARGET_NR_timer_create)
465 /* Maxiumum of 32 active POSIX timers allowed at any one time. */
466 static timer_t g_posix_timers[32] = { 0, } ;
467 
468 static inline int next_free_host_timer(void)
469 {
470     int k ;
471     /* FIXME: Does finding the next free slot require a lock? */
472     for (k = 0; k < ARRAY_SIZE(g_posix_timers); k++) {
473         if (g_posix_timers[k] == 0) {
474             g_posix_timers[k] = (timer_t) 1;
475             return k;
476         }
477     }
478     return -1;
479 }
480 #endif
481 
482 /* ARM EABI and MIPS expect 64bit types aligned even on pairs or registers */
483 #ifdef TARGET_ARM
484 static inline int regpairs_aligned(void *cpu_env, int num)
485 {
486     return ((((CPUARMState *)cpu_env)->eabi) == 1) ;
487 }
488 #elif defined(TARGET_MIPS) && (TARGET_ABI_BITS == 32)
489 static inline int regpairs_aligned(void *cpu_env, int num) { return 1; }
490 #elif defined(TARGET_PPC) && !defined(TARGET_PPC64)
491 /* SysV AVI for PPC32 expects 64bit parameters to be passed on odd/even pairs
492  * of registers which translates to the same as ARM/MIPS, because we start with
493  * r3 as arg1 */
494 static inline int regpairs_aligned(void *cpu_env, int num) { return 1; }
495 #elif defined(TARGET_SH4)
496 /* SH4 doesn't align register pairs, except for p{read,write}64 */
497 static inline int regpairs_aligned(void *cpu_env, int num)
498 {
499     switch (num) {
500     case TARGET_NR_pread64:
501     case TARGET_NR_pwrite64:
502         return 1;
503 
504     default:
505         return 0;
506     }
507 }
508 #elif defined(TARGET_XTENSA)
509 static inline int regpairs_aligned(void *cpu_env, int num) { return 1; }
510 #else
511 static inline int regpairs_aligned(void *cpu_env, int num) { return 0; }
512 #endif
513 
514 #define ERRNO_TABLE_SIZE 1200
515 
516 /* target_to_host_errno_table[] is initialized from
517  * host_to_target_errno_table[] in syscall_init(). */
518 static uint16_t target_to_host_errno_table[ERRNO_TABLE_SIZE] = {
519 };
520 
521 /*
522  * This list is the union of errno values overridden in asm-<arch>/errno.h
523  * minus the errnos that are not actually generic to all archs.
524  */
525 static uint16_t host_to_target_errno_table[ERRNO_TABLE_SIZE] = {
526     [EAGAIN]		= TARGET_EAGAIN,
527     [EIDRM]		= TARGET_EIDRM,
528     [ECHRNG]		= TARGET_ECHRNG,
529     [EL2NSYNC]		= TARGET_EL2NSYNC,
530     [EL3HLT]		= TARGET_EL3HLT,
531     [EL3RST]		= TARGET_EL3RST,
532     [ELNRNG]		= TARGET_ELNRNG,
533     [EUNATCH]		= TARGET_EUNATCH,
534     [ENOCSI]		= TARGET_ENOCSI,
535     [EL2HLT]		= TARGET_EL2HLT,
536     [EDEADLK]		= TARGET_EDEADLK,
537     [ENOLCK]		= TARGET_ENOLCK,
538     [EBADE]		= TARGET_EBADE,
539     [EBADR]		= TARGET_EBADR,
540     [EXFULL]		= TARGET_EXFULL,
541     [ENOANO]		= TARGET_ENOANO,
542     [EBADRQC]		= TARGET_EBADRQC,
543     [EBADSLT]		= TARGET_EBADSLT,
544     [EBFONT]		= TARGET_EBFONT,
545     [ENOSTR]		= TARGET_ENOSTR,
546     [ENODATA]		= TARGET_ENODATA,
547     [ETIME]		= TARGET_ETIME,
548     [ENOSR]		= TARGET_ENOSR,
549     [ENONET]		= TARGET_ENONET,
550     [ENOPKG]		= TARGET_ENOPKG,
551     [EREMOTE]		= TARGET_EREMOTE,
552     [ENOLINK]		= TARGET_ENOLINK,
553     [EADV]		= TARGET_EADV,
554     [ESRMNT]		= TARGET_ESRMNT,
555     [ECOMM]		= TARGET_ECOMM,
556     [EPROTO]		= TARGET_EPROTO,
557     [EDOTDOT]		= TARGET_EDOTDOT,
558     [EMULTIHOP]		= TARGET_EMULTIHOP,
559     [EBADMSG]		= TARGET_EBADMSG,
560     [ENAMETOOLONG]	= TARGET_ENAMETOOLONG,
561     [EOVERFLOW]		= TARGET_EOVERFLOW,
562     [ENOTUNIQ]		= TARGET_ENOTUNIQ,
563     [EBADFD]		= TARGET_EBADFD,
564     [EREMCHG]		= TARGET_EREMCHG,
565     [ELIBACC]		= TARGET_ELIBACC,
566     [ELIBBAD]		= TARGET_ELIBBAD,
567     [ELIBSCN]		= TARGET_ELIBSCN,
568     [ELIBMAX]		= TARGET_ELIBMAX,
569     [ELIBEXEC]		= TARGET_ELIBEXEC,
570     [EILSEQ]		= TARGET_EILSEQ,
571     [ENOSYS]		= TARGET_ENOSYS,
572     [ELOOP]		= TARGET_ELOOP,
573     [ERESTART]		= TARGET_ERESTART,
574     [ESTRPIPE]		= TARGET_ESTRPIPE,
575     [ENOTEMPTY]		= TARGET_ENOTEMPTY,
576     [EUSERS]		= TARGET_EUSERS,
577     [ENOTSOCK]		= TARGET_ENOTSOCK,
578     [EDESTADDRREQ]	= TARGET_EDESTADDRREQ,
579     [EMSGSIZE]		= TARGET_EMSGSIZE,
580     [EPROTOTYPE]	= TARGET_EPROTOTYPE,
581     [ENOPROTOOPT]	= TARGET_ENOPROTOOPT,
582     [EPROTONOSUPPORT]	= TARGET_EPROTONOSUPPORT,
583     [ESOCKTNOSUPPORT]	= TARGET_ESOCKTNOSUPPORT,
584     [EOPNOTSUPP]	= TARGET_EOPNOTSUPP,
585     [EPFNOSUPPORT]	= TARGET_EPFNOSUPPORT,
586     [EAFNOSUPPORT]	= TARGET_EAFNOSUPPORT,
587     [EADDRINUSE]	= TARGET_EADDRINUSE,
588     [EADDRNOTAVAIL]	= TARGET_EADDRNOTAVAIL,
589     [ENETDOWN]		= TARGET_ENETDOWN,
590     [ENETUNREACH]	= TARGET_ENETUNREACH,
591     [ENETRESET]		= TARGET_ENETRESET,
592     [ECONNABORTED]	= TARGET_ECONNABORTED,
593     [ECONNRESET]	= TARGET_ECONNRESET,
594     [ENOBUFS]		= TARGET_ENOBUFS,
595     [EISCONN]		= TARGET_EISCONN,
596     [ENOTCONN]		= TARGET_ENOTCONN,
597     [EUCLEAN]		= TARGET_EUCLEAN,
598     [ENOTNAM]		= TARGET_ENOTNAM,
599     [ENAVAIL]		= TARGET_ENAVAIL,
600     [EISNAM]		= TARGET_EISNAM,
601     [EREMOTEIO]		= TARGET_EREMOTEIO,
602     [EDQUOT]            = TARGET_EDQUOT,
603     [ESHUTDOWN]		= TARGET_ESHUTDOWN,
604     [ETOOMANYREFS]	= TARGET_ETOOMANYREFS,
605     [ETIMEDOUT]		= TARGET_ETIMEDOUT,
606     [ECONNREFUSED]	= TARGET_ECONNREFUSED,
607     [EHOSTDOWN]		= TARGET_EHOSTDOWN,
608     [EHOSTUNREACH]	= TARGET_EHOSTUNREACH,
609     [EALREADY]		= TARGET_EALREADY,
610     [EINPROGRESS]	= TARGET_EINPROGRESS,
611     [ESTALE]		= TARGET_ESTALE,
612     [ECANCELED]		= TARGET_ECANCELED,
613     [ENOMEDIUM]		= TARGET_ENOMEDIUM,
614     [EMEDIUMTYPE]	= TARGET_EMEDIUMTYPE,
615 #ifdef ENOKEY
616     [ENOKEY]		= TARGET_ENOKEY,
617 #endif
618 #ifdef EKEYEXPIRED
619     [EKEYEXPIRED]	= TARGET_EKEYEXPIRED,
620 #endif
621 #ifdef EKEYREVOKED
622     [EKEYREVOKED]	= TARGET_EKEYREVOKED,
623 #endif
624 #ifdef EKEYREJECTED
625     [EKEYREJECTED]	= TARGET_EKEYREJECTED,
626 #endif
627 #ifdef EOWNERDEAD
628     [EOWNERDEAD]	= TARGET_EOWNERDEAD,
629 #endif
630 #ifdef ENOTRECOVERABLE
631     [ENOTRECOVERABLE]	= TARGET_ENOTRECOVERABLE,
632 #endif
633 #ifdef ENOMSG
634     [ENOMSG]            = TARGET_ENOMSG,
635 #endif
636 #ifdef ERKFILL
637     [ERFKILL]           = TARGET_ERFKILL,
638 #endif
639 #ifdef EHWPOISON
640     [EHWPOISON]         = TARGET_EHWPOISON,
641 #endif
642 };
643 
644 static inline int host_to_target_errno(int err)
645 {
646     if (err >= 0 && err < ERRNO_TABLE_SIZE &&
647         host_to_target_errno_table[err]) {
648         return host_to_target_errno_table[err];
649     }
650     return err;
651 }
652 
653 static inline int target_to_host_errno(int err)
654 {
655     if (err >= 0 && err < ERRNO_TABLE_SIZE &&
656         target_to_host_errno_table[err]) {
657         return target_to_host_errno_table[err];
658     }
659     return err;
660 }
661 
662 static inline abi_long get_errno(abi_long ret)
663 {
664     if (ret == -1)
665         return -host_to_target_errno(errno);
666     else
667         return ret;
668 }
669 
670 const char *target_strerror(int err)
671 {
672     if (err == TARGET_ERESTARTSYS) {
673         return "To be restarted";
674     }
675     if (err == TARGET_QEMU_ESIGRETURN) {
676         return "Successful exit from sigreturn";
677     }
678 
679     if ((err >= ERRNO_TABLE_SIZE) || (err < 0)) {
680         return NULL;
681     }
682     return strerror(target_to_host_errno(err));
683 }
684 
685 #define safe_syscall0(type, name) \
686 static type safe_##name(void) \
687 { \
688     return safe_syscall(__NR_##name); \
689 }
690 
691 #define safe_syscall1(type, name, type1, arg1) \
692 static type safe_##name(type1 arg1) \
693 { \
694     return safe_syscall(__NR_##name, arg1); \
695 }
696 
697 #define safe_syscall2(type, name, type1, arg1, type2, arg2) \
698 static type safe_##name(type1 arg1, type2 arg2) \
699 { \
700     return safe_syscall(__NR_##name, arg1, arg2); \
701 }
702 
703 #define safe_syscall3(type, name, type1, arg1, type2, arg2, type3, arg3) \
704 static type safe_##name(type1 arg1, type2 arg2, type3 arg3) \
705 { \
706     return safe_syscall(__NR_##name, arg1, arg2, arg3); \
707 }
708 
709 #define safe_syscall4(type, name, type1, arg1, type2, arg2, type3, arg3, \
710     type4, arg4) \
711 static type safe_##name(type1 arg1, type2 arg2, type3 arg3, type4 arg4) \
712 { \
713     return safe_syscall(__NR_##name, arg1, arg2, arg3, arg4); \
714 }
715 
716 #define safe_syscall5(type, name, type1, arg1, type2, arg2, type3, arg3, \
717     type4, arg4, type5, arg5) \
718 static type safe_##name(type1 arg1, type2 arg2, type3 arg3, type4 arg4, \
719     type5 arg5) \
720 { \
721     return safe_syscall(__NR_##name, arg1, arg2, arg3, arg4, arg5); \
722 }
723 
724 #define safe_syscall6(type, name, type1, arg1, type2, arg2, type3, arg3, \
725     type4, arg4, type5, arg5, type6, arg6) \
726 static type safe_##name(type1 arg1, type2 arg2, type3 arg3, type4 arg4, \
727     type5 arg5, type6 arg6) \
728 { \
729     return safe_syscall(__NR_##name, arg1, arg2, arg3, arg4, arg5, arg6); \
730 }
731 
732 safe_syscall3(ssize_t, read, int, fd, void *, buff, size_t, count)
733 safe_syscall3(ssize_t, write, int, fd, const void *, buff, size_t, count)
734 safe_syscall4(int, openat, int, dirfd, const char *, pathname, \
735               int, flags, mode_t, mode)
736 safe_syscall4(pid_t, wait4, pid_t, pid, int *, status, int, options, \
737               struct rusage *, rusage)
738 safe_syscall5(int, waitid, idtype_t, idtype, id_t, id, siginfo_t *, infop, \
739               int, options, struct rusage *, rusage)
740 safe_syscall3(int, execve, const char *, filename, char **, argv, char **, envp)
741 safe_syscall6(int, pselect6, int, nfds, fd_set *, readfds, fd_set *, writefds, \
742               fd_set *, exceptfds, struct timespec *, timeout, void *, sig)
743 safe_syscall5(int, ppoll, struct pollfd *, ufds, unsigned int, nfds,
744               struct timespec *, tsp, const sigset_t *, sigmask,
745               size_t, sigsetsize)
746 safe_syscall6(int, epoll_pwait, int, epfd, struct epoll_event *, events,
747               int, maxevents, int, timeout, const sigset_t *, sigmask,
748               size_t, sigsetsize)
749 safe_syscall6(int,futex,int *,uaddr,int,op,int,val, \
750               const struct timespec *,timeout,int *,uaddr2,int,val3)
751 safe_syscall2(int, rt_sigsuspend, sigset_t *, newset, size_t, sigsetsize)
752 safe_syscall2(int, kill, pid_t, pid, int, sig)
753 safe_syscall2(int, tkill, int, tid, int, sig)
754 safe_syscall3(int, tgkill, int, tgid, int, pid, int, sig)
755 safe_syscall3(ssize_t, readv, int, fd, const struct iovec *, iov, int, iovcnt)
756 safe_syscall3(ssize_t, writev, int, fd, const struct iovec *, iov, int, iovcnt)
757 safe_syscall5(ssize_t, preadv, int, fd, const struct iovec *, iov, int, iovcnt,
758               unsigned long, pos_l, unsigned long, pos_h)
759 safe_syscall5(ssize_t, pwritev, int, fd, const struct iovec *, iov, int, iovcnt,
760               unsigned long, pos_l, unsigned long, pos_h)
761 safe_syscall3(int, connect, int, fd, const struct sockaddr *, addr,
762               socklen_t, addrlen)
763 safe_syscall6(ssize_t, sendto, int, fd, const void *, buf, size_t, len,
764               int, flags, const struct sockaddr *, addr, socklen_t, addrlen)
765 safe_syscall6(ssize_t, recvfrom, int, fd, void *, buf, size_t, len,
766               int, flags, struct sockaddr *, addr, socklen_t *, addrlen)
767 safe_syscall3(ssize_t, sendmsg, int, fd, const struct msghdr *, msg, int, flags)
768 safe_syscall3(ssize_t, recvmsg, int, fd, struct msghdr *, msg, int, flags)
769 safe_syscall2(int, flock, int, fd, int, operation)
770 safe_syscall4(int, rt_sigtimedwait, const sigset_t *, these, siginfo_t *, uinfo,
771               const struct timespec *, uts, size_t, sigsetsize)
772 safe_syscall4(int, accept4, int, fd, struct sockaddr *, addr, socklen_t *, len,
773               int, flags)
774 safe_syscall2(int, nanosleep, const struct timespec *, req,
775               struct timespec *, rem)
776 #ifdef TARGET_NR_clock_nanosleep
777 safe_syscall4(int, clock_nanosleep, const clockid_t, clock, int, flags,
778               const struct timespec *, req, struct timespec *, rem)
779 #endif
780 #ifdef __NR_ipc
781 safe_syscall6(int, ipc, int, call, long, first, long, second, long, third,
782               void *, ptr, long, fifth)
783 #endif
784 #ifdef __NR_msgsnd
785 safe_syscall4(int, msgsnd, int, msgid, const void *, msgp, size_t, sz,
786               int, flags)
787 #endif
788 #ifdef __NR_msgrcv
789 safe_syscall5(int, msgrcv, int, msgid, void *, msgp, size_t, sz,
790               long, msgtype, int, flags)
791 #endif
792 #ifdef __NR_semtimedop
793 safe_syscall4(int, semtimedop, int, semid, struct sembuf *, tsops,
794               unsigned, nsops, const struct timespec *, timeout)
795 #endif
796 #if defined(TARGET_NR_mq_open) && defined(__NR_mq_open)
797 safe_syscall5(int, mq_timedsend, int, mqdes, const char *, msg_ptr,
798               size_t, len, unsigned, prio, const struct timespec *, timeout)
799 safe_syscall5(int, mq_timedreceive, int, mqdes, char *, msg_ptr,
800               size_t, len, unsigned *, prio, const struct timespec *, timeout)
801 #endif
802 /* We do ioctl like this rather than via safe_syscall3 to preserve the
803  * "third argument might be integer or pointer or not present" behaviour of
804  * the libc function.
805  */
806 #define safe_ioctl(...) safe_syscall(__NR_ioctl, __VA_ARGS__)
807 /* Similarly for fcntl. Note that callers must always:
808  *  pass the F_GETLK64 etc constants rather than the unsuffixed F_GETLK
809  *  use the flock64 struct rather than unsuffixed flock
810  * This will then work and use a 64-bit offset for both 32-bit and 64-bit hosts.
811  */
812 #ifdef __NR_fcntl64
813 #define safe_fcntl(...) safe_syscall(__NR_fcntl64, __VA_ARGS__)
814 #else
815 #define safe_fcntl(...) safe_syscall(__NR_fcntl, __VA_ARGS__)
816 #endif
817 
818 static inline int host_to_target_sock_type(int host_type)
819 {
820     int target_type;
821 
822     switch (host_type & 0xf /* SOCK_TYPE_MASK */) {
823     case SOCK_DGRAM:
824         target_type = TARGET_SOCK_DGRAM;
825         break;
826     case SOCK_STREAM:
827         target_type = TARGET_SOCK_STREAM;
828         break;
829     default:
830         target_type = host_type & 0xf /* SOCK_TYPE_MASK */;
831         break;
832     }
833 
834 #if defined(SOCK_CLOEXEC)
835     if (host_type & SOCK_CLOEXEC) {
836         target_type |= TARGET_SOCK_CLOEXEC;
837     }
838 #endif
839 
840 #if defined(SOCK_NONBLOCK)
841     if (host_type & SOCK_NONBLOCK) {
842         target_type |= TARGET_SOCK_NONBLOCK;
843     }
844 #endif
845 
846     return target_type;
847 }
848 
849 static abi_ulong target_brk;
850 static abi_ulong target_original_brk;
851 static abi_ulong brk_page;
852 
853 void target_set_brk(abi_ulong new_brk)
854 {
855     target_original_brk = target_brk = HOST_PAGE_ALIGN(new_brk);
856     brk_page = HOST_PAGE_ALIGN(target_brk);
857 }
858 
859 //#define DEBUGF_BRK(message, args...) do { fprintf(stderr, (message), ## args); } while (0)
860 #define DEBUGF_BRK(message, args...)
861 
862 /* do_brk() must return target values and target errnos. */
863 abi_long do_brk(abi_ulong new_brk)
864 {
865     abi_long mapped_addr;
866     abi_ulong new_alloc_size;
867 
868     DEBUGF_BRK("do_brk(" TARGET_ABI_FMT_lx ") -> ", new_brk);
869 
870     if (!new_brk) {
871         DEBUGF_BRK(TARGET_ABI_FMT_lx " (!new_brk)\n", target_brk);
872         return target_brk;
873     }
874     if (new_brk < target_original_brk) {
875         DEBUGF_BRK(TARGET_ABI_FMT_lx " (new_brk < target_original_brk)\n",
876                    target_brk);
877         return target_brk;
878     }
879 
880     /* If the new brk is less than the highest page reserved to the
881      * target heap allocation, set it and we're almost done...  */
882     if (new_brk <= brk_page) {
883         /* Heap contents are initialized to zero, as for anonymous
884          * mapped pages.  */
885         if (new_brk > target_brk) {
886             memset(g2h(target_brk), 0, new_brk - target_brk);
887         }
888 	target_brk = new_brk;
889         DEBUGF_BRK(TARGET_ABI_FMT_lx " (new_brk <= brk_page)\n", target_brk);
890 	return target_brk;
891     }
892 
893     /* We need to allocate more memory after the brk... Note that
894      * we don't use MAP_FIXED because that will map over the top of
895      * any existing mapping (like the one with the host libc or qemu
896      * itself); instead we treat "mapped but at wrong address" as
897      * a failure and unmap again.
898      */
899     new_alloc_size = HOST_PAGE_ALIGN(new_brk - brk_page);
900     mapped_addr = get_errno(target_mmap(brk_page, new_alloc_size,
901                                         PROT_READ|PROT_WRITE,
902                                         MAP_ANON|MAP_PRIVATE, 0, 0));
903 
904     if (mapped_addr == brk_page) {
905         /* Heap contents are initialized to zero, as for anonymous
906          * mapped pages.  Technically the new pages are already
907          * initialized to zero since they *are* anonymous mapped
908          * pages, however we have to take care with the contents that
909          * come from the remaining part of the previous page: it may
910          * contains garbage data due to a previous heap usage (grown
911          * then shrunken).  */
912         memset(g2h(target_brk), 0, brk_page - target_brk);
913 
914         target_brk = new_brk;
915         brk_page = HOST_PAGE_ALIGN(target_brk);
916         DEBUGF_BRK(TARGET_ABI_FMT_lx " (mapped_addr == brk_page)\n",
917             target_brk);
918         return target_brk;
919     } else if (mapped_addr != -1) {
920         /* Mapped but at wrong address, meaning there wasn't actually
921          * enough space for this brk.
922          */
923         target_munmap(mapped_addr, new_alloc_size);
924         mapped_addr = -1;
925         DEBUGF_BRK(TARGET_ABI_FMT_lx " (mapped_addr != -1)\n", target_brk);
926     }
927     else {
928         DEBUGF_BRK(TARGET_ABI_FMT_lx " (otherwise)\n", target_brk);
929     }
930 
931 #if defined(TARGET_ALPHA)
932     /* We (partially) emulate OSF/1 on Alpha, which requires we
933        return a proper errno, not an unchanged brk value.  */
934     return -TARGET_ENOMEM;
935 #endif
936     /* For everything else, return the previous break. */
937     return target_brk;
938 }
939 
940 static inline abi_long copy_from_user_fdset(fd_set *fds,
941                                             abi_ulong target_fds_addr,
942                                             int n)
943 {
944     int i, nw, j, k;
945     abi_ulong b, *target_fds;
946 
947     nw = DIV_ROUND_UP(n, TARGET_ABI_BITS);
948     if (!(target_fds = lock_user(VERIFY_READ,
949                                  target_fds_addr,
950                                  sizeof(abi_ulong) * nw,
951                                  1)))
952         return -TARGET_EFAULT;
953 
954     FD_ZERO(fds);
955     k = 0;
956     for (i = 0; i < nw; i++) {
957         /* grab the abi_ulong */
958         __get_user(b, &target_fds[i]);
959         for (j = 0; j < TARGET_ABI_BITS; j++) {
960             /* check the bit inside the abi_ulong */
961             if ((b >> j) & 1)
962                 FD_SET(k, fds);
963             k++;
964         }
965     }
966 
967     unlock_user(target_fds, target_fds_addr, 0);
968 
969     return 0;
970 }
971 
972 static inline abi_ulong copy_from_user_fdset_ptr(fd_set *fds, fd_set **fds_ptr,
973                                                  abi_ulong target_fds_addr,
974                                                  int n)
975 {
976     if (target_fds_addr) {
977         if (copy_from_user_fdset(fds, target_fds_addr, n))
978             return -TARGET_EFAULT;
979         *fds_ptr = fds;
980     } else {
981         *fds_ptr = NULL;
982     }
983     return 0;
984 }
985 
986 static inline abi_long copy_to_user_fdset(abi_ulong target_fds_addr,
987                                           const fd_set *fds,
988                                           int n)
989 {
990     int i, nw, j, k;
991     abi_long v;
992     abi_ulong *target_fds;
993 
994     nw = DIV_ROUND_UP(n, TARGET_ABI_BITS);
995     if (!(target_fds = lock_user(VERIFY_WRITE,
996                                  target_fds_addr,
997                                  sizeof(abi_ulong) * nw,
998                                  0)))
999         return -TARGET_EFAULT;
1000 
1001     k = 0;
1002     for (i = 0; i < nw; i++) {
1003         v = 0;
1004         for (j = 0; j < TARGET_ABI_BITS; j++) {
1005             v |= ((abi_ulong)(FD_ISSET(k, fds) != 0) << j);
1006             k++;
1007         }
1008         __put_user(v, &target_fds[i]);
1009     }
1010 
1011     unlock_user(target_fds, target_fds_addr, sizeof(abi_ulong) * nw);
1012 
1013     return 0;
1014 }
1015 
1016 #if defined(__alpha__)
1017 #define HOST_HZ 1024
1018 #else
1019 #define HOST_HZ 100
1020 #endif
1021 
1022 static inline abi_long host_to_target_clock_t(long ticks)
1023 {
1024 #if HOST_HZ == TARGET_HZ
1025     return ticks;
1026 #else
1027     return ((int64_t)ticks * TARGET_HZ) / HOST_HZ;
1028 #endif
1029 }
1030 
1031 static inline abi_long host_to_target_rusage(abi_ulong target_addr,
1032                                              const struct rusage *rusage)
1033 {
1034     struct target_rusage *target_rusage;
1035 
1036     if (!lock_user_struct(VERIFY_WRITE, target_rusage, target_addr, 0))
1037         return -TARGET_EFAULT;
1038     target_rusage->ru_utime.tv_sec = tswapal(rusage->ru_utime.tv_sec);
1039     target_rusage->ru_utime.tv_usec = tswapal(rusage->ru_utime.tv_usec);
1040     target_rusage->ru_stime.tv_sec = tswapal(rusage->ru_stime.tv_sec);
1041     target_rusage->ru_stime.tv_usec = tswapal(rusage->ru_stime.tv_usec);
1042     target_rusage->ru_maxrss = tswapal(rusage->ru_maxrss);
1043     target_rusage->ru_ixrss = tswapal(rusage->ru_ixrss);
1044     target_rusage->ru_idrss = tswapal(rusage->ru_idrss);
1045     target_rusage->ru_isrss = tswapal(rusage->ru_isrss);
1046     target_rusage->ru_minflt = tswapal(rusage->ru_minflt);
1047     target_rusage->ru_majflt = tswapal(rusage->ru_majflt);
1048     target_rusage->ru_nswap = tswapal(rusage->ru_nswap);
1049     target_rusage->ru_inblock = tswapal(rusage->ru_inblock);
1050     target_rusage->ru_oublock = tswapal(rusage->ru_oublock);
1051     target_rusage->ru_msgsnd = tswapal(rusage->ru_msgsnd);
1052     target_rusage->ru_msgrcv = tswapal(rusage->ru_msgrcv);
1053     target_rusage->ru_nsignals = tswapal(rusage->ru_nsignals);
1054     target_rusage->ru_nvcsw = tswapal(rusage->ru_nvcsw);
1055     target_rusage->ru_nivcsw = tswapal(rusage->ru_nivcsw);
1056     unlock_user_struct(target_rusage, target_addr, 1);
1057 
1058     return 0;
1059 }
1060 
1061 static inline rlim_t target_to_host_rlim(abi_ulong target_rlim)
1062 {
1063     abi_ulong target_rlim_swap;
1064     rlim_t result;
1065 
1066     target_rlim_swap = tswapal(target_rlim);
1067     if (target_rlim_swap == TARGET_RLIM_INFINITY)
1068         return RLIM_INFINITY;
1069 
1070     result = target_rlim_swap;
1071     if (target_rlim_swap != (rlim_t)result)
1072         return RLIM_INFINITY;
1073 
1074     return result;
1075 }
1076 
1077 static inline abi_ulong host_to_target_rlim(rlim_t rlim)
1078 {
1079     abi_ulong target_rlim_swap;
1080     abi_ulong result;
1081 
1082     if (rlim == RLIM_INFINITY || rlim != (abi_long)rlim)
1083         target_rlim_swap = TARGET_RLIM_INFINITY;
1084     else
1085         target_rlim_swap = rlim;
1086     result = tswapal(target_rlim_swap);
1087 
1088     return result;
1089 }
1090 
1091 static inline int target_to_host_resource(int code)
1092 {
1093     switch (code) {
1094     case TARGET_RLIMIT_AS:
1095         return RLIMIT_AS;
1096     case TARGET_RLIMIT_CORE:
1097         return RLIMIT_CORE;
1098     case TARGET_RLIMIT_CPU:
1099         return RLIMIT_CPU;
1100     case TARGET_RLIMIT_DATA:
1101         return RLIMIT_DATA;
1102     case TARGET_RLIMIT_FSIZE:
1103         return RLIMIT_FSIZE;
1104     case TARGET_RLIMIT_LOCKS:
1105         return RLIMIT_LOCKS;
1106     case TARGET_RLIMIT_MEMLOCK:
1107         return RLIMIT_MEMLOCK;
1108     case TARGET_RLIMIT_MSGQUEUE:
1109         return RLIMIT_MSGQUEUE;
1110     case TARGET_RLIMIT_NICE:
1111         return RLIMIT_NICE;
1112     case TARGET_RLIMIT_NOFILE:
1113         return RLIMIT_NOFILE;
1114     case TARGET_RLIMIT_NPROC:
1115         return RLIMIT_NPROC;
1116     case TARGET_RLIMIT_RSS:
1117         return RLIMIT_RSS;
1118     case TARGET_RLIMIT_RTPRIO:
1119         return RLIMIT_RTPRIO;
1120     case TARGET_RLIMIT_SIGPENDING:
1121         return RLIMIT_SIGPENDING;
1122     case TARGET_RLIMIT_STACK:
1123         return RLIMIT_STACK;
1124     default:
1125         return code;
1126     }
1127 }
1128 
1129 static inline abi_long copy_from_user_timeval(struct timeval *tv,
1130                                               abi_ulong target_tv_addr)
1131 {
1132     struct target_timeval *target_tv;
1133 
1134     if (!lock_user_struct(VERIFY_READ, target_tv, target_tv_addr, 1)) {
1135         return -TARGET_EFAULT;
1136     }
1137 
1138     __get_user(tv->tv_sec, &target_tv->tv_sec);
1139     __get_user(tv->tv_usec, &target_tv->tv_usec);
1140 
1141     unlock_user_struct(target_tv, target_tv_addr, 0);
1142 
1143     return 0;
1144 }
1145 
1146 static inline abi_long copy_to_user_timeval(abi_ulong target_tv_addr,
1147                                             const struct timeval *tv)
1148 {
1149     struct target_timeval *target_tv;
1150 
1151     if (!lock_user_struct(VERIFY_WRITE, target_tv, target_tv_addr, 0)) {
1152         return -TARGET_EFAULT;
1153     }
1154 
1155     __put_user(tv->tv_sec, &target_tv->tv_sec);
1156     __put_user(tv->tv_usec, &target_tv->tv_usec);
1157 
1158     unlock_user_struct(target_tv, target_tv_addr, 1);
1159 
1160     return 0;
1161 }
1162 
1163 static inline abi_long copy_to_user_timeval64(abi_ulong target_tv_addr,
1164                                              const struct timeval *tv)
1165 {
1166     struct target__kernel_sock_timeval *target_tv;
1167 
1168     if (!lock_user_struct(VERIFY_WRITE, target_tv, target_tv_addr, 0)) {
1169         return -TARGET_EFAULT;
1170     }
1171 
1172     __put_user(tv->tv_sec, &target_tv->tv_sec);
1173     __put_user(tv->tv_usec, &target_tv->tv_usec);
1174 
1175     unlock_user_struct(target_tv, target_tv_addr, 1);
1176 
1177     return 0;
1178 }
1179 
1180 static inline abi_long target_to_host_timespec(struct timespec *host_ts,
1181                                                abi_ulong target_addr)
1182 {
1183     struct target_timespec *target_ts;
1184 
1185     if (!lock_user_struct(VERIFY_READ, target_ts, target_addr, 1)) {
1186         return -TARGET_EFAULT;
1187     }
1188     __get_user(host_ts->tv_sec, &target_ts->tv_sec);
1189     __get_user(host_ts->tv_nsec, &target_ts->tv_nsec);
1190     unlock_user_struct(target_ts, target_addr, 0);
1191     return 0;
1192 }
1193 
1194 static inline abi_long host_to_target_timespec(abi_ulong target_addr,
1195                                                struct timespec *host_ts)
1196 {
1197     struct target_timespec *target_ts;
1198 
1199     if (!lock_user_struct(VERIFY_WRITE, target_ts, target_addr, 0)) {
1200         return -TARGET_EFAULT;
1201     }
1202     __put_user(host_ts->tv_sec, &target_ts->tv_sec);
1203     __put_user(host_ts->tv_nsec, &target_ts->tv_nsec);
1204     unlock_user_struct(target_ts, target_addr, 1);
1205     return 0;
1206 }
1207 
1208 static inline abi_long host_to_target_timespec64(abi_ulong target_addr,
1209                                                  struct timespec *host_ts)
1210 {
1211     struct target__kernel_timespec *target_ts;
1212 
1213     if (!lock_user_struct(VERIFY_WRITE, target_ts, target_addr, 0)) {
1214         return -TARGET_EFAULT;
1215     }
1216     __put_user(host_ts->tv_sec, &target_ts->tv_sec);
1217     __put_user(host_ts->tv_nsec, &target_ts->tv_nsec);
1218     unlock_user_struct(target_ts, target_addr, 1);
1219     return 0;
1220 }
1221 
1222 static inline abi_long copy_from_user_timezone(struct timezone *tz,
1223                                                abi_ulong target_tz_addr)
1224 {
1225     struct target_timezone *target_tz;
1226 
1227     if (!lock_user_struct(VERIFY_READ, target_tz, target_tz_addr, 1)) {
1228         return -TARGET_EFAULT;
1229     }
1230 
1231     __get_user(tz->tz_minuteswest, &target_tz->tz_minuteswest);
1232     __get_user(tz->tz_dsttime, &target_tz->tz_dsttime);
1233 
1234     unlock_user_struct(target_tz, target_tz_addr, 0);
1235 
1236     return 0;
1237 }
1238 
1239 #if defined(TARGET_NR_mq_open) && defined(__NR_mq_open)
1240 #include <mqueue.h>
1241 
1242 static inline abi_long copy_from_user_mq_attr(struct mq_attr *attr,
1243                                               abi_ulong target_mq_attr_addr)
1244 {
1245     struct target_mq_attr *target_mq_attr;
1246 
1247     if (!lock_user_struct(VERIFY_READ, target_mq_attr,
1248                           target_mq_attr_addr, 1))
1249         return -TARGET_EFAULT;
1250 
1251     __get_user(attr->mq_flags, &target_mq_attr->mq_flags);
1252     __get_user(attr->mq_maxmsg, &target_mq_attr->mq_maxmsg);
1253     __get_user(attr->mq_msgsize, &target_mq_attr->mq_msgsize);
1254     __get_user(attr->mq_curmsgs, &target_mq_attr->mq_curmsgs);
1255 
1256     unlock_user_struct(target_mq_attr, target_mq_attr_addr, 0);
1257 
1258     return 0;
1259 }
1260 
1261 static inline abi_long copy_to_user_mq_attr(abi_ulong target_mq_attr_addr,
1262                                             const struct mq_attr *attr)
1263 {
1264     struct target_mq_attr *target_mq_attr;
1265 
1266     if (!lock_user_struct(VERIFY_WRITE, target_mq_attr,
1267                           target_mq_attr_addr, 0))
1268         return -TARGET_EFAULT;
1269 
1270     __put_user(attr->mq_flags, &target_mq_attr->mq_flags);
1271     __put_user(attr->mq_maxmsg, &target_mq_attr->mq_maxmsg);
1272     __put_user(attr->mq_msgsize, &target_mq_attr->mq_msgsize);
1273     __put_user(attr->mq_curmsgs, &target_mq_attr->mq_curmsgs);
1274 
1275     unlock_user_struct(target_mq_attr, target_mq_attr_addr, 1);
1276 
1277     return 0;
1278 }
1279 #endif
1280 
1281 #if defined(TARGET_NR_select) || defined(TARGET_NR__newselect)
1282 /* do_select() must return target values and target errnos. */
1283 static abi_long do_select(int n,
1284                           abi_ulong rfd_addr, abi_ulong wfd_addr,
1285                           abi_ulong efd_addr, abi_ulong target_tv_addr)
1286 {
1287     fd_set rfds, wfds, efds;
1288     fd_set *rfds_ptr, *wfds_ptr, *efds_ptr;
1289     struct timeval tv;
1290     struct timespec ts, *ts_ptr;
1291     abi_long ret;
1292 
1293     ret = copy_from_user_fdset_ptr(&rfds, &rfds_ptr, rfd_addr, n);
1294     if (ret) {
1295         return ret;
1296     }
1297     ret = copy_from_user_fdset_ptr(&wfds, &wfds_ptr, wfd_addr, n);
1298     if (ret) {
1299         return ret;
1300     }
1301     ret = copy_from_user_fdset_ptr(&efds, &efds_ptr, efd_addr, n);
1302     if (ret) {
1303         return ret;
1304     }
1305 
1306     if (target_tv_addr) {
1307         if (copy_from_user_timeval(&tv, target_tv_addr))
1308             return -TARGET_EFAULT;
1309         ts.tv_sec = tv.tv_sec;
1310         ts.tv_nsec = tv.tv_usec * 1000;
1311         ts_ptr = &ts;
1312     } else {
1313         ts_ptr = NULL;
1314     }
1315 
1316     ret = get_errno(safe_pselect6(n, rfds_ptr, wfds_ptr, efds_ptr,
1317                                   ts_ptr, NULL));
1318 
1319     if (!is_error(ret)) {
1320         if (rfd_addr && copy_to_user_fdset(rfd_addr, &rfds, n))
1321             return -TARGET_EFAULT;
1322         if (wfd_addr && copy_to_user_fdset(wfd_addr, &wfds, n))
1323             return -TARGET_EFAULT;
1324         if (efd_addr && copy_to_user_fdset(efd_addr, &efds, n))
1325             return -TARGET_EFAULT;
1326 
1327         if (target_tv_addr) {
1328             tv.tv_sec = ts.tv_sec;
1329             tv.tv_usec = ts.tv_nsec / 1000;
1330             if (copy_to_user_timeval(target_tv_addr, &tv)) {
1331                 return -TARGET_EFAULT;
1332             }
1333         }
1334     }
1335 
1336     return ret;
1337 }
1338 
1339 #if defined(TARGET_WANT_OLD_SYS_SELECT)
1340 static abi_long do_old_select(abi_ulong arg1)
1341 {
1342     struct target_sel_arg_struct *sel;
1343     abi_ulong inp, outp, exp, tvp;
1344     long nsel;
1345 
1346     if (!lock_user_struct(VERIFY_READ, sel, arg1, 1)) {
1347         return -TARGET_EFAULT;
1348     }
1349 
1350     nsel = tswapal(sel->n);
1351     inp = tswapal(sel->inp);
1352     outp = tswapal(sel->outp);
1353     exp = tswapal(sel->exp);
1354     tvp = tswapal(sel->tvp);
1355 
1356     unlock_user_struct(sel, arg1, 0);
1357 
1358     return do_select(nsel, inp, outp, exp, tvp);
1359 }
1360 #endif
1361 #endif
1362 
1363 static abi_long do_pipe2(int host_pipe[], int flags)
1364 {
1365 #ifdef CONFIG_PIPE2
1366     return pipe2(host_pipe, flags);
1367 #else
1368     return -ENOSYS;
1369 #endif
1370 }
1371 
1372 static abi_long do_pipe(void *cpu_env, abi_ulong pipedes,
1373                         int flags, int is_pipe2)
1374 {
1375     int host_pipe[2];
1376     abi_long ret;
1377     ret = flags ? do_pipe2(host_pipe, flags) : pipe(host_pipe);
1378 
1379     if (is_error(ret))
1380         return get_errno(ret);
1381 
1382     /* Several targets have special calling conventions for the original
1383        pipe syscall, but didn't replicate this into the pipe2 syscall.  */
1384     if (!is_pipe2) {
1385 #if defined(TARGET_ALPHA)
1386         ((CPUAlphaState *)cpu_env)->ir[IR_A4] = host_pipe[1];
1387         return host_pipe[0];
1388 #elif defined(TARGET_MIPS)
1389         ((CPUMIPSState*)cpu_env)->active_tc.gpr[3] = host_pipe[1];
1390         return host_pipe[0];
1391 #elif defined(TARGET_SH4)
1392         ((CPUSH4State*)cpu_env)->gregs[1] = host_pipe[1];
1393         return host_pipe[0];
1394 #elif defined(TARGET_SPARC)
1395         ((CPUSPARCState*)cpu_env)->regwptr[1] = host_pipe[1];
1396         return host_pipe[0];
1397 #endif
1398     }
1399 
1400     if (put_user_s32(host_pipe[0], pipedes)
1401         || put_user_s32(host_pipe[1], pipedes + sizeof(host_pipe[0])))
1402         return -TARGET_EFAULT;
1403     return get_errno(ret);
1404 }
1405 
1406 static inline abi_long target_to_host_ip_mreq(struct ip_mreqn *mreqn,
1407                                               abi_ulong target_addr,
1408                                               socklen_t len)
1409 {
1410     struct target_ip_mreqn *target_smreqn;
1411 
1412     target_smreqn = lock_user(VERIFY_READ, target_addr, len, 1);
1413     if (!target_smreqn)
1414         return -TARGET_EFAULT;
1415     mreqn->imr_multiaddr.s_addr = target_smreqn->imr_multiaddr.s_addr;
1416     mreqn->imr_address.s_addr = target_smreqn->imr_address.s_addr;
1417     if (len == sizeof(struct target_ip_mreqn))
1418         mreqn->imr_ifindex = tswapal(target_smreqn->imr_ifindex);
1419     unlock_user(target_smreqn, target_addr, 0);
1420 
1421     return 0;
1422 }
1423 
1424 static inline abi_long target_to_host_sockaddr(int fd, struct sockaddr *addr,
1425                                                abi_ulong target_addr,
1426                                                socklen_t len)
1427 {
1428     const socklen_t unix_maxlen = sizeof (struct sockaddr_un);
1429     sa_family_t sa_family;
1430     struct target_sockaddr *target_saddr;
1431 
1432     if (fd_trans_target_to_host_addr(fd)) {
1433         return fd_trans_target_to_host_addr(fd)(addr, target_addr, len);
1434     }
1435 
1436     target_saddr = lock_user(VERIFY_READ, target_addr, len, 1);
1437     if (!target_saddr)
1438         return -TARGET_EFAULT;
1439 
1440     sa_family = tswap16(target_saddr->sa_family);
1441 
1442     /* Oops. The caller might send a incomplete sun_path; sun_path
1443      * must be terminated by \0 (see the manual page), but
1444      * unfortunately it is quite common to specify sockaddr_un
1445      * length as "strlen(x->sun_path)" while it should be
1446      * "strlen(...) + 1". We'll fix that here if needed.
1447      * Linux kernel has a similar feature.
1448      */
1449 
1450     if (sa_family == AF_UNIX) {
1451         if (len < unix_maxlen && len > 0) {
1452             char *cp = (char*)target_saddr;
1453 
1454             if ( cp[len-1] && !cp[len] )
1455                 len++;
1456         }
1457         if (len > unix_maxlen)
1458             len = unix_maxlen;
1459     }
1460 
1461     memcpy(addr, target_saddr, len);
1462     addr->sa_family = sa_family;
1463     if (sa_family == AF_NETLINK) {
1464         struct sockaddr_nl *nladdr;
1465 
1466         nladdr = (struct sockaddr_nl *)addr;
1467         nladdr->nl_pid = tswap32(nladdr->nl_pid);
1468         nladdr->nl_groups = tswap32(nladdr->nl_groups);
1469     } else if (sa_family == AF_PACKET) {
1470 	struct target_sockaddr_ll *lladdr;
1471 
1472 	lladdr = (struct target_sockaddr_ll *)addr;
1473 	lladdr->sll_ifindex = tswap32(lladdr->sll_ifindex);
1474 	lladdr->sll_hatype = tswap16(lladdr->sll_hatype);
1475     }
1476     unlock_user(target_saddr, target_addr, 0);
1477 
1478     return 0;
1479 }
1480 
1481 static inline abi_long host_to_target_sockaddr(abi_ulong target_addr,
1482                                                struct sockaddr *addr,
1483                                                socklen_t len)
1484 {
1485     struct target_sockaddr *target_saddr;
1486 
1487     if (len == 0) {
1488         return 0;
1489     }
1490     assert(addr);
1491 
1492     target_saddr = lock_user(VERIFY_WRITE, target_addr, len, 0);
1493     if (!target_saddr)
1494         return -TARGET_EFAULT;
1495     memcpy(target_saddr, addr, len);
1496     if (len >= offsetof(struct target_sockaddr, sa_family) +
1497         sizeof(target_saddr->sa_family)) {
1498         target_saddr->sa_family = tswap16(addr->sa_family);
1499     }
1500     if (addr->sa_family == AF_NETLINK &&
1501         len >= sizeof(struct target_sockaddr_nl)) {
1502         struct target_sockaddr_nl *target_nl =
1503                (struct target_sockaddr_nl *)target_saddr;
1504         target_nl->nl_pid = tswap32(target_nl->nl_pid);
1505         target_nl->nl_groups = tswap32(target_nl->nl_groups);
1506     } else if (addr->sa_family == AF_PACKET) {
1507         struct sockaddr_ll *target_ll = (struct sockaddr_ll *)target_saddr;
1508         target_ll->sll_ifindex = tswap32(target_ll->sll_ifindex);
1509         target_ll->sll_hatype = tswap16(target_ll->sll_hatype);
1510     } else if (addr->sa_family == AF_INET6 &&
1511                len >= sizeof(struct target_sockaddr_in6)) {
1512         struct target_sockaddr_in6 *target_in6 =
1513                (struct target_sockaddr_in6 *)target_saddr;
1514         target_in6->sin6_scope_id = tswap16(target_in6->sin6_scope_id);
1515     }
1516     unlock_user(target_saddr, target_addr, len);
1517 
1518     return 0;
1519 }
1520 
1521 static inline abi_long target_to_host_cmsg(struct msghdr *msgh,
1522                                            struct target_msghdr *target_msgh)
1523 {
1524     struct cmsghdr *cmsg = CMSG_FIRSTHDR(msgh);
1525     abi_long msg_controllen;
1526     abi_ulong target_cmsg_addr;
1527     struct target_cmsghdr *target_cmsg, *target_cmsg_start;
1528     socklen_t space = 0;
1529 
1530     msg_controllen = tswapal(target_msgh->msg_controllen);
1531     if (msg_controllen < sizeof (struct target_cmsghdr))
1532         goto the_end;
1533     target_cmsg_addr = tswapal(target_msgh->msg_control);
1534     target_cmsg = lock_user(VERIFY_READ, target_cmsg_addr, msg_controllen, 1);
1535     target_cmsg_start = target_cmsg;
1536     if (!target_cmsg)
1537         return -TARGET_EFAULT;
1538 
1539     while (cmsg && target_cmsg) {
1540         void *data = CMSG_DATA(cmsg);
1541         void *target_data = TARGET_CMSG_DATA(target_cmsg);
1542 
1543         int len = tswapal(target_cmsg->cmsg_len)
1544             - sizeof(struct target_cmsghdr);
1545 
1546         space += CMSG_SPACE(len);
1547         if (space > msgh->msg_controllen) {
1548             space -= CMSG_SPACE(len);
1549             /* This is a QEMU bug, since we allocated the payload
1550              * area ourselves (unlike overflow in host-to-target
1551              * conversion, which is just the guest giving us a buffer
1552              * that's too small). It can't happen for the payload types
1553              * we currently support; if it becomes an issue in future
1554              * we would need to improve our allocation strategy to
1555              * something more intelligent than "twice the size of the
1556              * target buffer we're reading from".
1557              */
1558             gemu_log("Host cmsg overflow\n");
1559             break;
1560         }
1561 
1562         if (tswap32(target_cmsg->cmsg_level) == TARGET_SOL_SOCKET) {
1563             cmsg->cmsg_level = SOL_SOCKET;
1564         } else {
1565             cmsg->cmsg_level = tswap32(target_cmsg->cmsg_level);
1566         }
1567         cmsg->cmsg_type = tswap32(target_cmsg->cmsg_type);
1568         cmsg->cmsg_len = CMSG_LEN(len);
1569 
1570         if (cmsg->cmsg_level == SOL_SOCKET && cmsg->cmsg_type == SCM_RIGHTS) {
1571             int *fd = (int *)data;
1572             int *target_fd = (int *)target_data;
1573             int i, numfds = len / sizeof(int);
1574 
1575             for (i = 0; i < numfds; i++) {
1576                 __get_user(fd[i], target_fd + i);
1577             }
1578         } else if (cmsg->cmsg_level == SOL_SOCKET
1579                &&  cmsg->cmsg_type == SCM_CREDENTIALS) {
1580             struct ucred *cred = (struct ucred *)data;
1581             struct target_ucred *target_cred =
1582                 (struct target_ucred *)target_data;
1583 
1584             __get_user(cred->pid, &target_cred->pid);
1585             __get_user(cred->uid, &target_cred->uid);
1586             __get_user(cred->gid, &target_cred->gid);
1587         } else {
1588             gemu_log("Unsupported ancillary data: %d/%d\n",
1589                                         cmsg->cmsg_level, cmsg->cmsg_type);
1590             memcpy(data, target_data, len);
1591         }
1592 
1593         cmsg = CMSG_NXTHDR(msgh, cmsg);
1594         target_cmsg = TARGET_CMSG_NXTHDR(target_msgh, target_cmsg,
1595                                          target_cmsg_start);
1596     }
1597     unlock_user(target_cmsg, target_cmsg_addr, 0);
1598  the_end:
1599     msgh->msg_controllen = space;
1600     return 0;
1601 }
1602 
1603 static inline abi_long host_to_target_cmsg(struct target_msghdr *target_msgh,
1604                                            struct msghdr *msgh)
1605 {
1606     struct cmsghdr *cmsg = CMSG_FIRSTHDR(msgh);
1607     abi_long msg_controllen;
1608     abi_ulong target_cmsg_addr;
1609     struct target_cmsghdr *target_cmsg, *target_cmsg_start;
1610     socklen_t space = 0;
1611 
1612     msg_controllen = tswapal(target_msgh->msg_controllen);
1613     if (msg_controllen < sizeof (struct target_cmsghdr))
1614         goto the_end;
1615     target_cmsg_addr = tswapal(target_msgh->msg_control);
1616     target_cmsg = lock_user(VERIFY_WRITE, target_cmsg_addr, msg_controllen, 0);
1617     target_cmsg_start = target_cmsg;
1618     if (!target_cmsg)
1619         return -TARGET_EFAULT;
1620 
1621     while (cmsg && target_cmsg) {
1622         void *data = CMSG_DATA(cmsg);
1623         void *target_data = TARGET_CMSG_DATA(target_cmsg);
1624 
1625         int len = cmsg->cmsg_len - sizeof(struct cmsghdr);
1626         int tgt_len, tgt_space;
1627 
1628         /* We never copy a half-header but may copy half-data;
1629          * this is Linux's behaviour in put_cmsg(). Note that
1630          * truncation here is a guest problem (which we report
1631          * to the guest via the CTRUNC bit), unlike truncation
1632          * in target_to_host_cmsg, which is a QEMU bug.
1633          */
1634         if (msg_controllen < sizeof(struct target_cmsghdr)) {
1635             target_msgh->msg_flags |= tswap32(MSG_CTRUNC);
1636             break;
1637         }
1638 
1639         if (cmsg->cmsg_level == SOL_SOCKET) {
1640             target_cmsg->cmsg_level = tswap32(TARGET_SOL_SOCKET);
1641         } else {
1642             target_cmsg->cmsg_level = tswap32(cmsg->cmsg_level);
1643         }
1644         target_cmsg->cmsg_type = tswap32(cmsg->cmsg_type);
1645 
1646         /* Payload types which need a different size of payload on
1647          * the target must adjust tgt_len here.
1648          */
1649         tgt_len = len;
1650         switch (cmsg->cmsg_level) {
1651         case SOL_SOCKET:
1652             switch (cmsg->cmsg_type) {
1653             case SO_TIMESTAMP:
1654                 tgt_len = sizeof(struct target_timeval);
1655                 break;
1656             default:
1657                 break;
1658             }
1659             break;
1660         default:
1661             break;
1662         }
1663 
1664         if (msg_controllen < TARGET_CMSG_LEN(tgt_len)) {
1665             target_msgh->msg_flags |= tswap32(MSG_CTRUNC);
1666             tgt_len = msg_controllen - sizeof(struct target_cmsghdr);
1667         }
1668 
1669         /* We must now copy-and-convert len bytes of payload
1670          * into tgt_len bytes of destination space. Bear in mind
1671          * that in both source and destination we may be dealing
1672          * with a truncated value!
