xref: /openbmc/qemu/linux-user/syscall.c (revision f07eb1c4)
1 /*
2  *  Linux syscalls
3  *
4  *  Copyright (c) 2003 Fabrice Bellard
5  *
6  *  This program is free software; you can redistribute it and/or modify
7  *  it under the terms of the GNU General Public License as published by
8  *  the Free Software Foundation; either version 2 of the License, or
9  *  (at your option) any later version.
10  *
11  *  This program is distributed in the hope that it will be useful,
12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14  *  GNU General Public License for more details.
15  *
16  *  You should have received a copy of the GNU General Public License
17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
18  */
19 #define _ATFILE_SOURCE
20 #include "qemu/osdep.h"
21 #include "qemu/cutils.h"
22 #include "qemu/path.h"
23 #include "qemu/memfd.h"
24 #include "qemu/queue.h"
25 #include <elf.h>
26 #include <endian.h>
27 #include <grp.h>
28 #include <sys/ipc.h>
29 #include <sys/msg.h>
30 #include <sys/wait.h>
31 #include <sys/mount.h>
32 #include <sys/file.h>
33 #include <sys/fsuid.h>
34 #include <sys/personality.h>
35 #include <sys/prctl.h>
36 #include <sys/resource.h>
37 #include <sys/swap.h>
38 #include <linux/capability.h>
39 #include <sched.h>
40 #include <sys/timex.h>
41 #include <sys/socket.h>
42 #include <linux/sockios.h>
43 #include <sys/un.h>
44 #include <sys/uio.h>
45 #include <poll.h>
46 #include <sys/times.h>
47 #include <sys/shm.h>
48 #include <sys/sem.h>
49 #include <sys/statfs.h>
50 #include <utime.h>
51 #include <sys/sysinfo.h>
52 #include <sys/signalfd.h>
53 //#include <sys/user.h>
54 #include <netinet/in.h>
55 #include <netinet/ip.h>
56 #include <netinet/tcp.h>
57 #include <netinet/udp.h>
58 #include <linux/wireless.h>
59 #include <linux/icmp.h>
60 #include <linux/icmpv6.h>
61 #include <linux/if_tun.h>
62 #include <linux/in6.h>
63 #include <linux/errqueue.h>
64 #include <linux/random.h>
65 #ifdef CONFIG_TIMERFD
66 #include <sys/timerfd.h>
67 #endif
68 #ifdef CONFIG_EVENTFD
69 #include <sys/eventfd.h>
70 #endif
71 #ifdef CONFIG_EPOLL
72 #include <sys/epoll.h>
73 #endif
74 #ifdef CONFIG_ATTR
75 #include "qemu/xattr.h"
76 #endif
77 #ifdef CONFIG_SENDFILE
78 #include <sys/sendfile.h>
79 #endif
80 #ifdef HAVE_SYS_KCOV_H
81 #include <sys/kcov.h>
82 #endif
83 
84 #define termios host_termios
85 #define winsize host_winsize
86 #define termio host_termio
87 #define sgttyb host_sgttyb /* same as target */
88 #define tchars host_tchars /* same as target */
89 #define ltchars host_ltchars /* same as target */
90 
91 #include <linux/termios.h>
92 #include <linux/unistd.h>
93 #include <linux/cdrom.h>
94 #include <linux/hdreg.h>
95 #include <linux/soundcard.h>
96 #include <linux/kd.h>
97 #include <linux/mtio.h>
98 
99 #ifdef HAVE_SYS_MOUNT_FSCONFIG
100 /*
101  * glibc >= 2.36 linux/mount.h conflicts with sys/mount.h,
102  * which in turn prevents use of linux/fs.h. So we have to
103  * define the constants ourselves for now.
104  */
105 #define FS_IOC_GETFLAGS                _IOR('f', 1, long)
106 #define FS_IOC_SETFLAGS                _IOW('f', 2, long)
107 #define FS_IOC_GETVERSION              _IOR('v', 1, long)
108 #define FS_IOC_SETVERSION              _IOW('v', 2, long)
109 #define FS_IOC_FIEMAP                  _IOWR('f', 11, struct fiemap)
110 #define FS_IOC32_GETFLAGS              _IOR('f', 1, int)
111 #define FS_IOC32_SETFLAGS              _IOW('f', 2, int)
112 #define FS_IOC32_GETVERSION            _IOR('v', 1, int)
113 #define FS_IOC32_SETVERSION            _IOW('v', 2, int)
114 #else
115 #include <linux/fs.h>
116 #endif
117 #include <linux/fd.h>
118 #if defined(CONFIG_FIEMAP)
119 #include <linux/fiemap.h>
120 #endif
121 #include <linux/fb.h>
122 #if defined(CONFIG_USBFS)
123 #include <linux/usbdevice_fs.h>
124 #include <linux/usb/ch9.h>
125 #endif
126 #include <linux/vt.h>
127 #include <linux/dm-ioctl.h>
128 #include <linux/reboot.h>
129 #include <linux/route.h>
130 #include <linux/filter.h>
131 #include <linux/blkpg.h>
132 #include <netpacket/packet.h>
133 #include <linux/netlink.h>
134 #include <linux/if_alg.h>
135 #include <linux/rtc.h>
136 #include <sound/asound.h>
137 #ifdef HAVE_BTRFS_H
138 #include <linux/btrfs.h>
139 #endif
140 #ifdef HAVE_DRM_H
141 #include <libdrm/drm.h>
142 #include <libdrm/i915_drm.h>
143 #endif
144 #include "linux_loop.h"
145 #include "uname.h"
146 
147 #include "qemu.h"
148 #include "user-internals.h"
149 #include "strace.h"
150 #include "signal-common.h"
151 #include "loader.h"
152 #include "user-mmap.h"
153 #include "user/safe-syscall.h"
154 #include "qemu/guest-random.h"
155 #include "qemu/selfmap.h"
156 #include "user/syscall-trace.h"
157 #include "special-errno.h"
158 #include "qapi/error.h"
159 #include "fd-trans.h"
160 #include "tcg/tcg.h"
161 
162 #ifndef CLONE_IO
163 #define CLONE_IO                0x80000000      /* Clone io context */
164 #endif
165 
166 /* We can't directly call the host clone syscall, because this will
167  * badly confuse libc (breaking mutexes, for example). So we must
168  * divide clone flags into:
169  *  * flag combinations that look like pthread_create()
170  *  * flag combinations that look like fork()
171  *  * flags we can implement within QEMU itself
172  *  * flags we can't support and will return an error for
173  */
174 /* For thread creation, all these flags must be present; for
175  * fork, none must be present.
176  */
177 #define CLONE_THREAD_FLAGS                              \
178     (CLONE_VM | CLONE_FS | CLONE_FILES |                \
179      CLONE_SIGHAND | CLONE_THREAD | CLONE_SYSVSEM)
180 
181 /* These flags are ignored:
182  * CLONE_DETACHED is now ignored by the kernel;
183  * CLONE_IO is just an optimisation hint to the I/O scheduler
184  */
185 #define CLONE_IGNORED_FLAGS                     \
186     (CLONE_DETACHED | CLONE_IO)
187 
188 /* Flags for fork which we can implement within QEMU itself */
189 #define CLONE_OPTIONAL_FORK_FLAGS               \
190     (CLONE_SETTLS | CLONE_PARENT_SETTID |       \
191      CLONE_CHILD_CLEARTID | CLONE_CHILD_SETTID)
192 
193 /* Flags for thread creation which we can implement within QEMU itself */
194 #define CLONE_OPTIONAL_THREAD_FLAGS                             \
195     (CLONE_SETTLS | CLONE_PARENT_SETTID |                       \
196      CLONE_CHILD_CLEARTID | CLONE_CHILD_SETTID | CLONE_PARENT)
197 
198 #define CLONE_INVALID_FORK_FLAGS                                        \
199     (~(CSIGNAL | CLONE_OPTIONAL_FORK_FLAGS | CLONE_IGNORED_FLAGS))
200 
201 #define CLONE_INVALID_THREAD_FLAGS                                      \
202     (~(CSIGNAL | CLONE_THREAD_FLAGS | CLONE_OPTIONAL_THREAD_FLAGS |     \
203        CLONE_IGNORED_FLAGS))
204 
205 /* CLONE_VFORK is special cased early in do_fork(). The other flag bits
206  * have almost all been allocated. We cannot support any of
207  * CLONE_NEWNS, CLONE_NEWCGROUP, CLONE_NEWUTS, CLONE_NEWIPC,
208  * CLONE_NEWUSER, CLONE_NEWPID, CLONE_NEWNET, CLONE_PTRACE, CLONE_UNTRACED.
209  * The checks against the invalid thread masks above will catch these.
210  * (The one remaining unallocated bit is 0x1000 which used to be CLONE_PID.)
211  */
212 
213 /* Define DEBUG_ERESTARTSYS to force every syscall to be restarted
214  * once. This exercises the codepaths for restart.
215  */
216 //#define DEBUG_ERESTARTSYS
217 
218 //#include <linux/msdos_fs.h>
219 #define VFAT_IOCTL_READDIR_BOTH \
220     _IOC(_IOC_READ, 'r', 1, (sizeof(struct linux_dirent) + 256) * 2)
221 #define VFAT_IOCTL_READDIR_SHORT \
222     _IOC(_IOC_READ, 'r', 2, (sizeof(struct linux_dirent) + 256) * 2)
223 
224 #undef _syscall0
225 #undef _syscall1
226 #undef _syscall2
227 #undef _syscall3
228 #undef _syscall4
229 #undef _syscall5
230 #undef _syscall6
231 
232 #define _syscall0(type,name)		\
233 static type name (void)			\
234 {					\
235 	return syscall(__NR_##name);	\
236 }
237 
238 #define _syscall1(type,name,type1,arg1)		\
239 static type name (type1 arg1)			\
240 {						\
241 	return syscall(__NR_##name, arg1);	\
242 }
243 
244 #define _syscall2(type,name,type1,arg1,type2,arg2)	\
245 static type name (type1 arg1,type2 arg2)		\
246 {							\
247 	return syscall(__NR_##name, arg1, arg2);	\
248 }
249 
250 #define _syscall3(type,name,type1,arg1,type2,arg2,type3,arg3)	\
251 static type name (type1 arg1,type2 arg2,type3 arg3)		\
252 {								\
253 	return syscall(__NR_##name, arg1, arg2, arg3);		\
254 }
255 
256 #define _syscall4(type,name,type1,arg1,type2,arg2,type3,arg3,type4,arg4)	\
257 static type name (type1 arg1,type2 arg2,type3 arg3,type4 arg4)			\
258 {										\
259 	return syscall(__NR_##name, arg1, arg2, arg3, arg4);			\
260 }
261 
262 #define _syscall5(type,name,type1,arg1,type2,arg2,type3,arg3,type4,arg4,	\
263 		  type5,arg5)							\
264 static type name (type1 arg1,type2 arg2,type3 arg3,type4 arg4,type5 arg5)	\
265 {										\
266 	return syscall(__NR_##name, arg1, arg2, arg3, arg4, arg5);		\
267 }
268 
269 
270 #define _syscall6(type,name,type1,arg1,type2,arg2,type3,arg3,type4,arg4,	\
271 		  type5,arg5,type6,arg6)					\
272 static type name (type1 arg1,type2 arg2,type3 arg3,type4 arg4,type5 arg5,	\
273                   type6 arg6)							\
274 {										\
275 	return syscall(__NR_##name, arg1, arg2, arg3, arg4, arg5, arg6);	\
276 }
277 
278 
279 #define __NR_sys_uname __NR_uname
280 #define __NR_sys_getcwd1 __NR_getcwd
281 #define __NR_sys_getdents __NR_getdents
282 #define __NR_sys_getdents64 __NR_getdents64
283 #define __NR_sys_getpriority __NR_getpriority
284 #define __NR_sys_rt_sigqueueinfo __NR_rt_sigqueueinfo
285 #define __NR_sys_rt_tgsigqueueinfo __NR_rt_tgsigqueueinfo
286 #define __NR_sys_syslog __NR_syslog
287 #if defined(__NR_futex)
288 # define __NR_sys_futex __NR_futex
289 #endif
290 #if defined(__NR_futex_time64)
291 # define __NR_sys_futex_time64 __NR_futex_time64
292 #endif
293 #define __NR_sys_statx __NR_statx
294 
295 #if defined(__alpha__) || defined(__x86_64__) || defined(__s390x__)
296 #define __NR__llseek __NR_lseek
297 #endif
298 
299 /* Newer kernel ports have llseek() instead of _llseek() */
300 #if defined(TARGET_NR_llseek) && !defined(TARGET_NR__llseek)
301 #define TARGET_NR__llseek TARGET_NR_llseek
302 #endif
303 
304 /* some platforms need to mask more bits than just TARGET_O_NONBLOCK */
305 #ifndef TARGET_O_NONBLOCK_MASK
306 #define TARGET_O_NONBLOCK_MASK TARGET_O_NONBLOCK
307 #endif
308 
309 #define __NR_sys_gettid __NR_gettid
310 _syscall0(int, sys_gettid)
311 
312 /* For the 64-bit guest on 32-bit host case we must emulate
313  * getdents using getdents64, because otherwise the host
314  * might hand us back more dirent records than we can fit
315  * into the guest buffer after structure format conversion.
316  * Otherwise we emulate getdents with getdents if the host has it.
317  */
318 #if defined(__NR_getdents) && HOST_LONG_BITS >= TARGET_ABI_BITS
319 #define EMULATE_GETDENTS_WITH_GETDENTS
320 #endif
321 
322 #if defined(TARGET_NR_getdents) && defined(EMULATE_GETDENTS_WITH_GETDENTS)
323 _syscall3(int, sys_getdents, uint, fd, struct linux_dirent *, dirp, uint, count);
324 #endif
325 #if (defined(TARGET_NR_getdents) && \
326       !defined(EMULATE_GETDENTS_WITH_GETDENTS)) || \
327     (defined(TARGET_NR_getdents64) && defined(__NR_getdents64))
328 _syscall3(int, sys_getdents64, uint, fd, struct linux_dirent64 *, dirp, uint, count);
329 #endif
330 #if defined(TARGET_NR__llseek) && defined(__NR_llseek)
331 _syscall5(int, _llseek,  uint,  fd, ulong, hi, ulong, lo,
332           loff_t *, res, uint, wh);
333 #endif
334 _syscall3(int, sys_rt_sigqueueinfo, pid_t, pid, int, sig, siginfo_t *, uinfo)
335 _syscall4(int, sys_rt_tgsigqueueinfo, pid_t, pid, pid_t, tid, int, sig,
336           siginfo_t *, uinfo)
337 _syscall3(int,sys_syslog,int,type,char*,bufp,int,len)
338 #ifdef __NR_exit_group
339 _syscall1(int,exit_group,int,error_code)
340 #endif
341 #if defined(__NR_futex)
342 _syscall6(int,sys_futex,int *,uaddr,int,op,int,val,
343           const struct timespec *,timeout,int *,uaddr2,int,val3)
344 #endif
345 #if defined(__NR_futex_time64)
346 _syscall6(int,sys_futex_time64,int *,uaddr,int,op,int,val,
347           const struct timespec *,timeout,int *,uaddr2,int,val3)
348 #endif
349 #if defined(__NR_pidfd_open) && defined(TARGET_NR_pidfd_open)
350 _syscall2(int, pidfd_open, pid_t, pid, unsigned int, flags);
351 #endif
352 #if defined(__NR_pidfd_send_signal) && defined(TARGET_NR_pidfd_send_signal)
353 _syscall4(int, pidfd_send_signal, int, pidfd, int, sig, siginfo_t *, info,
354                              unsigned int, flags);
355 #endif
356 #if defined(__NR_pidfd_getfd) && defined(TARGET_NR_pidfd_getfd)
357 _syscall3(int, pidfd_getfd, int, pidfd, int, targetfd, unsigned int, flags);
358 #endif
359 #define __NR_sys_sched_getaffinity __NR_sched_getaffinity
360 _syscall3(int, sys_sched_getaffinity, pid_t, pid, unsigned int, len,
361           unsigned long *, user_mask_ptr);
362 #define __NR_sys_sched_setaffinity __NR_sched_setaffinity
363 _syscall3(int, sys_sched_setaffinity, pid_t, pid, unsigned int, len,
364           unsigned long *, user_mask_ptr);
365 /* sched_attr is not defined in glibc */
366 struct sched_attr {
367     uint32_t size;
368     uint32_t sched_policy;
369     uint64_t sched_flags;
370     int32_t sched_nice;
371     uint32_t sched_priority;
372     uint64_t sched_runtime;
373     uint64_t sched_deadline;
374     uint64_t sched_period;
375     uint32_t sched_util_min;
376     uint32_t sched_util_max;
377 };
378 #define __NR_sys_sched_getattr __NR_sched_getattr
379 _syscall4(int, sys_sched_getattr, pid_t, pid, struct sched_attr *, attr,
380           unsigned int, size, unsigned int, flags);
381 #define __NR_sys_sched_setattr __NR_sched_setattr
382 _syscall3(int, sys_sched_setattr, pid_t, pid, struct sched_attr *, attr,
383           unsigned int, flags);
384 #define __NR_sys_sched_getscheduler __NR_sched_getscheduler
385 _syscall1(int, sys_sched_getscheduler, pid_t, pid);
386 #define __NR_sys_sched_setscheduler __NR_sched_setscheduler
387 _syscall3(int, sys_sched_setscheduler, pid_t, pid, int, policy,
388           const struct sched_param *, param);
389 #define __NR_sys_sched_getparam __NR_sched_getparam
390 _syscall2(int, sys_sched_getparam, pid_t, pid,
391           struct sched_param *, param);
392 #define __NR_sys_sched_setparam __NR_sched_setparam
393 _syscall2(int, sys_sched_setparam, pid_t, pid,
394           const struct sched_param *, param);
395 #define __NR_sys_getcpu __NR_getcpu
396 _syscall3(int, sys_getcpu, unsigned *, cpu, unsigned *, node, void *, tcache);
397 _syscall4(int, reboot, int, magic1, int, magic2, unsigned int, cmd,
398           void *, arg);
399 _syscall2(int, capget, struct __user_cap_header_struct *, header,
400           struct __user_cap_data_struct *, data);
401 _syscall2(int, capset, struct __user_cap_header_struct *, header,
402           struct __user_cap_data_struct *, data);
403 #if defined(TARGET_NR_ioprio_get) && defined(__NR_ioprio_get)
404 _syscall2(int, ioprio_get, int, which, int, who)
405 #endif
406 #if defined(TARGET_NR_ioprio_set) && defined(__NR_ioprio_set)
407 _syscall3(int, ioprio_set, int, which, int, who, int, ioprio)
408 #endif
409 #if defined(TARGET_NR_getrandom) && defined(__NR_getrandom)
410 _syscall3(int, getrandom, void *, buf, size_t, buflen, unsigned int, flags)
411 #endif
412 
413 #if defined(TARGET_NR_kcmp) && defined(__NR_kcmp)
414 _syscall5(int, kcmp, pid_t, pid1, pid_t, pid2, int, type,
415           unsigned long, idx1, unsigned long, idx2)
416 #endif
417 
418 /*
419  * It is assumed that struct statx is architecture independent.
420  */
421 #if defined(TARGET_NR_statx) && defined(__NR_statx)
422 _syscall5(int, sys_statx, int, dirfd, const char *, pathname, int, flags,
423           unsigned int, mask, struct target_statx *, statxbuf)
424 #endif
425 #if defined(TARGET_NR_membarrier) && defined(__NR_membarrier)
426 _syscall2(int, membarrier, int, cmd, int, flags)
427 #endif
428 
429 static const bitmask_transtbl fcntl_flags_tbl[] = {
430   { TARGET_O_ACCMODE,   TARGET_O_WRONLY,    O_ACCMODE,   O_WRONLY,    },
431   { TARGET_O_ACCMODE,   TARGET_O_RDWR,      O_ACCMODE,   O_RDWR,      },
432   { TARGET_O_CREAT,     TARGET_O_CREAT,     O_CREAT,     O_CREAT,     },
433   { TARGET_O_EXCL,      TARGET_O_EXCL,      O_EXCL,      O_EXCL,      },
434   { TARGET_O_NOCTTY,    TARGET_O_NOCTTY,    O_NOCTTY,    O_NOCTTY,    },
435   { TARGET_O_TRUNC,     TARGET_O_TRUNC,     O_TRUNC,     O_TRUNC,     },
436   { TARGET_O_APPEND,    TARGET_O_APPEND,    O_APPEND,    O_APPEND,    },
437   { TARGET_O_NONBLOCK,  TARGET_O_NONBLOCK,  O_NONBLOCK,  O_NONBLOCK,  },
438   { TARGET_O_SYNC,      TARGET_O_DSYNC,     O_SYNC,      O_DSYNC,     },
439   { TARGET_O_SYNC,      TARGET_O_SYNC,      O_SYNC,      O_SYNC,      },
440   { TARGET_FASYNC,      TARGET_FASYNC,      FASYNC,      FASYNC,      },
441   { TARGET_O_DIRECTORY, TARGET_O_DIRECTORY, O_DIRECTORY, O_DIRECTORY, },
442   { TARGET_O_NOFOLLOW,  TARGET_O_NOFOLLOW,  O_NOFOLLOW,  O_NOFOLLOW,  },
443 #if defined(O_DIRECT)
444   { TARGET_O_DIRECT,    TARGET_O_DIRECT,    O_DIRECT,    O_DIRECT,    },
445 #endif
446 #if defined(O_NOATIME)
447   { TARGET_O_NOATIME,   TARGET_O_NOATIME,   O_NOATIME,   O_NOATIME    },
448 #endif
449 #if defined(O_CLOEXEC)
450   { TARGET_O_CLOEXEC,   TARGET_O_CLOEXEC,   O_CLOEXEC,   O_CLOEXEC    },
451 #endif
452 #if defined(O_PATH)
453   { TARGET_O_PATH,      TARGET_O_PATH,      O_PATH,      O_PATH       },
454 #endif
455 #if defined(O_TMPFILE)
456   { TARGET_O_TMPFILE,   TARGET_O_TMPFILE,   O_TMPFILE,   O_TMPFILE    },
457 #endif
458   /* Don't terminate the list prematurely on 64-bit host+guest.  */
459 #if TARGET_O_LARGEFILE != 0 || O_LARGEFILE != 0
460   { TARGET_O_LARGEFILE, TARGET_O_LARGEFILE, O_LARGEFILE, O_LARGEFILE, },
461 #endif
462   { 0, 0, 0, 0 }
463 };
464 
465 _syscall2(int, sys_getcwd1, char *, buf, size_t, size)
466 
467 #if defined(TARGET_NR_utimensat) || defined(TARGET_NR_utimensat_time64)
468 #if defined(__NR_utimensat)
469 #define __NR_sys_utimensat __NR_utimensat
470 _syscall4(int,sys_utimensat,int,dirfd,const char *,pathname,
471           const struct timespec *,tsp,int,flags)
472 #else
473 static int sys_utimensat(int dirfd, const char *pathname,
474                          const struct timespec times[2], int flags)
475 {
476     errno = ENOSYS;
477     return -1;
478 }
479 #endif
480 #endif /* TARGET_NR_utimensat */
481 
482 #ifdef TARGET_NR_renameat2
483 #if defined(__NR_renameat2)
484 #define __NR_sys_renameat2 __NR_renameat2
485 _syscall5(int, sys_renameat2, int, oldfd, const char *, old, int, newfd,
486           const char *, new, unsigned int, flags)
487 #else
488 static int sys_renameat2(int oldfd, const char *old,
489                          int newfd, const char *new, int flags)
490 {
491     if (flags == 0) {
492         return renameat(oldfd, old, newfd, new);
493     }
494     errno = ENOSYS;
495     return -1;
496 }
497 #endif
498 #endif /* TARGET_NR_renameat2 */
499 
500 #ifdef CONFIG_INOTIFY
501 #include <sys/inotify.h>
502 #else
503 /* Userspace can usually survive runtime without inotify */
504 #undef TARGET_NR_inotify_init
505 #undef TARGET_NR_inotify_init1
506 #undef TARGET_NR_inotify_add_watch
507 #undef TARGET_NR_inotify_rm_watch
508 #endif /* CONFIG_INOTIFY  */
509 
510 #if defined(TARGET_NR_prlimit64)
511 #ifndef __NR_prlimit64
512 # define __NR_prlimit64 -1
513 #endif
514 #define __NR_sys_prlimit64 __NR_prlimit64
515 /* The glibc rlimit structure may not be that used by the underlying syscall */
516 struct host_rlimit64 {
517     uint64_t rlim_cur;
518     uint64_t rlim_max;
519 };
520 _syscall4(int, sys_prlimit64, pid_t, pid, int, resource,
521           const struct host_rlimit64 *, new_limit,
522           struct host_rlimit64 *, old_limit)
523 #endif
524 
525 
526 #if defined(TARGET_NR_timer_create)
527 /* Maximum of 32 active POSIX timers allowed at any one time. */
528 #define GUEST_TIMER_MAX 32
529 static timer_t g_posix_timers[GUEST_TIMER_MAX];
530 static int g_posix_timer_allocated[GUEST_TIMER_MAX];
531 
532 static inline int next_free_host_timer(void)
533 {
534     int k;
535     for (k = 0; k < ARRAY_SIZE(g_posix_timer_allocated); k++) {
536         if (qatomic_xchg(g_posix_timer_allocated + k, 1) == 0) {
537             return k;
538         }
539     }
540     return -1;
541 }
542 
543 static inline void free_host_timer_slot(int id)
544 {
545     qatomic_store_release(g_posix_timer_allocated + id, 0);
546 }
547 #endif
548 
549 static inline int host_to_target_errno(int host_errno)
550 {
551     switch (host_errno) {
552 #define E(X)  case X: return TARGET_##X;
553 #include "errnos.c.inc"
554 #undef E
555     default:
556         return host_errno;
557     }
558 }
559 
560 static inline int target_to_host_errno(int target_errno)
561 {
562     switch (target_errno) {
563 #define E(X)  case TARGET_##X: return X;
564 #include "errnos.c.inc"
565 #undef E
566     default:
567         return target_errno;
568     }
569 }
570 
571 abi_long get_errno(abi_long ret)
572 {
573     if (ret == -1)
574         return -host_to_target_errno(errno);
575     else
576         return ret;
577 }
578 
579 const char *target_strerror(int err)
580 {
581     if (err == QEMU_ERESTARTSYS) {
582         return "To be restarted";
583     }
584     if (err == QEMU_ESIGRETURN) {
585         return "Successful exit from sigreturn";
586     }
587 
588     return strerror(target_to_host_errno(err));
589 }
590 
591 static int check_zeroed_user(abi_long addr, size_t ksize, size_t usize)
592 {
593     int i;
594     uint8_t b;
595     if (usize <= ksize) {
596         return 1;
597     }
598     for (i = ksize; i < usize; i++) {
599         if (get_user_u8(b, addr + i)) {
600             return -TARGET_EFAULT;
601         }
602         if (b != 0) {
603             return 0;
604         }
605     }
606     return 1;
607 }
608 
609 #define safe_syscall0(type, name) \
610 static type safe_##name(void) \
611 { \
612     return safe_syscall(__NR_##name); \
613 }
614 
615 #define safe_syscall1(type, name, type1, arg1) \
616 static type safe_##name(type1 arg1) \
617 { \
618     return safe_syscall(__NR_##name, arg1); \
619 }
620 
621 #define safe_syscall2(type, name, type1, arg1, type2, arg2) \
622 static type safe_##name(type1 arg1, type2 arg2) \
623 { \
624     return safe_syscall(__NR_##name, arg1, arg2); \
625 }
626 
627 #define safe_syscall3(type, name, type1, arg1, type2, arg2, type3, arg3) \
628 static type safe_##name(type1 arg1, type2 arg2, type3 arg3) \
629 { \
630     return safe_syscall(__NR_##name, arg1, arg2, arg3); \
631 }
632 
633 #define safe_syscall4(type, name, type1, arg1, type2, arg2, type3, arg3, \
634     type4, arg4) \
635 static type safe_##name(type1 arg1, type2 arg2, type3 arg3, type4 arg4) \
636 { \
637     return safe_syscall(__NR_##name, arg1, arg2, arg3, arg4); \
638 }
639 
640 #define safe_syscall5(type, name, type1, arg1, type2, arg2, type3, arg3, \
641     type4, arg4, type5, arg5) \
642 static type safe_##name(type1 arg1, type2 arg2, type3 arg3, type4 arg4, \
643     type5 arg5) \
644 { \
645     return safe_syscall(__NR_##name, arg1, arg2, arg3, arg4, arg5); \
646 }
647 
648 #define safe_syscall6(type, name, type1, arg1, type2, arg2, type3, arg3, \
649     type4, arg4, type5, arg5, type6, arg6) \
650 static type safe_##name(type1 arg1, type2 arg2, type3 arg3, type4 arg4, \
651     type5 arg5, type6 arg6) \
652 { \
653     return safe_syscall(__NR_##name, arg1, arg2, arg3, arg4, arg5, arg6); \
654 }
655 
656 safe_syscall3(ssize_t, read, int, fd, void *, buff, size_t, count)
657 safe_syscall3(ssize_t, write, int, fd, const void *, buff, size_t, count)
658 safe_syscall4(int, openat, int, dirfd, const char *, pathname, \
659               int, flags, mode_t, mode)
660 #if defined(TARGET_NR_wait4) || defined(TARGET_NR_waitpid)
661 safe_syscall4(pid_t, wait4, pid_t, pid, int *, status, int, options, \
662               struct rusage *, rusage)
663 #endif
664 safe_syscall5(int, waitid, idtype_t, idtype, id_t, id, siginfo_t *, infop, \
665               int, options, struct rusage *, rusage)
666 safe_syscall3(int, execve, const char *, filename, char **, argv, char **, envp)
667 #if defined(TARGET_NR_select) || defined(TARGET_NR__newselect) || \
668     defined(TARGET_NR_pselect6) || defined(TARGET_NR_pselect6_time64)
669 safe_syscall6(int, pselect6, int, nfds, fd_set *, readfds, fd_set *, writefds, \
670               fd_set *, exceptfds, struct timespec *, timeout, void *, sig)
671 #endif
672 #if defined(TARGET_NR_ppoll) || defined(TARGET_NR_ppoll_time64)
673 safe_syscall5(int, ppoll, struct pollfd *, ufds, unsigned int, nfds,
674               struct timespec *, tsp, const sigset_t *, sigmask,
675               size_t, sigsetsize)
676 #endif
677 safe_syscall6(int, epoll_pwait, int, epfd, struct epoll_event *, events,
678               int, maxevents, int, timeout, const sigset_t *, sigmask,
679               size_t, sigsetsize)
680 #if defined(__NR_futex)
681 safe_syscall6(int,futex,int *,uaddr,int,op,int,val, \
682               const struct timespec *,timeout,int *,uaddr2,int,val3)
683 #endif
684 #if defined(__NR_futex_time64)
685 safe_syscall6(int,futex_time64,int *,uaddr,int,op,int,val, \
686               const struct timespec *,timeout,int *,uaddr2,int,val3)
687 #endif
688 safe_syscall2(int, rt_sigsuspend, sigset_t *, newset, size_t, sigsetsize)
689 safe_syscall2(int, kill, pid_t, pid, int, sig)
690 safe_syscall2(int, tkill, int, tid, int, sig)
691 safe_syscall3(int, tgkill, int, tgid, int, pid, int, sig)
692 safe_syscall3(ssize_t, readv, int, fd, const struct iovec *, iov, int, iovcnt)
693 safe_syscall3(ssize_t, writev, int, fd, const struct iovec *, iov, int, iovcnt)
694 safe_syscall5(ssize_t, preadv, int, fd, const struct iovec *, iov, int, iovcnt,
695               unsigned long, pos_l, unsigned long, pos_h)
696 safe_syscall5(ssize_t, pwritev, int, fd, const struct iovec *, iov, int, iovcnt,
697               unsigned long, pos_l, unsigned long, pos_h)
698 safe_syscall3(int, connect, int, fd, const struct sockaddr *, addr,
699               socklen_t, addrlen)
700 safe_syscall6(ssize_t, sendto, int, fd, const void *, buf, size_t, len,
701               int, flags, const struct sockaddr *, addr, socklen_t, addrlen)
702 safe_syscall6(ssize_t, recvfrom, int, fd, void *, buf, size_t, len,
703               int, flags, struct sockaddr *, addr, socklen_t *, addrlen)
704 safe_syscall3(ssize_t, sendmsg, int, fd, const struct msghdr *, msg, int, flags)
705 safe_syscall3(ssize_t, recvmsg, int, fd, struct msghdr *, msg, int, flags)
706 safe_syscall2(int, flock, int, fd, int, operation)
707 #if defined(TARGET_NR_rt_sigtimedwait) || defined(TARGET_NR_rt_sigtimedwait_time64)
708 safe_syscall4(int, rt_sigtimedwait, const sigset_t *, these, siginfo_t *, uinfo,
709               const struct timespec *, uts, size_t, sigsetsize)
710 #endif
711 safe_syscall4(int, accept4, int, fd, struct sockaddr *, addr, socklen_t *, len,
712               int, flags)
713 #if defined(TARGET_NR_nanosleep)
714 safe_syscall2(int, nanosleep, const struct timespec *, req,
715               struct timespec *, rem)
716 #endif
717 #if defined(TARGET_NR_clock_nanosleep) || \
718     defined(TARGET_NR_clock_nanosleep_time64)
719 safe_syscall4(int, clock_nanosleep, const clockid_t, clock, int, flags,
720               const struct timespec *, req, struct timespec *, rem)
721 #endif
722 #ifdef __NR_ipc
723 #ifdef __s390x__
724 safe_syscall5(int, ipc, int, call, long, first, long, second, long, third,
725               void *, ptr)
726 #else
727 safe_syscall6(int, ipc, int, call, long, first, long, second, long, third,
728               void *, ptr, long, fifth)
729 #endif
730 #endif
731 #ifdef __NR_msgsnd
732 safe_syscall4(int, msgsnd, int, msgid, const void *, msgp, size_t, sz,
733               int, flags)
734 #endif
735 #ifdef __NR_msgrcv
736 safe_syscall5(int, msgrcv, int, msgid, void *, msgp, size_t, sz,
737               long, msgtype, int, flags)
738 #endif
739 #ifdef __NR_semtimedop
740 safe_syscall4(int, semtimedop, int, semid, struct sembuf *, tsops,
741               unsigned, nsops, const struct timespec *, timeout)
742 #endif
743 #if defined(TARGET_NR_mq_timedsend) || \
744     defined(TARGET_NR_mq_timedsend_time64)
745 safe_syscall5(int, mq_timedsend, int, mqdes, const char *, msg_ptr,
746               size_t, len, unsigned, prio, const struct timespec *, timeout)
747 #endif
748 #if defined(TARGET_NR_mq_timedreceive) || \
749     defined(TARGET_NR_mq_timedreceive_time64)
750 safe_syscall5(int, mq_timedreceive, int, mqdes, char *, msg_ptr,
751               size_t, len, unsigned *, prio, const struct timespec *, timeout)
752 #endif
753 #if defined(TARGET_NR_copy_file_range) && defined(__NR_copy_file_range)
754 safe_syscall6(ssize_t, copy_file_range, int, infd, loff_t *, pinoff,
755               int, outfd, loff_t *, poutoff, size_t, length,
756               unsigned int, flags)
757 #endif
758 
759 /* We do ioctl like this rather than via safe_syscall3 to preserve the
760  * "third argument might be integer or pointer or not present" behaviour of
761  * the libc function.
762  */
763 #define safe_ioctl(...) safe_syscall(__NR_ioctl, __VA_ARGS__)
764 /* Similarly for fcntl. Note that callers must always:
765  *  pass the F_GETLK64 etc constants rather than the unsuffixed F_GETLK
766  *  use the flock64 struct rather than unsuffixed flock
767  * This will then work and use a 64-bit offset for both 32-bit and 64-bit hosts.
768  */
769 #ifdef __NR_fcntl64
770 #define safe_fcntl(...) safe_syscall(__NR_fcntl64, __VA_ARGS__)
771 #else
772 #define safe_fcntl(...) safe_syscall(__NR_fcntl, __VA_ARGS__)
773 #endif
774 
775 static inline int host_to_target_sock_type(int host_type)
776 {
777     int target_type;
778 
779     switch (host_type & 0xf /* SOCK_TYPE_MASK */) {
780     case SOCK_DGRAM:
781         target_type = TARGET_SOCK_DGRAM;
782         break;
783     case SOCK_STREAM:
784         target_type = TARGET_SOCK_STREAM;
785         break;
786     default:
787         target_type = host_type & 0xf /* SOCK_TYPE_MASK */;
788         break;
789     }
790 
791 #if defined(SOCK_CLOEXEC)
792     if (host_type & SOCK_CLOEXEC) {
793         target_type |= TARGET_SOCK_CLOEXEC;
794     }
795 #endif
796 
797 #if defined(SOCK_NONBLOCK)
798     if (host_type & SOCK_NONBLOCK) {
799         target_type |= TARGET_SOCK_NONBLOCK;
800     }
801 #endif
802 
803     return target_type;
804 }
805 
806 static abi_ulong target_brk;
807 static abi_ulong target_original_brk;
808 static abi_ulong brk_page;
809 
810 void target_set_brk(abi_ulong new_brk)
811 {
812     target_original_brk = target_brk = HOST_PAGE_ALIGN(new_brk);
813     brk_page = HOST_PAGE_ALIGN(target_brk);
814 }
815 
816 //#define DEBUGF_BRK(message, args...) do { fprintf(stderr, (message), ## args); } while (0)
817 #define DEBUGF_BRK(message, args...)
818 
819 /* do_brk() must return target values and target errnos. */
820 abi_long do_brk(abi_ulong new_brk)
821 {
822     abi_long mapped_addr;
823     abi_ulong new_alloc_size;
824 
825     /* brk pointers are always untagged */
826 
827     DEBUGF_BRK("do_brk(" TARGET_ABI_FMT_lx ") -> ", new_brk);
828 
829     if (!new_brk) {
830         DEBUGF_BRK(TARGET_ABI_FMT_lx " (!new_brk)\n", target_brk);
831         return target_brk;
832     }
833     if (new_brk < target_original_brk) {
834         DEBUGF_BRK(TARGET_ABI_FMT_lx " (new_brk < target_original_brk)\n",
835                    target_brk);
836         return target_brk;
837     }
838 
839     /* If the new brk is less than the highest page reserved to the
840      * target heap allocation, set it and we're almost done...  */
841     if (new_brk <= brk_page) {
842         /* Heap contents are initialized to zero, as for anonymous
843          * mapped pages.  */
844         if (new_brk > target_brk) {
845             memset(g2h_untagged(target_brk), 0, new_brk - target_brk);
846         }
847 	target_brk = new_brk;
848         DEBUGF_BRK(TARGET_ABI_FMT_lx " (new_brk <= brk_page)\n", target_brk);
849 	return target_brk;
850     }
851 
852     /* We need to allocate more memory after the brk... Note that
853      * we don't use MAP_FIXED because that will map over the top of
854      * any existing mapping (like the one with the host libc or qemu
855      * itself); instead we treat "mapped but at wrong address" as
856      * a failure and unmap again.
857      */
858     new_alloc_size = HOST_PAGE_ALIGN(new_brk - brk_page);
859     mapped_addr = get_errno(target_mmap(brk_page, new_alloc_size,
860                                         PROT_READ|PROT_WRITE,
861                                         MAP_ANON|MAP_PRIVATE, 0, 0));
862 
863     if (mapped_addr == brk_page) {
864         /* Heap contents are initialized to zero, as for anonymous
865          * mapped pages.  Technically the new pages are already
866          * initialized to zero since they *are* anonymous mapped
867          * pages, however we have to take care with the contents that
868          * come from the remaining part of the previous page: it may
869          * contains garbage data due to a previous heap usage (grown
870          * then shrunken).  */
871         memset(g2h_untagged(target_brk), 0, brk_page - target_brk);
872 
873         target_brk = new_brk;
874         brk_page = HOST_PAGE_ALIGN(target_brk);
875         DEBUGF_BRK(TARGET_ABI_FMT_lx " (mapped_addr == brk_page)\n",
876             target_brk);
877         return target_brk;
878     } else if (mapped_addr != -1) {
879         /* Mapped but at wrong address, meaning there wasn't actually
880          * enough space for this brk.
881          */
882         target_munmap(mapped_addr, new_alloc_size);
883         mapped_addr = -1;
884         DEBUGF_BRK(TARGET_ABI_FMT_lx " (mapped_addr != -1)\n", target_brk);
885     }
886     else {
887         DEBUGF_BRK(TARGET_ABI_FMT_lx " (otherwise)\n", target_brk);
888     }
889 
890 #if defined(TARGET_ALPHA)
891     /* We (partially) emulate OSF/1 on Alpha, which requires we
892        return a proper errno, not an unchanged brk value.  */
893     return -TARGET_ENOMEM;
894 #endif
895     /* For everything else, return the previous break. */
896     return target_brk;
897 }
898 
899 #if defined(TARGET_NR_select) || defined(TARGET_NR__newselect) || \
900     defined(TARGET_NR_pselect6) || defined(TARGET_NR_pselect6_time64)
901 static inline abi_long copy_from_user_fdset(fd_set *fds,
902                                             abi_ulong target_fds_addr,
903                                             int n)
904 {
905     int i, nw, j, k;
906     abi_ulong b, *target_fds;
907 
908     nw = DIV_ROUND_UP(n, TARGET_ABI_BITS);
909     if (!(target_fds = lock_user(VERIFY_READ,
910                                  target_fds_addr,
911                                  sizeof(abi_ulong) * nw,
912                                  1)))
913         return -TARGET_EFAULT;
914 
915     FD_ZERO(fds);
916     k = 0;
917     for (i = 0; i < nw; i++) {
918         /* grab the abi_ulong */
919         __get_user(b, &target_fds[i]);
920         for (j = 0; j < TARGET_ABI_BITS; j++) {
921             /* check the bit inside the abi_ulong */
922             if ((b >> j) & 1)
923                 FD_SET(k, fds);
924             k++;
925         }
926     }
927 
928     unlock_user(target_fds, target_fds_addr, 0);
929 
930     return 0;
931 }
932 
933 static inline abi_ulong copy_from_user_fdset_ptr(fd_set *fds, fd_set **fds_ptr,
934                                                  abi_ulong target_fds_addr,
935                                                  int n)
936 {
937     if (target_fds_addr) {
938         if (copy_from_user_fdset(fds, target_fds_addr, n))
939             return -TARGET_EFAULT;
940         *fds_ptr = fds;
941     } else {
942         *fds_ptr = NULL;
943     }
944     return 0;
945 }
946 
947 static inline abi_long copy_to_user_fdset(abi_ulong target_fds_addr,
948                                           const fd_set *fds,
949                                           int n)
950 {
951     int i, nw, j, k;
952     abi_long v;
953     abi_ulong *target_fds;
954 
955     nw = DIV_ROUND_UP(n, TARGET_ABI_BITS);
956     if (!(target_fds = lock_user(VERIFY_WRITE,
957                                  target_fds_addr,
958                                  sizeof(abi_ulong) * nw,
959                                  0)))
960         return -TARGET_EFAULT;
961 
962     k = 0;
963     for (i = 0; i < nw; i++) {
964         v = 0;
965         for (j = 0; j < TARGET_ABI_BITS; j++) {
966             v |= ((abi_ulong)(FD_ISSET(k, fds) != 0) << j);
967             k++;
968         }
969         __put_user(v, &target_fds[i]);
970     }
971 
972     unlock_user(target_fds, target_fds_addr, sizeof(abi_ulong) * nw);
973 
974     return 0;
975 }
976 #endif
977 
978 #if defined(__alpha__)
979 #define HOST_HZ 1024
980 #else
981 #define HOST_HZ 100
982 #endif
983 
984 static inline abi_long host_to_target_clock_t(long ticks)
985 {
986 #if HOST_HZ == TARGET_HZ
987     return ticks;
988 #else
989     return ((int64_t)ticks * TARGET_HZ) / HOST_HZ;
990 #endif
991 }
992 
993 static inline abi_long host_to_target_rusage(abi_ulong target_addr,
994                                              const struct rusage *rusage)
995 {
996     struct target_rusage *target_rusage;
997 
998     if (!lock_user_struct(VERIFY_WRITE, target_rusage, target_addr, 0))
999         return -TARGET_EFAULT;
1000     target_rusage->ru_utime.tv_sec = tswapal(rusage->ru_utime.tv_sec);
1001     target_rusage->ru_utime.tv_usec = tswapal(rusage->ru_utime.tv_usec);
1002     target_rusage->ru_stime.tv_sec = tswapal(rusage->ru_stime.tv_sec);
1003     target_rusage->ru_stime.tv_usec = tswapal(rusage->ru_stime.tv_usec);
1004     target_rusage->ru_maxrss = tswapal(rusage->ru_maxrss);
1005     target_rusage->ru_ixrss = tswapal(rusage->ru_ixrss);
1006     target_rusage->ru_idrss = tswapal(rusage->ru_idrss);
1007     target_rusage->ru_isrss = tswapal(rusage->ru_isrss);
1008     target_rusage->ru_minflt = tswapal(rusage->ru_minflt);
1009     target_rusage->ru_majflt = tswapal(rusage->ru_majflt);
1010     target_rusage->ru_nswap = tswapal(rusage->ru_nswap);
1011     target_rusage->ru_inblock = tswapal(rusage->ru_inblock);
1012     target_rusage->ru_oublock = tswapal(rusage->ru_oublock);
1013     target_rusage->ru_msgsnd = tswapal(rusage->ru_msgsnd);
1014     target_rusage->ru_msgrcv = tswapal(rusage->ru_msgrcv);
1015     target_rusage->ru_nsignals = tswapal(rusage->ru_nsignals);
1016     target_rusage->ru_nvcsw = tswapal(rusage->ru_nvcsw);
1017     target_rusage->ru_nivcsw = tswapal(rusage->ru_nivcsw);
1018     unlock_user_struct(target_rusage, target_addr, 1);
1019 
1020     return 0;
1021 }
1022 
1023 #ifdef TARGET_NR_setrlimit
1024 static inline rlim_t target_to_host_rlim(abi_ulong target_rlim)
1025 {
1026     abi_ulong target_rlim_swap;
1027     rlim_t result;
1028 
1029     target_rlim_swap = tswapal(target_rlim);
1030     if (target_rlim_swap == TARGET_RLIM_INFINITY)
1031         return RLIM_INFINITY;
1032 
1033     result = target_rlim_swap;
1034     if (target_rlim_swap != (rlim_t)result)
1035         return RLIM_INFINITY;
1036 
1037     return result;
1038 }
1039 #endif
1040 
1041 #if defined(TARGET_NR_getrlimit) || defined(TARGET_NR_ugetrlimit)
1042 static inline abi_ulong host_to_target_rlim(rlim_t rlim)
1043 {
1044     abi_ulong target_rlim_swap;
1045     abi_ulong result;
1046 
1047     if (rlim == RLIM_INFINITY || rlim != (abi_long)rlim)
1048         target_rlim_swap = TARGET_RLIM_INFINITY;
1049     else
1050         target_rlim_swap = rlim;
1051     result = tswapal(target_rlim_swap);
1052 
1053     return result;
1054 }
1055 #endif
1056 
1057 static inline int target_to_host_resource(int code)
1058 {
1059     switch (code) {
1060     case TARGET_RLIMIT_AS:
1061         return RLIMIT_AS;
1062     case TARGET_RLIMIT_CORE:
1063         return RLIMIT_CORE;
1064     case TARGET_RLIMIT_CPU:
1065         return RLIMIT_CPU;
1066     case TARGET_RLIMIT_DATA:
1067         return RLIMIT_DATA;
1068     case TARGET_RLIMIT_FSIZE:
1069         return RLIMIT_FSIZE;
1070     case TARGET_RLIMIT_LOCKS:
1071         return RLIMIT_LOCKS;
1072     case TARGET_RLIMIT_MEMLOCK:
1073         return RLIMIT_MEMLOCK;
1074     case TARGET_RLIMIT_MSGQUEUE:
1075         return RLIMIT_MSGQUEUE;
1076     case TARGET_RLIMIT_NICE:
1077         return RLIMIT_NICE;
1078     case TARGET_RLIMIT_NOFILE:
1079         return RLIMIT_NOFILE;
1080     case TARGET_RLIMIT_NPROC:
1081         return RLIMIT_NPROC;
1082     case TARGET_RLIMIT_RSS:
1083         return RLIMIT_RSS;
1084     case TARGET_RLIMIT_RTPRIO:
1085         return RLIMIT_RTPRIO;
1086 #ifdef RLIMIT_RTTIME
1087     case TARGET_RLIMIT_RTTIME:
1088         return RLIMIT_RTTIME;
1089 #endif
1090     case TARGET_RLIMIT_SIGPENDING:
1091         return RLIMIT_SIGPENDING;
1092     case TARGET_RLIMIT_STACK:
1093         return RLIMIT_STACK;
1094     default:
1095         return code;
1096     }
1097 }
1098 
1099 static inline abi_long copy_from_user_timeval(struct timeval *tv,
1100                                               abi_ulong target_tv_addr)
1101 {
1102     struct target_timeval *target_tv;
1103 
1104     if (!lock_user_struct(VERIFY_READ, target_tv, target_tv_addr, 1)) {
1105         return -TARGET_EFAULT;
1106     }
1107 
1108     __get_user(tv->tv_sec, &target_tv->tv_sec);
1109     __get_user(tv->tv_usec, &target_tv->tv_usec);
1110 
1111     unlock_user_struct(target_tv, target_tv_addr, 0);
1112 
1113     return 0;
1114 }
1115 
1116 static inline abi_long copy_to_user_timeval(abi_ulong target_tv_addr,
1117                                             const struct timeval *tv)
1118 {
1119     struct target_timeval *target_tv;
1120 
1121     if (!lock_user_struct(VERIFY_WRITE, target_tv, target_tv_addr, 0)) {
1122         return -TARGET_EFAULT;
1123     }
1124 
1125     __put_user(tv->tv_sec, &target_tv->tv_sec);
1126     __put_user(tv->tv_usec, &target_tv->tv_usec);
1127 
1128     unlock_user_struct(target_tv, target_tv_addr, 1);
1129 
1130     return 0;
1131 }
1132 
1133 #if defined(TARGET_NR_clock_adjtime64) && defined(CONFIG_CLOCK_ADJTIME)
1134 static inline abi_long copy_from_user_timeval64(struct timeval *tv,
1135                                                 abi_ulong target_tv_addr)
1136 {
1137     struct target__kernel_sock_timeval *target_tv;
1138 
1139     if (!lock_user_struct(VERIFY_READ, target_tv, target_tv_addr, 1)) {
1140         return -TARGET_EFAULT;
1141     }
1142 
1143     __get_user(tv->tv_sec, &target_tv->tv_sec);
1144     __get_user(tv->tv_usec, &target_tv->tv_usec);
1145 
1146     unlock_user_struct(target_tv, target_tv_addr, 0);
1147 
1148     return 0;
1149 }
1150 #endif
1151 
1152 static inline abi_long copy_to_user_timeval64(abi_ulong target_tv_addr,
1153                                               const struct timeval *tv)
1154 {
1155     struct target__kernel_sock_timeval *target_tv;
1156 
1157     if (!lock_user_struct(VERIFY_WRITE, target_tv, target_tv_addr, 0)) {
1158         return -TARGET_EFAULT;
1159     }
1160 
1161     __put_user(tv->tv_sec, &target_tv->tv_sec);
1162     __put_user(tv->tv_usec, &target_tv->tv_usec);
1163 
1164     unlock_user_struct(target_tv, target_tv_addr, 1);
1165 
1166     return 0;
1167 }
1168 
1169 #if defined(TARGET_NR_futex) || \
1170     defined(TARGET_NR_rt_sigtimedwait) || \
1171     defined(TARGET_NR_pselect6) || defined(TARGET_NR_pselect6) || \
1172     defined(TARGET_NR_nanosleep) || defined(TARGET_NR_clock_settime) || \
1173     defined(TARGET_NR_utimensat) || defined(TARGET_NR_mq_timedsend) || \
1174     defined(TARGET_NR_mq_timedreceive) || defined(TARGET_NR_ipc) || \
1175     defined(TARGET_NR_semop) || defined(TARGET_NR_semtimedop) || \
1176     defined(TARGET_NR_timer_settime) || \
1177     (defined(TARGET_NR_timerfd_settime) && defined(CONFIG_TIMERFD))
1178 static inline abi_long target_to_host_timespec(struct timespec *host_ts,
1179                                                abi_ulong target_addr)
1180 {
1181     struct target_timespec *target_ts;
1182 
1183     if (!lock_user_struct(VERIFY_READ, target_ts, target_addr, 1)) {
1184         return -TARGET_EFAULT;
1185     }
1186     __get_user(host_ts->tv_sec, &target_ts->tv_sec);
1187     __get_user(host_ts->tv_nsec, &target_ts->tv_nsec);
1188     unlock_user_struct(target_ts, target_addr, 0);
1189     return 0;
1190 }
1191 #endif
1192 
1193 #if defined(TARGET_NR_clock_settime64) || defined(TARGET_NR_futex_time64) || \
1194     defined(TARGET_NR_timer_settime64) || \
1195     defined(TARGET_NR_mq_timedsend_time64) || \
1196     defined(TARGET_NR_mq_timedreceive_time64) || \
1197     (defined(TARGET_NR_timerfd_settime64) && defined(CONFIG_TIMERFD)) || \
1198     defined(TARGET_NR_clock_nanosleep_time64) || \
1199     defined(TARGET_NR_rt_sigtimedwait_time64) || \
1200     defined(TARGET_NR_utimensat) || \
1201     defined(TARGET_NR_utimensat_time64) || \
1202     defined(TARGET_NR_semtimedop_time64) || \
1203     defined(TARGET_NR_pselect6_time64) || defined(TARGET_NR_ppoll_time64)
1204 static inline abi_long target_to_host_timespec64(struct timespec *host_ts,
1205                                                  abi_ulong target_addr)
1206 {
1207     struct target__kernel_timespec *target_ts;
1208 
1209     if (!lock_user_struct(VERIFY_READ, target_ts, target_addr, 1)) {
1210         return -TARGET_EFAULT;
1211     }
1212     __get_user(host_ts->tv_sec, &target_ts->tv_sec);
1213     __get_user(host_ts->tv_nsec, &target_ts->tv_nsec);
1214     /* in 32bit mode, this drops the padding */
1215     host_ts->tv_nsec = (long)(abi_long)host_ts->tv_nsec;
1216     unlock_user_struct(target_ts, target_addr, 0);
1217     return 0;
1218 }
1219 #endif
1220 
1221 static inline abi_long host_to_target_timespec(abi_ulong target_addr,
1222                                                struct timespec *host_ts)
1223 {
1224     struct target_timespec *target_ts;
1225 
1226     if (!lock_user_struct(VERIFY_WRITE, target_ts, target_addr, 0)) {
1227         return -TARGET_EFAULT;
1228     }
1229     __put_user(host_ts->tv_sec, &target_ts->tv_sec);
1230     __put_user(host_ts->tv_nsec, &target_ts->tv_nsec);
1231     unlock_user_struct(target_ts, target_addr, 1);
1232     return 0;
1233 }
1234 
1235 static inline abi_long host_to_target_timespec64(abi_ulong target_addr,
1236                                                  struct timespec *host_ts)
1237 {
1238     struct target__kernel_timespec *target_ts;
1239 
1240     if (!lock_user_struct(VERIFY_WRITE, target_ts, target_addr, 0)) {
1241         return -TARGET_EFAULT;
1242     }
1243     __put_user(host_ts->tv_sec, &target_ts->tv_sec);
1244     __put_user(host_ts->tv_nsec, &target_ts->tv_nsec);
1245     unlock_user_struct(target_ts, target_addr, 1);
1246     return 0;
1247 }
1248 
1249 #if defined(TARGET_NR_gettimeofday)
1250 static inline abi_long copy_to_user_timezone(abi_ulong target_tz_addr,
1251                                              struct timezone *tz)
1252 {
1253     struct target_timezone *target_tz;
1254 
1255     if (!lock_user_struct(VERIFY_WRITE, target_tz, target_tz_addr, 1)) {
1256         return -TARGET_EFAULT;
1257     }
1258 
1259     __put_user(tz->tz_minuteswest, &target_tz->tz_minuteswest);
1260     __put_user(tz->tz_dsttime, &target_tz->tz_dsttime);
1261 
1262     unlock_user_struct(target_tz, target_tz_addr, 1);
1263 
1264     return 0;
1265 }
1266 #endif
1267 
1268 #if defined(TARGET_NR_settimeofday)
1269 static inline abi_long copy_from_user_timezone(struct timezone *tz,
1270                                                abi_ulong target_tz_addr)
1271 {
1272     struct target_timezone *target_tz;
1273 
1274     if (!lock_user_struct(VERIFY_READ, target_tz, target_tz_addr, 1)) {
1275         return -TARGET_EFAULT;
1276     }
1277 
1278     __get_user(tz->tz_minuteswest, &target_tz->tz_minuteswest);
1279     __get_user(tz->tz_dsttime, &target_tz->tz_dsttime);
1280 
1281     unlock_user_struct(target_tz, target_tz_addr, 0);
1282 
1283     return 0;
1284 }
1285 #endif
1286 
1287 #if defined(TARGET_NR_mq_open) && defined(__NR_mq_open)
1288 #include <mqueue.h>
1289 
1290 static inline abi_long copy_from_user_mq_attr(struct mq_attr *attr,
1291                                               abi_ulong target_mq_attr_addr)
1292 {
1293     struct target_mq_attr *target_mq_attr;
1294 
1295     if (!lock_user_struct(VERIFY_READ, target_mq_attr,
1296                           target_mq_attr_addr, 1))
1297         return -TARGET_EFAULT;
1298 
1299     __get_user(attr->mq_flags, &target_mq_attr->mq_flags);
1300     __get_user(attr->mq_maxmsg, &target_mq_attr->mq_maxmsg);
1301     __get_user(attr->mq_msgsize, &target_mq_attr->mq_msgsize);
1302     __get_user(attr->mq_curmsgs, &target_mq_attr->mq_curmsgs);
1303 
1304     unlock_user_struct(target_mq_attr, target_mq_attr_addr, 0);
1305 
1306     return 0;
1307 }
1308 
1309 static inline abi_long copy_to_user_mq_attr(abi_ulong target_mq_attr_addr,
1310                                             const struct mq_attr *attr)
1311 {
1312     struct target_mq_attr *target_mq_attr;
1313 
1314     if (!lock_user_struct(VERIFY_WRITE, target_mq_attr,
1315                           target_mq_attr_addr, 0))
1316         return -TARGET_EFAULT;
1317 
1318     __put_user(attr->mq_flags, &target_mq_attr->mq_flags);
1319     __put_user(attr->mq_maxmsg, &target_mq_attr->mq_maxmsg);
1320     __put_user(attr->mq_msgsize, &target_mq_attr->mq_msgsize);
1321     __put_user(attr->mq_curmsgs, &target_mq_attr->mq_curmsgs);
1322 
1323     unlock_user_struct(target_mq_attr, target_mq_attr_addr, 1);
1324 
1325     return 0;
1326 }
1327 #endif
1328 
1329 #if defined(TARGET_NR_select) || defined(TARGET_NR__newselect)
1330 /* do_select() must return target values and target errnos. */
1331 static abi_long do_select(int n,
1332                           abi_ulong rfd_addr, abi_ulong wfd_addr,
1333                           abi_ulong efd_addr, abi_ulong target_tv_addr)
1334 {
1335     fd_set rfds, wfds, efds;
1336     fd_set *rfds_ptr, *wfds_ptr, *efds_ptr;
1337     struct timeval tv;
1338     struct timespec ts, *ts_ptr;
1339     abi_long ret;
1340 
1341     ret = copy_from_user_fdset_ptr(&rfds, &rfds_ptr, rfd_addr, n);
1342     if (ret) {
1343         return ret;
1344     }
1345     ret = copy_from_user_fdset_ptr(&wfds, &wfds_ptr, wfd_addr, n);
1346     if (ret) {
1347         return ret;
1348     }
1349     ret = copy_from_user_fdset_ptr(&efds, &efds_ptr, efd_addr, n);
1350     if (ret) {
1351         return ret;
1352     }
1353 
1354     if (target_tv_addr) {
1355         if (copy_from_user_timeval(&tv, target_tv_addr))
1356             return -TARGET_EFAULT;
1357         ts.tv_sec = tv.tv_sec;
1358         ts.tv_nsec = tv.tv_usec * 1000;
1359         ts_ptr = &ts;
1360     } else {
1361         ts_ptr = NULL;
1362     }
1363 
1364     ret = get_errno(safe_pselect6(n, rfds_ptr, wfds_ptr, efds_ptr,
1365                                   ts_ptr, NULL));
1366 
1367     if (!is_error(ret)) {
1368         if (rfd_addr && copy_to_user_fdset(rfd_addr, &rfds, n))
1369             return -TARGET_EFAULT;
1370         if (wfd_addr && copy_to_user_fdset(wfd_addr, &wfds, n))
1371             return -TARGET_EFAULT;
1372         if (efd_addr && copy_to_user_fdset(efd_addr, &efds, n))
1373             return -TARGET_EFAULT;
1374 
1375         if (target_tv_addr) {
1376             tv.tv_sec = ts.tv_sec;
1377             tv.tv_usec = ts.tv_nsec / 1000;
1378             if (copy_to_user_timeval(target_tv_addr, &tv)) {
1379                 return -TARGET_EFAULT;
1380             }
1381         }
1382     }
1383 
1384     return ret;
1385 }
1386 
1387 #if defined(TARGET_WANT_OLD_SYS_SELECT)
1388 static abi_long do_old_select(abi_ulong arg1)
1389 {
1390     struct target_sel_arg_struct *sel;
1391     abi_ulong inp, outp, exp, tvp;
1392     long nsel;
1393 
1394     if (!lock_user_struct(VERIFY_READ, sel, arg1, 1)) {
1395         return -TARGET_EFAULT;
1396     }
1397 
1398     nsel = tswapal(sel->n);
1399     inp = tswapal(sel->inp);
1400     outp = tswapal(sel->outp);
1401     exp = tswapal(sel->exp);
1402     tvp = tswapal(sel->tvp);
1403 
1404     unlock_user_struct(sel, arg1, 0);
1405 
1406     return do_select(nsel, inp, outp, exp, tvp);
1407 }
1408 #endif
1409 #endif
1410 
1411 #if defined(TARGET_NR_pselect6) || defined(TARGET_NR_pselect6_time64)
1412 static abi_long do_pselect6(abi_long arg1, abi_long arg2, abi_long arg3,
1413                             abi_long arg4, abi_long arg5, abi_long arg6,
1414                             bool time64)
1415 {
1416     abi_long rfd_addr, wfd_addr, efd_addr, n, ts_addr;
1417     fd_set rfds, wfds, efds;
1418     fd_set *rfds_ptr, *wfds_ptr, *efds_ptr;
1419     struct timespec ts, *ts_ptr;
1420     abi_long ret;
1421 
1422     /*
1423      * The 6th arg is actually two args smashed together,
1424      * so we cannot use the C library.
1425      */
1426     struct {
1427         sigset_t *set;
1428         size_t size;
1429     } sig, *sig_ptr;
1430 
1431     abi_ulong arg_sigset, arg_sigsize, *arg7;
1432 
1433     n = arg1;
1434     rfd_addr = arg2;
1435     wfd_addr = arg3;
1436     efd_addr = arg4;
1437     ts_addr = arg5;
1438 
1439     ret = copy_from_user_fdset_ptr(&rfds, &rfds_ptr, rfd_addr, n);
1440     if (ret) {
1441         return ret;
1442     }
1443     ret = copy_from_user_fdset_ptr(&wfds, &wfds_ptr, wfd_addr, n);
1444     if (ret) {
1445         return ret;
1446     }
1447     ret = copy_from_user_fdset_ptr(&efds, &efds_ptr, efd_addr, n);
1448     if (ret) {
1449         return ret;
1450     }
1451 
1452     /*
1453      * This takes a timespec, and not a timeval, so we cannot
1454      * use the do_select() helper ...
1455      */
1456     if (ts_addr) {
1457         if (time64) {
1458             if (target_to_host_timespec64(&ts, ts_addr)) {
1459                 return -TARGET_EFAULT;
1460             }
1461         } else {
1462             if (target_to_host_timespec(&ts, ts_addr)) {
1463                 return -TARGET_EFAULT;
1464             }
1465         }
1466             ts_ptr = &ts;
1467     } else {
1468         ts_ptr = NULL;
1469     }
1470 
1471     /* Extract the two packed args for the sigset */
1472     sig_ptr = NULL;
1473     if (arg6) {
1474         arg7 = lock_user(VERIFY_READ, arg6, sizeof(*arg7) * 2, 1);
1475         if (!arg7) {
1476             return -TARGET_EFAULT;
1477         }
1478         arg_sigset = tswapal(arg7[0]);
1479         arg_sigsize = tswapal(arg7[1]);
1480         unlock_user(arg7, arg6, 0);
1481 
1482         if (arg_sigset) {
1483             ret = process_sigsuspend_mask(&sig.set, arg_sigset, arg_sigsize);
1484             if (ret != 0) {
1485                 return ret;
1486             }
1487             sig_ptr = &sig;
1488             sig.size = SIGSET_T_SIZE;
1489         }
1490     }
1491 
1492     ret = get_errno(safe_pselect6(n, rfds_ptr, wfds_ptr, efds_ptr,
1493                                   ts_ptr, sig_ptr));
1494 
1495     if (sig_ptr) {
1496         finish_sigsuspend_mask(ret);
1497     }
1498 
1499     if (!is_error(ret)) {
1500         if (rfd_addr && copy_to_user_fdset(rfd_addr, &rfds, n)) {
1501             return -TARGET_EFAULT;
1502         }
1503         if (wfd_addr && copy_to_user_fdset(wfd_addr, &wfds, n)) {
1504             return -TARGET_EFAULT;
1505         }
1506         if (efd_addr && copy_to_user_fdset(efd_addr, &efds, n)) {
1507             return -TARGET_EFAULT;
1508         }
1509         if (time64) {
1510             if (ts_addr && host_to_target_timespec64(ts_addr, &ts)) {
1511                 return -TARGET_EFAULT;
1512             }
1513         } else {
1514             if (ts_addr && host_to_target_timespec(ts_addr, &ts)) {
1515                 return -TARGET_EFAULT;
1516             }
1517         }
1518     }
1519     return ret;
1520 }
1521 #endif
1522 
1523 #if defined(TARGET_NR_poll) || defined(TARGET_NR_ppoll) || \
1524     defined(TARGET_NR_ppoll_time64)
1525 static abi_long do_ppoll(abi_long arg1, abi_long arg2, abi_long arg3,
1526                          abi_long arg4, abi_long arg5, bool ppoll, bool time64)
1527 {
1528     struct target_pollfd *target_pfd;
1529     unsigned int nfds = arg2;
1530     struct pollfd *pfd;
1531     unsigned int i;
1532     abi_long ret;
1533 
1534     pfd = NULL;
1535     target_pfd = NULL;
1536     if (nfds) {
1537         if (nfds > (INT_MAX / sizeof(struct target_pollfd))) {
1538             return -TARGET_EINVAL;
1539         }
1540         target_pfd = lock_user(VERIFY_WRITE, arg1,
1541                                sizeof(struct target_pollfd) * nfds, 1);
1542         if (!target_pfd) {
1543             return -TARGET_EFAULT;
1544         }
1545 
1546         pfd = alloca(sizeof(struct pollfd) * nfds);
1547         for (i = 0; i < nfds; i++) {
1548             pfd[i].fd = tswap32(target_pfd[i].fd);
1549             pfd[i].events = tswap16(target_pfd[i].events);
1550         }
1551     }
1552     if (ppoll) {
1553         struct timespec _timeout_ts, *timeout_ts = &_timeout_ts;
1554         sigset_t *set = NULL;
1555 
1556         if (arg3) {
1557             if (time64) {
1558                 if (target_to_host_timespec64(timeout_ts, arg3)) {
1559                     unlock_user(target_pfd, arg1, 0);
1560                     return -TARGET_EFAULT;
1561                 }
1562             } else {
1563                 if (target_to_host_timespec(timeout_ts, arg3)) {
1564                     unlock_user(target_pfd, arg1, 0);
1565                     return -TARGET_EFAULT;
1566                 }
1567             }
1568         } else {
1569             timeout_ts = NULL;
1570         }
1571 
1572         if (arg4) {
1573             ret = process_sigsuspend_mask(&set, arg4, arg5);
1574             if (ret != 0) {
1575                 unlock_user(target_pfd, arg1, 0);
1576                 return ret;
1577             }
1578         }
1579 
1580         ret = get_errno(safe_ppoll(pfd, nfds, timeout_ts,
1581                                    set, SIGSET_T_SIZE));
1582 
1583         if (set) {
1584             finish_sigsuspend_mask(ret);
1585         }
1586         if (!is_error(ret) && arg3) {
1587             if (time64) {
1588                 if (host_to_target_timespec64(arg3, timeout_ts)) {
1589                     return -TARGET_EFAULT;
1590                 }
1591             } else {
1592                 if (host_to_target_timespec(arg3, timeout_ts)) {
1593                     return -TARGET_EFAULT;
1594                 }
1595             }
1596         }
1597     } else {
1598           struct timespec ts, *pts;
1599 
1600           if (arg3 >= 0) {
1601               /* Convert ms to secs, ns */
1602               ts.tv_sec = arg3 / 1000;
1603               ts.tv_nsec = (arg3 % 1000) * 1000000LL;
1604               pts = &ts;
1605           } else {
1606               /* -ve poll() timeout means "infinite" */
1607               pts = NULL;
1608           }
1609           ret = get_errno(safe_ppoll(pfd, nfds, pts, NULL, 0));
1610     }
1611 
1612     if (!is_error(ret)) {
1613         for (i = 0; i < nfds; i++) {
1614             target_pfd[i].revents = tswap16(pfd[i].revents);
1615         }
1616     }
1617     unlock_user(target_pfd, arg1, sizeof(struct target_pollfd) * nfds);
1618     return ret;
1619 }
1620 #endif
1621 
1622 static abi_long do_pipe(CPUArchState *cpu_env, abi_ulong pipedes,
1623                         int flags, int is_pipe2)
1624 {
1625     int host_pipe[2];
1626     abi_long ret;
1627     ret = pipe2(host_pipe, flags);
1628 
1629     if (is_error(ret))
1630         return get_errno(ret);
1631 
1632     /* Several targets have special calling conventions for the original
1633        pipe syscall, but didn't replicate this into the pipe2 syscall.  */
1634     if (!is_pipe2) {
1635 #if defined(TARGET_ALPHA)
1636         cpu_env->ir[IR_A4] = host_pipe[1];
1637         return host_pipe[0];
1638 #elif defined(TARGET_MIPS)
1639         cpu_env->active_tc.gpr[3] = host_pipe[1];
1640         return host_pipe[0];
1641 #elif defined(TARGET_SH4)
1642         cpu_env->gregs[1] = host_pipe[1];
1643         return host_pipe[0];
1644 #elif defined(TARGET_SPARC)
1645         cpu_env->regwptr[1] = host_pipe[1];
1646         return host_pipe[0];
1647 #endif
1648     }
1649 
1650     if (put_user_s32(host_pipe[0], pipedes)
1651         || put_user_s32(host_pipe[1], pipedes + sizeof(abi_int)))
1652         return -TARGET_EFAULT;
1653     return get_errno(ret);
1654 }
1655 
1656 static inline abi_long target_to_host_ip_mreq(struct ip_mreqn *mreqn,
1657                                               abi_ulong target_addr,
1658                                               socklen_t len)
1659 {
1660     struct target_ip_mreqn *target_smreqn;
1661 
1662     target_smreqn = lock_user(VERIFY_READ, target_addr, len, 1);
1663     if (!target_smreqn)
1664         return -TARGET_EFAULT;
1665     mreqn->imr_multiaddr.s_addr = target_smreqn->imr_multiaddr.s_addr;
1666     mreqn->imr_address.s_addr = target_smreqn->imr_address.s_addr;
1667     if (len == sizeof(struct target_ip_mreqn))
1668         mreqn->imr_ifindex = tswapal(target_smreqn->imr_ifindex);
1669     unlock_user(target_smreqn, target_addr, 0);
1670 
1671     return 0;
1672 }
1673 
1674 static inline abi_long target_to_host_sockaddr(int fd, struct sockaddr *addr,
1675                                                abi_ulong target_addr,
1676                                                socklen_t len)
1677 {
1678     const socklen_t unix_maxlen = sizeof (struct sockaddr_un);
1679     sa_family_t sa_family;
1680     struct target_sockaddr *target_saddr;
1681 
1682     if (fd_trans_target_to_host_addr(fd)) {
1683         return fd_trans_target_to_host_addr(fd)(addr, target_addr, len);
1684     }
1685 
1686     target_saddr = lock_user(VERIFY_READ, target_addr, len, 1);
1687     if (!target_saddr)
1688         return -TARGET_EFAULT;
1689 
1690     sa_family = tswap16(target_saddr->sa_family);
1691 
1692     /* Oops. The caller might send a incomplete sun_path; sun_path
1693      * must be terminated by \0 (see the manual page), but
1694      * unfortunately it is quite common to specify sockaddr_un
1695      * length as "strlen(x->sun_path)" while it should be
1696      * "strlen(...) + 1". We'll fix that here if needed.
1697      * Linux kernel has a similar feature.
1698      */
1699 
1700     if (sa_family == AF_UNIX) {
1701         if (len < unix_maxlen && len > 0) {
1702             char *cp = (char*)target_saddr;
1703 
1704             if ( cp[len-1] && !cp[len] )
1705                 len++;
1706         }
1707         if (len > unix_maxlen)
1708             len = unix_maxlen;
1709     }
1710 
1711     memcpy(addr, target_saddr, len);
1712     addr->sa_family = sa_family;
1713     if (sa_family == AF_NETLINK) {
1714         struct sockaddr_nl *nladdr;
1715 
1716         nladdr = (struct sockaddr_nl *)addr;
1717         nladdr->nl_pid = tswap32(nladdr->nl_pid);
1718         nladdr->nl_groups = tswap32(nladdr->nl_groups);
1719     } else if (sa_family == AF_PACKET) {
1720 	struct target_sockaddr_ll *lladdr;
1721 
1722 	lladdr = (struct target_sockaddr_ll *)addr;
1723 	lladdr->sll_ifindex = tswap32(lladdr->sll_ifindex);
1724 	lladdr->sll_hatype = tswap16(lladdr->sll_hatype);
1725     }
1726     unlock_user(target_saddr, target_addr, 0);
1727 
1728     return 0;
1729 }
1730 
1731 static inline abi_long host_to_target_sockaddr(abi_ulong target_addr,
1732                                                struct sockaddr *addr,
1733                                                socklen_t len)
1734 {
1735     struct target_sockaddr *target_saddr;
1736 
1737     if (len == 0) {
1738         return 0;
1739     }
1740     assert(addr);
1741 
1742     target_saddr = lock_user(VERIFY_WRITE, target_addr, len, 0);
1743     if (!target_saddr)
1744         return -TARGET_EFAULT;
1745     memcpy(target_saddr, addr, len);
1746     if (len >= offsetof(struct target_sockaddr, sa_family) +
1747         sizeof(target_saddr->sa_family)) {
1748         target_saddr->sa_family = tswap16(addr->sa_family);
1749     }
1750     if (addr->sa_family == AF_NETLINK &&
1751         len >= sizeof(struct target_sockaddr_nl)) {
1752         struct target_sockaddr_nl *target_nl =
1753                (struct target_sockaddr_nl *)target_saddr;
1754         target_nl->nl_pid = tswap32(target_nl->nl_pid);
1755         target_nl->nl_groups = tswap32(target_nl->nl_groups);
1756     } else if (addr->sa_family == AF_PACKET) {
1757         struct sockaddr_ll *target_ll = (struct sockaddr_ll *)target_saddr;
1758         target_ll->sll_ifindex = tswap32(target_ll->sll_ifindex);
1759         target_ll->sll_hatype = tswap16(target_ll->sll_hatype);
1760     } else if (addr->sa_family == AF_INET6 &&
1761                len >= sizeof(struct target_sockaddr_in6)) {
1762         struct target_sockaddr_in6 *target_in6 =
1763                (struct target_sockaddr_in6 *)target_saddr;
1764         target_in6->sin6_scope_id = tswap16(target_in6->sin6_scope_id);
1765     }
1766     unlock_user(target_saddr, target_addr, len);
1767 
1768     return 0;
1769 }
1770 
1771 static inline abi_long target_to_host_cmsg(struct msghdr *msgh,
1772                                            struct target_msghdr *target_msgh)
1773 {
1774     struct cmsghdr *cmsg = CMSG_FIRSTHDR(msgh);
1775     abi_long msg_controllen;
1776     abi_ulong target_cmsg_addr;
1777     struct target_cmsghdr *target_cmsg, *target_cmsg_start;
1778     socklen_t space = 0;
1779 
1780     msg_controllen = tswapal(target_msgh->msg_controllen);
1781     if (msg_controllen < sizeof (struct target_cmsghdr))
1782         goto the_end;
1783     target_cmsg_addr = tswapal(target_msgh->msg_control);
1784     target_cmsg = lock_user(VERIFY_READ, target_cmsg_addr, msg_controllen, 1);
1785     target_cmsg_start = target_cmsg;
1786     if (!target_cmsg)
1787         return -TARGET_EFAULT;
1788 
1789     while (cmsg && target_cmsg) {
1790         void *data = CMSG_DATA(cmsg);
1791         void *target_data = TARGET_CMSG_DATA(target_cmsg);
1792 
1793         int len = tswapal(target_cmsg->cmsg_len)
1794             - sizeof(struct target_cmsghdr);
1795 
1796         space += CMSG_SPACE(len);
1797         if (space > msgh->msg_controllen) {
1798             space -= CMSG_SPACE(len);
1799             /* This is a QEMU bug, since we allocated the payload
1800              * area ourselves (unlike overflow in host-to-target
1801              * conversion, which is just the guest giving us a buffer
1802              * that's too small). It can't happen for the payload types
1803              * we currently support; if it becomes an issue in future
1804              * we would need to improve our allocation strategy to
1805              * something more intelligent than "twice the size of the
1806              * target buffer we're reading from".
1807              */
1808             qemu_log_mask(LOG_UNIMP,
1809                           ("Unsupported ancillary data %d/%d: "
1810                            "unhandled msg size\n"),
1811                           tswap32(target_cmsg->cmsg_level),
1812                           tswap32(target_cmsg->cmsg_type));
1813             break;
1814         }
1815 
1816         if (tswap32(target_cmsg->cmsg_level) == TARGET_SOL_SOCKET) {
1817             cmsg->cmsg_level = SOL_SOCKET;
1818         } else {
1819             cmsg->cmsg_level = tswap32(target_cmsg->cmsg_level);
1820         }
1821         cmsg->cmsg_type = tswap32(target_cmsg->cmsg_type);
1822         cmsg->cmsg_len = CMSG_LEN(len);
1823 
1824         if (cmsg->cmsg_level == SOL_SOCKET && cmsg->cmsg_type == SCM_RIGHTS) {
1825             int *fd = (int *)data;
1826             int *target_fd = (int *)target_data;
1827             int i, numfds = len / sizeof(int);
1828 
1829             for (i = 0; i < numfds; i++) {
1830                 __get_user(fd[i], target_fd + i);
1831             }
1832         } else if (cmsg->cmsg_level == SOL_SOCKET
1833                &&  cmsg->cmsg_type == SCM_CREDENTIALS) {
1834             struct ucred *cred = (struct ucred *)data;
1835             struct target_ucred *target_cred =
1836                 (struct target_ucred *)target_data;
1837 
1838             __get_user(cred->pid, &target_cred->pid);
1839             __get_user(cred->uid, &target_cred->uid);
1840             __get_user(cred->gid, &target_cred->gid);
1841         } else {
1842             qemu_log_mask(LOG_UNIMP, "Unsupported ancillary data: %d/%d\n",
1843                           cmsg->cmsg_level, cmsg->cmsg_type);
1844             memcpy(data, target_data, len);
1845         }
1846 
1847         cmsg = CMSG_NXTHDR(msgh, cmsg);
1848         target_cmsg = TARGET_CMSG_NXTHDR(target_msgh, target_cmsg,
1849                                          target_cmsg_start);
1850     }
1851     unlock_user(target_cmsg, target_cmsg_addr, 0);
1852  the_end:
1853     msgh->msg_controllen = space;
1854     return 0;
1855 }
1856 
1857 static inline abi_long host_to_target_cmsg(struct target_msghdr *target_msgh,
1858                                            struct msghdr *msgh)
1859 {
1860     struct cmsghdr *cmsg = CMSG_FIRSTHDR(msgh);
1861     abi_long msg_controllen;
1862     abi_ulong target_cmsg_addr;
1863     struct target_cmsghdr *target_cmsg, *target_cmsg_start;
1864     socklen_t space = 0;
1865 
1866     msg_controllen = tswapal(target_msgh->msg_controllen);
1867     if (msg_controllen < sizeof (struct target_cmsghdr))
1868         goto the_end;
1869     target_cmsg_addr = tswapal(target_msgh->msg_control);
1870     target_cmsg = lock_user(VERIFY_WRITE, target_cmsg_addr, msg_controllen, 0);
1871     target_cmsg_start = target_cmsg;
1872     if (!target_cmsg)
1873         return -TARGET_EFAULT;
1874 
1875     while (cmsg && target_cmsg) {
1876         void *data = CMSG_DATA(cmsg);
1877         void *target_data = TARGET_CMSG_DATA(target_cmsg);
1878 
1879         int len = cmsg->cmsg_len - sizeof(struct cmsghdr);
1880         int tgt_len, tgt_space;
1881 
1882         /* We never copy a half-header but may copy half-data;
1883          * this is Linux's behaviour in put_cmsg(). Note that
1884          * truncation here is a guest problem (which we report
1885          * to the guest via the CTRUNC bit), unlike truncation
1886          * in target_to_host_cmsg, which is a QEMU bug.
1887          */
1888         if (msg_controllen < sizeof(struct target_cmsghdr)) {
1889             target_msgh->msg_flags |= tswap32(MSG_CTRUNC);
1890             break;
1891         }
1892 
1893         if (cmsg->cmsg_level == SOL_SOCKET) {
1894             target_cmsg->cmsg_level = tswap32(TARGET_SOL_SOCKET);
1895         } else {
1896             target_cmsg->cmsg_level = tswap32(cmsg->cmsg_level);
1897         }
1898         target_cmsg->cmsg_type = tswap32(cmsg->cmsg_type);
1899 
1900         /* Payload types which need a different size of payload on
1901          * the target must adjust tgt_len here.
1902          */
1903         tgt_len = len;
1904         switch (cmsg->cmsg_level) {
1905         case SOL_SOCKET:
1906             switch (cmsg->cmsg_type) {
1907             case SO_TIMESTAMP:
1908                 tgt_len = sizeof(struct target_timeval);
1909                 break;
1910             default:
1911                 break;
1912             }
1913             break;
1914         default:
1915             break;
1916         }
1917 
1918         if (msg_controllen < TARGET_CMSG_LEN(tgt_len)) {
1919             target_msgh->msg_flags |= tswap32(MSG_CTRUNC);
1920             tgt_len = msg_controllen - sizeof(struct target_cmsghdr);
1921         }
1922 
1923         /* We must now copy-and-convert len bytes of payload
1924          * into tgt_len bytes of destination space. Bear in mind
1925          * that in both source and destination we may be dealing
1926          * with a truncated value!