1673          */
1674         switch (cmsg->cmsg_level) {
1675         case SOL_SOCKET:
1676             switch (cmsg->cmsg_type) {
1677             case SCM_RIGHTS:
1678             {
1679                 int *fd = (int *)data;
1680                 int *target_fd = (int *)target_data;
1681                 int i, numfds = tgt_len / sizeof(int);
1682 
1683                 for (i = 0; i < numfds; i++) {
1684                     __put_user(fd[i], target_fd + i);
1685                 }
1686                 break;
1687             }
1688             case SO_TIMESTAMP:
1689             {
1690                 struct timeval *tv = (struct timeval *)data;
1691                 struct target_timeval *target_tv =
1692                     (struct target_timeval *)target_data;
1693 
1694                 if (len != sizeof(struct timeval) ||
1695                     tgt_len != sizeof(struct target_timeval)) {
1696                     goto unimplemented;
1697                 }
1698 
1699                 /* copy struct timeval to target */
1700                 __put_user(tv->tv_sec, &target_tv->tv_sec);
1701                 __put_user(tv->tv_usec, &target_tv->tv_usec);
1702                 break;
1703             }
1704             case SCM_CREDENTIALS:
1705             {
1706                 struct ucred *cred = (struct ucred *)data;
1707                 struct target_ucred *target_cred =
1708                     (struct target_ucred *)target_data;
1709 
1710                 __put_user(cred->pid, &target_cred->pid);
1711                 __put_user(cred->uid, &target_cred->uid);
1712                 __put_user(cred->gid, &target_cred->gid);
1713                 break;
1714             }
1715             default:
1716                 goto unimplemented;
1717             }
1718             break;
1719 
1720         case SOL_IP:
1721             switch (cmsg->cmsg_type) {
1722             case IP_TTL:
1723             {
1724                 uint32_t *v = (uint32_t *)data;
1725                 uint32_t *t_int = (uint32_t *)target_data;
1726 
1727                 if (len != sizeof(uint32_t) ||
1728                     tgt_len != sizeof(uint32_t)) {
1729                     goto unimplemented;
1730                 }
1731                 __put_user(*v, t_int);
1732                 break;
1733             }
1734             case IP_RECVERR:
1735             {
1736                 struct errhdr_t {
1737                    struct sock_extended_err ee;
1738                    struct sockaddr_in offender;
1739                 };
1740                 struct errhdr_t *errh = (struct errhdr_t *)data;
1741                 struct errhdr_t *target_errh =
1742                     (struct errhdr_t *)target_data;
1743 
1744                 if (len != sizeof(struct errhdr_t) ||
1745                     tgt_len != sizeof(struct errhdr_t)) {
1746                     goto unimplemented;
1747                 }
1748                 __put_user(errh->ee.ee_errno, &target_errh->ee.ee_errno);
1749                 __put_user(errh->ee.ee_origin, &target_errh->ee.ee_origin);
1750                 __put_user(errh->ee.ee_type,  &target_errh->ee.ee_type);
1751                 __put_user(errh->ee.ee_code, &target_errh->ee.ee_code);
1752                 __put_user(errh->ee.ee_pad, &target_errh->ee.ee_pad);
1753                 __put_user(errh->ee.ee_info, &target_errh->ee.ee_info);
1754                 __put_user(errh->ee.ee_data, &target_errh->ee.ee_data);
1755                 host_to_target_sockaddr((unsigned long) &target_errh->offender,
1756                     (void *) &errh->offender, sizeof(errh->offender));
1757                 break;
1758             }
1759             default:
1760                 goto unimplemented;
1761             }
1762             break;
1763 
1764         case SOL_IPV6:
1765             switch (cmsg->cmsg_type) {
1766             case IPV6_HOPLIMIT:
1767             {
1768                 uint32_t *v = (uint32_t *)data;
1769                 uint32_t *t_int = (uint32_t *)target_data;
1770 
1771                 if (len != sizeof(uint32_t) ||
1772                     tgt_len != sizeof(uint32_t)) {
1773                     goto unimplemented;
1774                 }
1775                 __put_user(*v, t_int);
1776                 break;
1777             }
1778             case IPV6_RECVERR:
1779             {
1780                 struct errhdr6_t {
1781                    struct sock_extended_err ee;
1782                    struct sockaddr_in6 offender;
1783                 };
1784                 struct errhdr6_t *errh = (struct errhdr6_t *)data;
1785                 struct errhdr6_t *target_errh =
1786                     (struct errhdr6_t *)target_data;
1787 
1788                 if (len != sizeof(struct errhdr6_t) ||
1789                     tgt_len != sizeof(struct errhdr6_t)) {
1790                     goto unimplemented;
1791                 }
1792                 __put_user(errh->ee.ee_errno, &target_errh->ee.ee_errno);
1793                 __put_user(errh->ee.ee_origin, &target_errh->ee.ee_origin);
1794                 __put_user(errh->ee.ee_type,  &target_errh->ee.ee_type);
1795                 __put_user(errh->ee.ee_code, &target_errh->ee.ee_code);
1796                 __put_user(errh->ee.ee_pad, &target_errh->ee.ee_pad);
1797                 __put_user(errh->ee.ee_info, &target_errh->ee.ee_info);
1798                 __put_user(errh->ee.ee_data, &target_errh->ee.ee_data);
1799                 host_to_target_sockaddr((unsigned long) &target_errh->offender,
1800                     (void *) &errh->offender, sizeof(errh->offender));
1801                 break;
1802             }
1803             default:
1804                 goto unimplemented;
1805             }
1806             break;
1807 
1808         default:
1809         unimplemented:
1810             gemu_log("Unsupported ancillary data: %d/%d\n",
1811                                         cmsg->cmsg_level, cmsg->cmsg_type);
1812             memcpy(target_data, data, MIN(len, tgt_len));
1813             if (tgt_len > len) {
1814                 memset(target_data + len, 0, tgt_len - len);
1815             }
1816         }
1817 
1818         target_cmsg->cmsg_len = tswapal(TARGET_CMSG_LEN(tgt_len));
1819         tgt_space = TARGET_CMSG_SPACE(tgt_len);
1820         if (msg_controllen < tgt_space) {
1821             tgt_space = msg_controllen;
1822         }
1823         msg_controllen -= tgt_space;
1824         space += tgt_space;
1825         cmsg = CMSG_NXTHDR(msgh, cmsg);
1826         target_cmsg = TARGET_CMSG_NXTHDR(target_msgh, target_cmsg,
1827                                          target_cmsg_start);
1828     }
1829     unlock_user(target_cmsg, target_cmsg_addr, space);
1830  the_end:
1831     target_msgh->msg_controllen = tswapal(space);
1832     return 0;
1833 }
1834 
1835 /* do_setsockopt() Must return target values and target errnos. */
1836 static abi_long do_setsockopt(int sockfd, int level, int optname,
1837                               abi_ulong optval_addr, socklen_t optlen)
1838 {
1839     abi_long ret;
1840     int val;
1841     struct ip_mreqn *ip_mreq;
1842     struct ip_mreq_source *ip_mreq_source;
1843 
1844     switch(level) {
1845     case SOL_TCP:
1846         /* TCP options all take an 'int' value.  */
1847         if (optlen < sizeof(uint32_t))
1848             return -TARGET_EINVAL;
1849 
1850         if (get_user_u32(val, optval_addr))
1851             return -TARGET_EFAULT;
1852         ret = get_errno(setsockopt(sockfd, level, optname, &val, sizeof(val)));
1853         break;
1854     case SOL_IP:
1855         switch(optname) {
1856         case IP_TOS:
1857         case IP_TTL:
1858         case IP_HDRINCL:
1859         case IP_ROUTER_ALERT:
1860         case IP_RECVOPTS:
1861         case IP_RETOPTS:
1862         case IP_PKTINFO:
1863         case IP_MTU_DISCOVER:
1864         case IP_RECVERR:
1865         case IP_RECVTTL:
1866         case IP_RECVTOS:
1867 #ifdef IP_FREEBIND
1868         case IP_FREEBIND:
1869 #endif
1870         case IP_MULTICAST_TTL:
1871         case IP_MULTICAST_LOOP:
1872             val = 0;
1873             if (optlen >= sizeof(uint32_t)) {
1874                 if (get_user_u32(val, optval_addr))
1875                     return -TARGET_EFAULT;
1876             } else if (optlen >= 1) {
1877                 if (get_user_u8(val, optval_addr))
1878                     return -TARGET_EFAULT;
1879             }
1880             ret = get_errno(setsockopt(sockfd, level, optname, &val, sizeof(val)));
1881             break;
1882         case IP_ADD_MEMBERSHIP:
1883         case IP_DROP_MEMBERSHIP:
1884             if (optlen < sizeof (struct target_ip_mreq) ||
1885                 optlen > sizeof (struct target_ip_mreqn))
1886                 return -TARGET_EINVAL;
1887 
1888             ip_mreq = (struct ip_mreqn *) alloca(optlen);
1889             target_to_host_ip_mreq(ip_mreq, optval_addr, optlen);
1890             ret = get_errno(setsockopt(sockfd, level, optname, ip_mreq, optlen));
1891             break;
1892 
1893         case IP_BLOCK_SOURCE:
1894         case IP_UNBLOCK_SOURCE:
1895         case IP_ADD_SOURCE_MEMBERSHIP:
1896         case IP_DROP_SOURCE_MEMBERSHIP:
1897             if (optlen != sizeof (struct target_ip_mreq_source))
1898                 return -TARGET_EINVAL;
1899 
1900             ip_mreq_source = lock_user(VERIFY_READ, optval_addr, optlen, 1);
1901             ret = get_errno(setsockopt(sockfd, level, optname, ip_mreq_source, optlen));
1902             unlock_user (ip_mreq_source, optval_addr, 0);
1903             break;
1904 
1905         default:
1906             goto unimplemented;
1907         }
1908         break;
1909     case SOL_IPV6:
1910         switch (optname) {
1911         case IPV6_MTU_DISCOVER:
1912         case IPV6_MTU:
1913         case IPV6_V6ONLY:
1914         case IPV6_RECVPKTINFO:
1915         case IPV6_UNICAST_HOPS:
1916         case IPV6_MULTICAST_HOPS:
1917         case IPV6_MULTICAST_LOOP:
1918         case IPV6_RECVERR:
1919         case IPV6_RECVHOPLIMIT:
1920         case IPV6_2292HOPLIMIT:
1921         case IPV6_CHECKSUM:
1922         case IPV6_ADDRFORM:
1923         case IPV6_2292PKTINFO:
1924         case IPV6_RECVTCLASS:
1925         case IPV6_RECVRTHDR:
1926         case IPV6_2292RTHDR:
1927         case IPV6_RECVHOPOPTS:
1928         case IPV6_2292HOPOPTS:
1929         case IPV6_RECVDSTOPTS:
1930         case IPV6_2292DSTOPTS:
1931         case IPV6_TCLASS:
1932 #ifdef IPV6_RECVPATHMTU
1933         case IPV6_RECVPATHMTU:
1934 #endif
1935 #ifdef IPV6_TRANSPARENT
1936         case IPV6_TRANSPARENT:
1937 #endif
1938 #ifdef IPV6_FREEBIND
1939         case IPV6_FREEBIND:
1940 #endif
1941 #ifdef IPV6_RECVORIGDSTADDR
1942         case IPV6_RECVORIGDSTADDR:
1943 #endif
1944             val = 0;
1945             if (optlen < sizeof(uint32_t)) {
1946                 return -TARGET_EINVAL;
1947             }
1948             if (get_user_u32(val, optval_addr)) {
1949                 return -TARGET_EFAULT;
1950             }
1951             ret = get_errno(setsockopt(sockfd, level, optname,
1952                                        &val, sizeof(val)));
1953             break;
1954         case IPV6_PKTINFO:
1955         {
1956             struct in6_pktinfo pki;
1957 
1958             if (optlen < sizeof(pki)) {
1959                 return -TARGET_EINVAL;
1960             }
1961 
1962             if (copy_from_user(&pki, optval_addr, sizeof(pki))) {
1963                 return -TARGET_EFAULT;
1964             }
1965 
1966             pki.ipi6_ifindex = tswap32(pki.ipi6_ifindex);
1967 
1968             ret = get_errno(setsockopt(sockfd, level, optname,
1969                                        &pki, sizeof(pki)));
1970             break;
1971         }
1972         case IPV6_ADD_MEMBERSHIP:
1973         case IPV6_DROP_MEMBERSHIP:
1974         {
1975             struct ipv6_mreq ipv6mreq;
1976 
1977             if (optlen < sizeof(ipv6mreq)) {
1978                 return -TARGET_EINVAL;
1979             }
1980 
1981             if (copy_from_user(&ipv6mreq, optval_addr, sizeof(ipv6mreq))) {
1982                 return -TARGET_EFAULT;
1983             }
1984 
1985             ipv6mreq.ipv6mr_interface = tswap32(ipv6mreq.ipv6mr_interface);
1986 
1987             ret = get_errno(setsockopt(sockfd, level, optname,
1988                                        &ipv6mreq, sizeof(ipv6mreq)));
1989             break;
1990         }
1991         default:
1992             goto unimplemented;
1993         }
1994         break;
1995     case SOL_ICMPV6:
1996         switch (optname) {
1997         case ICMPV6_FILTER:
1998         {
1999             struct icmp6_filter icmp6f;
2000 
2001             if (optlen > sizeof(icmp6f)) {
2002                 optlen = sizeof(icmp6f);
2003             }
2004 
2005             if (copy_from_user(&icmp6f, optval_addr, optlen)) {
2006                 return -TARGET_EFAULT;
2007             }
2008 
2009             for (val = 0; val < 8; val++) {
2010                 icmp6f.data[val] = tswap32(icmp6f.data[val]);
2011             }
2012 
2013             ret = get_errno(setsockopt(sockfd, level, optname,
2014                                        &icmp6f, optlen));
2015             break;
2016         }
2017         default:
2018             goto unimplemented;
2019         }
2020         break;
2021     case SOL_RAW:
2022         switch (optname) {
2023         case ICMP_FILTER:
2024         case IPV6_CHECKSUM:
2025             /* those take an u32 value */
2026             if (optlen < sizeof(uint32_t)) {
2027                 return -TARGET_EINVAL;
2028             }
2029 
2030             if (get_user_u32(val, optval_addr)) {
2031                 return -TARGET_EFAULT;
2032             }
2033             ret = get_errno(setsockopt(sockfd, level, optname,
2034                                        &val, sizeof(val)));
2035             break;
2036 
2037         default:
2038             goto unimplemented;
2039         }
2040         break;
2041 #if defined(SOL_ALG) && defined(ALG_SET_KEY) && defined(ALG_SET_AEAD_AUTHSIZE)
2042     case SOL_ALG:
2043         switch (optname) {
2044         case ALG_SET_KEY:
2045         {
2046             char *alg_key = g_malloc(optlen);
2047 
2048             if (!alg_key) {
2049                 return -TARGET_ENOMEM;
2050             }
2051             if (copy_from_user(alg_key, optval_addr, optlen)) {
2052                 g_free(alg_key);
2053                 return -TARGET_EFAULT;
2054             }
2055             ret = get_errno(setsockopt(sockfd, level, optname,
2056                                        alg_key, optlen));
2057             g_free(alg_key);
2058             break;
2059         }
2060         case ALG_SET_AEAD_AUTHSIZE:
2061         {
2062             ret = get_errno(setsockopt(sockfd, level, optname,
2063                                        NULL, optlen));
2064             break;
2065         }
2066         default:
2067             goto unimplemented;
2068         }
2069         break;
2070 #endif
2071     case TARGET_SOL_SOCKET:
2072         switch (optname) {
2073         case TARGET_SO_RCVTIMEO:
2074         {
2075                 struct timeval tv;
2076 
2077                 optname = SO_RCVTIMEO;
2078 
2079 set_timeout:
2080                 if (optlen != sizeof(struct target_timeval)) {
2081                     return -TARGET_EINVAL;
2082                 }
2083 
2084                 if (copy_from_user_timeval(&tv, optval_addr)) {
2085                     return -TARGET_EFAULT;
2086                 }
2087 
2088                 ret = get_errno(setsockopt(sockfd, SOL_SOCKET, optname,
2089                                 &tv, sizeof(tv)));
2090                 return ret;
2091         }
2092         case TARGET_SO_SNDTIMEO:
2093                 optname = SO_SNDTIMEO;
2094                 goto set_timeout;
2095         case TARGET_SO_ATTACH_FILTER:
2096         {
2097                 struct target_sock_fprog *tfprog;
2098                 struct target_sock_filter *tfilter;
2099                 struct sock_fprog fprog;
2100                 struct sock_filter *filter;
2101                 int i;
2102 
2103                 if (optlen != sizeof(*tfprog)) {
2104                     return -TARGET_EINVAL;
2105                 }
2106                 if (!lock_user_struct(VERIFY_READ, tfprog, optval_addr, 0)) {
2107                     return -TARGET_EFAULT;
2108                 }
2109                 if (!lock_user_struct(VERIFY_READ, tfilter,
2110                                       tswapal(tfprog->filter), 0)) {
2111                     unlock_user_struct(tfprog, optval_addr, 1);
2112                     return -TARGET_EFAULT;
2113                 }
2114 
2115                 fprog.len = tswap16(tfprog->len);
2116                 filter = g_try_new(struct sock_filter, fprog.len);
2117                 if (filter == NULL) {
2118                     unlock_user_struct(tfilter, tfprog->filter, 1);
2119                     unlock_user_struct(tfprog, optval_addr, 1);
2120                     return -TARGET_ENOMEM;
2121                 }
2122                 for (i = 0; i < fprog.len; i++) {
2123                     filter[i].code = tswap16(tfilter[i].code);
2124                     filter[i].jt = tfilter[i].jt;
2125                     filter[i].jf = tfilter[i].jf;
2126                     filter[i].k = tswap32(tfilter[i].k);
2127                 }
2128                 fprog.filter = filter;
2129 
2130                 ret = get_errno(setsockopt(sockfd, SOL_SOCKET,
2131                                 SO_ATTACH_FILTER, &fprog, sizeof(fprog)));
2132                 g_free(filter);
2133 
2134                 unlock_user_struct(tfilter, tfprog->filter, 1);
2135                 unlock_user_struct(tfprog, optval_addr, 1);
2136                 return ret;
2137         }
2138 	case TARGET_SO_BINDTODEVICE:
2139 	{
2140 		char *dev_ifname, *addr_ifname;
2141 
2142 		if (optlen > IFNAMSIZ - 1) {
2143 		    optlen = IFNAMSIZ - 1;
2144 		}
2145 		dev_ifname = lock_user(VERIFY_READ, optval_addr, optlen, 1);
2146 		if (!dev_ifname) {
2147 		    return -TARGET_EFAULT;
2148 		}
2149 		optname = SO_BINDTODEVICE;
2150 		addr_ifname = alloca(IFNAMSIZ);
2151 		memcpy(addr_ifname, dev_ifname, optlen);
2152 		addr_ifname[optlen] = 0;
2153 		ret = get_errno(setsockopt(sockfd, SOL_SOCKET, optname,
2154                                            addr_ifname, optlen));
2155 		unlock_user (dev_ifname, optval_addr, 0);
2156 		return ret;
2157 	}
2158         case TARGET_SO_LINGER:
2159         {
2160                 struct linger lg;
2161                 struct target_linger *tlg;
2162 
2163                 if (optlen != sizeof(struct target_linger)) {
2164                     return -TARGET_EINVAL;
2165                 }
2166                 if (!lock_user_struct(VERIFY_READ, tlg, optval_addr, 1)) {
2167                     return -TARGET_EFAULT;
2168                 }
2169                 __get_user(lg.l_onoff, &tlg->l_onoff);
2170                 __get_user(lg.l_linger, &tlg->l_linger);
2171                 ret = get_errno(setsockopt(sockfd, SOL_SOCKET, SO_LINGER,
2172                                 &lg, sizeof(lg)));
2173                 unlock_user_struct(tlg, optval_addr, 0);
2174                 return ret;
2175         }
2176             /* Options with 'int' argument.  */
2177         case TARGET_SO_DEBUG:
2178 		optname = SO_DEBUG;
2179 		break;
2180         case TARGET_SO_REUSEADDR:
2181 		optname = SO_REUSEADDR;
2182 		break;
2183 #ifdef SO_REUSEPORT
2184         case TARGET_SO_REUSEPORT:
2185                 optname = SO_REUSEPORT;
2186                 break;
2187 #endif
2188         case TARGET_SO_TYPE:
2189 		optname = SO_TYPE;
2190 		break;
2191         case TARGET_SO_ERROR:
2192 		optname = SO_ERROR;
2193 		break;
2194         case TARGET_SO_DONTROUTE:
2195 		optname = SO_DONTROUTE;
2196 		break;
2197         case TARGET_SO_BROADCAST:
2198 		optname = SO_BROADCAST;
2199 		break;
2200         case TARGET_SO_SNDBUF:
2201 		optname = SO_SNDBUF;
2202 		break;
2203         case TARGET_SO_SNDBUFFORCE:
2204                 optname = SO_SNDBUFFORCE;
2205                 break;
2206         case TARGET_SO_RCVBUF:
2207 		optname = SO_RCVBUF;
2208 		break;
2209         case TARGET_SO_RCVBUFFORCE:
2210                 optname = SO_RCVBUFFORCE;
2211                 break;
2212         case TARGET_SO_KEEPALIVE:
2213 		optname = SO_KEEPALIVE;
2214 		break;
2215         case TARGET_SO_OOBINLINE:
2216 		optname = SO_OOBINLINE;
2217 		break;
2218         case TARGET_SO_NO_CHECK:
2219 		optname = SO_NO_CHECK;
2220 		break;
2221         case TARGET_SO_PRIORITY:
2222 		optname = SO_PRIORITY;
2223 		break;
2224 #ifdef SO_BSDCOMPAT
2225         case TARGET_SO_BSDCOMPAT:
2226 		optname = SO_BSDCOMPAT;
2227 		break;
2228 #endif
2229         case TARGET_SO_PASSCRED:
2230 		optname = SO_PASSCRED;
2231 		break;
2232         case TARGET_SO_PASSSEC:
2233                 optname = SO_PASSSEC;
2234                 break;
2235         case TARGET_SO_TIMESTAMP:
2236 		optname = SO_TIMESTAMP;
2237 		break;
2238         case TARGET_SO_RCVLOWAT:
2239 		optname = SO_RCVLOWAT;
2240 		break;
2241         default:
2242             goto unimplemented;
2243         }
2244 	if (optlen < sizeof(uint32_t))
2245             return -TARGET_EINVAL;
2246 
2247 	if (get_user_u32(val, optval_addr))
2248             return -TARGET_EFAULT;
2249 	ret = get_errno(setsockopt(sockfd, SOL_SOCKET, optname, &val, sizeof(val)));
2250         break;
2251 #ifdef SOL_NETLINK
2252     case SOL_NETLINK:
2253         switch (optname) {
2254         case NETLINK_PKTINFO:
2255         case NETLINK_ADD_MEMBERSHIP:
2256         case NETLINK_DROP_MEMBERSHIP:
2257         case NETLINK_BROADCAST_ERROR:
2258         case NETLINK_NO_ENOBUFS:
2259 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 2, 0)
2260         case NETLINK_LISTEN_ALL_NSID:
2261         case NETLINK_CAP_ACK:
2262 #endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 2, 0) */
2263 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 12, 0)
2264         case NETLINK_EXT_ACK:
2265 #endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 12, 0) */
2266 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 20, 0)
2267         case NETLINK_GET_STRICT_CHK:
2268 #endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 12, 0) */
2269             break;
2270         default:
2271             goto unimplemented;
2272         }
2273         val = 0;
2274         if (optlen < sizeof(uint32_t)) {
2275             return -TARGET_EINVAL;
2276         }
2277         if (get_user_u32(val, optval_addr)) {
2278             return -TARGET_EFAULT;
2279         }
2280         ret = get_errno(setsockopt(sockfd, SOL_NETLINK, optname, &val,
2281                                    sizeof(val)));
2282         break;
2283 #endif /* SOL_NETLINK */
2284     default:
2285     unimplemented:
2286         gemu_log("Unsupported setsockopt level=%d optname=%d\n", level, optname);
2287         ret = -TARGET_ENOPROTOOPT;
2288     }
2289     return ret;
2290 }
2291 
2292 /* do_getsockopt() Must return target values and target errnos. */
2293 static abi_long do_getsockopt(int sockfd, int level, int optname,
2294                               abi_ulong optval_addr, abi_ulong optlen)
2295 {
2296     abi_long ret;
2297     int len, val;
2298     socklen_t lv;
2299 
2300     switch(level) {
2301     case TARGET_SOL_SOCKET:
2302         level = SOL_SOCKET;
2303         switch (optname) {
2304         /* These don't just return a single integer */
2305         case TARGET_SO_RCVTIMEO:
2306         case TARGET_SO_SNDTIMEO:
2307         case TARGET_SO_PEERNAME:
2308             goto unimplemented;
2309         case TARGET_SO_PEERCRED: {
2310             struct ucred cr;
2311             socklen_t crlen;
2312             struct target_ucred *tcr;
2313 
2314             if (get_user_u32(len, optlen)) {
2315                 return -TARGET_EFAULT;
2316             }
2317             if (len < 0) {
2318                 return -TARGET_EINVAL;
2319             }
2320 
2321             crlen = sizeof(cr);
2322             ret = get_errno(getsockopt(sockfd, level, SO_PEERCRED,
2323                                        &cr, &crlen));
2324             if (ret < 0) {
2325                 return ret;
2326             }
2327             if (len > crlen) {
2328                 len = crlen;
2329             }
2330             if (!lock_user_struct(VERIFY_WRITE, tcr, optval_addr, 0)) {
2331                 return -TARGET_EFAULT;
2332             }
2333             __put_user(cr.pid, &tcr->pid);
2334             __put_user(cr.uid, &tcr->uid);
2335             __put_user(cr.gid, &tcr->gid);
2336             unlock_user_struct(tcr, optval_addr, 1);
2337             if (put_user_u32(len, optlen)) {
2338                 return -TARGET_EFAULT;
2339             }
2340             break;
2341         }
2342         case TARGET_SO_LINGER:
2343         {
2344             struct linger lg;
2345             socklen_t lglen;
2346             struct target_linger *tlg;
2347 
2348             if (get_user_u32(len, optlen)) {
2349                 return -TARGET_EFAULT;
2350             }
2351             if (len < 0) {
2352                 return -TARGET_EINVAL;
2353             }
2354 
2355             lglen = sizeof(lg);
2356             ret = get_errno(getsockopt(sockfd, level, SO_LINGER,
2357                                        &lg, &lglen));
2358             if (ret < 0) {
2359                 return ret;
2360             }
2361             if (len > lglen) {
2362                 len = lglen;
2363             }
2364             if (!lock_user_struct(VERIFY_WRITE, tlg, optval_addr, 0)) {
2365                 return -TARGET_EFAULT;
2366             }
2367             __put_user(lg.l_onoff, &tlg->l_onoff);
2368             __put_user(lg.l_linger, &tlg->l_linger);
2369             unlock_user_struct(tlg, optval_addr, 1);
2370             if (put_user_u32(len, optlen)) {
2371                 return -TARGET_EFAULT;
2372             }
2373             break;
2374         }
2375         /* Options with 'int' argument.  */
2376         case TARGET_SO_DEBUG:
2377             optname = SO_DEBUG;
2378             goto int_case;
2379         case TARGET_SO_REUSEADDR:
2380             optname = SO_REUSEADDR;
2381             goto int_case;
2382 #ifdef SO_REUSEPORT
2383         case TARGET_SO_REUSEPORT:
2384             optname = SO_REUSEPORT;
2385             goto int_case;
2386 #endif
2387         case TARGET_SO_TYPE:
2388             optname = SO_TYPE;
2389             goto int_case;
2390         case TARGET_SO_ERROR:
2391             optname = SO_ERROR;
2392             goto int_case;
2393         case TARGET_SO_DONTROUTE:
2394             optname = SO_DONTROUTE;
2395             goto int_case;
2396         case TARGET_SO_BROADCAST:
2397             optname = SO_BROADCAST;
2398             goto int_case;
2399         case TARGET_SO_SNDBUF:
2400             optname = SO_SNDBUF;
2401             goto int_case;
2402         case TARGET_SO_RCVBUF:
2403             optname = SO_RCVBUF;
2404             goto int_case;
2405         case TARGET_SO_KEEPALIVE:
2406             optname = SO_KEEPALIVE;
2407             goto int_case;
2408         case TARGET_SO_OOBINLINE:
2409             optname = SO_OOBINLINE;
2410             goto int_case;
2411         case TARGET_SO_NO_CHECK:
2412             optname = SO_NO_CHECK;
2413             goto int_case;
2414         case TARGET_SO_PRIORITY:
2415             optname = SO_PRIORITY;
2416             goto int_case;
2417 #ifdef SO_BSDCOMPAT
2418         case TARGET_SO_BSDCOMPAT:
2419             optname = SO_BSDCOMPAT;
2420             goto int_case;
2421 #endif
2422         case TARGET_SO_PASSCRED:
2423             optname = SO_PASSCRED;
2424             goto int_case;
2425         case TARGET_SO_TIMESTAMP:
2426             optname = SO_TIMESTAMP;
2427             goto int_case;
2428         case TARGET_SO_RCVLOWAT:
2429             optname = SO_RCVLOWAT;
2430             goto int_case;
2431         case TARGET_SO_ACCEPTCONN:
2432             optname = SO_ACCEPTCONN;
2433             goto int_case;
2434         default:
2435             goto int_case;
2436         }
2437         break;
2438     case SOL_TCP:
2439         /* TCP options all take an 'int' value.  */
2440     int_case:
2441         if (get_user_u32(len, optlen))
2442             return -TARGET_EFAULT;
2443         if (len < 0)
2444             return -TARGET_EINVAL;
2445         lv = sizeof(lv);
2446         ret = get_errno(getsockopt(sockfd, level, optname, &val, &lv));
2447         if (ret < 0)
2448             return ret;
2449         if (optname == SO_TYPE) {
2450             val = host_to_target_sock_type(val);
2451         }
2452         if (len > lv)
2453             len = lv;
2454         if (len == 4) {
2455             if (put_user_u32(val, optval_addr))
2456                 return -TARGET_EFAULT;
2457         } else {
2458             if (put_user_u8(val, optval_addr))
2459                 return -TARGET_EFAULT;
2460         }
2461         if (put_user_u32(len, optlen))
2462             return -TARGET_EFAULT;
2463         break;
2464     case SOL_IP:
2465         switch(optname) {
2466         case IP_TOS:
2467         case IP_TTL:
2468         case IP_HDRINCL:
2469         case IP_ROUTER_ALERT:
2470         case IP_RECVOPTS:
2471         case IP_RETOPTS:
2472         case IP_PKTINFO:
2473         case IP_MTU_DISCOVER:
2474         case IP_RECVERR:
2475         case IP_RECVTOS:
2476 #ifdef IP_FREEBIND
2477         case IP_FREEBIND:
2478 #endif
2479         case IP_MULTICAST_TTL:
2480         case IP_MULTICAST_LOOP:
2481             if (get_user_u32(len, optlen))
2482                 return -TARGET_EFAULT;
2483             if (len < 0)
2484                 return -TARGET_EINVAL;
2485             lv = sizeof(lv);
2486             ret = get_errno(getsockopt(sockfd, level, optname, &val, &lv));
2487             if (ret < 0)
2488                 return ret;
2489             if (len < sizeof(int) && len > 0 && val >= 0 && val < 255) {
2490                 len = 1;
2491                 if (put_user_u32(len, optlen)
2492                     || put_user_u8(val, optval_addr))
2493                     return -TARGET_EFAULT;
2494             } else {
2495                 if (len > sizeof(int))
2496                     len = sizeof(int);
2497                 if (put_user_u32(len, optlen)
2498                     || put_user_u32(val, optval_addr))
2499                     return -TARGET_EFAULT;
2500             }
2501             break;
2502         default:
2503             ret = -TARGET_ENOPROTOOPT;
2504             break;
2505         }
2506         break;
2507     case SOL_IPV6:
2508         switch (optname) {
2509         case IPV6_MTU_DISCOVER:
2510         case IPV6_MTU:
2511         case IPV6_V6ONLY:
2512         case IPV6_RECVPKTINFO:
2513         case IPV6_UNICAST_HOPS:
2514         case IPV6_MULTICAST_HOPS:
2515         case IPV6_MULTICAST_LOOP:
2516         case IPV6_RECVERR:
2517         case IPV6_RECVHOPLIMIT:
2518         case IPV6_2292HOPLIMIT:
2519         case IPV6_CHECKSUM:
2520         case IPV6_ADDRFORM:
2521         case IPV6_2292PKTINFO:
2522         case IPV6_RECVTCLASS:
2523         case IPV6_RECVRTHDR:
2524         case IPV6_2292RTHDR:
2525         case IPV6_RECVHOPOPTS:
2526         case IPV6_2292HOPOPTS:
2527         case IPV6_RECVDSTOPTS:
2528         case IPV6_2292DSTOPTS:
2529         case IPV6_TCLASS:
2530 #ifdef IPV6_RECVPATHMTU
2531         case IPV6_RECVPATHMTU:
2532 #endif
2533 #ifdef IPV6_TRANSPARENT
2534         case IPV6_TRANSPARENT:
2535 #endif
2536 #ifdef IPV6_FREEBIND
2537         case IPV6_FREEBIND:
2538 #endif
2539 #ifdef IPV6_RECVORIGDSTADDR
2540         case IPV6_RECVORIGDSTADDR:
2541 #endif
2542             if (get_user_u32(len, optlen))
2543                 return -TARGET_EFAULT;
2544             if (len < 0)
2545                 return -TARGET_EINVAL;
2546             lv = sizeof(lv);
2547             ret = get_errno(getsockopt(sockfd, level, optname, &val, &lv));
2548             if (ret < 0)
2549                 return ret;
2550             if (len < sizeof(int) && len > 0 && val >= 0 && val < 255) {
2551                 len = 1;
2552                 if (put_user_u32(len, optlen)
2553                     || put_user_u8(val, optval_addr))
2554                     return -TARGET_EFAULT;
2555             } else {
2556                 if (len > sizeof(int))
2557                     len = sizeof(int);
2558                 if (put_user_u32(len, optlen)
2559                     || put_user_u32(val, optval_addr))
2560                     return -TARGET_EFAULT;
2561             }
2562             break;
2563         default:
2564             ret = -TARGET_ENOPROTOOPT;
2565             break;
2566         }
2567         break;
2568 #ifdef SOL_NETLINK
2569     case SOL_NETLINK:
2570         switch (optname) {
2571         case NETLINK_PKTINFO:
2572         case NETLINK_BROADCAST_ERROR:
2573         case NETLINK_NO_ENOBUFS:
2574 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 2, 0)
2575         case NETLINK_LISTEN_ALL_NSID:
2576         case NETLINK_CAP_ACK:
2577 #endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 2, 0) */
2578 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 12, 0)
2579         case NETLINK_EXT_ACK:
2580 #endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 12, 0) */
2581 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 20, 0)
2582         case NETLINK_GET_STRICT_CHK:
2583 #endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 12, 0) */
2584             if (get_user_u32(len, optlen)) {
2585                 return -TARGET_EFAULT;
2586             }
2587             if (len != sizeof(val)) {
2588                 return -TARGET_EINVAL;
2589             }
2590             lv = len;
2591             ret = get_errno(getsockopt(sockfd, level, optname, &val, &lv));
2592             if (ret < 0) {
2593                 return ret;
2594             }
2595             if (put_user_u32(lv, optlen)
2596                 || put_user_u32(val, optval_addr)) {
2597                 return -TARGET_EFAULT;
2598             }
2599             break;
2600 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 2, 0)
2601         case NETLINK_LIST_MEMBERSHIPS:
2602         {
2603             uint32_t *results;
2604             int i;
2605             if (get_user_u32(len, optlen)) {
2606                 return -TARGET_EFAULT;
2607             }
2608             if (len < 0) {
2609                 return -TARGET_EINVAL;
2610             }
2611             results = lock_user(VERIFY_WRITE, optval_addr, len, 1);
2612             if (!results) {
2613                 return -TARGET_EFAULT;
2614             }
2615             lv = len;
2616             ret = get_errno(getsockopt(sockfd, level, optname, results, &lv));
2617             if (ret < 0) {
2618                 unlock_user(results, optval_addr, 0);
2619                 return ret;
2620             }
2621             /* swap host endianess to target endianess. */
2622             for (i = 0; i < (len / sizeof(uint32_t)); i++) {
2623                 results[i] = tswap32(results[i]);
2624             }
2625             if (put_user_u32(lv, optlen)) {
2626                 return -TARGET_EFAULT;
2627             }
2628             unlock_user(results, optval_addr, 0);
2629             break;
2630         }
2631 #endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 2, 0) */
2632         default:
2633             goto unimplemented;
2634         }
2635         break;
2636 #endif /* SOL_NETLINK */
2637     default:
2638     unimplemented:
2639         gemu_log("getsockopt level=%d optname=%d not yet supported\n",
2640                  level, optname);
2641         ret = -TARGET_EOPNOTSUPP;
2642         break;
2643     }
2644     return ret;
2645 }
2646 
2647 /* Convert target low/high pair representing file offset into the host
2648  * low/high pair. This function doesn't handle offsets bigger than 64 bits
2649  * as the kernel doesn't handle them either.
2650  */
2651 static void target_to_host_low_high(abi_ulong tlow,
2652                                     abi_ulong thigh,
2653                                     unsigned long *hlow,
2654                                     unsigned long *hhigh)
2655 {
2656     uint64_t off = tlow |
2657         ((unsigned long long)thigh << TARGET_LONG_BITS / 2) <<
2658         TARGET_LONG_BITS / 2;
2659 
2660     *hlow = off;
2661     *hhigh = (off >> HOST_LONG_BITS / 2) >> HOST_LONG_BITS / 2;
2662 }
2663 
2664 static struct iovec *lock_iovec(int type, abi_ulong target_addr,
2665                                 abi_ulong count, int copy)
2666 {
2667     struct target_iovec *target_vec;
2668     struct iovec *vec;
2669     abi_ulong total_len, max_len;
2670     int i;
2671     int err = 0;
2672     bool bad_address = false;
2673 
2674     if (count == 0) {
2675         errno = 0;
2676         return NULL;
2677     }
2678     if (count > IOV_MAX) {
2679         errno = EINVAL;
2680         return NULL;
2681     }
2682 
2683     vec = g_try_new0(struct iovec, count);
2684     if (vec == NULL) {
2685         errno = ENOMEM;
2686         return NULL;
2687     }
2688 
2689     target_vec = lock_user(VERIFY_READ, target_addr,
2690                            count * sizeof(struct target_iovec), 1);
2691     if (target_vec == NULL) {
2692         err = EFAULT;
2693         goto fail2;
2694     }
2695 
2696     /* ??? If host page size > target page size, this will result in a
2697        value larger than what we can actually support.  */
2698     max_len = 0x7fffffff & TARGET_PAGE_MASK;
2699     total_len = 0;
2700 
2701     for (i = 0; i < count; i++) {
2702         abi_ulong base = tswapal(target_vec[i].iov_base);
2703         abi_long len = tswapal(target_vec[i].iov_len);
2704 
2705         if (len < 0) {
2706             err = EINVAL;
2707             goto fail;
2708         } else if (len == 0) {
2709             /* Zero length pointer is ignored.  */
2710             vec[i].iov_base = 0;
2711         } else {
2712             vec[i].iov_base = lock_user(type, base, len, copy);
2713             /* If the first buffer pointer is bad, this is a fault.  But
2714              * subsequent bad buffers will result in a partial write; this
2715              * is realized by filling the vector with null pointers and
2716              * zero lengths. */
2717             if (!vec[i].iov_base) {
2718                 if (i == 0) {
2719                     err = EFAULT;
2720                     goto fail;
2721                 } else {
2722                     bad_address = true;
2723                 }
2724             }
2725             if (bad_address) {
2726                 len = 0;
2727             }
2728             if (len > max_len - total_len) {
2729                 len = max_len - total_len;
2730             }
2731         }
2732         vec[i].iov_len = len;
2733         total_len += len;
2734     }
2735 
2736     unlock_user(target_vec, target_addr, 0);
2737     return vec;
2738 
2739  fail:
2740     while (--i >= 0) {
2741         if (tswapal(target_vec[i].iov_len) > 0) {
2742             unlock_user(vec[i].iov_base, tswapal(target_vec[i].iov_base), 0);
2743         }
2744     }
2745     unlock_user(target_vec, target_addr, 0);
2746  fail2:
2747     g_free(vec);
2748     errno = err;
2749     return NULL;
2750 }
2751 
2752 static void unlock_iovec(struct iovec *vec, abi_ulong target_addr,
2753                          abi_ulong count, int copy)
2754 {
2755     struct target_iovec *target_vec;
2756     int i;
2757 
2758     target_vec = lock_user(VERIFY_READ, target_addr,
2759                            count * sizeof(struct target_iovec), 1);
2760     if (target_vec) {
2761         for (i = 0; i < count; i++) {
2762             abi_ulong base = tswapal(target_vec[i].iov_base);
2763             abi_long len = tswapal(target_vec[i].iov_len);
2764             if (len < 0) {
2765                 break;
2766             }
2767             unlock_user(vec[i].iov_base, base, copy ? vec[i].iov_len : 0);
2768         }
2769         unlock_user(target_vec, target_addr, 0);
2770     }
2771 
2772     g_free(vec);
2773 }
2774 
2775 static inline int target_to_host_sock_type(int *type)
2776 {
2777     int host_type = 0;
2778     int target_type = *type;
2779 
2780     switch (target_type & TARGET_SOCK_TYPE_MASK) {
2781     case TARGET_SOCK_DGRAM:
2782         host_type = SOCK_DGRAM;
2783         break;
2784     case TARGET_SOCK_STREAM:
2785         host_type = SOCK_STREAM;
2786         break;
2787     default:
2788         host_type = target_type & TARGET_SOCK_TYPE_MASK;
2789         break;
2790     }
2791     if (target_type & TARGET_SOCK_CLOEXEC) {
2792 #if defined(SOCK_CLOEXEC)
2793         host_type |= SOCK_CLOEXEC;
2794 #else
2795         return -TARGET_EINVAL;
2796 #endif
2797     }
2798     if (target_type & TARGET_SOCK_NONBLOCK) {
2799 #if defined(SOCK_NONBLOCK)
2800         host_type |= SOCK_NONBLOCK;
2801 #elif !defined(O_NONBLOCK)
2802         return -TARGET_EINVAL;
2803 #endif
2804     }
2805     *type = host_type;
2806     return 0;
2807 }
2808 
2809 /* Try to emulate socket type flags after socket creation.  */
2810 static int sock_flags_fixup(int fd, int target_type)
2811 {
2812 #if !defined(SOCK_NONBLOCK) && defined(O_NONBLOCK)
2813     if (target_type & TARGET_SOCK_NONBLOCK) {
2814         int flags = fcntl(fd, F_GETFL);
2815         if (fcntl(fd, F_SETFL, O_NONBLOCK | flags) == -1) {
2816             close(fd);
2817             return -TARGET_EINVAL;
2818         }
2819     }
2820 #endif
2821     return fd;
2822 }
2823 
2824 /* do_socket() Must return target values and target errnos. */
2825 static abi_long do_socket(int domain, int type, int protocol)
2826 {
2827     int target_type = type;
2828     int ret;
2829 
2830     ret = target_to_host_sock_type(&type);
2831     if (ret) {
2832         return ret;
2833     }
2834 
2835     if (domain == PF_NETLINK && !(
2836 #ifdef CONFIG_RTNETLINK
2837          protocol == NETLINK_ROUTE ||
2838 #endif
2839          protocol == NETLINK_KOBJECT_UEVENT ||
2840          protocol == NETLINK_AUDIT)) {
2841         return -EPFNOSUPPORT;
2842     }
2843 
2844     if (domain == AF_PACKET ||
2845         (domain == AF_INET && type == SOCK_PACKET)) {
2846         protocol = tswap16(protocol);
2847     }
2848 
2849     ret = get_errno(socket(domain, type, protocol));
2850     if (ret >= 0) {
2851         ret = sock_flags_fixup(ret, target_type);
2852         if (type == SOCK_PACKET) {
2853             /* Manage an obsolete case :
2854              * if socket type is SOCK_PACKET, bind by name
2855              */
2856             fd_trans_register(ret, &target_packet_trans);
2857         } else if (domain == PF_NETLINK) {
2858             switch (protocol) {
2859 #ifdef CONFIG_RTNETLINK
2860             case NETLINK_ROUTE:
2861                 fd_trans_register(ret, &target_netlink_route_trans);
2862                 break;
2863 #endif
2864             case NETLINK_KOBJECT_UEVENT:
2865                 /* nothing to do: messages are strings */
2866                 break;
2867             case NETLINK_AUDIT:
2868                 fd_trans_register(ret, &target_netlink_audit_trans);
2869                 break;
2870             default:
2871                 g_assert_not_reached();
2872             }
2873         }
2874     }
2875     return ret;
2876 }
2877 
2878 /* do_bind() Must return target values and target errnos. */
2879 static abi_long do_bind(int sockfd, abi_ulong target_addr,
2880                         socklen_t addrlen)
2881 {
2882     void *addr;
2883     abi_long ret;
2884 
2885     if ((int)addrlen < 0) {
2886         return -TARGET_EINVAL;
2887     }
2888 
2889     addr = alloca(addrlen+1);
2890 
2891     ret = target_to_host_sockaddr(sockfd, addr, target_addr, addrlen);
2892     if (ret)
2893         return ret;
2894 
2895     return get_errno(bind(sockfd, addr, addrlen));
2896 }
2897 
2898 /* do_connect() Must return target values and target errnos. */
2899 static abi_long do_connect(int sockfd, abi_ulong target_addr,
2900                            socklen_t addrlen)
2901 {
2902     void *addr;
2903     abi_long ret;
2904 
2905     if ((int)addrlen < 0) {
2906         return -TARGET_EINVAL;
2907     }
2908 
2909     addr = alloca(addrlen+1);
2910 
2911     ret = target_to_host_sockaddr(sockfd, addr, target_addr, addrlen);
2912     if (ret)
2913         return ret;
2914 
2915     return get_errno(safe_connect(sockfd, addr, addrlen));
2916 }
2917 
2918 /* do_sendrecvmsg_locked() Must return target values and target errnos. */
2919 static abi_long do_sendrecvmsg_locked(int fd, struct target_msghdr *msgp,
2920                                       int flags, int send)
2921 {
2922     abi_long ret, len;
2923     struct msghdr msg;
2924     abi_ulong count;
2925     struct iovec *vec;
2926     abi_ulong target_vec;
2927 
2928     if (msgp->msg_name) {
2929         msg.msg_namelen = tswap32(msgp->msg_namelen);
2930         msg.msg_name = alloca(msg.msg_namelen+1);
2931         ret = target_to_host_sockaddr(fd, msg.msg_name,
2932                                       tswapal(msgp->msg_name),
2933                                       msg.msg_namelen);
2934         if (ret == -TARGET_EFAULT) {
2935             /* For connected sockets msg_name and msg_namelen must
2936              * be ignored, so returning EFAULT immediately is wrong.
2937              * Instead, pass a bad msg_name to the host kernel, and
2938              * let it decide whether to return EFAULT or not.
2939              */
2940             msg.msg_name = (void *)-1;
2941         } else if (ret) {
2942             goto out2;
2943         }
2944     } else {
2945         msg.msg_name = NULL;
2946         msg.msg_namelen = 0;
2947     }
2948     msg.msg_controllen = 2 * tswapal(msgp->msg_controllen);
2949     msg.msg_control = alloca(msg.msg_controllen);
2950     memset(msg.msg_control, 0, msg.msg_controllen);
2951 
2952     msg.msg_flags = tswap32(msgp->msg_flags);
2953 
2954     count = tswapal(msgp->msg_iovlen);
2955     target_vec = tswapal(msgp->msg_iov);
2956 
2957     if (count > IOV_MAX) {
2958         /* sendrcvmsg returns a different errno for this condition than
2959          * readv/writev, so we must catch it here before lock_iovec() does.
2960          */
2961         ret = -TARGET_EMSGSIZE;
2962         goto out2;
2963     }
2964 
2965     vec = lock_iovec(send ? VERIFY_READ : VERIFY_WRITE,
2966                      target_vec, count, send);
2967     if (vec == NULL) {
2968         ret = -host_to_target_errno(errno);
2969         goto out2;
2970     }
2971     msg.msg_iovlen = count;
2972     msg.msg_iov = vec;
2973 
2974     if (send) {
2975         if (fd_trans_target_to_host_data(fd)) {
2976             void *host_msg;
2977 
2978             host_msg = g_malloc(msg.msg_iov->iov_len);
2979             memcpy(host_msg, msg.msg_iov->iov_base, msg.msg_iov->iov_len);
2980             ret = fd_trans_target_to_host_data(fd)(host_msg,
2981                                                    msg.msg_iov->iov_len);
2982             if (ret >= 0) {
2983                 msg.msg_iov->iov_base = host_msg;
2984                 ret = get_errno(safe_sendmsg(fd, &msg, flags));
2985             }
2986             g_free(host_msg);
2987         } else {
2988             ret = target_to_host_cmsg(&msg, msgp);
2989             if (ret == 0) {
2990                 ret = get_errno(safe_sendmsg(fd, &msg, flags));
2991             }
2992         }
2993     } else {
2994         ret = get_errno(safe_recvmsg(fd, &msg, flags));
2995         if (!is_error(ret)) {
2996             len = ret;
2997             if (fd_trans_host_to_target_data(fd)) {
2998                 ret = fd_trans_host_to_target_data(fd)(msg.msg_iov->iov_base,
2999                                                MIN(msg.msg_iov->iov_len, len));
3000             } else {
3001                 ret = host_to_target_cmsg(msgp, &msg);
3002             }
3003             if (!is_error(ret)) {
3004                 msgp->msg_namelen = tswap32(msg.msg_namelen);
3005                 msgp->msg_flags = tswap32(msg.msg_flags);
3006                 if (msg.msg_name != NULL && msg.msg_name != (void *)-1) {
3007                     ret = host_to_target_sockaddr(tswapal(msgp->msg_name),
3008                                     msg.msg_name, msg.msg_namelen);
3009                     if (ret) {
3010                         goto out;
3011                     }
3012                 }
3013 
3014                 ret = len;
3015             }
3016         }
3017     }
3018 
3019 out:
3020     unlock_iovec(vec, target_vec, count, !send);
3021 out2:
3022     return ret;
3023 }
3024 
3025 static abi_long do_sendrecvmsg(int fd, abi_ulong target_msg,
3026                                int flags, int send)
3027 {
3028     abi_long ret;
3029     struct target_msghdr *msgp;
3030 
3031     if (!lock_user_struct(send ? VERIFY_READ : VERIFY_WRITE,
3032                           msgp,
3033                           target_msg,
3034                           send ? 1 : 0)) {
3035         return -TARGET_EFAULT;
3036     }
3037     ret = do_sendrecvmsg_locked(fd, msgp, flags, send);
3038     unlock_user_struct(msgp, target_msg, send ? 0 : 1);
3039     return ret;
3040 }
3041 
3042 /* We don't rely on the C library to have sendmmsg/recvmmsg support,
3043  * so it might not have this *mmsg-specific flag either.
3044  */
3045 #ifndef MSG_WAITFORONE
3046 #define MSG_WAITFORONE 0x10000
3047 #endif
3048 
3049 static abi_long do_sendrecvmmsg(int fd, abi_ulong target_msgvec,
3050                                 unsigned int vlen, unsigned int flags,
3051                                 int send)
3052 {
3053     struct target_mmsghdr *mmsgp;
3054     abi_long ret = 0;
3055     int i;
3056 
3057     if (vlen > UIO_MAXIOV) {
3058         vlen = UIO_MAXIOV;
3059     }
3060 
3061     mmsgp = lock_user(VERIFY_WRITE, target_msgvec, sizeof(*mmsgp) * vlen, 1);
3062     if (!mmsgp) {
3063         return -TARGET_EFAULT;
3064     }
3065 
3066     for (i = 0; i < vlen; i++) {
3067         ret = do_sendrecvmsg_locked(fd, &mmsgp[i].msg_hdr, flags, send);
3068         if (is_error(ret)) {
3069             break;
3070         }
3071         mmsgp[i].msg_len = tswap32(ret);
3072         /* MSG_WAITFORONE turns on MSG_DONTWAIT after one packet */
3073         if (flags & MSG_WAITFORONE) {
3074             flags |= MSG_DONTWAIT;
3075         }
3076     }
3077 
3078     unlock_user(mmsgp, target_msgvec, sizeof(*mmsgp) * i);
3079 
3080     /* Return number of datagrams sent if we sent any at all;
3081      * otherwise return the error.