1927          */
1928         switch (cmsg->cmsg_level) {
1929         case SOL_SOCKET:
1930             switch (cmsg->cmsg_type) {
1931             case SCM_RIGHTS:
1932             {
1933                 int *fd = (int *)data;
1934                 int *target_fd = (int *)target_data;
1935                 int i, numfds = tgt_len / sizeof(int);
1936 
1937                 for (i = 0; i < numfds; i++) {
1938                     __put_user(fd[i], target_fd + i);
1939                 }
1940                 break;
1941             }
1942             case SO_TIMESTAMP:
1943             {
1944                 struct timeval *tv = (struct timeval *)data;
1945                 struct target_timeval *target_tv =
1946                     (struct target_timeval *)target_data;
1947 
1948                 if (len != sizeof(struct timeval) ||
1949                     tgt_len != sizeof(struct target_timeval)) {
1950                     goto unimplemented;
1951                 }
1952 
1953                 /* copy struct timeval to target */
1954                 __put_user(tv->tv_sec, &target_tv->tv_sec);
1955                 __put_user(tv->tv_usec, &target_tv->tv_usec);
1956                 break;
1957             }
1958             case SCM_CREDENTIALS:
1959             {
1960                 struct ucred *cred = (struct ucred *)data;
1961                 struct target_ucred *target_cred =
1962                     (struct target_ucred *)target_data;
1963 
1964                 __put_user(cred->pid, &target_cred->pid);
1965                 __put_user(cred->uid, &target_cred->uid);
1966                 __put_user(cred->gid, &target_cred->gid);
1967                 break;
1968             }
1969             default:
1970                 goto unimplemented;
1971             }
1972             break;
1973 
1974         case SOL_IP:
1975             switch (cmsg->cmsg_type) {
1976             case IP_TTL:
1977             {
1978                 uint32_t *v = (uint32_t *)data;
1979                 uint32_t *t_int = (uint32_t *)target_data;
1980 
1981                 if (len != sizeof(uint32_t) ||
1982                     tgt_len != sizeof(uint32_t)) {
1983                     goto unimplemented;
1984                 }
1985                 __put_user(*v, t_int);
1986                 break;
1987             }
1988             case IP_RECVERR:
1989             {
1990                 struct errhdr_t {
1991                    struct sock_extended_err ee;
1992                    struct sockaddr_in offender;
1993                 };
1994                 struct errhdr_t *errh = (struct errhdr_t *)data;
1995                 struct errhdr_t *target_errh =
1996                     (struct errhdr_t *)target_data;
1997 
1998                 if (len != sizeof(struct errhdr_t) ||
1999                     tgt_len != sizeof(struct errhdr_t)) {
2000                     goto unimplemented;
2001                 }
2002                 __put_user(errh->ee.ee_errno, &target_errh->ee.ee_errno);
2003                 __put_user(errh->ee.ee_origin, &target_errh->ee.ee_origin);
2004                 __put_user(errh->ee.ee_type,  &target_errh->ee.ee_type);
2005                 __put_user(errh->ee.ee_code, &target_errh->ee.ee_code);
2006                 __put_user(errh->ee.ee_pad, &target_errh->ee.ee_pad);
2007                 __put_user(errh->ee.ee_info, &target_errh->ee.ee_info);
2008                 __put_user(errh->ee.ee_data, &target_errh->ee.ee_data);
2009                 host_to_target_sockaddr((unsigned long) &target_errh->offender,
2010                     (void *) &errh->offender, sizeof(errh->offender));
2011                 break;
2012             }
2013             default:
2014                 goto unimplemented;
2015             }
2016             break;
2017 
2018         case SOL_IPV6:
2019             switch (cmsg->cmsg_type) {
2020             case IPV6_HOPLIMIT:
2021             {
2022                 uint32_t *v = (uint32_t *)data;
2023                 uint32_t *t_int = (uint32_t *)target_data;
2024 
2025                 if (len != sizeof(uint32_t) ||
2026                     tgt_len != sizeof(uint32_t)) {
2027                     goto unimplemented;
2028                 }
2029                 __put_user(*v, t_int);
2030                 break;
2031             }
2032             case IPV6_RECVERR:
2033             {
2034                 struct errhdr6_t {
2035                    struct sock_extended_err ee;
2036                    struct sockaddr_in6 offender;
2037                 };
2038                 struct errhdr6_t *errh = (struct errhdr6_t *)data;
2039                 struct errhdr6_t *target_errh =
2040                     (struct errhdr6_t *)target_data;
2041 
2042                 if (len != sizeof(struct errhdr6_t) ||
2043                     tgt_len != sizeof(struct errhdr6_t)) {
2044                     goto unimplemented;
2045                 }
2046                 __put_user(errh->ee.ee_errno, &target_errh->ee.ee_errno);
2047                 __put_user(errh->ee.ee_origin, &target_errh->ee.ee_origin);
2048                 __put_user(errh->ee.ee_type,  &target_errh->ee.ee_type);
2049                 __put_user(errh->ee.ee_code, &target_errh->ee.ee_code);
2050                 __put_user(errh->ee.ee_pad, &target_errh->ee.ee_pad);
2051                 __put_user(errh->ee.ee_info, &target_errh->ee.ee_info);
2052                 __put_user(errh->ee.ee_data, &target_errh->ee.ee_data);
2053                 host_to_target_sockaddr((unsigned long) &target_errh->offender,
2054                     (void *) &errh->offender, sizeof(errh->offender));
2055                 break;
2056             }
2057             default:
2058                 goto unimplemented;
2059             }
2060             break;
2061 
2062         default:
2063         unimplemented:
2064             qemu_log_mask(LOG_UNIMP, "Unsupported ancillary data: %d/%d\n",
2065                           cmsg->cmsg_level, cmsg->cmsg_type);
2066             memcpy(target_data, data, MIN(len, tgt_len));
2067             if (tgt_len > len) {
2068                 memset(target_data + len, 0, tgt_len - len);
2069             }
2070         }
2071 
2072         target_cmsg->cmsg_len = tswapal(TARGET_CMSG_LEN(tgt_len));
2073         tgt_space = TARGET_CMSG_SPACE(tgt_len);
2074         if (msg_controllen < tgt_space) {
2075             tgt_space = msg_controllen;
2076         }
2077         msg_controllen -= tgt_space;
2078         space += tgt_space;
2079         cmsg = CMSG_NXTHDR(msgh, cmsg);
2080         target_cmsg = TARGET_CMSG_NXTHDR(target_msgh, target_cmsg,
2081                                          target_cmsg_start);
2082     }
2083     unlock_user(target_cmsg, target_cmsg_addr, space);
2084  the_end:
2085     target_msgh->msg_controllen = tswapal(space);
2086     return 0;
2087 }
2088 
2089 /* do_setsockopt() Must return target values and target errnos. */
2090 static abi_long do_setsockopt(int sockfd, int level, int optname,
2091                               abi_ulong optval_addr, socklen_t optlen)
2092 {
2093     abi_long ret;
2094     int val;
2095     struct ip_mreqn *ip_mreq;
2096     struct ip_mreq_source *ip_mreq_source;
2097 
2098     switch(level) {
2099     case SOL_TCP:
2100     case SOL_UDP:
2101         /* TCP and UDP options all take an 'int' value.  */
2102         if (optlen < sizeof(uint32_t))
2103             return -TARGET_EINVAL;
2104 
2105         if (get_user_u32(val, optval_addr))
2106             return -TARGET_EFAULT;
2107         ret = get_errno(setsockopt(sockfd, level, optname, &val, sizeof(val)));
2108         break;
2109     case SOL_IP:
2110         switch(optname) {
2111         case IP_TOS:
2112         case IP_TTL:
2113         case IP_HDRINCL:
2114         case IP_ROUTER_ALERT:
2115         case IP_RECVOPTS:
2116         case IP_RETOPTS:
2117         case IP_PKTINFO:
2118         case IP_MTU_DISCOVER:
2119         case IP_RECVERR:
2120         case IP_RECVTTL:
2121         case IP_RECVTOS:
2122 #ifdef IP_FREEBIND
2123         case IP_FREEBIND:
2124 #endif
2125         case IP_MULTICAST_TTL:
2126         case IP_MULTICAST_LOOP:
2127             val = 0;
2128             if (optlen >= sizeof(uint32_t)) {
2129                 if (get_user_u32(val, optval_addr))
2130                     return -TARGET_EFAULT;
2131             } else if (optlen >= 1) {
2132                 if (get_user_u8(val, optval_addr))
2133                     return -TARGET_EFAULT;
2134             }
2135             ret = get_errno(setsockopt(sockfd, level, optname, &val, sizeof(val)));
2136             break;
2137         case IP_ADD_MEMBERSHIP:
2138         case IP_DROP_MEMBERSHIP:
2139             if (optlen < sizeof (struct target_ip_mreq) ||
2140                 optlen > sizeof (struct target_ip_mreqn))
2141                 return -TARGET_EINVAL;
2142 
2143             ip_mreq = (struct ip_mreqn *) alloca(optlen);
2144             target_to_host_ip_mreq(ip_mreq, optval_addr, optlen);
2145             ret = get_errno(setsockopt(sockfd, level, optname, ip_mreq, optlen));
2146             break;
2147 
2148         case IP_BLOCK_SOURCE:
2149         case IP_UNBLOCK_SOURCE:
2150         case IP_ADD_SOURCE_MEMBERSHIP:
2151         case IP_DROP_SOURCE_MEMBERSHIP:
2152             if (optlen != sizeof (struct target_ip_mreq_source))
2153                 return -TARGET_EINVAL;
2154 
2155             ip_mreq_source = lock_user(VERIFY_READ, optval_addr, optlen, 1);
2156             if (!ip_mreq_source) {
2157                 return -TARGET_EFAULT;
2158             }
2159             ret = get_errno(setsockopt(sockfd, level, optname, ip_mreq_source, optlen));
2160             unlock_user (ip_mreq_source, optval_addr, 0);
2161             break;
2162 
2163         default:
2164             goto unimplemented;
2165         }
2166         break;
2167     case SOL_IPV6:
2168         switch (optname) {
2169         case IPV6_MTU_DISCOVER:
2170         case IPV6_MTU:
2171         case IPV6_V6ONLY:
2172         case IPV6_RECVPKTINFO:
2173         case IPV6_UNICAST_HOPS:
2174         case IPV6_MULTICAST_HOPS:
2175         case IPV6_MULTICAST_LOOP:
2176         case IPV6_RECVERR:
2177         case IPV6_RECVHOPLIMIT:
2178         case IPV6_2292HOPLIMIT:
2179         case IPV6_CHECKSUM:
2180         case IPV6_ADDRFORM:
2181         case IPV6_2292PKTINFO:
2182         case IPV6_RECVTCLASS:
2183         case IPV6_RECVRTHDR:
2184         case IPV6_2292RTHDR:
2185         case IPV6_RECVHOPOPTS:
2186         case IPV6_2292HOPOPTS:
2187         case IPV6_RECVDSTOPTS:
2188         case IPV6_2292DSTOPTS:
2189         case IPV6_TCLASS:
2190         case IPV6_ADDR_PREFERENCES:
2191 #ifdef IPV6_RECVPATHMTU
2192         case IPV6_RECVPATHMTU:
2193 #endif
2194 #ifdef IPV6_TRANSPARENT
2195         case IPV6_TRANSPARENT:
2196 #endif
2197 #ifdef IPV6_FREEBIND
2198         case IPV6_FREEBIND:
2199 #endif
2200 #ifdef IPV6_RECVORIGDSTADDR
2201         case IPV6_RECVORIGDSTADDR:
2202 #endif
2203             val = 0;
2204             if (optlen < sizeof(uint32_t)) {
2205                 return -TARGET_EINVAL;
2206             }
2207             if (get_user_u32(val, optval_addr)) {
2208                 return -TARGET_EFAULT;
2209             }
2210             ret = get_errno(setsockopt(sockfd, level, optname,
2211                                        &val, sizeof(val)));
2212             break;
2213         case IPV6_PKTINFO:
2214         {
2215             struct in6_pktinfo pki;
2216 
2217             if (optlen < sizeof(pki)) {
2218                 return -TARGET_EINVAL;
2219             }
2220 
2221             if (copy_from_user(&pki, optval_addr, sizeof(pki))) {
2222                 return -TARGET_EFAULT;
2223             }
2224 
2225             pki.ipi6_ifindex = tswap32(pki.ipi6_ifindex);
2226 
2227             ret = get_errno(setsockopt(sockfd, level, optname,
2228                                        &pki, sizeof(pki)));
2229             break;
2230         }
2231         case IPV6_ADD_MEMBERSHIP:
2232         case IPV6_DROP_MEMBERSHIP:
2233         {
2234             struct ipv6_mreq ipv6mreq;
2235 
2236             if (optlen < sizeof(ipv6mreq)) {
2237                 return -TARGET_EINVAL;
2238             }
2239 
2240             if (copy_from_user(&ipv6mreq, optval_addr, sizeof(ipv6mreq))) {
2241                 return -TARGET_EFAULT;
2242             }
2243 
2244             ipv6mreq.ipv6mr_interface = tswap32(ipv6mreq.ipv6mr_interface);
2245 
2246             ret = get_errno(setsockopt(sockfd, level, optname,
2247                                        &ipv6mreq, sizeof(ipv6mreq)));
2248             break;
2249         }
2250         default:
2251             goto unimplemented;
2252         }
2253         break;
2254     case SOL_ICMPV6:
2255         switch (optname) {
2256         case ICMPV6_FILTER:
2257         {
2258             struct icmp6_filter icmp6f;
2259 
2260             if (optlen > sizeof(icmp6f)) {
2261                 optlen = sizeof(icmp6f);
2262             }
2263 
2264             if (copy_from_user(&icmp6f, optval_addr, optlen)) {
2265                 return -TARGET_EFAULT;
2266             }
2267 
2268             for (val = 0; val < 8; val++) {
2269                 icmp6f.data[val] = tswap32(icmp6f.data[val]);
2270             }
2271 
2272             ret = get_errno(setsockopt(sockfd, level, optname,
2273                                        &icmp6f, optlen));
2274             break;
2275         }
2276         default:
2277             goto unimplemented;
2278         }
2279         break;
2280     case SOL_RAW:
2281         switch (optname) {
2282         case ICMP_FILTER:
2283         case IPV6_CHECKSUM:
2284             /* those take an u32 value */
2285             if (optlen < sizeof(uint32_t)) {
2286                 return -TARGET_EINVAL;
2287             }
2288 
2289             if (get_user_u32(val, optval_addr)) {
2290                 return -TARGET_EFAULT;
2291             }
2292             ret = get_errno(setsockopt(sockfd, level, optname,
2293                                        &val, sizeof(val)));
2294             break;
2295 
2296         default:
2297             goto unimplemented;
2298         }
2299         break;
2300 #if defined(SOL_ALG) && defined(ALG_SET_KEY) && defined(ALG_SET_AEAD_AUTHSIZE)
2301     case SOL_ALG:
2302         switch (optname) {
2303         case ALG_SET_KEY:
2304         {
2305             char *alg_key = g_malloc(optlen);
2306 
2307             if (!alg_key) {
2308                 return -TARGET_ENOMEM;
2309             }
2310             if (copy_from_user(alg_key, optval_addr, optlen)) {
2311                 g_free(alg_key);
2312                 return -TARGET_EFAULT;
2313             }
2314             ret = get_errno(setsockopt(sockfd, level, optname,
2315                                        alg_key, optlen));
2316             g_free(alg_key);
2317             break;
2318         }
2319         case ALG_SET_AEAD_AUTHSIZE:
2320         {
2321             ret = get_errno(setsockopt(sockfd, level, optname,
2322                                        NULL, optlen));
2323             break;
2324         }
2325         default:
2326             goto unimplemented;
2327         }
2328         break;
2329 #endif
2330     case TARGET_SOL_SOCKET:
2331         switch (optname) {
2332         case TARGET_SO_RCVTIMEO:
2333         {
2334                 struct timeval tv;
2335 
2336                 optname = SO_RCVTIMEO;
2337 
2338 set_timeout:
2339                 if (optlen != sizeof(struct target_timeval)) {
2340                     return -TARGET_EINVAL;
2341                 }
2342 
2343                 if (copy_from_user_timeval(&tv, optval_addr)) {
2344                     return -TARGET_EFAULT;
2345                 }
2346 
2347                 ret = get_errno(setsockopt(sockfd, SOL_SOCKET, optname,
2348                                 &tv, sizeof(tv)));
2349                 return ret;
2350         }
2351         case TARGET_SO_SNDTIMEO:
2352                 optname = SO_SNDTIMEO;
2353                 goto set_timeout;
2354         case TARGET_SO_ATTACH_FILTER:
2355         {
2356                 struct target_sock_fprog *tfprog;
2357                 struct target_sock_filter *tfilter;
2358                 struct sock_fprog fprog;
2359                 struct sock_filter *filter;
2360                 int i;
2361 
2362                 if (optlen != sizeof(*tfprog)) {
2363                     return -TARGET_EINVAL;
2364                 }
2365                 if (!lock_user_struct(VERIFY_READ, tfprog, optval_addr, 0)) {
2366                     return -TARGET_EFAULT;
2367                 }
2368                 if (!lock_user_struct(VERIFY_READ, tfilter,
2369                                       tswapal(tfprog->filter), 0)) {
2370                     unlock_user_struct(tfprog, optval_addr, 1);
2371                     return -TARGET_EFAULT;
2372                 }
2373 
2374                 fprog.len = tswap16(tfprog->len);
2375                 filter = g_try_new(struct sock_filter, fprog.len);
2376                 if (filter == NULL) {
2377                     unlock_user_struct(tfilter, tfprog->filter, 1);
2378                     unlock_user_struct(tfprog, optval_addr, 1);
2379                     return -TARGET_ENOMEM;
2380                 }
2381                 for (i = 0; i < fprog.len; i++) {
2382                     filter[i].code = tswap16(tfilter[i].code);
2383                     filter[i].jt = tfilter[i].jt;
2384                     filter[i].jf = tfilter[i].jf;
2385                     filter[i].k = tswap32(tfilter[i].k);
2386                 }
2387                 fprog.filter = filter;
2388 
2389                 ret = get_errno(setsockopt(sockfd, SOL_SOCKET,
2390                                 SO_ATTACH_FILTER, &fprog, sizeof(fprog)));
2391                 g_free(filter);
2392 
2393                 unlock_user_struct(tfilter, tfprog->filter, 1);
2394                 unlock_user_struct(tfprog, optval_addr, 1);
2395                 return ret;
2396         }
2397 	case TARGET_SO_BINDTODEVICE:
2398 	{
2399 		char *dev_ifname, *addr_ifname;
2400 
2401 		if (optlen > IFNAMSIZ - 1) {
2402 		    optlen = IFNAMSIZ - 1;
2403 		}
2404 		dev_ifname = lock_user(VERIFY_READ, optval_addr, optlen, 1);
2405 		if (!dev_ifname) {
2406 		    return -TARGET_EFAULT;
2407 		}
2408 		optname = SO_BINDTODEVICE;
2409 		addr_ifname = alloca(IFNAMSIZ);
2410 		memcpy(addr_ifname, dev_ifname, optlen);
2411 		addr_ifname[optlen] = 0;
2412 		ret = get_errno(setsockopt(sockfd, SOL_SOCKET, optname,
2413                                            addr_ifname, optlen));
2414 		unlock_user (dev_ifname, optval_addr, 0);
2415 		return ret;
2416 	}
2417         case TARGET_SO_LINGER:
2418         {
2419                 struct linger lg;
2420                 struct target_linger *tlg;
2421 
2422                 if (optlen != sizeof(struct target_linger)) {
2423                     return -TARGET_EINVAL;
2424                 }
2425                 if (!lock_user_struct(VERIFY_READ, tlg, optval_addr, 1)) {
2426                     return -TARGET_EFAULT;
2427                 }
2428                 __get_user(lg.l_onoff, &tlg->l_onoff);
2429                 __get_user(lg.l_linger, &tlg->l_linger);
2430                 ret = get_errno(setsockopt(sockfd, SOL_SOCKET, SO_LINGER,
2431                                 &lg, sizeof(lg)));
2432                 unlock_user_struct(tlg, optval_addr, 0);
2433                 return ret;
2434         }
2435             /* Options with 'int' argument.  */
2436         case TARGET_SO_DEBUG:
2437 		optname = SO_DEBUG;
2438 		break;
2439         case TARGET_SO_REUSEADDR:
2440 		optname = SO_REUSEADDR;
2441 		break;
2442 #ifdef SO_REUSEPORT
2443         case TARGET_SO_REUSEPORT:
2444                 optname = SO_REUSEPORT;
2445                 break;
2446 #endif
2447         case TARGET_SO_TYPE:
2448 		optname = SO_TYPE;
2449 		break;
2450         case TARGET_SO_ERROR:
2451 		optname = SO_ERROR;
2452 		break;
2453         case TARGET_SO_DONTROUTE:
2454 		optname = SO_DONTROUTE;
2455 		break;
2456         case TARGET_SO_BROADCAST:
2457 		optname = SO_BROADCAST;
2458 		break;
2459         case TARGET_SO_SNDBUF:
2460 		optname = SO_SNDBUF;
2461 		break;
2462         case TARGET_SO_SNDBUFFORCE:
2463                 optname = SO_SNDBUFFORCE;
2464                 break;
2465         case TARGET_SO_RCVBUF:
2466 		optname = SO_RCVBUF;
2467 		break;
2468         case TARGET_SO_RCVBUFFORCE:
2469                 optname = SO_RCVBUFFORCE;
2470                 break;
2471         case TARGET_SO_KEEPALIVE:
2472 		optname = SO_KEEPALIVE;
2473 		break;
2474         case TARGET_SO_OOBINLINE:
2475 		optname = SO_OOBINLINE;
2476 		break;
2477         case TARGET_SO_NO_CHECK:
2478 		optname = SO_NO_CHECK;
2479 		break;
2480         case TARGET_SO_PRIORITY:
2481 		optname = SO_PRIORITY;
2482 		break;
2483 #ifdef SO_BSDCOMPAT
2484         case TARGET_SO_BSDCOMPAT:
2485 		optname = SO_BSDCOMPAT;
2486 		break;
2487 #endif
2488         case TARGET_SO_PASSCRED:
2489 		optname = SO_PASSCRED;
2490 		break;
2491         case TARGET_SO_PASSSEC:
2492                 optname = SO_PASSSEC;
2493                 break;
2494         case TARGET_SO_TIMESTAMP:
2495 		optname = SO_TIMESTAMP;
2496 		break;
2497         case TARGET_SO_RCVLOWAT:
2498 		optname = SO_RCVLOWAT;
2499 		break;
2500         default:
2501             goto unimplemented;
2502         }
2503 	if (optlen < sizeof(uint32_t))
2504             return -TARGET_EINVAL;
2505 
2506 	if (get_user_u32(val, optval_addr))
2507             return -TARGET_EFAULT;
2508 	ret = get_errno(setsockopt(sockfd, SOL_SOCKET, optname, &val, sizeof(val)));
2509         break;
2510 #ifdef SOL_NETLINK
2511     case SOL_NETLINK:
2512         switch (optname) {
2513         case NETLINK_PKTINFO:
2514         case NETLINK_ADD_MEMBERSHIP:
2515         case NETLINK_DROP_MEMBERSHIP:
2516         case NETLINK_BROADCAST_ERROR:
2517         case NETLINK_NO_ENOBUFS:
2518 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 2, 0)
2519         case NETLINK_LISTEN_ALL_NSID:
2520         case NETLINK_CAP_ACK:
2521 #endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 2, 0) */
2522 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 12, 0)
2523         case NETLINK_EXT_ACK:
2524 #endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 12, 0) */
2525 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 20, 0)
2526         case NETLINK_GET_STRICT_CHK:
2527 #endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 12, 0) */
2528             break;
2529         default:
2530             goto unimplemented;
2531         }
2532         val = 0;
2533         if (optlen < sizeof(uint32_t)) {
2534             return -TARGET_EINVAL;
2535         }
2536         if (get_user_u32(val, optval_addr)) {
2537             return -TARGET_EFAULT;
2538         }
2539         ret = get_errno(setsockopt(sockfd, SOL_NETLINK, optname, &val,
2540                                    sizeof(val)));
2541         break;
2542 #endif /* SOL_NETLINK */
2543     default:
2544     unimplemented:
2545         qemu_log_mask(LOG_UNIMP, "Unsupported setsockopt level=%d optname=%d\n",
2546                       level, optname);
2547         ret = -TARGET_ENOPROTOOPT;
2548     }
2549     return ret;
2550 }
2551 
2552 /* do_getsockopt() Must return target values and target errnos. */
2553 static abi_long do_getsockopt(int sockfd, int level, int optname,
2554                               abi_ulong optval_addr, abi_ulong optlen)
2555 {
2556     abi_long ret;
2557     int len, val;
2558     socklen_t lv;
2559 
2560     switch(level) {
2561     case TARGET_SOL_SOCKET:
2562         level = SOL_SOCKET;
2563         switch (optname) {
2564         /* These don't just return a single integer */
2565         case TARGET_SO_PEERNAME:
2566             goto unimplemented;
2567         case TARGET_SO_RCVTIMEO: {
2568             struct timeval tv;
2569             socklen_t tvlen;
2570 
2571             optname = SO_RCVTIMEO;
2572 
2573 get_timeout:
2574             if (get_user_u32(len, optlen)) {
2575                 return -TARGET_EFAULT;
2576             }
2577             if (len < 0) {
2578                 return -TARGET_EINVAL;
2579             }
2580 
2581             tvlen = sizeof(tv);
2582             ret = get_errno(getsockopt(sockfd, level, optname,
2583                                        &tv, &tvlen));
2584             if (ret < 0) {
2585                 return ret;
2586             }
2587             if (len > sizeof(struct target_timeval)) {
2588                 len = sizeof(struct target_timeval);
2589             }
2590             if (copy_to_user_timeval(optval_addr, &tv)) {
2591                 return -TARGET_EFAULT;
2592             }
2593             if (put_user_u32(len, optlen)) {
2594                 return -TARGET_EFAULT;
2595             }
2596             break;
2597         }
2598         case TARGET_SO_SNDTIMEO:
2599             optname = SO_SNDTIMEO;
2600             goto get_timeout;
2601         case TARGET_SO_PEERCRED: {
2602             struct ucred cr;
2603             socklen_t crlen;
2604             struct target_ucred *tcr;
2605 
2606             if (get_user_u32(len, optlen)) {
2607                 return -TARGET_EFAULT;
2608             }
2609             if (len < 0) {
2610                 return -TARGET_EINVAL;
2611             }
2612 
2613             crlen = sizeof(cr);
2614             ret = get_errno(getsockopt(sockfd, level, SO_PEERCRED,
2615                                        &cr, &crlen));
2616             if (ret < 0) {
2617                 return ret;
2618             }
2619             if (len > crlen) {
2620                 len = crlen;
2621             }
2622             if (!lock_user_struct(VERIFY_WRITE, tcr, optval_addr, 0)) {
2623                 return -TARGET_EFAULT;
2624             }
2625             __put_user(cr.pid, &tcr->pid);
2626             __put_user(cr.uid, &tcr->uid);
2627             __put_user(cr.gid, &tcr->gid);
2628             unlock_user_struct(tcr, optval_addr, 1);
2629             if (put_user_u32(len, optlen)) {
2630                 return -TARGET_EFAULT;
2631             }
2632             break;
2633         }
2634         case TARGET_SO_PEERSEC: {
2635             char *name;
2636 
2637             if (get_user_u32(len, optlen)) {
2638                 return -TARGET_EFAULT;
2639             }
2640             if (len < 0) {
2641                 return -TARGET_EINVAL;
2642             }
2643             name = lock_user(VERIFY_WRITE, optval_addr, len, 0);
2644             if (!name) {
2645                 return -TARGET_EFAULT;
2646             }
2647             lv = len;
2648             ret = get_errno(getsockopt(sockfd, level, SO_PEERSEC,
2649                                        name, &lv));
2650             if (put_user_u32(lv, optlen)) {
2651                 ret = -TARGET_EFAULT;
2652             }
2653             unlock_user(name, optval_addr, lv);
2654             break;
2655         }
2656         case TARGET_SO_LINGER:
2657         {
2658             struct linger lg;
2659             socklen_t lglen;
2660             struct target_linger *tlg;
2661 
2662             if (get_user_u32(len, optlen)) {
2663                 return -TARGET_EFAULT;
2664             }
2665             if (len < 0) {
2666                 return -TARGET_EINVAL;
2667             }
2668 
2669             lglen = sizeof(lg);
2670             ret = get_errno(getsockopt(sockfd, level, SO_LINGER,
2671                                        &lg, &lglen));
2672             if (ret < 0) {
2673                 return ret;
2674             }
2675             if (len > lglen) {
2676                 len = lglen;
2677             }
2678             if (!lock_user_struct(VERIFY_WRITE, tlg, optval_addr, 0)) {
2679                 return -TARGET_EFAULT;
2680             }
2681             __put_user(lg.l_onoff, &tlg->l_onoff);
2682             __put_user(lg.l_linger, &tlg->l_linger);
2683             unlock_user_struct(tlg, optval_addr, 1);
2684             if (put_user_u32(len, optlen)) {
2685                 return -TARGET_EFAULT;
2686             }
2687             break;
2688         }
2689         /* Options with 'int' argument.  */
2690         case TARGET_SO_DEBUG:
2691             optname = SO_DEBUG;
2692             goto int_case;
2693         case TARGET_SO_REUSEADDR:
2694             optname = SO_REUSEADDR;
2695             goto int_case;
2696 #ifdef SO_REUSEPORT
2697         case TARGET_SO_REUSEPORT:
2698             optname = SO_REUSEPORT;
2699             goto int_case;
2700 #endif
2701         case TARGET_SO_TYPE:
2702             optname = SO_TYPE;
2703             goto int_case;
2704         case TARGET_SO_ERROR:
2705             optname = SO_ERROR;
2706             goto int_case;
2707         case TARGET_SO_DONTROUTE:
2708             optname = SO_DONTROUTE;
2709             goto int_case;
2710         case TARGET_SO_BROADCAST:
2711             optname = SO_BROADCAST;
2712             goto int_case;
2713         case TARGET_SO_SNDBUF:
2714             optname = SO_SNDBUF;
2715             goto int_case;
2716         case TARGET_SO_RCVBUF:
2717             optname = SO_RCVBUF;
2718             goto int_case;
2719         case TARGET_SO_KEEPALIVE:
2720             optname = SO_KEEPALIVE;
2721             goto int_case;
2722         case TARGET_SO_OOBINLINE:
2723             optname = SO_OOBINLINE;
2724             goto int_case;
2725         case TARGET_SO_NO_CHECK:
2726             optname = SO_NO_CHECK;
2727             goto int_case;
2728         case TARGET_SO_PRIORITY:
2729             optname = SO_PRIORITY;
2730             goto int_case;
2731 #ifdef SO_BSDCOMPAT
2732         case TARGET_SO_BSDCOMPAT:
2733             optname = SO_BSDCOMPAT;
2734             goto int_case;
2735 #endif
2736         case TARGET_SO_PASSCRED:
2737             optname = SO_PASSCRED;
2738             goto int_case;
2739         case TARGET_SO_TIMESTAMP:
2740             optname = SO_TIMESTAMP;
2741             goto int_case;
2742         case TARGET_SO_RCVLOWAT:
2743             optname = SO_RCVLOWAT;
2744             goto int_case;
2745         case TARGET_SO_ACCEPTCONN:
2746             optname = SO_ACCEPTCONN;
2747             goto int_case;
2748         case TARGET_SO_PROTOCOL:
2749             optname = SO_PROTOCOL;
2750             goto int_case;
2751         case TARGET_SO_DOMAIN:
2752             optname = SO_DOMAIN;
2753             goto int_case;
2754         default:
2755             goto int_case;
2756         }
2757         break;
2758     case SOL_TCP:
2759     case SOL_UDP:
2760         /* TCP and UDP options all take an 'int' value.  */
2761     int_case:
2762         if (get_user_u32(len, optlen))
2763             return -TARGET_EFAULT;
2764         if (len < 0)
2765             return -TARGET_EINVAL;
2766         lv = sizeof(lv);
2767         ret = get_errno(getsockopt(sockfd, level, optname, &val, &lv));
2768         if (ret < 0)
2769             return ret;
2770         if (optname == SO_TYPE) {
2771             val = host_to_target_sock_type(val);
2772         }
2773         if (len > lv)
2774             len = lv;
2775         if (len == 4) {
2776             if (put_user_u32(val, optval_addr))
2777                 return -TARGET_EFAULT;
2778         } else {
2779             if (put_user_u8(val, optval_addr))
2780                 return -TARGET_EFAULT;
2781         }
2782         if (put_user_u32(len, optlen))
2783             return -TARGET_EFAULT;
2784         break;
2785     case SOL_IP:
2786         switch(optname) {
2787         case IP_TOS:
2788         case IP_TTL:
2789         case IP_HDRINCL:
2790         case IP_ROUTER_ALERT:
2791         case IP_RECVOPTS:
2792         case IP_RETOPTS:
2793         case IP_PKTINFO:
2794         case IP_MTU_DISCOVER:
2795         case IP_RECVERR:
2796         case IP_RECVTOS:
2797 #ifdef IP_FREEBIND
2798         case IP_FREEBIND:
2799 #endif
2800         case IP_MULTICAST_TTL:
2801         case IP_MULTICAST_LOOP:
2802             if (get_user_u32(len, optlen))
2803                 return -TARGET_EFAULT;
2804             if (len < 0)
2805                 return -TARGET_EINVAL;
2806             lv = sizeof(lv);
2807             ret = get_errno(getsockopt(sockfd, level, optname, &val, &lv));
2808             if (ret < 0)
2809                 return ret;
2810             if (len < sizeof(int) && len > 0 && val >= 0 && val < 255) {
2811                 len = 1;
2812                 if (put_user_u32(len, optlen)
2813                     || put_user_u8(val, optval_addr))
2814                     return -TARGET_EFAULT;
2815             } else {
2816                 if (len > sizeof(int))
2817                     len = sizeof(int);
2818                 if (put_user_u32(len, optlen)
2819                     || put_user_u32(val, optval_addr))
2820                     return -TARGET_EFAULT;
2821             }
2822             break;
2823         default:
2824             ret = -TARGET_ENOPROTOOPT;
2825             break;
2826         }
2827         break;
2828     case SOL_IPV6:
2829         switch (optname) {
2830         case IPV6_MTU_DISCOVER:
2831         case IPV6_MTU:
2832         case IPV6_V6ONLY:
2833         case IPV6_RECVPKTINFO:
2834         case IPV6_UNICAST_HOPS:
2835         case IPV6_MULTICAST_HOPS:
2836         case IPV6_MULTICAST_LOOP:
2837         case IPV6_RECVERR:
2838         case IPV6_RECVHOPLIMIT:
2839         case IPV6_2292HOPLIMIT:
2840         case IPV6_CHECKSUM:
2841         case IPV6_ADDRFORM:
2842         case IPV6_2292PKTINFO:
2843         case IPV6_RECVTCLASS:
2844         case IPV6_RECVRTHDR:
2845         case IPV6_2292RTHDR:
2846         case IPV6_RECVHOPOPTS:
2847         case IPV6_2292HOPOPTS:
2848         case IPV6_RECVDSTOPTS:
2849         case IPV6_2292DSTOPTS:
2850         case IPV6_TCLASS:
2851         case IPV6_ADDR_PREFERENCES:
2852 #ifdef IPV6_RECVPATHMTU
2853         case IPV6_RECVPATHMTU:
2854 #endif
2855 #ifdef IPV6_TRANSPARENT
2856         case IPV6_TRANSPARENT:
2857 #endif
2858 #ifdef IPV6_FREEBIND
2859         case IPV6_FREEBIND:
2860 #endif
2861 #ifdef IPV6_RECVORIGDSTADDR
2862         case IPV6_RECVORIGDSTADDR:
2863 #endif
2864             if (get_user_u32(len, optlen))
2865                 return -TARGET_EFAULT;
2866             if (len < 0)
2867                 return -TARGET_EINVAL;
2868             lv = sizeof(lv);
2869             ret = get_errno(getsockopt(sockfd, level, optname, &val, &lv));
2870             if (ret < 0)
2871                 return ret;
2872             if (len < sizeof(int) && len > 0 && val >= 0 && val < 255) {
2873                 len = 1;
2874                 if (put_user_u32(len, optlen)
2875                     || put_user_u8(val, optval_addr))
2876                     return -TARGET_EFAULT;
2877             } else {
2878                 if (len > sizeof(int))
2879                     len = sizeof(int);
2880                 if (put_user_u32(len, optlen)
2881                     || put_user_u32(val, optval_addr))
2882                     return -TARGET_EFAULT;
2883             }
2884             break;
2885         default:
2886             ret = -TARGET_ENOPROTOOPT;
2887             break;
2888         }
2889         break;
2890 #ifdef SOL_NETLINK
2891     case SOL_NETLINK:
2892         switch (optname) {
2893         case NETLINK_PKTINFO:
2894         case NETLINK_BROADCAST_ERROR:
2895         case NETLINK_NO_ENOBUFS:
2896 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 2, 0)
2897         case NETLINK_LISTEN_ALL_NSID:
2898         case NETLINK_CAP_ACK:
2899 #endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 2, 0) */
2900 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 12, 0)
2901         case NETLINK_EXT_ACK:
2902 #endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 12, 0) */
2903 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 20, 0)
2904         case NETLINK_GET_STRICT_CHK:
2905 #endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 12, 0) */
2906             if (get_user_u32(len, optlen)) {
2907                 return -TARGET_EFAULT;
2908             }
2909             if (len != sizeof(val)) {
2910                 return -TARGET_EINVAL;
2911             }
2912             lv = len;
2913             ret = get_errno(getsockopt(sockfd, level, optname, &val, &lv));
2914             if (ret < 0) {
2915                 return ret;
2916             }
2917             if (put_user_u32(lv, optlen)
2918                 || put_user_u32(val, optval_addr)) {
2919                 return -TARGET_EFAULT;
2920             }
2921             break;
2922 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 2, 0)
2923         case NETLINK_LIST_MEMBERSHIPS:
2924         {
2925             uint32_t *results;
2926             int i;
2927             if (get_user_u32(len, optlen)) {
2928                 return -TARGET_EFAULT;
2929             }
2930             if (len < 0) {
2931                 return -TARGET_EINVAL;
2932             }
2933             results = lock_user(VERIFY_WRITE, optval_addr, len, 1);
2934             if (!results && len > 0) {
2935                 return -TARGET_EFAULT;
2936             }
2937             lv = len;
2938             ret = get_errno(getsockopt(sockfd, level, optname, results, &lv));
2939             if (ret < 0) {
2940                 unlock_user(results, optval_addr, 0);
2941                 return ret;
2942             }
2943             /* swap host endianess to target endianess. */
2944             for (i = 0; i < (len / sizeof(uint32_t)); i++) {
2945                 results[i] = tswap32(results[i]);
2946             }
2947             if (put_user_u32(lv, optlen)) {
2948                 return -TARGET_EFAULT;
2949             }
2950             unlock_user(results, optval_addr, 0);
2951             break;
2952         }
2953 #endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 2, 0) */
2954         default:
2955             goto unimplemented;
2956         }
2957         break;
2958 #endif /* SOL_NETLINK */
2959     default:
2960     unimplemented:
2961         qemu_log_mask(LOG_UNIMP,
2962                       "getsockopt level=%d optname=%d not yet supported\n",
2963                       level, optname);
2964         ret = -TARGET_EOPNOTSUPP;
2965         break;
2966     }
2967     return ret;
2968 }
2969 
2970 /* Convert target low/high pair representing file offset into the host
2971  * low/high pair. This function doesn't handle offsets bigger than 64 bits
2972  * as the kernel doesn't handle them either.
2973  */
2974 static void target_to_host_low_high(abi_ulong tlow,
2975                                     abi_ulong thigh,
2976                                     unsigned long *hlow,
2977                                     unsigned long *hhigh)
2978 {
2979     uint64_t off = tlow |
2980         ((unsigned long long)thigh << TARGET_LONG_BITS / 2) <<
2981         TARGET_LONG_BITS / 2;
2982 
2983     *hlow = off;
2984     *hhigh = (off >> HOST_LONG_BITS / 2) >> HOST_LONG_BITS / 2;
2985 }
2986 
2987 static struct iovec *lock_iovec(int type, abi_ulong target_addr,
2988                                 abi_ulong count, int copy)
2989 {
2990     struct target_iovec *target_vec;
2991     struct iovec *vec;
2992     abi_ulong total_len, max_len;
2993     int i;
2994     int err = 0;
2995     bool bad_address = false;
2996 
2997     if (count == 0) {
2998         errno = 0;
2999         return NULL;
3000     }
3001     if (count > IOV_MAX) {
3002         errno = EINVAL;
3003         return NULL;
3004     }
3005 
3006     vec = g_try_new0(struct iovec, count);
3007     if (vec == NULL) {
3008         errno = ENOMEM;
3009         return NULL;
3010     }
3011 
3012     target_vec = lock_user(VERIFY_READ, target_addr,
3013                            count * sizeof(struct target_iovec), 1);
3014     if (target_vec == NULL) {
3015         err = EFAULT;
3016         goto fail2;
3017     }
3018 
3019     /* ??? If host page size > target page size, this will result in a
3020        value larger than what we can actually support.  */
3021     max_len = 0x7fffffff & TARGET_PAGE_MASK;
3022     total_len = 0;
3023 
3024     for (i = 0; i < count; i++) {
3025         abi_ulong base = tswapal(target_vec[i].iov_base);
3026         abi_long len = tswapal(target_vec[i].iov_len);
3027 
3028         if (len < 0) {
3029             err = EINVAL;
3030             goto fail;
3031         } else if (len == 0) {
3032             /* Zero length pointer is ignored.  */
3033             vec[i].iov_base = 0;
3034         } else {
3035             vec[i].iov_base = lock_user(type, base, len, copy);
3036             /* If the first buffer pointer is bad, this is a fault.  But
3037              * subsequent bad buffers will result in a partial write; this
3038              * is realized by filling the vector with null pointers and
3039              * zero lengths. */
3040             if (!vec[i].iov_base) {
3041                 if (i == 0) {
3042                     err = EFAULT;
3043                     goto fail;
3044                 } else {
3045                     bad_address = true;
3046                 }
3047             }
3048             if (bad_address) {
3049                 len = 0;
3050             }
3051             if (len > max_len - total_len) {
3052                 len = max_len - total_len;
3053             }
3054         }
3055         vec[i].iov_len = len;
3056         total_len += len;
3057     }
3058 
3059     unlock_user(target_vec, target_addr, 0);
3060     return vec;
3061 
3062  fail:
3063     while (--i >= 0) {
3064         if (tswapal(target_vec[i].iov_len) > 0) {
3065             unlock_user(vec[i].iov_base, tswapal(target_vec[i].iov_base), 0);
3066         }
3067     }
3068     unlock_user(target_vec, target_addr, 0);
3069  fail2:
3070     g_free(vec);
3071     errno = err;
3072     return NULL;
3073 }
3074 
3075 static void unlock_iovec(struct iovec *vec, abi_ulong target_addr,
3076                          abi_ulong count, int copy)
3077 {
3078     struct target_iovec *target_vec;
3079     int i;
3080 
3081     target_vec = lock_user(VERIFY_READ, target_addr,
3082                            count * sizeof(struct target_iovec), 1);
3083     if (target_vec) {
3084         for (i = 0; i < count; i++) {
3085             abi_ulong base = tswapal(target_vec[i].iov_base);
3086             abi_long len = tswapal(target_vec[i].iov_len);
3087             if (len < 0) {
3088                 break;
3089             }
3090             unlock_user(vec[i].iov_base, base, copy ? vec[i].iov_len : 0);
3091         }
3092         unlock_user(target_vec, target_addr, 0);
3093     }
3094 
3095     g_free(vec);
3096 }
3097 
3098 static inline int target_to_host_sock_type(int *type)
3099 {
3100     int host_type = 0;
3101     int target_type = *type;
3102 
3103     switch (target_type & TARGET_SOCK_TYPE_MASK) {
3104     case TARGET_SOCK_DGRAM:
3105         host_type = SOCK_DGRAM;
3106         break;
3107     case TARGET_SOCK_STREAM:
3108         host_type = SOCK_STREAM;
3109         break;
3110     default:
3111         host_type = target_type & TARGET_SOCK_TYPE_MASK;
3112         break;
3113     }
3114     if (target_type & TARGET_SOCK_CLOEXEC) {
3115 #if defined(SOCK_CLOEXEC)
3116         host_type |= SOCK_CLOEXEC;
3117 #else
3118         return -TARGET_EINVAL;
3119 #endif
3120     }
3121     if (target_type & TARGET_SOCK_NONBLOCK) {
3122 #if defined(SOCK_NONBLOCK)
3123         host_type |= SOCK_NONBLOCK;
3124 #elif !defined(O_NONBLOCK)
3125         return -TARGET_EINVAL;
3126 #endif
3127     }
3128     *type = host_type;
3129     return 0;
3130 }
3131 
3132 /* Try to emulate socket type flags after socket creation.  */
3133 static int sock_flags_fixup(int fd, int target_type)
3134 {
3135 #if !defined(SOCK_NONBLOCK) && defined(O_NONBLOCK)
3136     if (target_type & TARGET_SOCK_NONBLOCK) {
3137         int flags = fcntl(fd, F_GETFL);
3138         if (fcntl(fd, F_SETFL, O_NONBLOCK | flags) == -1) {
3139             close(fd);
3140             return -TARGET_EINVAL;
3141         }
3142     }
3143 #endif
3144     return fd;
3145 }
3146 
3147 /* do_socket() Must return target values and target errnos. */
3148 static abi_long do_socket(int domain, int type, int protocol)
3149 {
3150     int target_type = type;
3151     int ret;
3152 
3153     ret = target_to_host_sock_type(&type);
3154     if (ret) {
3155         return ret;
3156     }
3157 
3158     if (domain == PF_NETLINK && !(
3159 #ifdef CONFIG_RTNETLINK
3160          protocol == NETLINK_ROUTE ||
3161 #endif
3162          protocol == NETLINK_KOBJECT_UEVENT ||
3163          protocol == NETLINK_AUDIT)) {
3164         return -TARGET_EPROTONOSUPPORT;
3165     }
3166 
3167     if (domain == AF_PACKET ||
3168         (domain == AF_INET && type == SOCK_PACKET)) {
3169         protocol = tswap16(protocol);
3170     }
3171 
3172     ret = get_errno(socket(domain, type, protocol));
3173     if (ret >= 0) {
3174         ret = sock_flags_fixup(ret, target_type);
3175         if (type == SOCK_PACKET) {
3176             /* Manage an obsolete case :
3177              * if socket type is SOCK_PACKET, bind by name
3178              */
3179             fd_trans_register(ret, &target_packet_trans);
3180         } else if (domain == PF_NETLINK) {
3181             switch (protocol) {
3182 #ifdef CONFIG_RTNETLINK
3183             case NETLINK_ROUTE:
3184                 fd_trans_register(ret, &target_netlink_route_trans);
3185                 break;
3186 #endif
3187             case NETLINK_KOBJECT_UEVENT:
3188                 /* nothing to do: messages are strings */
3189                 break;
3190             case NETLINK_AUDIT:
3191                 fd_trans_register(ret, &target_netlink_audit_trans);
3192                 break;
3193             default:
3194                 g_assert_not_reached();
3195             }
3196         }
3197     }
3198     return ret;
3199 }
3200 
3201 /* do_bind() Must return target values and target errnos. */
3202 static abi_long do_bind(int sockfd, abi_ulong target_addr,
3203                         socklen_t addrlen)
3204 {
3205     void *addr;
3206     abi_long ret;
3207 
3208     if ((int)addrlen < 0) {
3209         return -TARGET_EINVAL;
3210     }
3211 
3212     addr = alloca(addrlen+1);
3213 
3214     ret = target_to_host_sockaddr(sockfd, addr, target_addr, addrlen);
3215     if (ret)
3216         return ret;
3217 
3218     return get_errno(bind(sockfd, addr, addrlen));
3219 }
3220 
3221 /* do_connect() Must return target values and target errnos. */
3222 static abi_long do_connect(int sockfd, abi_ulong target_addr,
3223                            socklen_t addrlen)
3224 {
3225     void *addr;
3226     abi_long ret;
3227 
3228     if ((int)addrlen < 0) {
3229         return -TARGET_EINVAL;
3230     }
3231 
3232     addr = alloca(addrlen+1);
3233 
3234     ret = target_to_host_sockaddr(sockfd, addr, target_addr, addrlen);
3235     if (ret)
3236         return ret;
3237 
3238     return get_errno(safe_connect(sockfd, addr, addrlen));
3239 }
3240 
3241 /* do_sendrecvmsg_locked() Must return target values and target errnos. */
3242 static abi_long do_sendrecvmsg_locked(int fd, struct target_msghdr *msgp,
3243                                       int flags, int send)
3244 {
3245     abi_long ret, len;
3246     struct msghdr msg;
3247     abi_ulong count;
3248     struct iovec *vec;
3249     abi_ulong target_vec;
3250 
3251     if (msgp->msg_name) {
3252         msg.msg_namelen = tswap32(msgp->msg_namelen);
3253         msg.msg_name = alloca(msg.msg_namelen+1);
3254         ret = target_to_host_sockaddr(fd, msg.msg_name,
3255                                       tswapal(msgp->msg_name),
3256                                       msg.msg_namelen);
3257         if (ret == -TARGET_EFAULT) {
3258             /* For connected sockets msg_name and msg_namelen must
3259              * be ignored, so returning EFAULT immediately is wrong.
3260              * Instead, pass a bad msg_name to the host kernel, and
3261              * let it decide whether to return EFAULT or not.
3262              */
3263             msg.msg_name = (void *)-1;
3264         } else if (ret) {
3265             goto out2;
3266         }
3267     } else {
3268         msg.msg_name = NULL;
3269         msg.msg_namelen = 0;
3270     }
3271     msg.msg_controllen = 2 * tswapal(msgp->msg_controllen);
3272     msg.msg_control = alloca(msg.msg_controllen);
3273     memset(msg.msg_control, 0, msg.msg_controllen);
3274 
3275     msg.msg_flags = tswap32(msgp->msg_flags);
3276 
3277     count = tswapal(msgp->msg_iovlen);
3278     target_vec = tswapal(msgp->msg_iov);
3279 
3280     if (count > IOV_MAX) {
3281         /* sendrcvmsg returns a different errno for this condition than
3282          * readv/writev, so we must catch it here before lock_iovec() does.
3283          */
3284         ret = -TARGET_EMSGSIZE;
3285         goto out2;
3286     }
3287 
3288     vec = lock_iovec(send ? VERIFY_READ : VERIFY_WRITE,
3289                      target_vec, count, send);
3290     if (vec == NULL) {
3291         ret = -host_to_target_errno(errno);
3292         goto out2;
3293     }
3294     msg.msg_iovlen = count;
3295     msg.msg_iov = vec;
3296 
3297     if (send) {
3298         if (fd_trans_target_to_host_data(fd)) {
3299             void *host_msg;
3300 
3301             host_msg = g_malloc(msg.msg_iov->iov_len);
3302             memcpy(host_msg, msg.msg_iov->iov_base, msg.msg_iov->iov_len);
3303             ret = fd_trans_target_to_host_data(fd)(host_msg,
3304                                                    msg.msg_iov->iov_len);
3305             if (ret >= 0) {
3306                 msg.msg_iov->iov_base = host_msg;
3307                 ret = get_errno(safe_sendmsg(fd, &msg, flags));
3308             }
3309             g_free(host_msg);
3310         } else {
3311             ret = target_to_host_cmsg(&msg, msgp);
3312             if (ret == 0) {
3313                 ret = get_errno(safe_sendmsg(fd, &msg, flags));
3314             }
3315         }
3316     } else {
3317         ret = get_errno(safe_recvmsg(fd, &msg, flags));
3318         if (!is_error(ret)) {
3319             len = ret;
3320             if (fd_trans_host_to_target_data(fd)) {
3321                 ret = fd_trans_host_to_target_data(fd)(msg.msg_iov->iov_base,
3322                                                MIN(msg.msg_iov->iov_len, len));
3323             } else {
3324                 ret = host_to_target_cmsg(msgp, &msg);
3325             }
3326             if (!is_error(ret)) {
3327                 msgp->msg_namelen = tswap32(msg.msg_namelen);
3328                 msgp->msg_flags = tswap32(msg.msg_flags);
3329                 if (msg.msg_name != NULL && msg.msg_name != (void *)-1) {
3330                     ret = host_to_target_sockaddr(tswapal(msgp->msg_name),
3331                                     msg.msg_name, msg.msg_namelen);
3332                     if (ret) {
3333                         goto out;
3334                     }
3335                 }
3336 
3337                 ret = len;
3338             }
3339         }
3340     }
3341 
3342 out:
3343     unlock_iovec(vec, target_vec, count, !send);
3344 out2:
3345     return ret;
3346 }
3347 
3348 static abi_long do_sendrecvmsg(int fd, abi_ulong target_msg,
3349                                int flags, int send)
3350 {
3351     abi_long ret;
3352     struct target_msghdr *msgp;
3353 
3354     if (!lock_user_struct(send ? VERIFY_READ : VERIFY_WRITE,
3355                           msgp,
3356                           target_msg,
3357                           send ? 1 : 0)) {
3358         return -TARGET_EFAULT;
3359     }
3360     ret = do_sendrecvmsg_locked(fd, msgp, flags, send);
3361     unlock_user_struct(msgp, target_msg, send ? 0 : 1);
3362     return ret;
3363 }
3364 
3365 /* We don't rely on the C library to have sendmmsg/recvmmsg support,
3366  * so it might not have this *mmsg-specific flag either.
3367  */
3368 #ifndef MSG_WAITFORONE
3369 #define MSG_WAITFORONE 0x10000
3370 #endif
3371 
3372 static abi_long do_sendrecvmmsg(int fd, abi_ulong target_msgvec,
3373                                 unsigned int vlen, unsigned int flags,
3374                                 int send)
3375 {
3376     struct target_mmsghdr *mmsgp;
3377     abi_long ret = 0;
3378     int i;
3379 
3380     if (vlen > UIO_MAXIOV) {
3381         vlen = UIO_MAXIOV;
3382     }
3383 
3384     mmsgp = lock_user(VERIFY_WRITE, target_msgvec, sizeof(*mmsgp) * vlen, 1);
3385     if (!mmsgp) {
3386         return -TARGET_EFAULT;
3387     }
3388 
3389     for (i = 0; i < vlen; i++) {
3390         ret = do_sendrecvmsg_locked(fd, &mmsgp[i].msg_hdr, flags, send);
3391         if (is_error(ret)) {
3392             break;
3393         }
3394         mmsgp[i].msg_len = tswap32(ret);
3395         /* MSG_WAITFORONE turns on MSG_DONTWAIT after one packet */
3396         if (flags & MSG_WAITFORONE) {
3397             flags |= MSG_DONTWAIT;
3398         }
3399     }
3400 
3401     unlock_user(mmsgp, target_msgvec, sizeof(*mmsgp) * i);
3402 
3403     /* Return number of datagrams sent if we sent any at all;
3404      * otherwise return the error.
3405      */
3406     if (i) {
3407         return i;
3408     }
3409     return ret;
3410 }
3411 
3412 /* do_accept4() Must return target values and target errnos. */
3413 static abi_long do_accept4(int fd, abi_ulong target_addr,
3414                            abi_ulong target_addrlen_addr, int flags)
3415 {
3416     socklen_t addrlen, ret_addrlen;
3417     void *addr;
3418     abi_long ret;
3419     int host_flags;
3420 
3421     host_flags = target_to_host_bitmask(flags, fcntl_flags_tbl);
3422 
3423     if (target_addr == 0) {
3424         return get_errno(safe_accept4(fd, NULL, NULL, host_flags));
3425     }
3426 
3427     /* linux returns EFAULT if addrlen pointer is invalid */
3428     if (get_user_u32(addrlen, target_addrlen_addr))
3429         return -TARGET_EFAULT;
3430 
3431     if ((int)addrlen < 0) {
3432         return -TARGET_EINVAL;
3433     }
3434 
3435     if (!access_ok(thread_cpu, VERIFY_WRITE, target_addr, addrlen)) {
3436         return -TARGET_EFAULT;
3437     }
3438 
3439     addr = alloca(addrlen);
3440 
3441     ret_addrlen = addrlen;
3442     ret = get_errno(safe_accept4(fd, addr, &ret_addrlen, host_flags));
3443     if (!is_error(ret)) {
3444         host_to_target_sockaddr(target_addr, addr, MIN(addrlen, ret_addrlen));
3445         if (put_user_u32(ret_addrlen, target_addrlen_addr)) {
3446             ret = -TARGET_EFAULT;
3447         }
3448     }
3449     return ret;
3450 }
3451 
3452 /* do_getpeername() Must return target values and target errnos. */
3453 static abi_long do_getpeername(int fd, abi_ulong target_addr,
3454                                abi_ulong target_addrlen_addr)
3455 {
3456     socklen_t addrlen, ret_addrlen;
3457     void *addr;
3458     abi_long ret;
3459 
3460     if (get_user_u32(addrlen, target_addrlen_addr))
3461         return -TARGET_EFAULT;
3462 
3463     if ((int)addrlen < 0) {
3464         return -TARGET_EINVAL;
3465     }
3466 
3467     if (!access_ok(thread_cpu, VERIFY_WRITE, target_addr, addrlen)) {
3468         return -TARGET_EFAULT;
3469     }
3470 
3471     addr = alloca(addrlen);
3472 
3473     ret_addrlen = addrlen;
3474     ret = get_errno(getpeername(fd, addr, &ret_addrlen));
3475     if (!is_error(ret)) {
3476         host_to_target_sockaddr(target_addr, addr, MIN(addrlen, ret_addrlen));
3477         if (put_user_u32(ret_addrlen, target_addrlen_addr)) {
3478             ret = -TARGET_EFAULT;
3479         }
3480     }
3481     return ret;
3482 }
3483 
3484 /* do_getsockname() Must return target values and target errnos. */
3485 static abi_long do_getsockname(int fd, abi_ulong target_addr,
3486                                abi_ulong target_addrlen_addr)
3487 {
3488     socklen_t addrlen, ret_addrlen;
3489     void *addr;
3490     abi_long ret;
3491 
3492     if (get_user_u32(addrlen, target_addrlen_addr))
3493         return -TARGET_EFAULT;
3494 
3495     if ((int)addrlen < 0) {
3496         return -TARGET_EINVAL;
3497     }
3498 
3499     if (!access_ok(thread_cpu, VERIFY_WRITE, target_addr, addrlen)) {
3500         return -TARGET_EFAULT;
3501     }
3502 
3503     addr = alloca(addrlen);
3504 
3505     ret_addrlen = addrlen;
3506     ret = get_errno(getsockname(fd, addr, &ret_addrlen));
3507     if (!is_error(ret)) {
3508         host_to_target_sockaddr(target_addr, addr, MIN(addrlen, ret_addrlen));
3509         if (put_user_u32(ret_addrlen, target_addrlen_addr)) {
3510             ret = -TARGET_EFAULT;
3511         }
3512     }
3513     return ret;
3514 }
3515 
3516 /* do_socketpair() Must return target values and target errnos. */
3517 static abi_long do_socketpair(int domain, int type, int protocol,
3518                               abi_ulong target_tab_addr)
3519 {
3520     int tab[2];
3521     abi_long ret;
3522 
3523     target_to_host_sock_type(&type);
3524 
3525     ret = get_errno(socketpair(domain, type, protocol, tab));
3526     if (!is_error(ret)) {
3527         if (put_user_s32(tab[0], target_tab_addr)
3528             || put_user_s32(tab[1], target_tab_addr + sizeof(tab[0])))
3529             ret = -TARGET_EFAULT;
3530     }
3531     return ret;
3532 }
3533 
3534 /* do_sendto() Must return target values and target errnos. */
3535 static abi_long do_sendto(int fd, abi_ulong msg, size_t len, int flags,
3536                           abi_ulong target_addr, socklen_t addrlen)
3537 {
3538     void *addr;
3539     void *host_msg;
3540     void *copy_msg = NULL;
3541     abi_long ret;
3542 
3543     if ((int)addrlen < 0) {
3544         return -TARGET_EINVAL;
3545     }
3546 
3547     host_msg = lock_user(VERIFY_READ, msg, len, 1);
3548     if (!host_msg)
3549         return -TARGET_EFAULT;
3550     if (fd_trans_target_to_host_data(fd)) {
3551         copy_msg = host_msg;
3552         host_msg = g_malloc(len);
3553         memcpy(host_msg, copy_msg, len);
3554         ret = fd_trans_target_to_host_data(fd)(host_msg, len);
3555         if (ret < 0) {
3556             goto fail;
3557         }
3558     }
3559     if (target_addr) {
3560         addr = alloca(addrlen+1);
3561         ret = target_to_host_sockaddr(fd, addr, target_addr, addrlen);
3562         if (ret) {
3563             goto fail;
3564         }
3565         ret = get_errno(safe_sendto(fd, host_msg, len, flags, addr, addrlen));
3566     } else {
3567         ret = get_errno(safe_sendto(fd, host_msg, len, flags, NULL, 0));
3568     }
3569 fail:
3570     if (copy_msg) {
3571         g_free(host_msg);
3572         host_msg = copy_msg;
3573     }
3574     unlock_user(host_msg, msg, 0);
3575     return ret;
3576 }
3577 
3578 /* do_recvfrom() Must return target values and target errnos. */
3579 static abi_long do_recvfrom(int fd, abi_ulong msg, size_t len, int flags,
3580                             abi_ulong target_addr,
3581                             abi_ulong target_addrlen)
3582 {
3583     socklen_t addrlen, ret_addrlen;
3584     void *addr;
3585     void *host_msg;
3586     abi_long ret;
3587 
3588     if (!msg) {
3589         host_msg = NULL;
3590     } else {
3591         host_msg = lock_user(VERIFY_WRITE, msg, len, 0);
3592         if (!host_msg) {
3593             return -TARGET_EFAULT;
3594         }
3595     }
3596     if (target_addr) {
3597         if (get_user_u32(addrlen, target_addrlen)) {
3598             ret = -TARGET_EFAULT;
3599             goto fail;
3600         }
3601         if ((int)addrlen < 0) {
3602             ret = -TARGET_EINVAL;
3603             goto fail;
3604         }
3605         addr = alloca(addrlen);
3606         ret_addrlen = addrlen;
3607         ret = get_errno(safe_recvfrom(fd, host_msg, len, flags,
3608                                       addr, &ret_addrlen));
3609     } else {
3610         addr = NULL; /* To keep compiler quiet.  */
3611         addrlen = 0; /* To keep compiler quiet.  */
3612         ret = get_errno(safe_recvfrom(fd, host_msg, len, flags, NULL, 0));
3613     }
3614     if (!is_error(ret)) {
3615         if (fd_trans_host_to_target_data(fd)) {
3616             abi_long trans;
3617             trans = fd_trans_host_to_target_data(fd)(host_msg, MIN(ret, len));
3618             if (is_error(trans)) {
3619                 ret = trans;
3620                 goto fail;
3621             }
3622         }
3623         if (target_addr) {
3624             host_to_target_sockaddr(target_addr, addr,
3625                                     MIN(addrlen, ret_addrlen));
3626             if (put_user_u32(ret_addrlen, target_addrlen)) {
3627                 ret = -TARGET_EFAULT;
3628                 goto fail;
3629             }
3630         }
3631         unlock_user(host_msg, msg, len);
3632     } else {
3633 fail:
3634         unlock_user(host_msg, msg, 0);
3635     }
3636     return ret;
3637 }
3638 
3639 #ifdef TARGET_NR_socketcall
3640 /* do_socketcall() must return target values and target errnos. */
3641 static abi_long do_socketcall(int num, abi_ulong vptr)
3642 {
3643     static const unsigned nargs[] = { /* number of arguments per operation */
3644         [TARGET_SYS_SOCKET] = 3,      /* domain, type, protocol */
3645         [TARGET_SYS_BIND] = 3,        /* fd, addr, addrlen */
3646         [TARGET_SYS_CONNECT] = 3,     /* fd, addr, addrlen */
3647         [TARGET_SYS_LISTEN] = 2,      /* fd, backlog */
3648         [TARGET_SYS_ACCEPT] = 3,      /* fd, addr, addrlen */
3649         [TARGET_SYS_GETSOCKNAME] = 3, /* fd, addr, addrlen */
3650         [TARGET_SYS_GETPEERNAME] = 3, /* fd, addr, addrlen */
3651         [TARGET_SYS_SOCKETPAIR] = 4,  /* domain, type, protocol, tab */
3652         [TARGET_SYS_SEND] = 4,        /* fd, msg, len, flags */
3653         [TARGET_SYS_RECV] = 4,        /* fd, msg, len, flags */
3654         [TARGET_SYS_SENDTO] = 6,      /* fd, msg, len, flags, addr, addrlen */
3655         [TARGET_SYS_RECVFROM] = 6,    /* fd, msg, len, flags, addr, addrlen */
3656         [TARGET_SYS_SHUTDOWN] = 2,    /* fd, how */
3657         [TARGET_SYS_SETSOCKOPT] = 5,  /* fd, level, optname, optval, optlen */
3658         [TARGET_SYS_GETSOCKOPT] = 5,  /* fd, level, optname, optval, optlen */
3659         [TARGET_SYS_SENDMSG] = 3,     /* fd, msg, flags */
3660         [TARGET_SYS_RECVMSG] = 3,     /* fd, msg, flags */
3661         [TARGET_SYS_ACCEPT4] = 4,     /* fd, addr, addrlen, flags */
3662         [TARGET_SYS_RECVMMSG] = 4,    /* fd, msgvec, vlen, flags */
3663         [TARGET_SYS_SENDMMSG] = 4,    /* fd, msgvec, vlen, flags */
3664     };
3665     abi_long a[6]; /* max 6 args */
3666     unsigned i;
3667 
3668     /* check the range of the first argument num */
3669     /* (TARGET_SYS_SENDMMSG is the highest among TARGET_SYS_xxx) */
3670     if (num < 1 || num > TARGET_SYS_SENDMMSG) {
3671         return -TARGET_EINVAL;
3672     }
3673     /* ensure we have space for args */
3674     if (nargs[num] > ARRAY_SIZE(a)) {
3675         return -TARGET_EINVAL;
3676     }
3677     /* collect the arguments in a[] according to nargs[] */
3678     for (i = 0; i < nargs[num]; ++i) {
3679         if (get_user_ual(a[i], vptr + i * sizeof(abi_long)) != 0) {
3680             return -TARGET_EFAULT;
3681         }
3682     }
3683     /* now when we have the args, invoke the appropriate underlying function */
3684     switch (num) {
3685     case TARGET_SYS_SOCKET: /* domain, type, protocol */
3686         return do_socket(a[0], a[1], a[2]);
3687     case TARGET_SYS_BIND: /* sockfd, addr, addrlen */
3688         return do_bind(a[0], a[1], a[2]);
3689     case TARGET_SYS_CONNECT: /* sockfd, addr, addrlen */
3690         return do_connect(a[0], a[1], a[2]);
3691     case TARGET_SYS_LISTEN: /* sockfd, backlog */
3692         return get_errno(listen(a[0], a[1]));
3693     case TARGET_SYS_ACCEPT: /* sockfd, addr, addrlen */
3694         return do_accept4(a[0], a[1], a[2], 0);
3695     case TARGET_SYS_GETSOCKNAME: /* sockfd, addr, addrlen */
3696         return do_getsockname(a[0], a[1], a[2]);
3697     case TARGET_SYS_GETPEERNAME: /* sockfd, addr, addrlen */
3698         return do_getpeername(a[0], a[1], a[2]);
3699     case TARGET_SYS_SOCKETPAIR: /* domain, type, protocol, tab */
3700         return do_socketpair(a[0], a[1], a[2], a[3]);
3701     case TARGET_SYS_SEND: /* sockfd, msg, len, flags */
3702         return do_sendto(a[0], a[1], a[2], a[3], 0, 0);
3703     case TARGET_SYS_RECV: /* sockfd, msg, len, flags */
3704         return do_recvfrom(a[0], a[1], a[2], a[3], 0, 0);
3705     case TARGET_SYS_SENDTO: /* sockfd, msg, len, flags, addr, addrlen */
3706         return do_sendto(a[0], a[1], a[2], a[3], a[4], a[5]);
3707     case TARGET_SYS_RECVFROM: /* sockfd, msg, len, flags, addr, addrlen */
3708         return do_recvfrom(a[0], a[1], a[2], a[3], a[4], a[5]);
3709     case TARGET_SYS_SHUTDOWN: /* sockfd, how */
3710         return get_errno(shutdown(a[0], a[1]));
3711     case TARGET_SYS_SETSOCKOPT: /* sockfd, level, optname, optval, optlen */
3712         return do_setsockopt(a[0], a[1], a[2], a[3], a[4]);
3713     case TARGET_SYS_GETSOCKOPT: /* sockfd, level, optname, optval, optlen */
3714         return do_getsockopt(a[0], a[1], a[2], a[3], a[4]);
3715     case TARGET_SYS_SENDMSG: /* sockfd, msg, flags */
3716         return do_sendrecvmsg(a[0], a[1], a[2], 1);
3717     case TARGET_SYS_RECVMSG: /* sockfd, msg, flags */
3718         return do_sendrecvmsg(a[0], a[1], a[2], 0);
3719     case TARGET_SYS_ACCEPT4: /* sockfd, addr, addrlen, flags */
3720         return do_accept4(a[0], a[1], a[2], a[3]);
3721     case TARGET_SYS_RECVMMSG: /* sockfd, msgvec, vlen, flags */
3722         return do_sendrecvmmsg(a[0], a[1], a[2], a[3], 0);
3723     case TARGET_SYS_SENDMMSG: /* sockfd, msgvec, vlen, flags */
3724         return do_sendrecvmmsg(a[0], a[1], a[2], a[3], 1);
3725     default:
3726         qemu_log_mask(LOG_UNIMP, "Unsupported socketcall: %d\n", num);
3727         return -TARGET_EINVAL;
3728     }
3729 }
3730 #endif
3731 
3732 #define N_SHM_REGIONS	32
3733 
3734 static struct shm_region {
3735     abi_ulong start;
3736     abi_ulong size;
3737     bool in_use;
3738 } shm_regions[N_SHM_REGIONS];
3739 
3740 #ifndef TARGET_SEMID64_DS
3741 /* asm-generic version of this struct */
3742 struct target_semid64_ds
3743 {
3744   struct target_ipc_perm sem_perm;
3745   abi_ulong sem_otime;
3746 #if TARGET_ABI_BITS == 32
3747   abi_ulong __unused1;
3748 #endif
3749   abi_ulong sem_ctime;
3750 #if TARGET_ABI_BITS == 32
3751   abi_ulong __unused2;
3752 #endif
3753   abi_ulong sem_nsems;
3754   abi_ulong __unused3;
3755   abi_ulong __unused4;
3756 };
3757 #endif
3758 
3759 static inline abi_long target_to_host_ipc_perm(struct ipc_perm *host_ip,
3760                                                abi_ulong target_addr)
3761 {
3762     struct target_ipc_perm *target_ip;
3763     struct target_semid64_ds *target_sd;
3764 
3765     if (!lock_user_struct(VERIFY_READ, target_sd, target_addr, 1))
3766         return -TARGET_EFAULT;
3767     target_ip = &(target_sd->sem_perm);
3768     host_ip->__key = tswap32(target_ip->__key);
3769     host_ip->uid = tswap32(target_ip->uid);
3770     host_ip->gid = tswap32(target_ip->gid);
3771     host_ip->cuid = tswap32(target_ip->cuid);
3772     host_ip->cgid = tswap32(target_ip->cgid);
3773 #if defined(TARGET_ALPHA) || defined(TARGET_MIPS) || defined(TARGET_PPC)
3774     host_ip->mode = tswap32(target_ip->mode);
3775 #else
3776     host_ip->mode = tswap16(target_ip->mode);
3777 #endif
3778 #if defined(TARGET_PPC)
3779     host_ip->__seq = tswap32(target_ip->__seq);
3780 #else
3781     host_ip->__seq = tswap16(target_ip->__seq);
3782 #endif
3783     unlock_user_struct(target_sd, target_addr, 0);
3784     return 0;
3785 }
3786 
3787 static inline abi_long host_to_target_ipc_perm(abi_ulong target_addr,
3788                                                struct ipc_perm *host_ip)
3789 {
3790     struct target_ipc_perm *target_ip;
3791     struct target_semid64_ds *target_sd;
3792 
3793     if (!lock_user_struct(VERIFY_WRITE, target_sd, target_addr, 0))
3794         return -TARGET_EFAULT;
3795     target_ip = &(target_sd->sem_perm);
3796     target_ip->__key = tswap32(host_ip->__key);
3797     target_ip->uid = tswap32(host_ip->uid);
3798     target_ip->gid = tswap32(host_ip->gid);
3799     target_ip->cuid = tswap32(host_ip->cuid);
3800     target_ip->cgid = tswap32(host_ip->cgid);
3801 #if defined(TARGET_ALPHA) || defined(TARGET_MIPS) || defined(TARGET_PPC)
3802     target_ip->mode = tswap32(host_ip->mode);
3803 #else
3804     target_ip->mode = tswap16(host_ip->mode);
3805 #endif
3806 #if defined(TARGET_PPC)
3807     target_ip->__seq = tswap32(host_ip->__seq);
3808 #else
3809     target_ip->__seq = tswap16(host_ip->__seq);
3810 #endif
3811     unlock_user_struct(target_sd, target_addr, 1);
3812     return 0;
3813 }
3814 
3815 static inline abi_long target_to_host_semid_ds(struct semid_ds *host_sd,
3816                                                abi_ulong target_addr)
3817 {
3818     struct target_semid64_ds *target_sd;
3819 
3820     if (!lock_user_struct(VERIFY_READ, target_sd, target_addr, 1))
3821         return -TARGET_EFAULT;
3822     if (target_to_host_ipc_perm(&(host_sd->sem_perm),target_addr))
3823         return -TARGET_EFAULT;
3824     host_sd->sem_nsems = tswapal(target_sd->sem_nsems);
3825     host_sd->sem_otime = tswapal(target_sd->sem_otime);
3826     host_sd->sem_ctime = tswapal(target_sd->sem_ctime);
3827     unlock_user_struct(target_sd, target_addr, 0);
3828     return 0;
3829 }
3830 
3831 static inline abi_long host_to_target_semid_ds(abi_ulong target_addr,
3832                                                struct semid_ds *host_sd)
3833 {
3834     struct target_semid64_ds *target_sd;
3835 
3836     if (!lock_user_struct(VERIFY_WRITE, target_sd, target_addr, 0))
3837         return -TARGET_EFAULT;
3838     if (host_to_target_ipc_perm(target_addr,&(host_sd->sem_perm)))
3839         return -TARGET_EFAULT;
3840     target_sd->sem_nsems = tswapal(host_sd->sem_nsems);
3841     target_sd->sem_otime = tswapal(host_sd->sem_otime);
3842     target_sd->sem_ctime = tswapal(host_sd->sem_ctime);
3843     unlock_user_struct(target_sd, target_addr, 1);
3844     return 0;
3845 }
3846 
3847 struct target_seminfo {
3848     int semmap;
3849     int semmni;
3850     int semmns;
3851     int semmnu;
3852     int semmsl;
3853     int semopm;
3854     int semume;
3855     int semusz;
3856     int semvmx;
3857     int semaem;
3858 };
3859 
3860 static inline abi_long host_to_target_seminfo(abi_ulong target_addr,
3861                                               struct seminfo *host_seminfo)
3862 {
3863     struct target_seminfo *target_seminfo;
3864     if (!lock_user_struct(VERIFY_WRITE, target_seminfo, target_addr, 0))
3865         return -TARGET_EFAULT;
3866     __put_user(host_seminfo->semmap, &target_seminfo->semmap);
3867     __put_user(host_seminfo->semmni, &target_seminfo->semmni);
3868     __put_user(host_seminfo->semmns, &target_seminfo->semmns);
3869     __put_user(host_seminfo->semmnu, &target_seminfo->semmnu);
3870     __put_user(host_seminfo->semmsl, &target_seminfo->semmsl);
3871     __put_user(host_seminfo->semopm, &target_seminfo->semopm);
3872     __put_user(host_seminfo->semume, &target_seminfo->semume);
3873     __put_user(host_seminfo->semusz, &target_seminfo->semusz);
3874     __put_user(host_seminfo->semvmx, &target_seminfo->semvmx);
3875     __put_user(host_seminfo->semaem, &target_seminfo->semaem);
3876     unlock_user_struct(target_seminfo, target_addr, 1);
3877     return 0;
3878 }
3879 
3880 union semun {
3881 	int val;
3882 	struct semid_ds *buf;
3883 	unsigned short *array;
3884 	struct seminfo *__buf;
3885 };
3886 
3887 union target_semun {
3888 	int val;
3889 	abi_ulong buf;
3890 	abi_ulong array;
3891 	abi_ulong __buf;
3892 };
3893 
3894 static inline abi_long target_to_host_semarray(int semid, unsigned short **host_array,
3895                                                abi_ulong target_addr)
3896 {
3897     int nsems;
3898     unsigned short *array;
3899     union semun semun;
3900     struct semid_ds semid_ds;
3901     int i, ret;
3902 
3903     semun.buf = &semid_ds;
3904 
3905     ret = semctl(semid, 0, IPC_STAT, semun);
3906     if (ret == -1)
3907         return get_errno(ret);
3908 
3909     nsems = semid_ds.sem_nsems;
3910 
3911     *host_array = g_try_new(unsigned short, nsems);
3912     if (!*host_array) {
3913         return -TARGET_ENOMEM;
3914     }
3915     array = lock_user(VERIFY_READ, target_addr,
3916                       nsems*sizeof(unsigned short), 1);
3917     if (!array) {
3918         g_free(*host_array);
3919         return -TARGET_EFAULT;
3920     }
3921 
3922     for(i=0; i<nsems; i++) {
3923         __get_user((*host_array)[i], &array[i]);
3924     }
3925     unlock_user(array, target_addr, 0);
3926 
3927     return 0;
3928 }
3929 
3930 static inline abi_long host_to_target_semarray(int semid, abi_ulong target_addr,
3931                                                unsigned short **host_array)
3932 {
3933     int nsems;
3934     unsigned short *array;
3935     union semun semun;
3936     struct semid_ds semid_ds;
3937     int i, ret;
3938 
3939     semun.buf = &semid_ds;
3940 
3941     ret = semctl(semid, 0, IPC_STAT, semun);
3942     if (ret == -1)
3943         return get_errno(ret);
3944 
3945     nsems = semid_ds.sem_nsems;
3946 
3947     array = lock_user(VERIFY_WRITE, target_addr,
3948                       nsems*sizeof(unsigned short), 0);
3949     if (!array)
3950         return -TARGET_EFAULT;
3951 
3952     for(i=0; i<nsems; i++) {
3953         __put_user((*host_array)[i], &array[i]);
3954     }
3955     g_free(*host_array);
3956     unlock_user(array, target_addr, 1);
3957 
3958     return 0;
3959 }
3960 
3961 static inline abi_long do_semctl(int semid, int semnum, int cmd,
3962                                  abi_ulong target_arg)
3963 {
3964     union target_semun target_su = { .buf = target_arg };
3965     union semun arg;
3966     struct semid_ds dsarg;
3967     unsigned short *array = NULL;
3968     struct seminfo seminfo;
3969     abi_long ret = -TARGET_EINVAL;
3970     abi_long err;
3971     cmd &= 0xff;
3972 
3973     switch( cmd ) {
3974 	case GETVAL:
3975 	case SETVAL:
3976             /* In 64 bit cross-endian situations, we will erroneously pick up
3977              * the wrong half of the union for the "val" element.  To rectify
3978              * this, the entire 8-byte structure is byteswapped, followed by
3979 	     * a swap of the 4 byte val field. In other cases, the data is
3980 	     * already in proper host byte order. */
3981 	    if (sizeof(target_su.val) != (sizeof(target_su.buf))) {
3982 		target_su.buf = tswapal(target_su.buf);
3983 		arg.val = tswap32(target_su.val);
3984 	    } else {
3985 		arg.val = target_su.val;
3986 	    }
3987             ret = get_errno(semctl(semid, semnum, cmd, arg));
3988             break;
3989 	case GETALL:
3990 	case SETALL:
3991             err = target_to_host_semarray(semid, &array, target_su.array);
3992             if (err)
3993                 return err;
3994             arg.array = array;
3995             ret = get_errno(semctl(semid, semnum, cmd, arg));
3996             err = host_to_target_semarray(semid, target_su.array, &array);
3997             if (err)
3998                 return err;
3999             break;
4000 	case IPC_STAT:
4001 	case IPC_SET:
4002 	case SEM_STAT:
4003             err = target_to_host_semid_ds(&dsarg, target_su.buf);
4004             if (err)
4005                 return err;
4006             arg.buf = &dsarg;
4007             ret = get_errno(semctl(semid, semnum, cmd, arg));
4008             err = host_to_target_semid_ds(target_su.buf, &dsarg);
4009             if (err)
4010                 return err;
4011             break;
4012 	case IPC_INFO:
4013 	case SEM_INFO:
4014             arg.__buf = &seminfo;
4015             ret = get_errno(semctl(semid, semnum, cmd, arg));
4016             err = host_to_target_seminfo(target_su.__buf, &seminfo);
4017             if (err)
4018                 return err;
4019             break;
4020 	case IPC_RMID:
4021 	case GETPID:
4022 	case GETNCNT:
4023 	case GETZCNT:
4024             ret = get_errno(semctl(semid, semnum, cmd, NULL));
4025             break;
4026     }
4027 
4028     return ret;
4029 }
4030 
4031 struct target_sembuf {
4032     unsigned short sem_num;
4033     short sem_op;
4034     short sem_flg;
4035 };
4036 
4037 static inline abi_long target_to_host_sembuf(struct sembuf *host_sembuf,
4038                                              abi_ulong target_addr,
4039                                              unsigned nsops)
4040 {
4041     struct target_sembuf *target_sembuf;
4042     int i;
4043 
4044     target_sembuf = lock_user(VERIFY_READ, target_addr,
4045                               nsops*sizeof(struct target_sembuf), 1);
4046     if (!target_sembuf)
4047         return -TARGET_EFAULT;
4048 
4049     for(i=0; i<nsops; i++) {
4050         __get_user(host_sembuf[i].sem_num, &target_sembuf[i].sem_num);
4051         __get_user(host_sembuf[i].sem_op, &target_sembuf[i].sem_op);
4052         __get_user(host_sembuf[i].sem_flg, &target_sembuf[i].sem_flg);
4053     }
4054 
4055     unlock_user(target_sembuf, target_addr, 0);
4056 
4057     return 0;
4058 }
4059 
4060 #if defined(TARGET_NR_ipc) || defined(TARGET_NR_semop) || \
4061     defined(TARGET_NR_semtimedop) || defined(TARGET_NR_semtimedop_time64)
4062 
4063 /*
4064  * This macro is required to handle the s390 variants, which passes the
4065  * arguments in a different order than default.
4066  */
4067 #ifdef __s390x__
4068 #define SEMTIMEDOP_IPC_ARGS(__nsops, __sops, __timeout) \
4069   (__nsops), (__timeout), (__sops)
4070 #else
4071 #define SEMTIMEDOP_IPC_ARGS(__nsops, __sops, __timeout) \
4072   (__nsops), 0, (__sops), (__timeout)
4073 #endif
4074 
4075 static inline abi_long do_semtimedop(int semid,
4076                                      abi_long ptr,
4077                                      unsigned nsops,
4078                                      abi_long timeout, bool time64)
4079 {
4080     struct sembuf *sops;
4081     struct timespec ts, *pts = NULL;
4082     abi_long ret;
4083 
4084     if (timeout) {
4085         pts = &ts;
4086         if (time64) {
4087             if (target_to_host_timespec64(pts, timeout)) {
4088                 return -TARGET_EFAULT;
4089             }
4090         } else {
4091             if (target_to_host_timespec(pts, timeout)) {
4092                 return -TARGET_EFAULT;
4093             }
4094         }
4095     }
4096 
4097     if (nsops > TARGET_SEMOPM) {
4098         return -TARGET_E2BIG;
4099     }
4100 
4101     sops = g_new(struct sembuf, nsops);
4102 
4103     if (target_to_host_sembuf(sops, ptr, nsops)) {
4104         g_free(sops);
4105         return -TARGET_EFAULT;
4106     }
4107 
4108     ret = -TARGET_ENOSYS;
4109 #ifdef __NR_semtimedop
4110     ret = get_errno(safe_semtimedop(semid, sops, nsops, pts));
4111 #endif
4112 #ifdef __NR_ipc
4113     if (ret == -TARGET_ENOSYS) {
4114         ret = get_errno(safe_ipc(IPCOP_semtimedop, semid,
4115                                  SEMTIMEDOP_IPC_ARGS(nsops, sops, (long)pts)));
4116     }
4117 #endif
4118     g_free(sops);
4119     return ret;
4120 }
4121 #endif
4122 
4123 struct target_msqid_ds
4124 {
4125     struct target_ipc_perm msg_perm;
4126     abi_ulong msg_stime;
4127 #if TARGET_ABI_BITS == 32
4128     abi_ulong __unused1;
4129 #endif
4130     abi_ulong msg_rtime;
4131 #if TARGET_ABI_BITS == 32
4132     abi_ulong __unused2;
4133 #endif
4134     abi_ulong msg_ctime;
4135 #if TARGET_ABI_BITS == 32
4136     abi_ulong __unused3;
4137 #endif
4138     abi_ulong __msg_cbytes;
4139     abi_ulong msg_qnum;
4140     abi_ulong msg_qbytes;
4141     abi_ulong msg_lspid;
4142     abi_ulong msg_lrpid;
4143     abi_ulong __unused4;
4144     abi_ulong __unused5;
4145 };
4146 
4147 static inline abi_long target_to_host_msqid_ds(struct msqid_ds *host_md,
4148                                                abi_ulong target_addr)
4149 {
4150     struct target_msqid_ds *target_md;
4151 
4152     if (!lock_user_struct(VERIFY_READ, target_md, target_addr, 1))
4153         return -TARGET_EFAULT;
4154     if (target_to_host_ipc_perm(&(host_md->msg_perm),target_addr))
4155         return -TARGET_EFAULT;
4156     host_md->msg_stime = tswapal(target_md->msg_stime);
4157     host_md->msg_rtime = tswapal(target_md->msg_rtime);
4158     host_md->msg_ctime = tswapal(target_md->msg_ctime);
4159     host_md->__msg_cbytes = tswapal(target_md->__msg_cbytes);
4160     host_md->msg_qnum = tswapal(target_md->msg_qnum);
4161     host_md->msg_qbytes = tswapal(target_md->msg_qbytes);
4162     host_md->msg_lspid = tswapal(target_md->msg_lspid);
4163     host_md->msg_lrpid = tswapal(target_md->msg_lrpid);
4164     unlock_user_struct(target_md, target_addr, 0);
4165     return 0;
4166 }
4167 
4168 static inline abi_long host_to_target_msqid_ds(abi_ulong target_addr,
4169                                                struct msqid_ds *host_md)
4170 {
4171     struct target_msqid_ds *target_md;
4172 
4173     if (!lock_user_struct(VERIFY_WRITE, target_md, target_addr, 0))
4174         return -TARGET_EFAULT;
4175     if (host_to_target_ipc_perm(target_addr,&(host_md->msg_perm)))
4176         return -TARGET_EFAULT;
4177     target_md->msg_stime = tswapal(host_md->msg_stime);
4178     target_md->msg_rtime = tswapal(host_md->msg_rtime);
4179     target_md->msg_ctime = tswapal(host_md->msg_ctime);
4180     target_md->__msg_cbytes = tswapal(host_md->__msg_cbytes);
4181     target_md->msg_qnum = tswapal(host_md->msg_qnum);
4182     target_md->msg_qbytes = tswapal(host_md->msg_qbytes);
4183     target_md->msg_lspid = tswapal(host_md->msg_lspid);
4184     target_md->msg_lrpid = tswapal(host_md->msg_lrpid);
4185     unlock_user_struct(target_md, target_addr, 1);
4186     return 0;
4187 }
4188 
4189 struct target_msginfo {
4190     int msgpool;
4191     int msgmap;
4192     int msgmax;
4193     int msgmnb;
4194     int msgmni;
4195     int msgssz;
4196     int msgtql;
4197     unsigned short int msgseg;
4198 };
4199 
4200 static inline abi_long host_to_target_msginfo(abi_ulong target_addr,
4201                                               struct msginfo *host_msginfo)
4202 {
4203     struct target_msginfo *target_msginfo;
4204     if (!lock_user_struct(VERIFY_WRITE, target_msginfo, target_addr, 0))
4205         return -TARGET_EFAULT;
4206     __put_user(host_msginfo->msgpool, &target_msginfo->msgpool);
4207     __put_user(host_msginfo->msgmap, &target_msginfo->msgmap);
4208     __put_user(host_msginfo->msgmax, &target_msginfo->msgmax);
4209     __put_user(host_msginfo->msgmnb, &target_msginfo->msgmnb);
4210     __put_user(host_msginfo->msgmni, &target_msginfo->msgmni);
4211     __put_user(host_msginfo->msgssz, &target_msginfo->msgssz);
4212     __put_user(host_msginfo->msgtql, &target_msginfo->msgtql);
4213     __put_user(host_msginfo->msgseg, &target_msginfo->msgseg);
4214     unlock_user_struct(target_msginfo, target_addr, 1);
4215     return 0;
4216 }
4217 
4218 static inline abi_long do_msgctl(int msgid, int cmd, abi_long ptr)
4219 {
4220     struct msqid_ds dsarg;
4221     struct msginfo msginfo;
4222     abi_long ret = -TARGET_EINVAL;
4223 
4224     cmd &= 0xff;
4225 
4226     switch (cmd) {
4227     case IPC_STAT:
4228     case IPC_SET:
4229     case MSG_STAT:
4230         if (target_to_host_msqid_ds(&dsarg,ptr))
4231             return -TARGET_EFAULT;
4232         ret = get_errno(msgctl(msgid, cmd, &dsarg));
4233         if (host_to_target_msqid_ds(ptr,&dsarg))
4234             return -TARGET_EFAULT;
4235         break;
4236     case IPC_RMID:
4237         ret = get_errno(msgctl(msgid, cmd, NULL));
4238         break;
4239     case IPC_INFO:
4240     case MSG_INFO:
4241         ret = get_errno(msgctl(msgid, cmd, (struct msqid_ds *)&msginfo));
4242         if (host_to_target_msginfo(ptr, &msginfo))
4243             return -TARGET_EFAULT;
4244         break;
4245     }
4246 
4247     return ret;
4248 }
4249 
4250 struct target_msgbuf {
4251     abi_long mtype;
4252     char	mtext[1];
4253 };
4254 
4255 static inline abi_long do_msgsnd(int msqid, abi_long msgp,
4256                                  ssize_t msgsz, int msgflg)
4257 {
4258     struct target_msgbuf *target_mb;
4259     struct msgbuf *host_mb;
4260     abi_long ret = 0;
4261 
4262     if (msgsz < 0) {
4263         return -TARGET_EINVAL;
4264     }
4265 
4266     if (!lock_user_struct(VERIFY_READ, target_mb, msgp, 0))
4267         return -TARGET_EFAULT;
4268     host_mb = g_try_malloc(msgsz + sizeof(long));
4269     if (!host_mb) {
4270         unlock_user_struct(target_mb, msgp, 0);
4271         return -TARGET_ENOMEM;
4272     }
4273     host_mb->mtype = (abi_long) tswapal(target_mb->mtype);
4274     memcpy(host_mb->mtext, target_mb->mtext, msgsz);
4275     ret = -TARGET_ENOSYS;
4276 #ifdef __NR_msgsnd
4277     ret = get_errno(safe_msgsnd(msqid, host_mb, msgsz, msgflg));
4278 #endif
4279 #ifdef __NR_ipc
4280     if (ret == -TARGET_ENOSYS) {
4281 #ifdef __s390x__
4282         ret = get_errno(safe_ipc(IPCOP_msgsnd, msqid, msgsz, msgflg,
4283                                  host_mb));
4284 #else
4285         ret = get_errno(safe_ipc(IPCOP_msgsnd, msqid, msgsz, msgflg,
4286                                  host_mb, 0));
4287 #endif
4288     }
4289 #endif
4290     g_free(host_mb);
4291     unlock_user_struct(target_mb, msgp, 0);
4292 
4293     return ret;
4294 }
4295 
4296 #ifdef __NR_ipc
4297 #if defined(__sparc__)
4298 /* SPARC for msgrcv it does not use the kludge on final 2 arguments.  */
4299 #define MSGRCV_ARGS(__msgp, __msgtyp) __msgp, __msgtyp
4300 #elif defined(__s390x__)
4301 /* The s390 sys_ipc variant has only five parameters.  */
4302 #define MSGRCV_ARGS(__msgp, __msgtyp) \
4303     ((long int[]){(long int)__msgp, __msgtyp})
4304 #else
4305 #define MSGRCV_ARGS(__msgp, __msgtyp) \
4306     ((long int[]){(long int)__msgp, __msgtyp}), 0
4307 #endif
4308 #endif
4309 
4310 static inline abi_long do_msgrcv(int msqid, abi_long msgp,
4311                                  ssize_t msgsz, abi_long msgtyp,
4312                                  int msgflg)
4313 {
4314     struct target_msgbuf *target_mb;
4315     char *target_mtext;
4316     struct msgbuf *host_mb;
4317     abi_long ret = 0;
4318 
4319     if (msgsz < 0) {
4320         return -TARGET_EINVAL;
4321     }
4322 
4323     if (!lock_user_struct(VERIFY_WRITE, target_mb, msgp, 0))
4324         return -TARGET_EFAULT;
4325 
4326     host_mb = g_try_malloc(msgsz + sizeof(long));
4327     if (!host_mb) {
4328         ret = -TARGET_ENOMEM;
4329         goto end;
4330     }
4331     ret = -TARGET_ENOSYS;
4332 #ifdef __NR_msgrcv
4333     ret = get_errno(safe_msgrcv(msqid, host_mb, msgsz, msgtyp, msgflg));
4334 #endif
4335 #ifdef __NR_ipc
4336     if (ret == -TARGET_ENOSYS) {
4337         ret = get_errno(safe_ipc(IPCOP_CALL(1, IPCOP_msgrcv), msqid, msgsz,
4338                         msgflg, MSGRCV_ARGS(host_mb, msgtyp)));
4339     }
4340 #endif
4341 
4342     if (ret > 0) {
4343         abi_ulong target_mtext_addr = msgp + sizeof(abi_ulong);
4344         target_mtext = lock_user(VERIFY_WRITE, target_mtext_addr, ret, 0);
4345         if (!target_mtext) {
4346             ret = -TARGET_EFAULT;
4347             goto end;
4348         }
4349         memcpy(target_mb->mtext, host_mb->mtext, ret);
4350         unlock_user(target_mtext, target_mtext_addr, ret);
4351     }
4352 
4353     target_mb->mtype = tswapal(host_mb->mtype);
4354 
4355 end:
4356     if (target_mb)
4357         unlock_user_struct(target_mb, msgp, 1);
4358     g_free(host_mb);
4359     return ret;
4360 }
4361 
4362 static inline abi_long target_to_host_shmid_ds(struct shmid_ds *host_sd,
4363                                                abi_ulong target_addr)
4364 {
4365     struct target_shmid_ds *target_sd;
4366 
4367     if (!lock_user_struct(VERIFY_READ, target_sd, target_addr, 1))
4368         return -TARGET_EFAULT;
4369     if (target_to_host_ipc_perm(&(host_sd->shm_perm), target_addr))
4370         return -TARGET_EFAULT;
4371     __get_user(host_sd->shm_segsz, &target_sd->shm_segsz);
4372     __get_user(host_sd->shm_atime, &target_sd->shm_atime);
4373     __get_user(host_sd->shm_dtime, &target_sd->shm_dtime);
4374     __get_user(host_sd->shm_ctime, &target_sd->shm_ctime);
4375     __get_user(host_sd->shm_cpid, &target_sd->shm_cpid);
4376     __get_user(host_sd->shm_lpid, &target_sd->shm_lpid);
4377     __get_user(host_sd->shm_nattch, &target_sd->shm_nattch);
4378     unlock_user_struct(target_sd, target_addr, 0);
4379     return 0;
4380 }
4381 
4382 static inline abi_long host_to_target_shmid_ds(abi_ulong target_addr,
4383                                                struct shmid_ds *host_sd)
4384 {
4385     struct target_shmid_ds *target_sd;
4386 
4387     if (!lock_user_struct(VERIFY_WRITE, target_sd, target_addr, 0))
4388         return -TARGET_EFAULT;
4389     if (host_to_target_ipc_perm(target_addr, &(host_sd->shm_perm)))
4390         return -TARGET_EFAULT;
4391     __put_user(host_sd->shm_segsz, &target_sd->shm_segsz);
4392     __put_user(host_sd->shm_atime, &target_sd->shm_atime);
4393     __put_user(host_sd->shm_dtime, &target_sd->shm_dtime);
4394     __put_user(host_sd->shm_ctime, &target_sd->shm_ctime);
4395     __put_user(host_sd->shm_cpid, &target_sd->shm_cpid);
4396     __put_user(host_sd->shm_lpid, &target_sd->shm_lpid);
4397     __put_user(host_sd->shm_nattch, &target_sd->shm_nattch);
4398     unlock_user_struct(target_sd, target_addr, 1);
4399     return 0;
4400 }
4401 
4402 struct  target_shminfo {
4403     abi_ulong shmmax;
4404     abi_ulong shmmin;
4405     abi_ulong shmmni;
4406     abi_ulong shmseg;
4407     abi_ulong shmall;
4408 };
4409 
4410 static inline abi_long host_to_target_shminfo(abi_ulong target_addr,
4411                                               struct shminfo *host_shminfo)
4412 {
4413     struct target_shminfo *target_shminfo;
4414     if (!lock_user_struct(VERIFY_WRITE, target_shminfo, target_addr, 0))
4415         return -TARGET_EFAULT;
4416     __put_user(host_shminfo->shmmax, &target_shminfo->shmmax);
4417     __put_user(host_shminfo->shmmin, &target_shminfo->shmmin);
4418     __put_user(host_shminfo->shmmni, &target_shminfo->shmmni);
4419     __put_user(host_shminfo->shmseg, &target_shminfo->shmseg);
4420     __put_user(host_shminfo->shmall, &target_shminfo->shmall);
4421     unlock_user_struct(target_shminfo, target_addr, 1);
4422     return 0;
4423 }
4424 
4425 struct target_shm_info {
4426     int used_ids;
4427     abi_ulong shm_tot;
4428     abi_ulong shm_rss;
4429     abi_ulong shm_swp;
4430     abi_ulong swap_attempts;
4431     abi_ulong swap_successes;
4432 };
4433 
4434 static inline abi_long host_to_target_shm_info(abi_ulong target_addr,
4435                                                struct shm_info *host_shm_info)
4436 {
4437     struct target_shm_info *target_shm_info;
4438     if (!lock_user_struct(VERIFY_WRITE, target_shm_info, target_addr, 0))
4439         return -TARGET_EFAULT;
4440     __put_user(host_shm_info->used_ids, &target_shm_info->used_ids);
4441     __put_user(host_shm_info->shm_tot, &target_shm_info->shm_tot);
4442     __put_user(host_shm_info->shm_rss, &target_shm_info->shm_rss);
4443     __put_user(host_shm_info->shm_swp, &target_shm_info->shm_swp);
4444     __put_user(host_shm_info->swap_attempts, &target_shm_info->swap_attempts);
4445     __put_user(host_shm_info->swap_successes, &target_shm_info->swap_successes);
4446     unlock_user_struct(target_shm_info, target_addr, 1);
4447     return 0;
4448 }
4449 
4450 static inline abi_long do_shmctl(int shmid, int cmd, abi_long buf)
4451 {
4452     struct shmid_ds dsarg;
4453     struct shminfo shminfo;
4454     struct shm_info shm_info;
4455     abi_long ret = -TARGET_EINVAL;
4456 
4457     cmd &= 0xff;
4458 
4459     switch(cmd) {
4460     case IPC_STAT:
4461     case IPC_SET:
4462     case SHM_STAT:
4463         if (target_to_host_shmid_ds(&dsarg, buf))
4464             return -TARGET_EFAULT;
4465         ret = get_errno(shmctl(shmid, cmd, &dsarg));
4466         if (host_to_target_shmid_ds(buf, &dsarg))
4467             return -TARGET_EFAULT;
4468         break;
4469     case IPC_INFO:
4470         ret = get_errno(shmctl(shmid, cmd, (struct shmid_ds *)&shminfo));
4471         if (host_to_target_shminfo(buf, &shminfo))
4472             return -TARGET_EFAULT;
4473         break;
4474     case SHM_INFO:
4475         ret = get_errno(shmctl(shmid, cmd, (struct shmid_ds *)&shm_info));
4476         if (host_to_target_shm_info(buf, &shm_info))
4477             return -TARGET_EFAULT;
4478         break;
4479     case IPC_RMID:
4480     case SHM_LOCK:
4481     case SHM_UNLOCK:
4482         ret = get_errno(shmctl(shmid, cmd, NULL));
4483         break;
4484     }
4485 
4486     return ret;
4487 }
4488 
4489 #ifndef TARGET_FORCE_SHMLBA
4490 /* For most architectures, SHMLBA is the same as the page size;
4491  * some architectures have larger values, in which case they should
4492  * define TARGET_FORCE_SHMLBA and provide a target_shmlba() function.
4493  * This corresponds to the kernel arch code defining __ARCH_FORCE_SHMLBA
4494  * and defining its own value for SHMLBA.
4495  *
4496  * The kernel also permits SHMLBA to be set by the architecture to a
4497  * value larger than the page size without setting __ARCH_FORCE_SHMLBA;
4498  * this means that addresses are rounded to the large size if
4499  * SHM_RND is set but addresses not aligned to that size are not rejected
4500  * as long as they are at least page-aligned. Since the only architecture
4501  * which uses this is ia64 this code doesn't provide for that oddity.
4502  */
4503 static inline abi_ulong target_shmlba(CPUArchState *cpu_env)
4504 {
4505     return TARGET_PAGE_SIZE;
4506 }
4507 #endif
4508 
4509 static inline abi_ulong do_shmat(CPUArchState *cpu_env,
4510                                  int shmid, abi_ulong shmaddr, int shmflg)
4511 {
4512     CPUState *cpu = env_cpu(cpu_env);
4513     abi_long raddr;
4514     void *host_raddr;
4515     struct shmid_ds shm_info;
4516     int i,ret;
4517     abi_ulong shmlba;
4518 
4519     /* shmat pointers are always untagged */
4520 
4521     /* find out the length of the shared memory segment */
4522     ret = get_errno(shmctl(shmid, IPC_STAT, &shm_info));
4523     if (is_error(ret)) {
4524         /* can't get length, bail out */
4525         return ret;
4526     }
4527 
4528     shmlba = target_shmlba(cpu_env);
4529 
4530     if (shmaddr & (shmlba - 1)) {
4531         if (shmflg & SHM_RND) {
4532             shmaddr &= ~(shmlba - 1);
4533         } else {
4534             return -TARGET_EINVAL;
4535         }
4536     }
4537     if (!guest_range_valid_untagged(shmaddr, shm_info.shm_segsz)) {
4538         return -TARGET_EINVAL;
4539     }
4540 
4541     mmap_lock();
4542 
4543     /*
4544      * We're mapping shared memory, so ensure we generate code for parallel
4545      * execution and flush old translations.  This will work up to the level
4546      * supported by the host -- anything that requires EXCP_ATOMIC will not
4547      * be atomic with respect to an external process.
4548      */
4549     if (!(cpu->tcg_cflags & CF_PARALLEL)) {
4550         cpu->tcg_cflags |= CF_PARALLEL;
4551         tb_flush(cpu);
4552     }
4553 
4554     if (shmaddr)
4555         host_raddr = shmat(shmid, (void *)g2h_untagged(shmaddr), shmflg);
4556     else {
4557         abi_ulong mmap_start;
4558 
4559         /* In order to use the host shmat, we need to honor host SHMLBA.  */
4560         mmap_start = mmap_find_vma(0, shm_info.shm_segsz, MAX(SHMLBA, shmlba));
4561 
4562         if (mmap_start == -1) {
4563             errno = ENOMEM;
4564             host_raddr = (void *)-1;
4565         } else
4566             host_raddr = shmat(shmid, g2h_untagged(mmap_start),
4567                                shmflg | SHM_REMAP);
4568     }
4569 
4570     if (host_raddr == (void *)-1) {
4571         mmap_unlock();
4572         return get_errno((long)host_raddr);
4573     }
4574     raddr=h2g((unsigned long)host_raddr);
4575 
4576     page_set_flags(raddr, raddr + shm_info.shm_segsz,
4577                    PAGE_VALID | PAGE_RESET | PAGE_READ |
4578                    (shmflg & SHM_RDONLY ? 0 : PAGE_WRITE));
4579 
4580     for (i = 0; i < N_SHM_REGIONS; i++) {
4581         if (!shm_regions[i].in_use) {
4582             shm_regions[i].in_use = true;
4583             shm_regions[i].start = raddr;
4584             shm_regions[i].size = shm_info.shm_segsz;
4585             break;
4586         }
4587     }
4588 
4589     mmap_unlock();
4590     return raddr;
4591 
4592 }
4593 
4594 static inline abi_long do_shmdt(abi_ulong shmaddr)
4595 {
4596     int i;
4597     abi_long rv;
4598 
4599     /* shmdt pointers are always untagged */
4600 
4601     mmap_lock();
4602 
4603     for (i = 0; i < N_SHM_REGIONS; ++i) {
4604         if (shm_regions[i].in_use && shm_regions[i].start == shmaddr) {
4605             shm_regions[i].in_use = false;
4606             page_set_flags(shmaddr, shmaddr + shm_regions[i].size, 0);
4607             break;
4608         }
4609     }
4610     rv = get_errno(shmdt(g2h_untagged(shmaddr)));
4611 
4612     mmap_unlock();
4613 
4614     return rv;
4615 }
4616 
4617 #ifdef TARGET_NR_ipc
4618 /* ??? This only works with linear mappings.  */
4619 /* do_ipc() must return target values and target errnos. */
4620 static abi_long do_ipc(CPUArchState *cpu_env,
4621                        unsigned int call, abi_long first,
4622                        abi_long second, abi_long third,
4623                        abi_long ptr, abi_long fifth)
4624 {
4625     int version;
4626     abi_long ret = 0;
4627 
4628     version = call >> 16;
4629     call &= 0xffff;
4630 
4631     switch (call) {
4632     case IPCOP_semop:
4633         ret = do_semtimedop(first, ptr, second, 0, false);
4634         break;
4635     case IPCOP_semtimedop:
4636     /*
4637      * The s390 sys_ipc variant has only five parameters instead of six
4638      * (as for default variant) and the only difference is the handling of
4639      * SEMTIMEDOP where on s390 the third parameter is used as a pointer
4640      * to a struct timespec where the generic variant uses fifth parameter.