3082      */
3083     if (i) {
3084         return i;
3085     }
3086     return ret;
3087 }
3088 
3089 /* do_accept4() Must return target values and target errnos. */
3090 static abi_long do_accept4(int fd, abi_ulong target_addr,
3091                            abi_ulong target_addrlen_addr, int flags)
3092 {
3093     socklen_t addrlen, ret_addrlen;
3094     void *addr;
3095     abi_long ret;
3096     int host_flags;
3097 
3098     host_flags = target_to_host_bitmask(flags, fcntl_flags_tbl);
3099 
3100     if (target_addr == 0) {
3101         return get_errno(safe_accept4(fd, NULL, NULL, host_flags));
3102     }
3103 
3104     /* linux returns EINVAL if addrlen pointer is invalid */
3105     if (get_user_u32(addrlen, target_addrlen_addr))
3106         return -TARGET_EINVAL;
3107 
3108     if ((int)addrlen < 0) {
3109         return -TARGET_EINVAL;
3110     }
3111 
3112     if (!access_ok(VERIFY_WRITE, target_addr, addrlen))
3113         return -TARGET_EINVAL;
3114 
3115     addr = alloca(addrlen);
3116 
3117     ret_addrlen = addrlen;
3118     ret = get_errno(safe_accept4(fd, addr, &ret_addrlen, host_flags));
3119     if (!is_error(ret)) {
3120         host_to_target_sockaddr(target_addr, addr, MIN(addrlen, ret_addrlen));
3121         if (put_user_u32(ret_addrlen, target_addrlen_addr)) {
3122             ret = -TARGET_EFAULT;
3123         }
3124     }
3125     return ret;
3126 }
3127 
3128 /* do_getpeername() Must return target values and target errnos. */
3129 static abi_long do_getpeername(int fd, abi_ulong target_addr,
3130                                abi_ulong target_addrlen_addr)
3131 {
3132     socklen_t addrlen, ret_addrlen;
3133     void *addr;
3134     abi_long ret;
3135 
3136     if (get_user_u32(addrlen, target_addrlen_addr))
3137         return -TARGET_EFAULT;
3138 
3139     if ((int)addrlen < 0) {
3140         return -TARGET_EINVAL;
3141     }
3142 
3143     if (!access_ok(VERIFY_WRITE, target_addr, addrlen))
3144         return -TARGET_EFAULT;
3145 
3146     addr = alloca(addrlen);
3147 
3148     ret_addrlen = addrlen;
3149     ret = get_errno(getpeername(fd, addr, &ret_addrlen));
3150     if (!is_error(ret)) {
3151         host_to_target_sockaddr(target_addr, addr, MIN(addrlen, ret_addrlen));
3152         if (put_user_u32(ret_addrlen, target_addrlen_addr)) {
3153             ret = -TARGET_EFAULT;
3154         }
3155     }
3156     return ret;
3157 }
3158 
3159 /* do_getsockname() Must return target values and target errnos. */
3160 static abi_long do_getsockname(int fd, abi_ulong target_addr,
3161                                abi_ulong target_addrlen_addr)
3162 {
3163     socklen_t addrlen, ret_addrlen;
3164     void *addr;
3165     abi_long ret;
3166 
3167     if (get_user_u32(addrlen, target_addrlen_addr))
3168         return -TARGET_EFAULT;
3169 
3170     if ((int)addrlen < 0) {
3171         return -TARGET_EINVAL;
3172     }
3173 
3174     if (!access_ok(VERIFY_WRITE, target_addr, addrlen))
3175         return -TARGET_EFAULT;
3176 
3177     addr = alloca(addrlen);
3178 
3179     ret_addrlen = addrlen;
3180     ret = get_errno(getsockname(fd, addr, &ret_addrlen));
3181     if (!is_error(ret)) {
3182         host_to_target_sockaddr(target_addr, addr, MIN(addrlen, ret_addrlen));
3183         if (put_user_u32(ret_addrlen, target_addrlen_addr)) {
3184             ret = -TARGET_EFAULT;
3185         }
3186     }
3187     return ret;
3188 }
3189 
3190 /* do_socketpair() Must return target values and target errnos. */
3191 static abi_long do_socketpair(int domain, int type, int protocol,
3192                               abi_ulong target_tab_addr)
3193 {
3194     int tab[2];
3195     abi_long ret;
3196 
3197     target_to_host_sock_type(&type);
3198 
3199     ret = get_errno(socketpair(domain, type, protocol, tab));
3200     if (!is_error(ret)) {
3201         if (put_user_s32(tab[0], target_tab_addr)
3202             || put_user_s32(tab[1], target_tab_addr + sizeof(tab[0])))
3203             ret = -TARGET_EFAULT;
3204     }
3205     return ret;
3206 }
3207 
3208 /* do_sendto() Must return target values and target errnos. */
3209 static abi_long do_sendto(int fd, abi_ulong msg, size_t len, int flags,
3210                           abi_ulong target_addr, socklen_t addrlen)
3211 {
3212     void *addr;
3213     void *host_msg;
3214     void *copy_msg = NULL;
3215     abi_long ret;
3216 
3217     if ((int)addrlen < 0) {
3218         return -TARGET_EINVAL;
3219     }
3220 
3221     host_msg = lock_user(VERIFY_READ, msg, len, 1);
3222     if (!host_msg)
3223         return -TARGET_EFAULT;
3224     if (fd_trans_target_to_host_data(fd)) {
3225         copy_msg = host_msg;
3226         host_msg = g_malloc(len);
3227         memcpy(host_msg, copy_msg, len);
3228         ret = fd_trans_target_to_host_data(fd)(host_msg, len);
3229         if (ret < 0) {
3230             goto fail;
3231         }
3232     }
3233     if (target_addr) {
3234         addr = alloca(addrlen+1);
3235         ret = target_to_host_sockaddr(fd, addr, target_addr, addrlen);
3236         if (ret) {
3237             goto fail;
3238         }
3239         ret = get_errno(safe_sendto(fd, host_msg, len, flags, addr, addrlen));
3240     } else {
3241         ret = get_errno(safe_sendto(fd, host_msg, len, flags, NULL, 0));
3242     }
3243 fail:
3244     if (copy_msg) {
3245         g_free(host_msg);
3246         host_msg = copy_msg;
3247     }
3248     unlock_user(host_msg, msg, 0);
3249     return ret;
3250 }
3251 
3252 /* do_recvfrom() Must return target values and target errnos. */
3253 static abi_long do_recvfrom(int fd, abi_ulong msg, size_t len, int flags,
3254                             abi_ulong target_addr,
3255                             abi_ulong target_addrlen)
3256 {
3257     socklen_t addrlen, ret_addrlen;
3258     void *addr;
3259     void *host_msg;
3260     abi_long ret;
3261 
3262     host_msg = lock_user(VERIFY_WRITE, msg, len, 0);
3263     if (!host_msg)
3264         return -TARGET_EFAULT;
3265     if (target_addr) {
3266         if (get_user_u32(addrlen, target_addrlen)) {
3267             ret = -TARGET_EFAULT;
3268             goto fail;
3269         }
3270         if ((int)addrlen < 0) {
3271             ret = -TARGET_EINVAL;
3272             goto fail;
3273         }
3274         addr = alloca(addrlen);
3275         ret_addrlen = addrlen;
3276         ret = get_errno(safe_recvfrom(fd, host_msg, len, flags,
3277                                       addr, &ret_addrlen));
3278     } else {
3279         addr = NULL; /* To keep compiler quiet.  */
3280         addrlen = 0; /* To keep compiler quiet.  */
3281         ret = get_errno(safe_recvfrom(fd, host_msg, len, flags, NULL, 0));
3282     }
3283     if (!is_error(ret)) {
3284         if (fd_trans_host_to_target_data(fd)) {
3285             abi_long trans;
3286             trans = fd_trans_host_to_target_data(fd)(host_msg, MIN(ret, len));
3287             if (is_error(trans)) {
3288                 ret = trans;
3289                 goto fail;
3290             }
3291         }
3292         if (target_addr) {
3293             host_to_target_sockaddr(target_addr, addr,
3294                                     MIN(addrlen, ret_addrlen));
3295             if (put_user_u32(ret_addrlen, target_addrlen)) {
3296                 ret = -TARGET_EFAULT;
3297                 goto fail;
3298             }
3299         }
3300         unlock_user(host_msg, msg, len);
3301     } else {
3302 fail:
3303         unlock_user(host_msg, msg, 0);
3304     }
3305     return ret;
3306 }
3307 
3308 #ifdef TARGET_NR_socketcall
3309 /* do_socketcall() must return target values and target errnos. */
3310 static abi_long do_socketcall(int num, abi_ulong vptr)
3311 {
3312     static const unsigned nargs[] = { /* number of arguments per operation */
3313         [TARGET_SYS_SOCKET] = 3,      /* domain, type, protocol */
3314         [TARGET_SYS_BIND] = 3,        /* fd, addr, addrlen */
3315         [TARGET_SYS_CONNECT] = 3,     /* fd, addr, addrlen */
3316         [TARGET_SYS_LISTEN] = 2,      /* fd, backlog */
3317         [TARGET_SYS_ACCEPT] = 3,      /* fd, addr, addrlen */
3318         [TARGET_SYS_GETSOCKNAME] = 3, /* fd, addr, addrlen */
3319         [TARGET_SYS_GETPEERNAME] = 3, /* fd, addr, addrlen */
3320         [TARGET_SYS_SOCKETPAIR] = 4,  /* domain, type, protocol, tab */
3321         [TARGET_SYS_SEND] = 4,        /* fd, msg, len, flags */
3322         [TARGET_SYS_RECV] = 4,        /* fd, msg, len, flags */
3323         [TARGET_SYS_SENDTO] = 6,      /* fd, msg, len, flags, addr, addrlen */
3324         [TARGET_SYS_RECVFROM] = 6,    /* fd, msg, len, flags, addr, addrlen */
3325         [TARGET_SYS_SHUTDOWN] = 2,    /* fd, how */
3326         [TARGET_SYS_SETSOCKOPT] = 5,  /* fd, level, optname, optval, optlen */
3327         [TARGET_SYS_GETSOCKOPT] = 5,  /* fd, level, optname, optval, optlen */
3328         [TARGET_SYS_SENDMSG] = 3,     /* fd, msg, flags */
3329         [TARGET_SYS_RECVMSG] = 3,     /* fd, msg, flags */
3330         [TARGET_SYS_ACCEPT4] = 4,     /* fd, addr, addrlen, flags */
3331         [TARGET_SYS_RECVMMSG] = 4,    /* fd, msgvec, vlen, flags */
3332         [TARGET_SYS_SENDMMSG] = 4,    /* fd, msgvec, vlen, flags */
3333     };
3334     abi_long a[6]; /* max 6 args */
3335     unsigned i;
3336 
3337     /* check the range of the first argument num */
3338     /* (TARGET_SYS_SENDMMSG is the highest among TARGET_SYS_xxx) */
3339     if (num < 1 || num > TARGET_SYS_SENDMMSG) {
3340         return -TARGET_EINVAL;
3341     }
3342     /* ensure we have space for args */
3343     if (nargs[num] > ARRAY_SIZE(a)) {
3344         return -TARGET_EINVAL;
3345     }
3346     /* collect the arguments in a[] according to nargs[] */
3347     for (i = 0; i < nargs[num]; ++i) {
3348         if (get_user_ual(a[i], vptr + i * sizeof(abi_long)) != 0) {
3349             return -TARGET_EFAULT;
3350         }
3351     }
3352     /* now when we have the args, invoke the appropriate underlying function */
3353     switch (num) {
3354     case TARGET_SYS_SOCKET: /* domain, type, protocol */
3355         return do_socket(a[0], a[1], a[2]);
3356     case TARGET_SYS_BIND: /* sockfd, addr, addrlen */
3357         return do_bind(a[0], a[1], a[2]);
3358     case TARGET_SYS_CONNECT: /* sockfd, addr, addrlen */
3359         return do_connect(a[0], a[1], a[2]);
3360     case TARGET_SYS_LISTEN: /* sockfd, backlog */
3361         return get_errno(listen(a[0], a[1]));
3362     case TARGET_SYS_ACCEPT: /* sockfd, addr, addrlen */
3363         return do_accept4(a[0], a[1], a[2], 0);
3364     case TARGET_SYS_GETSOCKNAME: /* sockfd, addr, addrlen */
3365         return do_getsockname(a[0], a[1], a[2]);
3366     case TARGET_SYS_GETPEERNAME: /* sockfd, addr, addrlen */
3367         return do_getpeername(a[0], a[1], a[2]);
3368     case TARGET_SYS_SOCKETPAIR: /* domain, type, protocol, tab */
3369         return do_socketpair(a[0], a[1], a[2], a[3]);
3370     case TARGET_SYS_SEND: /* sockfd, msg, len, flags */
3371         return do_sendto(a[0], a[1], a[2], a[3], 0, 0);
3372     case TARGET_SYS_RECV: /* sockfd, msg, len, flags */
3373         return do_recvfrom(a[0], a[1], a[2], a[3], 0, 0);
3374     case TARGET_SYS_SENDTO: /* sockfd, msg, len, flags, addr, addrlen */
3375         return do_sendto(a[0], a[1], a[2], a[3], a[4], a[5]);
3376     case TARGET_SYS_RECVFROM: /* sockfd, msg, len, flags, addr, addrlen */
3377         return do_recvfrom(a[0], a[1], a[2], a[3], a[4], a[5]);
3378     case TARGET_SYS_SHUTDOWN: /* sockfd, how */
3379         return get_errno(shutdown(a[0], a[1]));
3380     case TARGET_SYS_SETSOCKOPT: /* sockfd, level, optname, optval, optlen */
3381         return do_setsockopt(a[0], a[1], a[2], a[3], a[4]);
3382     case TARGET_SYS_GETSOCKOPT: /* sockfd, level, optname, optval, optlen */
3383         return do_getsockopt(a[0], a[1], a[2], a[3], a[4]);
3384     case TARGET_SYS_SENDMSG: /* sockfd, msg, flags */
3385         return do_sendrecvmsg(a[0], a[1], a[2], 1);
3386     case TARGET_SYS_RECVMSG: /* sockfd, msg, flags */
3387         return do_sendrecvmsg(a[0], a[1], a[2], 0);
3388     case TARGET_SYS_ACCEPT4: /* sockfd, addr, addrlen, flags */
3389         return do_accept4(a[0], a[1], a[2], a[3]);
3390     case TARGET_SYS_RECVMMSG: /* sockfd, msgvec, vlen, flags */
3391         return do_sendrecvmmsg(a[0], a[1], a[2], a[3], 0);
3392     case TARGET_SYS_SENDMMSG: /* sockfd, msgvec, vlen, flags */
3393         return do_sendrecvmmsg(a[0], a[1], a[2], a[3], 1);
3394     default:
3395         gemu_log("Unsupported socketcall: %d\n", num);
3396         return -TARGET_EINVAL;
3397     }
3398 }
3399 #endif
3400 
3401 #define N_SHM_REGIONS	32
3402 
3403 static struct shm_region {
3404     abi_ulong start;
3405     abi_ulong size;
3406     bool in_use;
3407 } shm_regions[N_SHM_REGIONS];
3408 
3409 #ifndef TARGET_SEMID64_DS
3410 /* asm-generic version of this struct */
3411 struct target_semid64_ds
3412 {
3413   struct target_ipc_perm sem_perm;
3414   abi_ulong sem_otime;
3415 #if TARGET_ABI_BITS == 32
3416   abi_ulong __unused1;
3417 #endif
3418   abi_ulong sem_ctime;
3419 #if TARGET_ABI_BITS == 32
3420   abi_ulong __unused2;
3421 #endif
3422   abi_ulong sem_nsems;
3423   abi_ulong __unused3;
3424   abi_ulong __unused4;
3425 };
3426 #endif
3427 
3428 static inline abi_long target_to_host_ipc_perm(struct ipc_perm *host_ip,
3429                                                abi_ulong target_addr)
3430 {
3431     struct target_ipc_perm *target_ip;
3432     struct target_semid64_ds *target_sd;
3433 
3434     if (!lock_user_struct(VERIFY_READ, target_sd, target_addr, 1))
3435         return -TARGET_EFAULT;
3436     target_ip = &(target_sd->sem_perm);
3437     host_ip->__key = tswap32(target_ip->__key);
3438     host_ip->uid = tswap32(target_ip->uid);
3439     host_ip->gid = tswap32(target_ip->gid);
3440     host_ip->cuid = tswap32(target_ip->cuid);
3441     host_ip->cgid = tswap32(target_ip->cgid);
3442 #if defined(TARGET_ALPHA) || defined(TARGET_MIPS) || defined(TARGET_PPC)
3443     host_ip->mode = tswap32(target_ip->mode);
3444 #else
3445     host_ip->mode = tswap16(target_ip->mode);
3446 #endif
3447 #if defined(TARGET_PPC)
3448     host_ip->__seq = tswap32(target_ip->__seq);
3449 #else
3450     host_ip->__seq = tswap16(target_ip->__seq);
3451 #endif
3452     unlock_user_struct(target_sd, target_addr, 0);
3453     return 0;
3454 }
3455 
3456 static inline abi_long host_to_target_ipc_perm(abi_ulong target_addr,
3457                                                struct ipc_perm *host_ip)
3458 {
3459     struct target_ipc_perm *target_ip;
3460     struct target_semid64_ds *target_sd;
3461 
3462     if (!lock_user_struct(VERIFY_WRITE, target_sd, target_addr, 0))
3463         return -TARGET_EFAULT;
3464     target_ip = &(target_sd->sem_perm);
3465     target_ip->__key = tswap32(host_ip->__key);
3466     target_ip->uid = tswap32(host_ip->uid);
3467     target_ip->gid = tswap32(host_ip->gid);
3468     target_ip->cuid = tswap32(host_ip->cuid);
3469     target_ip->cgid = tswap32(host_ip->cgid);
3470 #if defined(TARGET_ALPHA) || defined(TARGET_MIPS) || defined(TARGET_PPC)
3471     target_ip->mode = tswap32(host_ip->mode);
3472 #else
3473     target_ip->mode = tswap16(host_ip->mode);
3474 #endif
3475 #if defined(TARGET_PPC)
3476     target_ip->__seq = tswap32(host_ip->__seq);
3477 #else
3478     target_ip->__seq = tswap16(host_ip->__seq);
3479 #endif
3480     unlock_user_struct(target_sd, target_addr, 1);
3481     return 0;
3482 }
3483 
3484 static inline abi_long target_to_host_semid_ds(struct semid_ds *host_sd,
3485                                                abi_ulong target_addr)
3486 {
3487     struct target_semid64_ds *target_sd;
3488 
3489     if (!lock_user_struct(VERIFY_READ, target_sd, target_addr, 1))
3490         return -TARGET_EFAULT;
3491     if (target_to_host_ipc_perm(&(host_sd->sem_perm),target_addr))
3492         return -TARGET_EFAULT;
3493     host_sd->sem_nsems = tswapal(target_sd->sem_nsems);
3494     host_sd->sem_otime = tswapal(target_sd->sem_otime);
3495     host_sd->sem_ctime = tswapal(target_sd->sem_ctime);
3496     unlock_user_struct(target_sd, target_addr, 0);
3497     return 0;
3498 }
3499 
3500 static inline abi_long host_to_target_semid_ds(abi_ulong target_addr,
3501                                                struct semid_ds *host_sd)
3502 {
3503     struct target_semid64_ds *target_sd;
3504 
3505     if (!lock_user_struct(VERIFY_WRITE, target_sd, target_addr, 0))
3506         return -TARGET_EFAULT;
3507     if (host_to_target_ipc_perm(target_addr,&(host_sd->sem_perm)))
3508         return -TARGET_EFAULT;
3509     target_sd->sem_nsems = tswapal(host_sd->sem_nsems);
3510     target_sd->sem_otime = tswapal(host_sd->sem_otime);
3511     target_sd->sem_ctime = tswapal(host_sd->sem_ctime);
3512     unlock_user_struct(target_sd, target_addr, 1);
3513     return 0;
3514 }
3515 
3516 struct target_seminfo {
3517     int semmap;
3518     int semmni;
3519     int semmns;
3520     int semmnu;
3521     int semmsl;
3522     int semopm;
3523     int semume;
3524     int semusz;
3525     int semvmx;
3526     int semaem;
3527 };
3528 
3529 static inline abi_long host_to_target_seminfo(abi_ulong target_addr,
3530                                               struct seminfo *host_seminfo)
3531 {
3532     struct target_seminfo *target_seminfo;
3533     if (!lock_user_struct(VERIFY_WRITE, target_seminfo, target_addr, 0))
3534         return -TARGET_EFAULT;
3535     __put_user(host_seminfo->semmap, &target_seminfo->semmap);
3536     __put_user(host_seminfo->semmni, &target_seminfo->semmni);
3537     __put_user(host_seminfo->semmns, &target_seminfo->semmns);
3538     __put_user(host_seminfo->semmnu, &target_seminfo->semmnu);
3539     __put_user(host_seminfo->semmsl, &target_seminfo->semmsl);
3540     __put_user(host_seminfo->semopm, &target_seminfo->semopm);
3541     __put_user(host_seminfo->semume, &target_seminfo->semume);
3542     __put_user(host_seminfo->semusz, &target_seminfo->semusz);
3543     __put_user(host_seminfo->semvmx, &target_seminfo->semvmx);
3544     __put_user(host_seminfo->semaem, &target_seminfo->semaem);
3545     unlock_user_struct(target_seminfo, target_addr, 1);
3546     return 0;
3547 }
3548 
3549 union semun {
3550 	int val;
3551 	struct semid_ds *buf;
3552 	unsigned short *array;
3553 	struct seminfo *__buf;
3554 };
3555 
3556 union target_semun {
3557 	int val;
3558 	abi_ulong buf;
3559 	abi_ulong array;
3560 	abi_ulong __buf;
3561 };
3562 
3563 static inline abi_long target_to_host_semarray(int semid, unsigned short **host_array,
3564                                                abi_ulong target_addr)
3565 {
3566     int nsems;
3567     unsigned short *array;
3568     union semun semun;
3569     struct semid_ds semid_ds;
3570     int i, ret;
3571 
3572     semun.buf = &semid_ds;
3573 
3574     ret = semctl(semid, 0, IPC_STAT, semun);
3575     if (ret == -1)
3576         return get_errno(ret);
3577 
3578     nsems = semid_ds.sem_nsems;
3579 
3580     *host_array = g_try_new(unsigned short, nsems);
3581     if (!*host_array) {
3582         return -TARGET_ENOMEM;
3583     }
3584     array = lock_user(VERIFY_READ, target_addr,
3585                       nsems*sizeof(unsigned short), 1);
3586     if (!array) {
3587         g_free(*host_array);
3588         return -TARGET_EFAULT;
3589     }
3590 
3591     for(i=0; i<nsems; i++) {
3592         __get_user((*host_array)[i], &array[i]);
3593     }
3594     unlock_user(array, target_addr, 0);
3595 
3596     return 0;
3597 }
3598 
3599 static inline abi_long host_to_target_semarray(int semid, abi_ulong target_addr,
3600                                                unsigned short **host_array)
3601 {
3602     int nsems;
3603     unsigned short *array;
3604     union semun semun;
3605     struct semid_ds semid_ds;
3606     int i, ret;
3607 
3608     semun.buf = &semid_ds;
3609 
3610     ret = semctl(semid, 0, IPC_STAT, semun);
3611     if (ret == -1)
3612         return get_errno(ret);
3613 
3614     nsems = semid_ds.sem_nsems;
3615 
3616     array = lock_user(VERIFY_WRITE, target_addr,
3617                       nsems*sizeof(unsigned short), 0);
3618     if (!array)
3619         return -TARGET_EFAULT;
3620 
3621     for(i=0; i<nsems; i++) {
3622         __put_user((*host_array)[i], &array[i]);
3623     }
3624     g_free(*host_array);
3625     unlock_user(array, target_addr, 1);
3626 
3627     return 0;
3628 }
3629 
3630 static inline abi_long do_semctl(int semid, int semnum, int cmd,
3631                                  abi_ulong target_arg)
3632 {
3633     union target_semun target_su = { .buf = target_arg };
3634     union semun arg;
3635     struct semid_ds dsarg;
3636     unsigned short *array = NULL;
3637     struct seminfo seminfo;
3638     abi_long ret = -TARGET_EINVAL;
3639     abi_long err;
3640     cmd &= 0xff;
3641 
3642     switch( cmd ) {
3643 	case GETVAL:
3644 	case SETVAL:
3645             /* In 64 bit cross-endian situations, we will erroneously pick up
3646              * the wrong half of the union for the "val" element.  To rectify
3647              * this, the entire 8-byte structure is byteswapped, followed by
3648 	     * a swap of the 4 byte val field. In other cases, the data is
3649 	     * already in proper host byte order. */
3650 	    if (sizeof(target_su.val) != (sizeof(target_su.buf))) {
3651 		target_su.buf = tswapal(target_su.buf);
3652 		arg.val = tswap32(target_su.val);
3653 	    } else {
3654 		arg.val = target_su.val;
3655 	    }
3656             ret = get_errno(semctl(semid, semnum, cmd, arg));
3657             break;
3658 	case GETALL:
3659 	case SETALL:
3660             err = target_to_host_semarray(semid, &array, target_su.array);
3661             if (err)
3662                 return err;
3663             arg.array = array;
3664             ret = get_errno(semctl(semid, semnum, cmd, arg));
3665             err = host_to_target_semarray(semid, target_su.array, &array);
3666             if (err)
3667                 return err;
3668             break;
3669 	case IPC_STAT:
3670 	case IPC_SET:
3671 	case SEM_STAT:
3672             err = target_to_host_semid_ds(&dsarg, target_su.buf);
3673             if (err)
3674                 return err;
3675             arg.buf = &dsarg;
3676             ret = get_errno(semctl(semid, semnum, cmd, arg));
3677             err = host_to_target_semid_ds(target_su.buf, &dsarg);
3678             if (err)
3679                 return err;
3680             break;
3681 	case IPC_INFO:
3682 	case SEM_INFO:
3683             arg.__buf = &seminfo;
3684             ret = get_errno(semctl(semid, semnum, cmd, arg));
3685             err = host_to_target_seminfo(target_su.__buf, &seminfo);
3686             if (err)
3687                 return err;
3688             break;
3689 	case IPC_RMID:
3690 	case GETPID:
3691 	case GETNCNT:
3692 	case GETZCNT:
3693             ret = get_errno(semctl(semid, semnum, cmd, NULL));
3694             break;
3695     }
3696 
3697     return ret;
3698 }
3699 
3700 struct target_sembuf {
3701     unsigned short sem_num;
3702     short sem_op;
3703     short sem_flg;
3704 };
3705 
3706 static inline abi_long target_to_host_sembuf(struct sembuf *host_sembuf,
3707                                              abi_ulong target_addr,
3708                                              unsigned nsops)
3709 {
3710     struct target_sembuf *target_sembuf;
3711     int i;
3712 
3713     target_sembuf = lock_user(VERIFY_READ, target_addr,
3714                               nsops*sizeof(struct target_sembuf), 1);
3715     if (!target_sembuf)
3716         return -TARGET_EFAULT;
3717 
3718     for(i=0; i<nsops; i++) {
3719         __get_user(host_sembuf[i].sem_num, &target_sembuf[i].sem_num);
3720         __get_user(host_sembuf[i].sem_op, &target_sembuf[i].sem_op);
3721         __get_user(host_sembuf[i].sem_flg, &target_sembuf[i].sem_flg);
3722     }
3723 
3724     unlock_user(target_sembuf, target_addr, 0);
3725 
3726     return 0;
3727 }
3728 
3729 static inline abi_long do_semop(int semid, abi_long ptr, unsigned nsops)
3730 {
3731     struct sembuf sops[nsops];
3732     abi_long ret;
3733 
3734     if (target_to_host_sembuf(sops, ptr, nsops))
3735         return -TARGET_EFAULT;
3736 
3737     ret = -TARGET_ENOSYS;
3738 #ifdef __NR_semtimedop
3739     ret = get_errno(safe_semtimedop(semid, sops, nsops, NULL));
3740 #endif
3741 #ifdef __NR_ipc
3742     if (ret == -TARGET_ENOSYS) {
3743         ret = get_errno(safe_ipc(IPCOP_semtimedop, semid, nsops, 0, sops, 0));
3744     }
3745 #endif
3746     return ret;
3747 }
3748 
3749 struct target_msqid_ds
3750 {
3751     struct target_ipc_perm msg_perm;
3752     abi_ulong msg_stime;
3753 #if TARGET_ABI_BITS == 32
3754     abi_ulong __unused1;
3755 #endif
3756     abi_ulong msg_rtime;
3757 #if TARGET_ABI_BITS == 32
3758     abi_ulong __unused2;
3759 #endif
3760     abi_ulong msg_ctime;
3761 #if TARGET_ABI_BITS == 32
3762     abi_ulong __unused3;
3763 #endif
3764     abi_ulong __msg_cbytes;
3765     abi_ulong msg_qnum;
3766     abi_ulong msg_qbytes;
3767     abi_ulong msg_lspid;
3768     abi_ulong msg_lrpid;
3769     abi_ulong __unused4;
3770     abi_ulong __unused5;
3771 };
3772 
3773 static inline abi_long target_to_host_msqid_ds(struct msqid_ds *host_md,
3774                                                abi_ulong target_addr)
3775 {
3776     struct target_msqid_ds *target_md;
3777 
3778     if (!lock_user_struct(VERIFY_READ, target_md, target_addr, 1))
3779         return -TARGET_EFAULT;
3780     if (target_to_host_ipc_perm(&(host_md->msg_perm),target_addr))
3781         return -TARGET_EFAULT;
3782     host_md->msg_stime = tswapal(target_md->msg_stime);
3783     host_md->msg_rtime = tswapal(target_md->msg_rtime);
3784     host_md->msg_ctime = tswapal(target_md->msg_ctime);
3785     host_md->__msg_cbytes = tswapal(target_md->__msg_cbytes);
3786     host_md->msg_qnum = tswapal(target_md->msg_qnum);
3787     host_md->msg_qbytes = tswapal(target_md->msg_qbytes);
3788     host_md->msg_lspid = tswapal(target_md->msg_lspid);
3789     host_md->msg_lrpid = tswapal(target_md->msg_lrpid);
3790     unlock_user_struct(target_md, target_addr, 0);
3791     return 0;
3792 }
3793 
3794 static inline abi_long host_to_target_msqid_ds(abi_ulong target_addr,
3795                                                struct msqid_ds *host_md)
3796 {
3797     struct target_msqid_ds *target_md;
3798 
3799     if (!lock_user_struct(VERIFY_WRITE, target_md, target_addr, 0))
3800         return -TARGET_EFAULT;
3801     if (host_to_target_ipc_perm(target_addr,&(host_md->msg_perm)))
3802         return -TARGET_EFAULT;
3803     target_md->msg_stime = tswapal(host_md->msg_stime);
3804     target_md->msg_rtime = tswapal(host_md->msg_rtime);
3805     target_md->msg_ctime = tswapal(host_md->msg_ctime);
3806     target_md->__msg_cbytes = tswapal(host_md->__msg_cbytes);
3807     target_md->msg_qnum = tswapal(host_md->msg_qnum);
3808     target_md->msg_qbytes = tswapal(host_md->msg_qbytes);
3809     target_md->msg_lspid = tswapal(host_md->msg_lspid);
3810     target_md->msg_lrpid = tswapal(host_md->msg_lrpid);
3811     unlock_user_struct(target_md, target_addr, 1);
3812     return 0;
3813 }
3814 
3815 struct target_msginfo {
3816     int msgpool;
3817     int msgmap;
3818     int msgmax;
3819     int msgmnb;
3820     int msgmni;
3821     int msgssz;
3822     int msgtql;
3823     unsigned short int msgseg;
3824 };
3825 
3826 static inline abi_long host_to_target_msginfo(abi_ulong target_addr,
3827                                               struct msginfo *host_msginfo)
3828 {
3829     struct target_msginfo *target_msginfo;
3830     if (!lock_user_struct(VERIFY_WRITE, target_msginfo, target_addr, 0))
3831         return -TARGET_EFAULT;
3832     __put_user(host_msginfo->msgpool, &target_msginfo->msgpool);
3833     __put_user(host_msginfo->msgmap, &target_msginfo->msgmap);
3834     __put_user(host_msginfo->msgmax, &target_msginfo->msgmax);
3835     __put_user(host_msginfo->msgmnb, &target_msginfo->msgmnb);
3836     __put_user(host_msginfo->msgmni, &target_msginfo->msgmni);
3837     __put_user(host_msginfo->msgssz, &target_msginfo->msgssz);
3838     __put_user(host_msginfo->msgtql, &target_msginfo->msgtql);
3839     __put_user(host_msginfo->msgseg, &target_msginfo->msgseg);
3840     unlock_user_struct(target_msginfo, target_addr, 1);
3841     return 0;
3842 }
3843 
3844 static inline abi_long do_msgctl(int msgid, int cmd, abi_long ptr)
3845 {
3846     struct msqid_ds dsarg;
3847     struct msginfo msginfo;
3848     abi_long ret = -TARGET_EINVAL;
3849 
3850     cmd &= 0xff;
3851 
3852     switch (cmd) {
3853     case IPC_STAT:
3854     case IPC_SET:
3855     case MSG_STAT:
3856         if (target_to_host_msqid_ds(&dsarg,ptr))
3857             return -TARGET_EFAULT;
3858         ret = get_errno(msgctl(msgid, cmd, &dsarg));
3859         if (host_to_target_msqid_ds(ptr,&dsarg))
3860             return -TARGET_EFAULT;
3861         break;
3862     case IPC_RMID:
3863         ret = get_errno(msgctl(msgid, cmd, NULL));
3864         break;
3865     case IPC_INFO:
3866     case MSG_INFO:
3867         ret = get_errno(msgctl(msgid, cmd, (struct msqid_ds *)&msginfo));
3868         if (host_to_target_msginfo(ptr, &msginfo))
3869             return -TARGET_EFAULT;
3870         break;
3871     }
3872 
3873     return ret;
3874 }
3875 
3876 struct target_msgbuf {
3877     abi_long mtype;
3878     char	mtext[1];
3879 };
3880 
3881 static inline abi_long do_msgsnd(int msqid, abi_long msgp,
3882                                  ssize_t msgsz, int msgflg)
3883 {
3884     struct target_msgbuf *target_mb;
3885     struct msgbuf *host_mb;
3886     abi_long ret = 0;
3887 
3888     if (msgsz < 0) {
3889         return -TARGET_EINVAL;
3890     }
3891 
3892     if (!lock_user_struct(VERIFY_READ, target_mb, msgp, 0))
3893         return -TARGET_EFAULT;
3894     host_mb = g_try_malloc(msgsz + sizeof(long));
3895     if (!host_mb) {
3896         unlock_user_struct(target_mb, msgp, 0);
3897         return -TARGET_ENOMEM;
3898     }
3899     host_mb->mtype = (abi_long) tswapal(target_mb->mtype);
3900     memcpy(host_mb->mtext, target_mb->mtext, msgsz);
3901     ret = -TARGET_ENOSYS;
3902 #ifdef __NR_msgsnd
3903     ret = get_errno(safe_msgsnd(msqid, host_mb, msgsz, msgflg));
3904 #endif
3905 #ifdef __NR_ipc
3906     if (ret == -TARGET_ENOSYS) {
3907         ret = get_errno(safe_ipc(IPCOP_msgsnd, msqid, msgsz, msgflg,
3908                                  host_mb, 0));
3909     }
3910 #endif
3911     g_free(host_mb);
3912     unlock_user_struct(target_mb, msgp, 0);
3913 
3914     return ret;
3915 }
3916 
3917 static inline abi_long do_msgrcv(int msqid, abi_long msgp,
3918                                  ssize_t msgsz, abi_long msgtyp,
3919                                  int msgflg)
3920 {
3921     struct target_msgbuf *target_mb;
3922     char *target_mtext;
3923     struct msgbuf *host_mb;
3924     abi_long ret = 0;
3925 
3926     if (msgsz < 0) {
3927         return -TARGET_EINVAL;
3928     }
3929 
3930     if (!lock_user_struct(VERIFY_WRITE, target_mb, msgp, 0))
3931         return -TARGET_EFAULT;
3932 
3933     host_mb = g_try_malloc(msgsz + sizeof(long));
3934     if (!host_mb) {
3935         ret = -TARGET_ENOMEM;
3936         goto end;
3937     }
3938     ret = -TARGET_ENOSYS;
3939 #ifdef __NR_msgrcv
3940     ret = get_errno(safe_msgrcv(msqid, host_mb, msgsz, msgtyp, msgflg));
3941 #endif
3942 #ifdef __NR_ipc
3943     if (ret == -TARGET_ENOSYS) {
3944         ret = get_errno(safe_ipc(IPCOP_CALL(1, IPCOP_msgrcv), msqid, msgsz,
3945                         msgflg, host_mb, msgtyp));
3946     }
3947 #endif
3948 
3949     if (ret > 0) {
3950         abi_ulong target_mtext_addr = msgp + sizeof(abi_ulong);
3951         target_mtext = lock_user(VERIFY_WRITE, target_mtext_addr, ret, 0);
3952         if (!target_mtext) {
3953             ret = -TARGET_EFAULT;
3954             goto end;
3955         }
3956         memcpy(target_mb->mtext, host_mb->mtext, ret);
3957         unlock_user(target_mtext, target_mtext_addr, ret);
3958     }
3959 
3960     target_mb->mtype = tswapal(host_mb->mtype);
3961 
3962 end:
3963     if (target_mb)
3964         unlock_user_struct(target_mb, msgp, 1);
3965     g_free(host_mb);
3966     return ret;
3967 }
3968 
3969 static inline abi_long target_to_host_shmid_ds(struct shmid_ds *host_sd,
3970                                                abi_ulong target_addr)
3971 {
3972     struct target_shmid_ds *target_sd;
3973 
3974     if (!lock_user_struct(VERIFY_READ, target_sd, target_addr, 1))
3975         return -TARGET_EFAULT;
3976     if (target_to_host_ipc_perm(&(host_sd->shm_perm), target_addr))
3977         return -TARGET_EFAULT;
3978     __get_user(host_sd->shm_segsz, &target_sd->shm_segsz);
3979     __get_user(host_sd->shm_atime, &target_sd->shm_atime);
3980     __get_user(host_sd->shm_dtime, &target_sd->shm_dtime);
3981     __get_user(host_sd->shm_ctime, &target_sd->shm_ctime);
3982     __get_user(host_sd->shm_cpid, &target_sd->shm_cpid);
3983     __get_user(host_sd->shm_lpid, &target_sd->shm_lpid);
3984     __get_user(host_sd->shm_nattch, &target_sd->shm_nattch);
3985     unlock_user_struct(target_sd, target_addr, 0);
3986     return 0;
3987 }
3988 
3989 static inline abi_long host_to_target_shmid_ds(abi_ulong target_addr,
3990                                                struct shmid_ds *host_sd)
3991 {
3992     struct target_shmid_ds *target_sd;
3993 
3994     if (!lock_user_struct(VERIFY_WRITE, target_sd, target_addr, 0))
3995         return -TARGET_EFAULT;
3996     if (host_to_target_ipc_perm(target_addr, &(host_sd->shm_perm)))
3997         return -TARGET_EFAULT;
3998     __put_user(host_sd->shm_segsz, &target_sd->shm_segsz);
3999     __put_user(host_sd->shm_atime, &target_sd->shm_atime);
4000     __put_user(host_sd->shm_dtime, &target_sd->shm_dtime);
4001     __put_user(host_sd->shm_ctime, &target_sd->shm_ctime);
4002     __put_user(host_sd->shm_cpid, &target_sd->shm_cpid);
4003     __put_user(host_sd->shm_lpid, &target_sd->shm_lpid);
4004     __put_user(host_sd->shm_nattch, &target_sd->shm_nattch);
4005     unlock_user_struct(target_sd, target_addr, 1);
4006     return 0;
4007 }
4008 
4009 struct  target_shminfo {
4010     abi_ulong shmmax;
4011     abi_ulong shmmin;
4012     abi_ulong shmmni;
4013     abi_ulong shmseg;
4014     abi_ulong shmall;
4015 };
4016 
4017 static inline abi_long host_to_target_shminfo(abi_ulong target_addr,
4018                                               struct shminfo *host_shminfo)
4019 {
4020     struct target_shminfo *target_shminfo;
4021     if (!lock_user_struct(VERIFY_WRITE, target_shminfo, target_addr, 0))
4022         return -TARGET_EFAULT;
4023     __put_user(host_shminfo->shmmax, &target_shminfo->shmmax);
4024     __put_user(host_shminfo->shmmin, &target_shminfo->shmmin);
4025     __put_user(host_shminfo->shmmni, &target_shminfo->shmmni);
4026     __put_user(host_shminfo->shmseg, &target_shminfo->shmseg);
4027     __put_user(host_shminfo->shmall, &target_shminfo->shmall);
4028     unlock_user_struct(target_shminfo, target_addr, 1);
4029     return 0;
4030 }
4031 
4032 struct target_shm_info {
4033     int used_ids;
4034     abi_ulong shm_tot;
4035     abi_ulong shm_rss;
4036     abi_ulong shm_swp;
4037     abi_ulong swap_attempts;
4038     abi_ulong swap_successes;
4039 };
4040 
4041 static inline abi_long host_to_target_shm_info(abi_ulong target_addr,
4042                                                struct shm_info *host_shm_info)
4043 {
4044     struct target_shm_info *target_shm_info;
4045     if (!lock_user_struct(VERIFY_WRITE, target_shm_info, target_addr, 0))
4046         return -TARGET_EFAULT;
4047     __put_user(host_shm_info->used_ids, &target_shm_info->used_ids);
4048     __put_user(host_shm_info->shm_tot, &target_shm_info->shm_tot);
4049     __put_user(host_shm_info->shm_rss, &target_shm_info->shm_rss);
4050     __put_user(host_shm_info->shm_swp, &target_shm_info->shm_swp);
4051     __put_user(host_shm_info->swap_attempts, &target_shm_info->swap_attempts);
4052     __put_user(host_shm_info->swap_successes, &target_shm_info->swap_successes);
4053     unlock_user_struct(target_shm_info, target_addr, 1);
4054     return 0;
4055 }
4056 
4057 static inline abi_long do_shmctl(int shmid, int cmd, abi_long buf)
4058 {
4059     struct shmid_ds dsarg;
4060     struct shminfo shminfo;
4061     struct shm_info shm_info;
4062     abi_long ret = -TARGET_EINVAL;
4063 
4064     cmd &= 0xff;
4065 
4066     switch(cmd) {
4067     case IPC_STAT:
4068     case IPC_SET:
4069     case SHM_STAT:
4070         if (target_to_host_shmid_ds(&dsarg, buf))
4071             return -TARGET_EFAULT;
4072         ret = get_errno(shmctl(shmid, cmd, &dsarg));
4073         if (host_to_target_shmid_ds(buf, &dsarg))
4074             return -TARGET_EFAULT;
4075         break;
4076     case IPC_INFO:
4077         ret = get_errno(shmctl(shmid, cmd, (struct shmid_ds *)&shminfo));
4078         if (host_to_target_shminfo(buf, &shminfo))
4079             return -TARGET_EFAULT;
4080         break;
4081     case SHM_INFO:
4082         ret = get_errno(shmctl(shmid, cmd, (struct shmid_ds *)&shm_info));
4083         if (host_to_target_shm_info(buf, &shm_info))
4084             return -TARGET_EFAULT;
4085         break;
4086     case IPC_RMID:
4087     case SHM_LOCK:
4088     case SHM_UNLOCK:
4089         ret = get_errno(shmctl(shmid, cmd, NULL));
4090         break;
4091     }
4092 
4093     return ret;
4094 }
4095 
4096 #ifndef TARGET_FORCE_SHMLBA
4097 /* For most architectures, SHMLBA is the same as the page size;
4098  * some architectures have larger values, in which case they should
4099  * define TARGET_FORCE_SHMLBA and provide a target_shmlba() function.
4100  * This corresponds to the kernel arch code defining __ARCH_FORCE_SHMLBA
4101  * and defining its own value for SHMLBA.
4102  *
4103  * The kernel also permits SHMLBA to be set by the architecture to a
4104  * value larger than the page size without setting __ARCH_FORCE_SHMLBA;
4105  * this means that addresses are rounded to the large size if
4106  * SHM_RND is set but addresses not aligned to that size are not rejected
4107  * as long as they are at least page-aligned. Since the only architecture
4108  * which uses this is ia64 this code doesn't provide for that oddity.
4109  */
4110 static inline abi_ulong target_shmlba(CPUArchState *cpu_env)
4111 {
4112     return TARGET_PAGE_SIZE;
4113 }
4114 #endif
4115 
4116 static inline abi_ulong do_shmat(CPUArchState *cpu_env,
4117                                  int shmid, abi_ulong shmaddr, int shmflg)
4118 {
4119     abi_long raddr;
4120     void *host_raddr;
4121     struct shmid_ds shm_info;
4122     int i,ret;
4123     abi_ulong shmlba;
4124 
4125     /* find out the length of the shared memory segment */
4126     ret = get_errno(shmctl(shmid, IPC_STAT, &shm_info));
4127     if (is_error(ret)) {
4128         /* can't get length, bail out */
4129         return ret;
4130     }
4131 
4132     shmlba = target_shmlba(cpu_env);
4133 
4134     if (shmaddr & (shmlba - 1)) {
4135         if (shmflg & SHM_RND) {
4136             shmaddr &= ~(shmlba - 1);
4137         } else {
4138             return -TARGET_EINVAL;
4139         }
4140     }
4141     if (!guest_range_valid(shmaddr, shm_info.shm_segsz)) {
4142         return -TARGET_EINVAL;
4143     }
4144 
4145     mmap_lock();
4146 
4147     if (shmaddr)
4148         host_raddr = shmat(shmid, (void *)g2h(shmaddr), shmflg);
4149     else {
4150         abi_ulong mmap_start;
4151 
4152         /* In order to use the host shmat, we need to honor host SHMLBA.  */
4153         mmap_start = mmap_find_vma(0, shm_info.shm_segsz, MAX(SHMLBA, shmlba));
4154 
4155         if (mmap_start == -1) {
4156             errno = ENOMEM;
4157             host_raddr = (void *)-1;
4158         } else
4159             host_raddr = shmat(shmid, g2h(mmap_start), shmflg | SHM_REMAP);
4160     }
4161 
4162     if (host_raddr == (void *)-1) {
4163         mmap_unlock();
4164         return get_errno((long)host_raddr);
4165     }
4166     raddr=h2g((unsigned long)host_raddr);
4167 
4168     page_set_flags(raddr, raddr + shm_info.shm_segsz,
4169                    PAGE_VALID | PAGE_READ |
4170                    ((shmflg & SHM_RDONLY)? 0 : PAGE_WRITE));
4171 
4172     for (i = 0; i < N_SHM_REGIONS; i++) {
4173         if (!shm_regions[i].in_use) {
4174             shm_regions[i].in_use = true;
4175             shm_regions[i].start = raddr;
4176             shm_regions[i].size = shm_info.shm_segsz;
4177             break;
4178         }
4179     }
4180 
4181     mmap_unlock();
4182     return raddr;
4183 
4184 }
4185 
4186 static inline abi_long do_shmdt(abi_ulong shmaddr)
4187 {
4188     int i;
4189     abi_long rv;
4190 
4191     mmap_lock();
4192 
4193     for (i = 0; i < N_SHM_REGIONS; ++i) {
4194         if (shm_regions[i].in_use && shm_regions[i].start == shmaddr) {
4195             shm_regions[i].in_use = false;
4196             page_set_flags(shmaddr, shmaddr + shm_regions[i].size, 0);
4197             break;
4198         }
4199     }
4200     rv = get_errno(shmdt(g2h(shmaddr)));
4201 
4202     mmap_unlock();
4203 
4204     return rv;
4205 }
4206 
4207 #ifdef TARGET_NR_ipc
4208 /* ??? This only works with linear mappings.  */
4209 /* do_ipc() must return target values and target errnos. */
4210 static abi_long do_ipc(CPUArchState *cpu_env,
4211                        unsigned int call, abi_long first,
4212                        abi_long second, abi_long third,
4213                        abi_long ptr, abi_long fifth)
4214 {
4215     int version;
4216     abi_long ret = 0;
4217 
4218     version = call >> 16;
4219     call &= 0xffff;
4220 
4221     switch (call) {
4222     case IPCOP_semop:
4223         ret = do_semop(first, ptr, second);
4224         break;
4225 
4226     case IPCOP_semget:
4227         ret = get_errno(semget(first, second, third));
4228         break;
4229 
4230     case IPCOP_semctl: {
4231         /* The semun argument to semctl is passed by value, so dereference the
4232          * ptr argument. */
4233         abi_ulong atptr;
4234         get_user_ual(atptr, ptr);
4235         ret = do_semctl(first, second, third, atptr);
4236         break;
4237     }
4238 
4239     case IPCOP_msgget:
4240         ret = get_errno(msgget(first, second));
4241         break;
4242 
4243     case IPCOP_msgsnd:
4244         ret = do_msgsnd(first, ptr, second, third);
4245         break;
4246 
4247     case IPCOP_msgctl:
4248         ret = do_msgctl(first, second, ptr);
4249         break;
4250 
4251     case IPCOP_msgrcv:
4252         switch (version) {
4253         case 0:
4254             {
4255                 struct target_ipc_kludge {
4256                     abi_long msgp;
4257                     abi_long msgtyp;
4258                 } *tmp;
4259 
4260                 if (!lock_user_struct(VERIFY_READ, tmp, ptr, 1)) {
4261                     ret = -TARGET_EFAULT;
4262                     break;
4263                 }
4264 
4265                 ret = do_msgrcv(first, tswapal(tmp->msgp), second, tswapal(tmp->msgtyp), third);
4266 
4267                 unlock_user_struct(tmp, ptr, 0);
4268                 break;
4269             }
4270         default:
4271             ret = do_msgrcv(first, ptr, second, fifth, third);
4272         }
4273         break;
4274 
4275     case IPCOP_shmat:
4276         switch (version) {
4277         default:
4278         {
4279             abi_ulong raddr;
4280             raddr = do_shmat(cpu_env, first, ptr, second);
4281             if (is_error(raddr))
4282                 return get_errno(raddr);
4283             if (put_user_ual(raddr, third))
4284                 return -TARGET_EFAULT;
4285             break;
4286         }
4287         case 1:
4288             ret = -TARGET_EINVAL;
4289             break;
4290         }
4291 	break;
4292     case IPCOP_shmdt:
4293         ret = do_shmdt(ptr);
4294 	break;
4295 
4296     case IPCOP_shmget:
4297 	/* IPC_* flag values are the same on all linux platforms */
4298 	ret = get_errno(shmget(first, second, third));
4299 	break;
4300 
4301 	/* IPC_* and SHM_* command values are the same on all linux platforms */
4302     case IPCOP_shmctl:
4303         ret = do_shmctl(first, second, ptr);
4304         break;
4305     default:
4306 	gemu_log("Unsupported ipc call: %d (version %d)\n", call, version);
4307 	ret = -TARGET_ENOSYS;
4308 	break;
4309     }
4310     return ret;
4311 }
4312 #endif
4313 
4314 /* kernel structure types definitions */
4315 
4316 #define STRUCT(name, ...) STRUCT_ ## name,
4317 #define STRUCT_SPECIAL(name) STRUCT_ ## name,
4318 enum {
4319 #include "syscall_types.h"
4320 STRUCT_MAX
4321 };
4322 #undef STRUCT
4323 #undef STRUCT_SPECIAL
4324 
4325 #define STRUCT(name, ...) static const argtype struct_ ## name ## _def[] = {  __VA_ARGS__, TYPE_NULL };
4326 #define STRUCT_SPECIAL(name)
4327 #include "syscall_types.h"
4328 #undef STRUCT
4329 #undef STRUCT_SPECIAL
4330 
4331 typedef struct IOCTLEntry IOCTLEntry;
4332 
4333 typedef abi_long do_ioctl_fn(const IOCTLEntry *ie, uint8_t *buf_temp,
4334                              int fd, int cmd, abi_long arg);
4335 
4336 struct IOCTLEntry {
4337     int target_cmd;
4338     unsigned int host_cmd;
4339     const char *name;
4340     int access;
4341     do_ioctl_fn *do_ioctl;
4342     const argtype arg_type[5];
4343 };
4344 
4345 #define IOC_R 0x0001
4346 #define IOC_W 0x0002
4347 #define IOC_RW (IOC_R | IOC_W)
4348 
4349 #define MAX_STRUCT_SIZE 4096
4350 
4351 #ifdef CONFIG_FIEMAP
4352 /* So fiemap access checks don't overflow on 32 bit systems.
4353  * This is very slightly smaller than the limit imposed by
4354  * the underlying kernel.
4355  */
4356 #define FIEMAP_MAX_EXTENTS ((UINT_MAX - sizeof(struct fiemap))  \
4357                             / sizeof(struct fiemap_extent))
4358 
4359 static abi_long do_ioctl_fs_ioc_fiemap(const IOCTLEntry *ie, uint8_t *buf_temp,
4360                                        int fd, int cmd, abi_long arg)
4361 {
4362     /* The parameter for this ioctl is a struct fiemap followed
4363      * by an array of struct fiemap_extent whose size is set
4364      * in fiemap->fm_extent_count. The array is filled in by the
4365      * ioctl.
4366      */
4367     int target_size_in, target_size_out;
4368     struct fiemap *fm;
4369     const argtype *arg_type = ie->arg_type;
4370     const argtype extent_arg_type[] = { MK_STRUCT(STRUCT_fiemap_extent) };
4371     void *argptr, *p;
4372     abi_long ret;
4373     int i, extent_size = thunk_type_size(extent_arg_type, 0);
4374     uint32_t outbufsz;
4375     int free_fm = 0;
4376 
4377     assert(arg_type[0] == TYPE_PTR);
4378     assert(ie->access == IOC_RW);
4379     arg_type++;
4380     target_size_in = thunk_type_size(arg_type, 0);
4381     argptr = lock_user(VERIFY_READ, arg, target_size_in, 1);
4382     if (!argptr) {
4383         return -TARGET_EFAULT;
4384     }
4385     thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
4386     unlock_user(argptr, arg, 0);
4387     fm = (struct fiemap *)buf_temp;
4388     if (fm->fm_extent_count > FIEMAP_MAX_EXTENTS) {
4389         return -TARGET_EINVAL;
4390     }
4391 
4392     outbufsz = sizeof (*fm) +
4393         (sizeof(struct fiemap_extent) * fm->fm_extent_count);
4394 
4395     if (outbufsz > MAX_STRUCT_SIZE) {
4396         /* We can't fit all the extents into the fixed size buffer.
4397          * Allocate one that is large enough and use it instead.
4398          */
4399         fm = g_try_malloc(outbufsz);
4400         if (!fm) {
4401             return -TARGET_ENOMEM;
4402         }
4403         memcpy(fm, buf_temp, sizeof(struct fiemap));
4404         free_fm = 1;
4405     }
4406     ret = get_errno(safe_ioctl(fd, ie->host_cmd, fm));
4407     if (!is_error(ret)) {
4408         target_size_out = target_size_in;
4409         /* An extent_count of 0 means we were only counting the extents
4410          * so there are no structs to copy
4411          */
4412         if (fm->fm_extent_count != 0) {
4413             target_size_out += fm->fm_mapped_extents * extent_size;
4414         }
4415         argptr = lock_user(VERIFY_WRITE, arg, target_size_out, 0);
4416         if (!argptr) {
4417             ret = -TARGET_EFAULT;
4418         } else {
4419             /* Convert the struct fiemap */
4420             thunk_convert(argptr, fm, arg_type, THUNK_TARGET);
4421             if (fm->fm_extent_count != 0) {
4422                 p = argptr + target_size_in;
4423                 /* ...and then all the struct fiemap_extents */
4424                 for (i = 0; i < fm->fm_mapped_extents; i++) {
4425                     thunk_convert(p, &fm->fm_extents[i], extent_arg_type,
4426                                   THUNK_TARGET);
4427                     p += extent_size;
4428                 }
4429             }
4430             unlock_user(argptr, arg, target_size_out);
4431         }
4432     }
4433     if (free_fm) {
4434         g_free(fm);
4435     }
4436     return ret;
4437 }
4438 #endif
4439 
4440 static abi_long do_ioctl_ifconf(const IOCTLEntry *ie, uint8_t *buf_temp,
4441                                 int fd, int cmd, abi_long arg)
4442 {
4443     const argtype *arg_type = ie->arg_type;
4444     int target_size;
4445     void *argptr;
4446     int ret;
4447     struct ifconf *host_ifconf;
4448     uint32_t outbufsz;
4449     const argtype ifreq_arg_type[] = { MK_STRUCT(STRUCT_sockaddr_ifreq) };
4450     int target_ifreq_size;
4451     int nb_ifreq;
4452     int free_buf = 0;
4453     int i;
4454     int target_ifc_len;
4455     abi_long target_ifc_buf;
4456     int host_ifc_len;
4457     char *host_ifc_buf;
4458 
4459     assert(arg_type[0] == TYPE_PTR);
4460     assert(ie->access == IOC_RW);
4461 
4462     arg_type++;
4463     target_size = thunk_type_size(arg_type, 0);
4464 
4465     argptr = lock_user(VERIFY_READ, arg, target_size, 1);
4466     if (!argptr)
4467         return -TARGET_EFAULT;
4468     thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
4469     unlock_user(argptr, arg, 0);
4470 
4471     host_ifconf = (struct ifconf *)(unsigned long)buf_temp;
4472     target_ifc_buf = (abi_long)(unsigned long)host_ifconf->ifc_buf;
4473     target_ifreq_size = thunk_type_size(ifreq_arg_type, 0);
4474 
4475     if (target_ifc_buf != 0) {
4476         target_ifc_len = host_ifconf->ifc_len;
4477         nb_ifreq = target_ifc_len / target_ifreq_size;
4478         host_ifc_len = nb_ifreq * sizeof(struct ifreq);
4479 
4480         outbufsz = sizeof(*host_ifconf) + host_ifc_len;
4481         if (outbufsz > MAX_STRUCT_SIZE) {
4482             /*
4483              * We can't fit all the extents into the fixed size buffer.
4484              * Allocate one that is large enough and use it instead.
4485              */
4486             host_ifconf = malloc(outbufsz);
4487             if (!host_ifconf) {
4488                 return -TARGET_ENOMEM;
4489             }
4490             memcpy(host_ifconf, buf_temp, sizeof(*host_ifconf));
4491             free_buf = 1;
4492         }
4493         host_ifc_buf = (char *)host_ifconf + sizeof(*host_ifconf);
4494 
4495         host_ifconf->ifc_len = host_ifc_len;
4496     } else {
4497       host_ifc_buf = NULL;
4498     }
4499     host_ifconf->ifc_buf = host_ifc_buf;
4500 
4501     ret = get_errno(safe_ioctl(fd, ie->host_cmd, host_ifconf));
4502     if (!is_error(ret)) {
4503 	/* convert host ifc_len to target ifc_len */
4504 
4505         nb_ifreq = host_ifconf->ifc_len / sizeof(struct ifreq);
4506         target_ifc_len = nb_ifreq * target_ifreq_size;
4507         host_ifconf->ifc_len = target_ifc_len;
4508 
4509 	/* restore target ifc_buf */
4510 
4511         host_ifconf->ifc_buf = (char *)(unsigned long)target_ifc_buf;
4512 
4513 	/* copy struct ifconf to target user */
4514 
4515         argptr = lock_user(VERIFY_WRITE, arg, target_size, 0);
4516         if (!argptr)
4517             return -TARGET_EFAULT;
4518         thunk_convert(argptr, host_ifconf, arg_type, THUNK_TARGET);
4519         unlock_user(argptr, arg, target_size);
4520 
4521         if (target_ifc_buf != 0) {
4522             /* copy ifreq[] to target user */
4523             argptr = lock_user(VERIFY_WRITE, target_ifc_buf, target_ifc_len, 0);
4524             for (i = 0; i < nb_ifreq ; i++) {
4525                 thunk_convert(argptr + i * target_ifreq_size,
4526                               host_ifc_buf + i * sizeof(struct ifreq),
4527                               ifreq_arg_type, THUNK_TARGET);
4528             }
4529             unlock_user(argptr, target_ifc_buf, target_ifc_len);
4530         }
4531     }
4532 
4533     if (free_buf) {
4534         free(host_ifconf);
4535     }
4536 
4537     return ret;
4538 }
4539 
4540 #if defined(CONFIG_USBFS)
4541 #if HOST_LONG_BITS > 64
4542 #error USBDEVFS thunks do not support >64 bit hosts yet.
4543 #endif
4544 struct live_urb {
4545     uint64_t target_urb_adr;
4546     uint64_t target_buf_adr;
4547     char *target_buf_ptr;
4548     struct usbdevfs_urb host_urb;
4549 };
4550 
4551 static GHashTable *usbdevfs_urb_hashtable(void)
4552 {
4553     static GHashTable *urb_hashtable;
4554 
4555     if (!urb_hashtable) {
4556         urb_hashtable = g_hash_table_new(g_int64_hash, g_int64_equal);
4557     }
4558     return urb_hashtable;
4559 }
4560 
4561 static void urb_hashtable_insert(struct live_urb *urb)
4562 {
4563     GHashTable *urb_hashtable = usbdevfs_urb_hashtable();
4564     g_hash_table_insert(urb_hashtable, urb, urb);
4565 }
4566 
4567 static struct live_urb *urb_hashtable_lookup(uint64_t target_urb_adr)
4568 {
4569     GHashTable *urb_hashtable = usbdevfs_urb_hashtable();
4570     return g_hash_table_lookup(urb_hashtable, &target_urb_adr);
4571 }
4572 
4573 static void urb_hashtable_remove(struct live_urb *urb)
4574 {
4575     GHashTable *urb_hashtable = usbdevfs_urb_hashtable();
4576     g_hash_table_remove(urb_hashtable, urb);
4577 }
4578 
4579 static abi_long
4580 do_ioctl_usbdevfs_reapurb(const IOCTLEntry *ie, uint8_t *buf_temp,
4581                           int fd, int cmd, abi_long arg)
4582 {
4583     const argtype usbfsurb_arg_type[] = { MK_STRUCT(STRUCT_usbdevfs_urb) };
4584     const argtype ptrvoid_arg_type[] = { TYPE_PTRVOID, 0, 0 };
4585     struct live_urb *lurb;
4586     void *argptr;
4587     uint64_t hurb;
4588     int target_size;
4589     uintptr_t target_urb_adr;
4590     abi_long ret;
4591 
4592     target_size = thunk_type_size(usbfsurb_arg_type, THUNK_TARGET);
4593 
4594     memset(buf_temp, 0, sizeof(uint64_t));
4595     ret = get_errno(safe_ioctl(fd, ie->host_cmd, buf_temp));
4596     if (is_error(ret)) {
4597         return ret;
4598     }
4599 
4600     memcpy(&hurb, buf_temp, sizeof(uint64_t));
4601     lurb = (void *)((uintptr_t)hurb - offsetof(struct live_urb, host_urb));
4602     if (!lurb->target_urb_adr) {
4603         return -TARGET_EFAULT;
4604     }
4605     urb_hashtable_remove(lurb);
4606     unlock_user(lurb->target_buf_ptr, lurb->target_buf_adr,
4607         lurb->host_urb.buffer_length);
4608     lurb->target_buf_ptr = NULL;
4609 
4610     /* restore the guest buffer pointer */
4611     lurb->host_urb.buffer = (void *)(uintptr_t)lurb->target_buf_adr;
4612 
4613     /* update the guest urb struct */
4614     argptr = lock_user(VERIFY_WRITE, lurb->target_urb_adr, target_size, 0);
4615     if (!argptr) {
4616         g_free(lurb);
4617         return -TARGET_EFAULT;
4618     }
4619     thunk_convert(argptr, &lurb->host_urb, usbfsurb_arg_type, THUNK_TARGET);
4620     unlock_user(argptr, lurb->target_urb_adr, target_size);
4621 
4622     target_size = thunk_type_size(ptrvoid_arg_type, THUNK_TARGET);
4623     /* write back the urb handle */
4624     argptr = lock_user(VERIFY_WRITE, arg, target_size, 0);
4625     if (!argptr) {
4626         g_free(lurb);
4627         return -TARGET_EFAULT;
4628     }
4629 
4630     /* GHashTable uses 64-bit keys but thunk_convert expects uintptr_t */
4631     target_urb_adr = lurb->target_urb_adr;
4632     thunk_convert(argptr, &target_urb_adr, ptrvoid_arg_type, THUNK_TARGET);
4633     unlock_user(argptr, arg, target_size);
4634 
4635     g_free(lurb);
4636     return ret;
4637 }
4638 
4639 static abi_long
4640 do_ioctl_usbdevfs_discardurb(const IOCTLEntry *ie,
4641                              uint8_t *buf_temp __attribute__((unused)),
4642                              int fd, int cmd, abi_long arg)
4643 {
4644     struct live_urb *lurb;
4645 
4646     /* map target address back to host URB with metadata. */
4647     lurb = urb_hashtable_lookup(arg);
4648     if (!lurb) {
4649         return -TARGET_EFAULT;
4650     }
4651     return get_errno(safe_ioctl(fd, ie->host_cmd, &lurb->host_urb));
4652 }
4653 
4654 static abi_long
4655 do_ioctl_usbdevfs_submiturb(const IOCTLEntry *ie, uint8_t *buf_temp,
4656                             int fd, int cmd, abi_long arg)
4657 {
4658     const argtype *arg_type = ie->arg_type;
4659     int target_size;
4660     abi_long ret;
4661     void *argptr;
4662     int rw_dir;
4663     struct live_urb *lurb;
4664 
4665     /*
4666      * each submitted URB needs to map to a unique ID for the
4667      * kernel, and that unique ID needs to be a pointer to
4668      * host memory.  hence, we need to malloc for each URB.
4669      * isochronous transfers have a variable length struct.