4641      */
4642 #if defined(TARGET_S390X)
4643         ret = do_semtimedop(first, ptr, second, third, TARGET_ABI_BITS == 64);
4644 #else
4645         ret = do_semtimedop(first, ptr, second, fifth, TARGET_ABI_BITS == 64);
4646 #endif
4647         break;
4648 
4649     case IPCOP_semget:
4650         ret = get_errno(semget(first, second, third));
4651         break;
4652 
4653     case IPCOP_semctl: {
4654         /* The semun argument to semctl is passed by value, so dereference the
4655          * ptr argument. */
4656         abi_ulong atptr;
4657         get_user_ual(atptr, ptr);
4658         ret = do_semctl(first, second, third, atptr);
4659         break;
4660     }
4661 
4662     case IPCOP_msgget:
4663         ret = get_errno(msgget(first, second));
4664         break;
4665 
4666     case IPCOP_msgsnd:
4667         ret = do_msgsnd(first, ptr, second, third);
4668         break;
4669 
4670     case IPCOP_msgctl:
4671         ret = do_msgctl(first, second, ptr);
4672         break;
4673 
4674     case IPCOP_msgrcv:
4675         switch (version) {
4676         case 0:
4677             {
4678                 struct target_ipc_kludge {
4679                     abi_long msgp;
4680                     abi_long msgtyp;
4681                 } *tmp;
4682 
4683                 if (!lock_user_struct(VERIFY_READ, tmp, ptr, 1)) {
4684                     ret = -TARGET_EFAULT;
4685                     break;
4686                 }
4687 
4688                 ret = do_msgrcv(first, tswapal(tmp->msgp), second, tswapal(tmp->msgtyp), third);
4689 
4690                 unlock_user_struct(tmp, ptr, 0);
4691                 break;
4692             }
4693         default:
4694             ret = do_msgrcv(first, ptr, second, fifth, third);
4695         }
4696         break;
4697 
4698     case IPCOP_shmat:
4699         switch (version) {
4700         default:
4701         {
4702             abi_ulong raddr;
4703             raddr = do_shmat(cpu_env, first, ptr, second);
4704             if (is_error(raddr))
4705                 return get_errno(raddr);
4706             if (put_user_ual(raddr, third))
4707                 return -TARGET_EFAULT;
4708             break;
4709         }
4710         case 1:
4711             ret = -TARGET_EINVAL;
4712             break;
4713         }
4714 	break;
4715     case IPCOP_shmdt:
4716         ret = do_shmdt(ptr);
4717 	break;
4718 
4719     case IPCOP_shmget:
4720 	/* IPC_* flag values are the same on all linux platforms */
4721 	ret = get_errno(shmget(first, second, third));
4722 	break;
4723 
4724 	/* IPC_* and SHM_* command values are the same on all linux platforms */
4725     case IPCOP_shmctl:
4726         ret = do_shmctl(first, second, ptr);
4727         break;
4728     default:
4729         qemu_log_mask(LOG_UNIMP, "Unsupported ipc call: %d (version %d)\n",
4730                       call, version);
4731 	ret = -TARGET_ENOSYS;
4732 	break;
4733     }
4734     return ret;
4735 }
4736 #endif
4737 
4738 /* kernel structure types definitions */
4739 
4740 #define STRUCT(name, ...) STRUCT_ ## name,
4741 #define STRUCT_SPECIAL(name) STRUCT_ ## name,
4742 enum {
4743 #include "syscall_types.h"
4744 STRUCT_MAX
4745 };
4746 #undef STRUCT
4747 #undef STRUCT_SPECIAL
4748 
4749 #define STRUCT(name, ...) static const argtype struct_ ## name ## _def[] = {  __VA_ARGS__, TYPE_NULL };
4750 #define STRUCT_SPECIAL(name)
4751 #include "syscall_types.h"
4752 #undef STRUCT
4753 #undef STRUCT_SPECIAL
4754 
4755 #define MAX_STRUCT_SIZE 4096
4756 
4757 #ifdef CONFIG_FIEMAP
4758 /* So fiemap access checks don't overflow on 32 bit systems.
4759  * This is very slightly smaller than the limit imposed by
4760  * the underlying kernel.
4761  */
4762 #define FIEMAP_MAX_EXTENTS ((UINT_MAX - sizeof(struct fiemap))  \
4763                             / sizeof(struct fiemap_extent))
4764 
4765 static abi_long do_ioctl_fs_ioc_fiemap(const IOCTLEntry *ie, uint8_t *buf_temp,
4766                                        int fd, int cmd, abi_long arg)
4767 {
4768     /* The parameter for this ioctl is a struct fiemap followed
4769      * by an array of struct fiemap_extent whose size is set
4770      * in fiemap->fm_extent_count. The array is filled in by the
4771      * ioctl.
4772      */
4773     int target_size_in, target_size_out;
4774     struct fiemap *fm;
4775     const argtype *arg_type = ie->arg_type;
4776     const argtype extent_arg_type[] = { MK_STRUCT(STRUCT_fiemap_extent) };
4777     void *argptr, *p;
4778     abi_long ret;
4779     int i, extent_size = thunk_type_size(extent_arg_type, 0);
4780     uint32_t outbufsz;
4781     int free_fm = 0;
4782 
4783     assert(arg_type[0] == TYPE_PTR);
4784     assert(ie->access == IOC_RW);
4785     arg_type++;
4786     target_size_in = thunk_type_size(arg_type, 0);
4787     argptr = lock_user(VERIFY_READ, arg, target_size_in, 1);
4788     if (!argptr) {
4789         return -TARGET_EFAULT;
4790     }
4791     thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
4792     unlock_user(argptr, arg, 0);
4793     fm = (struct fiemap *)buf_temp;
4794     if (fm->fm_extent_count > FIEMAP_MAX_EXTENTS) {
4795         return -TARGET_EINVAL;
4796     }
4797 
4798     outbufsz = sizeof (*fm) +
4799         (sizeof(struct fiemap_extent) * fm->fm_extent_count);
4800 
4801     if (outbufsz > MAX_STRUCT_SIZE) {
4802         /* We can't fit all the extents into the fixed size buffer.
4803          * Allocate one that is large enough and use it instead.
4804          */
4805         fm = g_try_malloc(outbufsz);
4806         if (!fm) {
4807             return -TARGET_ENOMEM;
4808         }
4809         memcpy(fm, buf_temp, sizeof(struct fiemap));
4810         free_fm = 1;
4811     }
4812     ret = get_errno(safe_ioctl(fd, ie->host_cmd, fm));
4813     if (!is_error(ret)) {
4814         target_size_out = target_size_in;
4815         /* An extent_count of 0 means we were only counting the extents
4816          * so there are no structs to copy
4817          */
4818         if (fm->fm_extent_count != 0) {
4819             target_size_out += fm->fm_mapped_extents * extent_size;
4820         }
4821         argptr = lock_user(VERIFY_WRITE, arg, target_size_out, 0);
4822         if (!argptr) {
4823             ret = -TARGET_EFAULT;
4824         } else {
4825             /* Convert the struct fiemap */
4826             thunk_convert(argptr, fm, arg_type, THUNK_TARGET);
4827             if (fm->fm_extent_count != 0) {
4828                 p = argptr + target_size_in;
4829                 /* ...and then all the struct fiemap_extents */
4830                 for (i = 0; i < fm->fm_mapped_extents; i++) {
4831                     thunk_convert(p, &fm->fm_extents[i], extent_arg_type,
4832                                   THUNK_TARGET);
4833                     p += extent_size;
4834                 }
4835             }
4836             unlock_user(argptr, arg, target_size_out);
4837         }
4838     }
4839     if (free_fm) {
4840         g_free(fm);
4841     }
4842     return ret;
4843 }
4844 #endif
4845 
4846 static abi_long do_ioctl_ifconf(const IOCTLEntry *ie, uint8_t *buf_temp,
4847                                 int fd, int cmd, abi_long arg)
4848 {
4849     const argtype *arg_type = ie->arg_type;
4850     int target_size;
4851     void *argptr;
4852     int ret;
4853     struct ifconf *host_ifconf;
4854     uint32_t outbufsz;
4855     const argtype ifreq_arg_type[] = { MK_STRUCT(STRUCT_sockaddr_ifreq) };
4856     const argtype ifreq_max_type[] = { MK_STRUCT(STRUCT_ifmap_ifreq) };
4857     int target_ifreq_size;
4858     int nb_ifreq;
4859     int free_buf = 0;
4860     int i;
4861     int target_ifc_len;
4862     abi_long target_ifc_buf;
4863     int host_ifc_len;
4864     char *host_ifc_buf;
4865 
4866     assert(arg_type[0] == TYPE_PTR);
4867     assert(ie->access == IOC_RW);
4868 
4869     arg_type++;
4870     target_size = thunk_type_size(arg_type, 0);
4871 
4872     argptr = lock_user(VERIFY_READ, arg, target_size, 1);
4873     if (!argptr)
4874         return -TARGET_EFAULT;
4875     thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
4876     unlock_user(argptr, arg, 0);
4877 
4878     host_ifconf = (struct ifconf *)(unsigned long)buf_temp;
4879     target_ifc_buf = (abi_long)(unsigned long)host_ifconf->ifc_buf;
4880     target_ifreq_size = thunk_type_size(ifreq_max_type, 0);
4881 
4882     if (target_ifc_buf != 0) {
4883         target_ifc_len = host_ifconf->ifc_len;
4884         nb_ifreq = target_ifc_len / target_ifreq_size;
4885         host_ifc_len = nb_ifreq * sizeof(struct ifreq);
4886 
4887         outbufsz = sizeof(*host_ifconf) + host_ifc_len;
4888         if (outbufsz > MAX_STRUCT_SIZE) {
4889             /*
4890              * We can't fit all the extents into the fixed size buffer.
4891              * Allocate one that is large enough and use it instead.
4892              */
4893             host_ifconf = g_try_malloc(outbufsz);
4894             if (!host_ifconf) {
4895                 return -TARGET_ENOMEM;
4896             }
4897             memcpy(host_ifconf, buf_temp, sizeof(*host_ifconf));
4898             free_buf = 1;
4899         }
4900         host_ifc_buf = (char *)host_ifconf + sizeof(*host_ifconf);
4901 
4902         host_ifconf->ifc_len = host_ifc_len;
4903     } else {
4904       host_ifc_buf = NULL;
4905     }
4906     host_ifconf->ifc_buf = host_ifc_buf;
4907 
4908     ret = get_errno(safe_ioctl(fd, ie->host_cmd, host_ifconf));
4909     if (!is_error(ret)) {
4910 	/* convert host ifc_len to target ifc_len */
4911 
4912         nb_ifreq = host_ifconf->ifc_len / sizeof(struct ifreq);
4913         target_ifc_len = nb_ifreq * target_ifreq_size;
4914         host_ifconf->ifc_len = target_ifc_len;
4915 
4916 	/* restore target ifc_buf */
4917 
4918         host_ifconf->ifc_buf = (char *)(unsigned long)target_ifc_buf;
4919 
4920 	/* copy struct ifconf to target user */
4921 
4922         argptr = lock_user(VERIFY_WRITE, arg, target_size, 0);
4923         if (!argptr)
4924             return -TARGET_EFAULT;
4925         thunk_convert(argptr, host_ifconf, arg_type, THUNK_TARGET);
4926         unlock_user(argptr, arg, target_size);
4927 
4928         if (target_ifc_buf != 0) {
4929             /* copy ifreq[] to target user */
4930             argptr = lock_user(VERIFY_WRITE, target_ifc_buf, target_ifc_len, 0);
4931             for (i = 0; i < nb_ifreq ; i++) {
4932                 thunk_convert(argptr + i * target_ifreq_size,
4933                               host_ifc_buf + i * sizeof(struct ifreq),
4934                               ifreq_arg_type, THUNK_TARGET);
4935             }
4936             unlock_user(argptr, target_ifc_buf, target_ifc_len);
4937         }
4938     }
4939 
4940     if (free_buf) {
4941         g_free(host_ifconf);
4942     }
4943 
4944     return ret;
4945 }
4946 
4947 #if defined(CONFIG_USBFS)
4948 #if HOST_LONG_BITS > 64
4949 #error USBDEVFS thunks do not support >64 bit hosts yet.
4950 #endif
4951 struct live_urb {
4952     uint64_t target_urb_adr;
4953     uint64_t target_buf_adr;
4954     char *target_buf_ptr;
4955     struct usbdevfs_urb host_urb;
4956 };
4957 
4958 static GHashTable *usbdevfs_urb_hashtable(void)
4959 {
4960     static GHashTable *urb_hashtable;
4961 
4962     if (!urb_hashtable) {
4963         urb_hashtable = g_hash_table_new(g_int64_hash, g_int64_equal);
4964     }
4965     return urb_hashtable;
4966 }
4967 
4968 static void urb_hashtable_insert(struct live_urb *urb)
4969 {
4970     GHashTable *urb_hashtable = usbdevfs_urb_hashtable();
4971     g_hash_table_insert(urb_hashtable, urb, urb);
4972 }
4973 
4974 static struct live_urb *urb_hashtable_lookup(uint64_t target_urb_adr)
4975 {
4976     GHashTable *urb_hashtable = usbdevfs_urb_hashtable();
4977     return g_hash_table_lookup(urb_hashtable, &target_urb_adr);
4978 }
4979 
4980 static void urb_hashtable_remove(struct live_urb *urb)
4981 {
4982     GHashTable *urb_hashtable = usbdevfs_urb_hashtable();
4983     g_hash_table_remove(urb_hashtable, urb);
4984 }
4985 
4986 static abi_long
4987 do_ioctl_usbdevfs_reapurb(const IOCTLEntry *ie, uint8_t *buf_temp,
4988                           int fd, int cmd, abi_long arg)
4989 {
4990     const argtype usbfsurb_arg_type[] = { MK_STRUCT(STRUCT_usbdevfs_urb) };
4991     const argtype ptrvoid_arg_type[] = { TYPE_PTRVOID, 0, 0 };
4992     struct live_urb *lurb;
4993     void *argptr;
4994     uint64_t hurb;
4995     int target_size;
4996     uintptr_t target_urb_adr;
4997     abi_long ret;
4998 
4999     target_size = thunk_type_size(usbfsurb_arg_type, THUNK_TARGET);
5000 
5001     memset(buf_temp, 0, sizeof(uint64_t));
5002     ret = get_errno(safe_ioctl(fd, ie->host_cmd, buf_temp));
5003     if (is_error(ret)) {
5004         return ret;
5005     }
5006 
5007     memcpy(&hurb, buf_temp, sizeof(uint64_t));
5008     lurb = (void *)((uintptr_t)hurb - offsetof(struct live_urb, host_urb));
5009     if (!lurb->target_urb_adr) {
5010         return -TARGET_EFAULT;
5011     }
5012     urb_hashtable_remove(lurb);
5013     unlock_user(lurb->target_buf_ptr, lurb->target_buf_adr,
5014         lurb->host_urb.buffer_length);
5015     lurb->target_buf_ptr = NULL;
5016 
5017     /* restore the guest buffer pointer */
5018     lurb->host_urb.buffer = (void *)(uintptr_t)lurb->target_buf_adr;
5019 
5020     /* update the guest urb struct */
5021     argptr = lock_user(VERIFY_WRITE, lurb->target_urb_adr, target_size, 0);
5022     if (!argptr) {
5023         g_free(lurb);
5024         return -TARGET_EFAULT;
5025     }
5026     thunk_convert(argptr, &lurb->host_urb, usbfsurb_arg_type, THUNK_TARGET);
5027     unlock_user(argptr, lurb->target_urb_adr, target_size);
5028 
5029     target_size = thunk_type_size(ptrvoid_arg_type, THUNK_TARGET);
5030     /* write back the urb handle */
5031     argptr = lock_user(VERIFY_WRITE, arg, target_size, 0);
5032     if (!argptr) {
5033         g_free(lurb);
5034         return -TARGET_EFAULT;
5035     }
5036 
5037     /* GHashTable uses 64-bit keys but thunk_convert expects uintptr_t */
5038     target_urb_adr = lurb->target_urb_adr;
5039     thunk_convert(argptr, &target_urb_adr, ptrvoid_arg_type, THUNK_TARGET);
5040     unlock_user(argptr, arg, target_size);
5041 
5042     g_free(lurb);
5043     return ret;
5044 }
5045 
5046 static abi_long
5047 do_ioctl_usbdevfs_discardurb(const IOCTLEntry *ie,
5048                              uint8_t *buf_temp __attribute__((unused)),
5049                              int fd, int cmd, abi_long arg)
5050 {
5051     struct live_urb *lurb;
5052 
5053     /* map target address back to host URB with metadata. */
5054     lurb = urb_hashtable_lookup(arg);
5055     if (!lurb) {
5056         return -TARGET_EFAULT;
5057     }
5058     return get_errno(safe_ioctl(fd, ie->host_cmd, &lurb->host_urb));
5059 }
5060 
5061 static abi_long
5062 do_ioctl_usbdevfs_submiturb(const IOCTLEntry *ie, uint8_t *buf_temp,
5063                             int fd, int cmd, abi_long arg)
5064 {
5065     const argtype *arg_type = ie->arg_type;
5066     int target_size;
5067     abi_long ret;
5068     void *argptr;
5069     int rw_dir;
5070     struct live_urb *lurb;
5071 
5072     /*
5073      * each submitted URB needs to map to a unique ID for the
5074      * kernel, and that unique ID needs to be a pointer to
5075      * host memory.  hence, we need to malloc for each URB.
5076      * isochronous transfers have a variable length struct.
5077      */
5078     arg_type++;
5079     target_size = thunk_type_size(arg_type, THUNK_TARGET);
5080 
5081     /* construct host copy of urb and metadata */
5082     lurb = g_try_new0(struct live_urb, 1);
5083     if (!lurb) {
5084         return -TARGET_ENOMEM;
5085     }
5086 
5087     argptr = lock_user(VERIFY_READ, arg, target_size, 1);
5088     if (!argptr) {
5089         g_free(lurb);
5090         return -TARGET_EFAULT;
5091     }
5092     thunk_convert(&lurb->host_urb, argptr, arg_type, THUNK_HOST);
5093     unlock_user(argptr, arg, 0);
5094 
5095     lurb->target_urb_adr = arg;
5096     lurb->target_buf_adr = (uintptr_t)lurb->host_urb.buffer;
5097 
5098     /* buffer space used depends on endpoint type so lock the entire buffer */
5099     /* control type urbs should check the buffer contents for true direction */
5100     rw_dir = lurb->host_urb.endpoint & USB_DIR_IN ? VERIFY_WRITE : VERIFY_READ;
5101     lurb->target_buf_ptr = lock_user(rw_dir, lurb->target_buf_adr,
5102         lurb->host_urb.buffer_length, 1);
5103     if (lurb->target_buf_ptr == NULL) {
5104         g_free(lurb);
5105         return -TARGET_EFAULT;
5106     }
5107 
5108     /* update buffer pointer in host copy */
5109     lurb->host_urb.buffer = lurb->target_buf_ptr;
5110 
5111     ret = get_errno(safe_ioctl(fd, ie->host_cmd, &lurb->host_urb));
5112     if (is_error(ret)) {
5113         unlock_user(lurb->target_buf_ptr, lurb->target_buf_adr, 0);
5114         g_free(lurb);
5115     } else {
5116         urb_hashtable_insert(lurb);
5117     }
5118 
5119     return ret;
5120 }
5121 #endif /* CONFIG_USBFS */
5122 
5123 static abi_long do_ioctl_dm(const IOCTLEntry *ie, uint8_t *buf_temp, int fd,
5124                             int cmd, abi_long arg)
5125 {
5126     void *argptr;
5127     struct dm_ioctl *host_dm;
5128     abi_long guest_data;
5129     uint32_t guest_data_size;
5130     int target_size;
5131     const argtype *arg_type = ie->arg_type;
5132     abi_long ret;
5133     void *big_buf = NULL;
5134     char *host_data;
5135 
5136     arg_type++;
5137     target_size = thunk_type_size(arg_type, 0);
5138     argptr = lock_user(VERIFY_READ, arg, target_size, 1);
5139     if (!argptr) {
5140         ret = -TARGET_EFAULT;
5141         goto out;
5142     }
5143     thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
5144     unlock_user(argptr, arg, 0);
5145 
5146     /* buf_temp is too small, so fetch things into a bigger buffer */
5147     big_buf = g_malloc0(((struct dm_ioctl*)buf_temp)->data_size * 2);
5148     memcpy(big_buf, buf_temp, target_size);
5149     buf_temp = big_buf;
5150     host_dm = big_buf;
5151 
5152     guest_data = arg + host_dm->data_start;
5153     if ((guest_data - arg) < 0) {
5154         ret = -TARGET_EINVAL;
5155         goto out;
5156     }
5157     guest_data_size = host_dm->data_size - host_dm->data_start;
5158     host_data = (char*)host_dm + host_dm->data_start;
5159 
5160     argptr = lock_user(VERIFY_READ, guest_data, guest_data_size, 1);
5161     if (!argptr) {
5162         ret = -TARGET_EFAULT;
5163         goto out;
5164     }
5165 
5166     switch (ie->host_cmd) {
5167     case DM_REMOVE_ALL:
5168     case DM_LIST_DEVICES:
5169     case DM_DEV_CREATE:
5170     case DM_DEV_REMOVE:
5171     case DM_DEV_SUSPEND:
5172     case DM_DEV_STATUS:
5173     case DM_DEV_WAIT:
5174     case DM_TABLE_STATUS:
5175     case DM_TABLE_CLEAR:
5176     case DM_TABLE_DEPS:
5177     case DM_LIST_VERSIONS:
5178         /* no input data */
5179         break;
5180     case DM_DEV_RENAME:
5181     case DM_DEV_SET_GEOMETRY:
5182         /* data contains only strings */
5183         memcpy(host_data, argptr, guest_data_size);
5184         break;
5185     case DM_TARGET_MSG:
5186         memcpy(host_data, argptr, guest_data_size);
5187         *(uint64_t*)host_data = tswap64(*(uint64_t*)argptr);
5188         break;
5189     case DM_TABLE_LOAD:
5190     {
5191         void *gspec = argptr;
5192         void *cur_data = host_data;
5193         const argtype arg_type[] = { MK_STRUCT(STRUCT_dm_target_spec) };
5194         int spec_size = thunk_type_size(arg_type, 0);
5195         int i;
5196 
5197         for (i = 0; i < host_dm->target_count; i++) {
5198             struct dm_target_spec *spec = cur_data;
5199             uint32_t next;
5200             int slen;
5201 
5202             thunk_convert(spec, gspec, arg_type, THUNK_HOST);
5203             slen = strlen((char*)gspec + spec_size) + 1;
5204             next = spec->next;
5205             spec->next = sizeof(*spec) + slen;
5206             strcpy((char*)&spec[1], gspec + spec_size);
5207             gspec += next;
5208             cur_data += spec->next;
5209         }
5210         break;
5211     }
5212     default:
5213         ret = -TARGET_EINVAL;
5214         unlock_user(argptr, guest_data, 0);
5215         goto out;
5216     }
5217     unlock_user(argptr, guest_data, 0);
5218 
5219     ret = get_errno(safe_ioctl(fd, ie->host_cmd, buf_temp));
5220     if (!is_error(ret)) {
5221         guest_data = arg + host_dm->data_start;
5222         guest_data_size = host_dm->data_size - host_dm->data_start;
5223         argptr = lock_user(VERIFY_WRITE, guest_data, guest_data_size, 0);
5224         switch (ie->host_cmd) {
5225         case DM_REMOVE_ALL:
5226         case DM_DEV_CREATE:
5227         case DM_DEV_REMOVE:
5228         case DM_DEV_RENAME:
5229         case DM_DEV_SUSPEND:
5230         case DM_DEV_STATUS:
5231         case DM_TABLE_LOAD:
5232         case DM_TABLE_CLEAR:
5233         case DM_TARGET_MSG:
5234         case DM_DEV_SET_GEOMETRY:
5235             /* no return data */
5236             break;
5237         case DM_LIST_DEVICES:
5238         {
5239             struct dm_name_list *nl = (void*)host_dm + host_dm->data_start;
5240             uint32_t remaining_data = guest_data_size;
5241             void *cur_data = argptr;
5242             const argtype arg_type[] = { MK_STRUCT(STRUCT_dm_name_list) };
5243             int nl_size = 12; /* can't use thunk_size due to alignment */
5244 
5245             while (1) {
5246                 uint32_t next = nl->next;
5247                 if (next) {
5248                     nl->next = nl_size + (strlen(nl->name) + 1);
5249                 }
5250                 if (remaining_data < nl->next) {
5251                     host_dm->flags |= DM_BUFFER_FULL_FLAG;
5252                     break;
5253                 }
5254                 thunk_convert(cur_data, nl, arg_type, THUNK_TARGET);
5255                 strcpy(cur_data + nl_size, nl->name);
5256                 cur_data += nl->next;
5257                 remaining_data -= nl->next;
5258                 if (!next) {
5259                     break;
5260                 }
5261                 nl = (void*)nl + next;
5262             }
5263             break;
5264         }
5265         case DM_DEV_WAIT:
5266         case DM_TABLE_STATUS:
5267         {
5268             struct dm_target_spec *spec = (void*)host_dm + host_dm->data_start;
5269             void *cur_data = argptr;
5270             const argtype arg_type[] = { MK_STRUCT(STRUCT_dm_target_spec) };
5271             int spec_size = thunk_type_size(arg_type, 0);
5272             int i;
5273 
5274             for (i = 0; i < host_dm->target_count; i++) {
5275                 uint32_t next = spec->next;
5276                 int slen = strlen((char*)&spec[1]) + 1;
5277                 spec->next = (cur_data - argptr) + spec_size + slen;
5278                 if (guest_data_size < spec->next) {
5279                     host_dm->flags |= DM_BUFFER_FULL_FLAG;
5280                     break;
5281                 }
5282                 thunk_convert(cur_data, spec, arg_type, THUNK_TARGET);
5283                 strcpy(cur_data + spec_size, (char*)&spec[1]);
5284                 cur_data = argptr + spec->next;
5285                 spec = (void*)host_dm + host_dm->data_start + next;
5286             }
5287             break;
5288         }
5289         case DM_TABLE_DEPS:
5290         {
5291             void *hdata = (void*)host_dm + host_dm->data_start;
5292             int count = *(uint32_t*)hdata;
5293             uint64_t *hdev = hdata + 8;
5294             uint64_t *gdev = argptr + 8;
5295             int i;
5296 
5297             *(uint32_t*)argptr = tswap32(count);
5298             for (i = 0; i < count; i++) {
5299                 *gdev = tswap64(*hdev);
5300                 gdev++;
5301                 hdev++;
5302             }
5303             break;
5304         }
5305         case DM_LIST_VERSIONS:
5306         {
5307             struct dm_target_versions *vers = (void*)host_dm + host_dm->data_start;
5308             uint32_t remaining_data = guest_data_size;
5309             void *cur_data = argptr;
5310             const argtype arg_type[] = { MK_STRUCT(STRUCT_dm_target_versions) };
5311             int vers_size = thunk_type_size(arg_type, 0);
5312 
5313             while (1) {
5314                 uint32_t next = vers->next;
5315                 if (next) {
5316                     vers->next = vers_size + (strlen(vers->name) + 1);
5317                 }
5318                 if (remaining_data < vers->next) {
5319                     host_dm->flags |= DM_BUFFER_FULL_FLAG;
5320                     break;
5321                 }
5322                 thunk_convert(cur_data, vers, arg_type, THUNK_TARGET);
5323                 strcpy(cur_data + vers_size, vers->name);
5324                 cur_data += vers->next;
5325                 remaining_data -= vers->next;
5326                 if (!next) {
5327                     break;
5328                 }
5329                 vers = (void*)vers + next;
5330             }
5331             break;
5332         }
5333         default:
5334             unlock_user(argptr, guest_data, 0);
5335             ret = -TARGET_EINVAL;
5336             goto out;
5337         }
5338         unlock_user(argptr, guest_data, guest_data_size);
5339 
5340         argptr = lock_user(VERIFY_WRITE, arg, target_size, 0);
5341         if (!argptr) {
5342             ret = -TARGET_EFAULT;
5343             goto out;
5344         }
5345         thunk_convert(argptr, buf_temp, arg_type, THUNK_TARGET);
5346         unlock_user(argptr, arg, target_size);
5347     }
5348 out:
5349     g_free(big_buf);
5350     return ret;
5351 }
5352 
5353 static abi_long do_ioctl_blkpg(const IOCTLEntry *ie, uint8_t *buf_temp, int fd,
5354                                int cmd, abi_long arg)
5355 {
5356     void *argptr;
5357     int target_size;
5358     const argtype *arg_type = ie->arg_type;
5359     const argtype part_arg_type[] = { MK_STRUCT(STRUCT_blkpg_partition) };
5360     abi_long ret;
5361 
5362     struct blkpg_ioctl_arg *host_blkpg = (void*)buf_temp;
5363     struct blkpg_partition host_part;
5364 
5365     /* Read and convert blkpg */
5366     arg_type++;
5367     target_size = thunk_type_size(arg_type, 0);
5368     argptr = lock_user(VERIFY_READ, arg, target_size, 1);
5369     if (!argptr) {
5370         ret = -TARGET_EFAULT;
5371         goto out;
5372     }
5373     thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
5374     unlock_user(argptr, arg, 0);
5375 
5376     switch (host_blkpg->op) {
5377     case BLKPG_ADD_PARTITION:
5378     case BLKPG_DEL_PARTITION:
5379         /* payload is struct blkpg_partition */
5380         break;
5381     default:
5382         /* Unknown opcode */
5383         ret = -TARGET_EINVAL;
5384         goto out;
5385     }
5386 
5387     /* Read and convert blkpg->data */
5388     arg = (abi_long)(uintptr_t)host_blkpg->data;
5389     target_size = thunk_type_size(part_arg_type, 0);
5390     argptr = lock_user(VERIFY_READ, arg, target_size, 1);
5391     if (!argptr) {
5392         ret = -TARGET_EFAULT;
5393         goto out;
5394     }
5395     thunk_convert(&host_part, argptr, part_arg_type, THUNK_HOST);
5396     unlock_user(argptr, arg, 0);
5397 
5398     /* Swizzle the data pointer to our local copy and call! */
5399     host_blkpg->data = &host_part;
5400     ret = get_errno(safe_ioctl(fd, ie->host_cmd, host_blkpg));
5401 
5402 out:
5403     return ret;
5404 }
5405 
5406 static abi_long do_ioctl_rt(const IOCTLEntry *ie, uint8_t *buf_temp,
5407                                 int fd, int cmd, abi_long arg)
5408 {
5409     const argtype *arg_type = ie->arg_type;
5410     const StructEntry *se;
5411     const argtype *field_types;
5412     const int *dst_offsets, *src_offsets;
5413     int target_size;
5414     void *argptr;
5415     abi_ulong *target_rt_dev_ptr = NULL;
5416     unsigned long *host_rt_dev_ptr = NULL;
5417     abi_long ret;
5418     int i;
5419 
5420     assert(ie->access == IOC_W);
5421     assert(*arg_type == TYPE_PTR);
5422     arg_type++;
5423     assert(*arg_type == TYPE_STRUCT);
5424     target_size = thunk_type_size(arg_type, 0);
5425     argptr = lock_user(VERIFY_READ, arg, target_size, 1);
5426     if (!argptr) {
5427         return -TARGET_EFAULT;
5428     }
5429     arg_type++;
5430     assert(*arg_type == (int)STRUCT_rtentry);
5431     se = struct_entries + *arg_type++;
5432     assert(se->convert[0] == NULL);
5433     /* convert struct here to be able to catch rt_dev string */
5434     field_types = se->field_types;
5435     dst_offsets = se->field_offsets[THUNK_HOST];
5436     src_offsets = se->field_offsets[THUNK_TARGET];
5437     for (i = 0; i < se->nb_fields; i++) {
5438         if (dst_offsets[i] == offsetof(struct rtentry, rt_dev)) {
5439             assert(*field_types == TYPE_PTRVOID);
5440             target_rt_dev_ptr = (abi_ulong *)(argptr + src_offsets[i]);
5441             host_rt_dev_ptr = (unsigned long *)(buf_temp + dst_offsets[i]);
5442             if (*target_rt_dev_ptr != 0) {
5443                 *host_rt_dev_ptr = (unsigned long)lock_user_string(
5444                                                   tswapal(*target_rt_dev_ptr));
5445                 if (!*host_rt_dev_ptr) {
5446                     unlock_user(argptr, arg, 0);
5447                     return -TARGET_EFAULT;
5448                 }
5449             } else {
5450                 *host_rt_dev_ptr = 0;
5451             }
5452             field_types++;
5453             continue;
5454         }
5455         field_types = thunk_convert(buf_temp + dst_offsets[i],
5456                                     argptr + src_offsets[i],
5457                                     field_types, THUNK_HOST);
5458     }
5459     unlock_user(argptr, arg, 0);
5460 
5461     ret = get_errno(safe_ioctl(fd, ie->host_cmd, buf_temp));
5462 
5463     assert(host_rt_dev_ptr != NULL);
5464     assert(target_rt_dev_ptr != NULL);
5465     if (*host_rt_dev_ptr != 0) {
5466         unlock_user((void *)*host_rt_dev_ptr,
5467                     *target_rt_dev_ptr, 0);
5468     }
5469     return ret;
5470 }
5471 
5472 static abi_long do_ioctl_kdsigaccept(const IOCTLEntry *ie, uint8_t *buf_temp,
5473                                      int fd, int cmd, abi_long arg)
5474 {
5475     int sig = target_to_host_signal(arg);
5476     return get_errno(safe_ioctl(fd, ie->host_cmd, sig));
5477 }
5478 
5479 static abi_long do_ioctl_SIOCGSTAMP(const IOCTLEntry *ie, uint8_t *buf_temp,
5480                                     int fd, int cmd, abi_long arg)
5481 {
5482     struct timeval tv;
5483     abi_long ret;
5484 
5485     ret = get_errno(safe_ioctl(fd, SIOCGSTAMP, &tv));
5486     if (is_error(ret)) {
5487         return ret;
5488     }
5489 
5490     if (cmd == (int)TARGET_SIOCGSTAMP_OLD) {
5491         if (copy_to_user_timeval(arg, &tv)) {
5492             return -TARGET_EFAULT;
5493         }
5494     } else {
5495         if (copy_to_user_timeval64(arg, &tv)) {
5496             return -TARGET_EFAULT;
5497         }
5498     }
5499 
5500     return ret;
5501 }
5502 
5503 static abi_long do_ioctl_SIOCGSTAMPNS(const IOCTLEntry *ie, uint8_t *buf_temp,
5504                                       int fd, int cmd, abi_long arg)
5505 {
5506     struct timespec ts;
5507     abi_long ret;
5508 
5509     ret = get_errno(safe_ioctl(fd, SIOCGSTAMPNS, &ts));
5510     if (is_error(ret)) {
5511         return ret;
5512     }
5513 
5514     if (cmd == (int)TARGET_SIOCGSTAMPNS_OLD) {
5515         if (host_to_target_timespec(arg, &ts)) {
5516             return -TARGET_EFAULT;
5517         }
5518     } else{
5519         if (host_to_target_timespec64(arg, &ts)) {
5520             return -TARGET_EFAULT;
5521         }
5522     }
5523 
5524     return ret;
5525 }
5526 
5527 #ifdef TIOCGPTPEER
5528 static abi_long do_ioctl_tiocgptpeer(const IOCTLEntry *ie, uint8_t *buf_temp,
5529                                      int fd, int cmd, abi_long arg)
5530 {
5531     int flags = target_to_host_bitmask(arg, fcntl_flags_tbl);
5532     return get_errno(safe_ioctl(fd, ie->host_cmd, flags));
5533 }
5534 #endif
5535 
5536 #ifdef HAVE_DRM_H
5537 
5538 static void unlock_drm_version(struct drm_version *host_ver,
5539                                struct target_drm_version *target_ver,
5540                                bool copy)
5541 {
5542     unlock_user(host_ver->name, target_ver->name,
5543                                 copy ? host_ver->name_len : 0);
5544     unlock_user(host_ver->date, target_ver->date,
5545                                 copy ? host_ver->date_len : 0);
5546     unlock_user(host_ver->desc, target_ver->desc,
5547                                 copy ? host_ver->desc_len : 0);
5548 }
5549 
5550 static inline abi_long target_to_host_drmversion(struct drm_version *host_ver,
5551                                           struct target_drm_version *target_ver)
5552 {
5553     memset(host_ver, 0, sizeof(*host_ver));
5554 
5555     __get_user(host_ver->name_len, &target_ver->name_len);
5556     if (host_ver->name_len) {
5557         host_ver->name = lock_user(VERIFY_WRITE, target_ver->name,
5558                                    target_ver->name_len, 0);
5559         if (!host_ver->name) {
5560             return -EFAULT;
5561         }
5562     }
5563 
5564     __get_user(host_ver->date_len, &target_ver->date_len);
5565     if (host_ver->date_len) {
5566         host_ver->date = lock_user(VERIFY_WRITE, target_ver->date,
5567                                    target_ver->date_len, 0);
5568         if (!host_ver->date) {
5569             goto err;
5570         }
5571     }
5572 
5573     __get_user(host_ver->desc_len, &target_ver->desc_len);
5574     if (host_ver->desc_len) {
5575         host_ver->desc = lock_user(VERIFY_WRITE, target_ver->desc,
5576                                    target_ver->desc_len, 0);
5577         if (!host_ver->desc) {
5578             goto err;
5579         }
5580     }
5581 
5582     return 0;
5583 err:
5584     unlock_drm_version(host_ver, target_ver, false);
5585     return -EFAULT;
5586 }
5587 
5588 static inline void host_to_target_drmversion(
5589                                           struct target_drm_version *target_ver,
5590                                           struct drm_version *host_ver)
5591 {
5592     __put_user(host_ver->version_major, &target_ver->version_major);
5593     __put_user(host_ver->version_minor, &target_ver->version_minor);
5594     __put_user(host_ver->version_patchlevel, &target_ver->version_patchlevel);
5595     __put_user(host_ver->name_len, &target_ver->name_len);
5596     __put_user(host_ver->date_len, &target_ver->date_len);
5597     __put_user(host_ver->desc_len, &target_ver->desc_len);
5598     unlock_drm_version(host_ver, target_ver, true);
5599 }
5600 
5601 static abi_long do_ioctl_drm(const IOCTLEntry *ie, uint8_t *buf_temp,
5602                              int fd, int cmd, abi_long arg)
5603 {
5604     struct drm_version *ver;
5605     struct target_drm_version *target_ver;
5606     abi_long ret;
5607 
5608     switch (ie->host_cmd) {
5609     case DRM_IOCTL_VERSION:
5610         if (!lock_user_struct(VERIFY_WRITE, target_ver, arg, 0)) {
5611             return -TARGET_EFAULT;
5612         }
5613         ver = (struct drm_version *)buf_temp;
5614         ret = target_to_host_drmversion(ver, target_ver);
5615         if (!is_error(ret)) {
5616             ret = get_errno(safe_ioctl(fd, ie->host_cmd, ver));
5617             if (is_error(ret)) {
5618                 unlock_drm_version(ver, target_ver, false);
5619             } else {
5620                 host_to_target_drmversion(target_ver, ver);
5621             }
5622         }
5623         unlock_user_struct(target_ver, arg, 0);
5624         return ret;
5625     }
5626     return -TARGET_ENOSYS;
5627 }
5628 
5629 static abi_long do_ioctl_drm_i915_getparam(const IOCTLEntry *ie,
5630                                            struct drm_i915_getparam *gparam,
5631                                            int fd, abi_long arg)
5632 {
5633     abi_long ret;
5634     int value;
5635     struct target_drm_i915_getparam *target_gparam;
5636 
5637     if (!lock_user_struct(VERIFY_READ, target_gparam, arg, 0)) {
5638         return -TARGET_EFAULT;
5639     }
5640 
5641     __get_user(gparam->param, &target_gparam->param);
5642     gparam->value = &value;
5643     ret = get_errno(safe_ioctl(fd, ie->host_cmd, gparam));
5644     put_user_s32(value, target_gparam->value);
5645 
5646     unlock_user_struct(target_gparam, arg, 0);
5647     return ret;
5648 }
5649 
5650 static abi_long do_ioctl_drm_i915(const IOCTLEntry *ie, uint8_t *buf_temp,
5651                                   int fd, int cmd, abi_long arg)
5652 {
5653     switch (ie->host_cmd) {
5654     case DRM_IOCTL_I915_GETPARAM:
5655         return do_ioctl_drm_i915_getparam(ie,
5656                                           (struct drm_i915_getparam *)buf_temp,
5657                                           fd, arg);
5658     default:
5659         return -TARGET_ENOSYS;
5660     }
5661 }
5662 
5663 #endif
5664 
5665 static abi_long do_ioctl_TUNSETTXFILTER(const IOCTLEntry *ie, uint8_t *buf_temp,
5666                                         int fd, int cmd, abi_long arg)
5667 {
5668     struct tun_filter *filter = (struct tun_filter *)buf_temp;
5669     struct tun_filter *target_filter;
5670     char *target_addr;
5671 
5672     assert(ie->access == IOC_W);
5673 
5674     target_filter = lock_user(VERIFY_READ, arg, sizeof(*target_filter), 1);
5675     if (!target_filter) {
5676         return -TARGET_EFAULT;
5677     }
5678     filter->flags = tswap16(target_filter->flags);
5679     filter->count = tswap16(target_filter->count);
5680     unlock_user(target_filter, arg, 0);
5681 
5682     if (filter->count) {
5683         if (offsetof(struct tun_filter, addr) + filter->count * ETH_ALEN >
5684             MAX_STRUCT_SIZE) {
5685             return -TARGET_EFAULT;
5686         }
5687 
5688         target_addr = lock_user(VERIFY_READ,
5689                                 arg + offsetof(struct tun_filter, addr),
5690                                 filter->count * ETH_ALEN, 1);
5691         if (!target_addr) {
5692             return -TARGET_EFAULT;
5693         }
5694         memcpy(filter->addr, target_addr, filter->count * ETH_ALEN);
5695         unlock_user(target_addr, arg + offsetof(struct tun_filter, addr), 0);
5696     }
5697 
5698     return get_errno(safe_ioctl(fd, ie->host_cmd, filter));
5699 }
5700 
5701 IOCTLEntry ioctl_entries[] = {
5702 #define IOCTL(cmd, access, ...) \
5703     { TARGET_ ## cmd, cmd, #cmd, access, 0, {  __VA_ARGS__ } },
5704 #define IOCTL_SPECIAL(cmd, access, dofn, ...)                      \
5705     { TARGET_ ## cmd, cmd, #cmd, access, dofn, {  __VA_ARGS__ } },
5706 #define IOCTL_IGNORE(cmd) \
5707     { TARGET_ ## cmd, 0, #cmd },
5708 #include "ioctls.h"
5709     { 0, 0, },
5710 };
5711 
5712 /* ??? Implement proper locking for ioctls.  */
5713 /* do_ioctl() Must return target values and target errnos. */
5714 static abi_long do_ioctl(int fd, int cmd, abi_long arg)
5715 {
5716     const IOCTLEntry *ie;
5717     const argtype *arg_type;
5718     abi_long ret;
5719     uint8_t buf_temp[MAX_STRUCT_SIZE];
5720     int target_size;
5721     void *argptr;
5722 
5723     ie = ioctl_entries;
5724     for(;;) {
5725         if (ie->target_cmd == 0) {
5726             qemu_log_mask(
5727                 LOG_UNIMP, "Unsupported ioctl: cmd=0x%04lx\n", (long)cmd);
5728             return -TARGET_ENOSYS;
5729         }
5730         if (ie->target_cmd == cmd)
5731             break;
5732         ie++;
5733     }
5734     arg_type = ie->arg_type;
5735     if (ie->do_ioctl) {
5736         return ie->do_ioctl(ie, buf_temp, fd, cmd, arg);
5737     } else if (!ie->host_cmd) {
5738         /* Some architectures define BSD ioctls in their headers
5739            that are not implemented in Linux.  */
5740         return -TARGET_ENOSYS;
5741     }
5742 
5743     switch(arg_type[0]) {
5744     case TYPE_NULL:
5745         /* no argument */
5746         ret = get_errno(safe_ioctl(fd, ie->host_cmd));
5747         break;
5748     case TYPE_PTRVOID:
5749     case TYPE_INT:
5750     case TYPE_LONG:
5751     case TYPE_ULONG:
5752         ret = get_errno(safe_ioctl(fd, ie->host_cmd, arg));
5753         break;
5754     case TYPE_PTR:
5755         arg_type++;
5756         target_size = thunk_type_size(arg_type, 0);
5757         switch(ie->access) {
5758         case IOC_R:
5759             ret = get_errno(safe_ioctl(fd, ie->host_cmd, buf_temp));
5760             if (!is_error(ret)) {
5761                 argptr = lock_user(VERIFY_WRITE, arg, target_size, 0);
5762                 if (!argptr)
5763                     return -TARGET_EFAULT;
5764                 thunk_convert(argptr, buf_temp, arg_type, THUNK_TARGET);
5765                 unlock_user(argptr, arg, target_size);
5766             }
5767             break;
5768         case IOC_W:
5769             argptr = lock_user(VERIFY_READ, arg, target_size, 1);
5770             if (!argptr)
5771                 return -TARGET_EFAULT;
5772             thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
5773             unlock_user(argptr, arg, 0);
5774             ret = get_errno(safe_ioctl(fd, ie->host_cmd, buf_temp));
5775             break;
5776         default:
5777         case IOC_RW:
5778             argptr = lock_user(VERIFY_READ, arg, target_size, 1);
5779             if (!argptr)
5780                 return -TARGET_EFAULT;
5781             thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
5782             unlock_user(argptr, arg, 0);
5783             ret = get_errno(safe_ioctl(fd, ie->host_cmd, buf_temp));
5784             if (!is_error(ret)) {
5785                 argptr = lock_user(VERIFY_WRITE, arg, target_size, 0);
5786                 if (!argptr)
5787                     return -TARGET_EFAULT;
5788                 thunk_convert(argptr, buf_temp, arg_type, THUNK_TARGET);
5789                 unlock_user(argptr, arg, target_size);
5790             }
5791             break;
5792         }
5793         break;
5794     default:
5795         qemu_log_mask(LOG_UNIMP,
5796                       "Unsupported ioctl type: cmd=0x%04lx type=%d\n",
5797                       (long)cmd, arg_type[0]);
5798         ret = -TARGET_ENOSYS;
5799         break;
5800     }
5801     return ret;
5802 }
5803 
5804 static const bitmask_transtbl iflag_tbl[] = {
5805         { TARGET_IGNBRK, TARGET_IGNBRK, IGNBRK, IGNBRK },
5806         { TARGET_BRKINT, TARGET_BRKINT, BRKINT, BRKINT },
5807         { TARGET_IGNPAR, TARGET_IGNPAR, IGNPAR, IGNPAR },
5808         { TARGET_PARMRK, TARGET_PARMRK, PARMRK, PARMRK },
5809         { TARGET_INPCK, TARGET_INPCK, INPCK, INPCK },
5810         { TARGET_ISTRIP, TARGET_ISTRIP, ISTRIP, ISTRIP },
5811         { TARGET_INLCR, TARGET_INLCR, INLCR, INLCR },
5812         { TARGET_IGNCR, TARGET_IGNCR, IGNCR, IGNCR },
5813         { TARGET_ICRNL, TARGET_ICRNL, ICRNL, ICRNL },
5814         { TARGET_IUCLC, TARGET_IUCLC, IUCLC, IUCLC },
5815         { TARGET_IXON, TARGET_IXON, IXON, IXON },
5816         { TARGET_IXANY, TARGET_IXANY, IXANY, IXANY },
5817         { TARGET_IXOFF, TARGET_IXOFF, IXOFF, IXOFF },
5818         { TARGET_IMAXBEL, TARGET_IMAXBEL, IMAXBEL, IMAXBEL },
5819         { TARGET_IUTF8, TARGET_IUTF8, IUTF8, IUTF8},
5820         { 0, 0, 0, 0 }
5821 };
5822 
5823 static const bitmask_transtbl oflag_tbl[] = {
5824 	{ TARGET_OPOST, TARGET_OPOST, OPOST, OPOST },
5825 	{ TARGET_OLCUC, TARGET_OLCUC, OLCUC, OLCUC },
5826 	{ TARGET_ONLCR, TARGET_ONLCR, ONLCR, ONLCR },
5827 	{ TARGET_OCRNL, TARGET_OCRNL, OCRNL, OCRNL },
5828 	{ TARGET_ONOCR, TARGET_ONOCR, ONOCR, ONOCR },
5829 	{ TARGET_ONLRET, TARGET_ONLRET, ONLRET, ONLRET },
5830 	{ TARGET_OFILL, TARGET_OFILL, OFILL, OFILL },
5831 	{ TARGET_OFDEL, TARGET_OFDEL, OFDEL, OFDEL },
5832 	{ TARGET_NLDLY, TARGET_NL0, NLDLY, NL0 },
5833 	{ TARGET_NLDLY, TARGET_NL1, NLDLY, NL1 },
5834 	{ TARGET_CRDLY, TARGET_CR0, CRDLY, CR0 },
5835 	{ TARGET_CRDLY, TARGET_CR1, CRDLY, CR1 },
5836 	{ TARGET_CRDLY, TARGET_CR2, CRDLY, CR2 },
5837 	{ TARGET_CRDLY, TARGET_CR3, CRDLY, CR3 },
5838 	{ TARGET_TABDLY, TARGET_TAB0, TABDLY, TAB0 },
5839 	{ TARGET_TABDLY, TARGET_TAB1, TABDLY, TAB1 },
5840 	{ TARGET_TABDLY, TARGET_TAB2, TABDLY, TAB2 },
5841 	{ TARGET_TABDLY, TARGET_TAB3, TABDLY, TAB3 },
5842 	{ TARGET_BSDLY, TARGET_BS0, BSDLY, BS0 },
5843 	{ TARGET_BSDLY, TARGET_BS1, BSDLY, BS1 },
5844 	{ TARGET_VTDLY, TARGET_VT0, VTDLY, VT0 },
5845 	{ TARGET_VTDLY, TARGET_VT1, VTDLY, VT1 },
5846 	{ TARGET_FFDLY, TARGET_FF0, FFDLY, FF0 },
5847 	{ TARGET_FFDLY, TARGET_FF1, FFDLY, FF1 },
5848 	{ 0, 0, 0, 0 }
5849 };
5850 
5851 static const bitmask_transtbl cflag_tbl[] = {
5852 	{ TARGET_CBAUD, TARGET_B0, CBAUD, B0 },
5853 	{ TARGET_CBAUD, TARGET_B50, CBAUD, B50 },
5854 	{ TARGET_CBAUD, TARGET_B75, CBAUD, B75 },
5855 	{ TARGET_CBAUD, TARGET_B110, CBAUD, B110 },
5856 	{ TARGET_CBAUD, TARGET_B134, CBAUD, B134 },
5857 	{ TARGET_CBAUD, TARGET_B150, CBAUD, B150 },
5858 	{ TARGET_CBAUD, TARGET_B200, CBAUD, B200 },
5859 	{ TARGET_CBAUD, TARGET_B300, CBAUD, B300 },
5860 	{ TARGET_CBAUD, TARGET_B600, CBAUD, B600 },
5861 	{ TARGET_CBAUD, TARGET_B1200, CBAUD, B1200 },
5862 	{ TARGET_CBAUD, TARGET_B1800, CBAUD, B1800 },
5863 	{ TARGET_CBAUD, TARGET_B2400, CBAUD, B2400 },
5864 	{ TARGET_CBAUD, TARGET_B4800, CBAUD, B4800 },
5865 	{ TARGET_CBAUD, TARGET_B9600, CBAUD, B9600 },
5866 	{ TARGET_CBAUD, TARGET_B19200, CBAUD, B19200 },
5867 	{ TARGET_CBAUD, TARGET_B38400, CBAUD, B38400 },
5868 	{ TARGET_CBAUD, TARGET_B57600, CBAUD, B57600 },
5869 	{ TARGET_CBAUD, TARGET_B115200, CBAUD, B115200 },
5870 	{ TARGET_CBAUD, TARGET_B230400, CBAUD, B230400 },
5871 	{ TARGET_CBAUD, TARGET_B460800, CBAUD, B460800 },
5872 	{ TARGET_CSIZE, TARGET_CS5, CSIZE, CS5 },
5873 	{ TARGET_CSIZE, TARGET_CS6, CSIZE, CS6 },
5874 	{ TARGET_CSIZE, TARGET_CS7, CSIZE, CS7 },
5875 	{ TARGET_CSIZE, TARGET_CS8, CSIZE, CS8 },
5876 	{ TARGET_CSTOPB, TARGET_CSTOPB, CSTOPB, CSTOPB },
5877 	{ TARGET_CREAD, TARGET_CREAD, CREAD, CREAD },
5878 	{ TARGET_PARENB, TARGET_PARENB, PARENB, PARENB },
5879 	{ TARGET_PARODD, TARGET_PARODD, PARODD, PARODD },
5880 	{ TARGET_HUPCL, TARGET_HUPCL, HUPCL, HUPCL },
5881 	{ TARGET_CLOCAL, TARGET_CLOCAL, CLOCAL, CLOCAL },
5882 	{ TARGET_CRTSCTS, TARGET_CRTSCTS, CRTSCTS, CRTSCTS },
5883 	{ 0, 0, 0, 0 }
5884 };
5885 
5886 static const bitmask_transtbl lflag_tbl[] = {
5887   { TARGET_ISIG, TARGET_ISIG, ISIG, ISIG },
5888   { TARGET_ICANON, TARGET_ICANON, ICANON, ICANON },
5889   { TARGET_XCASE, TARGET_XCASE, XCASE, XCASE },
5890   { TARGET_ECHO, TARGET_ECHO, ECHO, ECHO },
5891   { TARGET_ECHOE, TARGET_ECHOE, ECHOE, ECHOE },
5892   { TARGET_ECHOK, TARGET_ECHOK, ECHOK, ECHOK },
5893   { TARGET_ECHONL, TARGET_ECHONL, ECHONL, ECHONL },
5894   { TARGET_NOFLSH, TARGET_NOFLSH, NOFLSH, NOFLSH },
5895   { TARGET_TOSTOP, TARGET_TOSTOP, TOSTOP, TOSTOP },
5896   { TARGET_ECHOCTL, TARGET_ECHOCTL, ECHOCTL, ECHOCTL },
5897   { TARGET_ECHOPRT, TARGET_ECHOPRT, ECHOPRT, ECHOPRT },
5898   { TARGET_ECHOKE, TARGET_ECHOKE, ECHOKE, ECHOKE },
5899   { TARGET_FLUSHO, TARGET_FLUSHO, FLUSHO, FLUSHO },
5900   { TARGET_PENDIN, TARGET_PENDIN, PENDIN, PENDIN },
5901   { TARGET_IEXTEN, TARGET_IEXTEN, IEXTEN, IEXTEN },
5902   { TARGET_EXTPROC, TARGET_EXTPROC, EXTPROC, EXTPROC},
5903   { 0, 0, 0, 0 }
5904 };
5905 
5906 static void target_to_host_termios (void *dst, const void *src)
5907 {
5908     struct host_termios *host = dst;
5909     const struct target_termios *target = src;
5910 
5911     host->c_iflag =
5912         target_to_host_bitmask(tswap32(target->c_iflag), iflag_tbl);
5913     host->c_oflag =
5914         target_to_host_bitmask(tswap32(target->c_oflag), oflag_tbl);
5915     host->c_cflag =
5916         target_to_host_bitmask(tswap32(target->c_cflag), cflag_tbl);
5917     host->c_lflag =
5918         target_to_host_bitmask(tswap32(target->c_lflag), lflag_tbl);
5919     host->c_line = target->c_line;
5920 
5921     memset(host->c_cc, 0, sizeof(host->c_cc));
5922     host->c_cc[VINTR] = target->c_cc[TARGET_VINTR];
5923     host->c_cc[VQUIT] = target->c_cc[TARGET_VQUIT];
5924     host->c_cc[VERASE] = target->c_cc[TARGET_VERASE];
5925     host->c_cc[VKILL] = target->c_cc[TARGET_VKILL];
5926     host->c_cc[VEOF] = target->c_cc[TARGET_VEOF];
5927     host->c_cc[VTIME] = target->c_cc[TARGET_VTIME];
5928     host->c_cc[VMIN] = target->c_cc[TARGET_VMIN];
5929     host->c_cc[VSWTC] = target->c_cc[TARGET_VSWTC];
5930     host->c_cc[VSTART] = target->c_cc[TARGET_VSTART];
5931     host->c_cc[VSTOP] = target->c_cc[TARGET_VSTOP];
5932     host->c_cc[VSUSP] = target->c_cc[TARGET_VSUSP];
5933     host->c_cc[VEOL] = target->c_cc[TARGET_VEOL];
5934     host->c_cc[VREPRINT] = target->c_cc[TARGET_VREPRINT];
5935     host->c_cc[VDISCARD] = target->c_cc[TARGET_VDISCARD];
5936     host->c_cc[VWERASE] = target->c_cc[TARGET_VWERASE];
5937     host->c_cc[VLNEXT] = target->c_cc[TARGET_VLNEXT];
5938     host->c_cc[VEOL2] = target->c_cc[TARGET_VEOL2];
5939 }
5940 
5941 static void host_to_target_termios (void *dst, const void *src)
5942 {
5943     struct target_termios *target = dst;
5944     const struct host_termios *host = src;
5945 
5946     target->c_iflag =
5947         tswap32(host_to_target_bitmask(host->c_iflag, iflag_tbl));
5948     target->c_oflag =
5949         tswap32(host_to_target_bitmask(host->c_oflag, oflag_tbl));
5950     target->c_cflag =
5951         tswap32(host_to_target_bitmask(host->c_cflag, cflag_tbl));
5952     target->c_lflag =
5953         tswap32(host_to_target_bitmask(host->c_lflag, lflag_tbl));
5954     target->c_line = host->c_line;
5955 
5956     memset(target->c_cc, 0, sizeof(target->c_cc));
5957     target->c_cc[TARGET_VINTR] = host->c_cc[VINTR];
5958     target->c_cc[TARGET_VQUIT] = host->c_cc[VQUIT];
5959     target->c_cc[TARGET_VERASE] = host->c_cc[VERASE];
5960     target->c_cc[TARGET_VKILL] = host->c_cc[VKILL];
5961     target->c_cc[TARGET_VEOF] = host->c_cc[VEOF];
5962     target->c_cc[TARGET_VTIME] = host->c_cc[VTIME];
5963     target->c_cc[TARGET_VMIN] = host->c_cc[VMIN];
5964     target->c_cc[TARGET_VSWTC] = host->c_cc[VSWTC];
5965     target->c_cc[TARGET_VSTART] = host->c_cc[VSTART];
5966     target->c_cc[TARGET_VSTOP] = host->c_cc[VSTOP];
5967     target->c_cc[TARGET_VSUSP] = host->c_cc[VSUSP];
5968     target->c_cc[TARGET_VEOL] = host->c_cc[VEOL];
5969     target->c_cc[TARGET_VREPRINT] = host->c_cc[VREPRINT];
5970     target->c_cc[TARGET_VDISCARD] = host->c_cc[VDISCARD];
5971     target->c_cc[TARGET_VWERASE] = host->c_cc[VWERASE];
5972     target->c_cc[TARGET_VLNEXT] = host->c_cc[VLNEXT];
5973     target->c_cc[TARGET_VEOL2] = host->c_cc[VEOL2];
5974 }
5975 
5976 static const StructEntry struct_termios_def = {
5977     .convert = { host_to_target_termios, target_to_host_termios },
5978     .size = { sizeof(struct target_termios), sizeof(struct host_termios) },
5979     .align = { __alignof__(struct target_termios), __alignof__(struct host_termios) },
5980     .print = print_termios,
5981 };
5982 
5983 static const bitmask_transtbl mmap_flags_tbl[] = {
5984     { TARGET_MAP_SHARED, TARGET_MAP_SHARED, MAP_SHARED, MAP_SHARED },
5985     { TARGET_MAP_PRIVATE, TARGET_MAP_PRIVATE, MAP_PRIVATE, MAP_PRIVATE },
5986     { TARGET_MAP_FIXED, TARGET_MAP_FIXED, MAP_FIXED, MAP_FIXED },
5987     { TARGET_MAP_ANONYMOUS, TARGET_MAP_ANONYMOUS,
5988       MAP_ANONYMOUS, MAP_ANONYMOUS },
5989     { TARGET_MAP_GROWSDOWN, TARGET_MAP_GROWSDOWN,
5990       MAP_GROWSDOWN, MAP_GROWSDOWN },
5991     { TARGET_MAP_DENYWRITE, TARGET_MAP_DENYWRITE,
5992       MAP_DENYWRITE, MAP_DENYWRITE },
5993     { TARGET_MAP_EXECUTABLE, TARGET_MAP_EXECUTABLE,
5994       MAP_EXECUTABLE, MAP_EXECUTABLE },
5995     { TARGET_MAP_LOCKED, TARGET_MAP_LOCKED, MAP_LOCKED, MAP_LOCKED },
5996     { TARGET_MAP_NORESERVE, TARGET_MAP_NORESERVE,
5997       MAP_NORESERVE, MAP_NORESERVE },
5998     { TARGET_MAP_HUGETLB, TARGET_MAP_HUGETLB, MAP_HUGETLB, MAP_HUGETLB },
5999     /* MAP_STACK had been ignored by the kernel for quite some time.