4670      */
4671     arg_type++;
4672     target_size = thunk_type_size(arg_type, THUNK_TARGET);
4673 
4674     /* construct host copy of urb and metadata */
4675     lurb = g_try_malloc0(sizeof(struct live_urb));
4676     if (!lurb) {
4677         return -TARGET_ENOMEM;
4678     }
4679 
4680     argptr = lock_user(VERIFY_READ, arg, target_size, 1);
4681     if (!argptr) {
4682         g_free(lurb);
4683         return -TARGET_EFAULT;
4684     }
4685     thunk_convert(&lurb->host_urb, argptr, arg_type, THUNK_HOST);
4686     unlock_user(argptr, arg, 0);
4687 
4688     lurb->target_urb_adr = arg;
4689     lurb->target_buf_adr = (uintptr_t)lurb->host_urb.buffer;
4690 
4691     /* buffer space used depends on endpoint type so lock the entire buffer */
4692     /* control type urbs should check the buffer contents for true direction */
4693     rw_dir = lurb->host_urb.endpoint & USB_DIR_IN ? VERIFY_WRITE : VERIFY_READ;
4694     lurb->target_buf_ptr = lock_user(rw_dir, lurb->target_buf_adr,
4695         lurb->host_urb.buffer_length, 1);
4696     if (lurb->target_buf_ptr == NULL) {
4697         g_free(lurb);
4698         return -TARGET_EFAULT;
4699     }
4700 
4701     /* update buffer pointer in host copy */
4702     lurb->host_urb.buffer = lurb->target_buf_ptr;
4703 
4704     ret = get_errno(safe_ioctl(fd, ie->host_cmd, &lurb->host_urb));
4705     if (is_error(ret)) {
4706         unlock_user(lurb->target_buf_ptr, lurb->target_buf_adr, 0);
4707         g_free(lurb);
4708     } else {
4709         urb_hashtable_insert(lurb);
4710     }
4711 
4712     return ret;
4713 }
4714 #endif /* CONFIG_USBFS */
4715 
4716 static abi_long do_ioctl_dm(const IOCTLEntry *ie, uint8_t *buf_temp, int fd,
4717                             int cmd, abi_long arg)
4718 {
4719     void *argptr;
4720     struct dm_ioctl *host_dm;
4721     abi_long guest_data;
4722     uint32_t guest_data_size;
4723     int target_size;
4724     const argtype *arg_type = ie->arg_type;
4725     abi_long ret;
4726     void *big_buf = NULL;
4727     char *host_data;
4728 
4729     arg_type++;
4730     target_size = thunk_type_size(arg_type, 0);
4731     argptr = lock_user(VERIFY_READ, arg, target_size, 1);
4732     if (!argptr) {
4733         ret = -TARGET_EFAULT;
4734         goto out;
4735     }
4736     thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
4737     unlock_user(argptr, arg, 0);
4738 
4739     /* buf_temp is too small, so fetch things into a bigger buffer */
4740     big_buf = g_malloc0(((struct dm_ioctl*)buf_temp)->data_size * 2);
4741     memcpy(big_buf, buf_temp, target_size);
4742     buf_temp = big_buf;
4743     host_dm = big_buf;
4744 
4745     guest_data = arg + host_dm->data_start;
4746     if ((guest_data - arg) < 0) {
4747         ret = -TARGET_EINVAL;
4748         goto out;
4749     }
4750     guest_data_size = host_dm->data_size - host_dm->data_start;
4751     host_data = (char*)host_dm + host_dm->data_start;
4752 
4753     argptr = lock_user(VERIFY_READ, guest_data, guest_data_size, 1);
4754     if (!argptr) {
4755         ret = -TARGET_EFAULT;
4756         goto out;
4757     }
4758 
4759     switch (ie->host_cmd) {
4760     case DM_REMOVE_ALL:
4761     case DM_LIST_DEVICES:
4762     case DM_DEV_CREATE:
4763     case DM_DEV_REMOVE:
4764     case DM_DEV_SUSPEND:
4765     case DM_DEV_STATUS:
4766     case DM_DEV_WAIT:
4767     case DM_TABLE_STATUS:
4768     case DM_TABLE_CLEAR:
4769     case DM_TABLE_DEPS:
4770     case DM_LIST_VERSIONS:
4771         /* no input data */
4772         break;
4773     case DM_DEV_RENAME:
4774     case DM_DEV_SET_GEOMETRY:
4775         /* data contains only strings */
4776         memcpy(host_data, argptr, guest_data_size);
4777         break;
4778     case DM_TARGET_MSG:
4779         memcpy(host_data, argptr, guest_data_size);
4780         *(uint64_t*)host_data = tswap64(*(uint64_t*)argptr);
4781         break;
4782     case DM_TABLE_LOAD:
4783     {
4784         void *gspec = argptr;
4785         void *cur_data = host_data;
4786         const argtype arg_type[] = { MK_STRUCT(STRUCT_dm_target_spec) };
4787         int spec_size = thunk_type_size(arg_type, 0);
4788         int i;
4789 
4790         for (i = 0; i < host_dm->target_count; i++) {
4791             struct dm_target_spec *spec = cur_data;
4792             uint32_t next;
4793             int slen;
4794 
4795             thunk_convert(spec, gspec, arg_type, THUNK_HOST);
4796             slen = strlen((char*)gspec + spec_size) + 1;
4797             next = spec->next;
4798             spec->next = sizeof(*spec) + slen;
4799             strcpy((char*)&spec[1], gspec + spec_size);
4800             gspec += next;
4801             cur_data += spec->next;
4802         }
4803         break;
4804     }
4805     default:
4806         ret = -TARGET_EINVAL;
4807         unlock_user(argptr, guest_data, 0);
4808         goto out;
4809     }
4810     unlock_user(argptr, guest_data, 0);
4811 
4812     ret = get_errno(safe_ioctl(fd, ie->host_cmd, buf_temp));
4813     if (!is_error(ret)) {
4814         guest_data = arg + host_dm->data_start;
4815         guest_data_size = host_dm->data_size - host_dm->data_start;
4816         argptr = lock_user(VERIFY_WRITE, guest_data, guest_data_size, 0);
4817         switch (ie->host_cmd) {
4818         case DM_REMOVE_ALL:
4819         case DM_DEV_CREATE:
4820         case DM_DEV_REMOVE:
4821         case DM_DEV_RENAME:
4822         case DM_DEV_SUSPEND:
4823         case DM_DEV_STATUS:
4824         case DM_TABLE_LOAD:
4825         case DM_TABLE_CLEAR:
4826         case DM_TARGET_MSG:
4827         case DM_DEV_SET_GEOMETRY:
4828             /* no return data */
4829             break;
4830         case DM_LIST_DEVICES:
4831         {
4832             struct dm_name_list *nl = (void*)host_dm + host_dm->data_start;
4833             uint32_t remaining_data = guest_data_size;
4834             void *cur_data = argptr;
4835             const argtype arg_type[] = { MK_STRUCT(STRUCT_dm_name_list) };
4836             int nl_size = 12; /* can't use thunk_size due to alignment */
4837 
4838             while (1) {
4839                 uint32_t next = nl->next;
4840                 if (next) {
4841                     nl->next = nl_size + (strlen(nl->name) + 1);
4842                 }
4843                 if (remaining_data < nl->next) {
4844                     host_dm->flags |= DM_BUFFER_FULL_FLAG;
4845                     break;
4846                 }
4847                 thunk_convert(cur_data, nl, arg_type, THUNK_TARGET);
4848                 strcpy(cur_data + nl_size, nl->name);
4849                 cur_data += nl->next;
4850                 remaining_data -= nl->next;
4851                 if (!next) {
4852                     break;
4853                 }
4854                 nl = (void*)nl + next;
4855             }
4856             break;
4857         }
4858         case DM_DEV_WAIT:
4859         case DM_TABLE_STATUS:
4860         {
4861             struct dm_target_spec *spec = (void*)host_dm + host_dm->data_start;
4862             void *cur_data = argptr;
4863             const argtype arg_type[] = { MK_STRUCT(STRUCT_dm_target_spec) };
4864             int spec_size = thunk_type_size(arg_type, 0);
4865             int i;
4866 
4867             for (i = 0; i < host_dm->target_count; i++) {
4868                 uint32_t next = spec->next;
4869                 int slen = strlen((char*)&spec[1]) + 1;
4870                 spec->next = (cur_data - argptr) + spec_size + slen;
4871                 if (guest_data_size < spec->next) {
4872                     host_dm->flags |= DM_BUFFER_FULL_FLAG;
4873                     break;
4874                 }
4875                 thunk_convert(cur_data, spec, arg_type, THUNK_TARGET);
4876                 strcpy(cur_data + spec_size, (char*)&spec[1]);
4877                 cur_data = argptr + spec->next;
4878                 spec = (void*)host_dm + host_dm->data_start + next;
4879             }
4880             break;
4881         }
4882         case DM_TABLE_DEPS:
4883         {
4884             void *hdata = (void*)host_dm + host_dm->data_start;
4885             int count = *(uint32_t*)hdata;
4886             uint64_t *hdev = hdata + 8;
4887             uint64_t *gdev = argptr + 8;
4888             int i;
4889 
4890             *(uint32_t*)argptr = tswap32(count);
4891             for (i = 0; i < count; i++) {
4892                 *gdev = tswap64(*hdev);
4893                 gdev++;
4894                 hdev++;
4895             }
4896             break;
4897         }
4898         case DM_LIST_VERSIONS:
4899         {
4900             struct dm_target_versions *vers = (void*)host_dm + host_dm->data_start;
4901             uint32_t remaining_data = guest_data_size;
4902             void *cur_data = argptr;
4903             const argtype arg_type[] = { MK_STRUCT(STRUCT_dm_target_versions) };
4904             int vers_size = thunk_type_size(arg_type, 0);
4905 
4906             while (1) {
4907                 uint32_t next = vers->next;
4908                 if (next) {
4909                     vers->next = vers_size + (strlen(vers->name) + 1);
4910                 }
4911                 if (remaining_data < vers->next) {
4912                     host_dm->flags |= DM_BUFFER_FULL_FLAG;
4913                     break;
4914                 }
4915                 thunk_convert(cur_data, vers, arg_type, THUNK_TARGET);
4916                 strcpy(cur_data + vers_size, vers->name);
4917                 cur_data += vers->next;
4918                 remaining_data -= vers->next;
4919                 if (!next) {
4920                     break;
4921                 }
4922                 vers = (void*)vers + next;
4923             }
4924             break;
4925         }
4926         default:
4927             unlock_user(argptr, guest_data, 0);
4928             ret = -TARGET_EINVAL;
4929             goto out;
4930         }
4931         unlock_user(argptr, guest_data, guest_data_size);
4932 
4933         argptr = lock_user(VERIFY_WRITE, arg, target_size, 0);
4934         if (!argptr) {
4935             ret = -TARGET_EFAULT;
4936             goto out;
4937         }
4938         thunk_convert(argptr, buf_temp, arg_type, THUNK_TARGET);
4939         unlock_user(argptr, arg, target_size);
4940     }
4941 out:
4942     g_free(big_buf);
4943     return ret;
4944 }
4945 
4946 static abi_long do_ioctl_blkpg(const IOCTLEntry *ie, uint8_t *buf_temp, int fd,
4947                                int cmd, abi_long arg)
4948 {
4949     void *argptr;
4950     int target_size;
4951     const argtype *arg_type = ie->arg_type;
4952     const argtype part_arg_type[] = { MK_STRUCT(STRUCT_blkpg_partition) };
4953     abi_long ret;
4954 
4955     struct blkpg_ioctl_arg *host_blkpg = (void*)buf_temp;
4956     struct blkpg_partition host_part;
4957 
4958     /* Read and convert blkpg */
4959     arg_type++;
4960     target_size = thunk_type_size(arg_type, 0);
4961     argptr = lock_user(VERIFY_READ, arg, target_size, 1);
4962     if (!argptr) {
4963         ret = -TARGET_EFAULT;
4964         goto out;
4965     }
4966     thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
4967     unlock_user(argptr, arg, 0);
4968 
4969     switch (host_blkpg->op) {
4970     case BLKPG_ADD_PARTITION:
4971     case BLKPG_DEL_PARTITION:
4972         /* payload is struct blkpg_partition */
4973         break;
4974     default:
4975         /* Unknown opcode */
4976         ret = -TARGET_EINVAL;
4977         goto out;
4978     }
4979 
4980     /* Read and convert blkpg->data */
4981     arg = (abi_long)(uintptr_t)host_blkpg->data;
4982     target_size = thunk_type_size(part_arg_type, 0);
4983     argptr = lock_user(VERIFY_READ, arg, target_size, 1);
4984     if (!argptr) {
4985         ret = -TARGET_EFAULT;
4986         goto out;
4987     }
4988     thunk_convert(&host_part, argptr, part_arg_type, THUNK_HOST);
4989     unlock_user(argptr, arg, 0);
4990 
4991     /* Swizzle the data pointer to our local copy and call! */
4992     host_blkpg->data = &host_part;
4993     ret = get_errno(safe_ioctl(fd, ie->host_cmd, host_blkpg));
4994 
4995 out:
4996     return ret;
4997 }
4998 
4999 static abi_long do_ioctl_rt(const IOCTLEntry *ie, uint8_t *buf_temp,
5000                                 int fd, int cmd, abi_long arg)
5001 {
5002     const argtype *arg_type = ie->arg_type;
5003     const StructEntry *se;
5004     const argtype *field_types;
5005     const int *dst_offsets, *src_offsets;
5006     int target_size;
5007     void *argptr;
5008     abi_ulong *target_rt_dev_ptr = NULL;
5009     unsigned long *host_rt_dev_ptr = NULL;
5010     abi_long ret;
5011     int i;
5012 
5013     assert(ie->access == IOC_W);
5014     assert(*arg_type == TYPE_PTR);
5015     arg_type++;
5016     assert(*arg_type == TYPE_STRUCT);
5017     target_size = thunk_type_size(arg_type, 0);
5018     argptr = lock_user(VERIFY_READ, arg, target_size, 1);
5019     if (!argptr) {
5020         return -TARGET_EFAULT;
5021     }
5022     arg_type++;
5023     assert(*arg_type == (int)STRUCT_rtentry);
5024     se = struct_entries + *arg_type++;
5025     assert(se->convert[0] == NULL);
5026     /* convert struct here to be able to catch rt_dev string */
5027     field_types = se->field_types;
5028     dst_offsets = se->field_offsets[THUNK_HOST];
5029     src_offsets = se->field_offsets[THUNK_TARGET];
5030     for (i = 0; i < se->nb_fields; i++) {
5031         if (dst_offsets[i] == offsetof(struct rtentry, rt_dev)) {
5032             assert(*field_types == TYPE_PTRVOID);
5033             target_rt_dev_ptr = (abi_ulong *)(argptr + src_offsets[i]);
5034             host_rt_dev_ptr = (unsigned long *)(buf_temp + dst_offsets[i]);
5035             if (*target_rt_dev_ptr != 0) {
5036                 *host_rt_dev_ptr = (unsigned long)lock_user_string(
5037                                                   tswapal(*target_rt_dev_ptr));
5038                 if (!*host_rt_dev_ptr) {
5039                     unlock_user(argptr, arg, 0);
5040                     return -TARGET_EFAULT;
5041                 }
5042             } else {
5043                 *host_rt_dev_ptr = 0;
5044             }
5045             field_types++;
5046             continue;
5047         }
5048         field_types = thunk_convert(buf_temp + dst_offsets[i],
5049                                     argptr + src_offsets[i],
5050                                     field_types, THUNK_HOST);
5051     }
5052     unlock_user(argptr, arg, 0);
5053 
5054     ret = get_errno(safe_ioctl(fd, ie->host_cmd, buf_temp));
5055 
5056     assert(host_rt_dev_ptr != NULL);
5057     assert(target_rt_dev_ptr != NULL);
5058     if (*host_rt_dev_ptr != 0) {
5059         unlock_user((void *)*host_rt_dev_ptr,
5060                     *target_rt_dev_ptr, 0);
5061     }
5062     return ret;
5063 }
5064 
5065 static abi_long do_ioctl_kdsigaccept(const IOCTLEntry *ie, uint8_t *buf_temp,
5066                                      int fd, int cmd, abi_long arg)
5067 {
5068     int sig = target_to_host_signal(arg);
5069     return get_errno(safe_ioctl(fd, ie->host_cmd, sig));
5070 }
5071 
5072 static abi_long do_ioctl_SIOCGSTAMP(const IOCTLEntry *ie, uint8_t *buf_temp,
5073                                     int fd, int cmd, abi_long arg)
5074 {
5075     struct timeval tv;
5076     abi_long ret;
5077 
5078     ret = get_errno(safe_ioctl(fd, SIOCGSTAMP, &tv));
5079     if (is_error(ret)) {
5080         return ret;
5081     }
5082 
5083     if (cmd == (int)TARGET_SIOCGSTAMP_OLD) {
5084         if (copy_to_user_timeval(arg, &tv)) {
5085             return -TARGET_EFAULT;
5086         }
5087     } else {
5088         if (copy_to_user_timeval64(arg, &tv)) {
5089             return -TARGET_EFAULT;
5090         }
5091     }
5092 
5093     return ret;
5094 }
5095 
5096 static abi_long do_ioctl_SIOCGSTAMPNS(const IOCTLEntry *ie, uint8_t *buf_temp,
5097                                       int fd, int cmd, abi_long arg)
5098 {
5099     struct timespec ts;
5100     abi_long ret;
5101 
5102     ret = get_errno(safe_ioctl(fd, SIOCGSTAMPNS, &ts));
5103     if (is_error(ret)) {
5104         return ret;
5105     }
5106 
5107     if (cmd == (int)TARGET_SIOCGSTAMPNS_OLD) {
5108         if (host_to_target_timespec(arg, &ts)) {
5109             return -TARGET_EFAULT;
5110         }
5111     } else{
5112         if (host_to_target_timespec64(arg, &ts)) {
5113             return -TARGET_EFAULT;
5114         }
5115     }
5116 
5117     return ret;
5118 }
5119 
5120 #ifdef TIOCGPTPEER
5121 static abi_long do_ioctl_tiocgptpeer(const IOCTLEntry *ie, uint8_t *buf_temp,
5122                                      int fd, int cmd, abi_long arg)
5123 {
5124     int flags = target_to_host_bitmask(arg, fcntl_flags_tbl);
5125     return get_errno(safe_ioctl(fd, ie->host_cmd, flags));
5126 }
5127 #endif
5128 
5129 static IOCTLEntry ioctl_entries[] = {
5130 #define IOCTL(cmd, access, ...) \
5131     { TARGET_ ## cmd, cmd, #cmd, access, 0, {  __VA_ARGS__ } },
5132 #define IOCTL_SPECIAL(cmd, access, dofn, ...)                      \
5133     { TARGET_ ## cmd, cmd, #cmd, access, dofn, {  __VA_ARGS__ } },
5134 #define IOCTL_IGNORE(cmd) \
5135     { TARGET_ ## cmd, 0, #cmd },
5136 #include "ioctls.h"
5137     { 0, 0, },
5138 };
5139 
5140 /* ??? Implement proper locking for ioctls.  */
5141 /* do_ioctl() Must return target values and target errnos. */
5142 static abi_long do_ioctl(int fd, int cmd, abi_long arg)
5143 {
5144     const IOCTLEntry *ie;
5145     const argtype *arg_type;
5146     abi_long ret;
5147     uint8_t buf_temp[MAX_STRUCT_SIZE];
5148     int target_size;
5149     void *argptr;
5150 
5151     ie = ioctl_entries;
5152     for(;;) {
5153         if (ie->target_cmd == 0) {
5154             gemu_log("Unsupported ioctl: cmd=0x%04lx\n", (long)cmd);
5155             return -TARGET_ENOSYS;
5156         }
5157         if (ie->target_cmd == cmd)
5158             break;
5159         ie++;
5160     }
5161     arg_type = ie->arg_type;
5162     if (ie->do_ioctl) {
5163         return ie->do_ioctl(ie, buf_temp, fd, cmd, arg);
5164     } else if (!ie->host_cmd) {
5165         /* Some architectures define BSD ioctls in their headers
5166            that are not implemented in Linux.  */
5167         return -TARGET_ENOSYS;
5168     }
5169 
5170     switch(arg_type[0]) {
5171     case TYPE_NULL:
5172         /* no argument */
5173         ret = get_errno(safe_ioctl(fd, ie->host_cmd));
5174         break;
5175     case TYPE_PTRVOID:
5176     case TYPE_INT:
5177         ret = get_errno(safe_ioctl(fd, ie->host_cmd, arg));
5178         break;
5179     case TYPE_PTR:
5180         arg_type++;
5181         target_size = thunk_type_size(arg_type, 0);
5182         switch(ie->access) {
5183         case IOC_R:
5184             ret = get_errno(safe_ioctl(fd, ie->host_cmd, buf_temp));
5185             if (!is_error(ret)) {
5186                 argptr = lock_user(VERIFY_WRITE, arg, target_size, 0);
5187                 if (!argptr)
5188                     return -TARGET_EFAULT;
5189                 thunk_convert(argptr, buf_temp, arg_type, THUNK_TARGET);
5190                 unlock_user(argptr, arg, target_size);
5191             }
5192             break;
5193         case IOC_W:
5194             argptr = lock_user(VERIFY_READ, arg, target_size, 1);
5195             if (!argptr)
5196                 return -TARGET_EFAULT;
5197             thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
5198             unlock_user(argptr, arg, 0);
5199             ret = get_errno(safe_ioctl(fd, ie->host_cmd, buf_temp));
5200             break;
5201         default:
5202         case IOC_RW:
5203             argptr = lock_user(VERIFY_READ, arg, target_size, 1);
5204             if (!argptr)
5205                 return -TARGET_EFAULT;
5206             thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
5207             unlock_user(argptr, arg, 0);
5208             ret = get_errno(safe_ioctl(fd, ie->host_cmd, buf_temp));
5209             if (!is_error(ret)) {
5210                 argptr = lock_user(VERIFY_WRITE, arg, target_size, 0);
5211                 if (!argptr)
5212                     return -TARGET_EFAULT;
5213                 thunk_convert(argptr, buf_temp, arg_type, THUNK_TARGET);
5214                 unlock_user(argptr, arg, target_size);
5215             }
5216             break;
5217         }
5218         break;
5219     default:
5220         gemu_log("Unsupported ioctl type: cmd=0x%04lx type=%d\n",
5221                  (long)cmd, arg_type[0]);
5222         ret = -TARGET_ENOSYS;
5223         break;
5224     }
5225     return ret;
5226 }
5227 
5228 static const bitmask_transtbl iflag_tbl[] = {
5229         { TARGET_IGNBRK, TARGET_IGNBRK, IGNBRK, IGNBRK },
5230         { TARGET_BRKINT, TARGET_BRKINT, BRKINT, BRKINT },
5231         { TARGET_IGNPAR, TARGET_IGNPAR, IGNPAR, IGNPAR },
5232         { TARGET_PARMRK, TARGET_PARMRK, PARMRK, PARMRK },
5233         { TARGET_INPCK, TARGET_INPCK, INPCK, INPCK },
5234         { TARGET_ISTRIP, TARGET_ISTRIP, ISTRIP, ISTRIP },
5235         { TARGET_INLCR, TARGET_INLCR, INLCR, INLCR },
5236         { TARGET_IGNCR, TARGET_IGNCR, IGNCR, IGNCR },
5237         { TARGET_ICRNL, TARGET_ICRNL, ICRNL, ICRNL },
5238         { TARGET_IUCLC, TARGET_IUCLC, IUCLC, IUCLC },
5239         { TARGET_IXON, TARGET_IXON, IXON, IXON },
5240         { TARGET_IXANY, TARGET_IXANY, IXANY, IXANY },
5241         { TARGET_IXOFF, TARGET_IXOFF, IXOFF, IXOFF },
5242         { TARGET_IMAXBEL, TARGET_IMAXBEL, IMAXBEL, IMAXBEL },
5243         { 0, 0, 0, 0 }
5244 };
5245 
5246 static const bitmask_transtbl oflag_tbl[] = {
5247 	{ TARGET_OPOST, TARGET_OPOST, OPOST, OPOST },
5248 	{ TARGET_OLCUC, TARGET_OLCUC, OLCUC, OLCUC },
5249 	{ TARGET_ONLCR, TARGET_ONLCR, ONLCR, ONLCR },
5250 	{ TARGET_OCRNL, TARGET_OCRNL, OCRNL, OCRNL },
5251 	{ TARGET_ONOCR, TARGET_ONOCR, ONOCR, ONOCR },
5252 	{ TARGET_ONLRET, TARGET_ONLRET, ONLRET, ONLRET },
5253 	{ TARGET_OFILL, TARGET_OFILL, OFILL, OFILL },
5254 	{ TARGET_OFDEL, TARGET_OFDEL, OFDEL, OFDEL },
5255 	{ TARGET_NLDLY, TARGET_NL0, NLDLY, NL0 },
5256 	{ TARGET_NLDLY, TARGET_NL1, NLDLY, NL1 },
5257 	{ TARGET_CRDLY, TARGET_CR0, CRDLY, CR0 },
5258 	{ TARGET_CRDLY, TARGET_CR1, CRDLY, CR1 },
5259 	{ TARGET_CRDLY, TARGET_CR2, CRDLY, CR2 },
5260 	{ TARGET_CRDLY, TARGET_CR3, CRDLY, CR3 },
5261 	{ TARGET_TABDLY, TARGET_TAB0, TABDLY, TAB0 },
5262 	{ TARGET_TABDLY, TARGET_TAB1, TABDLY, TAB1 },
5263 	{ TARGET_TABDLY, TARGET_TAB2, TABDLY, TAB2 },
5264 	{ TARGET_TABDLY, TARGET_TAB3, TABDLY, TAB3 },
5265 	{ TARGET_BSDLY, TARGET_BS0, BSDLY, BS0 },
5266 	{ TARGET_BSDLY, TARGET_BS1, BSDLY, BS1 },
5267 	{ TARGET_VTDLY, TARGET_VT0, VTDLY, VT0 },
5268 	{ TARGET_VTDLY, TARGET_VT1, VTDLY, VT1 },
5269 	{ TARGET_FFDLY, TARGET_FF0, FFDLY, FF0 },
5270 	{ TARGET_FFDLY, TARGET_FF1, FFDLY, FF1 },
5271 	{ 0, 0, 0, 0 }
5272 };
5273 
5274 static const bitmask_transtbl cflag_tbl[] = {
5275 	{ TARGET_CBAUD, TARGET_B0, CBAUD, B0 },
5276 	{ TARGET_CBAUD, TARGET_B50, CBAUD, B50 },
5277 	{ TARGET_CBAUD, TARGET_B75, CBAUD, B75 },
5278 	{ TARGET_CBAUD, TARGET_B110, CBAUD, B110 },
5279 	{ TARGET_CBAUD, TARGET_B134, CBAUD, B134 },
5280 	{ TARGET_CBAUD, TARGET_B150, CBAUD, B150 },
5281 	{ TARGET_CBAUD, TARGET_B200, CBAUD, B200 },
5282 	{ TARGET_CBAUD, TARGET_B300, CBAUD, B300 },
5283 	{ TARGET_CBAUD, TARGET_B600, CBAUD, B600 },
5284 	{ TARGET_CBAUD, TARGET_B1200, CBAUD, B1200 },
5285 	{ TARGET_CBAUD, TARGET_B1800, CBAUD, B1800 },
5286 	{ TARGET_CBAUD, TARGET_B2400, CBAUD, B2400 },
5287 	{ TARGET_CBAUD, TARGET_B4800, CBAUD, B4800 },
5288 	{ TARGET_CBAUD, TARGET_B9600, CBAUD, B9600 },
5289 	{ TARGET_CBAUD, TARGET_B19200, CBAUD, B19200 },
5290 	{ TARGET_CBAUD, TARGET_B38400, CBAUD, B38400 },
5291 	{ TARGET_CBAUD, TARGET_B57600, CBAUD, B57600 },
5292 	{ TARGET_CBAUD, TARGET_B115200, CBAUD, B115200 },
5293 	{ TARGET_CBAUD, TARGET_B230400, CBAUD, B230400 },
5294 	{ TARGET_CBAUD, TARGET_B460800, CBAUD, B460800 },
5295 	{ TARGET_CSIZE, TARGET_CS5, CSIZE, CS5 },
5296 	{ TARGET_CSIZE, TARGET_CS6, CSIZE, CS6 },
5297 	{ TARGET_CSIZE, TARGET_CS7, CSIZE, CS7 },
5298 	{ TARGET_CSIZE, TARGET_CS8, CSIZE, CS8 },
5299 	{ TARGET_CSTOPB, TARGET_CSTOPB, CSTOPB, CSTOPB },
5300 	{ TARGET_CREAD, TARGET_CREAD, CREAD, CREAD },
5301 	{ TARGET_PARENB, TARGET_PARENB, PARENB, PARENB },
5302 	{ TARGET_PARODD, TARGET_PARODD, PARODD, PARODD },
5303 	{ TARGET_HUPCL, TARGET_HUPCL, HUPCL, HUPCL },
5304 	{ TARGET_CLOCAL, TARGET_CLOCAL, CLOCAL, CLOCAL },
5305 	{ TARGET_CRTSCTS, TARGET_CRTSCTS, CRTSCTS, CRTSCTS },
5306 	{ 0, 0, 0, 0 }
5307 };
5308 
5309 static const bitmask_transtbl lflag_tbl[] = {
5310 	{ TARGET_ISIG, TARGET_ISIG, ISIG, ISIG },
5311 	{ TARGET_ICANON, TARGET_ICANON, ICANON, ICANON },
5312 	{ TARGET_XCASE, TARGET_XCASE, XCASE, XCASE },
5313 	{ TARGET_ECHO, TARGET_ECHO, ECHO, ECHO },
5314 	{ TARGET_ECHOE, TARGET_ECHOE, ECHOE, ECHOE },
5315 	{ TARGET_ECHOK, TARGET_ECHOK, ECHOK, ECHOK },
5316 	{ TARGET_ECHONL, TARGET_ECHONL, ECHONL, ECHONL },
5317 	{ TARGET_NOFLSH, TARGET_NOFLSH, NOFLSH, NOFLSH },
5318 	{ TARGET_TOSTOP, TARGET_TOSTOP, TOSTOP, TOSTOP },
5319 	{ TARGET_ECHOCTL, TARGET_ECHOCTL, ECHOCTL, ECHOCTL },
5320 	{ TARGET_ECHOPRT, TARGET_ECHOPRT, ECHOPRT, ECHOPRT },
5321 	{ TARGET_ECHOKE, TARGET_ECHOKE, ECHOKE, ECHOKE },
5322 	{ TARGET_FLUSHO, TARGET_FLUSHO, FLUSHO, FLUSHO },
5323 	{ TARGET_PENDIN, TARGET_PENDIN, PENDIN, PENDIN },
5324 	{ TARGET_IEXTEN, TARGET_IEXTEN, IEXTEN, IEXTEN },
5325 	{ 0, 0, 0, 0 }
5326 };
5327 
5328 static void target_to_host_termios (void *dst, const void *src)
5329 {
5330     struct host_termios *host = dst;
5331     const struct target_termios *target = src;
5332 
5333     host->c_iflag =
5334         target_to_host_bitmask(tswap32(target->c_iflag), iflag_tbl);
5335     host->c_oflag =
5336         target_to_host_bitmask(tswap32(target->c_oflag), oflag_tbl);
5337     host->c_cflag =
5338         target_to_host_bitmask(tswap32(target->c_cflag), cflag_tbl);
5339     host->c_lflag =
5340         target_to_host_bitmask(tswap32(target->c_lflag), lflag_tbl);
5341     host->c_line = target->c_line;
5342 
5343     memset(host->c_cc, 0, sizeof(host->c_cc));
5344     host->c_cc[VINTR] = target->c_cc[TARGET_VINTR];
5345     host->c_cc[VQUIT] = target->c_cc[TARGET_VQUIT];
5346     host->c_cc[VERASE] = target->c_cc[TARGET_VERASE];
5347     host->c_cc[VKILL] = target->c_cc[TARGET_VKILL];
5348     host->c_cc[VEOF] = target->c_cc[TARGET_VEOF];
5349     host->c_cc[VTIME] = target->c_cc[TARGET_VTIME];
5350     host->c_cc[VMIN] = target->c_cc[TARGET_VMIN];
5351     host->c_cc[VSWTC] = target->c_cc[TARGET_VSWTC];
5352     host->c_cc[VSTART] = target->c_cc[TARGET_VSTART];
5353     host->c_cc[VSTOP] = target->c_cc[TARGET_VSTOP];
5354     host->c_cc[VSUSP] = target->c_cc[TARGET_VSUSP];
5355     host->c_cc[VEOL] = target->c_cc[TARGET_VEOL];
5356     host->c_cc[VREPRINT] = target->c_cc[TARGET_VREPRINT];
5357     host->c_cc[VDISCARD] = target->c_cc[TARGET_VDISCARD];
5358     host->c_cc[VWERASE] = target->c_cc[TARGET_VWERASE];
5359     host->c_cc[VLNEXT] = target->c_cc[TARGET_VLNEXT];
5360     host->c_cc[VEOL2] = target->c_cc[TARGET_VEOL2];
5361 }
5362 
5363 static void host_to_target_termios (void *dst, const void *src)
5364 {
5365     struct target_termios *target = dst;
5366     const struct host_termios *host = src;
5367 
5368     target->c_iflag =
5369         tswap32(host_to_target_bitmask(host->c_iflag, iflag_tbl));
5370     target->c_oflag =
5371         tswap32(host_to_target_bitmask(host->c_oflag, oflag_tbl));
5372     target->c_cflag =
5373         tswap32(host_to_target_bitmask(host->c_cflag, cflag_tbl));
5374     target->c_lflag =
5375         tswap32(host_to_target_bitmask(host->c_lflag, lflag_tbl));
5376     target->c_line = host->c_line;
5377 
5378     memset(target->c_cc, 0, sizeof(target->c_cc));
5379     target->c_cc[TARGET_VINTR] = host->c_cc[VINTR];
5380     target->c_cc[TARGET_VQUIT] = host->c_cc[VQUIT];
5381     target->c_cc[TARGET_VERASE] = host->c_cc[VERASE];
5382     target->c_cc[TARGET_VKILL] = host->c_cc[VKILL];
5383     target->c_cc[TARGET_VEOF] = host->c_cc[VEOF];
5384     target->c_cc[TARGET_VTIME] = host->c_cc[VTIME];
5385     target->c_cc[TARGET_VMIN] = host->c_cc[VMIN];
5386     target->c_cc[TARGET_VSWTC] = host->c_cc[VSWTC];
5387     target->c_cc[TARGET_VSTART] = host->c_cc[VSTART];
5388     target->c_cc[TARGET_VSTOP] = host->c_cc[VSTOP];
5389     target->c_cc[TARGET_VSUSP] = host->c_cc[VSUSP];
5390     target->c_cc[TARGET_VEOL] = host->c_cc[VEOL];
5391     target->c_cc[TARGET_VREPRINT] = host->c_cc[VREPRINT];
5392     target->c_cc[TARGET_VDISCARD] = host->c_cc[VDISCARD];
5393     target->c_cc[TARGET_VWERASE] = host->c_cc[VWERASE];
5394     target->c_cc[TARGET_VLNEXT] = host->c_cc[VLNEXT];
5395     target->c_cc[TARGET_VEOL2] = host->c_cc[VEOL2];
5396 }
5397 
5398 static const StructEntry struct_termios_def = {
5399     .convert = { host_to_target_termios, target_to_host_termios },
5400     .size = { sizeof(struct target_termios), sizeof(struct host_termios) },
5401     .align = { __alignof__(struct target_termios), __alignof__(struct host_termios) },
5402 };
5403 
5404 static bitmask_transtbl mmap_flags_tbl[] = {
5405     { TARGET_MAP_SHARED, TARGET_MAP_SHARED, MAP_SHARED, MAP_SHARED },
5406     { TARGET_MAP_PRIVATE, TARGET_MAP_PRIVATE, MAP_PRIVATE, MAP_PRIVATE },
5407     { TARGET_MAP_FIXED, TARGET_MAP_FIXED, MAP_FIXED, MAP_FIXED },
5408     { TARGET_MAP_ANONYMOUS, TARGET_MAP_ANONYMOUS,
5409       MAP_ANONYMOUS, MAP_ANONYMOUS },
5410     { TARGET_MAP_GROWSDOWN, TARGET_MAP_GROWSDOWN,
5411       MAP_GROWSDOWN, MAP_GROWSDOWN },
5412     { TARGET_MAP_DENYWRITE, TARGET_MAP_DENYWRITE,
5413       MAP_DENYWRITE, MAP_DENYWRITE },
5414     { TARGET_MAP_EXECUTABLE, TARGET_MAP_EXECUTABLE,
5415       MAP_EXECUTABLE, MAP_EXECUTABLE },
5416     { TARGET_MAP_LOCKED, TARGET_MAP_LOCKED, MAP_LOCKED, MAP_LOCKED },
5417     { TARGET_MAP_NORESERVE, TARGET_MAP_NORESERVE,
5418       MAP_NORESERVE, MAP_NORESERVE },
5419     { TARGET_MAP_HUGETLB, TARGET_MAP_HUGETLB, MAP_HUGETLB, MAP_HUGETLB },
5420     /* MAP_STACK had been ignored by the kernel for quite some time.
5421        Recognize it for the target insofar as we do not want to pass
5422        it through to the host.  */
5423     { TARGET_MAP_STACK, TARGET_MAP_STACK, 0, 0 },
5424     { 0, 0, 0, 0 }
5425 };
5426 
5427 #if defined(TARGET_I386)
5428 
5429 /* NOTE: there is really one LDT for all the threads */
5430 static uint8_t *ldt_table;
5431 
5432 static abi_long read_ldt(abi_ulong ptr, unsigned long bytecount)
5433 {
5434     int size;
5435     void *p;
5436 
5437     if (!ldt_table)
5438         return 0;
5439     size = TARGET_LDT_ENTRIES * TARGET_LDT_ENTRY_SIZE;
5440     if (size > bytecount)
5441         size = bytecount;
5442     p = lock_user(VERIFY_WRITE, ptr, size, 0);
5443     if (!p)
5444         return -TARGET_EFAULT;
5445     /* ??? Should this by byteswapped?  */
5446     memcpy(p, ldt_table, size);
5447     unlock_user(p, ptr, size);
5448     return size;
5449 }
5450 
5451 /* XXX: add locking support */
5452 static abi_long write_ldt(CPUX86State *env,
5453                           abi_ulong ptr, unsigned long bytecount, int oldmode)
5454 {
5455     struct target_modify_ldt_ldt_s ldt_info;
5456     struct target_modify_ldt_ldt_s *target_ldt_info;
5457     int seg_32bit, contents, read_exec_only, limit_in_pages;
5458     int seg_not_present, useable, lm;
5459     uint32_t *lp, entry_1, entry_2;
5460 
5461     if (bytecount != sizeof(ldt_info))
5462         return -TARGET_EINVAL;
5463     if (!lock_user_struct(VERIFY_READ, target_ldt_info, ptr, 1))
5464         return -TARGET_EFAULT;
5465     ldt_info.entry_number = tswap32(target_ldt_info->entry_number);
5466     ldt_info.base_addr = tswapal(target_ldt_info->base_addr);
5467     ldt_info.limit = tswap32(target_ldt_info->limit);
5468     ldt_info.flags = tswap32(target_ldt_info->flags);
5469     unlock_user_struct(target_ldt_info, ptr, 0);
5470 
5471     if (ldt_info.entry_number >= TARGET_LDT_ENTRIES)
5472         return -TARGET_EINVAL;
5473     seg_32bit = ldt_info.flags & 1;
5474     contents = (ldt_info.flags >> 1) & 3;
5475     read_exec_only = (ldt_info.flags >> 3) & 1;
5476     limit_in_pages = (ldt_info.flags >> 4) & 1;
5477     seg_not_present = (ldt_info.flags >> 5) & 1;
5478     useable = (ldt_info.flags >> 6) & 1;
5479 #ifdef TARGET_ABI32
5480     lm = 0;
5481 #else
5482     lm = (ldt_info.flags >> 7) & 1;
5483 #endif
5484     if (contents == 3) {
5485         if (oldmode)
5486             return -TARGET_EINVAL;
5487         if (seg_not_present == 0)
5488             return -TARGET_EINVAL;
5489     }
5490     /* allocate the LDT */
5491     if (!ldt_table) {
5492         env->ldt.base = target_mmap(0,
5493                                     TARGET_LDT_ENTRIES * TARGET_LDT_ENTRY_SIZE,
5494                                     PROT_READ|PROT_WRITE,
5495                                     MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);
5496         if (env->ldt.base == -1)
5497             return -TARGET_ENOMEM;
5498         memset(g2h(env->ldt.base), 0,
5499                TARGET_LDT_ENTRIES * TARGET_LDT_ENTRY_SIZE);
5500         env->ldt.limit = 0xffff;
5501         ldt_table = g2h(env->ldt.base);
5502     }
5503 
5504     /* NOTE: same code as Linux kernel */
5505     /* Allow LDTs to be cleared by the user. */
5506     if (ldt_info.base_addr == 0 && ldt_info.limit == 0) {
5507         if (oldmode ||
5508             (contents == 0		&&
5509              read_exec_only == 1	&&
5510              seg_32bit == 0		&&
5511              limit_in_pages == 0	&&
5512              seg_not_present == 1	&&
5513              useable == 0 )) {
5514             entry_1 = 0;
5515             entry_2 = 0;
5516             goto install;
5517         }
5518     }
5519 
5520     entry_1 = ((ldt_info.base_addr & 0x0000ffff) << 16) |
5521         (ldt_info.limit & 0x0ffff);
5522     entry_2 = (ldt_info.base_addr & 0xff000000) |
5523         ((ldt_info.base_addr & 0x00ff0000) >> 16) |
5524         (ldt_info.limit & 0xf0000) |
5525         ((read_exec_only ^ 1) << 9) |
5526         (contents << 10) |
5527         ((seg_not_present ^ 1) << 15) |
5528         (seg_32bit << 22) |
5529         (limit_in_pages << 23) |
5530         (lm << 21) |
5531         0x7000;
5532     if (!oldmode)
5533         entry_2 |= (useable << 20);
5534 
5535     /* Install the new entry ...  */
5536 install:
5537     lp = (uint32_t *)(ldt_table + (ldt_info.entry_number << 3));
5538     lp[0] = tswap32(entry_1);
5539     lp[1] = tswap32(entry_2);
5540     return 0;
5541 }
5542 
5543 /* specific and weird i386 syscalls */
5544 static abi_long do_modify_ldt(CPUX86State *env, int func, abi_ulong ptr,
5545                               unsigned long bytecount)
5546 {
5547     abi_long ret;
5548 
5549     switch (func) {
5550     case 0:
5551         ret = read_ldt(ptr, bytecount);
5552         break;
5553     case 1:
5554         ret = write_ldt(env, ptr, bytecount, 1);
5555         break;
5556     case 0x11:
5557         ret = write_ldt(env, ptr, bytecount, 0);
5558         break;
5559     default:
5560         ret = -TARGET_ENOSYS;
5561         break;
5562     }
5563     return ret;
5564 }
5565 
5566 #if defined(TARGET_I386) && defined(TARGET_ABI32)
5567 abi_long do_set_thread_area(CPUX86State *env, abi_ulong ptr)
5568 {
5569     uint64_t *gdt_table = g2h(env->gdt.base);
5570     struct target_modify_ldt_ldt_s ldt_info;
5571     struct target_modify_ldt_ldt_s *target_ldt_info;
5572     int seg_32bit, contents, read_exec_only, limit_in_pages;
5573     int seg_not_present, useable, lm;
5574     uint32_t *lp, entry_1, entry_2;
5575     int i;
5576 
5577     lock_user_struct(VERIFY_WRITE, target_ldt_info, ptr, 1);
5578     if (!target_ldt_info)
5579         return -TARGET_EFAULT;
5580     ldt_info.entry_number = tswap32(target_ldt_info->entry_number);
5581     ldt_info.base_addr = tswapal(target_ldt_info->base_addr);
5582     ldt_info.limit = tswap32(target_ldt_info->limit);
5583     ldt_info.flags = tswap32(target_ldt_info->flags);
5584     if (ldt_info.entry_number == -1) {
5585         for (i=TARGET_GDT_ENTRY_TLS_MIN; i<=TARGET_GDT_ENTRY_TLS_MAX; i++) {
5586             if (gdt_table[i] == 0) {
5587                 ldt_info.entry_number = i;
5588                 target_ldt_info->entry_number = tswap32(i);
5589                 break;
5590             }
5591         }
5592     }
5593     unlock_user_struct(target_ldt_info, ptr, 1);
5594 
5595     if (ldt_info.entry_number < TARGET_GDT_ENTRY_TLS_MIN ||
5596         ldt_info.entry_number > TARGET_GDT_ENTRY_TLS_MAX)
5597            return -TARGET_EINVAL;
5598     seg_32bit = ldt_info.flags & 1;
5599     contents = (ldt_info.flags >> 1) & 3;
5600     read_exec_only = (ldt_info.flags >> 3) & 1;
5601     limit_in_pages = (ldt_info.flags >> 4) & 1;
5602     seg_not_present = (ldt_info.flags >> 5) & 1;
5603     useable = (ldt_info.flags >> 6) & 1;
5604 #ifdef TARGET_ABI32
5605     lm = 0;
5606 #else
5607     lm = (ldt_info.flags >> 7) & 1;
5608 #endif
5609 
5610     if (contents == 3) {
5611         if (seg_not_present == 0)
5612             return -TARGET_EINVAL;
5613     }
5614 
5615     /* NOTE: same code as Linux kernel */
5616     /* Allow LDTs to be cleared by the user. */
5617     if (ldt_info.base_addr == 0 && ldt_info.limit == 0) {
5618         if ((contents == 0             &&
5619              read_exec_only == 1       &&
5620              seg_32bit == 0            &&
5621              limit_in_pages == 0       &&
5622              seg_not_present == 1      &&
5623              useable == 0 )) {
5624             entry_1 = 0;
5625             entry_2 = 0;
5626             goto install;
5627         }
5628     }
5629 
5630     entry_1 = ((ldt_info.base_addr & 0x0000ffff) << 16) |
5631         (ldt_info.limit & 0x0ffff);
5632     entry_2 = (ldt_info.base_addr & 0xff000000) |
5633         ((ldt_info.base_addr & 0x00ff0000) >> 16) |
5634         (ldt_info.limit & 0xf0000) |
5635         ((read_exec_only ^ 1) << 9) |
5636         (contents << 10) |
5637         ((seg_not_present ^ 1) << 15) |
5638         (seg_32bit << 22) |
5639         (limit_in_pages << 23) |
5640         (useable << 20) |
5641         (lm << 21) |
5642         0x7000;
5643 
5644     /* Install the new entry ...  */
5645 install:
5646     lp = (uint32_t *)(gdt_table + ldt_info.entry_number);
5647     lp[0] = tswap32(entry_1);
5648     lp[1] = tswap32(entry_2);
5649     return 0;
5650 }
5651 
5652 static abi_long do_get_thread_area(CPUX86State *env, abi_ulong ptr)
5653 {
5654     struct target_modify_ldt_ldt_s *target_ldt_info;
5655     uint64_t *gdt_table = g2h(env->gdt.base);
5656     uint32_t base_addr, limit, flags;
5657     int seg_32bit, contents, read_exec_only, limit_in_pages, idx;
5658     int seg_not_present, useable, lm;
5659     uint32_t *lp, entry_1, entry_2;
5660 
5661     lock_user_struct(VERIFY_WRITE, target_ldt_info, ptr, 1);
5662     if (!target_ldt_info)
5663         return -TARGET_EFAULT;
5664     idx = tswap32(target_ldt_info->entry_number);
5665     if (idx < TARGET_GDT_ENTRY_TLS_MIN ||
5666         idx > TARGET_GDT_ENTRY_TLS_MAX) {
5667         unlock_user_struct(target_ldt_info, ptr, 1);
5668         return -TARGET_EINVAL;
5669     }
5670     lp = (uint32_t *)(gdt_table + idx);
5671     entry_1 = tswap32(lp[0]);
5672     entry_2 = tswap32(lp[1]);
5673 
5674     read_exec_only = ((entry_2 >> 9) & 1) ^ 1;
5675     contents = (entry_2 >> 10) & 3;
5676     seg_not_present = ((entry_2 >> 15) & 1) ^ 1;
5677     seg_32bit = (entry_2 >> 22) & 1;
5678     limit_in_pages = (entry_2 >> 23) & 1;
5679     useable = (entry_2 >> 20) & 1;
5680 #ifdef TARGET_ABI32
5681     lm = 0;
5682 #else
5683     lm = (entry_2 >> 21) & 1;
5684 #endif
5685     flags = (seg_32bit << 0) | (contents << 1) |
5686         (read_exec_only << 3) | (limit_in_pages << 4) |
5687         (seg_not_present << 5) | (useable << 6) | (lm << 7);
5688     limit = (entry_1 & 0xffff) | (entry_2  & 0xf0000);
5689     base_addr = (entry_1 >> 16) |
5690         (entry_2 & 0xff000000) |
5691         ((entry_2 & 0xff) << 16);
5692     target_ldt_info->base_addr = tswapal(base_addr);
5693     target_ldt_info->limit = tswap32(limit);
5694     target_ldt_info->flags = tswap32(flags);
5695     unlock_user_struct(target_ldt_info, ptr, 1);
5696     return 0;
5697 }
5698 #endif /* TARGET_I386 && TARGET_ABI32 */
5699 
5700 #ifndef TARGET_ABI32
5701 abi_long do_arch_prctl(CPUX86State *env, int code, abi_ulong addr)
5702 {
5703     abi_long ret = 0;
5704     abi_ulong val;
5705     int idx;
5706 
5707     switch(code) {
5708     case TARGET_ARCH_SET_GS:
5709     case TARGET_ARCH_SET_FS:
5710         if (code == TARGET_ARCH_SET_GS)
5711             idx = R_GS;
5712         else
5713             idx = R_FS;
5714         cpu_x86_load_seg(env, idx, 0);
5715         env->segs[idx].base = addr;
5716         break;
5717     case TARGET_ARCH_GET_GS:
5718     case TARGET_ARCH_GET_FS:
5719         if (code == TARGET_ARCH_GET_GS)
5720             idx = R_GS;
5721         else
5722             idx = R_FS;
5723         val = env->segs[idx].base;
5724         if (put_user(val, addr, abi_ulong))
5725             ret = -TARGET_EFAULT;
5726         break;
5727     default:
5728         ret = -TARGET_EINVAL;
5729         break;
5730     }
5731     return ret;
5732 }
5733 #endif
5734 
5735 #endif /* defined(TARGET_I386) */
5736 
5737 #define NEW_STACK_SIZE 0x40000
5738 
5739 
5740 static pthread_mutex_t clone_lock = PTHREAD_MUTEX_INITIALIZER;
5741 typedef struct {
5742     CPUArchState *env;
5743     pthread_mutex_t mutex;
5744     pthread_cond_t cond;
5745     pthread_t thread;
5746     uint32_t tid;
5747     abi_ulong child_tidptr;
5748     abi_ulong parent_tidptr;
5749     sigset_t sigmask;
5750 } new_thread_info;
5751 
5752 static void *clone_func(void *arg)
5753 {
5754     new_thread_info *info = arg;
5755     CPUArchState *env;
5756     CPUState *cpu;
5757     TaskState *ts;
5758 
5759     rcu_register_thread();
5760     tcg_register_thread();
5761     env = info->env;
5762     cpu = env_cpu(env);
5763     thread_cpu = cpu;
5764     ts = (TaskState *)cpu->opaque;
5765     info->tid = sys_gettid();
5766     task_settid(ts);
5767     if (info->child_tidptr)
5768         put_user_u32(info->tid, info->child_tidptr);
5769     if (info->parent_tidptr)
5770         put_user_u32(info->tid, info->parent_tidptr);
5771     qemu_guest_random_seed_thread_part2(cpu->random_seed);
5772     /* Enable signals.  */
5773     sigprocmask(SIG_SETMASK, &info->sigmask, NULL);
5774     /* Signal to the parent that we're ready.  */
5775     pthread_mutex_lock(&info->mutex);
5776     pthread_cond_broadcast(&info->cond);
5777     pthread_mutex_unlock(&info->mutex);
5778     /* Wait until the parent has finished initializing the tls state.  */
5779     pthread_mutex_lock(&clone_lock);
5780     pthread_mutex_unlock(&clone_lock);
5781     cpu_loop(env);
5782     /* never exits */
5783     return NULL;
5784 }
5785 
5786 /* do_fork() Must return host values and target errnos (unlike most
5787    do_*() functions). */
5788 static int do_fork(CPUArchState *env, unsigned int flags, abi_ulong newsp,
5789                    abi_ulong parent_tidptr, target_ulong newtls,
5790                    abi_ulong child_tidptr)
5791 {
5792     CPUState *cpu = env_cpu(env);
5793     int ret;
5794     TaskState *ts;
5795     CPUState *new_cpu;
5796     CPUArchState *new_env;
5797     sigset_t sigmask;
5798 
5799     flags &= ~CLONE_IGNORED_FLAGS;
5800 
5801     /* Emulate vfork() with fork() */
5802     if (flags & CLONE_VFORK)
5803         flags &= ~(CLONE_VFORK | CLONE_VM);
5804 
5805     if (flags & CLONE_VM) {
5806         TaskState *parent_ts = (TaskState *)cpu->opaque;
5807         new_thread_info info;
5808         pthread_attr_t attr;
5809 
5810         if (((flags & CLONE_THREAD_FLAGS) != CLONE_THREAD_FLAGS) ||
5811             (flags & CLONE_INVALID_THREAD_FLAGS)) {
5812             return -TARGET_EINVAL;
5813         }
5814 
5815         ts = g_new0(TaskState, 1);
5816         init_task_state(ts);
5817 
5818         /* Grab a mutex so that thread setup appears atomic.  */
5819         pthread_mutex_lock(&clone_lock);
5820 
5821         /* we create a new CPU instance. */
5822         new_env = cpu_copy(env);
5823         /* Init regs that differ from the parent.  */
5824         cpu_clone_regs_child(new_env, newsp, flags);
5825         cpu_clone_regs_parent(env, flags);
5826         new_cpu = env_cpu(new_env);
5827         new_cpu->opaque = ts;
5828         ts->bprm = parent_ts->bprm;
5829         ts->info = parent_ts->info;
5830         ts->signal_mask = parent_ts->signal_mask;
5831 
5832         if (flags & CLONE_CHILD_CLEARTID) {
5833             ts->child_tidptr = child_tidptr;
5834         }
5835 
5836         if (flags & CLONE_SETTLS) {
5837             cpu_set_tls (new_env, newtls);
5838         }
5839 
5840         memset(&info, 0, sizeof(info));
5841         pthread_mutex_init(&info.mutex, NULL);
5842         pthread_mutex_lock(&info.mutex);
5843         pthread_cond_init(&info.cond, NULL);
5844         info.env = new_env;
5845         if (flags & CLONE_CHILD_SETTID) {
5846             info.child_tidptr = child_tidptr;
5847         }
5848         if (flags & CLONE_PARENT_SETTID) {
5849             info.parent_tidptr = parent_tidptr;
5850         }
5851 
5852         ret = pthread_attr_init(&attr);
5853         ret = pthread_attr_setstacksize(&attr, NEW_STACK_SIZE);
5854         ret = pthread_attr_setdetachstate(&attr, PTHREAD_CREATE_DETACHED);
5855         /* It is not safe to deliver signals until the child has finished
5856            initializing, so temporarily block all signals.  */
5857         sigfillset(&sigmask);
5858         sigprocmask(SIG_BLOCK, &sigmask, &info.sigmask);
5859         cpu->random_seed = qemu_guest_random_seed_thread_part1();
5860 
5861         /* If this is our first additional thread, we need to ensure we
5862          * generate code for parallel execution and flush old translations.
5863          */
5864         if (!parallel_cpus) {
5865             parallel_cpus = true;
5866             tb_flush(cpu);
5867         }
5868 
5869         ret = pthread_create(&info.thread, &attr, clone_func, &info);
5870         /* TODO: Free new CPU state if thread creation failed.  */
5871 
5872         sigprocmask(SIG_SETMASK, &info.sigmask, NULL);
5873         pthread_attr_destroy(&attr);
5874         if (ret == 0) {
5875             /* Wait for the child to initialize.  */
5876             pthread_cond_wait(&info.cond, &info.mutex);
5877             ret = info.tid;
5878         } else {
5879             ret = -1;
5880         }
5881         pthread_mutex_unlock(&info.mutex);
5882         pthread_cond_destroy(&info.cond);
5883         pthread_mutex_destroy(&info.mutex);
5884         pthread_mutex_unlock(&clone_lock);
5885     } else {
5886         /* if no CLONE_VM, we consider it is a fork */
5887         if (flags & CLONE_INVALID_FORK_FLAGS) {
5888             return -TARGET_EINVAL;
5889         }
5890 
5891         /* We can't support custom termination signals */
5892         if ((flags & CSIGNAL) != TARGET_SIGCHLD) {
5893             return -TARGET_EINVAL;
5894         }
5895 
5896         if (block_signals()) {
5897             return -TARGET_ERESTARTSYS;
5898         }
5899 
5900         fork_start();
5901         ret = fork();
5902         if (ret == 0) {
5903             /* Child Process.  */
5904             cpu_clone_regs_child(env, newsp, flags);
5905             fork_end(1);
5906             /* There is a race condition here.  The parent process could
5907                theoretically read the TID in the child process before the child
5908                tid is set.  This would require using either ptrace
5909                (not implemented) or having *_tidptr to point at a shared memory
5910                mapping.  We can't repeat the spinlock hack used above because
5911                the child process gets its own copy of the lock.  */
5912             if (flags & CLONE_CHILD_SETTID)
5913                 put_user_u32(sys_gettid(), child_tidptr);
5914             if (flags & CLONE_PARENT_SETTID)
5915                 put_user_u32(sys_gettid(), parent_tidptr);
5916             ts = (TaskState *)cpu->opaque;
5917             if (flags & CLONE_SETTLS)
5918                 cpu_set_tls (env, newtls);
5919             if (flags & CLONE_CHILD_CLEARTID)
5920                 ts->child_tidptr = child_tidptr;
5921         } else {
5922             cpu_clone_regs_parent(env, flags);
5923             fork_end(0);
5924         }
5925     }
5926     return ret;
5927 }
5928 
5929 /* warning : doesn't handle linux specific flags... */
5930 static int target_to_host_fcntl_cmd(int cmd)
5931 {
5932     int ret;
5933 
5934     switch(cmd) {
5935     case TARGET_F_DUPFD:
5936     case TARGET_F_GETFD:
5937     case TARGET_F_SETFD:
5938     case TARGET_F_GETFL:
5939     case TARGET_F_SETFL:
5940         ret = cmd;
5941         break;
5942     case TARGET_F_GETLK:
5943         ret = F_GETLK64;
5944         break;
5945     case TARGET_F_SETLK:
5946         ret = F_SETLK64;
5947         break;
5948     case TARGET_F_SETLKW:
5949         ret = F_SETLKW64;
5950         break;
5951     case TARGET_F_GETOWN:
5952         ret = F_GETOWN;
5953         break;
5954     case TARGET_F_SETOWN:
5955         ret = F_SETOWN;
5956         break;
5957     case TARGET_F_GETSIG:
5958         ret = F_GETSIG;
5959         break;
5960     case TARGET_F_SETSIG:
5961         ret = F_SETSIG;
5962         break;
5963 #if TARGET_ABI_BITS == 32
5964     case TARGET_F_GETLK64:
5965         ret = F_GETLK64;
5966         break;
5967     case TARGET_F_SETLK64:
5968         ret = F_SETLK64;
5969         break;
5970     case TARGET_F_SETLKW64:
5971         ret = F_SETLKW64;
5972         break;
5973 #endif
5974     case TARGET_F_SETLEASE:
5975         ret = F_SETLEASE;
5976         break;
5977     case TARGET_F_GETLEASE:
5978         ret = F_GETLEASE;
5979         break;
5980 #ifdef F_DUPFD_CLOEXEC
5981     case TARGET_F_DUPFD_CLOEXEC:
5982         ret = F_DUPFD_CLOEXEC;
5983         break;
5984 #endif
5985     case TARGET_F_NOTIFY:
5986         ret = F_NOTIFY;
5987         break;
5988 #ifdef F_GETOWN_EX
5989     case TARGET_F_GETOWN_EX:
5990         ret = F_GETOWN_EX;
5991         break;
5992 #endif
5993 #ifdef F_SETOWN_EX
5994     case TARGET_F_SETOWN_EX:
5995         ret = F_SETOWN_EX;
5996         break;
5997 #endif
5998 #ifdef F_SETPIPE_SZ
5999     case TARGET_F_SETPIPE_SZ:
6000         ret = F_SETPIPE_SZ;
6001         break;
6002     case TARGET_F_GETPIPE_SZ:
6003         ret = F_GETPIPE_SZ;
6004         break;
6005 #endif
6006     default:
6007         ret = -TARGET_EINVAL;
6008         break;
6009     }
6010 
6011 #if defined(__powerpc64__)
6012     /* On PPC64, glibc headers has the F_*LK* defined to 12, 13 and 14 and
6013      * is not supported by kernel. The glibc fcntl call actually adjusts
6014      * them to 5, 6 and 7 before making the syscall(). Since we make the
6015      * syscall directly, adjust to what is supported by the kernel.