6000        Recognize it for the target insofar as we do not want to pass
6001        it through to the host.  */
6002     { TARGET_MAP_STACK, TARGET_MAP_STACK, 0, 0 },
6003     { 0, 0, 0, 0 }
6004 };
6005 
6006 /*
6007  * NOTE: TARGET_ABI32 is defined for TARGET_I386 (but not for TARGET_X86_64)
6008  *       TARGET_I386 is defined if TARGET_X86_64 is defined
6009  */
6010 #if defined(TARGET_I386)
6011 
6012 /* NOTE: there is really one LDT for all the threads */
6013 static uint8_t *ldt_table;
6014 
6015 static abi_long read_ldt(abi_ulong ptr, unsigned long bytecount)
6016 {
6017     int size;
6018     void *p;
6019 
6020     if (!ldt_table)
6021         return 0;
6022     size = TARGET_LDT_ENTRIES * TARGET_LDT_ENTRY_SIZE;
6023     if (size > bytecount)
6024         size = bytecount;
6025     p = lock_user(VERIFY_WRITE, ptr, size, 0);
6026     if (!p)
6027         return -TARGET_EFAULT;
6028     /* ??? Should this by byteswapped?  */
6029     memcpy(p, ldt_table, size);
6030     unlock_user(p, ptr, size);
6031     return size;
6032 }
6033 
6034 /* XXX: add locking support */
6035 static abi_long write_ldt(CPUX86State *env,
6036                           abi_ulong ptr, unsigned long bytecount, int oldmode)
6037 {
6038     struct target_modify_ldt_ldt_s ldt_info;
6039     struct target_modify_ldt_ldt_s *target_ldt_info;
6040     int seg_32bit, contents, read_exec_only, limit_in_pages;
6041     int seg_not_present, useable, lm;
6042     uint32_t *lp, entry_1, entry_2;
6043 
6044     if (bytecount != sizeof(ldt_info))
6045         return -TARGET_EINVAL;
6046     if (!lock_user_struct(VERIFY_READ, target_ldt_info, ptr, 1))
6047         return -TARGET_EFAULT;
6048     ldt_info.entry_number = tswap32(target_ldt_info->entry_number);
6049     ldt_info.base_addr = tswapal(target_ldt_info->base_addr);
6050     ldt_info.limit = tswap32(target_ldt_info->limit);
6051     ldt_info.flags = tswap32(target_ldt_info->flags);
6052     unlock_user_struct(target_ldt_info, ptr, 0);
6053 
6054     if (ldt_info.entry_number >= TARGET_LDT_ENTRIES)
6055         return -TARGET_EINVAL;
6056     seg_32bit = ldt_info.flags & 1;
6057     contents = (ldt_info.flags >> 1) & 3;
6058     read_exec_only = (ldt_info.flags >> 3) & 1;
6059     limit_in_pages = (ldt_info.flags >> 4) & 1;
6060     seg_not_present = (ldt_info.flags >> 5) & 1;
6061     useable = (ldt_info.flags >> 6) & 1;
6062 #ifdef TARGET_ABI32
6063     lm = 0;
6064 #else
6065     lm = (ldt_info.flags >> 7) & 1;
6066 #endif
6067     if (contents == 3) {
6068         if (oldmode)
6069             return -TARGET_EINVAL;
6070         if (seg_not_present == 0)
6071             return -TARGET_EINVAL;
6072     }
6073     /* allocate the LDT */
6074     if (!ldt_table) {
6075         env->ldt.base = target_mmap(0,
6076                                     TARGET_LDT_ENTRIES * TARGET_LDT_ENTRY_SIZE,
6077                                     PROT_READ|PROT_WRITE,
6078                                     MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);
6079         if (env->ldt.base == -1)
6080             return -TARGET_ENOMEM;
6081         memset(g2h_untagged(env->ldt.base), 0,
6082                TARGET_LDT_ENTRIES * TARGET_LDT_ENTRY_SIZE);
6083         env->ldt.limit = 0xffff;
6084         ldt_table = g2h_untagged(env->ldt.base);
6085     }
6086 
6087     /* NOTE: same code as Linux kernel */
6088     /* Allow LDTs to be cleared by the user. */
6089     if (ldt_info.base_addr == 0 && ldt_info.limit == 0) {
6090         if (oldmode ||
6091             (contents == 0		&&
6092              read_exec_only == 1	&&
6093              seg_32bit == 0		&&
6094              limit_in_pages == 0	&&
6095              seg_not_present == 1	&&
6096              useable == 0 )) {
6097             entry_1 = 0;
6098             entry_2 = 0;
6099             goto install;
6100         }
6101     }
6102 
6103     entry_1 = ((ldt_info.base_addr & 0x0000ffff) << 16) |
6104         (ldt_info.limit & 0x0ffff);
6105     entry_2 = (ldt_info.base_addr & 0xff000000) |
6106         ((ldt_info.base_addr & 0x00ff0000) >> 16) |
6107         (ldt_info.limit & 0xf0000) |
6108         ((read_exec_only ^ 1) << 9) |
6109         (contents << 10) |
6110         ((seg_not_present ^ 1) << 15) |
6111         (seg_32bit << 22) |
6112         (limit_in_pages << 23) |
6113         (lm << 21) |
6114         0x7000;
6115     if (!oldmode)
6116         entry_2 |= (useable << 20);
6117 
6118     /* Install the new entry ...  */
6119 install:
6120     lp = (uint32_t *)(ldt_table + (ldt_info.entry_number << 3));
6121     lp[0] = tswap32(entry_1);
6122     lp[1] = tswap32(entry_2);
6123     return 0;
6124 }
6125 
6126 /* specific and weird i386 syscalls */
6127 static abi_long do_modify_ldt(CPUX86State *env, int func, abi_ulong ptr,
6128                               unsigned long bytecount)
6129 {
6130     abi_long ret;
6131 
6132     switch (func) {
6133     case 0:
6134         ret = read_ldt(ptr, bytecount);
6135         break;
6136     case 1:
6137         ret = write_ldt(env, ptr, bytecount, 1);
6138         break;
6139     case 0x11:
6140         ret = write_ldt(env, ptr, bytecount, 0);
6141         break;
6142     default:
6143         ret = -TARGET_ENOSYS;
6144         break;
6145     }
6146     return ret;
6147 }
6148 
6149 #if defined(TARGET_ABI32)
6150 abi_long do_set_thread_area(CPUX86State *env, abi_ulong ptr)
6151 {
6152     uint64_t *gdt_table = g2h_untagged(env->gdt.base);
6153     struct target_modify_ldt_ldt_s ldt_info;
6154     struct target_modify_ldt_ldt_s *target_ldt_info;
6155     int seg_32bit, contents, read_exec_only, limit_in_pages;
6156     int seg_not_present, useable, lm;
6157     uint32_t *lp, entry_1, entry_2;
6158     int i;
6159 
6160     lock_user_struct(VERIFY_WRITE, target_ldt_info, ptr, 1);
6161     if (!target_ldt_info)
6162         return -TARGET_EFAULT;
6163     ldt_info.entry_number = tswap32(target_ldt_info->entry_number);
6164     ldt_info.base_addr = tswapal(target_ldt_info->base_addr);
6165     ldt_info.limit = tswap32(target_ldt_info->limit);
6166     ldt_info.flags = tswap32(target_ldt_info->flags);
6167     if (ldt_info.entry_number == -1) {
6168         for (i=TARGET_GDT_ENTRY_TLS_MIN; i<=TARGET_GDT_ENTRY_TLS_MAX; i++) {
6169             if (gdt_table[i] == 0) {
6170                 ldt_info.entry_number = i;
6171                 target_ldt_info->entry_number = tswap32(i);
6172                 break;
6173             }
6174         }
6175     }
6176     unlock_user_struct(target_ldt_info, ptr, 1);
6177 
6178     if (ldt_info.entry_number < TARGET_GDT_ENTRY_TLS_MIN ||
6179         ldt_info.entry_number > TARGET_GDT_ENTRY_TLS_MAX)
6180            return -TARGET_EINVAL;
6181     seg_32bit = ldt_info.flags & 1;
6182     contents = (ldt_info.flags >> 1) & 3;
6183     read_exec_only = (ldt_info.flags >> 3) & 1;
6184     limit_in_pages = (ldt_info.flags >> 4) & 1;
6185     seg_not_present = (ldt_info.flags >> 5) & 1;
6186     useable = (ldt_info.flags >> 6) & 1;
6187 #ifdef TARGET_ABI32
6188     lm = 0;
6189 #else
6190     lm = (ldt_info.flags >> 7) & 1;
6191 #endif
6192 
6193     if (contents == 3) {
6194         if (seg_not_present == 0)
6195             return -TARGET_EINVAL;
6196     }
6197 
6198     /* NOTE: same code as Linux kernel */
6199     /* Allow LDTs to be cleared by the user. */
6200     if (ldt_info.base_addr == 0 && ldt_info.limit == 0) {
6201         if ((contents == 0             &&
6202              read_exec_only == 1       &&
6203              seg_32bit == 0            &&
6204              limit_in_pages == 0       &&
6205              seg_not_present == 1      &&
6206              useable == 0 )) {
6207             entry_1 = 0;
6208             entry_2 = 0;
6209             goto install;
6210         }
6211     }
6212 
6213     entry_1 = ((ldt_info.base_addr & 0x0000ffff) << 16) |
6214         (ldt_info.limit & 0x0ffff);
6215     entry_2 = (ldt_info.base_addr & 0xff000000) |
6216         ((ldt_info.base_addr & 0x00ff0000) >> 16) |
6217         (ldt_info.limit & 0xf0000) |
6218         ((read_exec_only ^ 1) << 9) |
6219         (contents << 10) |
6220         ((seg_not_present ^ 1) << 15) |
6221         (seg_32bit << 22) |
6222         (limit_in_pages << 23) |
6223         (useable << 20) |
6224         (lm << 21) |
6225         0x7000;
6226 
6227     /* Install the new entry ...  */
6228 install:
6229     lp = (uint32_t *)(gdt_table + ldt_info.entry_number);
6230     lp[0] = tswap32(entry_1);
6231     lp[1] = tswap32(entry_2);
6232     return 0;
6233 }
6234 
6235 static abi_long do_get_thread_area(CPUX86State *env, abi_ulong ptr)
6236 {
6237     struct target_modify_ldt_ldt_s *target_ldt_info;
6238     uint64_t *gdt_table = g2h_untagged(env->gdt.base);
6239     uint32_t base_addr, limit, flags;
6240     int seg_32bit, contents, read_exec_only, limit_in_pages, idx;
6241     int seg_not_present, useable, lm;
6242     uint32_t *lp, entry_1, entry_2;
6243 
6244     lock_user_struct(VERIFY_WRITE, target_ldt_info, ptr, 1);
6245     if (!target_ldt_info)
6246         return -TARGET_EFAULT;
6247     idx = tswap32(target_ldt_info->entry_number);
6248     if (idx < TARGET_GDT_ENTRY_TLS_MIN ||
6249         idx > TARGET_GDT_ENTRY_TLS_MAX) {
6250         unlock_user_struct(target_ldt_info, ptr, 1);
6251         return -TARGET_EINVAL;
6252     }
6253     lp = (uint32_t *)(gdt_table + idx);
6254     entry_1 = tswap32(lp[0]);
6255     entry_2 = tswap32(lp[1]);
6256 
6257     read_exec_only = ((entry_2 >> 9) & 1) ^ 1;
6258     contents = (entry_2 >> 10) & 3;
6259     seg_not_present = ((entry_2 >> 15) & 1) ^ 1;
6260     seg_32bit = (entry_2 >> 22) & 1;
6261     limit_in_pages = (entry_2 >> 23) & 1;
6262     useable = (entry_2 >> 20) & 1;
6263 #ifdef TARGET_ABI32
6264     lm = 0;
6265 #else
6266     lm = (entry_2 >> 21) & 1;
6267 #endif
6268     flags = (seg_32bit << 0) | (contents << 1) |
6269         (read_exec_only << 3) | (limit_in_pages << 4) |
6270         (seg_not_present << 5) | (useable << 6) | (lm << 7);
6271     limit = (entry_1 & 0xffff) | (entry_2  & 0xf0000);
6272     base_addr = (entry_1 >> 16) |
6273         (entry_2 & 0xff000000) |
6274         ((entry_2 & 0xff) << 16);
6275     target_ldt_info->base_addr = tswapal(base_addr);
6276     target_ldt_info->limit = tswap32(limit);
6277     target_ldt_info->flags = tswap32(flags);
6278     unlock_user_struct(target_ldt_info, ptr, 1);
6279     return 0;
6280 }
6281 
6282 abi_long do_arch_prctl(CPUX86State *env, int code, abi_ulong addr)
6283 {
6284     return -TARGET_ENOSYS;
6285 }
6286 #else
6287 abi_long do_arch_prctl(CPUX86State *env, int code, abi_ulong addr)
6288 {
6289     abi_long ret = 0;
6290     abi_ulong val;
6291     int idx;
6292 
6293     switch(code) {
6294     case TARGET_ARCH_SET_GS:
6295     case TARGET_ARCH_SET_FS:
6296         if (code == TARGET_ARCH_SET_GS)
6297             idx = R_GS;
6298         else
6299             idx = R_FS;
6300         cpu_x86_load_seg(env, idx, 0);
6301         env->segs[idx].base = addr;
6302         break;
6303     case TARGET_ARCH_GET_GS:
6304     case TARGET_ARCH_GET_FS:
6305         if (code == TARGET_ARCH_GET_GS)
6306             idx = R_GS;
6307         else
6308             idx = R_FS;
6309         val = env->segs[idx].base;
6310         if (put_user(val, addr, abi_ulong))
6311             ret = -TARGET_EFAULT;
6312         break;
6313     default:
6314         ret = -TARGET_EINVAL;
6315         break;
6316     }
6317     return ret;
6318 }
6319 #endif /* defined(TARGET_ABI32 */
6320 #endif /* defined(TARGET_I386) */
6321 
6322 /*
6323  * These constants are generic.  Supply any that are missing from the host.
6324  */
6325 #ifndef PR_SET_NAME
6326 # define PR_SET_NAME    15
6327 # define PR_GET_NAME    16
6328 #endif
6329 #ifndef PR_SET_FP_MODE
6330 # define PR_SET_FP_MODE 45
6331 # define PR_GET_FP_MODE 46
6332 # define PR_FP_MODE_FR   (1 << 0)
6333 # define PR_FP_MODE_FRE  (1 << 1)
6334 #endif
6335 #ifndef PR_SVE_SET_VL
6336 # define PR_SVE_SET_VL  50
6337 # define PR_SVE_GET_VL  51
6338 # define PR_SVE_VL_LEN_MASK  0xffff
6339 # define PR_SVE_VL_INHERIT   (1 << 17)
6340 #endif
6341 #ifndef PR_PAC_RESET_KEYS
6342 # define PR_PAC_RESET_KEYS  54
6343 # define PR_PAC_APIAKEY   (1 << 0)
6344 # define PR_PAC_APIBKEY   (1 << 1)
6345 # define PR_PAC_APDAKEY   (1 << 2)
6346 # define PR_PAC_APDBKEY   (1 << 3)
6347 # define PR_PAC_APGAKEY   (1 << 4)
6348 #endif
6349 #ifndef PR_SET_TAGGED_ADDR_CTRL
6350 # define PR_SET_TAGGED_ADDR_CTRL 55
6351 # define PR_GET_TAGGED_ADDR_CTRL 56
6352 # define PR_TAGGED_ADDR_ENABLE  (1UL << 0)
6353 #endif
6354 #ifndef PR_MTE_TCF_SHIFT
6355 # define PR_MTE_TCF_SHIFT       1
6356 # define PR_MTE_TCF_NONE        (0UL << PR_MTE_TCF_SHIFT)
6357 # define PR_MTE_TCF_SYNC        (1UL << PR_MTE_TCF_SHIFT)
6358 # define PR_MTE_TCF_ASYNC       (2UL << PR_MTE_TCF_SHIFT)
6359 # define PR_MTE_TCF_MASK        (3UL << PR_MTE_TCF_SHIFT)
6360 # define PR_MTE_TAG_SHIFT       3
6361 # define PR_MTE_TAG_MASK        (0xffffUL << PR_MTE_TAG_SHIFT)
6362 #endif
6363 #ifndef PR_SET_IO_FLUSHER
6364 # define PR_SET_IO_FLUSHER 57
6365 # define PR_GET_IO_FLUSHER 58
6366 #endif
6367 #ifndef PR_SET_SYSCALL_USER_DISPATCH
6368 # define PR_SET_SYSCALL_USER_DISPATCH 59
6369 #endif
6370 #ifndef PR_SME_SET_VL
6371 # define PR_SME_SET_VL  63
6372 # define PR_SME_GET_VL  64
6373 # define PR_SME_VL_LEN_MASK  0xffff
6374 # define PR_SME_VL_INHERIT   (1 << 17)
6375 #endif
6376 
6377 #include "target_prctl.h"
6378 
6379 static abi_long do_prctl_inval0(CPUArchState *env)
6380 {
6381     return -TARGET_EINVAL;
6382 }
6383 
6384 static abi_long do_prctl_inval1(CPUArchState *env, abi_long arg2)
6385 {
6386     return -TARGET_EINVAL;
6387 }
6388 
6389 #ifndef do_prctl_get_fp_mode
6390 #define do_prctl_get_fp_mode do_prctl_inval0
6391 #endif
6392 #ifndef do_prctl_set_fp_mode
6393 #define do_prctl_set_fp_mode do_prctl_inval1
6394 #endif
6395 #ifndef do_prctl_sve_get_vl
6396 #define do_prctl_sve_get_vl do_prctl_inval0
6397 #endif
6398 #ifndef do_prctl_sve_set_vl
6399 #define do_prctl_sve_set_vl do_prctl_inval1
6400 #endif
6401 #ifndef do_prctl_reset_keys
6402 #define do_prctl_reset_keys do_prctl_inval1
6403 #endif
6404 #ifndef do_prctl_set_tagged_addr_ctrl
6405 #define do_prctl_set_tagged_addr_ctrl do_prctl_inval1
6406 #endif
6407 #ifndef do_prctl_get_tagged_addr_ctrl
6408 #define do_prctl_get_tagged_addr_ctrl do_prctl_inval0
6409 #endif
6410 #ifndef do_prctl_get_unalign
6411 #define do_prctl_get_unalign do_prctl_inval1
6412 #endif
6413 #ifndef do_prctl_set_unalign
6414 #define do_prctl_set_unalign do_prctl_inval1
6415 #endif
6416 #ifndef do_prctl_sme_get_vl
6417 #define do_prctl_sme_get_vl do_prctl_inval0
6418 #endif
6419 #ifndef do_prctl_sme_set_vl
6420 #define do_prctl_sme_set_vl do_prctl_inval1
6421 #endif
6422 
6423 static abi_long do_prctl(CPUArchState *env, abi_long option, abi_long arg2,
6424                          abi_long arg3, abi_long arg4, abi_long arg5)
6425 {
6426     abi_long ret;
6427 
6428     switch (option) {
6429     case PR_GET_PDEATHSIG:
6430         {
6431             int deathsig;
6432             ret = get_errno(prctl(PR_GET_PDEATHSIG, &deathsig,
6433                                   arg3, arg4, arg5));
6434             if (!is_error(ret) &&
6435                 put_user_s32(host_to_target_signal(deathsig), arg2)) {
6436                 return -TARGET_EFAULT;
6437             }
6438             return ret;
6439         }
6440     case PR_SET_PDEATHSIG:
6441         return get_errno(prctl(PR_SET_PDEATHSIG, target_to_host_signal(arg2),
6442                                arg3, arg4, arg5));
6443     case PR_GET_NAME:
6444         {
6445             void *name = lock_user(VERIFY_WRITE, arg2, 16, 1);
6446             if (!name) {
6447                 return -TARGET_EFAULT;
6448             }
6449             ret = get_errno(prctl(PR_GET_NAME, (uintptr_t)name,
6450                                   arg3, arg4, arg5));
6451             unlock_user(name, arg2, 16);
6452             return ret;
6453         }
6454     case PR_SET_NAME:
6455         {
6456             void *name = lock_user(VERIFY_READ, arg2, 16, 1);
6457             if (!name) {
6458                 return -TARGET_EFAULT;
6459             }
6460             ret = get_errno(prctl(PR_SET_NAME, (uintptr_t)name,
6461                                   arg3, arg4, arg5));
6462             unlock_user(name, arg2, 0);
6463             return ret;
6464         }
6465     case PR_GET_FP_MODE:
6466         return do_prctl_get_fp_mode(env);
6467     case PR_SET_FP_MODE:
6468         return do_prctl_set_fp_mode(env, arg2);
6469     case PR_SVE_GET_VL:
6470         return do_prctl_sve_get_vl(env);
6471     case PR_SVE_SET_VL:
6472         return do_prctl_sve_set_vl(env, arg2);
6473     case PR_SME_GET_VL:
6474         return do_prctl_sme_get_vl(env);
6475     case PR_SME_SET_VL:
6476         return do_prctl_sme_set_vl(env, arg2);
6477     case PR_PAC_RESET_KEYS:
6478         if (arg3 || arg4 || arg5) {
6479             return -TARGET_EINVAL;
6480         }
6481         return do_prctl_reset_keys(env, arg2);
6482     case PR_SET_TAGGED_ADDR_CTRL:
6483         if (arg3 || arg4 || arg5) {
6484             return -TARGET_EINVAL;
6485         }
6486         return do_prctl_set_tagged_addr_ctrl(env, arg2);
6487     case PR_GET_TAGGED_ADDR_CTRL:
6488         if (arg2 || arg3 || arg4 || arg5) {
6489             return -TARGET_EINVAL;
6490         }
6491         return do_prctl_get_tagged_addr_ctrl(env);
6492 
6493     case PR_GET_UNALIGN:
6494         return do_prctl_get_unalign(env, arg2);
6495     case PR_SET_UNALIGN:
6496         return do_prctl_set_unalign(env, arg2);
6497 
6498     case PR_CAP_AMBIENT:
6499     case PR_CAPBSET_READ:
6500     case PR_CAPBSET_DROP:
6501     case PR_GET_DUMPABLE:
6502     case PR_SET_DUMPABLE:
6503     case PR_GET_KEEPCAPS:
6504     case PR_SET_KEEPCAPS:
6505     case PR_GET_SECUREBITS:
6506     case PR_SET_SECUREBITS:
6507     case PR_GET_TIMING:
6508     case PR_SET_TIMING:
6509     case PR_GET_TIMERSLACK:
6510     case PR_SET_TIMERSLACK:
6511     case PR_MCE_KILL:
6512     case PR_MCE_KILL_GET:
6513     case PR_GET_NO_NEW_PRIVS:
6514     case PR_SET_NO_NEW_PRIVS:
6515     case PR_GET_IO_FLUSHER:
6516     case PR_SET_IO_FLUSHER:
6517         /* Some prctl options have no pointer arguments and we can pass on. */
6518         return get_errno(prctl(option, arg2, arg3, arg4, arg5));
6519 
6520     case PR_GET_CHILD_SUBREAPER:
6521     case PR_SET_CHILD_SUBREAPER:
6522     case PR_GET_SPECULATION_CTRL:
6523     case PR_SET_SPECULATION_CTRL:
6524     case PR_GET_TID_ADDRESS:
6525         /* TODO */
6526         return -TARGET_EINVAL;
6527 
6528     case PR_GET_FPEXC:
6529     case PR_SET_FPEXC:
6530         /* Was used for SPE on PowerPC. */
6531         return -TARGET_EINVAL;
6532 
6533     case PR_GET_ENDIAN:
6534     case PR_SET_ENDIAN:
6535     case PR_GET_FPEMU:
6536     case PR_SET_FPEMU:
6537     case PR_SET_MM:
6538     case PR_GET_SECCOMP:
6539     case PR_SET_SECCOMP:
6540     case PR_SET_SYSCALL_USER_DISPATCH:
6541     case PR_GET_THP_DISABLE:
6542     case PR_SET_THP_DISABLE:
6543     case PR_GET_TSC:
6544     case PR_SET_TSC:
6545         /* Disable to prevent the target disabling stuff we need. */
6546         return -TARGET_EINVAL;
6547 
6548     default:
6549         qemu_log_mask(LOG_UNIMP, "Unsupported prctl: " TARGET_ABI_FMT_ld "\n",
6550                       option);
6551         return -TARGET_EINVAL;
6552     }
6553 }
6554 
6555 #define NEW_STACK_SIZE 0x40000
6556 
6557 
6558 static pthread_mutex_t clone_lock = PTHREAD_MUTEX_INITIALIZER;
6559 typedef struct {
6560     CPUArchState *env;
6561     pthread_mutex_t mutex;
6562     pthread_cond_t cond;
6563     pthread_t thread;
6564     uint32_t tid;
6565     abi_ulong child_tidptr;
6566     abi_ulong parent_tidptr;
6567     sigset_t sigmask;
6568 } new_thread_info;
6569 
6570 static void *clone_func(void *arg)
6571 {
6572     new_thread_info *info = arg;
6573     CPUArchState *env;
6574     CPUState *cpu;
6575     TaskState *ts;
6576 
6577     rcu_register_thread();
6578     tcg_register_thread();
6579     env = info->env;
6580     cpu = env_cpu(env);
6581     thread_cpu = cpu;
6582     ts = (TaskState *)cpu->opaque;
6583     info->tid = sys_gettid();
6584     task_settid(ts);
6585     if (info->child_tidptr)
6586         put_user_u32(info->tid, info->child_tidptr);
6587     if (info->parent_tidptr)
6588         put_user_u32(info->tid, info->parent_tidptr);
6589     qemu_guest_random_seed_thread_part2(cpu->random_seed);
6590     /* Enable signals.  */
6591     sigprocmask(SIG_SETMASK, &info->sigmask, NULL);
6592     /* Signal to the parent that we're ready.  */
6593     pthread_mutex_lock(&info->mutex);
6594     pthread_cond_broadcast(&info->cond);
6595     pthread_mutex_unlock(&info->mutex);
6596     /* Wait until the parent has finished initializing the tls state.  */
6597     pthread_mutex_lock(&clone_lock);
6598     pthread_mutex_unlock(&clone_lock);
6599     cpu_loop(env);
6600     /* never exits */
6601     return NULL;
6602 }
6603 
6604 /* do_fork() Must return host values and target errnos (unlike most
6605    do_*() functions). */
6606 static int do_fork(CPUArchState *env, unsigned int flags, abi_ulong newsp,
6607                    abi_ulong parent_tidptr, target_ulong newtls,
6608                    abi_ulong child_tidptr)
6609 {
6610     CPUState *cpu = env_cpu(env);
6611     int ret;
6612     TaskState *ts;
6613     CPUState *new_cpu;
6614     CPUArchState *new_env;
6615     sigset_t sigmask;
6616 
6617     flags &= ~CLONE_IGNORED_FLAGS;
6618 
6619     /* Emulate vfork() with fork() */
6620     if (flags & CLONE_VFORK)
6621         flags &= ~(CLONE_VFORK | CLONE_VM);
6622 
6623     if (flags & CLONE_VM) {
6624         TaskState *parent_ts = (TaskState *)cpu->opaque;
6625         new_thread_info info;
6626         pthread_attr_t attr;
6627 
6628         if (((flags & CLONE_THREAD_FLAGS) != CLONE_THREAD_FLAGS) ||
6629             (flags & CLONE_INVALID_THREAD_FLAGS)) {
6630             return -TARGET_EINVAL;
6631         }
6632 
6633         ts = g_new0(TaskState, 1);
6634         init_task_state(ts);
6635 
6636         /* Grab a mutex so that thread setup appears atomic.  */
6637         pthread_mutex_lock(&clone_lock);
6638 
6639         /*
6640          * If this is our first additional thread, we need to ensure we
6641          * generate code for parallel execution and flush old translations.
6642          * Do this now so that the copy gets CF_PARALLEL too.
6643          */
6644         if (!(cpu->tcg_cflags & CF_PARALLEL)) {
6645             cpu->tcg_cflags |= CF_PARALLEL;
6646             tb_flush(cpu);
6647         }
6648 
6649         /* we create a new CPU instance. */
6650         new_env = cpu_copy(env);
6651         /* Init regs that differ from the parent.  */
6652         cpu_clone_regs_child(new_env, newsp, flags);
6653         cpu_clone_regs_parent(env, flags);
6654         new_cpu = env_cpu(new_env);
6655         new_cpu->opaque = ts;
6656         ts->bprm = parent_ts->bprm;
6657         ts->info = parent_ts->info;
6658         ts->signal_mask = parent_ts->signal_mask;
6659 
6660         if (flags & CLONE_CHILD_CLEARTID) {
6661             ts->child_tidptr = child_tidptr;
6662         }
6663 
6664         if (flags & CLONE_SETTLS) {
6665             cpu_set_tls (new_env, newtls);
6666         }
6667 
6668         memset(&info, 0, sizeof(info));
6669         pthread_mutex_init(&info.mutex, NULL);
6670         pthread_mutex_lock(&info.mutex);
6671         pthread_cond_init(&info.cond, NULL);
6672         info.env = new_env;
6673         if (flags & CLONE_CHILD_SETTID) {
6674             info.child_tidptr = child_tidptr;
6675         }
6676         if (flags & CLONE_PARENT_SETTID) {
6677             info.parent_tidptr = parent_tidptr;
6678         }
6679 
6680         ret = pthread_attr_init(&attr);
6681         ret = pthread_attr_setstacksize(&attr, NEW_STACK_SIZE);
6682         ret = pthread_attr_setdetachstate(&attr, PTHREAD_CREATE_DETACHED);
6683         /* It is not safe to deliver signals until the child has finished
6684            initializing, so temporarily block all signals.  */
6685         sigfillset(&sigmask);
6686         sigprocmask(SIG_BLOCK, &sigmask, &info.sigmask);
6687         cpu->random_seed = qemu_guest_random_seed_thread_part1();
6688 
6689         ret = pthread_create(&info.thread, &attr, clone_func, &info);
6690         /* TODO: Free new CPU state if thread creation failed.  */
6691 
6692         sigprocmask(SIG_SETMASK, &info.sigmask, NULL);
6693         pthread_attr_destroy(&attr);
6694         if (ret == 0) {
6695             /* Wait for the child to initialize.  */
6696             pthread_cond_wait(&info.cond, &info.mutex);
6697             ret = info.tid;
6698         } else {
6699             ret = -1;
6700         }
6701         pthread_mutex_unlock(&info.mutex);
6702         pthread_cond_destroy(&info.cond);
6703         pthread_mutex_destroy(&info.mutex);
6704         pthread_mutex_unlock(&clone_lock);
6705     } else {
6706         /* if no CLONE_VM, we consider it is a fork */
6707         if (flags & CLONE_INVALID_FORK_FLAGS) {
6708             return -TARGET_EINVAL;
6709         }
6710 
6711         /* We can't support custom termination signals */
6712         if ((flags & CSIGNAL) != TARGET_SIGCHLD) {
6713             return -TARGET_EINVAL;
6714         }
6715 
6716         if (block_signals()) {
6717             return -QEMU_ERESTARTSYS;
6718         }
6719 
6720         fork_start();
6721         ret = fork();
6722         if (ret == 0) {
6723             /* Child Process.  */
6724             cpu_clone_regs_child(env, newsp, flags);
6725             fork_end(1);
6726             /* There is a race condition here.  The parent process could
6727                theoretically read the TID in the child process before the child
6728                tid is set.  This would require using either ptrace
6729                (not implemented) or having *_tidptr to point at a shared memory
6730                mapping.  We can't repeat the spinlock hack used above because
6731                the child process gets its own copy of the lock.  */
6732             if (flags & CLONE_CHILD_SETTID)
6733                 put_user_u32(sys_gettid(), child_tidptr);
6734             if (flags & CLONE_PARENT_SETTID)
6735                 put_user_u32(sys_gettid(), parent_tidptr);
6736             ts = (TaskState *)cpu->opaque;
6737             if (flags & CLONE_SETTLS)
6738                 cpu_set_tls (env, newtls);
6739             if (flags & CLONE_CHILD_CLEARTID)
6740                 ts->child_tidptr = child_tidptr;
6741         } else {
6742             cpu_clone_regs_parent(env, flags);
6743             fork_end(0);
6744         }
6745     }
6746     return ret;
6747 }
6748 
6749 /* warning : doesn't handle linux specific flags... */
6750 static int target_to_host_fcntl_cmd(int cmd)
6751 {
6752     int ret;
6753 
6754     switch(cmd) {
6755     case TARGET_F_DUPFD:
6756     case TARGET_F_GETFD:
6757     case TARGET_F_SETFD:
6758     case TARGET_F_GETFL:
6759     case TARGET_F_SETFL:
6760     case TARGET_F_OFD_GETLK:
6761     case TARGET_F_OFD_SETLK:
6762     case TARGET_F_OFD_SETLKW:
6763         ret = cmd;
6764         break;
6765     case TARGET_F_GETLK:
6766         ret = F_GETLK64;
6767         break;
6768     case TARGET_F_SETLK:
6769         ret = F_SETLK64;
6770         break;
6771     case TARGET_F_SETLKW:
6772         ret = F_SETLKW64;
6773         break;
6774     case TARGET_F_GETOWN:
6775         ret = F_GETOWN;
6776         break;
6777     case TARGET_F_SETOWN:
6778         ret = F_SETOWN;
6779         break;
6780     case TARGET_F_GETSIG:
6781         ret = F_GETSIG;
6782         break;
6783     case TARGET_F_SETSIG:
6784         ret = F_SETSIG;
6785         break;
6786 #if TARGET_ABI_BITS == 32
6787     case TARGET_F_GETLK64:
6788         ret = F_GETLK64;
6789         break;
6790     case TARGET_F_SETLK64:
6791         ret = F_SETLK64;
6792         break;
6793     case TARGET_F_SETLKW64:
6794         ret = F_SETLKW64;
6795         break;
6796 #endif
6797     case TARGET_F_SETLEASE:
6798         ret = F_SETLEASE;
6799         break;
6800     case TARGET_F_GETLEASE:
6801         ret = F_GETLEASE;
6802         break;
6803 #ifdef F_DUPFD_CLOEXEC
6804     case TARGET_F_DUPFD_CLOEXEC:
6805         ret = F_DUPFD_CLOEXEC;
6806         break;
6807 #endif
6808     case TARGET_F_NOTIFY:
6809         ret = F_NOTIFY;
6810         break;
6811 #ifdef F_GETOWN_EX
6812     case TARGET_F_GETOWN_EX:
6813         ret = F_GETOWN_EX;
6814         break;
6815 #endif
6816 #ifdef F_SETOWN_EX
6817     case TARGET_F_SETOWN_EX:
6818         ret = F_SETOWN_EX;
6819         break;
6820 #endif
6821 #ifdef F_SETPIPE_SZ
6822     case TARGET_F_SETPIPE_SZ:
6823         ret = F_SETPIPE_SZ;
6824         break;
6825     case TARGET_F_GETPIPE_SZ:
6826         ret = F_GETPIPE_SZ;
6827         break;
6828 #endif
6829 #ifdef F_ADD_SEALS
6830     case TARGET_F_ADD_SEALS:
6831         ret = F_ADD_SEALS;
6832         break;
6833     case TARGET_F_GET_SEALS:
6834         ret = F_GET_SEALS;
6835         break;
6836 #endif
6837     default:
6838         ret = -TARGET_EINVAL;
6839         break;
6840     }
6841 
6842 #if defined(__powerpc64__)
6843     /* On PPC64, glibc headers has the F_*LK* defined to 12, 13 and 14 and
6844      * is not supported by kernel. The glibc fcntl call actually adjusts
6845      * them to 5, 6 and 7 before making the syscall(). Since we make the
6846      * syscall directly, adjust to what is supported by the kernel.