6016      */
6017     if (ret >= F_GETLK64 && ret <= F_SETLKW64) {
6018         ret -= F_GETLK64 - 5;
6019     }
6020 #endif
6021 
6022     return ret;
6023 }
6024 
6025 #define FLOCK_TRANSTBL \
6026     switch (type) { \
6027     TRANSTBL_CONVERT(F_RDLCK); \
6028     TRANSTBL_CONVERT(F_WRLCK); \
6029     TRANSTBL_CONVERT(F_UNLCK); \
6030     TRANSTBL_CONVERT(F_EXLCK); \
6031     TRANSTBL_CONVERT(F_SHLCK); \
6032     }
6033 
6034 static int target_to_host_flock(int type)
6035 {
6036 #define TRANSTBL_CONVERT(a) case TARGET_##a: return a
6037     FLOCK_TRANSTBL
6038 #undef  TRANSTBL_CONVERT
6039     return -TARGET_EINVAL;
6040 }
6041 
6042 static int host_to_target_flock(int type)
6043 {
6044 #define TRANSTBL_CONVERT(a) case a: return TARGET_##a
6045     FLOCK_TRANSTBL
6046 #undef  TRANSTBL_CONVERT
6047     /* if we don't know how to convert the value coming
6048      * from the host we copy to the target field as-is
6049      */
6050     return type;
6051 }
6052 
6053 static inline abi_long copy_from_user_flock(struct flock64 *fl,
6054                                             abi_ulong target_flock_addr)
6055 {
6056     struct target_flock *target_fl;
6057     int l_type;
6058 
6059     if (!lock_user_struct(VERIFY_READ, target_fl, target_flock_addr, 1)) {
6060         return -TARGET_EFAULT;
6061     }
6062 
6063     __get_user(l_type, &target_fl->l_type);
6064     l_type = target_to_host_flock(l_type);
6065     if (l_type < 0) {
6066         return l_type;
6067     }
6068     fl->l_type = l_type;
6069     __get_user(fl->l_whence, &target_fl->l_whence);
6070     __get_user(fl->l_start, &target_fl->l_start);
6071     __get_user(fl->l_len, &target_fl->l_len);
6072     __get_user(fl->l_pid, &target_fl->l_pid);
6073     unlock_user_struct(target_fl, target_flock_addr, 0);
6074     return 0;
6075 }
6076 
6077 static inline abi_long copy_to_user_flock(abi_ulong target_flock_addr,
6078                                           const struct flock64 *fl)
6079 {
6080     struct target_flock *target_fl;
6081     short l_type;
6082 
6083     if (!lock_user_struct(VERIFY_WRITE, target_fl, target_flock_addr, 0)) {
6084         return -TARGET_EFAULT;
6085     }
6086 
6087     l_type = host_to_target_flock(fl->l_type);
6088     __put_user(l_type, &target_fl->l_type);
6089     __put_user(fl->l_whence, &target_fl->l_whence);
6090     __put_user(fl->l_start, &target_fl->l_start);
6091     __put_user(fl->l_len, &target_fl->l_len);
6092     __put_user(fl->l_pid, &target_fl->l_pid);
6093     unlock_user_struct(target_fl, target_flock_addr, 1);
6094     return 0;
6095 }
6096 
6097 typedef abi_long from_flock64_fn(struct flock64 *fl, abi_ulong target_addr);
6098 typedef abi_long to_flock64_fn(abi_ulong target_addr, const struct flock64 *fl);
6099 
6100 #if defined(TARGET_ARM) && TARGET_ABI_BITS == 32
6101 static inline abi_long copy_from_user_oabi_flock64(struct flock64 *fl,
6102                                                    abi_ulong target_flock_addr)
6103 {
6104     struct target_oabi_flock64 *target_fl;
6105     int l_type;
6106 
6107     if (!lock_user_struct(VERIFY_READ, target_fl, target_flock_addr, 1)) {
6108         return -TARGET_EFAULT;
6109     }
6110 
6111     __get_user(l_type, &target_fl->l_type);
6112     l_type = target_to_host_flock(l_type);
6113     if (l_type < 0) {
6114         return l_type;
6115     }
6116     fl->l_type = l_type;
6117     __get_user(fl->l_whence, &target_fl->l_whence);
6118     __get_user(fl->l_start, &target_fl->l_start);
6119     __get_user(fl->l_len, &target_fl->l_len);
6120     __get_user(fl->l_pid, &target_fl->l_pid);
6121     unlock_user_struct(target_fl, target_flock_addr, 0);
6122     return 0;
6123 }
6124 
6125 static inline abi_long copy_to_user_oabi_flock64(abi_ulong target_flock_addr,
6126                                                  const struct flock64 *fl)
6127 {
6128     struct target_oabi_flock64 *target_fl;
6129     short l_type;
6130 
6131     if (!lock_user_struct(VERIFY_WRITE, target_fl, target_flock_addr, 0)) {
6132         return -TARGET_EFAULT;
6133     }
6134 
6135     l_type = host_to_target_flock(fl->l_type);
6136     __put_user(l_type, &target_fl->l_type);
6137     __put_user(fl->l_whence, &target_fl->l_whence);
6138     __put_user(fl->l_start, &target_fl->l_start);
6139     __put_user(fl->l_len, &target_fl->l_len);
6140     __put_user(fl->l_pid, &target_fl->l_pid);
6141     unlock_user_struct(target_fl, target_flock_addr, 1);
6142     return 0;
6143 }
6144 #endif
6145 
6146 static inline abi_long copy_from_user_flock64(struct flock64 *fl,
6147                                               abi_ulong target_flock_addr)
6148 {
6149     struct target_flock64 *target_fl;
6150     int l_type;
6151 
6152     if (!lock_user_struct(VERIFY_READ, target_fl, target_flock_addr, 1)) {
6153         return -TARGET_EFAULT;
6154     }
6155 
6156     __get_user(l_type, &target_fl->l_type);
6157     l_type = target_to_host_flock(l_type);
6158     if (l_type < 0) {
6159         return l_type;
6160     }
6161     fl->l_type = l_type;
6162     __get_user(fl->l_whence, &target_fl->l_whence);
6163     __get_user(fl->l_start, &target_fl->l_start);
6164     __get_user(fl->l_len, &target_fl->l_len);
6165     __get_user(fl->l_pid, &target_fl->l_pid);
6166     unlock_user_struct(target_fl, target_flock_addr, 0);
6167     return 0;
6168 }
6169 
6170 static inline abi_long copy_to_user_flock64(abi_ulong target_flock_addr,
6171                                             const struct flock64 *fl)
6172 {
6173     struct target_flock64 *target_fl;
6174     short l_type;
6175 
6176     if (!lock_user_struct(VERIFY_WRITE, target_fl, target_flock_addr, 0)) {
6177         return -TARGET_EFAULT;
6178     }
6179 
6180     l_type = host_to_target_flock(fl->l_type);
6181     __put_user(l_type, &target_fl->l_type);
6182     __put_user(fl->l_whence, &target_fl->l_whence);
6183     __put_user(fl->l_start, &target_fl->l_start);
6184     __put_user(fl->l_len, &target_fl->l_len);
6185     __put_user(fl->l_pid, &target_fl->l_pid);
6186     unlock_user_struct(target_fl, target_flock_addr, 1);
6187     return 0;
6188 }
6189 
6190 static abi_long do_fcntl(int fd, int cmd, abi_ulong arg)
6191 {
6192     struct flock64 fl64;
6193 #ifdef F_GETOWN_EX
6194     struct f_owner_ex fox;
6195     struct target_f_owner_ex *target_fox;
6196 #endif
6197     abi_long ret;
6198     int host_cmd = target_to_host_fcntl_cmd(cmd);
6199 
6200     if (host_cmd == -TARGET_EINVAL)
6201 	    return host_cmd;
6202 
6203     switch(cmd) {
6204     case TARGET_F_GETLK:
6205         ret = copy_from_user_flock(&fl64, arg);
6206         if (ret) {
6207             return ret;
6208         }
6209         ret = get_errno(safe_fcntl(fd, host_cmd, &fl64));
6210         if (ret == 0) {
6211             ret = copy_to_user_flock(arg, &fl64);
6212         }
6213         break;
6214 
6215     case TARGET_F_SETLK:
6216     case TARGET_F_SETLKW:
6217         ret = copy_from_user_flock(&fl64, arg);
6218         if (ret) {
6219             return ret;
6220         }
6221         ret = get_errno(safe_fcntl(fd, host_cmd, &fl64));
6222         break;
6223 
6224     case TARGET_F_GETLK64:
6225         ret = copy_from_user_flock64(&fl64, arg);
6226         if (ret) {
6227             return ret;
6228         }
6229         ret = get_errno(safe_fcntl(fd, host_cmd, &fl64));
6230         if (ret == 0) {
6231             ret = copy_to_user_flock64(arg, &fl64);
6232         }
6233         break;
6234     case TARGET_F_SETLK64:
6235     case TARGET_F_SETLKW64:
6236         ret = copy_from_user_flock64(&fl64, arg);
6237         if (ret) {
6238             return ret;
6239         }
6240         ret = get_errno(safe_fcntl(fd, host_cmd, &fl64));
6241         break;
6242 
6243     case TARGET_F_GETFL:
6244         ret = get_errno(safe_fcntl(fd, host_cmd, arg));
6245         if (ret >= 0) {
6246             ret = host_to_target_bitmask(ret, fcntl_flags_tbl);
6247         }
6248         break;
6249 
6250     case TARGET_F_SETFL:
6251         ret = get_errno(safe_fcntl(fd, host_cmd,
6252                                    target_to_host_bitmask(arg,
6253                                                           fcntl_flags_tbl)));
6254         break;
6255 
6256 #ifdef F_GETOWN_EX
6257     case TARGET_F_GETOWN_EX:
6258         ret = get_errno(safe_fcntl(fd, host_cmd, &fox));
6259         if (ret >= 0) {
6260             if (!lock_user_struct(VERIFY_WRITE, target_fox, arg, 0))
6261                 return -TARGET_EFAULT;
6262             target_fox->type = tswap32(fox.type);
6263             target_fox->pid = tswap32(fox.pid);
6264             unlock_user_struct(target_fox, arg, 1);
6265         }
6266         break;
6267 #endif
6268 
6269 #ifdef F_SETOWN_EX
6270     case TARGET_F_SETOWN_EX:
6271         if (!lock_user_struct(VERIFY_READ, target_fox, arg, 1))
6272             return -TARGET_EFAULT;
6273         fox.type = tswap32(target_fox->type);
6274         fox.pid = tswap32(target_fox->pid);
6275         unlock_user_struct(target_fox, arg, 0);
6276         ret = get_errno(safe_fcntl(fd, host_cmd, &fox));
6277         break;
6278 #endif
6279 
6280     case TARGET_F_SETOWN:
6281     case TARGET_F_GETOWN:
6282     case TARGET_F_SETSIG:
6283     case TARGET_F_GETSIG:
6284     case TARGET_F_SETLEASE:
6285     case TARGET_F_GETLEASE:
6286     case TARGET_F_SETPIPE_SZ:
6287     case TARGET_F_GETPIPE_SZ:
6288         ret = get_errno(safe_fcntl(fd, host_cmd, arg));
6289         break;
6290 
6291     default:
6292         ret = get_errno(safe_fcntl(fd, cmd, arg));
6293         break;
6294     }
6295     return ret;
6296 }
6297 
6298 #ifdef USE_UID16
6299 
6300 static inline int high2lowuid(int uid)
6301 {
6302     if (uid > 65535)
6303         return 65534;
6304     else
6305         return uid;
6306 }
6307 
6308 static inline int high2lowgid(int gid)
6309 {
6310     if (gid > 65535)
6311         return 65534;
6312     else
6313         return gid;
6314 }
6315 
6316 static inline int low2highuid(int uid)
6317 {
6318     if ((int16_t)uid == -1)
6319         return -1;
6320     else
6321         return uid;
6322 }
6323 
6324 static inline int low2highgid(int gid)
6325 {
6326     if ((int16_t)gid == -1)
6327         return -1;
6328     else
6329         return gid;
6330 }
6331 static inline int tswapid(int id)
6332 {
6333     return tswap16(id);
6334 }
6335 
6336 #define put_user_id(x, gaddr) put_user_u16(x, gaddr)
6337 
6338 #else /* !USE_UID16 */
6339 static inline int high2lowuid(int uid)
6340 {
6341     return uid;
6342 }
6343 static inline int high2lowgid(int gid)
6344 {
6345     return gid;
6346 }
6347 static inline int low2highuid(int uid)
6348 {
6349     return uid;
6350 }
6351 static inline int low2highgid(int gid)
6352 {
6353     return gid;
6354 }
6355 static inline int tswapid(int id)
6356 {
6357     return tswap32(id);
6358 }
6359 
6360 #define put_user_id(x, gaddr) put_user_u32(x, gaddr)
6361 
6362 #endif /* USE_UID16 */
6363 
6364 /* We must do direct syscalls for setting UID/GID, because we want to
6365  * implement the Linux system call semantics of "change only for this thread",
6366  * not the libc/POSIX semantics of "change for all threads in process".
6367  * (See http://ewontfix.com/17/ for more details.)
6368  * We use the 32-bit version of the syscalls if present; if it is not
6369  * then either the host architecture supports 32-bit UIDs natively with
6370  * the standard syscall, or the 16-bit UID is the best we can do.
6371  */
6372 #ifdef __NR_setuid32
6373 #define __NR_sys_setuid __NR_setuid32
6374 #else
6375 #define __NR_sys_setuid __NR_setuid
6376 #endif
6377 #ifdef __NR_setgid32
6378 #define __NR_sys_setgid __NR_setgid32
6379 #else
6380 #define __NR_sys_setgid __NR_setgid
6381 #endif
6382 #ifdef __NR_setresuid32
6383 #define __NR_sys_setresuid __NR_setresuid32
6384 #else
6385 #define __NR_sys_setresuid __NR_setresuid
6386 #endif
6387 #ifdef __NR_setresgid32
6388 #define __NR_sys_setresgid __NR_setresgid32
6389 #else
6390 #define __NR_sys_setresgid __NR_setresgid
6391 #endif
6392 
6393 _syscall1(int, sys_setuid, uid_t, uid)
6394 _syscall1(int, sys_setgid, gid_t, gid)
6395 _syscall3(int, sys_setresuid, uid_t, ruid, uid_t, euid, uid_t, suid)
6396 _syscall3(int, sys_setresgid, gid_t, rgid, gid_t, egid, gid_t, sgid)
6397 
6398 void syscall_init(void)
6399 {
6400     IOCTLEntry *ie;
6401     const argtype *arg_type;
6402     int size;
6403     int i;
6404 
6405     thunk_init(STRUCT_MAX);
6406 
6407 #define STRUCT(name, ...) thunk_register_struct(STRUCT_ ## name, #name, struct_ ## name ## _def);
6408 #define STRUCT_SPECIAL(name) thunk_register_struct_direct(STRUCT_ ## name, #name, &struct_ ## name ## _def);
6409 #include "syscall_types.h"
6410 #undef STRUCT
6411 #undef STRUCT_SPECIAL
6412 
6413     /* Build target_to_host_errno_table[] table from
6414      * host_to_target_errno_table[]. */
6415     for (i = 0; i < ERRNO_TABLE_SIZE; i++) {
6416         target_to_host_errno_table[host_to_target_errno_table[i]] = i;
6417     }
6418 
6419     /* we patch the ioctl size if necessary. We rely on the fact that
6420        no ioctl has all the bits at '1' in the size field */
6421     ie = ioctl_entries;
6422     while (ie->target_cmd != 0) {
6423         if (((ie->target_cmd >> TARGET_IOC_SIZESHIFT) & TARGET_IOC_SIZEMASK) ==
6424             TARGET_IOC_SIZEMASK) {
6425             arg_type = ie->arg_type;
6426             if (arg_type[0] != TYPE_PTR) {
6427                 fprintf(stderr, "cannot patch size for ioctl 0x%x\n",
6428                         ie->target_cmd);
6429                 exit(1);
6430             }
6431             arg_type++;
6432             size = thunk_type_size(arg_type, 0);
6433             ie->target_cmd = (ie->target_cmd &
6434                               ~(TARGET_IOC_SIZEMASK << TARGET_IOC_SIZESHIFT)) |
6435                 (size << TARGET_IOC_SIZESHIFT);
6436         }
6437 
6438         /* automatic consistency check if same arch */
6439 #if (defined(__i386__) && defined(TARGET_I386) && defined(TARGET_ABI32)) || \
6440     (defined(__x86_64__) && defined(TARGET_X86_64))
6441         if (unlikely(ie->target_cmd != ie->host_cmd)) {
6442             fprintf(stderr, "ERROR: ioctl(%s): target=0x%x host=0x%x\n",
6443                     ie->name, ie->target_cmd, ie->host_cmd);
6444         }
6445 #endif
6446         ie++;
6447     }
6448 }
6449 
6450 #if TARGET_ABI_BITS == 32
6451 static inline uint64_t target_offset64(uint32_t word0, uint32_t word1)
6452 {
6453 #ifdef TARGET_WORDS_BIGENDIAN
6454     return ((uint64_t)word0 << 32) | word1;
6455 #else
6456     return ((uint64_t)word1 << 32) | word0;
6457 #endif
6458 }
6459 #else /* TARGET_ABI_BITS == 32 */
6460 static inline uint64_t target_offset64(uint64_t word0, uint64_t word1)
6461 {
6462     return word0;
6463 }
6464 #endif /* TARGET_ABI_BITS != 32 */
6465 
6466 #ifdef TARGET_NR_truncate64
6467 static inline abi_long target_truncate64(void *cpu_env, const char *arg1,
6468                                          abi_long arg2,
6469                                          abi_long arg3,
6470                                          abi_long arg4)
6471 {
6472     if (regpairs_aligned(cpu_env, TARGET_NR_truncate64)) {
6473         arg2 = arg3;
6474         arg3 = arg4;
6475     }
6476     return get_errno(truncate64(arg1, target_offset64(arg2, arg3)));
6477 }
6478 #endif
6479 
6480 #ifdef TARGET_NR_ftruncate64
6481 static inline abi_long target_ftruncate64(void *cpu_env, abi_long arg1,
6482                                           abi_long arg2,
6483                                           abi_long arg3,
6484                                           abi_long arg4)
6485 {
6486     if (regpairs_aligned(cpu_env, TARGET_NR_ftruncate64)) {
6487         arg2 = arg3;
6488         arg3 = arg4;
6489     }
6490     return get_errno(ftruncate64(arg1, target_offset64(arg2, arg3)));
6491 }
6492 #endif
6493 
6494 static inline abi_long target_to_host_itimerspec(struct itimerspec *host_itspec,
6495                                                  abi_ulong target_addr)
6496 {
6497     struct target_itimerspec *target_itspec;
6498 
6499     if (!lock_user_struct(VERIFY_READ, target_itspec, target_addr, 1)) {
6500         return -TARGET_EFAULT;
6501     }
6502 
6503     host_itspec->it_interval.tv_sec =
6504                             tswapal(target_itspec->it_interval.tv_sec);
6505     host_itspec->it_interval.tv_nsec =
6506                             tswapal(target_itspec->it_interval.tv_nsec);
6507     host_itspec->it_value.tv_sec = tswapal(target_itspec->it_value.tv_sec);
6508     host_itspec->it_value.tv_nsec = tswapal(target_itspec->it_value.tv_nsec);
6509 
6510     unlock_user_struct(target_itspec, target_addr, 1);
6511     return 0;
6512 }
6513 
6514 static inline abi_long host_to_target_itimerspec(abi_ulong target_addr,
6515                                                struct itimerspec *host_its)
6516 {
6517     struct target_itimerspec *target_itspec;
6518 
6519     if (!lock_user_struct(VERIFY_WRITE, target_itspec, target_addr, 0)) {
6520         return -TARGET_EFAULT;
6521     }
6522 
6523     target_itspec->it_interval.tv_sec = tswapal(host_its->it_interval.tv_sec);
6524     target_itspec->it_interval.tv_nsec = tswapal(host_its->it_interval.tv_nsec);
6525 
6526     target_itspec->it_value.tv_sec = tswapal(host_its->it_value.tv_sec);
6527     target_itspec->it_value.tv_nsec = tswapal(host_its->it_value.tv_nsec);
6528 
6529     unlock_user_struct(target_itspec, target_addr, 0);
6530     return 0;
6531 }
6532 
6533 static inline abi_long target_to_host_timex(struct timex *host_tx,
6534                                             abi_long target_addr)
6535 {
6536     struct target_timex *target_tx;
6537 
6538     if (!lock_user_struct(VERIFY_READ, target_tx, target_addr, 1)) {
6539         return -TARGET_EFAULT;
6540     }
6541 
6542     __get_user(host_tx->modes, &target_tx->modes);
6543     __get_user(host_tx->offset, &target_tx->offset);
6544     __get_user(host_tx->freq, &target_tx->freq);
6545     __get_user(host_tx->maxerror, &target_tx->maxerror);
6546     __get_user(host_tx->esterror, &target_tx->esterror);
6547     __get_user(host_tx->status, &target_tx->status);
6548     __get_user(host_tx->constant, &target_tx->constant);
6549     __get_user(host_tx->precision, &target_tx->precision);
6550     __get_user(host_tx->tolerance, &target_tx->tolerance);
6551     __get_user(host_tx->time.tv_sec, &target_tx->time.tv_sec);
6552     __get_user(host_tx->time.tv_usec, &target_tx->time.tv_usec);
6553     __get_user(host_tx->tick, &target_tx->tick);
6554     __get_user(host_tx->ppsfreq, &target_tx->ppsfreq);
6555     __get_user(host_tx->jitter, &target_tx->jitter);
6556     __get_user(host_tx->shift, &target_tx->shift);
6557     __get_user(host_tx->stabil, &target_tx->stabil);
6558     __get_user(host_tx->jitcnt, &target_tx->jitcnt);
6559     __get_user(host_tx->calcnt, &target_tx->calcnt);
6560     __get_user(host_tx->errcnt, &target_tx->errcnt);
6561     __get_user(host_tx->stbcnt, &target_tx->stbcnt);
6562     __get_user(host_tx->tai, &target_tx->tai);
6563 
6564     unlock_user_struct(target_tx, target_addr, 0);
6565     return 0;
6566 }
6567 
6568 static inline abi_long host_to_target_timex(abi_long target_addr,
6569                                             struct timex *host_tx)
6570 {
6571     struct target_timex *target_tx;
6572 
6573     if (!lock_user_struct(VERIFY_WRITE, target_tx, target_addr, 0)) {
6574         return -TARGET_EFAULT;
6575     }
6576 
6577     __put_user(host_tx->modes, &target_tx->modes);
6578     __put_user(host_tx->offset, &target_tx->offset);
6579     __put_user(host_tx->freq, &target_tx->freq);
6580     __put_user(host_tx->maxerror, &target_tx->maxerror);
6581     __put_user(host_tx->esterror, &target_tx->esterror);
6582     __put_user(host_tx->status, &target_tx->status);
6583     __put_user(host_tx->constant, &target_tx->constant);
6584     __put_user(host_tx->precision, &target_tx->precision);
6585     __put_user(host_tx->tolerance, &target_tx->tolerance);
6586     __put_user(host_tx->time.tv_sec, &target_tx->time.tv_sec);
6587     __put_user(host_tx->time.tv_usec, &target_tx->time.tv_usec);
6588     __put_user(host_tx->tick, &target_tx->tick);
6589     __put_user(host_tx->ppsfreq, &target_tx->ppsfreq);
6590     __put_user(host_tx->jitter, &target_tx->jitter);
6591     __put_user(host_tx->shift, &target_tx->shift);
6592     __put_user(host_tx->stabil, &target_tx->stabil);
6593     __put_user(host_tx->jitcnt, &target_tx->jitcnt);
6594     __put_user(host_tx->calcnt, &target_tx->calcnt);
6595     __put_user(host_tx->errcnt, &target_tx->errcnt);
6596     __put_user(host_tx->stbcnt, &target_tx->stbcnt);
6597     __put_user(host_tx->tai, &target_tx->tai);
6598 
6599     unlock_user_struct(target_tx, target_addr, 1);
6600     return 0;
6601 }
6602 
6603 
6604 static inline abi_long target_to_host_sigevent(struct sigevent *host_sevp,
6605                                                abi_ulong target_addr)
6606 {
6607     struct target_sigevent *target_sevp;
6608 
6609     if (!lock_user_struct(VERIFY_READ, target_sevp, target_addr, 1)) {
6610         return -TARGET_EFAULT;
6611     }
6612 
6613     /* This union is awkward on 64 bit systems because it has a 32 bit
6614      * integer and a pointer in it; we follow the conversion approach
6615      * used for handling sigval types in signal.c so the guest should get
6616      * the correct value back even if we did a 64 bit byteswap and it's
6617      * using the 32 bit integer.
6618      */
6619     host_sevp->sigev_value.sival_ptr =
6620         (void *)(uintptr_t)tswapal(target_sevp->sigev_value.sival_ptr);
6621     host_sevp->sigev_signo =
6622         target_to_host_signal(tswap32(target_sevp->sigev_signo));
6623     host_sevp->sigev_notify = tswap32(target_sevp->sigev_notify);
6624     host_sevp->_sigev_un._tid = tswap32(target_sevp->_sigev_un._tid);
6625 
6626     unlock_user_struct(target_sevp, target_addr, 1);
6627     return 0;
6628 }
6629 
6630 #if defined(TARGET_NR_mlockall)
6631 static inline int target_to_host_mlockall_arg(int arg)
6632 {
6633     int result = 0;
6634 
6635     if (arg & TARGET_MLOCKALL_MCL_CURRENT) {
6636         result |= MCL_CURRENT;
6637     }
6638     if (arg & TARGET_MLOCKALL_MCL_FUTURE) {
6639         result |= MCL_FUTURE;
6640     }
6641     return result;
6642 }
6643 #endif
6644 
6645 #if (defined(TARGET_NR_stat64) || defined(TARGET_NR_lstat64) ||     \
6646      defined(TARGET_NR_fstat64) || defined(TARGET_NR_fstatat64) ||  \
6647      defined(TARGET_NR_newfstatat))
6648 static inline abi_long host_to_target_stat64(void *cpu_env,
6649                                              abi_ulong target_addr,
6650                                              struct stat *host_st)
6651 {
6652 #if defined(TARGET_ARM) && defined(TARGET_ABI32)
6653     if (((CPUARMState *)cpu_env)->eabi) {
6654         struct target_eabi_stat64 *target_st;
6655 
6656         if (!lock_user_struct(VERIFY_WRITE, target_st, target_addr, 0))
6657             return -TARGET_EFAULT;
6658         memset(target_st, 0, sizeof(struct target_eabi_stat64));
6659         __put_user(host_st->st_dev, &target_st->st_dev);
6660         __put_user(host_st->st_ino, &target_st->st_ino);
6661 #ifdef TARGET_STAT64_HAS_BROKEN_ST_INO
6662         __put_user(host_st->st_ino, &target_st->__st_ino);
6663 #endif
6664         __put_user(host_st->st_mode, &target_st->st_mode);
6665         __put_user(host_st->st_nlink, &target_st->st_nlink);
6666         __put_user(host_st->st_uid, &target_st->st_uid);
6667         __put_user(host_st->st_gid, &target_st->st_gid);
6668         __put_user(host_st->st_rdev, &target_st->st_rdev);
6669         __put_user(host_st->st_size, &target_st->st_size);
6670         __put_user(host_st->st_blksize, &target_st->st_blksize);
6671         __put_user(host_st->st_blocks, &target_st->st_blocks);
6672         __put_user(host_st->st_atime, &target_st->target_st_atime);
6673         __put_user(host_st->st_mtime, &target_st->target_st_mtime);
6674         __put_user(host_st->st_ctime, &target_st->target_st_ctime);
6675 #if _POSIX_C_SOURCE >= 200809L || _XOPEN_SOURCE >= 700
6676         __put_user(host_st->st_atim.tv_nsec, &target_st->target_st_atime_nsec);
6677         __put_user(host_st->st_mtim.tv_nsec, &target_st->target_st_mtime_nsec);
6678         __put_user(host_st->st_ctim.tv_nsec, &target_st->target_st_ctime_nsec);
6679 #endif
6680         unlock_user_struct(target_st, target_addr, 1);
6681     } else
6682 #endif
6683     {
6684 #if defined(TARGET_HAS_STRUCT_STAT64)
6685         struct target_stat64 *target_st;
6686 #else
6687         struct target_stat *target_st;
6688 #endif
6689 
6690         if (!lock_user_struct(VERIFY_WRITE, target_st, target_addr, 0))
6691             return -TARGET_EFAULT;
6692         memset(target_st, 0, sizeof(*target_st));
6693         __put_user(host_st->st_dev, &target_st->st_dev);
6694         __put_user(host_st->st_ino, &target_st->st_ino);
6695 #ifdef TARGET_STAT64_HAS_BROKEN_ST_INO
6696         __put_user(host_st->st_ino, &target_st->__st_ino);
6697 #endif
6698         __put_user(host_st->st_mode, &target_st->st_mode);
6699         __put_user(host_st->st_nlink, &target_st->st_nlink);
6700         __put_user(host_st->st_uid, &target_st->st_uid);
6701         __put_user(host_st->st_gid, &target_st->st_gid);
6702         __put_user(host_st->st_rdev, &target_st->st_rdev);
6703         /* XXX: better use of kernel struct */
6704         __put_user(host_st->st_size, &target_st->st_size);
6705         __put_user(host_st->st_blksize, &target_st->st_blksize);
6706         __put_user(host_st->st_blocks, &target_st->st_blocks);
6707         __put_user(host_st->st_atime, &target_st->target_st_atime);
6708         __put_user(host_st->st_mtime, &target_st->target_st_mtime);
6709         __put_user(host_st->st_ctime, &target_st->target_st_ctime);
6710 #if _POSIX_C_SOURCE >= 200809L || _XOPEN_SOURCE >= 700
6711         __put_user(host_st->st_atim.tv_nsec, &target_st->target_st_atime_nsec);
6712         __put_user(host_st->st_mtim.tv_nsec, &target_st->target_st_mtime_nsec);
6713         __put_user(host_st->st_ctim.tv_nsec, &target_st->target_st_ctime_nsec);
6714 #endif
6715         unlock_user_struct(target_st, target_addr, 1);
6716     }
6717 
6718     return 0;
6719 }
6720 #endif
6721 
6722 #if defined(TARGET_NR_statx) && defined(__NR_statx)
6723 static inline abi_long host_to_target_statx(struct target_statx *host_stx,
6724                                             abi_ulong target_addr)
6725 {
6726     struct target_statx *target_stx;
6727 
6728     if (!lock_user_struct(VERIFY_WRITE, target_stx, target_addr,  0)) {
6729         return -TARGET_EFAULT;
6730     }
6731     memset(target_stx, 0, sizeof(*target_stx));
6732 
6733     __put_user(host_stx->stx_mask, &target_stx->stx_mask);
6734     __put_user(host_stx->stx_blksize, &target_stx->stx_blksize);
6735     __put_user(host_stx->stx_attributes, &target_stx->stx_attributes);
6736     __put_user(host_stx->stx_nlink, &target_stx->stx_nlink);
6737     __put_user(host_stx->stx_uid, &target_stx->stx_uid);
6738     __put_user(host_stx->stx_gid, &target_stx->stx_gid);
6739     __put_user(host_stx->stx_mode, &target_stx->stx_mode);
6740     __put_user(host_stx->stx_ino, &target_stx->stx_ino);
6741     __put_user(host_stx->stx_size, &target_stx->stx_size);
6742     __put_user(host_stx->stx_blocks, &target_stx->stx_blocks);
6743     __put_user(host_stx->stx_attributes_mask, &target_stx->stx_attributes_mask);
6744     __put_user(host_stx->stx_atime.tv_sec, &target_stx->stx_atime.tv_sec);
6745     __put_user(host_stx->stx_atime.tv_nsec, &target_stx->stx_atime.tv_nsec);
6746     __put_user(host_stx->stx_btime.tv_sec, &target_stx->stx_atime.tv_sec);
6747     __put_user(host_stx->stx_btime.tv_nsec, &target_stx->stx_atime.tv_nsec);
6748     __put_user(host_stx->stx_ctime.tv_sec, &target_stx->stx_atime.tv_sec);
6749     __put_user(host_stx->stx_ctime.tv_nsec, &target_stx->stx_atime.tv_nsec);
6750     __put_user(host_stx->stx_mtime.tv_sec, &target_stx->stx_atime.tv_sec);
6751     __put_user(host_stx->stx_mtime.tv_nsec, &target_stx->stx_atime.tv_nsec);
6752     __put_user(host_stx->stx_rdev_major, &target_stx->stx_rdev_major);
6753     __put_user(host_stx->stx_rdev_minor, &target_stx->stx_rdev_minor);
6754     __put_user(host_stx->stx_dev_major, &target_stx->stx_dev_major);
6755     __put_user(host_stx->stx_dev_minor, &target_stx->stx_dev_minor);
6756 
6757     unlock_user_struct(target_stx, target_addr, 1);
6758 
6759     return 0;
6760 }
6761 #endif
6762 
6763 
6764 /* ??? Using host futex calls even when target atomic operations
6765    are not really atomic probably breaks things.  However implementing
6766    futexes locally would make futexes shared between multiple processes
6767    tricky.  However they're probably useless because guest atomic
6768    operations won't work either.  */
6769 static int do_futex(target_ulong uaddr, int op, int val, target_ulong timeout,
6770                     target_ulong uaddr2, int val3)
6771 {
6772     struct timespec ts, *pts;
6773     int base_op;
6774 
6775     /* ??? We assume FUTEX_* constants are the same on both host
6776        and target.  */
6777 #ifdef FUTEX_CMD_MASK
6778     base_op = op & FUTEX_CMD_MASK;
6779 #else
6780     base_op = op;
6781 #endif
6782     switch (base_op) {
6783     case FUTEX_WAIT:
6784     case FUTEX_WAIT_BITSET:
6785         if (timeout) {
6786             pts = &ts;
6787             target_to_host_timespec(pts, timeout);
6788         } else {
6789             pts = NULL;
6790         }
6791         return get_errno(safe_futex(g2h(uaddr), op, tswap32(val),
6792                          pts, NULL, val3));
6793     case FUTEX_WAKE:
6794         return get_errno(safe_futex(g2h(uaddr), op, val, NULL, NULL, 0));
6795     case FUTEX_FD:
6796         return get_errno(safe_futex(g2h(uaddr), op, val, NULL, NULL, 0));
6797     case FUTEX_REQUEUE:
6798     case FUTEX_CMP_REQUEUE:
6799     case FUTEX_WAKE_OP:
6800         /* For FUTEX_REQUEUE, FUTEX_CMP_REQUEUE, and FUTEX_WAKE_OP, the
6801            TIMEOUT parameter is interpreted as a uint32_t by the kernel.
6802            But the prototype takes a `struct timespec *'; insert casts
6803            to satisfy the compiler.  We do not need to tswap TIMEOUT
6804            since it's not compared to guest memory.  */
6805         pts = (struct timespec *)(uintptr_t) timeout;
6806         return get_errno(safe_futex(g2h(uaddr), op, val, pts,
6807                                     g2h(uaddr2),
6808                                     (base_op == FUTEX_CMP_REQUEUE
6809                                      ? tswap32(val3)
6810                                      : val3)));
6811     default:
6812         return -TARGET_ENOSYS;
6813     }
6814 }
6815 #if defined(TARGET_NR_name_to_handle_at) && defined(CONFIG_OPEN_BY_HANDLE)
6816 static abi_long do_name_to_handle_at(abi_long dirfd, abi_long pathname,
6817                                      abi_long handle, abi_long mount_id,
6818                                      abi_long flags)
6819 {
6820     struct file_handle *target_fh;
6821     struct file_handle *fh;
6822     int mid = 0;
6823     abi_long ret;
6824     char *name;
6825     unsigned int size, total_size;
6826 
6827     if (get_user_s32(size, handle)) {
6828         return -TARGET_EFAULT;
6829     }
6830 
6831     name = lock_user_string(pathname);
6832     if (!name) {
6833         return -TARGET_EFAULT;
6834     }
6835 
6836     total_size = sizeof(struct file_handle) + size;
6837     target_fh = lock_user(VERIFY_WRITE, handle, total_size, 0);
6838     if (!target_fh) {
6839         unlock_user(name, pathname, 0);
6840         return -TARGET_EFAULT;
6841     }
6842 
6843     fh = g_malloc0(total_size);
6844     fh->handle_bytes = size;
6845 
6846     ret = get_errno(name_to_handle_at(dirfd, path(name), fh, &mid, flags));
6847     unlock_user(name, pathname, 0);
6848 
6849     /* man name_to_handle_at(2):
6850      * Other than the use of the handle_bytes field, the caller should treat
6851      * the file_handle structure as an opaque data type
6852      */
6853 
6854     memcpy(target_fh, fh, total_size);
6855     target_fh->handle_bytes = tswap32(fh->handle_bytes);
6856     target_fh->handle_type = tswap32(fh->handle_type);
6857     g_free(fh);
6858     unlock_user(target_fh, handle, total_size);
6859 
6860     if (put_user_s32(mid, mount_id)) {
6861         return -TARGET_EFAULT;
6862     }
6863 
6864     return ret;
6865 
6866 }
6867 #endif
6868 
6869 #if defined(TARGET_NR_open_by_handle_at) && defined(CONFIG_OPEN_BY_HANDLE)
6870 static abi_long do_open_by_handle_at(abi_long mount_fd, abi_long handle,
6871                                      abi_long flags)
6872 {
6873     struct file_handle *target_fh;
6874     struct file_handle *fh;
6875     unsigned int size, total_size;
6876     abi_long ret;
6877 
6878     if (get_user_s32(size, handle)) {
6879         return -TARGET_EFAULT;
6880     }
6881 
6882     total_size = sizeof(struct file_handle) + size;
6883     target_fh = lock_user(VERIFY_READ, handle, total_size, 1);
6884     if (!target_fh) {
6885         return -TARGET_EFAULT;
6886     }
6887 
6888     fh = g_memdup(target_fh, total_size);
6889     fh->handle_bytes = size;
6890     fh->handle_type = tswap32(target_fh->handle_type);
6891 
6892     ret = get_errno(open_by_handle_at(mount_fd, fh,
6893                     target_to_host_bitmask(flags, fcntl_flags_tbl)));
6894 
6895     g_free(fh);
6896 
6897     unlock_user(target_fh, handle, total_size);
6898 
6899     return ret;
6900 }
6901 #endif
6902 
6903 #if defined(TARGET_NR_signalfd) || defined(TARGET_NR_signalfd4)
6904 
6905 static abi_long do_signalfd4(int fd, abi_long mask, int flags)
6906 {
6907     int host_flags;
6908     target_sigset_t *target_mask;
6909     sigset_t host_mask;
6910     abi_long ret;
6911 
6912     if (flags & ~(TARGET_O_NONBLOCK | TARGET_O_CLOEXEC)) {
6913         return -TARGET_EINVAL;
6914     }
6915     if (!lock_user_struct(VERIFY_READ, target_mask, mask, 1)) {
6916         return -TARGET_EFAULT;
6917     }
6918 
6919     target_to_host_sigset(&host_mask, target_mask);
6920 
6921     host_flags = target_to_host_bitmask(flags, fcntl_flags_tbl);
6922 
6923     ret = get_errno(signalfd(fd, &host_mask, host_flags));
6924     if (ret >= 0) {
6925         fd_trans_register(ret, &target_signalfd_trans);
6926     }
6927 
6928     unlock_user_struct(target_mask, mask, 0);
6929 
6930     return ret;
6931 }
6932 #endif
6933 
6934 /* Map host to target signal numbers for the wait family of syscalls.
6935    Assume all other status bits are the same.  */
6936 int host_to_target_waitstatus(int status)
6937 {
6938     if (WIFSIGNALED(status)) {
6939         return host_to_target_signal(WTERMSIG(status)) | (status & ~0x7f);
6940     }
6941     if (WIFSTOPPED(status)) {
6942         return (host_to_target_signal(WSTOPSIG(status)) << 8)
6943                | (status & 0xff);
6944     }
6945     return status;
6946 }
6947 
6948 static int open_self_cmdline(void *cpu_env, int fd)
6949 {
6950     CPUState *cpu = env_cpu((CPUArchState *)cpu_env);
6951     struct linux_binprm *bprm = ((TaskState *)cpu->opaque)->bprm;
6952     int i;
6953 
6954     for (i = 0; i < bprm->argc; i++) {
6955         size_t len = strlen(bprm->argv[i]) + 1;
6956 
6957         if (write(fd, bprm->argv[i], len) != len) {
6958             return -1;
6959         }
6960     }
6961 
6962     return 0;
6963 }
6964 
6965 static int open_self_maps(void *cpu_env, int fd)
6966 {
6967     CPUState *cpu = env_cpu((CPUArchState *)cpu_env);
6968     TaskState *ts = cpu->opaque;
6969     FILE *fp;
6970     char *line = NULL;
6971     size_t len = 0;
6972     ssize_t read;
6973 
6974     fp = fopen("/proc/self/maps", "r");
6975     if (fp == NULL) {
6976         return -1;
6977     }
6978 
6979     while ((read = getline(&line, &len, fp)) != -1) {
6980         int fields, dev_maj, dev_min, inode;
6981         uint64_t min, max, offset;
6982         char flag_r, flag_w, flag_x, flag_p;
6983         char path[512] = "";
6984         fields = sscanf(line, "%"PRIx64"-%"PRIx64" %c%c%c%c %"PRIx64" %x:%x %d"
6985                         " %512s", &min, &max, &flag_r, &flag_w, &flag_x,
6986                         &flag_p, &offset, &dev_maj, &dev_min, &inode, path);
6987 
6988         if ((fields < 10) || (fields > 11)) {
6989             continue;
6990         }
6991         if (h2g_valid(min)) {
6992             int flags = page_get_flags(h2g(min));
6993             max = h2g_valid(max - 1) ? max : (uintptr_t)g2h(GUEST_ADDR_MAX) + 1;
6994             if (page_check_range(h2g(min), max - min, flags) == -1) {
6995                 continue;
6996             }
6997             if (h2g(min) == ts->info->stack_limit) {
6998                 pstrcpy(path, sizeof(path), "      [stack]");
6999             }
7000             dprintf(fd, TARGET_ABI_FMT_ptr "-" TARGET_ABI_FMT_ptr
7001                     " %c%c%c%c %08" PRIx64 " %02x:%02x %d %s%s\n",
7002                     h2g(min), h2g(max - 1) + 1, flag_r, flag_w,
7003                     flag_x, flag_p, offset, dev_maj, dev_min, inode,
7004                     path[0] ? "         " : "", path);
7005         }
7006     }
7007 
7008     free(line);
7009     fclose(fp);
7010 
7011     return 0;
7012 }
7013 
7014 static int open_self_stat(void *cpu_env, int fd)
7015 {
7016     CPUState *cpu = env_cpu((CPUArchState *)cpu_env);
7017     TaskState *ts = cpu->opaque;
7018     abi_ulong start_stack = ts->info->start_stack;
7019     int i;
7020 
7021     for (i = 0; i < 44; i++) {
7022       char buf[128];
7023       int len;
7024       uint64_t val = 0;
7025 
7026       if (i == 0) {
7027         /* pid */
7028         val = getpid();
7029         snprintf(buf, sizeof(buf), "%"PRId64 " ", val);
7030       } else if (i == 1) {
7031         /* app name */
7032         snprintf(buf, sizeof(buf), "(%s) ", ts->bprm->argv[0]);
7033       } else if (i == 27) {
7034         /* stack bottom */
7035         val = start_stack;
7036         snprintf(buf, sizeof(buf), "%"PRId64 " ", val);
7037       } else {
7038         /* for the rest, there is MasterCard */
7039         snprintf(buf, sizeof(buf), "0%c", i == 43 ? '\n' : ' ');
7040       }
7041 
7042       len = strlen(buf);
7043       if (write(fd, buf, len) != len) {
7044           return -1;
7045       }
7046     }
7047 
7048     return 0;
7049 }
7050 
7051 static int open_self_auxv(void *cpu_env, int fd)
7052 {
7053     CPUState *cpu = env_cpu((CPUArchState *)cpu_env);
7054     TaskState *ts = cpu->opaque;
7055     abi_ulong auxv = ts->info->saved_auxv;
7056     abi_ulong len = ts->info->auxv_len;
7057     char *ptr;
7058 
7059     /*
7060      * Auxiliary vector is stored in target process stack.
7061      * read in whole auxv vector and copy it to file
7062      */
7063     ptr = lock_user(VERIFY_READ, auxv, len, 0);
7064     if (ptr != NULL) {
7065         while (len > 0) {
7066             ssize_t r;
7067             r = write(fd, ptr, len);
7068             if (r <= 0) {
7069                 break;
7070             }
7071             len -= r;
7072             ptr += r;
7073         }
7074         lseek(fd, 0, SEEK_SET);
7075         unlock_user(ptr, auxv, len);
7076     }
7077 
7078     return 0;
7079 }
7080 
7081 static int is_proc_myself(const char *filename, const char *entry)
7082 {
7083     if (!strncmp(filename, "/proc/", strlen("/proc/"))) {
7084         filename += strlen("/proc/");
7085         if (!strncmp(filename, "self/", strlen("self/"))) {
7086             filename += strlen("self/");
7087         } else if (*filename >= '1' && *filename <= '9') {
7088             char myself[80];
7089             snprintf(myself, sizeof(myself), "%d/", getpid());
7090             if (!strncmp(filename, myself, strlen(myself))) {
7091                 filename += strlen(myself);
7092             } else {
7093                 return 0;
7094             }
7095         } else {
7096             return 0;
7097         }
7098         if (!strcmp(filename, entry)) {
7099             return 1;
7100         }
7101     }
7102     return 0;
7103 }
7104 
7105 #if defined(HOST_WORDS_BIGENDIAN) != defined(TARGET_WORDS_BIGENDIAN) || \
7106     defined(TARGET_SPARC) || defined(TARGET_M68K)
7107 static int is_proc(const char *filename, const char *entry)
7108 {
7109     return strcmp(filename, entry) == 0;
7110 }
7111 #endif
7112 
7113 #if defined(HOST_WORDS_BIGENDIAN) != defined(TARGET_WORDS_BIGENDIAN)
7114 static int open_net_route(void *cpu_env, int fd)
7115 {
7116     FILE *fp;
7117     char *line = NULL;
7118     size_t len = 0;
7119     ssize_t read;
7120 
7121     fp = fopen("/proc/net/route", "r");
7122     if (fp == NULL) {
7123         return -1;
7124     }
7125 
7126     /* read header */
7127 
7128     read = getline(&line, &len, fp);
7129     dprintf(fd, "%s", line);
7130 
7131     /* read routes */
7132 
7133     while ((read = getline(&line, &len, fp)) != -1) {
7134         char iface[16];
7135         uint32_t dest, gw, mask;
7136         unsigned int flags, refcnt, use, metric, mtu, window, irtt;
7137         int fields;
7138 
7139         fields = sscanf(line,
7140                         "%s\t%08x\t%08x\t%04x\t%d\t%d\t%d\t%08x\t%d\t%u\t%u\n",
7141                         iface, &dest, &gw, &flags, &refcnt, &use, &metric,
7142                         &mask, &mtu, &window, &irtt);
7143         if (fields != 11) {
7144             continue;
7145         }
7146         dprintf(fd, "%s\t%08x\t%08x\t%04x\t%d\t%d\t%d\t%08x\t%d\t%u\t%u\n",
7147                 iface, tswap32(dest), tswap32(gw), flags, refcnt, use,
7148                 metric, tswap32(mask), mtu, window, irtt);
7149     }
7150 
7151     free(line);
7152     fclose(fp);
7153 
7154     return 0;
7155 }
7156 #endif
7157 
7158 #if defined(TARGET_SPARC)
7159 static int open_cpuinfo(void *cpu_env, int fd)
7160 {
7161     dprintf(fd, "type\t\t: sun4u\n");
7162     return 0;
7163 }
7164 #endif
7165 
7166 #if defined(TARGET_M68K)
7167 static int open_hardware(void *cpu_env, int fd)
7168 {
7169     dprintf(fd, "Model:\t\tqemu-m68k\n");
7170     return 0;
7171 }
7172 #endif
7173 
7174 static int do_openat(void *cpu_env, int dirfd, const char *pathname, int flags, mode_t mode)
7175 {
7176     struct fake_open {
7177         const char *filename;
7178         int (*fill)(void *cpu_env, int fd);
7179         int (*cmp)(const char *s1, const char *s2);
7180     };
7181     const struct fake_open *fake_open;
7182     static const struct fake_open fakes[] = {
7183         { "maps", open_self_maps, is_proc_myself },
7184         { "stat", open_self_stat, is_proc_myself },
7185         { "auxv", open_self_auxv, is_proc_myself },
7186         { "cmdline", open_self_cmdline, is_proc_myself },
7187 #if defined(HOST_WORDS_BIGENDIAN) != defined(TARGET_WORDS_BIGENDIAN)
7188         { "/proc/net/route", open_net_route, is_proc },
7189 #endif
7190 #if defined(TARGET_SPARC)
7191         { "/proc/cpuinfo", open_cpuinfo, is_proc },
7192 #endif
7193 #if defined(TARGET_M68K)
7194         { "/proc/hardware", open_hardware, is_proc },
7195 #endif
7196         { NULL, NULL, NULL }
7197     };
7198 
7199     if (is_proc_myself(pathname, "exe")) {
7200         int execfd = qemu_getauxval(AT_EXECFD);
7201         return execfd ? execfd : safe_openat(dirfd, exec_path, flags, mode);
7202     }
7203 
7204     for (fake_open = fakes; fake_open->filename; fake_open++) {
7205         if (fake_open->cmp(pathname, fake_open->filename)) {
7206             break;
7207         }
7208     }
7209 
7210     if (fake_open->filename) {
7211         const char *tmpdir;
7212         char filename[PATH_MAX];
7213         int fd, r;
7214 
7215         /* create temporary file to map stat to */
7216         tmpdir = getenv("TMPDIR");
7217         if (!tmpdir)
7218             tmpdir = "/tmp";
7219         snprintf(filename, sizeof(filename), "%s/qemu-open.XXXXXX", tmpdir);
7220         fd = mkstemp(filename);
7221         if (fd < 0) {
7222             return fd;
7223         }
7224         unlink(filename);
7225 
7226         if ((r = fake_open->fill(cpu_env, fd))) {
7227             int e = errno;
7228             close(fd);
7229             errno = e;
7230             return r;
7231         }
7232         lseek(fd, 0, SEEK_SET);
7233 
7234         return fd;
7235     }
7236 
7237     return safe_openat(dirfd, path(pathname), flags, mode);
7238 }
7239 
7240 #define TIMER_MAGIC 0x0caf0000
7241 #define TIMER_MAGIC_MASK 0xffff0000
7242 
7243 /* Convert QEMU provided timer ID back to internal 16bit index format */
7244 static target_timer_t get_timer_id(abi_long arg)
7245 {
7246     target_timer_t timerid = arg;
7247 
7248     if ((timerid & TIMER_MAGIC_MASK) != TIMER_MAGIC) {
7249         return -TARGET_EINVAL;
7250     }
7251 
7252     timerid &= 0xffff;
7253 
7254     if (timerid >= ARRAY_SIZE(g_posix_timers)) {
7255         return -TARGET_EINVAL;
7256     }
7257 
7258     return timerid;
7259 }
7260 
7261 static int target_to_host_cpu_mask(unsigned long *host_mask,
7262                                    size_t host_size,
7263                                    abi_ulong target_addr,
7264                                    size_t target_size)
7265 {
7266     unsigned target_bits = sizeof(abi_ulong) * 8;
7267     unsigned host_bits = sizeof(*host_mask) * 8;
7268     abi_ulong *target_mask;
7269     unsigned i, j;
7270 
7271     assert(host_size >= target_size);
7272 
7273     target_mask = lock_user(VERIFY_READ, target_addr, target_size, 1);
7274     if (!target_mask) {
7275         return -TARGET_EFAULT;
7276     }
7277     memset(host_mask, 0, host_size);
7278 
7279     for (i = 0 ; i < target_size / sizeof(abi_ulong); i++) {
7280         unsigned bit = i * target_bits;
7281         abi_ulong val;
7282 
7283         __get_user(val, &target_mask[i]);
7284         for (j = 0; j < target_bits; j++, bit++) {
7285             if (val & (1UL << j)) {
7286                 host_mask[bit / host_bits] |= 1UL << (bit % host_bits);
7287             }
7288         }
7289     }
7290 
7291     unlock_user(target_mask, target_addr, 0);
7292     return 0;
7293 }
7294 
7295 static int host_to_target_cpu_mask(const unsigned long *host_mask,
7296                                    size_t host_size,
7297                                    abi_ulong target_addr,
7298                                    size_t target_size)
7299 {
7300     unsigned target_bits = sizeof(abi_ulong) * 8;
7301     unsigned host_bits = sizeof(*host_mask) * 8;
7302     abi_ulong *target_mask;
7303     unsigned i, j;
7304 
7305     assert(host_size >= target_size);
7306 
7307     target_mask = lock_user(VERIFY_WRITE, target_addr, target_size, 0);
7308     if (!target_mask) {
7309         return -TARGET_EFAULT;
7310     }
7311 
7312     for (i = 0 ; i < target_size / sizeof(abi_ulong); i++) {
7313         unsigned bit = i * target_bits;
7314         abi_ulong val = 0;
7315 
7316         for (j = 0; j < target_bits; j++, bit++) {
7317             if (host_mask[bit / host_bits] & (1UL << (bit % host_bits))) {
7318                 val |= 1UL << j;
7319             }
7320         }
7321         __put_user(val, &target_mask[i]);
7322     }
7323 
7324     unlock_user(target_mask, target_addr, target_size);
7325     return 0;
7326 }
7327 
7328 /* This is an internal helper for do_syscall so that it is easier
7329  * to have a single return point, so that actions, such as logging
7330  * of syscall results, can be performed.
7331  * All errnos that do_syscall() returns must be -TARGET_<errcode>.
7332  */
7333 static abi_long do_syscall1(void *cpu_env, int num, abi_long arg1,
7334                             abi_long arg2, abi_long arg3, abi_long arg4,
7335                             abi_long arg5, abi_long arg6, abi_long arg7,
7336                             abi_long arg8)
7337 {
7338     CPUState *cpu = env_cpu(cpu_env);
7339     abi_long ret;
7340 #if defined(TARGET_NR_stat) || defined(TARGET_NR_stat64) \
7341     || defined(TARGET_NR_lstat) || defined(TARGET_NR_lstat64) \
7342     || defined(TARGET_NR_fstat) || defined(TARGET_NR_fstat64) \
7343     || defined(TARGET_NR_statx)
7344     struct stat st;
7345 #endif
7346 #if defined(TARGET_NR_statfs) || defined(TARGET_NR_statfs64) \
7347     || defined(TARGET_NR_fstatfs)
7348     struct statfs stfs;
7349 #endif
7350     void *p;
7351 
7352     switch(num) {
7353     case TARGET_NR_exit:
7354         /* In old applications this may be used to implement _exit(2).
7355            However in threaded applictions it is used for thread termination,
7356            and _exit_group is used for application termination.
7357            Do thread termination if we have more then one thread.  */
7358 
7359         if (block_signals()) {
7360             return -TARGET_ERESTARTSYS;
7361         }
7362 
7363         cpu_list_lock();
7364 
7365         if (CPU_NEXT(first_cpu)) {
7366             TaskState *ts;
7367 
7368             /* Remove the CPU from the list.  */
7369             QTAILQ_REMOVE_RCU(&cpus, cpu, node);
7370 
7371             cpu_list_unlock();
7372 
7373             ts = cpu->opaque;
7374             if (ts->child_tidptr) {
7375                 put_user_u32(0, ts->child_tidptr);
7376                 sys_futex(g2h(ts->child_tidptr), FUTEX_WAKE, INT_MAX,
7377                           NULL, NULL, 0);
7378             }
7379             thread_cpu = NULL;
7380             object_unref(OBJECT(cpu));
7381             g_free(ts);
7382             rcu_unregister_thread();
7383             pthread_exit(NULL);
7384         }
7385 
7386         cpu_list_unlock();
7387         preexit_cleanup(cpu_env, arg1);
7388         _exit(arg1);
7389         return 0; /* avoid warning */
7390     case TARGET_NR_read:
7391         if (arg2 == 0 && arg3 == 0) {
7392             return get_errno(safe_read(arg1, 0, 0));
7393         } else {
7394             if (!(p = lock_user(VERIFY_WRITE, arg2, arg3, 0)))
7395                 return -TARGET_EFAULT;
7396             ret = get_errno(safe_read(arg1, p, arg3));
7397             if (ret >= 0 &&
7398                 fd_trans_host_to_target_data(arg1)) {
7399                 ret = fd_trans_host_to_target_data(arg1)(p, ret);
7400             }
7401             unlock_user(p, arg2, ret);
7402         }
7403         return ret;
7404     case TARGET_NR_write:
7405         if (arg2 == 0 && arg3 == 0) {
7406             return get_errno(safe_write(arg1, 0, 0));
7407         }
7408         if (!(p = lock_user(VERIFY_READ, arg2, arg3, 1)))
7409             return -TARGET_EFAULT;
7410         if (fd_trans_target_to_host_data(arg1)) {
7411             void *copy = g_malloc(arg3);
7412             memcpy(copy, p, arg3);
7413             ret = fd_trans_target_to_host_data(arg1)(copy, arg3);
7414             if (ret >= 0) {
7415                 ret = get_errno(safe_write(arg1, copy, ret));
7416             }
7417             g_free(copy);
7418         } else {
7419             ret = get_errno(safe_write(arg1, p, arg3));
7420         }
7421         unlock_user(p, arg2, 0);
7422         return ret;
7423 
7424 #ifdef TARGET_NR_open
7425     case TARGET_NR_open:
7426         if (!(p = lock_user_string(arg1)))
7427             return -TARGET_EFAULT;
7428         ret = get_errno(do_openat(cpu_env, AT_FDCWD, p,
7429                                   target_to_host_bitmask(arg2, fcntl_flags_tbl),
7430                                   arg3));
7431         fd_trans_unregister(ret);
7432         unlock_user(p, arg1, 0);
7433         return ret;
7434 #endif
7435     case TARGET_NR_openat:
7436         if (!(p = lock_user_string(arg2)))
7437             return -TARGET_EFAULT;
7438         ret = get_errno(do_openat(cpu_env, arg1, p,
7439                                   target_to_host_bitmask(arg3, fcntl_flags_tbl),
7440                                   arg4));
7441         fd_trans_unregister(ret);
7442         unlock_user(p, arg2, 0);
7443         return ret;
7444 #if defined(TARGET_NR_name_to_handle_at) && defined(CONFIG_OPEN_BY_HANDLE)
7445     case TARGET_NR_name_to_handle_at:
7446         ret = do_name_to_handle_at(arg1, arg2, arg3, arg4, arg5);
7447         return ret;
7448 #endif
7449 #if defined(TARGET_NR_open_by_handle_at) && defined(CONFIG_OPEN_BY_HANDLE)
7450     case TARGET_NR_open_by_handle_at:
7451         ret = do_open_by_handle_at(arg1, arg2, arg3);
7452         fd_trans_unregister(ret);
7453         return ret;
7454 #endif
7455     case TARGET_NR_close:
7456         fd_trans_unregister(arg1);
7457         return get_errno(close(arg1));
7458 
7459     case TARGET_NR_brk:
7460         return do_brk(arg1);
7461 #ifdef TARGET_NR_fork
7462     case TARGET_NR_fork:
7463         return get_errno(do_fork(cpu_env, TARGET_SIGCHLD, 0, 0, 0, 0));
7464 #endif
7465 #ifdef TARGET_NR_waitpid
7466     case TARGET_NR_waitpid:
7467         {
7468             int status;
7469             ret = get_errno(safe_wait4(arg1, &status, arg3, 0));
7470             if (!is_error(ret) && arg2 && ret
7471                 && put_user_s32(host_to_target_waitstatus(status), arg2))
7472                 return -TARGET_EFAULT;
7473         }
7474         return ret;
7475 #endif
7476 #ifdef TARGET_NR_waitid
7477     case TARGET_NR_waitid:
7478         {
7479             siginfo_t info;
7480             info.si_pid = 0;
7481             ret = get_errno(safe_waitid(arg1, arg2, &info, arg4, NULL));
7482             if (!is_error(ret) && arg3 && info.si_pid != 0) {
7483                 if (!(p = lock_user(VERIFY_WRITE, arg3, sizeof(target_siginfo_t), 0)))
7484                     return -TARGET_EFAULT;
7485                 host_to_target_siginfo(p, &info);
7486                 unlock_user(p, arg3, sizeof(target_siginfo_t));
7487             }
7488         }
7489         return ret;
7490 #endif
7491 #ifdef TARGET_NR_creat /* not on alpha */
7492     case TARGET_NR_creat:
7493         if (!(p = lock_user_string(arg1)))
7494             return -TARGET_EFAULT;
7495         ret = get_errno(creat(p, arg2));
7496         fd_trans_unregister(ret);
7497         unlock_user(p, arg1, 0);
7498         return ret;
7499 #endif
7500 #ifdef TARGET_NR_link
7501     case TARGET_NR_link:
7502         {
7503             void * p2;
7504             p = lock_user_string(arg1);
7505             p2 = lock_user_string(arg2);
7506             if (!p || !p2)
7507                 ret = -TARGET_EFAULT;
7508             else
7509                 ret = get_errno(link(p, p2));
7510             unlock_user(p2, arg2, 0);
7511             unlock_user(p, arg1, 0);
7512         }
7513         return ret;
7514 #endif
7515 #if defined(TARGET_NR_linkat)
7516     case TARGET_NR_linkat:
7517         {
7518             void * p2 = NULL;
7519             if (!arg2 || !arg4)
7520                 return -TARGET_EFAULT;
7521             p  = lock_user_string(arg2);
7522             p2 = lock_user_string(arg4);
7523             if (!p || !p2)
7524                 ret = -TARGET_EFAULT;
7525             else
7526                 ret = get_errno(linkat(arg1, p, arg3, p2, arg5));
7527             unlock_user(p, arg2, 0);
7528             unlock_user(p2, arg4, 0);
7529         }
7530         return ret;
7531 #endif
7532 #ifdef TARGET_NR_unlink
7533     case TARGET_NR_unlink:
7534         if (!(p = lock_user_string(arg1)))
7535             return -TARGET_EFAULT;
7536         ret = get_errno(unlink(p));
7537         unlock_user(p, arg1, 0);
7538         return ret;
7539 #endif
7540 #if defined(TARGET_NR_unlinkat)
7541     case TARGET_NR_unlinkat:
7542         if (!(p = lock_user_string(arg2)))
7543             return -TARGET_EFAULT;
7544         ret = get_errno(unlinkat(arg1, p, arg3));
7545         unlock_user(p, arg2, 0);
7546         return ret;
7547 #endif
7548     case TARGET_NR_execve:
7549         {
7550             char **argp, **envp;
7551             int argc, envc;
7552             abi_ulong gp;
7553             abi_ulong guest_argp;
7554             abi_ulong guest_envp;
7555             abi_ulong addr;
7556             char **q;
7557             int total_size = 0;
7558 
7559             argc = 0;
7560             guest_argp = arg2;
7561             for (gp = guest_argp; gp; gp += sizeof(abi_ulong)) {
7562                 if (get_user_ual(addr, gp))
7563                     return -TARGET_EFAULT;
7564                 if (!addr)
7565                     break;
7566                 argc++;
7567             }
7568             envc = 0;
7569             guest_envp = arg3;
7570             for (gp = guest_envp; gp; gp += sizeof(abi_ulong)) {
7571                 if (get_user_ual(addr, gp))
7572                     return -TARGET_EFAULT;
7573                 if (!addr)
7574                     break;
7575                 envc++;
7576             }
7577 
7578             argp = g_new0(char *, argc + 1);
7579             envp = g_new0(char *, envc + 1);
7580 
7581             for (gp = guest_argp, q = argp; gp;
7582                   gp += sizeof(abi_ulong), q++) {
7583                 if (get_user_ual(addr, gp))
7584                     goto execve_efault;
7585                 if (!addr)
7586                     break;
7587                 if (!(*q = lock_user_string(addr)))
7588                     goto execve_efault;
7589                 total_size += strlen(*q) + 1;
7590             }
7591             *q = NULL;
7592 
7593             for (gp = guest_envp, q = envp; gp;
7594                   gp += sizeof(abi_ulong), q++) {
7595                 if (get_user_ual(addr, gp))
7596                     goto execve_efault;
7597                 if (!addr)
7598                     break;
7599                 if (!(*q = lock_user_string(addr)))
7600                     goto execve_efault;
7601                 total_size += strlen(*q) + 1;
7602             }
7603             *q = NULL;
7604 
7605             if (!(p = lock_user_string(arg1)))
7606                 goto execve_efault;
7607             /* Although execve() is not an interruptible syscall it is
7608              * a special case where we must use the safe_syscall wrapper:
7609              * if we allow a signal to happen before we make the host
7610              * syscall then we will 'lose' it, because at the point of
7611              * execve the process leaves QEMU's control. So we use the
7612              * safe syscall wrapper to ensure that we either take the
7613              * signal as a guest signal, or else it does not happen
7614              * before the execve completes and makes it the other
7615              * program's problem.
7616              */
7617             ret = get_errno(safe_execve(p, argp, envp));
7618             unlock_user(p, arg1, 0);
7619 
7620             goto execve_end;
7621 
7622         execve_efault:
7623             ret = -TARGET_EFAULT;
7624 
7625         execve_end:
7626             for (gp = guest_argp, q = argp; *q;
7627                   gp += sizeof(abi_ulong), q++) {
7628                 if (get_user_ual(addr, gp)
7629                     || !addr)
7630                     break;
7631                 unlock_user(*q, addr, 0);
7632             }
7633             for (gp = guest_envp, q = envp; *q;
7634                   gp += sizeof(abi_ulong), q++) {
7635                 if (get_user_ual(addr, gp)
7636                     || !addr)
7637                     break;
7638                 unlock_user(*q, addr, 0);
7639             }
7640 
7641             g_free(argp);
7642             g_free(envp);
7643         }
7644         return ret;
7645     case TARGET_NR_chdir:
7646         if (!(p = lock_user_string(arg1)))
7647             return -TARGET_EFAULT;
7648         ret = get_errno(chdir(p));
7649         unlock_user(p, arg1, 0);
7650         return ret;
7651 #ifdef TARGET_NR_time
7652     case TARGET_NR_time:
7653         {
7654             time_t host_time;
7655             ret = get_errno(time(&host_time));
7656             if (!is_error(ret)
7657                 && arg1
7658                 && put_user_sal(host_time, arg1))
7659                 return -TARGET_EFAULT;
7660         }
7661         return ret;
7662 #endif
7663 #ifdef TARGET_NR_mknod
7664     case TARGET_NR_mknod:
7665         if (!(p = lock_user_string(arg1)))
7666             return -TARGET_EFAULT;
7667         ret = get_errno(mknod(p, arg2, arg3));
7668         unlock_user(p, arg1, 0);
7669         return ret;
7670 #endif
7671 #if defined(TARGET_NR_mknodat)
7672     case TARGET_NR_mknodat:
7673         if (!(p = lock_user_string(arg2)))
7674             return -TARGET_EFAULT;
7675         ret = get_errno(mknodat(arg1, p, arg3, arg4));
7676         unlock_user(p, arg2, 0);
7677         return ret;
7678 #endif
7679 #ifdef TARGET_NR_chmod
7680     case TARGET_NR_chmod:
7681         if (!(p = lock_user_string(arg1)))
7682             return -TARGET_EFAULT;
7683         ret = get_errno(chmod(p, arg2));
7684         unlock_user(p, arg1, 0);
7685         return ret;
7686 #endif
7687 #ifdef TARGET_NR_lseek
7688     case TARGET_NR_lseek:
7689         return get_errno(lseek(arg1, arg2, arg3));
7690 #endif
7691 #if defined(TARGET_NR_getxpid) && defined(TARGET_ALPHA)
7692     /* Alpha specific */
7693     case TARGET_NR_getxpid:
7694         ((CPUAlphaState *)cpu_env)->ir[IR_A4] = getppid();
7695         return get_errno(getpid());
7696 #endif
7697 #ifdef TARGET_NR_getpid
7698     case TARGET_NR_getpid:
7699         return get_errno(getpid());
7700 #endif
7701     case TARGET_NR_mount:
7702         {
7703             /* need to look at the data field */
7704             void *p2, *p3;
7705 
7706             if (arg1) {
7707                 p = lock_user_string(arg1);
7708                 if (!p) {
7709                     return -TARGET_EFAULT;
7710                 }
7711             } else {
7712                 p = NULL;
7713             }
7714 
7715             p2 = lock_user_string(arg2);
7716             if (!p2) {
7717                 if (arg1) {
7718                     unlock_user(p, arg1, 0);
7719                 }
7720                 return -TARGET_EFAULT;
7721             }
7722 
7723             if (arg3) {
7724                 p3 = lock_user_string(arg3);
7725                 if (!p3) {
7726                     if (arg1) {
7727                         unlock_user(p, arg1, 0);
7728                     }
7729                     unlock_user(p2, arg2, 0);
7730                     return -TARGET_EFAULT;
7731                 }
7732             } else {
7733                 p3 = NULL;
7734             }
7735 
7736             /* FIXME - arg5 should be locked, but it isn't clear how to
7737              * do that since it's not guaranteed to be a NULL-terminated
7738              * string.
7739              */
7740             if (!arg5) {
7741                 ret = mount(p, p2, p3, (unsigned long)arg4, NULL);
7742             } else {
7743                 ret = mount(p, p2, p3, (unsigned long)arg4, g2h(arg5));
7744             }
7745             ret = get_errno(ret);
7746 
7747             if (arg1) {
7748                 unlock_user(p, arg1, 0);
7749             }
7750             unlock_user(p2, arg2, 0);
7751             if (arg3) {
7752                 unlock_user(p3, arg3, 0);
7753             }
7754         }
7755         return ret;
7756 #ifdef TARGET_NR_umount
7757     case TARGET_NR_umount:
7758         if (!(p = lock_user_string(arg1)))
7759             return -TARGET_EFAULT;
7760         ret = get_errno(umount(p));
7761         unlock_user(p, arg1, 0);
7762         return ret;
7763 #endif
7764 #ifdef TARGET_NR_stime /* not on alpha */
7765     case TARGET_NR_stime:
7766         {
7767             time_t host_time;
7768             if (get_user_sal(host_time, arg1))
7769                 return -TARGET_EFAULT;
7770             return get_errno(stime(&host_time));
7771         }
7772 #endif
7773 #ifdef TARGET_NR_alarm /* not on alpha */
7774     case TARGET_NR_alarm:
7775         return alarm(arg1);
7776 #endif
7777 #ifdef TARGET_NR_pause /* not on alpha */
7778     case TARGET_NR_pause:
7779         if (!block_signals()) {
7780             sigsuspend(&((TaskState *)cpu->opaque)->signal_mask);
7781         }
7782         return -TARGET_EINTR;
7783 #endif
7784 #ifdef TARGET_NR_utime
7785     case TARGET_NR_utime:
7786         {
7787             struct utimbuf tbuf, *host_tbuf;
7788             struct target_utimbuf *target_tbuf;
7789             if (arg2) {
7790                 if (!lock_user_struct(VERIFY_READ, target_tbuf, arg2, 1))
7791                     return -TARGET_EFAULT;
7792                 tbuf.actime = tswapal(target_tbuf->actime);
7793                 tbuf.modtime = tswapal(target_tbuf->modtime);
7794                 unlock_user_struct(target_tbuf, arg2, 0);
7795                 host_tbuf = &tbuf;
7796             } else {
7797                 host_tbuf = NULL;
7798             }
7799             if (!(p = lock_user_string(arg1)))
7800                 return -TARGET_EFAULT;
7801             ret = get_errno(utime(p, host_tbuf));
7802             unlock_user(p, arg1, 0);
7803         }
7804         return ret;
7805 #endif
7806 #ifdef TARGET_NR_utimes
7807     case TARGET_NR_utimes:
7808         {
7809             struct timeval *tvp, tv[2];
7810             if (arg2) {
7811                 if (copy_from_user_timeval(&tv[0], arg2)
7812                     || copy_from_user_timeval(&tv[1],
7813                                               arg2 + sizeof(struct target_timeval)))
7814                     return -TARGET_EFAULT;
7815                 tvp = tv;
7816             } else {
7817                 tvp = NULL;
7818             }
7819             if (!(p = lock_user_string(arg1)))
7820                 return -TARGET_EFAULT;
7821             ret = get_errno(utimes(p, tvp));
7822             unlock_user(p, arg1, 0);
7823         }
7824         return ret;
7825 #endif
7826 #if defined(TARGET_NR_futimesat)
7827     case TARGET_NR_futimesat:
7828         {
7829             struct timeval *tvp, tv[2];
7830             if (arg3) {
7831                 if (copy_from_user_timeval(&tv[0], arg3)
7832                     || copy_from_user_timeval(&tv[1],
7833                                               arg3 + sizeof(struct target_timeval)))
7834                     return -TARGET_EFAULT;
7835                 tvp = tv;
7836             } else {
7837                 tvp = NULL;
7838             }
7839             if (!(p = lock_user_string(arg2))) {
7840                 return -TARGET_EFAULT;
7841             }
7842             ret = get_errno(futimesat(arg1, path(p), tvp));
7843             unlock_user(p, arg2, 0);
7844         }
7845         return ret;
7846 #endif
7847 #ifdef TARGET_NR_access
7848     case TARGET_NR_access:
7849         if (!(p = lock_user_string(arg1))) {
7850             return -TARGET_EFAULT;
7851         }
7852         ret = get_errno(access(path(p), arg2));
7853         unlock_user(p, arg1, 0);
7854         return ret;
7855 #endif
7856 #if defined(TARGET_NR_faccessat) && defined(__NR_faccessat)
7857     case TARGET_NR_faccessat:
7858         if (!(p = lock_user_string(arg2))) {
7859             return -TARGET_EFAULT;
7860         }
7861         ret = get_errno(faccessat(arg1, p, arg3, 0));
7862         unlock_user(p, arg2, 0);
7863         return ret;
7864 #endif
7865 #ifdef TARGET_NR_nice /* not on alpha */
7866     case TARGET_NR_nice:
7867         return get_errno(nice(arg1));
7868 #endif
7869     case TARGET_NR_sync:
7870         sync();
7871         return 0;
7872 #if defined(TARGET_NR_syncfs) && defined(CONFIG_SYNCFS)
7873     case TARGET_NR_syncfs:
7874         return get_errno(syncfs(arg1));
7875 #endif
7876     case TARGET_NR_kill:
7877         return get_errno(safe_kill(arg1, target_to_host_signal(arg2)));
7878 #ifdef TARGET_NR_rename
7879     case TARGET_NR_rename:
7880         {
7881             void *p2;
7882             p = lock_user_string(arg1);
7883             p2 = lock_user_string(arg2);
7884             if (!p || !p2)
7885                 ret = -TARGET_EFAULT;
7886             else
7887                 ret = get_errno(rename(p, p2));
7888             unlock_user(p2, arg2, 0);
7889             unlock_user(p, arg1, 0);
7890         }
7891         return ret;
7892 #endif
7893 #if defined(TARGET_NR_renameat)
7894     case TARGET_NR_renameat:
7895         {
7896             void *p2;
7897             p  = lock_user_string(arg2);
7898             p2 = lock_user_string(arg4);
7899             if (!p || !p2)
7900                 ret = -TARGET_EFAULT;
7901             else
7902                 ret = get_errno(renameat(arg1, p, arg3, p2));
7903             unlock_user(p2, arg4, 0);
7904             unlock_user(p, arg2, 0);
7905         }
7906         return ret;
7907 #endif
7908 #if defined(TARGET_NR_renameat2)
7909     case TARGET_NR_renameat2:
7910         {
7911             void *p2;
7912             p  = lock_user_string(arg2);
7913             p2 = lock_user_string(arg4);
7914             if (!p || !p2) {
7915                 ret = -TARGET_EFAULT;
7916             } else {
7917                 ret = get_errno(sys_renameat2(arg1, p, arg3, p2, arg5));
7918             }
7919             unlock_user(p2, arg4, 0);
7920             unlock_user(p, arg2, 0);
7921         }
7922         return ret;
7923 #endif
7924 #ifdef TARGET_NR_mkdir
7925     case TARGET_NR_mkdir:
7926         if (!(p = lock_user_string(arg1)))
7927             return -TARGET_EFAULT;
7928         ret = get_errno(mkdir(p, arg2));
7929         unlock_user(p, arg1, 0);
7930         return ret;
7931 #endif
7932 #if defined(TARGET_NR_mkdirat)
7933     case TARGET_NR_mkdirat:
7934         if (!(p = lock_user_string(arg2)))
7935             return -TARGET_EFAULT;
7936         ret = get_errno(mkdirat(arg1, p, arg3));
7937         unlock_user(p, arg2, 0);
7938         return ret;
7939 #endif
7940 #ifdef TARGET_NR_rmdir
7941     case TARGET_NR_rmdir:
7942         if (!(p = lock_user_string(arg1)))
7943             return -TARGET_EFAULT;
7944         ret = get_errno(rmdir(p));
7945         unlock_user(p, arg1, 0);
7946         return ret;
7947 #endif
7948     case TARGET_NR_dup:
7949         ret = get_errno(dup(arg1));
7950         if (ret >= 0) {
7951             fd_trans_dup(arg1, ret);
7952         }
7953         return ret;
7954 #ifdef TARGET_NR_pipe
7955     case TARGET_NR_pipe:
7956         return do_pipe(cpu_env, arg1, 0, 0);
7957 #endif
7958 #ifdef TARGET_NR_pipe2
7959     case TARGET_NR_pipe2:
7960         return do_pipe(cpu_env, arg1,
7961                        target_to_host_bitmask(arg2, fcntl_flags_tbl), 1);
7962 #endif
7963     case TARGET_NR_times:
7964         {
7965             struct target_tms *tmsp;
7966             struct tms tms;
7967             ret = get_errno(times(&tms));
7968             if (arg1) {
7969                 tmsp = lock_user(VERIFY_WRITE, arg1, sizeof(struct target_tms), 0);
7970                 if (!tmsp)
7971                     return -TARGET_EFAULT;
7972                 tmsp->tms_utime = tswapal(host_to_target_clock_t(tms.tms_utime));
7973                 tmsp->tms_stime = tswapal(host_to_target_clock_t(tms.tms_stime));
7974                 tmsp->tms_cutime = tswapal(host_to_target_clock_t(tms.tms_cutime));
7975                 tmsp->tms_cstime = tswapal(host_to_target_clock_t(tms.tms_cstime));
7976             }
7977             if (!is_error(ret))
7978                 ret = host_to_target_clock_t(ret);
7979         }
7980         return ret;
7981     case TARGET_NR_acct:
7982         if (arg1 == 0) {
7983             ret = get_errno(acct(NULL));
7984         } else {
7985             if (!(p = lock_user_string(arg1))) {
7986                 return -TARGET_EFAULT;
7987             }
7988             ret = get_errno(acct(path(p)));
7989             unlock_user(p, arg1, 0);
7990         }
7991         return ret;
7992 #ifdef TARGET_NR_umount2
7993     case TARGET_NR_umount2:
7994         if (!(p = lock_user_string(arg1)))
7995             return -TARGET_EFAULT;
7996         ret = get_errno(umount2(p, arg2));
7997         unlock_user(p, arg1, 0);
7998         return ret;
7999 #endif
8000     case TARGET_NR_ioctl:
8001         return do_ioctl(arg1, arg2, arg3);
8002 #ifdef TARGET_NR_fcntl
8003     case TARGET_NR_fcntl:
8004         return do_fcntl(arg1, arg2, arg3);
8005 #endif
8006     case TARGET_NR_setpgid:
8007         return get_errno(setpgid(arg1, arg2));
8008     case TARGET_NR_umask:
8009         return get_errno(umask(arg1));
8010     case TARGET_NR_chroot:
8011         if (!(p = lock_user_string(arg1)))
8012             return -TARGET_EFAULT;
8013         ret = get_errno(chroot(p));
8014         unlock_user(p, arg1, 0);
8015         return ret;
8016 #ifdef TARGET_NR_dup2
8017     case TARGET_NR_dup2:
8018         ret = get_errno(dup2(arg1, arg2));
8019         if (ret >= 0) {
8020             fd_trans_dup(arg1, arg2);
8021         }
8022         return ret;
8023 #endif
8024 #if defined(CONFIG_DUP3) && defined(TARGET_NR_dup3)
8025     case TARGET_NR_dup3:
8026     {
8027         int host_flags;
8028 
8029         if ((arg3 & ~TARGET_O_CLOEXEC) != 0) {
8030             return -EINVAL;
8031         }
8032         host_flags = target_to_host_bitmask(arg3, fcntl_flags_tbl);
8033         ret = get_errno(dup3(arg1, arg2, host_flags));
8034         if (ret >= 0) {
8035             fd_trans_dup(arg1, arg2);
8036         }
8037         return ret;
8038     }
8039 #endif
8040 #ifdef TARGET_NR_getppid /* not on alpha */
8041     case TARGET_NR_getppid:
8042         return get_errno(getppid());
8043 #endif
8044 #ifdef TARGET_NR_getpgrp
8045     case TARGET_NR_getpgrp:
8046         return get_errno(getpgrp());
8047 #endif
8048     case TARGET_NR_setsid:
8049         return get_errno(setsid());
8050 #ifdef TARGET_NR_sigaction
8051     case TARGET_NR_sigaction:
8052         {
8053 #if defined(TARGET_ALPHA)
8054             struct target_sigaction act, oact, *pact = 0;
8055             struct target_old_sigaction *old_act;
8056             if (arg2) {
8057                 if (!lock_user_struct(VERIFY_READ, old_act, arg2, 1))
8058                     return -TARGET_EFAULT;
8059                 act._sa_handler = old_act->_sa_handler;
8060                 target_siginitset(&act.sa_mask, old_act->sa_mask);
8061                 act.sa_flags = old_act->sa_flags;
8062                 act.sa_restorer = 0;
8063                 unlock_user_struct(old_act, arg2, 0);
8064                 pact = &act;
8065             }
8066             ret = get_errno(do_sigaction(arg1, pact, &oact));
8067             if (!is_error(ret) && arg3) {
8068                 if (!lock_user_struct(VERIFY_WRITE, old_act, arg3, 0))
8069                     return -TARGET_EFAULT;
8070                 old_act->_sa_handler = oact._sa_handler;
8071                 old_act->sa_mask = oact.sa_mask.sig[0];
8072                 old_act->sa_flags = oact.sa_flags;
8073                 unlock_user_struct(old_act, arg3, 1);
8074             }
8075 #elif defined(TARGET_MIPS)
8076 	    struct target_sigaction act, oact, *pact, *old_act;
8077 
8078 	    if (arg2) {
8079                 if (!lock_user_struct(VERIFY_READ, old_act, arg2, 1))
8080                     return -TARGET_EFAULT;
8081 		act._sa_handler = old_act->_sa_handler;
8082 		target_siginitset(&act.sa_mask, old_act->sa_mask.sig[0]);
8083 		act.sa_flags = old_act->sa_flags;
8084 		unlock_user_struct(old_act, arg2, 0);
8085 		pact = &act;
8086 	    } else {
8087 		pact = NULL;
8088 	    }
8089 
8090 	    ret = get_errno(do_sigaction(arg1, pact, &oact));
8091 
8092 	    if (!is_error(ret) && arg3) {
8093                 if (!lock_user_struct(VERIFY_WRITE, old_act, arg3, 0))
8094                     return -TARGET_EFAULT;
8095 		old_act->_sa_handler = oact._sa_handler;
8096 		old_act->sa_flags = oact.sa_flags;
8097 		old_act->sa_mask.sig[0] = oact.sa_mask.sig[0];
8098 		old_act->sa_mask.sig[1] = 0;
8099 		old_act->sa_mask.sig[2] = 0;
8100 		old_act->sa_mask.sig[3] = 0;
8101 		unlock_user_struct(old_act, arg3, 1);
8102 	    }
8103 #else
8104             struct target_old_sigaction *old_act;
8105             struct target_sigaction act, oact, *pact;
8106             if (arg2) {
8107                 if (!lock_user_struct(VERIFY_READ, old_act, arg2, 1))
8108                     return -TARGET_EFAULT;
8109                 act._sa_handler = old_act->_sa_handler;
8110                 target_siginitset(&act.sa_mask, old_act->sa_mask);
8111                 act.sa_flags = old_act->sa_flags;
8112                 act.sa_restorer = old_act->sa_restorer;
8113 #ifdef TARGET_ARCH_HAS_KA_RESTORER
8114                 act.ka_restorer = 0;
8115 #endif
8116                 unlock_user_struct(old_act, arg2, 0);
8117                 pact = &act;
8118             } else {
8119                 pact = NULL;
8120             }
8121             ret = get_errno(do_sigaction(arg1, pact, &oact));
8122             if (!is_error(ret) && arg3) {
8123                 if (!lock_user_struct(VERIFY_WRITE, old_act, arg3, 0))
8124                     return -TARGET_EFAULT;
8125                 old_act->_sa_handler = oact._sa_handler;
8126                 old_act->sa_mask = oact.sa_mask.sig[0];
8127                 old_act->sa_flags = oact.sa_flags;
8128                 old_act->sa_restorer = oact.sa_restorer;
8129                 unlock_user_struct(old_act, arg3, 1);
8130             }
8131 #endif
8132         }
8133         return ret;
8134 #endif
8135     case TARGET_NR_rt_sigaction:
8136         {
8137 #if defined(TARGET_ALPHA)
8138             /* For Alpha and SPARC this is a 5 argument syscall, with
8139              * a 'restorer' parameter which must be copied into the
8140              * sa_restorer field of the sigaction struct.
8141              * For Alpha that 'restorer' is arg5; for SPARC it is arg4,
8142              * and arg5 is the sigsetsize.
8143              * Alpha also has a separate rt_sigaction struct that it uses
8144              * here; SPARC uses the usual sigaction struct.
8145              */
8146             struct target_rt_sigaction *rt_act;
8147             struct target_sigaction act, oact, *pact = 0;
8148 
8149             if (arg4 != sizeof(target_sigset_t)) {
8150                 return -TARGET_EINVAL;
8151             }
8152             if (arg2) {
8153                 if (!lock_user_struct(VERIFY_READ, rt_act, arg2, 1))
8154                     return -TARGET_EFAULT;
8155                 act._sa_handler = rt_act->_sa_handler;
8156                 act.sa_mask = rt_act->sa_mask;
8157                 act.sa_flags = rt_act->sa_flags;
8158                 act.sa_restorer = arg5;
8159                 unlock_user_struct(rt_act, arg2, 0);
8160                 pact = &act;
8161             }
8162             ret = get_errno(do_sigaction(arg1, pact, &oact));
8163             if (!is_error(ret) && arg3) {
8164                 if (!lock_user_struct(VERIFY_WRITE, rt_act, arg3, 0))
8165                     return -TARGET_EFAULT;
8166                 rt_act->_sa_handler = oact._sa_handler;
8167                 rt_act->sa_mask = oact.sa_mask;
8168                 rt_act->sa_flags = oact.sa_flags;
8169                 unlock_user_struct(rt_act, arg3, 1);
8170             }
8171 #else
8172 #ifdef TARGET_SPARC
8173             target_ulong restorer = arg4;
8174             target_ulong sigsetsize = arg5;
8175 #else
8176             target_ulong sigsetsize = arg4;
8177 #endif
8178             struct target_sigaction *act;
8179             struct target_sigaction *oact;
8180 
8181             if (sigsetsize != sizeof(target_sigset_t)) {
8182                 return -TARGET_EINVAL;
8183             }
8184             if (arg2) {
8185                 if (!lock_user_struct(VERIFY_READ, act, arg2, 1)) {
8186                     return -TARGET_EFAULT;
8187                 }
8188 #ifdef TARGET_ARCH_HAS_KA_RESTORER
8189                 act->ka_restorer = restorer;
8190 #endif
8191             } else {
8192                 act = NULL;
8193             }
8194             if (arg3) {
8195                 if (!lock_user_struct(VERIFY_WRITE, oact, arg3, 0)) {
8196                     ret = -TARGET_EFAULT;
8197                     goto rt_sigaction_fail;
8198                 }
8199             } else
8200                 oact = NULL;
8201             ret = get_errno(do_sigaction(arg1, act, oact));
8202 	rt_sigaction_fail:
8203             if (act)
8204                 unlock_user_struct(act, arg2, 0);
8205             if (oact)
8206                 unlock_user_struct(oact, arg3, 1);
8207 #endif
8208         }
8209         return ret;
8210 #ifdef TARGET_NR_sgetmask /* not on alpha */
8211     case TARGET_NR_sgetmask:
8212         {
8213             sigset_t cur_set;
8214             abi_ulong target_set;
8215             ret = do_sigprocmask(0, NULL, &cur_set);
8216             if (!ret) {
8217                 host_to_target_old_sigset(&target_set, &cur_set);
8218                 ret = target_set;
8219             }
8220         }
8221         return ret;
8222 #endif
8223 #ifdef TARGET_NR_ssetmask /* not on alpha */
8224     case TARGET_NR_ssetmask:
8225         {
8226             sigset_t set, oset;
8227             abi_ulong target_set = arg1;
8228             target_to_host_old_sigset(&set, &target_set);
8229             ret = do_sigprocmask(SIG_SETMASK, &set, &oset);
8230             if (!ret) {
8231                 host_to_target_old_sigset(&target_set, &oset);
8232                 ret = target_set;
8233             }
8234         }
8235         return ret;
8236 #endif
8237 #ifdef TARGET_NR_sigprocmask
8238     case TARGET_NR_sigprocmask:
8239         {
8240 #if defined(TARGET_ALPHA)
8241             sigset_t set, oldset;
8242             abi_ulong mask;
8243             int how;
8244 
8245             switch (arg1) {
8246             case TARGET_SIG_BLOCK:
8247                 how = SIG_BLOCK;
8248                 break;
8249             case TARGET_SIG_UNBLOCK:
8250                 how = SIG_UNBLOCK;
8251                 break;
8252             case TARGET_SIG_SETMASK:
8253                 how = SIG_SETMASK;
8254                 break;
8255             default:
8256                 return -TARGET_EINVAL;
8257             }
8258             mask = arg2;
8259             target_to_host_old_sigset(&set, &mask);
8260 
8261             ret = do_sigprocmask(how, &set, &oldset);
8262             if (!is_error(ret)) {
8263                 host_to_target_old_sigset(&mask, &oldset);
8264                 ret = mask;
8265                 ((CPUAlphaState *)cpu_env)->ir[IR_V0] = 0; /* force no error */
8266             }
8267 #else
8268             sigset_t set, oldset, *set_ptr;
8269             int how;
8270 
8271             if (arg2) {
8272                 switch (arg1) {
8273                 case TARGET_SIG_BLOCK:
8274                     how = SIG_BLOCK;
8275                     break;
8276                 case TARGET_SIG_UNBLOCK:
8277                     how = SIG_UNBLOCK;
8278                     break;
8279                 case TARGET_SIG_SETMASK:
8280                     how = SIG_SETMASK;
8281                     break;
8282                 default:
8283                     return -TARGET_EINVAL;
8284                 }
8285                 if (!(p = lock_user(VERIFY_READ, arg2, sizeof(target_sigset_t), 1)))
8286                     return -TARGET_EFAULT;
8287                 target_to_host_old_sigset(&set, p);
8288                 unlock_user(p, arg2, 0);
8289                 set_ptr = &set;
8290             } else {
8291                 how = 0;
8292                 set_ptr = NULL;
8293             }
8294             ret = do_sigprocmask(how, set_ptr, &oldset);
8295             if (!is_error(ret) && arg3) {
8296                 if (!(p = lock_user(VERIFY_WRITE, arg3, sizeof(target_sigset_t), 0)))
8297                     return -TARGET_EFAULT;
8298                 host_to_target_old_sigset(p, &oldset);
8299                 unlock_user(p, arg3, sizeof(target_sigset_t));
8300             }
8301 #endif
8302         }
8303         return ret;
8304 #endif
8305     case TARGET_NR_rt_sigprocmask:
8306         {
8307             int how = arg1;
8308             sigset_t set, oldset, *set_ptr;
8309 
8310             if (arg4 != sizeof(target_sigset_t)) {
8311                 return -TARGET_EINVAL;
8312             }
8313 
8314             if (arg2) {
8315                 switch(how) {
8316                 case TARGET_SIG_BLOCK:
8317                     how = SIG_BLOCK;
8318                     break;
8319                 case TARGET_SIG_UNBLOCK:
8320                     how = SIG_UNBLOCK;
8321                     break;
8322                 case TARGET_SIG_SETMASK:
8323                     how = SIG_SETMASK;
8324                     break;
8325                 default:
8326                     return -TARGET_EINVAL;
8327                 }
8328                 if (!(p = lock_user(VERIFY_READ, arg2, sizeof(target_sigset_t), 1)))
8329                     return -TARGET_EFAULT;
8330                 target_to_host_sigset(&set, p);
8331                 unlock_user(p, arg2, 0);
8332                 set_ptr = &set;
8333             } else {
8334                 how = 0;
8335                 set_ptr = NULL;
8336             }
8337             ret = do_sigprocmask(how, set_ptr, &oldset);
8338             if (!is_error(ret) && arg3) {
8339                 if (!(p = lock_user(VERIFY_WRITE, arg3, sizeof(target_sigset_t), 0)))
8340                     return -TARGET_EFAULT;
8341                 host_to_target_sigset(p, &oldset);
8342                 unlock_user(p, arg3, sizeof(target_sigset_t));
8343             }
8344         }
8345         return ret;
8346 #ifdef TARGET_NR_sigpending
8347     case TARGET_NR_sigpending:
8348         {
8349             sigset_t set;
8350             ret = get_errno(sigpending(&set));
8351             if (!is_error(ret)) {
8352                 if (!(p = lock_user(VERIFY_WRITE, arg1, sizeof(target_sigset_t), 0)))
8353                     return -TARGET_EFAULT;
8354                 host_to_target_old_sigset(p, &set);
8355                 unlock_user(p, arg1, sizeof(target_sigset_t));
8356             }
8357         }
8358         return ret;
8359 #endif
8360     case TARGET_NR_rt_sigpending:
8361         {
8362             sigset_t set;
8363 
8364             /* Yes, this check is >, not != like most. We follow the kernel's
8365              * logic and it does it like this because it implements
8366              * NR_sigpending through the same code path, and in that case
8367              * the old_sigset_t is smaller in size.
8368              */
8369             if (arg2 > sizeof(target_sigset_t)) {
8370                 return -TARGET_EINVAL;
8371             }
8372 
8373             ret = get_errno(sigpending(&set));
8374             if (!is_error(ret)) {
8375                 if (!(p = lock_user(VERIFY_WRITE, arg1, sizeof(target_sigset_t), 0)))
8376                     return -TARGET_EFAULT;
8377                 host_to_target_sigset(p, &set);
8378                 unlock_user(p, arg1, sizeof(target_sigset_t));
8379             }
8380         }
8381         return ret;
8382 #ifdef TARGET_NR_sigsuspend
8383     case TARGET_NR_sigsuspend:
8384         {
8385             TaskState *ts = cpu->opaque;
8386 #if defined(TARGET_ALPHA)
8387             abi_ulong mask = arg1;
8388             target_to_host_old_sigset(&ts->sigsuspend_mask, &mask);
8389 #else
8390             if (!(p = lock_user(VERIFY_READ, arg1, sizeof(target_sigset_t), 1)))
8391                 return -TARGET_EFAULT;
8392             target_to_host_old_sigset(&ts->sigsuspend_mask, p);
8393             unlock_user(p, arg1, 0);
8394 #endif
8395             ret = get_errno(safe_rt_sigsuspend(&ts->sigsuspend_mask,
8396                                                SIGSET_T_SIZE));
8397             if (ret != -TARGET_ERESTARTSYS) {
8398                 ts->in_sigsuspend = 1;
8399             }
8400         }
8401         return ret;
8402 #endif
8403     case TARGET_NR_rt_sigsuspend:
8404         {
8405             TaskState *ts = cpu->opaque;
8406 
8407             if (arg2 != sizeof(target_sigset_t)) {
8408                 return -TARGET_EINVAL;
8409             }
8410             if (!(p = lock_user(VERIFY_READ, arg1, sizeof(target_sigset_t), 1)))
8411                 return -TARGET_EFAULT;
8412             target_to_host_sigset(&ts->sigsuspend_mask, p);
8413             unlock_user(p, arg1, 0);
8414             ret = get_errno(safe_rt_sigsuspend(&ts->sigsuspend_mask,
8415                                                SIGSET_T_SIZE));
8416             if (ret != -TARGET_ERESTARTSYS) {
8417                 ts->in_sigsuspend = 1;
8418             }
8419         }
8420         return ret;
8421     case TARGET_NR_rt_sigtimedwait:
8422         {
8423             sigset_t set;
8424             struct timespec uts, *puts;
8425             siginfo_t uinfo;
8426 
8427             if (arg4 != sizeof(target_sigset_t)) {
8428                 return -TARGET_EINVAL;
8429             }
8430 
8431             if (!(p = lock_user(VERIFY_READ, arg1, sizeof(target_sigset_t), 1)))
8432                 return -TARGET_EFAULT;
8433             target_to_host_sigset(&set, p);
8434             unlock_user(p, arg1, 0);
8435             if (arg3) {
8436                 puts = &uts;
8437                 target_to_host_timespec(puts, arg3);
8438             } else {
8439                 puts = NULL;
8440             }
8441             ret = get_errno(safe_rt_sigtimedwait(&set, &uinfo, puts,
8442                                                  SIGSET_T_SIZE));
8443             if (!is_error(ret)) {
8444                 if (arg2) {
8445                     p = lock_user(VERIFY_WRITE, arg2, sizeof(target_siginfo_t),
8446                                   0);
8447                     if (!p) {
8448                         return -TARGET_EFAULT;
8449                     }
8450                     host_to_target_siginfo(p, &uinfo);
8451                     unlock_user(p, arg2, sizeof(target_siginfo_t));
8452                 }
8453                 ret = host_to_target_signal(ret);
8454             }
8455         }
8456         return ret;
8457     case TARGET_NR_rt_sigqueueinfo:
8458         {
8459             siginfo_t uinfo;
8460 
8461             p = lock_user(VERIFY_READ, arg3, sizeof(target_siginfo_t), 1);
8462             if (!p) {
8463                 return -TARGET_EFAULT;
8464             }
8465             target_to_host_siginfo(&uinfo, p);
8466             unlock_user(p, arg3, 0);
8467             ret = get_errno(sys_rt_sigqueueinfo(arg1, arg2, &uinfo));
8468         }
8469         return ret;
8470     case TARGET_NR_rt_tgsigqueueinfo:
8471         {
8472             siginfo_t uinfo;
8473 
8474             p = lock_user(VERIFY_READ, arg4, sizeof(target_siginfo_t), 1);
8475             if (!p) {
8476                 return -TARGET_EFAULT;
8477             }
8478             target_to_host_siginfo(&uinfo, p);
8479             unlock_user(p, arg4, 0);
8480             ret = get_errno(sys_rt_tgsigqueueinfo(arg1, arg2, arg3, &uinfo));
8481         }
8482         return ret;
8483 #ifdef TARGET_NR_sigreturn
8484     case TARGET_NR_sigreturn:
8485         if (block_signals()) {
8486             return -TARGET_ERESTARTSYS;
8487         }
8488         return do_sigreturn(cpu_env);
8489 #endif
8490     case TARGET_NR_rt_sigreturn:
8491         if (block_signals()) {
8492             return -TARGET_ERESTARTSYS;
8493         }
8494         return do_rt_sigreturn(cpu_env);
8495     case TARGET_NR_sethostname:
8496         if (!(p = lock_user_string(arg1)))
8497             return -TARGET_EFAULT;
8498         ret = get_errno(sethostname(p, arg2));
8499         unlock_user(p, arg1, 0);
8500         return ret;
8501 #ifdef TARGET_NR_setrlimit
8502     case TARGET_NR_setrlimit:
8503         {
8504             int resource = target_to_host_resource(arg1);
8505             struct target_rlimit *target_rlim;
8506             struct rlimit rlim;
8507             if (!lock_user_struct(VERIFY_READ, target_rlim, arg2, 1))
8508                 return -TARGET_EFAULT;
8509             rlim.rlim_cur = target_to_host_rlim(target_rlim->rlim_cur);
8510             rlim.rlim_max = target_to_host_rlim(target_rlim->rlim_max);
8511             unlock_user_struct(target_rlim, arg2, 0);
8512             /*
8513              * If we just passed through resource limit settings for memory then
8514              * they would also apply to QEMU's own allocations, and QEMU will
8515              * crash or hang or die if its allocations fail. Ideally we would
8516              * track the guest allocations in QEMU and apply the limits ourselves.
8517              * For now, just tell the guest the call succeeded but don't actually
8518              * limit anything.
8519              */
8520             if (resource != RLIMIT_AS &&
8521                 resource != RLIMIT_DATA &&
8522                 resource != RLIMIT_STACK) {
8523                 return get_errno(setrlimit(resource, &rlim));
8524             } else {
8525                 return 0;
8526             }
8527         }
8528 #endif
8529 #ifdef TARGET_NR_getrlimit
8530     case TARGET_NR_getrlimit:
8531         {
8532             int resource = target_to_host_resource(arg1);
8533             struct target_rlimit *target_rlim;
8534             struct rlimit rlim;
8535 
8536             ret = get_errno(getrlimit(resource, &rlim));
8537             if (!is_error(ret)) {
8538                 if (!lock_user_struct(VERIFY_WRITE, target_rlim, arg2, 0))
8539                     return -TARGET_EFAULT;
8540                 target_rlim->rlim_cur = host_to_target_rlim(rlim.rlim_cur);
8541                 target_rlim->rlim_max = host_to_target_rlim(rlim.rlim_max);
8542                 unlock_user_struct(target_rlim, arg2, 1);
8543             }
8544         }
8545         return ret;
8546 #endif
8547     case TARGET_NR_getrusage:
8548         {
8549             struct rusage rusage;
8550             ret = get_errno(getrusage(arg1, &rusage));
8551             if (!is_error(ret)) {
8552                 ret = host_to_target_rusage(arg2, &rusage);
8553             }
8554         }
8555         return ret;
8556     case TARGET_NR_gettimeofday:
8557         {
8558             struct timeval tv;
8559             ret = get_errno(gettimeofday(&tv, NULL));
8560             if (!is_error(ret)) {
8561                 if (copy_to_user_timeval(arg1, &tv))
8562                     return -TARGET_EFAULT;
8563             }
8564         }
8565         return ret;
8566     case TARGET_NR_settimeofday:
8567         {
8568             struct timeval tv, *ptv = NULL;
8569             struct timezone tz, *ptz = NULL;
8570 
8571             if (arg1) {
8572                 if (copy_from_user_timeval(&tv, arg1)) {
8573                     return -TARGET_EFAULT;
8574                 }
8575                 ptv = &tv;
8576             }
8577 
8578             if (arg2) {
8579                 if (copy_from_user_timezone(&tz, arg2)) {
8580                     return -TARGET_EFAULT;
8581                 }
8582                 ptz = &tz;
8583             }
8584 
8585             return get_errno(settimeofday(ptv, ptz));
8586         }
8587 #if defined(TARGET_NR_select)
8588     case TARGET_NR_select:
8589 #if defined(TARGET_WANT_NI_OLD_SELECT)
8590         /* some architectures used to have old_select here
8591          * but now ENOSYS it.
8592          */
8593         ret = -TARGET_ENOSYS;
8594 #elif defined(TARGET_WANT_OLD_SYS_SELECT)
8595         ret = do_old_select(arg1);
8596 #else
8597         ret = do_select(arg1, arg2, arg3, arg4, arg5);
8598 #endif
8599         return ret;
8600 #endif
8601 #ifdef TARGET_NR_pselect6
8602     case TARGET_NR_pselect6:
8603         {
8604             abi_long rfd_addr, wfd_addr, efd_addr, n, ts_addr;
8605             fd_set rfds, wfds, efds;
8606             fd_set *rfds_ptr, *wfds_ptr, *efds_ptr;
8607             struct timespec ts, *ts_ptr;
8608 
8609             /*
8610              * The 6th arg is actually two args smashed together,
8611              * so we cannot use the C library.
8612              */
8613             sigset_t set;
8614             struct {
8615                 sigset_t *set;
8616                 size_t size;
8617             } sig, *sig_ptr;
8618 
8619             abi_ulong arg_sigset, arg_sigsize, *arg7;
8620             target_sigset_t *target_sigset;
8621 
8622             n = arg1;
8623             rfd_addr = arg2;
8624             wfd_addr = arg3;
8625             efd_addr = arg4;
8626             ts_addr = arg5;
8627 
8628             ret = copy_from_user_fdset_ptr(&rfds, &rfds_ptr, rfd_addr, n);
8629             if (ret) {
8630                 return ret;
8631             }
8632             ret = copy_from_user_fdset_ptr(&wfds, &wfds_ptr, wfd_addr, n);
8633             if (ret) {
8634                 return ret;
8635             }
8636             ret = copy_from_user_fdset_ptr(&efds, &efds_ptr, efd_addr, n);
8637             if (ret) {
8638                 return ret;
8639             }
8640 
8641             /*
8642              * This takes a timespec, and not a timeval, so we cannot
8643              * use the do_select() helper ...
8644              */
8645             if (ts_addr) {
8646                 if (target_to_host_timespec(&ts, ts_addr)) {
8647                     return -TARGET_EFAULT;
8648                 }
8649                 ts_ptr = &ts;
8650             } else {
8651                 ts_ptr = NULL;
8652             }
8653 
8654             /* Extract the two packed args for the sigset */
8655             if (arg6) {
8656                 sig_ptr = &sig;
8657                 sig.size = SIGSET_T_SIZE;
8658 
8659                 arg7 = lock_user(VERIFY_READ, arg6, sizeof(*arg7) * 2, 1);
8660                 if (!arg7) {
8661                     return -TARGET_EFAULT;
8662                 }
8663                 arg_sigset = tswapal(arg7[0]);
8664                 arg_sigsize = tswapal(arg7[1]);
8665                 unlock_user(arg7, arg6, 0);
8666 
8667                 if (arg_sigset) {
8668                     sig.set = &set;
8669                     if (arg_sigsize != sizeof(*target_sigset)) {
8670                         /* Like the kernel, we enforce correct size sigsets */
8671                         return -TARGET_EINVAL;
8672                     }
8673                     target_sigset = lock_user(VERIFY_READ, arg_sigset,
8674                                               sizeof(*target_sigset), 1);
8675                     if (!target_sigset) {
8676                         return -TARGET_EFAULT;
8677                     }
8678                     target_to_host_sigset(&set, target_sigset);
8679                     unlock_user(target_sigset, arg_sigset, 0);
8680                 } else {
8681                     sig.set = NULL;
8682                 }
8683             } else {
8684                 sig_ptr = NULL;
8685             }
8686 
8687             ret = get_errno(safe_pselect6(n, rfds_ptr, wfds_ptr, efds_ptr,
8688                                           ts_ptr, sig_ptr));
8689 
8690             if (!is_error(ret)) {
8691                 if (rfd_addr && copy_to_user_fdset(rfd_addr, &rfds, n))
8692                     return -TARGET_EFAULT;
8693                 if (wfd_addr && copy_to_user_fdset(wfd_addr, &wfds, n))
8694                     return -TARGET_EFAULT;
8695                 if (efd_addr && copy_to_user_fdset(efd_addr, &efds, n))
8696                     return -TARGET_EFAULT;
8697 
8698                 if (ts_addr && host_to_target_timespec(ts_addr, &ts))
8699                     return -TARGET_EFAULT;
8700             }
8701         }
8702         return ret;
8703 #endif
8704 #ifdef TARGET_NR_symlink
8705     case TARGET_NR_symlink:
8706         {
8707             void *p2;
8708             p = lock_user_string(arg1);
8709             p2 = lock_user_string(arg2);
8710             if (!p || !p2)
8711                 ret = -TARGET_EFAULT;
8712             else
8713                 ret = get_errno(symlink(p, p2));
8714             unlock_user(p2, arg2, 0);
8715             unlock_user(p, arg1, 0);
8716         }
8717         return ret;
8718 #endif
8719 #if defined(TARGET_NR_symlinkat)
8720     case TARGET_NR_symlinkat:
8721         {
8722             void *p2;
8723             p  = lock_user_string(arg1);
8724             p2 = lock_user_string(arg3);
8725             if (!p || !p2)
8726                 ret = -TARGET_EFAULT;
8727             else
8728                 ret = get_errno(symlinkat(p, arg2, p2));
8729             unlock_user(p2, arg3, 0);
8730             unlock_user(p, arg1, 0);
8731         }
8732         return ret;
8733 #endif
8734 #ifdef TARGET_NR_readlink
8735     case TARGET_NR_readlink:
8736         {
8737             void *p2;
8738             p = lock_user_string(arg1);
8739             p2 = lock_user(VERIFY_WRITE, arg2, arg3, 0);
8740             if (!p || !p2) {
8741                 ret = -TARGET_EFAULT;
8742             } else if (!arg3) {
8743                 /* Short circuit this for the magic exe check. */
8744                 ret = -TARGET_EINVAL;
8745             } else if (is_proc_myself((const char *)p, "exe")) {
8746                 char real[PATH_MAX], *temp;
8747                 temp = realpath(exec_path, real);
8748                 /* Return value is # of bytes that we wrote to the buffer. */
8749                 if (temp == NULL) {
8750                     ret = get_errno(-1);
8751                 } else {
8752                     /* Don't worry about sign mismatch as earlier mapping
8753                      * logic would have thrown a bad address error. */
8754                     ret = MIN(strlen(real), arg3);
8755                     /* We cannot NUL terminate the string. */
8756                     memcpy(p2, real, ret);
8757                 }
8758             } else {
8759                 ret = get_errno(readlink(path(p), p2, arg3));
8760             }
8761             unlock_user(p2, arg2, ret);
8762             unlock_user(p, arg1, 0);
8763         }
8764         return ret;
8765 #endif
8766 #if defined(TARGET_NR_readlinkat)
8767     case TARGET_NR_readlinkat:
8768         {
8769             void *p2;
8770             p  = lock_user_string(arg2);
8771             p2 = lock_user(VERIFY_WRITE, arg3, arg4, 0);
8772             if (!p || !p2) {
8773                 ret = -TARGET_EFAULT;
8774             } else if (is_proc_myself((const char *)p, "exe")) {
8775                 char real[PATH_MAX], *temp;
8776                 temp = realpath(exec_path, real);
8777                 ret = temp == NULL ? get_errno(-1) : strlen(real) ;
8778                 snprintf((char *)p2, arg4, "%s", real);
8779             } else {
8780                 ret = get_errno(readlinkat(arg1, path(p), p2, arg4));
8781             }
8782             unlock_user(p2, arg3, ret);
8783             unlock_user(p, arg2, 0);
8784         }
8785         return ret;
8786 #endif
8787 #ifdef TARGET_NR_swapon
8788     case TARGET_NR_swapon:
8789         if (!(p = lock_user_string(arg1)))
8790             return -TARGET_EFAULT;
8791         ret = get_errno(swapon(p, arg2));
8792         unlock_user(p, arg1, 0);
8793         return ret;
8794 #endif
8795     case TARGET_NR_reboot:
8796         if (arg3 == LINUX_REBOOT_CMD_RESTART2) {
8797            /* arg4 must be ignored in all other cases */
8798            p = lock_user_string(arg4);
8799            if (!p) {
8800                return -TARGET_EFAULT;
8801            }
8802            ret = get_errno(reboot(arg1, arg2, arg3, p));
8803            unlock_user(p, arg4, 0);
8804         } else {
8805            ret = get_errno(reboot(arg1, arg2, arg3, NULL));
8806         }
8807         return ret;
8808 #ifdef TARGET_NR_mmap
8809     case TARGET_NR_mmap:
8810 #if (defined(TARGET_I386) && defined(TARGET_ABI32)) || \
8811     (defined(TARGET_ARM) && defined(TARGET_ABI32)) || \
8812     defined(TARGET_M68K) || defined(TARGET_CRIS) || defined(TARGET_MICROBLAZE) \
8813     || defined(TARGET_S390X)
8814         {
8815             abi_ulong *v;
8816             abi_ulong v1, v2, v3, v4, v5, v6;
8817             if (!(v = lock_user(VERIFY_READ, arg1, 6 * sizeof(abi_ulong), 1)))
8818                 return -TARGET_EFAULT;
8819             v1 = tswapal(v[0]);
8820             v2 = tswapal(v[1]);
8821             v3 = tswapal(v[2]);
8822             v4 = tswapal(v[3]);
8823             v5 = tswapal(v[4]);
8824             v6 = tswapal(v[5]);
8825             unlock_user(v, arg1, 0);
8826             ret = get_errno(target_mmap(v1, v2, v3,
8827                                         target_to_host_bitmask(v4, mmap_flags_tbl),
8828                                         v5, v6));
8829         }
8830 #else
8831         ret = get_errno(target_mmap(arg1, arg2, arg3,
8832                                     target_to_host_bitmask(arg4, mmap_flags_tbl),
8833                                     arg5,
8834                                     arg6));
8835 #endif
8836         return ret;
8837 #endif
8838 #ifdef TARGET_NR_mmap2
8839     case TARGET_NR_mmap2:
8840 #ifndef MMAP_SHIFT
8841 #define MMAP_SHIFT 12
8842 #endif
8843         ret = target_mmap(arg1, arg2, arg3,
8844                           target_to_host_bitmask(arg4, mmap_flags_tbl),
8845                           arg5, arg6 << MMAP_SHIFT);
8846         return get_errno(ret);
8847 #endif
8848     case TARGET_NR_munmap:
8849         return get_errno(target_munmap(arg1, arg2));
8850     case TARGET_NR_mprotect:
8851         {
8852             TaskState *ts = cpu->opaque;
8853             /* Special hack to detect libc making the stack executable.  */
8854             if ((arg3 & PROT_GROWSDOWN)
8855                 && arg1 >= ts->info->stack_limit
8856                 && arg1 <= ts->info->start_stack) {
8857                 arg3 &= ~PROT_GROWSDOWN;
8858                 arg2 = arg2 + arg1 - ts->info->stack_limit;
8859                 arg1 = ts->info->stack_limit;
8860             }
8861         }
8862         return get_errno(target_mprotect(arg1, arg2, arg3));
8863 #ifdef TARGET_NR_mremap
8864     case TARGET_NR_mremap:
8865         return get_errno(target_mremap(arg1, arg2, arg3, arg4, arg5));
8866 #endif
8867         /* ??? msync/mlock/munlock are broken for softmmu.  */
8868 #ifdef TARGET_NR_msync
8869     case TARGET_NR_msync:
8870         return get_errno(msync(g2h(arg1), arg2, arg3));
8871 #endif
8872 #ifdef TARGET_NR_mlock
8873     case TARGET_NR_mlock:
8874         return get_errno(mlock(g2h(arg1), arg2));
8875 #endif
8876 #ifdef TARGET_NR_munlock
8877     case TARGET_NR_munlock:
8878         return get_errno(munlock(g2h(arg1), arg2));
8879 #endif
8880 #ifdef TARGET_NR_mlockall
8881     case TARGET_NR_mlockall:
8882         return get_errno(mlockall(target_to_host_mlockall_arg(arg1)));
8883 #endif
8884 #ifdef TARGET_NR_munlockall
8885     case TARGET_NR_munlockall:
8886         return get_errno(munlockall());
8887 #endif
8888 #ifdef TARGET_NR_truncate
8889     case TARGET_NR_truncate:
8890         if (!(p = lock_user_string(arg1)))
8891             return -TARGET_EFAULT;
8892         ret = get_errno(truncate(p, arg2));
8893         unlock_user(p, arg1, 0);
8894         return ret;
8895 #endif
8896 #ifdef TARGET_NR_ftruncate
8897     case TARGET_NR_ftruncate:
8898         return get_errno(ftruncate(arg1, arg2));
8899 #endif
8900     case TARGET_NR_fchmod:
8901         return get_errno(fchmod(arg1, arg2));
8902 #if defined(TARGET_NR_fchmodat)
8903     case TARGET_NR_fchmodat:
8904         if (!(p = lock_user_string(arg2)))
8905             return -TARGET_EFAULT;
8906         ret = get_errno(fchmodat(arg1, p, arg3, 0));
8907         unlock_user(p, arg2, 0);
8908         return ret;
8909 #endif
8910     case TARGET_NR_getpriority:
8911         /* Note that negative values are valid for getpriority, so we must
8912            differentiate based on errno settings.  */
8913         errno = 0;
8914         ret = getpriority(arg1, arg2);
8915         if (ret == -1 && errno != 0) {
8916             return -host_to_target_errno(errno);
8917         }
8918 #ifdef TARGET_ALPHA
8919         /* Return value is the unbiased priority.  Signal no error.  */
8920         ((CPUAlphaState *)cpu_env)->ir[IR_V0] = 0;
8921 #else
8922         /* Return value is a biased priority to avoid negative numbers.  */
8923         ret = 20 - ret;
8924 #endif
8925         return ret;
8926     case TARGET_NR_setpriority:
8927         return get_errno(setpriority(arg1, arg2, arg3));
8928 #ifdef TARGET_NR_statfs
8929     case TARGET_NR_statfs:
8930         if (!(p = lock_user_string(arg1))) {
8931             return -TARGET_EFAULT;
8932         }
8933         ret = get_errno(statfs(path(p), &stfs));
8934         unlock_user(p, arg1, 0);
8935     convert_statfs:
8936         if (!is_error(ret)) {
8937             struct target_statfs *target_stfs;
8938 
8939             if (!lock_user_struct(VERIFY_WRITE, target_stfs, arg2, 0))
8940                 return -TARGET_EFAULT;
8941             __put_user(stfs.f_type, &target_stfs->f_type);
8942             __put_user(stfs.f_bsize, &target_stfs->f_bsize);
8943             __put_user(stfs.f_blocks, &target_stfs->f_blocks);
8944             __put_user(stfs.f_bfree, &target_stfs->f_bfree);
8945             __put_user(stfs.f_bavail, &target_stfs->f_bavail);
8946             __put_user(stfs.f_files, &target_stfs->f_files);
8947             __put_user(stfs.f_ffree, &target_stfs->f_ffree);
8948             __put_user(stfs.f_fsid.__val[0], &target_stfs->f_fsid.val[0]);
8949             __put_user(stfs.f_fsid.__val[1], &target_stfs->f_fsid.val[1]);
8950             __put_user(stfs.f_namelen, &target_stfs->f_namelen);
8951             __put_user(stfs.f_frsize, &target_stfs->f_frsize);
8952 #ifdef _STATFS_F_FLAGS
8953             __put_user(stfs.f_flags, &target_stfs->f_flags);
8954 #else
8955             __put_user(0, &target_stfs->f_flags);
8956 #endif
8957             memset(target_stfs->f_spare, 0, sizeof(target_stfs->f_spare));
8958             unlock_user_struct(target_stfs, arg2, 1);
8959         }
8960         return ret;
8961 #endif
8962 #ifdef TARGET_NR_fstatfs
8963     case TARGET_NR_fstatfs:
8964         ret = get_errno(fstatfs(arg1, &stfs));
8965         goto convert_statfs;
8966 #endif
8967 #ifdef TARGET_NR_statfs64
8968     case TARGET_NR_statfs64:
8969         if (!(p = lock_user_string(arg1))) {
8970             return -TARGET_EFAULT;
8971         }
8972         ret = get_errno(statfs(path(p), &stfs));
8973         unlock_user(p, arg1, 0);
8974     convert_statfs64:
8975         if (!is_error(ret)) {
8976             struct target_statfs64 *target_stfs;
8977 
8978             if (!lock_user_struct(VERIFY_WRITE, target_stfs, arg3, 0))
8979                 return -TARGET_EFAULT;
8980             __put_user(stfs.f_type, &target_stfs->f_type);
8981             __put_user(stfs.f_bsize, &target_stfs->f_bsize);
8982             __put_user(stfs.f_blocks, &target_stfs->f_blocks);
8983             __put_user(stfs.f_bfree, &target_stfs->f_bfree);
8984             __put_user(stfs.f_bavail, &target_stfs->f_bavail);
8985             __put_user(stfs.f_files, &target_stfs->f_files);
8986             __put_user(stfs.f_ffree, &target_stfs->f_ffree);
8987             __put_user(stfs.f_fsid.__val[0], &target_stfs->f_fsid.val[0]);
8988             __put_user(stfs.f_fsid.__val[1], &target_stfs->f_fsid.val[1]);
8989             __put_user(stfs.f_namelen, &target_stfs->f_namelen);
8990             __put_user(stfs.f_frsize, &target_stfs->f_frsize);
8991             memset(target_stfs->f_spare, 0, sizeof(target_stfs->f_spare));
8992             unlock_user_struct(target_stfs, arg3, 1);
8993         }
8994         return ret;
8995     case TARGET_NR_fstatfs64:
8996         ret = get_errno(fstatfs(arg1, &stfs));
8997         goto convert_statfs64;
8998 #endif
8999 #ifdef TARGET_NR_socketcall
9000     case TARGET_NR_socketcall:
9001         return do_socketcall(arg1, arg2);
9002 #endif
9003 #ifdef TARGET_NR_accept
9004     case TARGET_NR_accept:
9005         return do_accept4(arg1, arg2, arg3, 0);
9006 #endif
9007 #ifdef TARGET_NR_accept4
9008     case TARGET_NR_accept4:
9009         return do_accept4(arg1, arg2, arg3, arg4);
9010 #endif
9011 #ifdef TARGET_NR_bind
9012     case TARGET_NR_bind:
9013         return do_bind(arg1, arg2, arg3);
9014 #endif
9015 #ifdef TARGET_NR_connect
9016     case TARGET_NR_connect:
9017         return do_connect(arg1, arg2, arg3);
9018 #endif
9019 #ifdef TARGET_NR_getpeername
9020     case TARGET_NR_getpeername:
9021         return do_getpeername(arg1, arg2, arg3);
9022 #endif
9023 #ifdef TARGET_NR_getsockname
9024     case TARGET_NR_getsockname:
9025         return do_getsockname(arg1, arg2, arg3);
9026 #endif
9027 #ifdef TARGET_NR_getsockopt
9028     case TARGET_NR_getsockopt:
9029         return do_getsockopt(arg1, arg2, arg3, arg4, arg5);
9030 #endif
9031 #ifdef TARGET_NR_listen
9032     case TARGET_NR_listen:
9033         return get_errno(listen(arg1, arg2));
9034 #endif
9035 #ifdef TARGET_NR_recv
9036     case TARGET_NR_recv:
9037         return do_recvfrom(arg1, arg2, arg3, arg4, 0, 0);
9038 #endif
9039 #ifdef TARGET_NR_recvfrom
9040     case TARGET_NR_recvfrom:
9041         return do_recvfrom(arg1, arg2, arg3, arg4, arg5, arg6);
9042 #endif
9043 #ifdef TARGET_NR_recvmsg
9044     case TARGET_NR_recvmsg:
9045         return do_sendrecvmsg(arg1, arg2, arg3, 0);
9046 #endif
9047 #ifdef TARGET_NR_send
9048     case TARGET_NR_send:
9049         return do_sendto(arg1, arg2, arg3, arg4, 0, 0);
9050 #endif
9051 #ifdef TARGET_NR_sendmsg
9052     case TARGET_NR_sendmsg:
9053         return do_sendrecvmsg(arg1, arg2, arg3, 1);
9054 #endif
9055 #ifdef TARGET_NR_sendmmsg
9056     case TARGET_NR_sendmmsg:
9057         return do_sendrecvmmsg(arg1, arg2, arg3, arg4, 1);
9058     case TARGET_NR_recvmmsg:
9059         return do_sendrecvmmsg(arg1, arg2, arg3, arg4, 0);
9060 #endif
9061 #ifdef TARGET_NR_sendto
9062     case TARGET_NR_sendto:
9063         return do_sendto(arg1, arg2, arg3, arg4, arg5, arg6);
9064 #endif
9065 #ifdef TARGET_NR_shutdown
9066     case TARGET_NR_shutdown:
9067         return get_errno(shutdown(arg1, arg2));
9068 #endif
9069 #if defined(TARGET_NR_getrandom) && defined(__NR_getrandom)
9070     case TARGET_NR_getrandom:
9071         p = lock_user(VERIFY_WRITE, arg1, arg2, 0);
9072         if (!p) {
9073             return -TARGET_EFAULT;
9074         }
9075         ret = get_errno(getrandom(p, arg2, arg3));
9076         unlock_user(p, arg1, ret);
9077         return ret;
9078 #endif
9079 #ifdef TARGET_NR_socket
9080     case TARGET_NR_socket:
9081         return do_socket(arg1, arg2, arg3);
9082 #endif
9083 #ifdef TARGET_NR_socketpair
9084     case TARGET_NR_socketpair:
9085         return do_socketpair(arg1, arg2, arg3, arg4);
9086 #endif
9087 #ifdef TARGET_NR_setsockopt
9088     case TARGET_NR_setsockopt:
9089         return do_setsockopt(arg1, arg2, arg3, arg4, (socklen_t) arg5);
9090 #endif
9091 #if defined(TARGET_NR_syslog)
9092     case TARGET_NR_syslog:
9093         {
9094             int len = arg2;
9095 
9096             switch (arg1) {
9097             case TARGET_SYSLOG_ACTION_CLOSE:         /* Close log */
9098             case TARGET_SYSLOG_ACTION_OPEN:          /* Open log */
9099             case TARGET_SYSLOG_ACTION_CLEAR:         /* Clear ring buffer */
9100             case TARGET_SYSLOG_ACTION_CONSOLE_OFF:   /* Disable logging */
9101             case TARGET_SYSLOG_ACTION_CONSOLE_ON:    /* Enable logging */
9102             case TARGET_SYSLOG_ACTION_CONSOLE_LEVEL: /* Set messages level */
9103             case TARGET_SYSLOG_ACTION_SIZE_UNREAD:   /* Number of chars */
9104             case TARGET_SYSLOG_ACTION_SIZE_BUFFER:   /* Size of the buffer */
9105                 return get_errno(sys_syslog((int)arg1, NULL, (int)arg3));
9106             case TARGET_SYSLOG_ACTION_READ:          /* Read from log */
9107             case TARGET_SYSLOG_ACTION_READ_CLEAR:    /* Read/clear msgs */
9108             case TARGET_SYSLOG_ACTION_READ_ALL:      /* Read last messages */
9109                 {
9110                     if (len < 0) {
9111                         return -TARGET_EINVAL;
9112                     }
9113                     if (len == 0) {
9114                         return 0;
9115                     }
9116                     p = lock_user(VERIFY_WRITE, arg2, arg3, 0);
9117                     if (!p) {
9118                         return -TARGET_EFAULT;
9119                     }
9120                     ret = get_errno(sys_syslog((int)arg1, p, (int)arg3));
9121                     unlock_user(p, arg2, arg3);
9122                 }
9123                 return ret;
9124             default:
9125                 return -TARGET_EINVAL;
9126             }
9127         }
9128         break;
9129 #endif
9130     case TARGET_NR_setitimer:
9131         {
9132             struct itimerval value, ovalue, *pvalue;
9133 
9134             if (arg2) {
9135                 pvalue = &value;
9136                 if (copy_from_user_timeval(&pvalue->it_interval, arg2)
9137                     || copy_from_user_timeval(&pvalue->it_value,
9138                                               arg2 + sizeof(struct target_timeval)))
9139                     return -TARGET_EFAULT;
9140             } else {
9141                 pvalue = NULL;
9142             }
9143             ret = get_errno(setitimer(arg1, pvalue, &ovalue));
9144             if (!is_error(ret) && arg3) {
9145                 if (copy_to_user_timeval(arg3,
9146                                          &ovalue.it_interval)
9147                     || copy_to_user_timeval(arg3 + sizeof(struct target_timeval),
9148                                             &ovalue.it_value))
9149                     return -TARGET_EFAULT;
9150             }
9151         }
9152         return ret;
9153     case TARGET_NR_getitimer:
9154         {
9155             struct itimerval value;
9156 
9157             ret = get_errno(getitimer(arg1, &value));
9158             if (!is_error(ret) && arg2) {
9159                 if (copy_to_user_timeval(arg2,
9160                                          &value.it_interval)
9161                     || copy_to_user_timeval(arg2 + sizeof(struct target_timeval),
9162                                             &value.it_value))
9163                     return -TARGET_EFAULT;
9164             }
9165         }
9166         return ret;
9167 #ifdef TARGET_NR_stat
9168     case TARGET_NR_stat:
9169         if (!(p = lock_user_string(arg1))) {
9170             return -TARGET_EFAULT;
9171         }
9172         ret = get_errno(stat(path(p), &st));
9173         unlock_user(p, arg1, 0);
9174         goto do_stat;
9175 #endif
9176 #ifdef TARGET_NR_lstat
9177     case TARGET_NR_lstat:
9178         if (!(p = lock_user_string(arg1))) {
9179             return -TARGET_EFAULT;
9180         }
9181         ret = get_errno(lstat(path(p), &st));
9182         unlock_user(p, arg1, 0);
9183         goto do_stat;
9184 #endif
9185 #ifdef TARGET_NR_fstat
9186     case TARGET_NR_fstat:
9187         {
9188             ret = get_errno(fstat(arg1, &st));
9189 #if defined(TARGET_NR_stat) || defined(TARGET_NR_lstat)
9190         do_stat:
9191 #endif
9192             if (!is_error(ret)) {
9193                 struct target_stat *target_st;
9194 
9195                 if (!lock_user_struct(VERIFY_WRITE, target_st, arg2, 0))
9196                     return -TARGET_EFAULT;
9197                 memset(target_st, 0, sizeof(*target_st));
9198                 __put_user(st.st_dev, &target_st->st_dev);
9199                 __put_user(st.st_ino, &target_st->st_ino);
9200                 __put_user(st.st_mode, &target_st->st_mode);
9201                 __put_user(st.st_uid, &target_st->st_uid);
9202                 __put_user(st.st_gid, &target_st->st_gid);
9203                 __put_user(st.st_nlink, &target_st->st_nlink);
9204                 __put_user(st.st_rdev, &target_st->st_rdev);
9205                 __put_user(st.st_size, &target_st->st_size);
9206                 __put_user(st.st_blksize, &target_st->st_blksize);
9207                 __put_user(st.st_blocks, &target_st->st_blocks);
9208                 __put_user(st.st_atime, &target_st->target_st_atime);
9209                 __put_user(st.st_mtime, &target_st->target_st_mtime);
9210                 __put_user(st.st_ctime, &target_st->target_st_ctime);
9211 #if (_POSIX_C_SOURCE >= 200809L || _XOPEN_SOURCE >= 700) && \
9212     defined(TARGET_STAT_HAVE_NSEC)
9213                 __put_user(st.st_atim.tv_nsec,
9214                            &target_st->target_st_atime_nsec);
9215                 __put_user(st.st_mtim.tv_nsec,
9216                            &target_st->target_st_mtime_nsec);
9217                 __put_user(st.st_ctim.tv_nsec,
9218                            &target_st->target_st_ctime_nsec);
9219 #endif
9220                 unlock_user_struct(target_st, arg2, 1);
9221             }
9222         }
9223         return ret;
9224 #endif
9225     case TARGET_NR_vhangup:
9226         return get_errno(vhangup());
9227 #ifdef TARGET_NR_syscall
9228     case TARGET_NR_syscall:
9229         return do_syscall(cpu_env, arg1 & 0xffff, arg2, arg3, arg4, arg5,
9230                           arg6, arg7, arg8, 0);
9231 #endif
9232     case TARGET_NR_wait4:
9233         {
9234             int status;
9235             abi_long status_ptr = arg2;
9236             struct rusage rusage, *rusage_ptr;
9237             abi_ulong target_rusage = arg4;
9238             abi_long rusage_err;
9239             if (target_rusage)
9240                 rusage_ptr = &rusage;
9241             else
9242                 rusage_ptr = NULL;
9243             ret = get_errno(safe_wait4(arg1, &status, arg3, rusage_ptr));
9244             if (!is_error(ret)) {
9245                 if (status_ptr && ret) {
9246                     status = host_to_target_waitstatus(status);
9247                     if (put_user_s32(status, status_ptr))
9248                         return -TARGET_EFAULT;
9249                 }
9250                 if (target_rusage) {
9251                     rusage_err = host_to_target_rusage(target_rusage, &rusage);
9252                     if (rusage_err) {
9253                         ret = rusage_err;
9254                     }
9255                 }
9256             }
9257         }
9258         return ret;
9259 #ifdef TARGET_NR_swapoff
9260     case TARGET_NR_swapoff:
9261         if (!(p = lock_user_string(arg1)))
9262             return -TARGET_EFAULT;
9263         ret = get_errno(swapoff(p));
9264         unlock_user(p, arg1, 0);
9265         return ret;
9266 #endif
9267     case TARGET_NR_sysinfo:
9268         {
9269             struct target_sysinfo *target_value;
9270             struct sysinfo value;
9271             ret = get_errno(sysinfo(&value));
9272             if (!is_error(ret) && arg1)
9273             {
9274                 if (!lock_user_struct(VERIFY_WRITE, target_value, arg1, 0))
9275                     return -TARGET_EFAULT;
9276                 __put_user(value.uptime, &target_value->uptime);
9277                 __put_user(value.loads[0], &target_value->loads[0]);
9278                 __put_user(value.loads[1], &target_value->loads[1]);
9279                 __put_user(value.loads[2], &target_value->loads[2]);
9280                 __put_user(value.totalram, &target_value->totalram);
9281                 __put_user(value.freeram, &target_value->freeram);
9282                 __put_user(value.sharedram, &target_value->sharedram);
9283                 __put_user(value.bufferram, &target_value->bufferram);
9284                 __put_user(value.totalswap, &target_value->totalswap);
9285                 __put_user(value.freeswap, &target_value->freeswap);
9286                 __put_user(value.procs, &target_value->procs);
9287                 __put_user(value.totalhigh, &target_value->totalhigh);
9288                 __put_user(value.freehigh, &target_value->freehigh);
9289                 __put_user(value.mem_unit, &target_value->mem_unit);
9290                 unlock_user_struct(target_value, arg1, 1);
9291             }
9292         }
9293         return ret;
9294 #ifdef TARGET_NR_ipc
9295     case TARGET_NR_ipc:
9296         return do_ipc(cpu_env, arg1, arg2, arg3, arg4, arg5, arg6);
9297 #endif
9298 #ifdef TARGET_NR_semget
9299     case TARGET_NR_semget:
9300         return get_errno(semget(arg1, arg2, arg3));
9301 #endif
9302 #ifdef TARGET_NR_semop
9303     case TARGET_NR_semop:
9304         return do_semop(arg1, arg2, arg3);
9305 #endif
9306 #ifdef TARGET_NR_semctl
9307     case TARGET_NR_semctl:
9308         return do_semctl(arg1, arg2, arg3, arg4);
9309 #endif
9310 #ifdef TARGET_NR_msgctl
9311     case TARGET_NR_msgctl:
9312         return do_msgctl(arg1, arg2, arg3);
9313 #endif
9314 #ifdef TARGET_NR_msgget
9315     case TARGET_NR_msgget:
9316         return get_errno(msgget(arg1, arg2));
9317 #endif
9318 #ifdef TARGET_NR_msgrcv
9319     case TARGET_NR_msgrcv:
9320         return do_msgrcv(arg1, arg2, arg3, arg4, arg5);
9321 #endif
9322 #ifdef TARGET_NR_msgsnd
9323     case TARGET_NR_msgsnd:
9324         return do_msgsnd(arg1, arg2, arg3, arg4);
9325 #endif
9326 #ifdef TARGET_NR_shmget
9327     case TARGET_NR_shmget:
9328         return get_errno(shmget(arg1, arg2, arg3));
9329 #endif
9330 #ifdef TARGET_NR_shmctl
9331     case TARGET_NR_shmctl:
9332         return do_shmctl(arg1, arg2, arg3);
9333 #endif
9334 #ifdef TARGET_NR_shmat
9335     case TARGET_NR_shmat:
9336         return do_shmat(cpu_env, arg1, arg2, arg3);
9337 #endif
9338 #ifdef TARGET_NR_shmdt
9339     case TARGET_NR_shmdt:
9340         return do_shmdt(arg1);
9341 #endif
9342     case TARGET_NR_fsync:
9343         return get_errno(fsync(arg1));
9344     case TARGET_NR_clone:
9345         /* Linux manages to have three different orderings for its
9346          * arguments to clone(); the BACKWARDS and BACKWARDS2 defines
9347          * match the kernel's CONFIG_CLONE_* settings.