6847      */
6848     if (ret >= F_GETLK64 && ret <= F_SETLKW64) {
6849         ret -= F_GETLK64 - 5;
6850     }
6851 #endif
6852 
6853     return ret;
6854 }
6855 
6856 #define FLOCK_TRANSTBL \
6857     switch (type) { \
6858     TRANSTBL_CONVERT(F_RDLCK); \
6859     TRANSTBL_CONVERT(F_WRLCK); \
6860     TRANSTBL_CONVERT(F_UNLCK); \
6861     }
6862 
6863 static int target_to_host_flock(int type)
6864 {
6865 #define TRANSTBL_CONVERT(a) case TARGET_##a: return a
6866     FLOCK_TRANSTBL
6867 #undef  TRANSTBL_CONVERT
6868     return -TARGET_EINVAL;
6869 }
6870 
6871 static int host_to_target_flock(int type)
6872 {
6873 #define TRANSTBL_CONVERT(a) case a: return TARGET_##a
6874     FLOCK_TRANSTBL
6875 #undef  TRANSTBL_CONVERT
6876     /* if we don't know how to convert the value coming
6877      * from the host we copy to the target field as-is
6878      */
6879     return type;
6880 }
6881 
6882 static inline abi_long copy_from_user_flock(struct flock64 *fl,
6883                                             abi_ulong target_flock_addr)
6884 {
6885     struct target_flock *target_fl;
6886     int l_type;
6887 
6888     if (!lock_user_struct(VERIFY_READ, target_fl, target_flock_addr, 1)) {
6889         return -TARGET_EFAULT;
6890     }
6891 
6892     __get_user(l_type, &target_fl->l_type);
6893     l_type = target_to_host_flock(l_type);
6894     if (l_type < 0) {
6895         return l_type;
6896     }
6897     fl->l_type = l_type;
6898     __get_user(fl->l_whence, &target_fl->l_whence);
6899     __get_user(fl->l_start, &target_fl->l_start);
6900     __get_user(fl->l_len, &target_fl->l_len);
6901     __get_user(fl->l_pid, &target_fl->l_pid);
6902     unlock_user_struct(target_fl, target_flock_addr, 0);
6903     return 0;
6904 }
6905 
6906 static inline abi_long copy_to_user_flock(abi_ulong target_flock_addr,
6907                                           const struct flock64 *fl)
6908 {
6909     struct target_flock *target_fl;
6910     short l_type;
6911 
6912     if (!lock_user_struct(VERIFY_WRITE, target_fl, target_flock_addr, 0)) {
6913         return -TARGET_EFAULT;
6914     }
6915 
6916     l_type = host_to_target_flock(fl->l_type);
6917     __put_user(l_type, &target_fl->l_type);
6918     __put_user(fl->l_whence, &target_fl->l_whence);
6919     __put_user(fl->l_start, &target_fl->l_start);
6920     __put_user(fl->l_len, &target_fl->l_len);
6921     __put_user(fl->l_pid, &target_fl->l_pid);
6922     unlock_user_struct(target_fl, target_flock_addr, 1);
6923     return 0;
6924 }
6925 
6926 typedef abi_long from_flock64_fn(struct flock64 *fl, abi_ulong target_addr);
6927 typedef abi_long to_flock64_fn(abi_ulong target_addr, const struct flock64 *fl);
6928 
6929 #if defined(TARGET_ARM) && TARGET_ABI_BITS == 32
6930 struct target_oabi_flock64 {
6931     abi_short l_type;
6932     abi_short l_whence;
6933     abi_llong l_start;
6934     abi_llong l_len;
6935     abi_int   l_pid;
6936 } QEMU_PACKED;
6937 
6938 static inline abi_long copy_from_user_oabi_flock64(struct flock64 *fl,
6939                                                    abi_ulong target_flock_addr)
6940 {
6941     struct target_oabi_flock64 *target_fl;
6942     int l_type;
6943 
6944     if (!lock_user_struct(VERIFY_READ, target_fl, target_flock_addr, 1)) {
6945         return -TARGET_EFAULT;
6946     }
6947 
6948     __get_user(l_type, &target_fl->l_type);
6949     l_type = target_to_host_flock(l_type);
6950     if (l_type < 0) {
6951         return l_type;
6952     }
6953     fl->l_type = l_type;
6954     __get_user(fl->l_whence, &target_fl->l_whence);
6955     __get_user(fl->l_start, &target_fl->l_start);
6956     __get_user(fl->l_len, &target_fl->l_len);
6957     __get_user(fl->l_pid, &target_fl->l_pid);
6958     unlock_user_struct(target_fl, target_flock_addr, 0);
6959     return 0;
6960 }
6961 
6962 static inline abi_long copy_to_user_oabi_flock64(abi_ulong target_flock_addr,
6963                                                  const struct flock64 *fl)
6964 {
6965     struct target_oabi_flock64 *target_fl;
6966     short l_type;
6967 
6968     if (!lock_user_struct(VERIFY_WRITE, target_fl, target_flock_addr, 0)) {
6969         return -TARGET_EFAULT;
6970     }
6971 
6972     l_type = host_to_target_flock(fl->l_type);
6973     __put_user(l_type, &target_fl->l_type);
6974     __put_user(fl->l_whence, &target_fl->l_whence);
6975     __put_user(fl->l_start, &target_fl->l_start);
6976     __put_user(fl->l_len, &target_fl->l_len);
6977     __put_user(fl->l_pid, &target_fl->l_pid);
6978     unlock_user_struct(target_fl, target_flock_addr, 1);
6979     return 0;
6980 }
6981 #endif
6982 
6983 static inline abi_long copy_from_user_flock64(struct flock64 *fl,
6984                                               abi_ulong target_flock_addr)
6985 {
6986     struct target_flock64 *target_fl;
6987     int l_type;
6988 
6989     if (!lock_user_struct(VERIFY_READ, target_fl, target_flock_addr, 1)) {
6990         return -TARGET_EFAULT;
6991     }
6992 
6993     __get_user(l_type, &target_fl->l_type);
6994     l_type = target_to_host_flock(l_type);
6995     if (l_type < 0) {
6996         return l_type;
6997     }
6998     fl->l_type = l_type;
6999     __get_user(fl->l_whence, &target_fl->l_whence);
7000     __get_user(fl->l_start, &target_fl->l_start);
7001     __get_user(fl->l_len, &target_fl->l_len);
7002     __get_user(fl->l_pid, &target_fl->l_pid);
7003     unlock_user_struct(target_fl, target_flock_addr, 0);
7004     return 0;
7005 }
7006 
7007 static inline abi_long copy_to_user_flock64(abi_ulong target_flock_addr,
7008                                             const struct flock64 *fl)
7009 {
7010     struct target_flock64 *target_fl;
7011     short l_type;
7012 
7013     if (!lock_user_struct(VERIFY_WRITE, target_fl, target_flock_addr, 0)) {
7014         return -TARGET_EFAULT;
7015     }
7016 
7017     l_type = host_to_target_flock(fl->l_type);
7018     __put_user(l_type, &target_fl->l_type);
7019     __put_user(fl->l_whence, &target_fl->l_whence);
7020     __put_user(fl->l_start, &target_fl->l_start);
7021     __put_user(fl->l_len, &target_fl->l_len);
7022     __put_user(fl->l_pid, &target_fl->l_pid);
7023     unlock_user_struct(target_fl, target_flock_addr, 1);
7024     return 0;
7025 }
7026 
7027 static abi_long do_fcntl(int fd, int cmd, abi_ulong arg)
7028 {
7029     struct flock64 fl64;
7030 #ifdef F_GETOWN_EX
7031     struct f_owner_ex fox;
7032     struct target_f_owner_ex *target_fox;
7033 #endif
7034     abi_long ret;
7035     int host_cmd = target_to_host_fcntl_cmd(cmd);
7036 
7037     if (host_cmd == -TARGET_EINVAL)
7038 	    return host_cmd;
7039 
7040     switch(cmd) {
7041     case TARGET_F_GETLK:
7042         ret = copy_from_user_flock(&fl64, arg);
7043         if (ret) {
7044             return ret;
7045         }
7046         ret = get_errno(safe_fcntl(fd, host_cmd, &fl64));
7047         if (ret == 0) {
7048             ret = copy_to_user_flock(arg, &fl64);
7049         }
7050         break;
7051 
7052     case TARGET_F_SETLK:
7053     case TARGET_F_SETLKW:
7054         ret = copy_from_user_flock(&fl64, arg);
7055         if (ret) {
7056             return ret;
7057         }
7058         ret = get_errno(safe_fcntl(fd, host_cmd, &fl64));
7059         break;
7060 
7061     case TARGET_F_GETLK64:
7062     case TARGET_F_OFD_GETLK:
7063         ret = copy_from_user_flock64(&fl64, arg);
7064         if (ret) {
7065             return ret;
7066         }
7067         ret = get_errno(safe_fcntl(fd, host_cmd, &fl64));
7068         if (ret == 0) {
7069             ret = copy_to_user_flock64(arg, &fl64);
7070         }
7071         break;
7072     case TARGET_F_SETLK64:
7073     case TARGET_F_SETLKW64:
7074     case TARGET_F_OFD_SETLK:
7075     case TARGET_F_OFD_SETLKW:
7076         ret = copy_from_user_flock64(&fl64, arg);
7077         if (ret) {
7078             return ret;
7079         }
7080         ret = get_errno(safe_fcntl(fd, host_cmd, &fl64));
7081         break;
7082 
7083     case TARGET_F_GETFL:
7084         ret = get_errno(safe_fcntl(fd, host_cmd, arg));
7085         if (ret >= 0) {
7086             ret = host_to_target_bitmask(ret, fcntl_flags_tbl);
7087         }
7088         break;
7089 
7090     case TARGET_F_SETFL:
7091         ret = get_errno(safe_fcntl(fd, host_cmd,
7092                                    target_to_host_bitmask(arg,
7093                                                           fcntl_flags_tbl)));
7094         break;
7095 
7096 #ifdef F_GETOWN_EX
7097     case TARGET_F_GETOWN_EX:
7098         ret = get_errno(safe_fcntl(fd, host_cmd, &fox));
7099         if (ret >= 0) {
7100             if (!lock_user_struct(VERIFY_WRITE, target_fox, arg, 0))
7101                 return -TARGET_EFAULT;
7102             target_fox->type = tswap32(fox.type);
7103             target_fox->pid = tswap32(fox.pid);
7104             unlock_user_struct(target_fox, arg, 1);
7105         }
7106         break;
7107 #endif
7108 
7109 #ifdef F_SETOWN_EX
7110     case TARGET_F_SETOWN_EX:
7111         if (!lock_user_struct(VERIFY_READ, target_fox, arg, 1))
7112             return -TARGET_EFAULT;
7113         fox.type = tswap32(target_fox->type);
7114         fox.pid = tswap32(target_fox->pid);
7115         unlock_user_struct(target_fox, arg, 0);
7116         ret = get_errno(safe_fcntl(fd, host_cmd, &fox));
7117         break;
7118 #endif
7119 
7120     case TARGET_F_SETSIG:
7121         ret = get_errno(safe_fcntl(fd, host_cmd, target_to_host_signal(arg)));
7122         break;
7123 
7124     case TARGET_F_GETSIG:
7125         ret = host_to_target_signal(get_errno(safe_fcntl(fd, host_cmd, arg)));
7126         break;
7127 
7128     case TARGET_F_SETOWN:
7129     case TARGET_F_GETOWN:
7130     case TARGET_F_SETLEASE:
7131     case TARGET_F_GETLEASE:
7132     case TARGET_F_SETPIPE_SZ:
7133     case TARGET_F_GETPIPE_SZ:
7134     case TARGET_F_ADD_SEALS:
7135     case TARGET_F_GET_SEALS:
7136         ret = get_errno(safe_fcntl(fd, host_cmd, arg));
7137         break;
7138 
7139     default:
7140         ret = get_errno(safe_fcntl(fd, cmd, arg));
7141         break;
7142     }
7143     return ret;
7144 }
7145 
7146 #ifdef USE_UID16
7147 
7148 static inline int high2lowuid(int uid)
7149 {
7150     if (uid > 65535)
7151         return 65534;
7152     else
7153         return uid;
7154 }
7155 
7156 static inline int high2lowgid(int gid)
7157 {
7158     if (gid > 65535)
7159         return 65534;
7160     else
7161         return gid;
7162 }
7163 
7164 static inline int low2highuid(int uid)
7165 {
7166     if ((int16_t)uid == -1)
7167         return -1;
7168     else
7169         return uid;
7170 }
7171 
7172 static inline int low2highgid(int gid)
7173 {
7174     if ((int16_t)gid == -1)
7175         return -1;
7176     else
7177         return gid;
7178 }
7179 static inline int tswapid(int id)
7180 {
7181     return tswap16(id);
7182 }
7183 
7184 #define put_user_id(x, gaddr) put_user_u16(x, gaddr)
7185 
7186 #else /* !USE_UID16 */
7187 static inline int high2lowuid(int uid)
7188 {
7189     return uid;
7190 }
7191 static inline int high2lowgid(int gid)
7192 {
7193     return gid;
7194 }
7195 static inline int low2highuid(int uid)
7196 {
7197     return uid;
7198 }
7199 static inline int low2highgid(int gid)
7200 {
7201     return gid;
7202 }
7203 static inline int tswapid(int id)
7204 {
7205     return tswap32(id);
7206 }
7207 
7208 #define put_user_id(x, gaddr) put_user_u32(x, gaddr)
7209 
7210 #endif /* USE_UID16 */
7211 
7212 /* We must do direct syscalls for setting UID/GID, because we want to
7213  * implement the Linux system call semantics of "change only for this thread",
7214  * not the libc/POSIX semantics of "change for all threads in process".
7215  * (See http://ewontfix.com/17/ for more details.)
7216  * We use the 32-bit version of the syscalls if present; if it is not
7217  * then either the host architecture supports 32-bit UIDs natively with
7218  * the standard syscall, or the 16-bit UID is the best we can do.
7219  */
7220 #ifdef __NR_setuid32
7221 #define __NR_sys_setuid __NR_setuid32
7222 #else
7223 #define __NR_sys_setuid __NR_setuid
7224 #endif
7225 #ifdef __NR_setgid32
7226 #define __NR_sys_setgid __NR_setgid32
7227 #else
7228 #define __NR_sys_setgid __NR_setgid
7229 #endif
7230 #ifdef __NR_setresuid32
7231 #define __NR_sys_setresuid __NR_setresuid32
7232 #else
7233 #define __NR_sys_setresuid __NR_setresuid
7234 #endif
7235 #ifdef __NR_setresgid32
7236 #define __NR_sys_setresgid __NR_setresgid32
7237 #else
7238 #define __NR_sys_setresgid __NR_setresgid
7239 #endif
7240 
7241 _syscall1(int, sys_setuid, uid_t, uid)
7242 _syscall1(int, sys_setgid, gid_t, gid)
7243 _syscall3(int, sys_setresuid, uid_t, ruid, uid_t, euid, uid_t, suid)
7244 _syscall3(int, sys_setresgid, gid_t, rgid, gid_t, egid, gid_t, sgid)
7245 
7246 void syscall_init(void)
7247 {
7248     IOCTLEntry *ie;
7249     const argtype *arg_type;
7250     int size;
7251 
7252     thunk_init(STRUCT_MAX);
7253 
7254 #define STRUCT(name, ...) thunk_register_struct(STRUCT_ ## name, #name, struct_ ## name ## _def);
7255 #define STRUCT_SPECIAL(name) thunk_register_struct_direct(STRUCT_ ## name, #name, &struct_ ## name ## _def);
7256 #include "syscall_types.h"
7257 #undef STRUCT
7258 #undef STRUCT_SPECIAL
7259 
7260     /* we patch the ioctl size if necessary. We rely on the fact that
7261        no ioctl has all the bits at '1' in the size field */
7262     ie = ioctl_entries;
7263     while (ie->target_cmd != 0) {
7264         if (((ie->target_cmd >> TARGET_IOC_SIZESHIFT) & TARGET_IOC_SIZEMASK) ==
7265             TARGET_IOC_SIZEMASK) {
7266             arg_type = ie->arg_type;
7267             if (arg_type[0] != TYPE_PTR) {
7268                 fprintf(stderr, "cannot patch size for ioctl 0x%x\n",
7269                         ie->target_cmd);
7270                 exit(1);
7271             }
7272             arg_type++;
7273             size = thunk_type_size(arg_type, 0);
7274             ie->target_cmd = (ie->target_cmd &
7275                               ~(TARGET_IOC_SIZEMASK << TARGET_IOC_SIZESHIFT)) |
7276                 (size << TARGET_IOC_SIZESHIFT);
7277         }
7278 
7279         /* automatic consistency check if same arch */
7280 #if (defined(__i386__) && defined(TARGET_I386) && defined(TARGET_ABI32)) || \
7281     (defined(__x86_64__) && defined(TARGET_X86_64))
7282         if (unlikely(ie->target_cmd != ie->host_cmd)) {
7283             fprintf(stderr, "ERROR: ioctl(%s): target=0x%x host=0x%x\n",
7284                     ie->name, ie->target_cmd, ie->host_cmd);
7285         }
7286 #endif
7287         ie++;
7288     }
7289 }
7290 
7291 #ifdef TARGET_NR_truncate64
7292 static inline abi_long target_truncate64(CPUArchState *cpu_env, const char *arg1,
7293                                          abi_long arg2,
7294                                          abi_long arg3,
7295                                          abi_long arg4)
7296 {
7297     if (regpairs_aligned(cpu_env, TARGET_NR_truncate64)) {
7298         arg2 = arg3;
7299         arg3 = arg4;
7300     }
7301     return get_errno(truncate64(arg1, target_offset64(arg2, arg3)));
7302 }
7303 #endif
7304 
7305 #ifdef TARGET_NR_ftruncate64
7306 static inline abi_long target_ftruncate64(CPUArchState *cpu_env, abi_long arg1,
7307                                           abi_long arg2,
7308                                           abi_long arg3,
7309                                           abi_long arg4)
7310 {
7311     if (regpairs_aligned(cpu_env, TARGET_NR_ftruncate64)) {
7312         arg2 = arg3;
7313         arg3 = arg4;
7314     }
7315     return get_errno(ftruncate64(arg1, target_offset64(arg2, arg3)));
7316 }
7317 #endif
7318 
7319 #if defined(TARGET_NR_timer_settime) || \
7320     (defined(TARGET_NR_timerfd_settime) && defined(CONFIG_TIMERFD))
7321 static inline abi_long target_to_host_itimerspec(struct itimerspec *host_its,
7322                                                  abi_ulong target_addr)
7323 {
7324     if (target_to_host_timespec(&host_its->it_interval, target_addr +
7325                                 offsetof(struct target_itimerspec,
7326                                          it_interval)) ||
7327         target_to_host_timespec(&host_its->it_value, target_addr +
7328                                 offsetof(struct target_itimerspec,
7329                                          it_value))) {
7330         return -TARGET_EFAULT;
7331     }
7332 
7333     return 0;
7334 }
7335 #endif
7336 
7337 #if defined(TARGET_NR_timer_settime64) || \
7338     (defined(TARGET_NR_timerfd_settime64) && defined(CONFIG_TIMERFD))
7339 static inline abi_long target_to_host_itimerspec64(struct itimerspec *host_its,
7340                                                    abi_ulong target_addr)
7341 {
7342     if (target_to_host_timespec64(&host_its->it_interval, target_addr +
7343                                   offsetof(struct target__kernel_itimerspec,
7344                                            it_interval)) ||
7345         target_to_host_timespec64(&host_its->it_value, target_addr +
7346                                   offsetof(struct target__kernel_itimerspec,
7347                                            it_value))) {
7348         return -TARGET_EFAULT;
7349     }
7350 
7351     return 0;
7352 }
7353 #endif
7354 
7355 #if ((defined(TARGET_NR_timerfd_gettime) || \
7356       defined(TARGET_NR_timerfd_settime)) && defined(CONFIG_TIMERFD)) || \
7357       defined(TARGET_NR_timer_gettime) || defined(TARGET_NR_timer_settime)
7358 static inline abi_long host_to_target_itimerspec(abi_ulong target_addr,
7359                                                  struct itimerspec *host_its)
7360 {
7361     if (host_to_target_timespec(target_addr + offsetof(struct target_itimerspec,
7362                                                        it_interval),
7363                                 &host_its->it_interval) ||
7364         host_to_target_timespec(target_addr + offsetof(struct target_itimerspec,
7365                                                        it_value),
7366                                 &host_its->it_value)) {
7367         return -TARGET_EFAULT;
7368     }
7369     return 0;
7370 }
7371 #endif
7372 
7373 #if ((defined(TARGET_NR_timerfd_gettime64) || \
7374       defined(TARGET_NR_timerfd_settime64)) && defined(CONFIG_TIMERFD)) || \
7375       defined(TARGET_NR_timer_gettime64) || defined(TARGET_NR_timer_settime64)
7376 static inline abi_long host_to_target_itimerspec64(abi_ulong target_addr,
7377                                                    struct itimerspec *host_its)
7378 {
7379     if (host_to_target_timespec64(target_addr +
7380                                   offsetof(struct target__kernel_itimerspec,
7381                                            it_interval),
7382                                   &host_its->it_interval) ||
7383         host_to_target_timespec64(target_addr +
7384                                   offsetof(struct target__kernel_itimerspec,
7385                                            it_value),
7386                                   &host_its->it_value)) {
7387         return -TARGET_EFAULT;
7388     }
7389     return 0;
7390 }
7391 #endif
7392 
7393 #if defined(TARGET_NR_adjtimex) || \
7394     (defined(TARGET_NR_clock_adjtime) && defined(CONFIG_CLOCK_ADJTIME))
7395 static inline abi_long target_to_host_timex(struct timex *host_tx,
7396                                             abi_long target_addr)
7397 {
7398     struct target_timex *target_tx;
7399 
7400     if (!lock_user_struct(VERIFY_READ, target_tx, target_addr, 1)) {
7401         return -TARGET_EFAULT;
7402     }
7403 
7404     __get_user(host_tx->modes, &target_tx->modes);
7405     __get_user(host_tx->offset, &target_tx->offset);
7406     __get_user(host_tx->freq, &target_tx->freq);
7407     __get_user(host_tx->maxerror, &target_tx->maxerror);
7408     __get_user(host_tx->esterror, &target_tx->esterror);
7409     __get_user(host_tx->status, &target_tx->status);
7410     __get_user(host_tx->constant, &target_tx->constant);
7411     __get_user(host_tx->precision, &target_tx->precision);
7412     __get_user(host_tx->tolerance, &target_tx->tolerance);
7413     __get_user(host_tx->time.tv_sec, &target_tx->time.tv_sec);
7414     __get_user(host_tx->time.tv_usec, &target_tx->time.tv_usec);
7415     __get_user(host_tx->tick, &target_tx->tick);
7416     __get_user(host_tx->ppsfreq, &target_tx->ppsfreq);
7417     __get_user(host_tx->jitter, &target_tx->jitter);
7418     __get_user(host_tx->shift, &target_tx->shift);
7419     __get_user(host_tx->stabil, &target_tx->stabil);
7420     __get_user(host_tx->jitcnt, &target_tx->jitcnt);
7421     __get_user(host_tx->calcnt, &target_tx->calcnt);
7422     __get_user(host_tx->errcnt, &target_tx->errcnt);
7423     __get_user(host_tx->stbcnt, &target_tx->stbcnt);
7424     __get_user(host_tx->tai, &target_tx->tai);
7425 
7426     unlock_user_struct(target_tx, target_addr, 0);
7427     return 0;
7428 }
7429 
7430 static inline abi_long host_to_target_timex(abi_long target_addr,
7431                                             struct timex *host_tx)
7432 {
7433     struct target_timex *target_tx;
7434 
7435     if (!lock_user_struct(VERIFY_WRITE, target_tx, target_addr, 0)) {
7436         return -TARGET_EFAULT;
7437     }
7438 
7439     __put_user(host_tx->modes, &target_tx->modes);
7440     __put_user(host_tx->offset, &target_tx->offset);
7441     __put_user(host_tx->freq, &target_tx->freq);
7442     __put_user(host_tx->maxerror, &target_tx->maxerror);
7443     __put_user(host_tx->esterror, &target_tx->esterror);
7444     __put_user(host_tx->status, &target_tx->status);
7445     __put_user(host_tx->constant, &target_tx->constant);
7446     __put_user(host_tx->precision, &target_tx->precision);
7447     __put_user(host_tx->tolerance, &target_tx->tolerance);
7448     __put_user(host_tx->time.tv_sec, &target_tx->time.tv_sec);
7449     __put_user(host_tx->time.tv_usec, &target_tx->time.tv_usec);
7450     __put_user(host_tx->tick, &target_tx->tick);
7451     __put_user(host_tx->ppsfreq, &target_tx->ppsfreq);
7452     __put_user(host_tx->jitter, &target_tx->jitter);
7453     __put_user(host_tx->shift, &target_tx->shift);
7454     __put_user(host_tx->stabil, &target_tx->stabil);
7455     __put_user(host_tx->jitcnt, &target_tx->jitcnt);
7456     __put_user(host_tx->calcnt, &target_tx->calcnt);
7457     __put_user(host_tx->errcnt, &target_tx->errcnt);
7458     __put_user(host_tx->stbcnt, &target_tx->stbcnt);
7459     __put_user(host_tx->tai, &target_tx->tai);
7460 
7461     unlock_user_struct(target_tx, target_addr, 1);
7462     return 0;
7463 }
7464 #endif
7465 
7466 
7467 #if defined(TARGET_NR_clock_adjtime64) && defined(CONFIG_CLOCK_ADJTIME)
7468 static inline abi_long target_to_host_timex64(struct timex *host_tx,
7469                                               abi_long target_addr)
7470 {
7471     struct target__kernel_timex *target_tx;
7472 
7473     if (copy_from_user_timeval64(&host_tx->time, target_addr +
7474                                  offsetof(struct target__kernel_timex,
7475                                           time))) {
7476         return -TARGET_EFAULT;
7477     }
7478 
7479     if (!lock_user_struct(VERIFY_READ, target_tx, target_addr, 1)) {
7480         return -TARGET_EFAULT;
7481     }
7482 
7483     __get_user(host_tx->modes, &target_tx->modes);
7484     __get_user(host_tx->offset, &target_tx->offset);
7485     __get_user(host_tx->freq, &target_tx->freq);
7486     __get_user(host_tx->maxerror, &target_tx->maxerror);
7487     __get_user(host_tx->esterror, &target_tx->esterror);
7488     __get_user(host_tx->status, &target_tx->status);
7489     __get_user(host_tx->constant, &target_tx->constant);
7490     __get_user(host_tx->precision, &target_tx->precision);
7491     __get_user(host_tx->tolerance, &target_tx->tolerance);
7492     __get_user(host_tx->tick, &target_tx->tick);
7493     __get_user(host_tx->ppsfreq, &target_tx->ppsfreq);
7494     __get_user(host_tx->jitter, &target_tx->jitter);
7495     __get_user(host_tx->shift, &target_tx->shift);
7496     __get_user(host_tx->stabil, &target_tx->stabil);
7497     __get_user(host_tx->jitcnt, &target_tx->jitcnt);
7498     __get_user(host_tx->calcnt, &target_tx->calcnt);
7499     __get_user(host_tx->errcnt, &target_tx->errcnt);
7500     __get_user(host_tx->stbcnt, &target_tx->stbcnt);
7501     __get_user(host_tx->tai, &target_tx->tai);
7502 
7503     unlock_user_struct(target_tx, target_addr, 0);
7504     return 0;
7505 }
7506 
7507 static inline abi_long host_to_target_timex64(abi_long target_addr,
7508                                               struct timex *host_tx)
7509 {
7510     struct target__kernel_timex *target_tx;
7511 
7512    if (copy_to_user_timeval64(target_addr +
7513                               offsetof(struct target__kernel_timex, time),
7514                               &host_tx->time)) {
7515         return -TARGET_EFAULT;
7516     }
7517 
7518     if (!lock_user_struct(VERIFY_WRITE, target_tx, target_addr, 0)) {
7519         return -TARGET_EFAULT;
7520     }
7521 
7522     __put_user(host_tx->modes, &target_tx->modes);
7523     __put_user(host_tx->offset, &target_tx->offset);
7524     __put_user(host_tx->freq, &target_tx->freq);
7525     __put_user(host_tx->maxerror, &target_tx->maxerror);
7526     __put_user(host_tx->esterror, &target_tx->esterror);
7527     __put_user(host_tx->status, &target_tx->status);
7528     __put_user(host_tx->constant, &target_tx->constant);
7529     __put_user(host_tx->precision, &target_tx->precision);
7530     __put_user(host_tx->tolerance, &target_tx->tolerance);
7531     __put_user(host_tx->tick, &target_tx->tick);
7532     __put_user(host_tx->ppsfreq, &target_tx->ppsfreq);
7533     __put_user(host_tx->jitter, &target_tx->jitter);
7534     __put_user(host_tx->shift, &target_tx->shift);
7535     __put_user(host_tx->stabil, &target_tx->stabil);
7536     __put_user(host_tx->jitcnt, &target_tx->jitcnt);
7537     __put_user(host_tx->calcnt, &target_tx->calcnt);
7538     __put_user(host_tx->errcnt, &target_tx->errcnt);
7539     __put_user(host_tx->stbcnt, &target_tx->stbcnt);
7540     __put_user(host_tx->tai, &target_tx->tai);
7541 
7542     unlock_user_struct(target_tx, target_addr, 1);
7543     return 0;
7544 }
7545 #endif
7546 
7547 #ifndef HAVE_SIGEV_NOTIFY_THREAD_ID
7548 #define sigev_notify_thread_id _sigev_un._tid
7549 #endif
7550 
7551 static inline abi_long target_to_host_sigevent(struct sigevent *host_sevp,
7552                                                abi_ulong target_addr)
7553 {
7554     struct target_sigevent *target_sevp;
7555 
7556     if (!lock_user_struct(VERIFY_READ, target_sevp, target_addr, 1)) {
7557         return -TARGET_EFAULT;
7558     }
7559 
7560     /* This union is awkward on 64 bit systems because it has a 32 bit
7561      * integer and a pointer in it; we follow the conversion approach
7562      * used for handling sigval types in signal.c so the guest should get
7563      * the correct value back even if we did a 64 bit byteswap and it's
7564      * using the 32 bit integer.
7565      */
7566     host_sevp->sigev_value.sival_ptr =
7567         (void *)(uintptr_t)tswapal(target_sevp->sigev_value.sival_ptr);
7568     host_sevp->sigev_signo =
7569         target_to_host_signal(tswap32(target_sevp->sigev_signo));
7570     host_sevp->sigev_notify = tswap32(target_sevp->sigev_notify);
7571     host_sevp->sigev_notify_thread_id = tswap32(target_sevp->_sigev_un._tid);
7572 
7573     unlock_user_struct(target_sevp, target_addr, 1);
7574     return 0;
7575 }
7576 
7577 #if defined(TARGET_NR_mlockall)
7578 static inline int target_to_host_mlockall_arg(int arg)
7579 {
7580     int result = 0;
7581 
7582     if (arg & TARGET_MCL_CURRENT) {
7583         result |= MCL_CURRENT;
7584     }
7585     if (arg & TARGET_MCL_FUTURE) {
7586         result |= MCL_FUTURE;
7587     }
7588 #ifdef MCL_ONFAULT
7589     if (arg & TARGET_MCL_ONFAULT) {
7590         result |= MCL_ONFAULT;
7591     }
7592 #endif
7593 
7594     return result;
7595 }
7596 #endif
7597 
7598 #if (defined(TARGET_NR_stat64) || defined(TARGET_NR_lstat64) ||     \
7599      defined(TARGET_NR_fstat64) || defined(TARGET_NR_fstatat64) ||  \
7600      defined(TARGET_NR_newfstatat))
7601 static inline abi_long host_to_target_stat64(CPUArchState *cpu_env,
7602                                              abi_ulong target_addr,
7603                                              struct stat *host_st)
7604 {
7605 #if defined(TARGET_ARM) && defined(TARGET_ABI32)
7606     if (cpu_env->eabi) {
7607         struct target_eabi_stat64 *target_st;
7608 
7609         if (!lock_user_struct(VERIFY_WRITE, target_st, target_addr, 0))
7610             return -TARGET_EFAULT;
7611         memset(target_st, 0, sizeof(struct target_eabi_stat64));
7612         __put_user(host_st->st_dev, &target_st->st_dev);
7613         __put_user(host_st->st_ino, &target_st->st_ino);
7614 #ifdef TARGET_STAT64_HAS_BROKEN_ST_INO
7615         __put_user(host_st->st_ino, &target_st->__st_ino);
7616 #endif
7617         __put_user(host_st->st_mode, &target_st->st_mode);
7618         __put_user(host_st->st_nlink, &target_st->st_nlink);
7619         __put_user(host_st->st_uid, &target_st->st_uid);
7620         __put_user(host_st->st_gid, &target_st->st_gid);
7621         __put_user(host_st->st_rdev, &target_st->st_rdev);
7622         __put_user(host_st->st_size, &target_st->st_size);
7623         __put_user(host_st->st_blksize, &target_st->st_blksize);
7624         __put_user(host_st->st_blocks, &target_st->st_blocks);
7625         __put_user(host_st->st_atime, &target_st->target_st_atime);
7626         __put_user(host_st->st_mtime, &target_st->target_st_mtime);
7627         __put_user(host_st->st_ctime, &target_st->target_st_ctime);
7628 #ifdef HAVE_STRUCT_STAT_ST_ATIM
7629         __put_user(host_st->st_atim.tv_nsec, &target_st->target_st_atime_nsec);
7630         __put_user(host_st->st_mtim.tv_nsec, &target_st->target_st_mtime_nsec);
7631         __put_user(host_st->st_ctim.tv_nsec, &target_st->target_st_ctime_nsec);
7632 #endif
7633         unlock_user_struct(target_st, target_addr, 1);
7634     } else
7635 #endif
7636     {
7637 #if defined(TARGET_HAS_STRUCT_STAT64)
7638         struct target_stat64 *target_st;
7639 #else
7640         struct target_stat *target_st;
7641 #endif
7642 
7643         if (!lock_user_struct(VERIFY_WRITE, target_st, target_addr, 0))
7644             return -TARGET_EFAULT;
7645         memset(target_st, 0, sizeof(*target_st));
7646         __put_user(host_st->st_dev, &target_st->st_dev);
7647         __put_user(host_st->st_ino, &target_st->st_ino);
7648 #ifdef TARGET_STAT64_HAS_BROKEN_ST_INO
7649         __put_user(host_st->st_ino, &target_st->__st_ino);
7650 #endif
7651         __put_user(host_st->st_mode, &target_st->st_mode);
7652         __put_user(host_st->st_nlink, &target_st->st_nlink);
7653         __put_user(host_st->st_uid, &target_st->st_uid);
7654         __put_user(host_st->st_gid, &target_st->st_gid);
7655         __put_user(host_st->st_rdev, &target_st->st_rdev);
7656         /* XXX: better use of kernel struct */
7657         __put_user(host_st->st_size, &target_st->st_size);
7658         __put_user(host_st->st_blksize, &target_st->st_blksize);
7659         __put_user(host_st->st_blocks, &target_st->st_blocks);
7660         __put_user(host_st->st_atime, &target_st->target_st_atime);
7661         __put_user(host_st->st_mtime, &target_st->target_st_mtime);
7662         __put_user(host_st->st_ctime, &target_st->target_st_ctime);
7663 #ifdef HAVE_STRUCT_STAT_ST_ATIM
7664         __put_user(host_st->st_atim.tv_nsec, &target_st->target_st_atime_nsec);
7665         __put_user(host_st->st_mtim.tv_nsec, &target_st->target_st_mtime_nsec);
7666         __put_user(host_st->st_ctim.tv_nsec, &target_st->target_st_ctime_nsec);
7667 #endif
7668         unlock_user_struct(target_st, target_addr, 1);
7669     }
7670 
7671     return 0;
7672 }
7673 #endif
7674 
7675 #if defined(TARGET_NR_statx) && defined(__NR_statx)
7676 static inline abi_long host_to_target_statx(struct target_statx *host_stx,
7677                                             abi_ulong target_addr)
7678 {
7679     struct target_statx *target_stx;
7680 
7681     if (!lock_user_struct(VERIFY_WRITE, target_stx, target_addr,  0)) {
7682         return -TARGET_EFAULT;
7683     }
7684     memset(target_stx, 0, sizeof(*target_stx));
7685 
7686     __put_user(host_stx->stx_mask, &target_stx->stx_mask);
7687     __put_user(host_stx->stx_blksize, &target_stx->stx_blksize);
7688     __put_user(host_stx->stx_attributes, &target_stx->stx_attributes);
7689     __put_user(host_stx->stx_nlink, &target_stx->stx_nlink);
7690     __put_user(host_stx->stx_uid, &target_stx->stx_uid);
7691     __put_user(host_stx->stx_gid, &target_stx->stx_gid);
7692     __put_user(host_stx->stx_mode, &target_stx->stx_mode);
7693     __put_user(host_stx->stx_ino, &target_stx->stx_ino);
7694     __put_user(host_stx->stx_size, &target_stx->stx_size);
7695     __put_user(host_stx->stx_blocks, &target_stx->stx_blocks);
7696     __put_user(host_stx->stx_attributes_mask, &target_stx->stx_attributes_mask);
7697     __put_user(host_stx->stx_atime.tv_sec, &target_stx->stx_atime.tv_sec);
7698     __put_user(host_stx->stx_atime.tv_nsec, &target_stx->stx_atime.tv_nsec);
7699     __put_user(host_stx->stx_btime.tv_sec, &target_stx->stx_btime.tv_sec);
7700     __put_user(host_stx->stx_btime.tv_nsec, &target_stx->stx_btime.tv_nsec);
7701     __put_user(host_stx->stx_ctime.tv_sec, &target_stx->stx_ctime.tv_sec);
7702     __put_user(host_stx->stx_ctime.tv_nsec, &target_stx->stx_ctime.tv_nsec);
7703     __put_user(host_stx->stx_mtime.tv_sec, &target_stx->stx_mtime.tv_sec);
7704     __put_user(host_stx->stx_mtime.tv_nsec, &target_stx->stx_mtime.tv_nsec);
7705     __put_user(host_stx->stx_rdev_major, &target_stx->stx_rdev_major);
7706     __put_user(host_stx->stx_rdev_minor, &target_stx->stx_rdev_minor);
7707     __put_user(host_stx->stx_dev_major, &target_stx->stx_dev_major);
7708     __put_user(host_stx->stx_dev_minor, &target_stx->stx_dev_minor);
7709 
7710     unlock_user_struct(target_stx, target_addr, 1);
7711 
7712     return 0;
7713 }
7714 #endif
7715 
7716 static int do_sys_futex(int *uaddr, int op, int val,
7717                          const struct timespec *timeout, int *uaddr2,
7718                          int val3)
7719 {
7720 #if HOST_LONG_BITS == 64
7721 #if defined(__NR_futex)
7722     /* always a 64-bit time_t, it doesn't define _time64 version  */
7723     return sys_futex(uaddr, op, val, timeout, uaddr2, val3);
7724 
7725 #endif
7726 #else /* HOST_LONG_BITS == 64 */
7727 #if defined(__NR_futex_time64)
7728     if (sizeof(timeout->tv_sec) == 8) {
7729         /* _time64 function on 32bit arch */
7730         return sys_futex_time64(uaddr, op, val, timeout, uaddr2, val3);
7731     }
7732 #endif
7733 #if defined(__NR_futex)
7734     /* old function on 32bit arch */
7735     return sys_futex(uaddr, op, val, timeout, uaddr2, val3);
7736 #endif
7737 #endif /* HOST_LONG_BITS == 64 */
7738     g_assert_not_reached();
7739 }
7740 
7741 static int do_safe_futex(int *uaddr, int op, int val,
7742                          const struct timespec *timeout, int *uaddr2,
7743                          int val3)
7744 {
7745 #if HOST_LONG_BITS == 64
7746 #if defined(__NR_futex)
7747     /* always a 64-bit time_t, it doesn't define _time64 version  */
7748     return get_errno(safe_futex(uaddr, op, val, timeout, uaddr2, val3));
7749 #endif
7750 #else /* HOST_LONG_BITS == 64 */
7751 #if defined(__NR_futex_time64)
7752     if (sizeof(timeout->tv_sec) == 8) {
7753         /* _time64 function on 32bit arch */
7754         return get_errno(safe_futex_time64(uaddr, op, val, timeout, uaddr2,
7755                                            val3));
7756     }
7757 #endif
7758 #if defined(__NR_futex)
7759     /* old function on 32bit arch */
7760     return get_errno(safe_futex(uaddr, op, val, timeout, uaddr2, val3));
7761 #endif
7762 #endif /* HOST_LONG_BITS == 64 */
7763     return -TARGET_ENOSYS;
7764 }
7765 
7766 /* ??? Using host futex calls even when target atomic operations
7767    are not really atomic probably breaks things.  However implementing
7768    futexes locally would make futexes shared between multiple processes
7769    tricky.  However they're probably useless because guest atomic
7770    operations won't work either.  */
7771 #if defined(TARGET_NR_futex) || defined(TARGET_NR_futex_time64)
7772 static int do_futex(CPUState *cpu, bool time64, target_ulong uaddr,
7773                     int op, int val, target_ulong timeout,
7774                     target_ulong uaddr2, int val3)
7775 {
7776     struct timespec ts, *pts = NULL;
7777     void *haddr2 = NULL;
7778     int base_op;
7779 
7780     /* We assume FUTEX_* constants are the same on both host and target. */
7781 #ifdef FUTEX_CMD_MASK
7782     base_op = op & FUTEX_CMD_MASK;
7783 #else
7784     base_op = op;
7785 #endif
7786     switch (base_op) {
7787     case FUTEX_WAIT:
7788     case FUTEX_WAIT_BITSET:
7789         val = tswap32(val);
7790         break;
7791     case FUTEX_WAIT_REQUEUE_PI:
7792         val = tswap32(val);
7793         haddr2 = g2h(cpu, uaddr2);
7794         break;
7795     case FUTEX_LOCK_PI:
7796     case FUTEX_LOCK_PI2:
7797         break;
7798     case FUTEX_WAKE:
7799     case FUTEX_WAKE_BITSET:
7800     case FUTEX_TRYLOCK_PI:
7801     case FUTEX_UNLOCK_PI:
7802         timeout = 0;
7803         break;
7804     case FUTEX_FD:
7805         val = target_to_host_signal(val);
7806         timeout = 0;
7807         break;
7808     case FUTEX_CMP_REQUEUE:
7809     case FUTEX_CMP_REQUEUE_PI:
7810         val3 = tswap32(val3);
7811         /* fall through */
7812     case FUTEX_REQUEUE:
7813     case FUTEX_WAKE_OP:
7814         /*
7815          * For these, the 4th argument is not TIMEOUT, but VAL2.
7816          * But the prototype of do_safe_futex takes a pointer, so
7817          * insert casts to satisfy the compiler.  We do not need
7818          * to tswap VAL2 since it's not compared to guest memory.
7819           */
7820         pts = (struct timespec *)(uintptr_t)timeout;
7821         timeout = 0;
7822         haddr2 = g2h(cpu, uaddr2);
7823         break;
7824     default:
7825         return -TARGET_ENOSYS;
7826     }
7827     if (timeout) {
7828         pts = &ts;
7829         if (time64
7830             ? target_to_host_timespec64(pts, timeout)
7831             : target_to_host_timespec(pts, timeout)) {
7832             return -TARGET_EFAULT;
7833         }
7834     }
7835     return do_safe_futex(g2h(cpu, uaddr), op, val, pts, haddr2, val3);
7836 }
7837 #endif
7838 
7839 #if defined(TARGET_NR_name_to_handle_at) && defined(CONFIG_OPEN_BY_HANDLE)
7840 static abi_long do_name_to_handle_at(abi_long dirfd, abi_long pathname,
7841                                      abi_long handle, abi_long mount_id,
7842                                      abi_long flags)
7843 {
7844     struct file_handle *target_fh;
7845     struct file_handle *fh;
7846     int mid = 0;
7847     abi_long ret;
7848     char *name;
7849     unsigned int size, total_size;
7850 
7851     if (get_user_s32(size, handle)) {
7852         return -TARGET_EFAULT;
7853     }
7854 
7855     name = lock_user_string(pathname);
7856     if (!name) {
7857         return -TARGET_EFAULT;
7858     }
7859 
7860     total_size = sizeof(struct file_handle) + size;
7861     target_fh = lock_user(VERIFY_WRITE, handle, total_size, 0);
7862     if (!target_fh) {
7863         unlock_user(name, pathname, 0);
7864         return -TARGET_EFAULT;
7865     }
7866 
7867     fh = g_malloc0(total_size);
7868     fh->handle_bytes = size;
7869 
7870     ret = get_errno(name_to_handle_at(dirfd, path(name), fh, &mid, flags));
7871     unlock_user(name, pathname, 0);
7872 
7873     /* man name_to_handle_at(2):
7874      * Other than the use of the handle_bytes field, the caller should treat
7875      * the file_handle structure as an opaque data type
7876      */
7877 
7878     memcpy(target_fh, fh, total_size);
7879     target_fh->handle_bytes = tswap32(fh->handle_bytes);
7880     target_fh->handle_type = tswap32(fh->handle_type);
7881     g_free(fh);
7882     unlock_user(target_fh, handle, total_size);
7883 
7884     if (put_user_s32(mid, mount_id)) {
7885         return -TARGET_EFAULT;
7886     }
7887 
7888     return ret;
7889 
7890 }
7891 #endif
7892 
7893 #if defined(TARGET_NR_open_by_handle_at) && defined(CONFIG_OPEN_BY_HANDLE)
7894 static abi_long do_open_by_handle_at(abi_long mount_fd, abi_long handle,
7895                                      abi_long flags)
7896 {
7897     struct file_handle *target_fh;
7898     struct file_handle *fh;
7899     unsigned int size, total_size;
7900     abi_long ret;
7901 
7902     if (get_user_s32(size, handle)) {
7903         return -TARGET_EFAULT;
7904     }
7905 
7906     total_size = sizeof(struct file_handle) + size;
7907     target_fh = lock_user(VERIFY_READ, handle, total_size, 1);
7908     if (!target_fh) {
7909         return -TARGET_EFAULT;
7910     }
7911 
7912     fh = g_memdup(target_fh, total_size);
7913     fh->handle_bytes = size;
7914     fh->handle_type = tswap32(target_fh->handle_type);
7915 
7916     ret = get_errno(open_by_handle_at(mount_fd, fh,
7917                     target_to_host_bitmask(flags, fcntl_flags_tbl)));
7918 
7919     g_free(fh);
7920 
7921     unlock_user(target_fh, handle, total_size);
7922 
7923     return ret;
7924 }
7925 #endif
7926 
7927 #if defined(TARGET_NR_signalfd) || defined(TARGET_NR_signalfd4)
7928 
7929 static abi_long do_signalfd4(int fd, abi_long mask, int flags)
7930 {
7931     int host_flags;
7932     target_sigset_t *target_mask;
7933     sigset_t host_mask;
7934     abi_long ret;
7935 
7936     if (flags & ~(TARGET_O_NONBLOCK_MASK | TARGET_O_CLOEXEC)) {
7937         return -TARGET_EINVAL;
7938     }
7939     if (!lock_user_struct(VERIFY_READ, target_mask, mask, 1)) {
7940         return -TARGET_EFAULT;
7941     }
7942 
7943     target_to_host_sigset(&host_mask, target_mask);
7944 
7945     host_flags = target_to_host_bitmask(flags, fcntl_flags_tbl);
7946 
7947     ret = get_errno(signalfd(fd, &host_mask, host_flags));
7948     if (ret >= 0) {
7949         fd_trans_register(ret, &target_signalfd_trans);
7950     }
7951 
7952     unlock_user_struct(target_mask, mask, 0);
7953 
7954     return ret;
7955 }
7956 #endif
7957 
7958 /* Map host to target signal numbers for the wait family of syscalls.