9348          * Microblaze is further special in that it uses a sixth
9349          * implicit argument to clone for the TLS pointer.
9350          */
9351 #if defined(TARGET_MICROBLAZE)
9352         ret = get_errno(do_fork(cpu_env, arg1, arg2, arg4, arg6, arg5));
9353 #elif defined(TARGET_CLONE_BACKWARDS)
9354         ret = get_errno(do_fork(cpu_env, arg1, arg2, arg3, arg4, arg5));
9355 #elif defined(TARGET_CLONE_BACKWARDS2)
9356         ret = get_errno(do_fork(cpu_env, arg2, arg1, arg3, arg5, arg4));
9357 #else
9358         ret = get_errno(do_fork(cpu_env, arg1, arg2, arg3, arg5, arg4));
9359 #endif
9360         return ret;
9361 #ifdef __NR_exit_group
9362         /* new thread calls */
9363     case TARGET_NR_exit_group:
9364         preexit_cleanup(cpu_env, arg1);
9365         return get_errno(exit_group(arg1));
9366 #endif
9367     case TARGET_NR_setdomainname:
9368         if (!(p = lock_user_string(arg1)))
9369             return -TARGET_EFAULT;
9370         ret = get_errno(setdomainname(p, arg2));
9371         unlock_user(p, arg1, 0);
9372         return ret;
9373     case TARGET_NR_uname:
9374         /* no need to transcode because we use the linux syscall */
9375         {
9376             struct new_utsname * buf;
9377 
9378             if (!lock_user_struct(VERIFY_WRITE, buf, arg1, 0))
9379                 return -TARGET_EFAULT;
9380             ret = get_errno(sys_uname(buf));
9381             if (!is_error(ret)) {
9382                 /* Overwrite the native machine name with whatever is being
9383                    emulated. */
9384                 g_strlcpy(buf->machine, cpu_to_uname_machine(cpu_env),
9385                           sizeof(buf->machine));
9386                 /* Allow the user to override the reported release.  */
9387                 if (qemu_uname_release && *qemu_uname_release) {
9388                     g_strlcpy(buf->release, qemu_uname_release,
9389                               sizeof(buf->release));
9390                 }
9391             }
9392             unlock_user_struct(buf, arg1, 1);
9393         }
9394         return ret;
9395 #ifdef TARGET_I386
9396     case TARGET_NR_modify_ldt:
9397         return do_modify_ldt(cpu_env, arg1, arg2, arg3);
9398 #if !defined(TARGET_X86_64)
9399     case TARGET_NR_vm86:
9400         return do_vm86(cpu_env, arg1, arg2);
9401 #endif
9402 #endif
9403     case TARGET_NR_adjtimex:
9404         {
9405             struct timex host_buf;
9406 
9407             if (target_to_host_timex(&host_buf, arg1) != 0) {
9408                 return -TARGET_EFAULT;
9409             }
9410             ret = get_errno(adjtimex(&host_buf));
9411             if (!is_error(ret)) {
9412                 if (host_to_target_timex(arg1, &host_buf) != 0) {
9413                     return -TARGET_EFAULT;
9414                 }
9415             }
9416         }
9417         return ret;
9418 #if defined(TARGET_NR_clock_adjtime) && defined(CONFIG_CLOCK_ADJTIME)
9419     case TARGET_NR_clock_adjtime:
9420         {
9421             struct timex htx, *phtx = &htx;
9422 
9423             if (target_to_host_timex(phtx, arg2) != 0) {
9424                 return -TARGET_EFAULT;
9425             }
9426             ret = get_errno(clock_adjtime(arg1, phtx));
9427             if (!is_error(ret) && phtx) {
9428                 if (host_to_target_timex(arg2, phtx) != 0) {
9429                     return -TARGET_EFAULT;
9430                 }
9431             }
9432         }
9433         return ret;
9434 #endif
9435     case TARGET_NR_getpgid:
9436         return get_errno(getpgid(arg1));
9437     case TARGET_NR_fchdir:
9438         return get_errno(fchdir(arg1));
9439     case TARGET_NR_personality:
9440         return get_errno(personality(arg1));
9441 #ifdef TARGET_NR__llseek /* Not on alpha */
9442     case TARGET_NR__llseek:
9443         {
9444             int64_t res;
9445 #if !defined(__NR_llseek)
9446             res = lseek(arg1, ((uint64_t)arg2 << 32) | (abi_ulong)arg3, arg5);
9447             if (res == -1) {
9448                 ret = get_errno(res);
9449             } else {
9450                 ret = 0;
9451             }
9452 #else
9453             ret = get_errno(_llseek(arg1, arg2, arg3, &res, arg5));
9454 #endif
9455             if ((ret == 0) && put_user_s64(res, arg4)) {
9456                 return -TARGET_EFAULT;
9457             }
9458         }
9459         return ret;
9460 #endif
9461 #ifdef TARGET_NR_getdents
9462     case TARGET_NR_getdents:
9463 #ifdef EMULATE_GETDENTS_WITH_GETDENTS
9464 #if TARGET_ABI_BITS == 32 && HOST_LONG_BITS == 64
9465         {
9466             struct target_dirent *target_dirp;
9467             struct linux_dirent *dirp;
9468             abi_long count = arg3;
9469 
9470             dirp = g_try_malloc(count);
9471             if (!dirp) {
9472                 return -TARGET_ENOMEM;
9473             }
9474 
9475             ret = get_errno(sys_getdents(arg1, dirp, count));
9476             if (!is_error(ret)) {
9477                 struct linux_dirent *de;
9478 		struct target_dirent *tde;
9479                 int len = ret;
9480                 int reclen, treclen;
9481 		int count1, tnamelen;
9482 
9483 		count1 = 0;
9484                 de = dirp;
9485                 if (!(target_dirp = lock_user(VERIFY_WRITE, arg2, count, 0)))
9486                     return -TARGET_EFAULT;
9487 		tde = target_dirp;
9488                 while (len > 0) {
9489                     reclen = de->d_reclen;
9490                     tnamelen = reclen - offsetof(struct linux_dirent, d_name);
9491                     assert(tnamelen >= 0);
9492                     treclen = tnamelen + offsetof(struct target_dirent, d_name);
9493                     assert(count1 + treclen <= count);
9494                     tde->d_reclen = tswap16(treclen);
9495                     tde->d_ino = tswapal(de->d_ino);
9496                     tde->d_off = tswapal(de->d_off);
9497                     memcpy(tde->d_name, de->d_name, tnamelen);
9498                     de = (struct linux_dirent *)((char *)de + reclen);
9499                     len -= reclen;
9500                     tde = (struct target_dirent *)((char *)tde + treclen);
9501 		    count1 += treclen;
9502                 }
9503 		ret = count1;
9504                 unlock_user(target_dirp, arg2, ret);
9505             }
9506             g_free(dirp);
9507         }
9508 #else
9509         {
9510             struct linux_dirent *dirp;
9511             abi_long count = arg3;
9512 
9513             if (!(dirp = lock_user(VERIFY_WRITE, arg2, count, 0)))
9514                 return -TARGET_EFAULT;
9515             ret = get_errno(sys_getdents(arg1, dirp, count));
9516             if (!is_error(ret)) {
9517                 struct linux_dirent *de;
9518                 int len = ret;
9519                 int reclen;
9520                 de = dirp;
9521                 while (len > 0) {
9522                     reclen = de->d_reclen;
9523                     if (reclen > len)
9524                         break;
9525                     de->d_reclen = tswap16(reclen);
9526                     tswapls(&de->d_ino);
9527                     tswapls(&de->d_off);
9528                     de = (struct linux_dirent *)((char *)de + reclen);
9529                     len -= reclen;
9530                 }
9531             }
9532             unlock_user(dirp, arg2, ret);
9533         }
9534 #endif
9535 #else
9536         /* Implement getdents in terms of getdents64 */
9537         {
9538             struct linux_dirent64 *dirp;
9539             abi_long count = arg3;
9540 
9541             dirp = lock_user(VERIFY_WRITE, arg2, count, 0);
9542             if (!dirp) {
9543                 return -TARGET_EFAULT;
9544             }
9545             ret = get_errno(sys_getdents64(arg1, dirp, count));
9546             if (!is_error(ret)) {
9547                 /* Convert the dirent64 structs to target dirent.  We do this
9548                  * in-place, since we can guarantee that a target_dirent is no
9549                  * larger than a dirent64; however this means we have to be
9550                  * careful to read everything before writing in the new format.
9551                  */
9552                 struct linux_dirent64 *de;
9553                 struct target_dirent *tde;
9554                 int len = ret;
9555                 int tlen = 0;
9556 
9557                 de = dirp;
9558                 tde = (struct target_dirent *)dirp;
9559                 while (len > 0) {
9560                     int namelen, treclen;
9561                     int reclen = de->d_reclen;
9562                     uint64_t ino = de->d_ino;
9563                     int64_t off = de->d_off;
9564                     uint8_t type = de->d_type;
9565 
9566                     namelen = strlen(de->d_name);
9567                     treclen = offsetof(struct target_dirent, d_name)
9568                         + namelen + 2;
9569                     treclen = QEMU_ALIGN_UP(treclen, sizeof(abi_long));
9570 
9571                     memmove(tde->d_name, de->d_name, namelen + 1);
9572                     tde->d_ino = tswapal(ino);
9573                     tde->d_off = tswapal(off);
9574                     tde->d_reclen = tswap16(treclen);
9575                     /* The target_dirent type is in what was formerly a padding
9576                      * byte at the end of the structure:
9577                      */
9578                     *(((char *)tde) + treclen - 1) = type;
9579 
9580                     de = (struct linux_dirent64 *)((char *)de + reclen);
9581                     tde = (struct target_dirent *)((char *)tde + treclen);
9582                     len -= reclen;
9583                     tlen += treclen;
9584                 }
9585                 ret = tlen;
9586             }
9587             unlock_user(dirp, arg2, ret);
9588         }
9589 #endif
9590         return ret;
9591 #endif /* TARGET_NR_getdents */
9592 #if defined(TARGET_NR_getdents64) && defined(__NR_getdents64)
9593     case TARGET_NR_getdents64:
9594         {
9595             struct linux_dirent64 *dirp;
9596             abi_long count = arg3;
9597             if (!(dirp = lock_user(VERIFY_WRITE, arg2, count, 0)))
9598                 return -TARGET_EFAULT;
9599             ret = get_errno(sys_getdents64(arg1, dirp, count));
9600             if (!is_error(ret)) {
9601                 struct linux_dirent64 *de;
9602                 int len = ret;
9603                 int reclen;
9604                 de = dirp;
9605                 while (len > 0) {
9606                     reclen = de->d_reclen;
9607                     if (reclen > len)
9608                         break;
9609                     de->d_reclen = tswap16(reclen);
9610                     tswap64s((uint64_t *)&de->d_ino);
9611                     tswap64s((uint64_t *)&de->d_off);
9612                     de = (struct linux_dirent64 *)((char *)de + reclen);
9613                     len -= reclen;
9614                 }
9615             }
9616             unlock_user(dirp, arg2, ret);
9617         }
9618         return ret;
9619 #endif /* TARGET_NR_getdents64 */
9620 #if defined(TARGET_NR__newselect)
9621     case TARGET_NR__newselect:
9622         return do_select(arg1, arg2, arg3, arg4, arg5);
9623 #endif
9624 #if defined(TARGET_NR_poll) || defined(TARGET_NR_ppoll)
9625 # ifdef TARGET_NR_poll
9626     case TARGET_NR_poll:
9627 # endif
9628 # ifdef TARGET_NR_ppoll
9629     case TARGET_NR_ppoll:
9630 # endif
9631         {
9632             struct target_pollfd *target_pfd;
9633             unsigned int nfds = arg2;
9634             struct pollfd *pfd;
9635             unsigned int i;
9636 
9637             pfd = NULL;
9638             target_pfd = NULL;
9639             if (nfds) {
9640                 if (nfds > (INT_MAX / sizeof(struct target_pollfd))) {
9641                     return -TARGET_EINVAL;
9642                 }
9643 
9644                 target_pfd = lock_user(VERIFY_WRITE, arg1,
9645                                        sizeof(struct target_pollfd) * nfds, 1);
9646                 if (!target_pfd) {
9647                     return -TARGET_EFAULT;
9648                 }
9649 
9650                 pfd = alloca(sizeof(struct pollfd) * nfds);
9651                 for (i = 0; i < nfds; i++) {
9652                     pfd[i].fd = tswap32(target_pfd[i].fd);
9653                     pfd[i].events = tswap16(target_pfd[i].events);
9654                 }
9655             }
9656 
9657             switch (num) {
9658 # ifdef TARGET_NR_ppoll
9659             case TARGET_NR_ppoll:
9660             {
9661                 struct timespec _timeout_ts, *timeout_ts = &_timeout_ts;
9662                 target_sigset_t *target_set;
9663                 sigset_t _set, *set = &_set;
9664 
9665                 if (arg3) {
9666                     if (target_to_host_timespec(timeout_ts, arg3)) {
9667                         unlock_user(target_pfd, arg1, 0);
9668                         return -TARGET_EFAULT;
9669                     }
9670                 } else {
9671                     timeout_ts = NULL;
9672                 }
9673 
9674                 if (arg4) {
9675                     if (arg5 != sizeof(target_sigset_t)) {
9676                         unlock_user(target_pfd, arg1, 0);
9677                         return -TARGET_EINVAL;
9678                     }
9679 
9680                     target_set = lock_user(VERIFY_READ, arg4, sizeof(target_sigset_t), 1);
9681                     if (!target_set) {
9682                         unlock_user(target_pfd, arg1, 0);
9683                         return -TARGET_EFAULT;
9684                     }
9685                     target_to_host_sigset(set, target_set);
9686                 } else {
9687                     set = NULL;
9688                 }
9689 
9690                 ret = get_errno(safe_ppoll(pfd, nfds, timeout_ts,
9691                                            set, SIGSET_T_SIZE));
9692 
9693                 if (!is_error(ret) && arg3) {
9694                     host_to_target_timespec(arg3, timeout_ts);
9695                 }
9696                 if (arg4) {
9697                     unlock_user(target_set, arg4, 0);
9698                 }
9699                 break;
9700             }
9701 # endif
9702 # ifdef TARGET_NR_poll
9703             case TARGET_NR_poll:
9704             {
9705                 struct timespec ts, *pts;
9706 
9707                 if (arg3 >= 0) {
9708                     /* Convert ms to secs, ns */
9709                     ts.tv_sec = arg3 / 1000;
9710                     ts.tv_nsec = (arg3 % 1000) * 1000000LL;
9711                     pts = &ts;
9712                 } else {
9713                     /* -ve poll() timeout means "infinite" */
9714                     pts = NULL;
9715                 }
9716                 ret = get_errno(safe_ppoll(pfd, nfds, pts, NULL, 0));
9717                 break;
9718             }
9719 # endif
9720             default:
9721                 g_assert_not_reached();
9722             }
9723 
9724             if (!is_error(ret)) {
9725                 for(i = 0; i < nfds; i++) {
9726                     target_pfd[i].revents = tswap16(pfd[i].revents);
9727                 }
9728             }
9729             unlock_user(target_pfd, arg1, sizeof(struct target_pollfd) * nfds);
9730         }
9731         return ret;
9732 #endif
9733     case TARGET_NR_flock:
9734         /* NOTE: the flock constant seems to be the same for every
9735            Linux platform */
9736         return get_errno(safe_flock(arg1, arg2));
9737     case TARGET_NR_readv:
9738         {
9739             struct iovec *vec = lock_iovec(VERIFY_WRITE, arg2, arg3, 0);
9740             if (vec != NULL) {
9741                 ret = get_errno(safe_readv(arg1, vec, arg3));
9742                 unlock_iovec(vec, arg2, arg3, 1);
9743             } else {
9744                 ret = -host_to_target_errno(errno);
9745             }
9746         }
9747         return ret;
9748     case TARGET_NR_writev:
9749         {
9750             struct iovec *vec = lock_iovec(VERIFY_READ, arg2, arg3, 1);
9751             if (vec != NULL) {
9752                 ret = get_errno(safe_writev(arg1, vec, arg3));
9753                 unlock_iovec(vec, arg2, arg3, 0);
9754             } else {
9755                 ret = -host_to_target_errno(errno);
9756             }
9757         }
9758         return ret;
9759 #if defined(TARGET_NR_preadv)
9760     case TARGET_NR_preadv:
9761         {
9762             struct iovec *vec = lock_iovec(VERIFY_WRITE, arg2, arg3, 0);
9763             if (vec != NULL) {
9764                 unsigned long low, high;
9765 
9766                 target_to_host_low_high(arg4, arg5, &low, &high);
9767                 ret = get_errno(safe_preadv(arg1, vec, arg3, low, high));
9768                 unlock_iovec(vec, arg2, arg3, 1);
9769             } else {
9770                 ret = -host_to_target_errno(errno);
9771            }
9772         }
9773         return ret;
9774 #endif
9775 #if defined(TARGET_NR_pwritev)
9776     case TARGET_NR_pwritev:
9777         {
9778             struct iovec *vec = lock_iovec(VERIFY_READ, arg2, arg3, 1);
9779             if (vec != NULL) {
9780                 unsigned long low, high;
9781 
9782                 target_to_host_low_high(arg4, arg5, &low, &high);
9783                 ret = get_errno(safe_pwritev(arg1, vec, arg3, low, high));
9784                 unlock_iovec(vec, arg2, arg3, 0);
9785             } else {
9786                 ret = -host_to_target_errno(errno);
9787            }
9788         }
9789         return ret;
9790 #endif
9791     case TARGET_NR_getsid:
9792         return get_errno(getsid(arg1));
9793 #if defined(TARGET_NR_fdatasync) /* Not on alpha (osf_datasync ?) */
9794     case TARGET_NR_fdatasync:
9795         return get_errno(fdatasync(arg1));
9796 #endif
9797 #ifdef TARGET_NR__sysctl
9798     case TARGET_NR__sysctl:
9799         /* We don't implement this, but ENOTDIR is always a safe
9800            return value. */
9801         return -TARGET_ENOTDIR;
9802 #endif
9803     case TARGET_NR_sched_getaffinity:
9804         {
9805             unsigned int mask_size;
9806             unsigned long *mask;
9807 
9808             /*
9809              * sched_getaffinity needs multiples of ulong, so need to take
9810              * care of mismatches between target ulong and host ulong sizes.
9811              */
9812             if (arg2 & (sizeof(abi_ulong) - 1)) {
9813                 return -TARGET_EINVAL;
9814             }
9815             mask_size = (arg2 + (sizeof(*mask) - 1)) & ~(sizeof(*mask) - 1);
9816 
9817             mask = alloca(mask_size);
9818             memset(mask, 0, mask_size);
9819             ret = get_errno(sys_sched_getaffinity(arg1, mask_size, mask));
9820 
9821             if (!is_error(ret)) {
9822                 if (ret > arg2) {
9823                     /* More data returned than the caller's buffer will fit.
9824                      * This only happens if sizeof(abi_long) < sizeof(long)
9825                      * and the caller passed us a buffer holding an odd number
9826                      * of abi_longs. If the host kernel is actually using the
9827                      * extra 4 bytes then fail EINVAL; otherwise we can just
9828                      * ignore them and only copy the interesting part.
9829                      */
9830                     int numcpus = sysconf(_SC_NPROCESSORS_CONF);
9831                     if (numcpus > arg2 * 8) {
9832                         return -TARGET_EINVAL;
9833                     }
9834                     ret = arg2;
9835                 }
9836 
9837                 if (host_to_target_cpu_mask(mask, mask_size, arg3, ret)) {
9838                     return -TARGET_EFAULT;
9839                 }
9840             }
9841         }
9842         return ret;
9843     case TARGET_NR_sched_setaffinity:
9844         {
9845             unsigned int mask_size;
9846             unsigned long *mask;
9847 
9848             /*
9849              * sched_setaffinity needs multiples of ulong, so need to take
9850              * care of mismatches between target ulong and host ulong sizes.
9851              */
9852             if (arg2 & (sizeof(abi_ulong) - 1)) {
9853                 return -TARGET_EINVAL;
9854             }
9855             mask_size = (arg2 + (sizeof(*mask) - 1)) & ~(sizeof(*mask) - 1);
9856             mask = alloca(mask_size);
9857 
9858             ret = target_to_host_cpu_mask(mask, mask_size, arg3, arg2);
9859             if (ret) {
9860                 return ret;
9861             }
9862 
9863             return get_errno(sys_sched_setaffinity(arg1, mask_size, mask));
9864         }
9865     case TARGET_NR_getcpu:
9866         {
9867             unsigned cpu, node;
9868             ret = get_errno(sys_getcpu(arg1 ? &cpu : NULL,
9869                                        arg2 ? &node : NULL,
9870                                        NULL));
9871             if (is_error(ret)) {
9872                 return ret;
9873             }
9874             if (arg1 && put_user_u32(cpu, arg1)) {
9875                 return -TARGET_EFAULT;
9876             }
9877             if (arg2 && put_user_u32(node, arg2)) {
9878                 return -TARGET_EFAULT;
9879             }
9880         }
9881         return ret;
9882     case TARGET_NR_sched_setparam:
9883         {
9884             struct sched_param *target_schp;
9885             struct sched_param schp;
9886 
9887             if (arg2 == 0) {
9888                 return -TARGET_EINVAL;
9889             }
9890             if (!lock_user_struct(VERIFY_READ, target_schp, arg2, 1))
9891                 return -TARGET_EFAULT;
9892             schp.sched_priority = tswap32(target_schp->sched_priority);
9893             unlock_user_struct(target_schp, arg2, 0);
9894             return get_errno(sched_setparam(arg1, &schp));
9895         }
9896     case TARGET_NR_sched_getparam:
9897         {
9898             struct sched_param *target_schp;
9899             struct sched_param schp;
9900 
9901             if (arg2 == 0) {
9902                 return -TARGET_EINVAL;
9903             }
9904             ret = get_errno(sched_getparam(arg1, &schp));
9905             if (!is_error(ret)) {
9906                 if (!lock_user_struct(VERIFY_WRITE, target_schp, arg2, 0))
9907                     return -TARGET_EFAULT;
9908                 target_schp->sched_priority = tswap32(schp.sched_priority);
9909                 unlock_user_struct(target_schp, arg2, 1);
9910             }
9911         }
9912         return ret;
9913     case TARGET_NR_sched_setscheduler:
9914         {
9915             struct sched_param *target_schp;
9916             struct sched_param schp;
9917             if (arg3 == 0) {
9918                 return -TARGET_EINVAL;
9919             }
9920             if (!lock_user_struct(VERIFY_READ, target_schp, arg3, 1))
9921                 return -TARGET_EFAULT;
9922             schp.sched_priority = tswap32(target_schp->sched_priority);
9923             unlock_user_struct(target_schp, arg3, 0);
9924             return get_errno(sched_setscheduler(arg1, arg2, &schp));
9925         }
9926     case TARGET_NR_sched_getscheduler:
9927         return get_errno(sched_getscheduler(arg1));
9928     case TARGET_NR_sched_yield:
9929         return get_errno(sched_yield());
9930     case TARGET_NR_sched_get_priority_max:
9931         return get_errno(sched_get_priority_max(arg1));
9932     case TARGET_NR_sched_get_priority_min:
9933         return get_errno(sched_get_priority_min(arg1));
9934     case TARGET_NR_sched_rr_get_interval:
9935         {
9936             struct timespec ts;
9937             ret = get_errno(sched_rr_get_interval(arg1, &ts));
9938             if (!is_error(ret)) {
9939                 ret = host_to_target_timespec(arg2, &ts);
9940             }
9941         }
9942         return ret;
9943     case TARGET_NR_nanosleep:
9944         {
9945             struct timespec req, rem;
9946             target_to_host_timespec(&req, arg1);
9947             ret = get_errno(safe_nanosleep(&req, &rem));
9948             if (is_error(ret) && arg2) {
9949                 host_to_target_timespec(arg2, &rem);
9950             }
9951         }
9952         return ret;
9953     case TARGET_NR_prctl:
9954         switch (arg1) {
9955         case PR_GET_PDEATHSIG:
9956         {
9957             int deathsig;
9958             ret = get_errno(prctl(arg1, &deathsig, arg3, arg4, arg5));
9959             if (!is_error(ret) && arg2
9960                 && put_user_ual(deathsig, arg2)) {
9961                 return -TARGET_EFAULT;
9962             }
9963             return ret;
9964         }
9965 #ifdef PR_GET_NAME
9966         case PR_GET_NAME:
9967         {
9968             void *name = lock_user(VERIFY_WRITE, arg2, 16, 1);
9969             if (!name) {
9970                 return -TARGET_EFAULT;
9971             }
9972             ret = get_errno(prctl(arg1, (unsigned long)name,
9973                                   arg3, arg4, arg5));
9974             unlock_user(name, arg2, 16);
9975             return ret;
9976         }
9977         case PR_SET_NAME:
9978         {
9979             void *name = lock_user(VERIFY_READ, arg2, 16, 1);
9980             if (!name) {
9981                 return -TARGET_EFAULT;
9982             }
9983             ret = get_errno(prctl(arg1, (unsigned long)name,
9984                                   arg3, arg4, arg5));
9985             unlock_user(name, arg2, 0);
9986             return ret;
9987         }
9988 #endif
9989 #ifdef TARGET_MIPS
9990         case TARGET_PR_GET_FP_MODE:
9991         {
9992             CPUMIPSState *env = ((CPUMIPSState *)cpu_env);
9993             ret = 0;
9994             if (env->CP0_Status & (1 << CP0St_FR)) {
9995                 ret |= TARGET_PR_FP_MODE_FR;
9996             }
9997             if (env->CP0_Config5 & (1 << CP0C5_FRE)) {
9998                 ret |= TARGET_PR_FP_MODE_FRE;
9999             }
10000             return ret;
10001         }
10002         case TARGET_PR_SET_FP_MODE:
10003         {
10004             CPUMIPSState *env = ((CPUMIPSState *)cpu_env);
10005             bool old_fr = env->CP0_Status & (1 << CP0St_FR);
10006             bool old_fre = env->CP0_Config5 & (1 << CP0C5_FRE);
10007             bool new_fr = arg2 & TARGET_PR_FP_MODE_FR;
10008             bool new_fre = arg2 & TARGET_PR_FP_MODE_FRE;
10009 
10010             const unsigned int known_bits = TARGET_PR_FP_MODE_FR |
10011                                             TARGET_PR_FP_MODE_FRE;
10012 
10013             /* If nothing to change, return right away, successfully.  */
10014             if (old_fr == new_fr && old_fre == new_fre) {
10015                 return 0;
10016             }
10017             /* Check the value is valid */
10018             if (arg2 & ~known_bits) {
10019                 return -TARGET_EOPNOTSUPP;
10020             }
10021             /* Setting FRE without FR is not supported.  */
10022             if (new_fre && !new_fr) {
10023                 return -TARGET_EOPNOTSUPP;
10024             }
10025             if (new_fr && !(env->active_fpu.fcr0 & (1 << FCR0_F64))) {
10026                 /* FR1 is not supported */
10027                 return -TARGET_EOPNOTSUPP;
10028             }
10029             if (!new_fr && (env->active_fpu.fcr0 & (1 << FCR0_F64))
10030                 && !(env->CP0_Status_rw_bitmask & (1 << CP0St_FR))) {
10031                 /* cannot set FR=0 */
10032                 return -TARGET_EOPNOTSUPP;
10033             }
10034             if (new_fre && !(env->active_fpu.fcr0 & (1 << FCR0_FREP))) {
10035                 /* Cannot set FRE=1 */
10036                 return -TARGET_EOPNOTSUPP;
10037             }
10038 
10039             int i;
10040             fpr_t *fpr = env->active_fpu.fpr;
10041             for (i = 0; i < 32 ; i += 2) {
10042                 if (!old_fr && new_fr) {
10043                     fpr[i].w[!FP_ENDIAN_IDX] = fpr[i + 1].w[FP_ENDIAN_IDX];
10044                 } else if (old_fr && !new_fr) {
10045                     fpr[i + 1].w[FP_ENDIAN_IDX] = fpr[i].w[!FP_ENDIAN_IDX];
10046                 }
10047             }
10048 
10049             if (new_fr) {
10050                 env->CP0_Status |= (1 << CP0St_FR);
10051                 env->hflags |= MIPS_HFLAG_F64;
10052             } else {
10053                 env->CP0_Status &= ~(1 << CP0St_FR);
10054                 env->hflags &= ~MIPS_HFLAG_F64;
10055             }
10056             if (new_fre) {
10057                 env->CP0_Config5 |= (1 << CP0C5_FRE);
10058                 if (env->active_fpu.fcr0 & (1 << FCR0_FREP)) {
10059                     env->hflags |= MIPS_HFLAG_FRE;
10060                 }
10061             } else {
10062                 env->CP0_Config5 &= ~(1 << CP0C5_FRE);
10063                 env->hflags &= ~MIPS_HFLAG_FRE;
10064             }
10065 
10066             return 0;
10067         }
10068 #endif /* MIPS */
10069 #ifdef TARGET_AARCH64
10070         case TARGET_PR_SVE_SET_VL:
10071             /*
10072              * We cannot support either PR_SVE_SET_VL_ONEXEC or
10073              * PR_SVE_VL_INHERIT.  Note the kernel definition
10074              * of sve_vl_valid allows for VQ=512, i.e. VL=8192,
10075              * even though the current architectural maximum is VQ=16.
10076              */
10077             ret = -TARGET_EINVAL;
10078             if (cpu_isar_feature(aa64_sve, env_archcpu(cpu_env))
10079                 && arg2 >= 0 && arg2 <= 512 * 16 && !(arg2 & 15)) {
10080                 CPUARMState *env = cpu_env;
10081                 ARMCPU *cpu = env_archcpu(env);
10082                 uint32_t vq, old_vq;
10083 
10084                 old_vq = (env->vfp.zcr_el[1] & 0xf) + 1;
10085                 vq = MAX(arg2 / 16, 1);
10086                 vq = MIN(vq, cpu->sve_max_vq);
10087 
10088                 if (vq < old_vq) {
10089                     aarch64_sve_narrow_vq(env, vq);
10090                 }
10091                 env->vfp.zcr_el[1] = vq - 1;
10092                 arm_rebuild_hflags(env);
10093                 ret = vq * 16;
10094             }
10095             return ret;
10096         case TARGET_PR_SVE_GET_VL:
10097             ret = -TARGET_EINVAL;
10098             {
10099                 ARMCPU *cpu = env_archcpu(cpu_env);
10100                 if (cpu_isar_feature(aa64_sve, cpu)) {
10101                     ret = ((cpu->env.vfp.zcr_el[1] & 0xf) + 1) * 16;
10102                 }
10103             }
10104             return ret;
10105         case TARGET_PR_PAC_RESET_KEYS:
10106             {
10107                 CPUARMState *env = cpu_env;
10108                 ARMCPU *cpu = env_archcpu(env);
10109 
10110                 if (arg3 || arg4 || arg5) {
10111                     return -TARGET_EINVAL;
10112                 }
10113                 if (cpu_isar_feature(aa64_pauth, cpu)) {
10114                     int all = (TARGET_PR_PAC_APIAKEY | TARGET_PR_PAC_APIBKEY |
10115                                TARGET_PR_PAC_APDAKEY | TARGET_PR_PAC_APDBKEY |
10116                                TARGET_PR_PAC_APGAKEY);
10117                     int ret = 0;
10118                     Error *err = NULL;
10119 
10120                     if (arg2 == 0) {
10121                         arg2 = all;
10122                     } else if (arg2 & ~all) {
10123                         return -TARGET_EINVAL;
10124                     }
10125                     if (arg2 & TARGET_PR_PAC_APIAKEY) {
10126                         ret |= qemu_guest_getrandom(&env->keys.apia,
10127                                                     sizeof(ARMPACKey), &err);
10128                     }
10129                     if (arg2 & TARGET_PR_PAC_APIBKEY) {
10130                         ret |= qemu_guest_getrandom(&env->keys.apib,
10131                                                     sizeof(ARMPACKey), &err);
10132                     }
10133                     if (arg2 & TARGET_PR_PAC_APDAKEY) {
10134                         ret |= qemu_guest_getrandom(&env->keys.apda,
10135                                                     sizeof(ARMPACKey), &err);
10136                     }
10137                     if (arg2 & TARGET_PR_PAC_APDBKEY) {
10138                         ret |= qemu_guest_getrandom(&env->keys.apdb,
10139                                                     sizeof(ARMPACKey), &err);
10140                     }
10141                     if (arg2 & TARGET_PR_PAC_APGAKEY) {
10142                         ret |= qemu_guest_getrandom(&env->keys.apga,
10143                                                     sizeof(ARMPACKey), &err);
10144                     }
10145                     if (ret != 0) {
10146                         /*
10147                          * Some unknown failure in the crypto.  The best
10148                          * we can do is log it and fail the syscall.
10149                          * The real syscall cannot fail this way.
10150                          */
10151                         qemu_log_mask(LOG_UNIMP,
10152                                       "PR_PAC_RESET_KEYS: Crypto failure: %s",
10153                                       error_get_pretty(err));
10154                         error_free(err);
10155                         return -TARGET_EIO;
10156                     }
10157                     return 0;
10158                 }
10159             }
10160             return -TARGET_EINVAL;
10161 #endif /* AARCH64 */
10162         case PR_GET_SECCOMP:
10163         case PR_SET_SECCOMP:
10164             /* Disable seccomp to prevent the target disabling syscalls we
10165              * need. */
10166             return -TARGET_EINVAL;
10167         default:
10168             /* Most prctl options have no pointer arguments */
10169             return get_errno(prctl(arg1, arg2, arg3, arg4, arg5));
10170         }
10171         break;
10172 #ifdef TARGET_NR_arch_prctl
10173     case TARGET_NR_arch_prctl:
10174 #if defined(TARGET_I386) && !defined(TARGET_ABI32)
10175         return do_arch_prctl(cpu_env, arg1, arg2);
10176 #else
10177 #error unreachable
10178 #endif
10179 #endif
10180 #ifdef TARGET_NR_pread64
10181     case TARGET_NR_pread64:
10182         if (regpairs_aligned(cpu_env, num)) {
10183             arg4 = arg5;
10184             arg5 = arg6;
10185         }
10186         if (arg2 == 0 && arg3 == 0) {
10187             /* Special-case NULL buffer and zero length, which should succeed */
10188             p = 0;
10189         } else {
10190             p = lock_user(VERIFY_WRITE, arg2, arg3, 0);
10191             if (!p) {
10192                 return -TARGET_EFAULT;
10193             }
10194         }
10195         ret = get_errno(pread64(arg1, p, arg3, target_offset64(arg4, arg5)));
10196         unlock_user(p, arg2, ret);
10197         return ret;
10198     case TARGET_NR_pwrite64:
10199         if (regpairs_aligned(cpu_env, num)) {
10200             arg4 = arg5;
10201             arg5 = arg6;
10202         }
10203         if (arg2 == 0 && arg3 == 0) {
10204             /* Special-case NULL buffer and zero length, which should succeed */
10205             p = 0;
10206         } else {
10207             p = lock_user(VERIFY_READ, arg2, arg3, 1);
10208             if (!p) {
10209                 return -TARGET_EFAULT;
10210             }
10211         }
10212         ret = get_errno(pwrite64(arg1, p, arg3, target_offset64(arg4, arg5)));
10213         unlock_user(p, arg2, 0);
10214         return ret;
10215 #endif
10216     case TARGET_NR_getcwd:
10217         if (!(p = lock_user(VERIFY_WRITE, arg1, arg2, 0)))
10218             return -TARGET_EFAULT;
10219         ret = get_errno(sys_getcwd1(p, arg2));
10220         unlock_user(p, arg1, ret);
10221         return ret;
10222     case TARGET_NR_capget:
10223     case TARGET_NR_capset:
10224     {
10225         struct target_user_cap_header *target_header;
10226         struct target_user_cap_data *target_data = NULL;
10227         struct __user_cap_header_struct header;
10228         struct __user_cap_data_struct data[2];
10229         struct __user_cap_data_struct *dataptr = NULL;
10230         int i, target_datalen;
10231         int data_items = 1;
10232 
10233         if (!lock_user_struct(VERIFY_WRITE, target_header, arg1, 1)) {
10234             return -TARGET_EFAULT;
10235         }
10236         header.version = tswap32(target_header->version);
10237         header.pid = tswap32(target_header->pid);
10238 
10239         if (header.version != _LINUX_CAPABILITY_VERSION) {
10240             /* Version 2 and up takes pointer to two user_data structs */
10241             data_items = 2;
10242         }
10243 
10244         target_datalen = sizeof(*target_data) * data_items;
10245 
10246         if (arg2) {
10247             if (num == TARGET_NR_capget) {
10248                 target_data = lock_user(VERIFY_WRITE, arg2, target_datalen, 0);
10249             } else {
10250                 target_data = lock_user(VERIFY_READ, arg2, target_datalen, 1);
10251             }
10252             if (!target_data) {
10253                 unlock_user_struct(target_header, arg1, 0);
10254                 return -TARGET_EFAULT;
10255             }
10256 
10257             if (num == TARGET_NR_capset) {
10258                 for (i = 0; i < data_items; i++) {
10259                     data[i].effective = tswap32(target_data[i].effective);
10260                     data[i].permitted = tswap32(target_data[i].permitted);
10261                     data[i].inheritable = tswap32(target_data[i].inheritable);
10262                 }
10263             }
10264 
10265             dataptr = data;
10266         }
10267 
10268         if (num == TARGET_NR_capget) {
10269             ret = get_errno(capget(&header, dataptr));
10270         } else {
10271             ret = get_errno(capset(&header, dataptr));
10272         }
10273 
10274         /* The kernel always updates version for both capget and capset */
10275         target_header->version = tswap32(header.version);
10276         unlock_user_struct(target_header, arg1, 1);
10277 
10278         if (arg2) {
10279             if (num == TARGET_NR_capget) {
10280                 for (i = 0; i < data_items; i++) {
10281                     target_data[i].effective = tswap32(data[i].effective);
10282                     target_data[i].permitted = tswap32(data[i].permitted);
10283                     target_data[i].inheritable = tswap32(data[i].inheritable);
10284                 }
10285                 unlock_user(target_data, arg2, target_datalen);
10286             } else {
10287                 unlock_user(target_data, arg2, 0);
10288             }
10289         }
10290         return ret;
10291     }
10292     case TARGET_NR_sigaltstack:
10293         return do_sigaltstack(arg1, arg2,
10294                               get_sp_from_cpustate((CPUArchState *)cpu_env));
10295 
10296 #ifdef CONFIG_SENDFILE
10297 #ifdef TARGET_NR_sendfile
10298     case TARGET_NR_sendfile:
10299     {
10300         off_t *offp = NULL;
10301         off_t off;
10302         if (arg3) {
10303             ret = get_user_sal(off, arg3);
10304             if (is_error(ret)) {
10305                 return ret;
10306             }
10307             offp = &off;
10308         }
10309         ret = get_errno(sendfile(arg1, arg2, offp, arg4));
10310         if (!is_error(ret) && arg3) {
10311             abi_long ret2 = put_user_sal(off, arg3);
10312             if (is_error(ret2)) {
10313                 ret = ret2;
10314             }
10315         }
10316         return ret;
10317     }
10318 #endif
10319 #ifdef TARGET_NR_sendfile64
10320     case TARGET_NR_sendfile64:
10321     {
10322         off_t *offp = NULL;
10323         off_t off;
10324         if (arg3) {
10325             ret = get_user_s64(off, arg3);
10326             if (is_error(ret)) {
10327                 return ret;
10328             }
10329             offp = &off;
10330         }
10331         ret = get_errno(sendfile(arg1, arg2, offp, arg4));
10332         if (!is_error(ret) && arg3) {
10333             abi_long ret2 = put_user_s64(off, arg3);
10334             if (is_error(ret2)) {
10335                 ret = ret2;
10336             }
10337         }
10338         return ret;
10339     }
10340 #endif
10341 #endif
10342 #ifdef TARGET_NR_vfork
10343     case TARGET_NR_vfork:
10344         return get_errno(do_fork(cpu_env,
10345                          CLONE_VFORK | CLONE_VM | TARGET_SIGCHLD,
10346                          0, 0, 0, 0));
10347 #endif
10348 #ifdef TARGET_NR_ugetrlimit
10349     case TARGET_NR_ugetrlimit:
10350     {
10351 	struct rlimit rlim;
10352 	int resource = target_to_host_resource(arg1);
10353 	ret = get_errno(getrlimit(resource, &rlim));
10354 	if (!is_error(ret)) {
10355 	    struct target_rlimit *target_rlim;
10356             if (!lock_user_struct(VERIFY_WRITE, target_rlim, arg2, 0))
10357                 return -TARGET_EFAULT;
10358 	    target_rlim->rlim_cur = host_to_target_rlim(rlim.rlim_cur);
10359 	    target_rlim->rlim_max = host_to_target_rlim(rlim.rlim_max);
10360             unlock_user_struct(target_rlim, arg2, 1);
10361 	}
10362         return ret;
10363     }
10364 #endif
10365 #ifdef TARGET_NR_truncate64
10366     case TARGET_NR_truncate64:
10367         if (!(p = lock_user_string(arg1)))
10368             return -TARGET_EFAULT;
10369 	ret = target_truncate64(cpu_env, p, arg2, arg3, arg4);
10370         unlock_user(p, arg1, 0);
10371         return ret;
10372 #endif
10373 #ifdef TARGET_NR_ftruncate64
10374     case TARGET_NR_ftruncate64:
10375         return target_ftruncate64(cpu_env, arg1, arg2, arg3, arg4);
10376 #endif
10377 #ifdef TARGET_NR_stat64
10378     case TARGET_NR_stat64:
10379         if (!(p = lock_user_string(arg1))) {
10380             return -TARGET_EFAULT;
10381         }
10382         ret = get_errno(stat(path(p), &st));
10383         unlock_user(p, arg1, 0);
10384         if (!is_error(ret))
10385             ret = host_to_target_stat64(cpu_env, arg2, &st);
10386         return ret;
10387 #endif
10388 #ifdef TARGET_NR_lstat64
10389     case TARGET_NR_lstat64:
10390         if (!(p = lock_user_string(arg1))) {
10391             return -TARGET_EFAULT;
10392         }
10393         ret = get_errno(lstat(path(p), &st));
10394         unlock_user(p, arg1, 0);
10395         if (!is_error(ret))
10396             ret = host_to_target_stat64(cpu_env, arg2, &st);
10397         return ret;
10398 #endif
10399 #ifdef TARGET_NR_fstat64
10400     case TARGET_NR_fstat64:
10401         ret = get_errno(fstat(arg1, &st));
10402         if (!is_error(ret))
10403             ret = host_to_target_stat64(cpu_env, arg2, &st);
10404         return ret;
10405 #endif
10406 #if (defined(TARGET_NR_fstatat64) || defined(TARGET_NR_newfstatat))
10407 #ifdef TARGET_NR_fstatat64
10408     case TARGET_NR_fstatat64:
10409 #endif
10410 #ifdef TARGET_NR_newfstatat
10411     case TARGET_NR_newfstatat:
10412 #endif
10413         if (!(p = lock_user_string(arg2))) {
10414             return -TARGET_EFAULT;
10415         }
10416         ret = get_errno(fstatat(arg1, path(p), &st, arg4));
10417         unlock_user(p, arg2, 0);
10418         if (!is_error(ret))
10419             ret = host_to_target_stat64(cpu_env, arg3, &st);
10420         return ret;
10421 #endif
10422 #if defined(TARGET_NR_statx)
10423     case TARGET_NR_statx:
10424         {
10425             struct target_statx *target_stx;
10426             int dirfd = arg1;
10427             int flags = arg3;
10428 
10429             p = lock_user_string(arg2);
10430             if (p == NULL) {
10431                 return -TARGET_EFAULT;
10432             }
10433 #if defined(__NR_statx)
10434             {
10435                 /*
10436                  * It is assumed that struct statx is architecture independent.
10437                  */
10438                 struct target_statx host_stx;
10439                 int mask = arg4;
10440 
10441                 ret = get_errno(sys_statx(dirfd, p, flags, mask, &host_stx));
10442                 if (!is_error(ret)) {
10443                     if (host_to_target_statx(&host_stx, arg5) != 0) {
10444                         unlock_user(p, arg2, 0);
10445                         return -TARGET_EFAULT;
10446                     }
10447                 }
10448 
10449                 if (ret != -TARGET_ENOSYS) {
10450                     unlock_user(p, arg2, 0);
10451                     return ret;
10452                 }
10453             }
10454 #endif
10455             ret = get_errno(fstatat(dirfd, path(p), &st, flags));
10456             unlock_user(p, arg2, 0);
10457 
10458             if (!is_error(ret)) {
10459                 if (!lock_user_struct(VERIFY_WRITE, target_stx, arg5, 0)) {
10460                     return -TARGET_EFAULT;
10461                 }
10462                 memset(target_stx, 0, sizeof(*target_stx));
10463                 __put_user(major(st.st_dev), &target_stx->stx_dev_major);
10464                 __put_user(minor(st.st_dev), &target_stx->stx_dev_minor);
10465                 __put_user(st.st_ino, &target_stx->stx_ino);
10466                 __put_user(st.st_mode, &target_stx->stx_mode);
10467                 __put_user(st.st_uid, &target_stx->stx_uid);
10468                 __put_user(st.st_gid, &target_stx->stx_gid);
10469                 __put_user(st.st_nlink, &target_stx->stx_nlink);
10470                 __put_user(major(st.st_rdev), &target_stx->stx_rdev_major);
10471                 __put_user(minor(st.st_rdev), &target_stx->stx_rdev_minor);
10472                 __put_user(st.st_size, &target_stx->stx_size);
10473                 __put_user(st.st_blksize, &target_stx->stx_blksize);
10474                 __put_user(st.st_blocks, &target_stx->stx_blocks);
10475                 __put_user(st.st_atime, &target_stx->stx_atime.tv_sec);
10476                 __put_user(st.st_mtime, &target_stx->stx_mtime.tv_sec);
10477                 __put_user(st.st_ctime, &target_stx->stx_ctime.tv_sec);
10478                 unlock_user_struct(target_stx, arg5, 1);
10479             }
10480         }
10481         return ret;
10482 #endif
10483 #ifdef TARGET_NR_lchown
10484     case TARGET_NR_lchown:
10485         if (!(p = lock_user_string(arg1)))
10486             return -TARGET_EFAULT;
10487         ret = get_errno(lchown(p, low2highuid(arg2), low2highgid(arg3)));
10488         unlock_user(p, arg1, 0);
10489         return ret;
10490 #endif
10491 #ifdef TARGET_NR_getuid
10492     case TARGET_NR_getuid:
10493         return get_errno(high2lowuid(getuid()));
10494 #endif
10495 #ifdef TARGET_NR_getgid
10496     case TARGET_NR_getgid:
10497         return get_errno(high2lowgid(getgid()));
10498 #endif
10499 #ifdef TARGET_NR_geteuid
10500     case TARGET_NR_geteuid:
10501         return get_errno(high2lowuid(geteuid()));
10502 #endif
10503 #ifdef TARGET_NR_getegid
10504     case TARGET_NR_getegid:
10505         return get_errno(high2lowgid(getegid()));
10506 #endif
10507     case TARGET_NR_setreuid:
10508         return get_errno(setreuid(low2highuid(arg1), low2highuid(arg2)));
10509     case TARGET_NR_setregid:
10510         return get_errno(setregid(low2highgid(arg1), low2highgid(arg2)));
10511     case TARGET_NR_getgroups:
10512         {
10513             int gidsetsize = arg1;
10514             target_id *target_grouplist;
10515             gid_t *grouplist;
10516             int i;
10517 
10518             grouplist = alloca(gidsetsize * sizeof(gid_t));
10519             ret = get_errno(getgroups(gidsetsize, grouplist));
10520             if (gidsetsize == 0)
10521                 return ret;
10522             if (!is_error(ret)) {
10523                 target_grouplist = lock_user(VERIFY_WRITE, arg2, gidsetsize * sizeof(target_id), 0);
10524                 if (!target_grouplist)
10525                     return -TARGET_EFAULT;
10526                 for(i = 0;i < ret; i++)
10527                     target_grouplist[i] = tswapid(high2lowgid(grouplist[i]));
10528                 unlock_user(target_grouplist, arg2, gidsetsize * sizeof(target_id));
10529             }
10530         }
10531         return ret;
10532     case TARGET_NR_setgroups:
10533         {
10534             int gidsetsize = arg1;
10535             target_id *target_grouplist;
10536             gid_t *grouplist = NULL;
10537             int i;
10538             if (gidsetsize) {
10539                 grouplist = alloca(gidsetsize * sizeof(gid_t));
10540                 target_grouplist = lock_user(VERIFY_READ, arg2, gidsetsize * sizeof(target_id), 1);
10541                 if (!target_grouplist) {
10542                     return -TARGET_EFAULT;
10543                 }
10544                 for (i = 0; i < gidsetsize; i++) {
10545                     grouplist[i] = low2highgid(tswapid(target_grouplist[i]));
10546                 }
10547                 unlock_user(target_grouplist, arg2, 0);
10548             }
10549             return get_errno(setgroups(gidsetsize, grouplist));
10550         }
10551     case TARGET_NR_fchown:
10552         return get_errno(fchown(arg1, low2highuid(arg2), low2highgid(arg3)));
10553 #if defined(TARGET_NR_fchownat)
10554     case TARGET_NR_fchownat:
10555         if (!(p = lock_user_string(arg2)))
10556             return -TARGET_EFAULT;
10557         ret = get_errno(fchownat(arg1, p, low2highuid(arg3),
10558                                  low2highgid(arg4), arg5));
10559         unlock_user(p, arg2, 0);
10560         return ret;
10561 #endif
10562 #ifdef TARGET_NR_setresuid
10563     case TARGET_NR_setresuid:
10564         return get_errno(sys_setresuid(low2highuid(arg1),
10565                                        low2highuid(arg2),
10566                                        low2highuid(arg3)));
10567 #endif
10568 #ifdef TARGET_NR_getresuid
10569     case TARGET_NR_getresuid:
10570         {
10571             uid_t ruid, euid, suid;
10572             ret = get_errno(getresuid(&ruid, &euid, &suid));
10573             if (!is_error(ret)) {
10574                 if (put_user_id(high2lowuid(ruid), arg1)
10575                     || put_user_id(high2lowuid(euid), arg2)
10576                     || put_user_id(high2lowuid(suid), arg3))
10577                     return -TARGET_EFAULT;
10578             }
10579         }
10580         return ret;
10581 #endif
10582 #ifdef TARGET_NR_getresgid
10583     case TARGET_NR_setresgid:
10584         return get_errno(sys_setresgid(low2highgid(arg1),
10585                                        low2highgid(arg2),
10586                                        low2highgid(arg3)));
10587 #endif
10588 #ifdef TARGET_NR_getresgid
10589     case TARGET_NR_getresgid:
10590         {
10591             gid_t rgid, egid, sgid;
10592             ret = get_errno(getresgid(&rgid, &egid, &sgid));
10593             if (!is_error(ret)) {
10594                 if (put_user_id(high2lowgid(rgid), arg1)
10595                     || put_user_id(high2lowgid(egid), arg2)
10596                     || put_user_id(high2lowgid(sgid), arg3))
10597                     return -TARGET_EFAULT;
10598             }
10599         }
10600         return ret;
10601 #endif
10602 #ifdef TARGET_NR_chown
10603     case TARGET_NR_chown:
10604         if (!(p = lock_user_string(arg1)))
10605             return -TARGET_EFAULT;
10606         ret = get_errno(chown(p, low2highuid(arg2), low2highgid(arg3)));
10607         unlock_user(p, arg1, 0);
10608         return ret;
10609 #endif
10610     case TARGET_NR_setuid:
10611         return get_errno(sys_setuid(low2highuid(arg1)));
10612     case TARGET_NR_setgid:
10613         return get_errno(sys_setgid(low2highgid(arg1)));
10614     case TARGET_NR_setfsuid:
10615         return get_errno(setfsuid(arg1));
10616     case TARGET_NR_setfsgid:
10617         return get_errno(setfsgid(arg1));
10618 
10619 #ifdef TARGET_NR_lchown32
10620     case TARGET_NR_lchown32:
10621         if (!(p = lock_user_string(arg1)))
10622             return -TARGET_EFAULT;
10623         ret = get_errno(lchown(p, arg2, arg3));
10624         unlock_user(p, arg1, 0);
10625         return ret;
10626 #endif
10627 #ifdef TARGET_NR_getuid32
10628     case TARGET_NR_getuid32:
10629         return get_errno(getuid());
10630 #endif
10631 
10632 #if defined(TARGET_NR_getxuid) && defined(TARGET_ALPHA)
10633    /* Alpha specific */
10634     case TARGET_NR_getxuid:
10635          {
10636             uid_t euid;
10637             euid=geteuid();
10638             ((CPUAlphaState *)cpu_env)->ir[IR_A4]=euid;
10639          }
10640         return get_errno(getuid());
10641 #endif
10642 #if defined(TARGET_NR_getxgid) && defined(TARGET_ALPHA)
10643    /* Alpha specific */
10644     case TARGET_NR_getxgid:
10645          {
10646             uid_t egid;
10647             egid=getegid();
10648             ((CPUAlphaState *)cpu_env)->ir[IR_A4]=egid;
10649          }
10650         return get_errno(getgid());
10651 #endif
10652 #if defined(TARGET_NR_osf_getsysinfo) && defined(TARGET_ALPHA)
10653     /* Alpha specific */
10654     case TARGET_NR_osf_getsysinfo:
10655         ret = -TARGET_EOPNOTSUPP;
10656         switch (arg1) {
10657           case TARGET_GSI_IEEE_FP_CONTROL:
10658             {
10659                 uint64_t fpcr = cpu_alpha_load_fpcr(cpu_env);
10660                 uint64_t swcr = ((CPUAlphaState *)cpu_env)->swcr;
10661 
10662                 swcr &= ~SWCR_STATUS_MASK;
10663                 swcr |= (fpcr >> 35) & SWCR_STATUS_MASK;
10664 
10665                 if (put_user_u64 (swcr, arg2))
10666                         return -TARGET_EFAULT;
10667                 ret = 0;
10668             }
10669             break;
10670 
10671           /* case GSI_IEEE_STATE_AT_SIGNAL:
10672              -- Not implemented in linux kernel.
10673              case GSI_UACPROC:
10674              -- Retrieves current unaligned access state; not much used.
10675              case GSI_PROC_TYPE:
10676              -- Retrieves implver information; surely not used.
10677              case GSI_GET_HWRPB:
10678              -- Grabs a copy of the HWRPB; surely not used.
10679           */
10680         }
10681         return ret;
10682 #endif
10683 #if defined(TARGET_NR_osf_setsysinfo) && defined(TARGET_ALPHA)
10684     /* Alpha specific */
10685     case TARGET_NR_osf_setsysinfo:
10686         ret = -TARGET_EOPNOTSUPP;
10687         switch (arg1) {
10688           case TARGET_SSI_IEEE_FP_CONTROL:
10689             {
10690                 uint64_t swcr, fpcr;
10691 
10692                 if (get_user_u64 (swcr, arg2)) {
10693                     return -TARGET_EFAULT;
10694                 }
10695 
10696                 /*
10697                  * The kernel calls swcr_update_status to update the
10698                  * status bits from the fpcr at every point that it
10699                  * could be queried.  Therefore, we store the status
10700                  * bits only in FPCR.
10701                  */
10702                 ((CPUAlphaState *)cpu_env)->swcr
10703                     = swcr & (SWCR_TRAP_ENABLE_MASK | SWCR_MAP_MASK);
10704 
10705                 fpcr = cpu_alpha_load_fpcr(cpu_env);
10706                 fpcr &= ((uint64_t)FPCR_DYN_MASK << 32);
10707                 fpcr |= alpha_ieee_swcr_to_fpcr(swcr);
10708                 cpu_alpha_store_fpcr(cpu_env, fpcr);
10709                 ret = 0;
10710             }
10711             break;
10712 
10713           case TARGET_SSI_IEEE_RAISE_EXCEPTION:
10714             {
10715                 uint64_t exc, fpcr, fex;
10716 
10717                 if (get_user_u64(exc, arg2)) {
10718                     return -TARGET_EFAULT;
10719                 }
10720                 exc &= SWCR_STATUS_MASK;
10721                 fpcr = cpu_alpha_load_fpcr(cpu_env);
10722 
10723                 /* Old exceptions are not signaled.  */
10724                 fex = alpha_ieee_fpcr_to_swcr(fpcr);
10725                 fex = exc & ~fex;
10726                 fex >>= SWCR_STATUS_TO_EXCSUM_SHIFT;
10727                 fex &= ((CPUArchState *)cpu_env)->swcr;
10728 
10729                 /* Update the hardware fpcr.  */
10730                 fpcr |= alpha_ieee_swcr_to_fpcr(exc);
10731                 cpu_alpha_store_fpcr(cpu_env, fpcr);
10732 
10733                 if (fex) {
10734                     int si_code = TARGET_FPE_FLTUNK;
10735                     target_siginfo_t info;
10736 
10737                     if (fex & SWCR_TRAP_ENABLE_DNO) {
10738                         si_code = TARGET_FPE_FLTUND;
10739                     }
10740                     if (fex & SWCR_TRAP_ENABLE_INE) {
10741                         si_code = TARGET_FPE_FLTRES;
10742                     }
10743                     if (fex & SWCR_TRAP_ENABLE_UNF) {
10744                         si_code = TARGET_FPE_FLTUND;
10745                     }
10746                     if (fex & SWCR_TRAP_ENABLE_OVF) {
10747                         si_code = TARGET_FPE_FLTOVF;
10748                     }
10749                     if (fex & SWCR_TRAP_ENABLE_DZE) {
10750                         si_code = TARGET_FPE_FLTDIV;
10751                     }
10752                     if (fex & SWCR_TRAP_ENABLE_INV) {
10753                         si_code = TARGET_FPE_FLTINV;
10754                     }
10755 
10756                     info.si_signo = SIGFPE;
10757                     info.si_errno = 0;
10758                     info.si_code = si_code;
10759                     info._sifields._sigfault._addr
10760                         = ((CPUArchState *)cpu_env)->pc;
10761                     queue_signal((CPUArchState *)cpu_env, info.si_signo,
10762                                  QEMU_SI_FAULT, &info);
10763                 }
10764                 ret = 0;
10765             }
10766             break;
10767 
10768           /* case SSI_NVPAIRS:
10769              -- Used with SSIN_UACPROC to enable unaligned accesses.
10770              case SSI_IEEE_STATE_AT_SIGNAL:
10771              case SSI_IEEE_IGNORE_STATE_AT_SIGNAL:
10772              -- Not implemented in linux kernel
10773           */
10774         }
10775         return ret;
10776 #endif
10777 #ifdef TARGET_NR_osf_sigprocmask
10778     /* Alpha specific.  */
10779     case TARGET_NR_osf_sigprocmask:
10780         {
10781             abi_ulong mask;
10782             int how;
10783             sigset_t set, oldset;
10784 
10785             switch(arg1) {
10786             case TARGET_SIG_BLOCK:
10787                 how = SIG_BLOCK;
10788                 break;
10789             case TARGET_SIG_UNBLOCK:
10790                 how = SIG_UNBLOCK;
10791                 break;
10792             case TARGET_SIG_SETMASK:
10793                 how = SIG_SETMASK;
10794                 break;
10795             default:
10796                 return -TARGET_EINVAL;
10797             }
10798             mask = arg2;
10799             target_to_host_old_sigset(&set, &mask);
10800             ret = do_sigprocmask(how, &set, &oldset);
10801             if (!ret) {
10802                 host_to_target_old_sigset(&mask, &oldset);
10803                 ret = mask;
10804             }
10805         }
10806         return ret;
10807 #endif
10808 
10809 #ifdef TARGET_NR_getgid32
10810     case TARGET_NR_getgid32:
10811         return get_errno(getgid());
10812 #endif
10813 #ifdef TARGET_NR_geteuid32
10814     case TARGET_NR_geteuid32:
10815         return get_errno(geteuid());
10816 #endif
10817 #ifdef TARGET_NR_getegid32
10818     case TARGET_NR_getegid32:
10819         return get_errno(getegid());
10820 #endif
10821 #ifdef TARGET_NR_setreuid32
10822     case TARGET_NR_setreuid32:
10823         return get_errno(setreuid(arg1, arg2));
10824 #endif
10825 #ifdef TARGET_NR_setregid32
10826     case TARGET_NR_setregid32:
10827         return get_errno(setregid(arg1, arg2));
10828 #endif
10829 #ifdef TARGET_NR_getgroups32
10830     case TARGET_NR_getgroups32:
10831         {
10832             int gidsetsize = arg1;
10833             uint32_t *target_grouplist;
10834             gid_t *grouplist;
10835             int i;
10836 
10837             grouplist = alloca(gidsetsize * sizeof(gid_t));
10838             ret = get_errno(getgroups(gidsetsize, grouplist));
10839             if (gidsetsize == 0)
10840                 return ret;
10841             if (!is_error(ret)) {
10842                 target_grouplist = lock_user(VERIFY_WRITE, arg2, gidsetsize * 4, 0);
10843                 if (!target_grouplist) {
10844                     return -TARGET_EFAULT;
10845                 }
10846                 for(i = 0;i < ret; i++)
10847                     target_grouplist[i] = tswap32(grouplist[i]);
10848                 unlock_user(target_grouplist, arg2, gidsetsize * 4);
10849             }
10850         }
10851         return ret;
10852 #endif
10853 #ifdef TARGET_NR_setgroups32
10854     case TARGET_NR_setgroups32:
10855         {
10856             int gidsetsize = arg1;
10857             uint32_t *target_grouplist;
10858             gid_t *grouplist;
10859             int i;
10860 
10861             grouplist = alloca(gidsetsize * sizeof(gid_t));
10862             target_grouplist = lock_user(VERIFY_READ, arg2, gidsetsize * 4, 1);
10863             if (!target_grouplist) {
10864                 return -TARGET_EFAULT;
10865             }
10866             for(i = 0;i < gidsetsize; i++)
10867                 grouplist[i] = tswap32(target_grouplist[i]);
10868             unlock_user(target_grouplist, arg2, 0);
10869             return get_errno(setgroups(gidsetsize, grouplist));
10870         }
10871 #endif
10872 #ifdef TARGET_NR_fchown32
10873     case TARGET_NR_fchown32:
10874         return get_errno(fchown(arg1, arg2, arg3));
10875 #endif
10876 #ifdef TARGET_NR_setresuid32
10877     case TARGET_NR_setresuid32:
10878         return get_errno(sys_setresuid(arg1, arg2, arg3));
10879 #endif
10880 #ifdef TARGET_NR_getresuid32
10881     case TARGET_NR_getresuid32:
10882         {
10883             uid_t ruid, euid, suid;
10884             ret = get_errno(getresuid(&ruid, &euid, &suid));
10885             if (!is_error(ret)) {
10886                 if (put_user_u32(ruid, arg1)
10887                     || put_user_u32(euid, arg2)
10888                     || put_user_u32(suid, arg3))
10889                     return -TARGET_EFAULT;
10890             }
10891         }
10892         return ret;
10893 #endif
10894 #ifdef TARGET_NR_setresgid32
10895     case TARGET_NR_setresgid32:
10896         return get_errno(sys_setresgid(arg1, arg2, arg3));
10897 #endif
10898 #ifdef TARGET_NR_getresgid32
10899     case TARGET_NR_getresgid32:
10900         {
10901             gid_t rgid, egid, sgid;
10902             ret = get_errno(getresgid(&rgid, &egid, &sgid));
10903             if (!is_error(ret)) {
10904                 if (put_user_u32(rgid, arg1)
10905                     || put_user_u32(egid, arg2)
10906                     || put_user_u32(sgid, arg3))
10907                     return -TARGET_EFAULT;
10908             }
10909         }
10910         return ret;
10911 #endif
10912 #ifdef TARGET_NR_chown32
10913     case TARGET_NR_chown32:
10914         if (!(p = lock_user_string(arg1)))
10915             return -TARGET_EFAULT;
10916         ret = get_errno(chown(p, arg2, arg3));
10917         unlock_user(p, arg1, 0);
10918         return ret;
10919 #endif
10920 #ifdef TARGET_NR_setuid32
10921     case TARGET_NR_setuid32:
10922         return get_errno(sys_setuid(arg1));
10923 #endif
10924 #ifdef TARGET_NR_setgid32
10925     case TARGET_NR_setgid32:
10926         return get_errno(sys_setgid(arg1));
10927 #endif
10928 #ifdef TARGET_NR_setfsuid32
10929     case TARGET_NR_setfsuid32:
10930         return get_errno(setfsuid(arg1));
10931 #endif
10932 #ifdef TARGET_NR_setfsgid32
10933     case TARGET_NR_setfsgid32:
10934         return get_errno(setfsgid(arg1));
10935 #endif
10936 #ifdef TARGET_NR_mincore
10937     case TARGET_NR_mincore:
10938         {
10939             void *a = lock_user(VERIFY_READ, arg1, arg2, 0);
10940             if (!a) {
10941                 return -TARGET_ENOMEM;
10942             }
10943             p = lock_user_string(arg3);
10944             if (!p) {
10945                 ret = -TARGET_EFAULT;
10946             } else {
10947                 ret = get_errno(mincore(a, arg2, p));
10948                 unlock_user(p, arg3, ret);
10949             }
10950             unlock_user(a, arg1, 0);
10951         }
10952         return ret;
10953 #endif
10954 #ifdef TARGET_NR_arm_fadvise64_64
10955     case TARGET_NR_arm_fadvise64_64:
10956         /* arm_fadvise64_64 looks like fadvise64_64 but
10957          * with different argument order: fd, advice, offset, len
10958          * rather than the usual fd, offset, len, advice.
10959          * Note that offset and len are both 64-bit so appear as
10960          * pairs of 32-bit registers.
10961          */
10962         ret = posix_fadvise(arg1, target_offset64(arg3, arg4),
10963                             target_offset64(arg5, arg6), arg2);
10964         return -host_to_target_errno(ret);
10965 #endif
10966 
10967 #if TARGET_ABI_BITS == 32
10968 
10969 #ifdef TARGET_NR_fadvise64_64
10970     case TARGET_NR_fadvise64_64:
10971 #if defined(TARGET_PPC) || defined(TARGET_XTENSA)
10972         /* 6 args: fd, advice, offset (high, low), len (high, low) */
10973         ret = arg2;
10974         arg2 = arg3;
10975         arg3 = arg4;
10976         arg4 = arg5;
10977         arg5 = arg6;
10978         arg6 = ret;
10979 #else
10980         /* 6 args: fd, offset (high, low), len (high, low), advice */
10981         if (regpairs_aligned(cpu_env, num)) {
10982             /* offset is in (3,4), len in (5,6) and advice in 7 */
10983             arg2 = arg3;
10984             arg3 = arg4;
10985             arg4 = arg5;
10986             arg5 = arg6;
10987             arg6 = arg7;
10988         }
10989 #endif
10990         ret = posix_fadvise(arg1, target_offset64(arg2, arg3),
10991                             target_offset64(arg4, arg5), arg6);
10992         return -host_to_target_errno(ret);
10993 #endif
10994 
10995 #ifdef TARGET_NR_fadvise64
10996     case TARGET_NR_fadvise64:
10997         /* 5 args: fd, offset (high, low), len, advice */
10998         if (regpairs_aligned(cpu_env, num)) {
10999             /* offset is in (3,4), len in 5 and advice in 6 */
11000             arg2 = arg3;
11001             arg3 = arg4;
11002             arg4 = arg5;
11003             arg5 = arg6;
11004         }
11005         ret = posix_fadvise(arg1, target_offset64(arg2, arg3), arg4, arg5);
11006         return -host_to_target_errno(ret);
11007 #endif
11008 
11009 #else /* not a 32-bit ABI */
11010 #if defined(TARGET_NR_fadvise64_64) || defined(TARGET_NR_fadvise64)
11011 #ifdef TARGET_NR_fadvise64_64
11012     case TARGET_NR_fadvise64_64:
11013 #endif
11014 #ifdef TARGET_NR_fadvise64
11015     case TARGET_NR_fadvise64:
11016 #endif
11017 #ifdef TARGET_S390X
11018         switch (arg4) {
11019         case 4: arg4 = POSIX_FADV_NOREUSE + 1; break; /* make sure it's an invalid value */
11020         case 5: arg4 = POSIX_FADV_NOREUSE + 2; break; /* ditto */
11021         case 6: arg4 = POSIX_FADV_DONTNEED; break;
11022         case 7: arg4 = POSIX_FADV_NOREUSE; break;
11023         default: break;
11024         }
11025 #endif
11026         return -host_to_target_errno(posix_fadvise(arg1, arg2, arg3, arg4));
11027 #endif
11028 #endif /* end of 64-bit ABI fadvise handling */
11029 
11030 #ifdef TARGET_NR_madvise
11031     case TARGET_NR_madvise:
11032         /* A straight passthrough may not be safe because qemu sometimes
11033            turns private file-backed mappings into anonymous mappings.
11034            This will break MADV_DONTNEED.
11035            This is a hint, so ignoring and returning success is ok.  */
11036         return 0;
11037 #endif
11038 #if TARGET_ABI_BITS == 32
11039     case TARGET_NR_fcntl64:
11040     {
11041 	int cmd;
11042 	struct flock64 fl;
11043         from_flock64_fn *copyfrom = copy_from_user_flock64;
11044         to_flock64_fn *copyto = copy_to_user_flock64;
11045 
11046 #ifdef TARGET_ARM
11047         if (!((CPUARMState *)cpu_env)->eabi) {
11048             copyfrom = copy_from_user_oabi_flock64;
11049             copyto = copy_to_user_oabi_flock64;
11050         }
11051 #endif
11052 
11053 	cmd = target_to_host_fcntl_cmd(arg2);
11054         if (cmd == -TARGET_EINVAL) {
11055             return cmd;
11056         }
11057 
11058         switch(arg2) {
11059         case TARGET_F_GETLK64:
11060             ret = copyfrom(&fl, arg3);
11061             if (ret) {
11062                 break;
11063             }
11064             ret = get_errno(safe_fcntl(arg1, cmd, &fl));
11065             if (ret == 0) {
11066                 ret = copyto(arg3, &fl);
11067             }
11068 	    break;
11069 
11070         case TARGET_F_SETLK64:
11071         case TARGET_F_SETLKW64:
11072             ret = copyfrom(&fl, arg3);
11073             if (ret) {
11074                 break;
11075             }
11076             ret = get_errno(safe_fcntl(arg1, cmd, &fl));
11077 	    break;
11078         default:
11079             ret = do_fcntl(arg1, arg2, arg3);
11080             break;
11081         }
11082         return ret;
11083     }
11084 #endif
11085 #ifdef TARGET_NR_cacheflush
11086     case TARGET_NR_cacheflush:
11087         /* self-modifying code is handled automatically, so nothing needed */
11088         return 0;
11089 #endif
11090 #ifdef TARGET_NR_getpagesize
11091     case TARGET_NR_getpagesize:
11092         return TARGET_PAGE_SIZE;
11093 #endif
11094     case TARGET_NR_gettid:
11095         return get_errno(sys_gettid());
11096 #ifdef TARGET_NR_readahead
11097     case TARGET_NR_readahead:
11098 #if TARGET_ABI_BITS == 32
11099         if (regpairs_aligned(cpu_env, num)) {
11100             arg2 = arg3;
11101             arg3 = arg4;
11102             arg4 = arg5;
11103         }
11104         ret = get_errno(readahead(arg1, target_offset64(arg2, arg3) , arg4));
11105 #else
11106         ret = get_errno(readahead(arg1, arg2, arg3));
11107 #endif
11108         return ret;
11109 #endif
11110 #ifdef CONFIG_ATTR
11111 #ifdef TARGET_NR_setxattr
11112     case TARGET_NR_listxattr:
11113     case TARGET_NR_llistxattr:
11114     {
11115         void *p, *b = 0;
11116         if (arg2) {
11117             b = lock_user(VERIFY_WRITE, arg2, arg3, 0);
11118             if (!b) {
11119                 return -TARGET_EFAULT;
11120             }
11121         }
11122         p = lock_user_string(arg1);
11123         if (p) {
11124             if (num == TARGET_NR_listxattr) {
11125                 ret = get_errno(listxattr(p, b, arg3));
11126             } else {
11127                 ret = get_errno(llistxattr(p, b, arg3));
11128             }
11129         } else {
11130             ret = -TARGET_EFAULT;
11131         }
11132         unlock_user(p, arg1, 0);
11133         unlock_user(b, arg2, arg3);
11134         return ret;
11135     }
11136     case TARGET_NR_flistxattr:
11137     {
11138         void *b = 0;
11139         if (arg2) {
11140             b = lock_user(VERIFY_WRITE, arg2, arg3, 0);
11141             if (!b) {
11142                 return -TARGET_EFAULT;
11143             }
11144         }
11145         ret = get_errno(flistxattr(arg1, b, arg3));
11146         unlock_user(b, arg2, arg3);
11147         return ret;
11148     }
11149     case TARGET_NR_setxattr:
11150     case TARGET_NR_lsetxattr:
11151         {
11152             void *p, *n, *v = 0;
11153             if (arg3) {
11154                 v = lock_user(VERIFY_READ, arg3, arg4, 1);
11155                 if (!v) {
11156                     return -TARGET_EFAULT;
11157                 }
11158             }
11159             p = lock_user_string(arg1);
11160             n = lock_user_string(arg2);
11161             if (p && n) {
11162                 if (num == TARGET_NR_setxattr) {
11163                     ret = get_errno(setxattr(p, n, v, arg4, arg5));
11164                 } else {
11165                     ret = get_errno(lsetxattr(p, n, v, arg4, arg5));
11166                 }
11167             } else {
11168                 ret = -TARGET_EFAULT;
11169             }
11170             unlock_user(p, arg1, 0);
11171             unlock_user(n, arg2, 0);
11172             unlock_user(v, arg3, 0);
11173         }
11174         return ret;
11175     case TARGET_NR_fsetxattr:
11176         {
11177             void *n, *v = 0;
11178             if (arg3) {
11179                 v = lock_user(VERIFY_READ, arg3, arg4, 1);
11180                 if (!v) {
11181                     return -TARGET_EFAULT;
11182                 }
11183             }
11184             n = lock_user_string(arg2);
11185             if (n) {
11186                 ret = get_errno(fsetxattr(arg1, n, v, arg4, arg5));
11187             } else {
11188                 ret = -TARGET_EFAULT;
11189             }
11190             unlock_user(n, arg2, 0);
11191             unlock_user(v, arg3, 0);
11192         }
11193         return ret;
11194     case TARGET_NR_getxattr:
11195     case TARGET_NR_lgetxattr:
11196         {
11197             void *p, *n, *v = 0;
11198             if (arg3) {
11199                 v = lock_user(VERIFY_WRITE, arg3, arg4, 0);
11200                 if (!v) {
11201                     return -TARGET_EFAULT;
11202                 }
11203             }
11204             p = lock_user_string(arg1);
11205             n = lock_user_string(arg2);
11206             if (p && n) {
11207                 if (num == TARGET_NR_getxattr) {
11208                     ret = get_errno(getxattr(p, n, v, arg4));
11209                 } else {
11210                     ret = get_errno(lgetxattr(p, n, v, arg4));
11211                 }
11212             } else {
11213                 ret = -TARGET_EFAULT;
11214             }
11215             unlock_user(p, arg1, 0);
11216             unlock_user(n, arg2, 0);
11217             unlock_user(v, arg3, arg4);
11218         }
11219         return ret;
11220     case TARGET_NR_fgetxattr:
11221         {
11222             void *n, *v = 0;
11223             if (arg3) {
11224                 v = lock_user(VERIFY_WRITE, arg3, arg4, 0);
11225                 if (!v) {
11226                     return -TARGET_EFAULT;
11227                 }
11228             }
11229             n = lock_user_string(arg2);
11230             if (n) {
11231                 ret = get_errno(fgetxattr(arg1, n, v, arg4));
11232             } else {
11233                 ret = -TARGET_EFAULT;
11234             }
11235             unlock_user(n, arg2, 0);
11236             unlock_user(v, arg3, arg4);
11237         }
11238         return ret;
11239     case TARGET_NR_removexattr:
11240     case TARGET_NR_lremovexattr:
11241         {
11242             void *p, *n;
11243             p = lock_user_string(arg1);
11244             n = lock_user_string(arg2);
11245             if (p && n) {
11246                 if (num == TARGET_NR_removexattr) {
11247                     ret = get_errno(removexattr(p, n));
11248                 } else {
11249                     ret = get_errno(lremovexattr(p, n));
11250                 }
11251             } else {
11252                 ret = -TARGET_EFAULT;
11253             }
11254             unlock_user(p, arg1, 0);
11255             unlock_user(n, arg2, 0);
11256         }
11257         return ret;
11258     case TARGET_NR_fremovexattr:
11259         {
11260             void *n;
11261             n = lock_user_string(arg2);
11262             if (n) {
11263                 ret = get_errno(fremovexattr(arg1, n));
11264             } else {
11265                 ret = -TARGET_EFAULT;
11266             }
11267             unlock_user(n, arg2, 0);
11268         }
11269         return ret;
11270 #endif
11271 #endif /* CONFIG_ATTR */
11272 #ifdef TARGET_NR_set_thread_area
11273     case TARGET_NR_set_thread_area:
11274 #if defined(TARGET_MIPS)
11275       ((CPUMIPSState *) cpu_env)->active_tc.CP0_UserLocal = arg1;
11276       return 0;
11277 #elif defined(TARGET_CRIS)
11278       if (arg1 & 0xff)
11279           ret = -TARGET_EINVAL;
11280       else {
11281           ((CPUCRISState *) cpu_env)->pregs[PR_PID] = arg1;
11282           ret = 0;
11283       }
11284       return ret;
11285 #elif defined(TARGET_I386) && defined(TARGET_ABI32)
11286       return do_set_thread_area(cpu_env, arg1);
11287 #elif defined(TARGET_M68K)
11288       {
11289           TaskState *ts = cpu->opaque;
11290           ts->tp_value = arg1;
11291           return 0;
11292       }
11293 #else
11294       return -TARGET_ENOSYS;
11295 #endif
11296 #endif
11297 #ifdef TARGET_NR_get_thread_area
11298     case TARGET_NR_get_thread_area:
11299 #if defined(TARGET_I386) && defined(TARGET_ABI32)
11300         return do_get_thread_area(cpu_env, arg1);
11301 #elif defined(TARGET_M68K)
11302         {
11303             TaskState *ts = cpu->opaque;
11304             return ts->tp_value;
11305         }
11306 #else
11307         return -TARGET_ENOSYS;
11308 #endif
11309 #endif
11310 #ifdef TARGET_NR_getdomainname
11311     case TARGET_NR_getdomainname:
11312         return -TARGET_ENOSYS;
11313 #endif
11314 
11315 #ifdef TARGET_NR_clock_settime
11316     case TARGET_NR_clock_settime:
11317     {
11318         struct timespec ts;
11319 
11320         ret = target_to_host_timespec(&ts, arg2);
11321         if (!is_error(ret)) {
11322             ret = get_errno(clock_settime(arg1, &ts));
11323         }
11324         return ret;
11325     }
11326 #endif
11327 #ifdef TARGET_NR_clock_gettime
11328     case TARGET_NR_clock_gettime:
11329     {
11330         struct timespec ts;
11331         ret = get_errno(clock_gettime(arg1, &ts));
11332         if (!is_error(ret)) {
11333             ret = host_to_target_timespec(arg2, &ts);
11334         }
11335         return ret;
11336     }
11337 #endif
11338 #ifdef TARGET_NR_clock_getres
11339     case TARGET_NR_clock_getres:
11340     {
11341         struct timespec ts;
11342         ret = get_errno(clock_getres(arg1, &ts));
11343         if (!is_error(ret)) {
11344             host_to_target_timespec(arg2, &ts);
11345         }
11346         return ret;
11347     }
11348 #endif
11349 #ifdef TARGET_NR_clock_nanosleep
11350     case TARGET_NR_clock_nanosleep:
11351     {
11352         struct timespec ts;
11353         target_to_host_timespec(&ts, arg3);
11354         ret = get_errno(safe_clock_nanosleep(arg1, arg2,
11355                                              &ts, arg4 ? &ts : NULL));
11356         if (arg4)
11357             host_to_target_timespec(arg4, &ts);
11358 
11359 #if defined(TARGET_PPC)
11360         /* clock_nanosleep is odd in that it returns positive errno values.
11361          * On PPC, CR0 bit 3 should be set in such a situation. */
11362         if (ret && ret != -TARGET_ERESTARTSYS) {
11363             ((CPUPPCState *)cpu_env)->crf[0] |= 1;
11364         }
11365 #endif
11366         return ret;
11367     }
11368 #endif
11369 
11370 #if defined(TARGET_NR_set_tid_address) && defined(__NR_set_tid_address)
11371     case TARGET_NR_set_tid_address:
11372         return get_errno(set_tid_address((int *)g2h(arg1)));
11373 #endif
11374 
11375     case TARGET_NR_tkill:
11376         return get_errno(safe_tkill((int)arg1, target_to_host_signal(arg2)));
11377 
11378     case TARGET_NR_tgkill:
11379         return get_errno(safe_tgkill((int)arg1, (int)arg2,
11380                          target_to_host_signal(arg3)));
11381 
11382 #ifdef TARGET_NR_set_robust_list
11383     case TARGET_NR_set_robust_list:
11384     case TARGET_NR_get_robust_list:
11385         /* The ABI for supporting robust futexes has userspace pass
11386          * the kernel a pointer to a linked list which is updated by
11387          * userspace after the syscall; the list is walked by the kernel
11388          * when the thread exits. Since the linked list in QEMU guest
11389          * memory isn't a valid linked list for the host and we have
11390          * no way to reliably intercept the thread-death event, we can't
11391          * support these. Silently return ENOSYS so that guest userspace
11392          * falls back to a non-robust futex implementation (which should
11393          * be OK except in the corner case of the guest crashing while
11394          * holding a mutex that is shared with another process via
11395          * shared memory).
11396          */
11397         return -TARGET_ENOSYS;
11398 #endif
11399 
11400 #if defined(TARGET_NR_utimensat)
11401     case TARGET_NR_utimensat:
11402         {
11403             struct timespec *tsp, ts[2];
11404             if (!arg3) {
11405                 tsp = NULL;
11406             } else {
11407                 target_to_host_timespec(ts, arg3);
11408                 target_to_host_timespec(ts+1, arg3+sizeof(struct target_timespec));
11409                 tsp = ts;
11410             }
11411             if (!arg2)
11412                 ret = get_errno(sys_utimensat(arg1, NULL, tsp, arg4));
11413             else {
11414                 if (!(p = lock_user_string(arg2))) {
11415                     return -TARGET_EFAULT;
11416                 }
11417                 ret = get_errno(sys_utimensat(arg1, path(p), tsp, arg4));
11418                 unlock_user(p, arg2, 0);
11419             }
11420         }
11421         return ret;
11422 #endif
11423     case TARGET_NR_futex:
11424         return do_futex(arg1, arg2, arg3, arg4, arg5, arg6);
11425 #if defined(TARGET_NR_inotify_init) && defined(__NR_inotify_init)
11426     case TARGET_NR_inotify_init:
11427         ret = get_errno(sys_inotify_init());
11428         if (ret >= 0) {
11429             fd_trans_register(ret, &target_inotify_trans);
11430         }
11431         return ret;
11432 #endif
11433 #ifdef CONFIG_INOTIFY1
11434 #if defined(TARGET_NR_inotify_init1) && defined(__NR_inotify_init1)
11435     case TARGET_NR_inotify_init1:
11436         ret = get_errno(sys_inotify_init1(target_to_host_bitmask(arg1,
11437                                           fcntl_flags_tbl)));
11438         if (ret >= 0) {
11439             fd_trans_register(ret, &target_inotify_trans);
11440         }
11441         return ret;
11442 #endif
11443 #endif
11444 #if defined(TARGET_NR_inotify_add_watch) && defined(__NR_inotify_add_watch)
11445     case TARGET_NR_inotify_add_watch:
11446         p = lock_user_string(arg2);
11447         ret = get_errno(sys_inotify_add_watch(arg1, path(p), arg3));
11448         unlock_user(p, arg2, 0);
11449         return ret;
11450 #endif
11451 #if defined(TARGET_NR_inotify_rm_watch) && defined(__NR_inotify_rm_watch)
11452     case TARGET_NR_inotify_rm_watch:
11453         return get_errno(sys_inotify_rm_watch(arg1, arg2));
11454 #endif
11455 
11456 #if defined(TARGET_NR_mq_open) && defined(__NR_mq_open)
11457     case TARGET_NR_mq_open:
11458         {
11459             struct mq_attr posix_mq_attr;
11460             struct mq_attr *pposix_mq_attr;
11461             int host_flags;
11462 
11463             host_flags = target_to_host_bitmask(arg2, fcntl_flags_tbl);
11464             pposix_mq_attr = NULL;
11465             if (arg4) {
11466                 if (copy_from_user_mq_attr(&posix_mq_attr, arg4) != 0) {
11467                     return -TARGET_EFAULT;
11468                 }
11469                 pposix_mq_attr = &posix_mq_attr;
11470             }
11471             p = lock_user_string(arg1 - 1);
11472             if (!p) {
11473                 return -TARGET_EFAULT;
11474             }
11475             ret = get_errno(mq_open(p, host_flags, arg3, pposix_mq_attr));
11476             unlock_user (p, arg1, 0);
11477         }
11478         return ret;
11479 
11480     case TARGET_NR_mq_unlink:
11481         p = lock_user_string(arg1 - 1);
11482         if (!p) {
11483             return -TARGET_EFAULT;
11484         }
11485         ret = get_errno(mq_unlink(p));
11486         unlock_user (p, arg1, 0);
11487         return ret;
11488 
11489     case TARGET_NR_mq_timedsend:
11490         {
11491             struct timespec ts;
11492 
11493             p = lock_user (VERIFY_READ, arg2, arg3, 1);
11494             if (arg5 != 0) {
11495                 target_to_host_timespec(&ts, arg5);
11496                 ret = get_errno(safe_mq_timedsend(arg1, p, arg3, arg4, &ts));
11497                 host_to_target_timespec(arg5, &ts);
11498             } else {
11499                 ret = get_errno(safe_mq_timedsend(arg1, p, arg3, arg4, NULL));
11500             }
11501             unlock_user (p, arg2, arg3);
11502         }
11503         return ret;
11504 
11505     case TARGET_NR_mq_timedreceive:
11506         {
11507             struct timespec ts;
11508             unsigned int prio;
11509 
11510             p = lock_user (VERIFY_READ, arg2, arg3, 1);
11511             if (arg5 != 0) {
11512                 target_to_host_timespec(&ts, arg5);
11513                 ret = get_errno(safe_mq_timedreceive(arg1, p, arg3,
11514                                                      &prio, &ts));
11515                 host_to_target_timespec(arg5, &ts);
11516             } else {
11517                 ret = get_errno(safe_mq_timedreceive(arg1, p, arg3,
11518                                                      &prio, NULL));
11519             }
11520             unlock_user (p, arg2, arg3);
11521             if (arg4 != 0)
11522                 put_user_u32(prio, arg4);
11523         }
11524         return ret;
11525 
11526     /* Not implemented for now... */
11527 /*     case TARGET_NR_mq_notify: */
11528 /*         break; */
11529 
11530     case TARGET_NR_mq_getsetattr:
11531         {
11532             struct mq_attr posix_mq_attr_in, posix_mq_attr_out;
11533             ret = 0;
11534             if (arg2 != 0) {
11535                 copy_from_user_mq_attr(&posix_mq_attr_in, arg2);
11536                 ret = get_errno(mq_setattr(arg1, &posix_mq_attr_in,
11537                                            &posix_mq_attr_out));
11538             } else if (arg3 != 0) {
11539                 ret = get_errno(mq_getattr(arg1, &posix_mq_attr_out));
11540             }
11541             if (ret == 0 && arg3 != 0) {
11542                 copy_to_user_mq_attr(arg3, &posix_mq_attr_out);
11543             }
11544         }
11545         return ret;
11546 #endif
11547 
11548 #ifdef CONFIG_SPLICE
11549 #ifdef TARGET_NR_tee
11550     case TARGET_NR_tee:
11551         {
11552             ret = get_errno(tee(arg1,arg2,arg3,arg4));
11553         }
11554         return ret;
11555 #endif
11556 #ifdef TARGET_NR_splice
11557     case TARGET_NR_splice:
11558         {
11559             loff_t loff_in, loff_out;
11560             loff_t *ploff_in = NULL, *ploff_out = NULL;
11561             if (arg2) {
11562                 if (get_user_u64(loff_in, arg2)) {
11563                     return -TARGET_EFAULT;
11564                 }
11565                 ploff_in = &loff_in;
11566             }
11567             if (arg4) {
11568                 if (get_user_u64(loff_out, arg4)) {
11569                     return -TARGET_EFAULT;
11570                 }
11571                 ploff_out = &loff_out;
11572             }
11573             ret = get_errno(splice(arg1, ploff_in, arg3, ploff_out, arg5, arg6));
11574             if (arg2) {
11575                 if (put_user_u64(loff_in, arg2)) {
11576                     return -TARGET_EFAULT;
11577                 }
11578             }
11579             if (arg4) {
11580                 if (put_user_u64(loff_out, arg4)) {
11581                     return -TARGET_EFAULT;
11582                 }
11583             }
11584         }
11585         return ret;
11586 #endif
11587 #ifdef TARGET_NR_vmsplice
11588 	case TARGET_NR_vmsplice:
11589         {
11590             struct iovec *vec = lock_iovec(VERIFY_READ, arg2, arg3, 1);
11591             if (vec != NULL) {
11592                 ret = get_errno(vmsplice(arg1, vec, arg3, arg4));
11593                 unlock_iovec(vec, arg2, arg3, 0);
11594             } else {
11595                 ret = -host_to_target_errno(errno);
11596             }
11597         }
11598         return ret;
11599 #endif
11600 #endif /* CONFIG_SPLICE */
11601 #ifdef CONFIG_EVENTFD
11602 #if defined(TARGET_NR_eventfd)
11603     case TARGET_NR_eventfd:
11604         ret = get_errno(eventfd(arg1, 0));
11605         if (ret >= 0) {
11606             fd_trans_register(ret, &target_eventfd_trans);
11607         }
11608         return ret;
11609 #endif
11610 #if defined(TARGET_NR_eventfd2)
11611     case TARGET_NR_eventfd2:
11612     {
11613         int host_flags = arg2 & (~(TARGET_O_NONBLOCK | TARGET_O_CLOEXEC));
11614         if (arg2 & TARGET_O_NONBLOCK) {
11615             host_flags |= O_NONBLOCK;
11616         }
11617         if (arg2 & TARGET_O_CLOEXEC) {
11618             host_flags |= O_CLOEXEC;
11619         }
11620         ret = get_errno(eventfd(arg1, host_flags));
11621         if (ret >= 0) {
11622             fd_trans_register(ret, &target_eventfd_trans);
11623         }
11624         return ret;
11625     }
11626 #endif
11627 #endif /* CONFIG_EVENTFD  */
11628 #if defined(CONFIG_FALLOCATE) && defined(TARGET_NR_fallocate)
11629     case TARGET_NR_fallocate:
11630 #if TARGET_ABI_BITS == 32
11631         ret = get_errno(fallocate(arg1, arg2, target_offset64(arg3, arg4),
11632                                   target_offset64(arg5, arg6)));
11633 #else
11634         ret = get_errno(fallocate(arg1, arg2, arg3, arg4));
11635 #endif
11636         return ret;
11637 #endif
11638 #if defined(CONFIG_SYNC_FILE_RANGE)
11639 #if defined(TARGET_NR_sync_file_range)
11640     case TARGET_NR_sync_file_range:
11641 #if TARGET_ABI_BITS == 32
11642 #if defined(TARGET_MIPS)
11643         ret = get_errno(sync_file_range(arg1, target_offset64(arg3, arg4),
11644                                         target_offset64(arg5, arg6), arg7));
11645 #else
11646         ret = get_errno(sync_file_range(arg1, target_offset64(arg2, arg3),
11647                                         target_offset64(arg4, arg5), arg6));
11648 #endif /* !TARGET_MIPS */
11649 #else
11650         ret = get_errno(sync_file_range(arg1, arg2, arg3, arg4));
11651 #endif
11652         return ret;
11653 #endif
11654 #if defined(TARGET_NR_sync_file_range2)
11655     case TARGET_NR_sync_file_range2:
11656         /* This is like sync_file_range but the arguments are reordered */
11657 #if TARGET_ABI_BITS == 32
11658         ret = get_errno(sync_file_range(arg1, target_offset64(arg3, arg4),
11659                                         target_offset64(arg5, arg6), arg2));
11660 #else
11661         ret = get_errno(sync_file_range(arg1, arg3, arg4, arg2));
11662 #endif
11663         return ret;
11664 #endif
11665 #endif
11666 #if defined(TARGET_NR_signalfd4)
11667     case TARGET_NR_signalfd4:
11668         return do_signalfd4(arg1, arg2, arg4);
11669 #endif
11670 #if defined(TARGET_NR_signalfd)
11671     case TARGET_NR_signalfd:
11672         return do_signalfd4(arg1, arg2, 0);
11673 #endif
11674 #if defined(CONFIG_EPOLL)
11675 #if defined(TARGET_NR_epoll_create)
11676     case TARGET_NR_epoll_create:
11677         return get_errno(epoll_create(arg1));
11678 #endif
11679 #if defined(TARGET_NR_epoll_create1) && defined(CONFIG_EPOLL_CREATE1)
11680     case TARGET_NR_epoll_create1:
11681         return get_errno(epoll_create1(arg1));
11682 #endif
11683 #if defined(TARGET_NR_epoll_ctl)
11684     case TARGET_NR_epoll_ctl:
11685     {
11686         struct epoll_event ep;
11687         struct epoll_event *epp = 0;
11688         if (arg4) {
11689             struct target_epoll_event *target_ep;
11690             if (!lock_user_struct(VERIFY_READ, target_ep, arg4, 1)) {
11691                 return -TARGET_EFAULT;
11692             }
11693             ep.events = tswap32(target_ep->events);
11694             /* The epoll_data_t union is just opaque data to the kernel,
11695              * so we transfer all 64 bits across and need not worry what
11696              * actual data type it is.
11697              */
11698             ep.data.u64 = tswap64(target_ep->data.u64);
11699             unlock_user_struct(target_ep, arg4, 0);
11700             epp = &ep;
11701         }
11702         return get_errno(epoll_ctl(arg1, arg2, arg3, epp));
11703     }
11704 #endif
11705 
11706 #if defined(TARGET_NR_epoll_wait) || defined(TARGET_NR_epoll_pwait)
11707 #if defined(TARGET_NR_epoll_wait)
11708     case TARGET_NR_epoll_wait:
11709 #endif
11710 #if defined(TARGET_NR_epoll_pwait)
11711     case TARGET_NR_epoll_pwait:
11712 #endif
11713     {
11714         struct target_epoll_event *target_ep;
11715         struct epoll_event *ep;
11716         int epfd = arg1;
11717         int maxevents = arg3;
11718         int timeout = arg4;
11719 
11720         if (maxevents <= 0 || maxevents > TARGET_EP_MAX_EVENTS) {
11721             return -TARGET_EINVAL;
11722         }
11723 
11724         target_ep = lock_user(VERIFY_WRITE, arg2,
11725                               maxevents * sizeof(struct target_epoll_event), 1);
11726         if (!target_ep) {
11727             return -TARGET_EFAULT;
11728         }
11729 
11730         ep = g_try_new(struct epoll_event, maxevents);
11731         if (!ep) {
11732             unlock_user(target_ep, arg2, 0);
11733             return -TARGET_ENOMEM;
11734         }
11735 
11736         switch (num) {
11737 #if defined(TARGET_NR_epoll_pwait)
11738         case TARGET_NR_epoll_pwait:
11739         {
11740             target_sigset_t *target_set;
11741             sigset_t _set, *set = &_set;
11742 
11743             if (arg5) {
11744                 if (arg6 != sizeof(target_sigset_t)) {
11745                     ret = -TARGET_EINVAL;
11746                     break;
11747                 }
11748 
11749                 target_set = lock_user(VERIFY_READ, arg5,
11750                                        sizeof(target_sigset_t), 1);
11751                 if (!target_set) {
11752                     ret = -TARGET_EFAULT;
11753                     break;
11754                 }
11755                 target_to_host_sigset(set, target_set);
11756                 unlock_user(target_set, arg5, 0);
11757             } else {
11758                 set = NULL;
11759             }
11760 
11761             ret = get_errno(safe_epoll_pwait(epfd, ep, maxevents, timeout,
11762                                              set, SIGSET_T_SIZE));
11763             break;
11764         }
11765 #endif
11766 #if defined(TARGET_NR_epoll_wait)
11767         case TARGET_NR_epoll_wait:
11768             ret = get_errno(safe_epoll_pwait(epfd, ep, maxevents, timeout,
11769                                              NULL, 0));
11770             break;
11771 #endif
11772         default:
11773             ret = -TARGET_ENOSYS;
11774         }
11775         if (!is_error(ret)) {
11776             int i;
11777             for (i = 0; i < ret; i++) {
11778                 target_ep[i].events = tswap32(ep[i].events);
11779                 target_ep[i].data.u64 = tswap64(ep[i].data.u64);
11780             }
11781             unlock_user(target_ep, arg2,
11782                         ret * sizeof(struct target_epoll_event));
11783         } else {
11784             unlock_user(target_ep, arg2, 0);
11785         }
11786         g_free(ep);
11787         return ret;
11788     }
11789 #endif
11790 #endif
11791 #ifdef TARGET_NR_prlimit64
11792     case TARGET_NR_prlimit64:
11793     {
11794         /* args: pid, resource number, ptr to new rlimit, ptr to old rlimit */
11795         struct target_rlimit64 *target_rnew, *target_rold;
11796         struct host_rlimit64 rnew, rold, *rnewp = 0;
11797         int resource = target_to_host_resource(arg2);
11798         if (arg3) {
11799             if (!lock_user_struct(VERIFY_READ, target_rnew, arg3, 1)) {
11800                 return -TARGET_EFAULT;
11801             }
11802             rnew.rlim_cur = tswap64(target_rnew->rlim_cur);
11803             rnew.rlim_max = tswap64(target_rnew->rlim_max);
11804             unlock_user_struct(target_rnew, arg3, 0);
11805             rnewp = &rnew;
11806         }
11807 
11808         ret = get_errno(sys_prlimit64(arg1, resource, rnewp, arg4 ? &rold : 0));
11809         if (!is_error(ret) && arg4) {
11810             if (!lock_user_struct(VERIFY_WRITE, target_rold, arg4, 1)) {
11811                 return -TARGET_EFAULT;
11812             }
11813             target_rold->rlim_cur = tswap64(rold.rlim_cur);
11814             target_rold->rlim_max = tswap64(rold.rlim_max);
11815             unlock_user_struct(target_rold, arg4, 1);
11816         }
11817         return ret;
11818     }
11819 #endif
11820 #ifdef TARGET_NR_gethostname
11821     case TARGET_NR_gethostname:
11822     {
11823         char *name = lock_user(VERIFY_WRITE, arg1, arg2, 0);
11824         if (name) {
11825             ret = get_errno(gethostname(name, arg2));
11826             unlock_user(name, arg1, arg2);
11827         } else {
11828             ret = -TARGET_EFAULT;
11829         }
11830         return ret;
11831     }
11832 #endif
11833 #ifdef TARGET_NR_atomic_cmpxchg_32
11834     case TARGET_NR_atomic_cmpxchg_32:
11835     {
11836         /* should use start_exclusive from main.c */
11837         abi_ulong mem_value;
11838         if (get_user_u32(mem_value, arg6)) {
11839             target_siginfo_t info;
11840             info.si_signo = SIGSEGV;
11841             info.si_errno = 0;
11842             info.si_code = TARGET_SEGV_MAPERR;
11843             info._sifields._sigfault._addr = arg6;
11844             queue_signal((CPUArchState *)cpu_env, info.si_signo,
11845                          QEMU_SI_FAULT, &info);
11846             ret = 0xdeadbeef;
11847 
11848         }
11849         if (mem_value == arg2)
11850             put_user_u32(arg1, arg6);
11851         return mem_value;
11852     }
11853 #endif
11854 #ifdef TARGET_NR_atomic_barrier
11855     case TARGET_NR_atomic_barrier:
11856         /* Like the kernel implementation and the
11857            qemu arm barrier, no-op this? */
11858         return 0;
11859 #endif
11860 
11861 #ifdef TARGET_NR_timer_create
11862     case TARGET_NR_timer_create:
11863     {
11864         /* args: clockid_t clockid, struct sigevent *sevp, timer_t *timerid */
11865 
11866         struct sigevent host_sevp = { {0}, }, *phost_sevp = NULL;
11867 
11868         int clkid = arg1;
11869         int timer_index = next_free_host_timer();
11870 
11871         if (timer_index < 0) {
11872             ret = -TARGET_EAGAIN;
11873         } else {
11874             timer_t *phtimer = g_posix_timers  + timer_index;
11875 
11876             if (arg2) {
11877                 phost_sevp = &host_sevp;
11878                 ret = target_to_host_sigevent(phost_sevp, arg2);
11879                 if (ret != 0) {
11880                     return ret;
11881                 }
11882             }
11883 
11884             ret = get_errno(timer_create(clkid, phost_sevp, phtimer));
11885             if (ret) {
11886                 phtimer = NULL;
11887             } else {
11888                 if (put_user(TIMER_MAGIC | timer_index, arg3, target_timer_t)) {
11889                     return -TARGET_EFAULT;
11890                 }
11891             }
11892         }
11893         return ret;
11894     }
11895 #endif
11896 
11897 #ifdef TARGET_NR_timer_settime
11898     case TARGET_NR_timer_settime:
11899     {
11900         /* args: timer_t timerid, int flags, const struct itimerspec *new_value,
11901          * struct itimerspec * old_value */
11902         target_timer_t timerid = get_timer_id(arg1);
11903 
11904         if (timerid < 0) {
11905             ret = timerid;
11906         } else if (arg3 == 0) {
11907             ret = -TARGET_EINVAL;
11908         } else {
11909             timer_t htimer = g_posix_timers[timerid];
11910             struct itimerspec hspec_new = {{0},}, hspec_old = {{0},};
11911 
11912             if (target_to_host_itimerspec(&hspec_new, arg3)) {
11913                 return -TARGET_EFAULT;
11914             }
11915             ret = get_errno(
11916                           timer_settime(htimer, arg2, &hspec_new, &hspec_old));
11917             if (arg4 && host_to_target_itimerspec(arg4, &hspec_old)) {
11918                 return -TARGET_EFAULT;
11919             }
11920         }
11921         return ret;
11922     }
11923 #endif
11924 
11925 #ifdef TARGET_NR_timer_gettime
11926     case TARGET_NR_timer_gettime:
11927     {
11928         /* args: timer_t timerid, struct itimerspec *curr_value */
11929         target_timer_t timerid = get_timer_id(arg1);
11930 
11931         if (timerid < 0) {
11932             ret = timerid;
11933         } else if (!arg2) {
11934             ret = -TARGET_EFAULT;
11935         } else {
11936             timer_t htimer = g_posix_timers[timerid];
11937             struct itimerspec hspec;
11938             ret = get_errno(timer_gettime(htimer, &hspec));
11939 
11940             if (host_to_target_itimerspec(arg2, &hspec)) {
11941                 ret = -TARGET_EFAULT;
11942             }
11943         }
11944         return ret;
11945     }
11946 #endif
11947 
11948 #ifdef TARGET_NR_timer_getoverrun
11949     case TARGET_NR_timer_getoverrun:
11950     {
11951         /* args: timer_t timerid */
11952         target_timer_t timerid = get_timer_id(arg1);
11953 
11954         if (timerid < 0) {
11955             ret = timerid;
11956         } else {
11957             timer_t htimer = g_posix_timers[timerid];
11958             ret = get_errno(timer_getoverrun(htimer));
11959         }
11960         return ret;
11961     }
11962 #endif
11963 
11964 #ifdef TARGET_NR_timer_delete
11965     case TARGET_NR_timer_delete:
11966     {
11967         /* args: timer_t timerid */
11968         target_timer_t timerid = get_timer_id(arg1);
11969 
11970         if (timerid < 0) {
11971             ret = timerid;
11972         } else {
11973             timer_t htimer = g_posix_timers[timerid];
11974             ret = get_errno(timer_delete(htimer));
11975             g_posix_timers[timerid] = 0;
11976         }
11977         return ret;
11978     }
11979 #endif
11980 
11981 #if defined(TARGET_NR_timerfd_create) && defined(CONFIG_TIMERFD)
11982     case TARGET_NR_timerfd_create:
11983         return get_errno(timerfd_create(arg1,
11984                           target_to_host_bitmask(arg2, fcntl_flags_tbl)));
11985 #endif
11986 
11987 #if defined(TARGET_NR_timerfd_gettime) && defined(CONFIG_TIMERFD)
11988     case TARGET_NR_timerfd_gettime:
11989         {
11990             struct itimerspec its_curr;
11991 
11992             ret = get_errno(timerfd_gettime(arg1, &its_curr));
11993 
11994             if (arg2 && host_to_target_itimerspec(arg2, &its_curr)) {
11995                 return -TARGET_EFAULT;
11996             }
11997         }
11998         return ret;
11999 #endif
12000 
12001 #if defined(TARGET_NR_timerfd_settime) && defined(CONFIG_TIMERFD)
12002     case TARGET_NR_timerfd_settime:
12003         {
12004             struct itimerspec its_new, its_old, *p_new;
12005 
12006             if (arg3) {
12007                 if (target_to_host_itimerspec(&its_new, arg3)) {
12008                     return -TARGET_EFAULT;
12009                 }
12010                 p_new = &its_new;
12011             } else {
12012                 p_new = NULL;
12013             }
12014 
12015             ret = get_errno(timerfd_settime(arg1, arg2, p_new, &its_old));
12016 
12017             if (arg4 && host_to_target_itimerspec(arg4, &its_old)) {
12018                 return -TARGET_EFAULT;
12019             }
12020         }
12021         return ret;
12022 #endif
12023 
12024 #if defined(TARGET_NR_ioprio_get) && defined(__NR_ioprio_get)
12025     case TARGET_NR_ioprio_get:
12026         return get_errno(ioprio_get(arg1, arg2));
12027 #endif
12028 
12029 #if defined(TARGET_NR_ioprio_set) && defined(__NR_ioprio_set)
12030     case TARGET_NR_ioprio_set:
12031         return get_errno(ioprio_set(arg1, arg2, arg3));
12032 #endif
12033 
12034 #if defined(TARGET_NR_setns) && defined(CONFIG_SETNS)
12035     case TARGET_NR_setns:
12036         return get_errno(setns(arg1, arg2));
12037 #endif
12038 #if defined(TARGET_NR_unshare) && defined(CONFIG_SETNS)
12039     case TARGET_NR_unshare:
12040         return get_errno(unshare(arg1));
12041 #endif
12042 #if defined(TARGET_NR_kcmp) && defined(__NR_kcmp)
12043     case TARGET_NR_kcmp:
12044         return get_errno(kcmp(arg1, arg2, arg3, arg4, arg5));
12045 #endif
12046 #ifdef TARGET_NR_swapcontext
12047     case TARGET_NR_swapcontext:
12048         /* PowerPC specific.  */
12049         return do_swapcontext(cpu_env, arg1, arg2, arg3);
12050 #endif
12051 #ifdef TARGET_NR_memfd_create
12052     case TARGET_NR_memfd_create:
12053         p = lock_user_string(arg1);
12054         if (!p) {
12055             return -TARGET_EFAULT;
12056         }
12057         ret = get_errno(memfd_create(p, arg2));
12058         fd_trans_unregister(ret);
12059         unlock_user(p, arg1, 0);
12060         return ret;
12061 #endif
12062 
12063     default:
12064         qemu_log_mask(LOG_UNIMP, "Unsupported syscall: %d\n", num);
12065         return -TARGET_ENOSYS;
12066     }
12067     return ret;
12068 }
12069 
12070 abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
12071                     abi_long arg2, abi_long arg3, abi_long arg4,
12072                     abi_long arg5, abi_long arg6, abi_long arg7,
12073                     abi_long arg8)
12074 {
12075     CPUState *cpu = env_cpu(cpu_env);
12076     abi_long ret;
12077 
12078 #ifdef DEBUG_ERESTARTSYS
12079     /* Debug-only code for exercising the syscall-restart code paths
12080      * in the per-architecture cpu main loops: restart every syscall
12081      * the guest makes once before letting it through.
12082      */
12083     {
12084         static bool flag;
12085         flag = !flag;
12086         if (flag) {
12087             return -TARGET_ERESTARTSYS;
12088         }
12089     }
12090 #endif
12091 
12092     record_syscall_start(cpu, num, arg1,
12093                          arg2, arg3, arg4, arg5, arg6, arg7, arg8);
12094 
12095     if (unlikely(do_strace)) {
12096         print_syscall(num, arg1, arg2, arg3, arg4, arg5, arg6);
12097         ret = do_syscall1(cpu_env, num, arg1, arg2, arg3, arg4,
12098                           arg5, arg6, arg7, arg8);
12099         print_syscall_ret(num, ret);
12100     } else {
12101         ret = do_syscall1(cpu_env, num, arg1, arg2, arg3, arg4,
12102                           arg5, arg6, arg7, arg8);
12103     }
12104 
12105     record_syscall_return(cpu, num, ret);
12106     return ret;
12107 }
12108