7959    Assume all other status bits are the same.  */
7960 int host_to_target_waitstatus(int status)
7961 {
7962     if (WIFSIGNALED(status)) {
7963         return host_to_target_signal(WTERMSIG(status)) | (status & ~0x7f);
7964     }
7965     if (WIFSTOPPED(status)) {
7966         return (host_to_target_signal(WSTOPSIG(status)) << 8)
7967                | (status & 0xff);
7968     }
7969     return status;
7970 }
7971 
7972 static int open_self_cmdline(CPUArchState *cpu_env, int fd)
7973 {
7974     CPUState *cpu = env_cpu(cpu_env);
7975     struct linux_binprm *bprm = ((TaskState *)cpu->opaque)->bprm;
7976     int i;
7977 
7978     for (i = 0; i < bprm->argc; i++) {
7979         size_t len = strlen(bprm->argv[i]) + 1;
7980 
7981         if (write(fd, bprm->argv[i], len) != len) {
7982             return -1;
7983         }
7984     }
7985 
7986     return 0;
7987 }
7988 
7989 static int open_self_maps(CPUArchState *cpu_env, int fd)
7990 {
7991     CPUState *cpu = env_cpu(cpu_env);
7992     TaskState *ts = cpu->opaque;
7993     GSList *map_info = read_self_maps();
7994     GSList *s;
7995     int count;
7996 
7997     for (s = map_info; s; s = g_slist_next(s)) {
7998         MapInfo *e = (MapInfo *) s->data;
7999 
8000         if (h2g_valid(e->start)) {
8001             unsigned long min = e->start;
8002             unsigned long max = e->end;
8003             int flags = page_get_flags(h2g(min));
8004             const char *path;
8005 
8006             max = h2g_valid(max - 1) ?
8007                 max : (uintptr_t) g2h_untagged(GUEST_ADDR_MAX) + 1;
8008 
8009             if (page_check_range(h2g(min), max - min, flags) == -1) {
8010                 continue;
8011             }
8012 
8013 #ifdef TARGET_HPPA
8014             if (h2g(max) == ts->info->stack_limit) {
8015 #else
8016             if (h2g(min) == ts->info->stack_limit) {
8017 #endif
8018                 path = "[stack]";
8019             } else {
8020                 path = e->path;
8021             }
8022 
8023             count = dprintf(fd, TARGET_ABI_FMT_ptr "-" TARGET_ABI_FMT_ptr
8024                             " %c%c%c%c %08" PRIx64 " %s %"PRId64,
8025                             h2g(min), h2g(max - 1) + 1,
8026                             (flags & PAGE_READ) ? 'r' : '-',
8027                             (flags & PAGE_WRITE_ORG) ? 'w' : '-',
8028                             (flags & PAGE_EXEC) ? 'x' : '-',
8029                             e->is_priv ? 'p' : 's',
8030                             (uint64_t) e->offset, e->dev, e->inode);
8031             if (path) {
8032                 dprintf(fd, "%*s%s\n", 73 - count, "", path);
8033             } else {
8034                 dprintf(fd, "\n");
8035             }
8036         }
8037     }
8038 
8039     free_self_maps(map_info);
8040 
8041 #ifdef TARGET_VSYSCALL_PAGE
8042     /*
8043      * We only support execution from the vsyscall page.
8044      * This is as if CONFIG_LEGACY_VSYSCALL_XONLY=y from v5.3.
8045      */
8046     count = dprintf(fd, TARGET_FMT_lx "-" TARGET_FMT_lx
8047                     " --xp 00000000 00:00 0",
8048                     TARGET_VSYSCALL_PAGE, TARGET_VSYSCALL_PAGE + TARGET_PAGE_SIZE);
8049     dprintf(fd, "%*s%s\n", 73 - count, "",  "[vsyscall]");
8050 #endif
8051 
8052     return 0;
8053 }
8054 
8055 static int open_self_stat(CPUArchState *cpu_env, int fd)
8056 {
8057     CPUState *cpu = env_cpu(cpu_env);
8058     TaskState *ts = cpu->opaque;
8059     g_autoptr(GString) buf = g_string_new(NULL);
8060     int i;
8061 
8062     for (i = 0; i < 44; i++) {
8063         if (i == 0) {
8064             /* pid */
8065             g_string_printf(buf, FMT_pid " ", getpid());
8066         } else if (i == 1) {
8067             /* app name */
8068             gchar *bin = g_strrstr(ts->bprm->argv[0], "/");
8069             bin = bin ? bin + 1 : ts->bprm->argv[0];
8070             g_string_printf(buf, "(%.15s) ", bin);
8071         } else if (i == 3) {
8072             /* ppid */
8073             g_string_printf(buf, FMT_pid " ", getppid());
8074         } else if (i == 21) {
8075             /* starttime */
8076             g_string_printf(buf, "%" PRIu64 " ", ts->start_boottime);
8077         } else if (i == 27) {
8078             /* stack bottom */
8079             g_string_printf(buf, TARGET_ABI_FMT_ld " ", ts->info->start_stack);
8080         } else {
8081             /* for the rest, there is MasterCard */
8082             g_string_printf(buf, "0%c", i == 43 ? '\n' : ' ');
8083         }
8084 
8085         if (write(fd, buf->str, buf->len) != buf->len) {
8086             return -1;
8087         }
8088     }
8089 
8090     return 0;
8091 }
8092 
8093 static int open_self_auxv(CPUArchState *cpu_env, int fd)
8094 {
8095     CPUState *cpu = env_cpu(cpu_env);
8096     TaskState *ts = cpu->opaque;
8097     abi_ulong auxv = ts->info->saved_auxv;
8098     abi_ulong len = ts->info->auxv_len;
8099     char *ptr;
8100 
8101     /*
8102      * Auxiliary vector is stored in target process stack.
8103      * read in whole auxv vector and copy it to file
8104      */
8105     ptr = lock_user(VERIFY_READ, auxv, len, 0);
8106     if (ptr != NULL) {
8107         while (len > 0) {
8108             ssize_t r;
8109             r = write(fd, ptr, len);
8110             if (r <= 0) {
8111                 break;
8112             }
8113             len -= r;
8114             ptr += r;
8115         }
8116         lseek(fd, 0, SEEK_SET);
8117         unlock_user(ptr, auxv, len);
8118     }
8119 
8120     return 0;
8121 }
8122 
8123 static int is_proc_myself(const char *filename, const char *entry)
8124 {
8125     if (!strncmp(filename, "/proc/", strlen("/proc/"))) {
8126         filename += strlen("/proc/");
8127         if (!strncmp(filename, "self/", strlen("self/"))) {
8128             filename += strlen("self/");
8129         } else if (*filename >= '1' && *filename <= '9') {
8130             char myself[80];
8131             snprintf(myself, sizeof(myself), "%d/", getpid());
8132             if (!strncmp(filename, myself, strlen(myself))) {
8133                 filename += strlen(myself);
8134             } else {
8135                 return 0;
8136             }
8137         } else {
8138             return 0;
8139         }
8140         if (!strcmp(filename, entry)) {
8141             return 1;
8142         }
8143     }
8144     return 0;
8145 }
8146 
8147 #if HOST_BIG_ENDIAN != TARGET_BIG_ENDIAN || \
8148     defined(TARGET_SPARC) || defined(TARGET_M68K) || defined(TARGET_HPPA)
8149 static int is_proc(const char *filename, const char *entry)
8150 {
8151     return strcmp(filename, entry) == 0;
8152 }
8153 #endif
8154 
8155 #if HOST_BIG_ENDIAN != TARGET_BIG_ENDIAN
8156 static int open_net_route(CPUArchState *cpu_env, int fd)
8157 {
8158     FILE *fp;
8159     char *line = NULL;
8160     size_t len = 0;
8161     ssize_t read;
8162 
8163     fp = fopen("/proc/net/route", "r");
8164     if (fp == NULL) {
8165         return -1;
8166     }
8167 
8168     /* read header */
8169 
8170     read = getline(&line, &len, fp);
8171     dprintf(fd, "%s", line);
8172 
8173     /* read routes */
8174 
8175     while ((read = getline(&line, &len, fp)) != -1) {
8176         char iface[16];
8177         uint32_t dest, gw, mask;
8178         unsigned int flags, refcnt, use, metric, mtu, window, irtt;
8179         int fields;
8180 
8181         fields = sscanf(line,
8182                         "%s\t%08x\t%08x\t%04x\t%d\t%d\t%d\t%08x\t%d\t%u\t%u\n",
8183                         iface, &dest, &gw, &flags, &refcnt, &use, &metric,
8184                         &mask, &mtu, &window, &irtt);
8185         if (fields != 11) {
8186             continue;
8187         }
8188         dprintf(fd, "%s\t%08x\t%08x\t%04x\t%d\t%d\t%d\t%08x\t%d\t%u\t%u\n",
8189                 iface, tswap32(dest), tswap32(gw), flags, refcnt, use,
8190                 metric, tswap32(mask), mtu, window, irtt);
8191     }
8192 
8193     free(line);
8194     fclose(fp);
8195 
8196     return 0;
8197 }
8198 #endif
8199 
8200 #if defined(TARGET_SPARC)
8201 static int open_cpuinfo(CPUArchState *cpu_env, int fd)
8202 {
8203     dprintf(fd, "type\t\t: sun4u\n");
8204     return 0;
8205 }
8206 #endif
8207 
8208 #if defined(TARGET_HPPA)
8209 static int open_cpuinfo(CPUArchState *cpu_env, int fd)
8210 {
8211     dprintf(fd, "cpu family\t: PA-RISC 1.1e\n");
8212     dprintf(fd, "cpu\t\t: PA7300LC (PCX-L2)\n");
8213     dprintf(fd, "capabilities\t: os32\n");
8214     dprintf(fd, "model\t\t: 9000/778/B160L\n");
8215     dprintf(fd, "model name\t: Merlin L2 160 QEMU (9000/778/B160L)\n");
8216     return 0;
8217 }
8218 #endif
8219 
8220 #if defined(TARGET_M68K)
8221 static int open_hardware(CPUArchState *cpu_env, int fd)
8222 {
8223     dprintf(fd, "Model:\t\tqemu-m68k\n");
8224     return 0;
8225 }
8226 #endif
8227 
8228 static int do_openat(CPUArchState *cpu_env, int dirfd, const char *pathname, int flags, mode_t mode)
8229 {
8230     struct fake_open {
8231         const char *filename;
8232         int (*fill)(CPUArchState *cpu_env, int fd);
8233         int (*cmp)(const char *s1, const char *s2);
8234     };
8235     const struct fake_open *fake_open;
8236     static const struct fake_open fakes[] = {
8237         { "maps", open_self_maps, is_proc_myself },
8238         { "stat", open_self_stat, is_proc_myself },
8239         { "auxv", open_self_auxv, is_proc_myself },
8240         { "cmdline", open_self_cmdline, is_proc_myself },
8241 #if HOST_BIG_ENDIAN != TARGET_BIG_ENDIAN
8242         { "/proc/net/route", open_net_route, is_proc },
8243 #endif
8244 #if defined(TARGET_SPARC) || defined(TARGET_HPPA)
8245         { "/proc/cpuinfo", open_cpuinfo, is_proc },
8246 #endif
8247 #if defined(TARGET_M68K)
8248         { "/proc/hardware", open_hardware, is_proc },
8249 #endif
8250         { NULL, NULL, NULL }
8251     };
8252 
8253     if (is_proc_myself(pathname, "exe")) {
8254         int execfd = qemu_getauxval(AT_EXECFD);
8255         return execfd ? execfd : safe_openat(dirfd, exec_path, flags, mode);
8256     }
8257 
8258     for (fake_open = fakes; fake_open->filename; fake_open++) {
8259         if (fake_open->cmp(pathname, fake_open->filename)) {
8260             break;
8261         }
8262     }
8263 
8264     if (fake_open->filename) {
8265         const char *tmpdir;
8266         char filename[PATH_MAX];
8267         int fd, r;
8268 
8269         fd = memfd_create("qemu-open", 0);
8270         if (fd < 0) {
8271             if (errno != ENOSYS) {
8272                 return fd;
8273             }
8274             /* create temporary file to map stat to */
8275             tmpdir = getenv("TMPDIR");
8276             if (!tmpdir)
8277                 tmpdir = "/tmp";
8278             snprintf(filename, sizeof(filename), "%s/qemu-open.XXXXXX", tmpdir);
8279             fd = mkstemp(filename);
8280             if (fd < 0) {
8281                 return fd;
8282             }
8283             unlink(filename);
8284         }
8285 
8286         if ((r = fake_open->fill(cpu_env, fd))) {
8287             int e = errno;
8288             close(fd);
8289             errno = e;
8290             return r;
8291         }
8292         lseek(fd, 0, SEEK_SET);
8293 
8294         return fd;
8295     }
8296 
8297     return safe_openat(dirfd, path(pathname), flags, mode);
8298 }
8299 
8300 #define TIMER_MAGIC 0x0caf0000
8301 #define TIMER_MAGIC_MASK 0xffff0000
8302 
8303 /* Convert QEMU provided timer ID back to internal 16bit index format */
8304 static target_timer_t get_timer_id(abi_long arg)
8305 {
8306     target_timer_t timerid = arg;
8307 
8308     if ((timerid & TIMER_MAGIC_MASK) != TIMER_MAGIC) {
8309         return -TARGET_EINVAL;
8310     }
8311 
8312     timerid &= 0xffff;
8313 
8314     if (timerid >= ARRAY_SIZE(g_posix_timers)) {
8315         return -TARGET_EINVAL;
8316     }
8317 
8318     return timerid;
8319 }
8320 
8321 static int target_to_host_cpu_mask(unsigned long *host_mask,
8322                                    size_t host_size,
8323                                    abi_ulong target_addr,
8324                                    size_t target_size)
8325 {
8326     unsigned target_bits = sizeof(abi_ulong) * 8;
8327     unsigned host_bits = sizeof(*host_mask) * 8;
8328     abi_ulong *target_mask;
8329     unsigned i, j;
8330 
8331     assert(host_size >= target_size);
8332 
8333     target_mask = lock_user(VERIFY_READ, target_addr, target_size, 1);
8334     if (!target_mask) {
8335         return -TARGET_EFAULT;
8336     }
8337     memset(host_mask, 0, host_size);
8338 
8339     for (i = 0 ; i < target_size / sizeof(abi_ulong); i++) {
8340         unsigned bit = i * target_bits;
8341         abi_ulong val;
8342 
8343         __get_user(val, &target_mask[i]);
8344         for (j = 0; j < target_bits; j++, bit++) {
8345             if (val & (1UL << j)) {
8346                 host_mask[bit / host_bits] |= 1UL << (bit % host_bits);
8347             }
8348         }
8349     }
8350 
8351     unlock_user(target_mask, target_addr, 0);
8352     return 0;
8353 }
8354 
8355 static int host_to_target_cpu_mask(const unsigned long *host_mask,
8356                                    size_t host_size,
8357                                    abi_ulong target_addr,
8358                                    size_t target_size)
8359 {
8360     unsigned target_bits = sizeof(abi_ulong) * 8;
8361     unsigned host_bits = sizeof(*host_mask) * 8;
8362     abi_ulong *target_mask;
8363     unsigned i, j;
8364 
8365     assert(host_size >= target_size);
8366 
8367     target_mask = lock_user(VERIFY_WRITE, target_addr, target_size, 0);
8368     if (!target_mask) {
8369         return -TARGET_EFAULT;
8370     }
8371 
8372     for (i = 0 ; i < target_size / sizeof(abi_ulong); i++) {
8373         unsigned bit = i * target_bits;
8374         abi_ulong val = 0;
8375 
8376         for (j = 0; j < target_bits; j++, bit++) {
8377             if (host_mask[bit / host_bits] & (1UL << (bit % host_bits))) {
8378                 val |= 1UL << j;
8379             }
8380         }
8381         __put_user(val, &target_mask[i]);
8382     }
8383 
8384     unlock_user(target_mask, target_addr, target_size);
8385     return 0;
8386 }
8387 
8388 #ifdef TARGET_NR_getdents
8389 static int do_getdents(abi_long dirfd, abi_long arg2, abi_long count)
8390 {
8391     g_autofree void *hdirp = NULL;
8392     void *tdirp;
8393     int hlen, hoff, toff;
8394     int hreclen, treclen;
8395     off64_t prev_diroff = 0;
8396 
8397     hdirp = g_try_malloc(count);
8398     if (!hdirp) {
8399         return -TARGET_ENOMEM;
8400     }
8401 
8402 #ifdef EMULATE_GETDENTS_WITH_GETDENTS
8403     hlen = sys_getdents(dirfd, hdirp, count);
8404 #else
8405     hlen = sys_getdents64(dirfd, hdirp, count);
8406 #endif
8407 
8408     hlen = get_errno(hlen);
8409     if (is_error(hlen)) {
8410         return hlen;
8411     }
8412 
8413     tdirp = lock_user(VERIFY_WRITE, arg2, count, 0);
8414     if (!tdirp) {
8415         return -TARGET_EFAULT;
8416     }
8417 
8418     for (hoff = toff = 0; hoff < hlen; hoff += hreclen, toff += treclen) {
8419 #ifdef EMULATE_GETDENTS_WITH_GETDENTS
8420         struct linux_dirent *hde = hdirp + hoff;
8421 #else
8422         struct linux_dirent64 *hde = hdirp + hoff;
8423 #endif
8424         struct target_dirent *tde = tdirp + toff;
8425         int namelen;
8426         uint8_t type;
8427 
8428         namelen = strlen(hde->d_name);
8429         hreclen = hde->d_reclen;
8430         treclen = offsetof(struct target_dirent, d_name) + namelen + 2;
8431         treclen = QEMU_ALIGN_UP(treclen, __alignof(struct target_dirent));
8432 
8433         if (toff + treclen > count) {
8434             /*
8435              * If the host struct is smaller than the target struct, or
8436              * requires less alignment and thus packs into less space,
8437              * then the host can return more entries than we can pass
8438              * on to the guest.
8439              */
8440             if (toff == 0) {
8441                 toff = -TARGET_EINVAL; /* result buffer is too small */
8442                 break;
8443             }
8444             /*
8445              * Return what we have, resetting the file pointer to the
8446              * location of the first record not returned.
8447              */
8448             lseek64(dirfd, prev_diroff, SEEK_SET);
8449             break;
8450         }
8451 
8452         prev_diroff = hde->d_off;
8453         tde->d_ino = tswapal(hde->d_ino);
8454         tde->d_off = tswapal(hde->d_off);
8455         tde->d_reclen = tswap16(treclen);
8456         memcpy(tde->d_name, hde->d_name, namelen + 1);
8457 
8458         /*
8459          * The getdents type is in what was formerly a padding byte at the
8460          * end of the structure.
8461          */
8462 #ifdef EMULATE_GETDENTS_WITH_GETDENTS
8463         type = *((uint8_t *)hde + hreclen - 1);
8464 #else
8465         type = hde->d_type;
8466 #endif
8467         *((uint8_t *)tde + treclen - 1) = type;
8468     }
8469 
8470     unlock_user(tdirp, arg2, toff);
8471     return toff;
8472 }
8473 #endif /* TARGET_NR_getdents */
8474 
8475 #if defined(TARGET_NR_getdents64) && defined(__NR_getdents64)
8476 static int do_getdents64(abi_long dirfd, abi_long arg2, abi_long count)
8477 {
8478     g_autofree void *hdirp = NULL;
8479     void *tdirp;
8480     int hlen, hoff, toff;
8481     int hreclen, treclen;
8482     off64_t prev_diroff = 0;
8483 
8484     hdirp = g_try_malloc(count);
8485     if (!hdirp) {
8486         return -TARGET_ENOMEM;
8487     }
8488 
8489     hlen = get_errno(sys_getdents64(dirfd, hdirp, count));
8490     if (is_error(hlen)) {
8491         return hlen;
8492     }
8493 
8494     tdirp = lock_user(VERIFY_WRITE, arg2, count, 0);
8495     if (!tdirp) {
8496         return -TARGET_EFAULT;
8497     }
8498 
8499     for (hoff = toff = 0; hoff < hlen; hoff += hreclen, toff += treclen) {
8500         struct linux_dirent64 *hde = hdirp + hoff;
8501         struct target_dirent64 *tde = tdirp + toff;
8502         int namelen;
8503 
8504         namelen = strlen(hde->d_name) + 1;
8505         hreclen = hde->d_reclen;
8506         treclen = offsetof(struct target_dirent64, d_name) + namelen;
8507         treclen = QEMU_ALIGN_UP(treclen, __alignof(struct target_dirent64));
8508 
8509         if (toff + treclen > count) {
8510             /*
8511              * If the host struct is smaller than the target struct, or
8512              * requires less alignment and thus packs into less space,
8513              * then the host can return more entries than we can pass
8514              * on to the guest.
8515              */
8516             if (toff == 0) {
8517                 toff = -TARGET_EINVAL; /* result buffer is too small */
8518                 break;
8519             }
8520             /*
8521              * Return what we have, resetting the file pointer to the
8522              * location of the first record not returned.
8523              */
8524             lseek64(dirfd, prev_diroff, SEEK_SET);
8525             break;
8526         }
8527 
8528         prev_diroff = hde->d_off;
8529         tde->d_ino = tswap64(hde->d_ino);
8530         tde->d_off = tswap64(hde->d_off);
8531         tde->d_reclen = tswap16(treclen);
8532         tde->d_type = hde->d_type;
8533         memcpy(tde->d_name, hde->d_name, namelen);
8534     }
8535 
8536     unlock_user(tdirp, arg2, toff);
8537     return toff;
8538 }
8539 #endif /* TARGET_NR_getdents64 */
8540 
8541 #if defined(TARGET_NR_pivot_root) && defined(__NR_pivot_root)
8542 _syscall2(int, pivot_root, const char *, new_root, const char *, put_old)
8543 #endif
8544 
8545 /* This is an internal helper for do_syscall so that it is easier
8546  * to have a single return point, so that actions, such as logging
8547  * of syscall results, can be performed.
8548  * All errnos that do_syscall() returns must be -TARGET_<errcode>.
8549  */
8550 static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
8551                             abi_long arg2, abi_long arg3, abi_long arg4,
8552                             abi_long arg5, abi_long arg6, abi_long arg7,
8553                             abi_long arg8)
8554 {
8555     CPUState *cpu = env_cpu(cpu_env);
8556     abi_long ret;
8557 #if defined(TARGET_NR_stat) || defined(TARGET_NR_stat64) \
8558     || defined(TARGET_NR_lstat) || defined(TARGET_NR_lstat64) \
8559     || defined(TARGET_NR_fstat) || defined(TARGET_NR_fstat64) \
8560     || defined(TARGET_NR_statx)
8561     struct stat st;
8562 #endif
8563 #if defined(TARGET_NR_statfs) || defined(TARGET_NR_statfs64) \
8564     || defined(TARGET_NR_fstatfs)
8565     struct statfs stfs;
8566 #endif
8567     void *p;
8568 
8569     switch(num) {
8570     case TARGET_NR_exit:
8571         /* In old applications this may be used to implement _exit(2).
8572            However in threaded applications it is used for thread termination,
8573            and _exit_group is used for application termination.
8574            Do thread termination if we have more then one thread.  */
8575 
8576         if (block_signals()) {
8577             return -QEMU_ERESTARTSYS;
8578         }
8579 
8580         pthread_mutex_lock(&clone_lock);
8581 
8582         if (CPU_NEXT(first_cpu)) {
8583             TaskState *ts = cpu->opaque;
8584 
8585             object_property_set_bool(OBJECT(cpu), "realized", false, NULL);
8586             object_unref(OBJECT(cpu));
8587             /*
8588              * At this point the CPU should be unrealized and removed
8589              * from cpu lists. We can clean-up the rest of the thread
8590              * data without the lock held.
8591              */
8592 
8593             pthread_mutex_unlock(&clone_lock);
8594 
8595             if (ts->child_tidptr) {
8596                 put_user_u32(0, ts->child_tidptr);
8597                 do_sys_futex(g2h(cpu, ts->child_tidptr),
8598                              FUTEX_WAKE, INT_MAX, NULL, NULL, 0);
8599             }
8600             thread_cpu = NULL;
8601             g_free(ts);
8602             rcu_unregister_thread();
8603             pthread_exit(NULL);
8604         }
8605 
8606         pthread_mutex_unlock(&clone_lock);
8607         preexit_cleanup(cpu_env, arg1);
8608         _exit(arg1);
8609         return 0; /* avoid warning */
8610     case TARGET_NR_read:
8611         if (arg2 == 0 && arg3 == 0) {
8612             return get_errno(safe_read(arg1, 0, 0));
8613         } else {
8614             if (!(p = lock_user(VERIFY_WRITE, arg2, arg3, 0)))
8615                 return -TARGET_EFAULT;
8616             ret = get_errno(safe_read(arg1, p, arg3));
8617             if (ret >= 0 &&
8618                 fd_trans_host_to_target_data(arg1)) {
8619                 ret = fd_trans_host_to_target_data(arg1)(p, ret);
8620             }
8621             unlock_user(p, arg2, ret);
8622         }
8623         return ret;
8624     case TARGET_NR_write:
8625         if (arg2 == 0 && arg3 == 0) {
8626             return get_errno(safe_write(arg1, 0, 0));
8627         }
8628         if (!(p = lock_user(VERIFY_READ, arg2, arg3, 1)))
8629             return -TARGET_EFAULT;
8630         if (fd_trans_target_to_host_data(arg1)) {
8631             void *copy = g_malloc(arg3);
8632             memcpy(copy, p, arg3);
8633             ret = fd_trans_target_to_host_data(arg1)(copy, arg3);
8634             if (ret >= 0) {
8635                 ret = get_errno(safe_write(arg1, copy, ret));
8636             }
8637             g_free(copy);
8638         } else {
8639             ret = get_errno(safe_write(arg1, p, arg3));
8640         }
8641         unlock_user(p, arg2, 0);
8642         return ret;
8643 
8644 #ifdef TARGET_NR_open
8645     case TARGET_NR_open:
8646         if (!(p = lock_user_string(arg1)))
8647             return -TARGET_EFAULT;
8648         ret = get_errno(do_openat(cpu_env, AT_FDCWD, p,
8649                                   target_to_host_bitmask(arg2, fcntl_flags_tbl),
8650                                   arg3));
8651         fd_trans_unregister(ret);
8652         unlock_user(p, arg1, 0);
8653         return ret;
8654 #endif
8655     case TARGET_NR_openat:
8656         if (!(p = lock_user_string(arg2)))
8657             return -TARGET_EFAULT;
8658         ret = get_errno(do_openat(cpu_env, arg1, p,
8659                                   target_to_host_bitmask(arg3, fcntl_flags_tbl),
8660                                   arg4));
8661         fd_trans_unregister(ret);
8662         unlock_user(p, arg2, 0);
8663         return ret;
8664 #if defined(TARGET_NR_name_to_handle_at) && defined(CONFIG_OPEN_BY_HANDLE)
8665     case TARGET_NR_name_to_handle_at:
8666         ret = do_name_to_handle_at(arg1, arg2, arg3, arg4, arg5);
8667         return ret;
8668 #endif
8669 #if defined(TARGET_NR_open_by_handle_at) && defined(CONFIG_OPEN_BY_HANDLE)
8670     case TARGET_NR_open_by_handle_at:
8671         ret = do_open_by_handle_at(arg1, arg2, arg3);
8672         fd_trans_unregister(ret);
8673         return ret;
8674 #endif
8675 #if defined(__NR_pidfd_open) && defined(TARGET_NR_pidfd_open)
8676     case TARGET_NR_pidfd_open:
8677         return get_errno(pidfd_open(arg1, arg2));
8678 #endif
8679 #if defined(__NR_pidfd_send_signal) && defined(TARGET_NR_pidfd_send_signal)
8680     case TARGET_NR_pidfd_send_signal:
8681         {
8682             siginfo_t uinfo, *puinfo;
8683 
8684             if (arg3) {
8685                 p = lock_user(VERIFY_READ, arg3, sizeof(target_siginfo_t), 1);
8686                 if (!p) {
8687                     return -TARGET_EFAULT;
8688                  }
8689                  target_to_host_siginfo(&uinfo, p);
8690                  unlock_user(p, arg3, 0);
8691                  puinfo = &uinfo;
8692             } else {
8693                  puinfo = NULL;
8694             }
8695             ret = get_errno(pidfd_send_signal(arg1, target_to_host_signal(arg2),
8696                                               puinfo, arg4));
8697         }
8698         return ret;
8699 #endif
8700 #if defined(__NR_pidfd_getfd) && defined(TARGET_NR_pidfd_getfd)
8701     case TARGET_NR_pidfd_getfd:
8702         return get_errno(pidfd_getfd(arg1, arg2, arg3));
8703 #endif
8704     case TARGET_NR_close:
8705         fd_trans_unregister(arg1);
8706         return get_errno(close(arg1));
8707 
8708     case TARGET_NR_brk:
8709         return do_brk(arg1);
8710 #ifdef TARGET_NR_fork
8711     case TARGET_NR_fork:
8712         return get_errno(do_fork(cpu_env, TARGET_SIGCHLD, 0, 0, 0, 0));
8713 #endif
8714 #ifdef TARGET_NR_waitpid
8715     case TARGET_NR_waitpid:
8716         {
8717             int status;
8718             ret = get_errno(safe_wait4(arg1, &status, arg3, 0));
8719             if (!is_error(ret) && arg2 && ret
8720                 && put_user_s32(host_to_target_waitstatus(status), arg2))
8721                 return -TARGET_EFAULT;
8722         }
8723         return ret;
8724 #endif
8725 #ifdef TARGET_NR_waitid
8726     case TARGET_NR_waitid:
8727         {
8728             siginfo_t info;
8729             info.si_pid = 0;
8730             ret = get_errno(safe_waitid(arg1, arg2, &info, arg4, NULL));
8731             if (!is_error(ret) && arg3 && info.si_pid != 0) {
8732                 if (!(p = lock_user(VERIFY_WRITE, arg3, sizeof(target_siginfo_t), 0)))
8733                     return -TARGET_EFAULT;
8734                 host_to_target_siginfo(p, &info);
8735                 unlock_user(p, arg3, sizeof(target_siginfo_t));
8736             }
8737         }
8738         return ret;
8739 #endif
8740 #ifdef TARGET_NR_creat /* not on alpha */
8741     case TARGET_NR_creat:
8742         if (!(p = lock_user_string(arg1)))
8743             return -TARGET_EFAULT;
8744         ret = get_errno(creat(p, arg2));
8745         fd_trans_unregister(ret);
8746         unlock_user(p, arg1, 0);
8747         return ret;
8748 #endif
8749 #ifdef TARGET_NR_link
8750     case TARGET_NR_link:
8751         {
8752             void * p2;
8753             p = lock_user_string(arg1);
8754             p2 = lock_user_string(arg2);
8755             if (!p || !p2)
8756                 ret = -TARGET_EFAULT;
8757             else
8758                 ret = get_errno(link(p, p2));
8759             unlock_user(p2, arg2, 0);
8760             unlock_user(p, arg1, 0);
8761         }
8762         return ret;
8763 #endif
8764 #if defined(TARGET_NR_linkat)
8765     case TARGET_NR_linkat:
8766         {
8767             void * p2 = NULL;
8768             if (!arg2 || !arg4)
8769                 return -TARGET_EFAULT;
8770             p  = lock_user_string(arg2);
8771             p2 = lock_user_string(arg4);
8772             if (!p || !p2)
8773                 ret = -TARGET_EFAULT;
8774             else
8775                 ret = get_errno(linkat(arg1, p, arg3, p2, arg5));
8776             unlock_user(p, arg2, 0);
8777             unlock_user(p2, arg4, 0);
8778         }
8779         return ret;
8780 #endif
8781 #ifdef TARGET_NR_unlink
8782     case TARGET_NR_unlink:
8783         if (!(p = lock_user_string(arg1)))
8784             return -TARGET_EFAULT;
8785         ret = get_errno(unlink(p));
8786         unlock_user(p, arg1, 0);
8787         return ret;
8788 #endif
8789 #if defined(TARGET_NR_unlinkat)
8790     case TARGET_NR_unlinkat:
8791         if (!(p = lock_user_string(arg2)))
8792             return -TARGET_EFAULT;
8793         ret = get_errno(unlinkat(arg1, p, arg3));
8794         unlock_user(p, arg2, 0);
8795         return ret;
8796 #endif
8797     case TARGET_NR_execve:
8798         {
8799             char **argp, **envp;
8800             int argc, envc;
8801             abi_ulong gp;
8802             abi_ulong guest_argp;
8803             abi_ulong guest_envp;
8804             abi_ulong addr;
8805             char **q;
8806 
8807             argc = 0;
8808             guest_argp = arg2;
8809             for (gp = guest_argp; gp; gp += sizeof(abi_ulong)) {
8810                 if (get_user_ual(addr, gp))
8811                     return -TARGET_EFAULT;
8812                 if (!addr)
8813                     break;
8814                 argc++;
8815             }
8816             envc = 0;
8817             guest_envp = arg3;
8818             for (gp = guest_envp; gp; gp += sizeof(abi_ulong)) {
8819                 if (get_user_ual(addr, gp))
8820                     return -TARGET_EFAULT;
8821                 if (!addr)
8822                     break;
8823                 envc++;
8824             }
8825 
8826             argp = g_new0(char *, argc + 1);
8827             envp = g_new0(char *, envc + 1);
8828 
8829             for (gp = guest_argp, q = argp; gp;
8830                   gp += sizeof(abi_ulong), q++) {
8831                 if (get_user_ual(addr, gp))
8832                     goto execve_efault;
8833                 if (!addr)
8834                     break;
8835                 if (!(*q = lock_user_string(addr)))
8836                     goto execve_efault;
8837             }
8838             *q = NULL;
8839 
8840             for (gp = guest_envp, q = envp; gp;
8841                   gp += sizeof(abi_ulong), q++) {
8842                 if (get_user_ual(addr, gp))
8843                     goto execve_efault;
8844                 if (!addr)
8845                     break;
8846                 if (!(*q = lock_user_string(addr)))
8847                     goto execve_efault;
8848             }
8849             *q = NULL;
8850 
8851             if (!(p = lock_user_string(arg1)))
8852                 goto execve_efault;
8853             /* Although execve() is not an interruptible syscall it is
8854              * a special case where we must use the safe_syscall wrapper:
8855              * if we allow a signal to happen before we make the host
8856              * syscall then we will 'lose' it, because at the point of
8857              * execve the process leaves QEMU's control. So we use the
8858              * safe syscall wrapper to ensure that we either take the
8859              * signal as a guest signal, or else it does not happen
8860              * before the execve completes and makes it the other
8861              * program's problem.
8862              */
8863             if (is_proc_myself(p, "exe")) {
8864                 ret = get_errno(safe_execve(exec_path, argp, envp));
8865             } else {
8866                 ret = get_errno(safe_execve(p, argp, envp));
8867             }
8868             unlock_user(p, arg1, 0);
8869 
8870             goto execve_end;
8871 
8872         execve_efault:
8873             ret = -TARGET_EFAULT;
8874 
8875         execve_end:
8876             for (gp = guest_argp, q = argp; *q;
8877                   gp += sizeof(abi_ulong), q++) {
8878                 if (get_user_ual(addr, gp)
8879                     || !addr)
8880                     break;
8881                 unlock_user(*q, addr, 0);
8882             }
8883             for (gp = guest_envp, q = envp; *q;
8884                   gp += sizeof(abi_ulong), q++) {
8885                 if (get_user_ual(addr, gp)
8886                     || !addr)
8887                     break;
8888                 unlock_user(*q, addr, 0);
8889             }
8890 
8891             g_free(argp);
8892             g_free(envp);
8893         }
8894         return ret;
8895     case TARGET_NR_chdir:
8896         if (!(p = lock_user_string(arg1)))
8897             return -TARGET_EFAULT;
8898         ret = get_errno(chdir(p));
8899         unlock_user(p, arg1, 0);
8900         return ret;
8901 #ifdef TARGET_NR_time
8902     case TARGET_NR_time:
8903         {
8904             time_t host_time;
8905             ret = get_errno(time(&host_time));
8906             if (!is_error(ret)
8907                 && arg1
8908                 && put_user_sal(host_time, arg1))
8909                 return -TARGET_EFAULT;
8910         }
8911         return ret;
8912 #endif
8913 #ifdef TARGET_NR_mknod
8914     case TARGET_NR_mknod:
8915         if (!(p = lock_user_string(arg1)))
8916             return -TARGET_EFAULT;
8917         ret = get_errno(mknod(p, arg2, arg3));
8918         unlock_user(p, arg1, 0);
8919         return ret;
8920 #endif
8921 #if defined(TARGET_NR_mknodat)
8922     case TARGET_NR_mknodat:
8923         if (!(p = lock_user_string(arg2)))
8924             return -TARGET_EFAULT;
8925         ret = get_errno(mknodat(arg1, p, arg3, arg4));
8926         unlock_user(p, arg2, 0);
8927         return ret;
8928 #endif
8929 #ifdef TARGET_NR_chmod
8930     case TARGET_NR_chmod:
8931         if (!(p = lock_user_string(arg1)))
8932             return -TARGET_EFAULT;
8933         ret = get_errno(chmod(p, arg2));
8934         unlock_user(p, arg1, 0);
8935         return ret;
8936 #endif
8937 #ifdef TARGET_NR_lseek
8938     case TARGET_NR_lseek:
8939         return get_errno(lseek(arg1, arg2, arg3));
8940 #endif
8941 #if defined(TARGET_NR_getxpid) && defined(TARGET_ALPHA)
8942     /* Alpha specific */
8943     case TARGET_NR_getxpid:
8944         cpu_env->ir[IR_A4] = getppid();
8945         return get_errno(getpid());
8946 #endif
8947 #ifdef TARGET_NR_getpid
8948     case TARGET_NR_getpid:
8949         return get_errno(getpid());
8950 #endif
8951     case TARGET_NR_mount:
8952         {
8953             /* need to look at the data field */
8954             void *p2, *p3;
8955 
8956             if (arg1) {
8957                 p = lock_user_string(arg1);
8958                 if (!p) {
8959                     return -TARGET_EFAULT;
8960                 }
8961             } else {
8962                 p = NULL;
8963             }
8964 
8965             p2 = lock_user_string(arg2);
8966             if (!p2) {
8967                 if (arg1) {
8968                     unlock_user(p, arg1, 0);
8969                 }
8970                 return -TARGET_EFAULT;
8971             }
8972 
8973             if (arg3) {
8974                 p3 = lock_user_string(arg3);
8975                 if (!p3) {
8976                     if (arg1) {
8977                         unlock_user(p, arg1, 0);
8978                     }
8979                     unlock_user(p2, arg2, 0);
8980                     return -TARGET_EFAULT;
8981                 }
8982             } else {
8983                 p3 = NULL;
8984             }
8985 
8986             /* FIXME - arg5 should be locked, but it isn't clear how to
8987              * do that since it's not guaranteed to be a NULL-terminated
8988              * string.
8989              */
8990             if (!arg5) {
8991                 ret = mount(p, p2, p3, (unsigned long)arg4, NULL);
8992             } else {
8993                 ret = mount(p, p2, p3, (unsigned long)arg4, g2h(cpu, arg5));
8994             }
8995             ret = get_errno(ret);
8996 
8997             if (arg1) {
8998                 unlock_user(p, arg1, 0);
8999             }
9000             unlock_user(p2, arg2, 0);
9001             if (arg3) {
9002                 unlock_user(p3, arg3, 0);
9003             }
9004         }
9005         return ret;
9006 #if defined(TARGET_NR_umount) || defined(TARGET_NR_oldumount)
9007 #if defined(TARGET_NR_umount)
9008     case TARGET_NR_umount:
9009 #endif
9010 #if defined(TARGET_NR_oldumount)
9011     case TARGET_NR_oldumount:
9012 #endif
9013         if (!(p = lock_user_string(arg1)))
9014             return -TARGET_EFAULT;
9015         ret = get_errno(umount(p));
9016         unlock_user(p, arg1, 0);
9017         return ret;
9018 #endif
9019 #ifdef TARGET_NR_stime /* not on alpha */
9020     case TARGET_NR_stime:
9021         {
9022             struct timespec ts;
9023             ts.tv_nsec = 0;
9024             if (get_user_sal(ts.tv_sec, arg1)) {
9025                 return -TARGET_EFAULT;
9026             }
9027             return get_errno(clock_settime(CLOCK_REALTIME, &ts));
9028         }
9029 #endif
9030 #ifdef TARGET_NR_alarm /* not on alpha */
9031     case TARGET_NR_alarm:
9032         return alarm(arg1);
9033 #endif
9034 #ifdef TARGET_NR_pause /* not on alpha */
9035     case TARGET_NR_pause:
9036         if (!block_signals()) {
9037             sigsuspend(&((TaskState *)cpu->opaque)->signal_mask);
9038         }
9039         return -TARGET_EINTR;
9040 #endif
9041 #ifdef TARGET_NR_utime
9042     case TARGET_NR_utime:
9043         {
9044             struct utimbuf tbuf, *host_tbuf;
9045             struct target_utimbuf *target_tbuf;
9046             if (arg2) {
9047                 if (!lock_user_struct(VERIFY_READ, target_tbuf, arg2, 1))
9048                     return -TARGET_EFAULT;
9049                 tbuf.actime = tswapal(target_tbuf->actime);
9050                 tbuf.modtime = tswapal(target_tbuf->modtime);
9051                 unlock_user_struct(target_tbuf, arg2, 0);
9052                 host_tbuf = &tbuf;
9053             } else {
9054                 host_tbuf = NULL;
9055             }
9056             if (!(p = lock_user_string(arg1)))
9057                 return -TARGET_EFAULT;
9058             ret = get_errno(utime(p, host_tbuf));
9059             unlock_user(p, arg1, 0);
9060         }
9061         return ret;
9062 #endif
9063 #ifdef TARGET_NR_utimes
9064     case TARGET_NR_utimes:
9065         {
9066             struct timeval *tvp, tv[2];
9067             if (arg2) {
9068                 if (copy_from_user_timeval(&tv[0], arg2)
9069                     || copy_from_user_timeval(&tv[1],
9070                                               arg2 + sizeof(struct target_timeval)))
9071                     return -TARGET_EFAULT;
9072                 tvp = tv;
9073             } else {
9074                 tvp = NULL;
9075             }
9076             if (!(p = lock_user_string(arg1)))
9077                 return -TARGET_EFAULT;
9078             ret = get_errno(utimes(p, tvp));
9079             unlock_user(p, arg1, 0);
9080         }
9081         return ret;
9082 #endif
9083 #if defined(TARGET_NR_futimesat)
9084     case TARGET_NR_futimesat:
9085         {
9086             struct timeval *tvp, tv[2];
9087             if (arg3) {
9088                 if (copy_from_user_timeval(&tv[0], arg3)
9089                     || copy_from_user_timeval(&tv[1],
9090                                               arg3 + sizeof(struct target_timeval)))
9091                     return -TARGET_EFAULT;
9092                 tvp = tv;
9093             } else {
9094                 tvp = NULL;
9095             }
9096             if (!(p = lock_user_string(arg2))) {
9097                 return -TARGET_EFAULT;
9098             }
9099             ret = get_errno(futimesat(arg1, path(p), tvp));
9100             unlock_user(p, arg2, 0);
9101         }
9102         return ret;
9103 #endif
9104 #ifdef TARGET_NR_access
9105     case TARGET_NR_access:
9106         if (!(p = lock_user_string(arg1))) {
9107             return -TARGET_EFAULT;
9108         }
9109         ret = get_errno(access(path(p), arg2));
9110         unlock_user(p, arg1, 0);
9111         return ret;
9112 #endif
9113 #if defined(TARGET_NR_faccessat) && defined(__NR_faccessat)
9114     case TARGET_NR_faccessat:
9115         if (!(p = lock_user_string(arg2))) {
9116             return -TARGET_EFAULT;
9117         }
9118         ret = get_errno(faccessat(arg1, p, arg3, 0));
9119         unlock_user(p, arg2, 0);
9120         return ret;
9121 #endif
9122 #ifdef TARGET_NR_nice /* not on alpha */
9123     case TARGET_NR_nice:
9124         return get_errno(nice(arg1));
9125 #endif
9126     case TARGET_NR_sync:
9127         sync();
9128         return 0;
9129 #if defined(TARGET_NR_syncfs) && defined(CONFIG_SYNCFS)
9130     case TARGET_NR_syncfs:
9131         return get_errno(syncfs(arg1));
9132 #endif
9133     case TARGET_NR_kill:
9134         return get_errno(safe_kill(arg1, target_to_host_signal(arg2)));
9135 #ifdef TARGET_NR_rename
9136     case TARGET_NR_rename:
9137         {
9138             void *p2;
9139             p = lock_user_string(arg1);
9140             p2 = lock_user_string(arg2);
9141             if (!p || !p2)
9142                 ret = -TARGET_EFAULT;
9143             else
9144                 ret = get_errno(rename(p, p2));
9145             unlock_user(p2, arg2, 0);
9146             unlock_user(p, arg1, 0);
9147         }
9148         return ret;
9149 #endif
9150 #if defined(TARGET_NR_renameat)
9151     case TARGET_NR_renameat:
9152         {
9153             void *p2;
9154             p  = lock_user_string(arg2);
9155             p2 = lock_user_string(arg4);
9156             if (!p || !p2)
9157                 ret = -TARGET_EFAULT;
9158             else
9159                 ret = get_errno(renameat(arg1, p, arg3, p2));
9160             unlock_user(p2, arg4, 0);
9161             unlock_user(p, arg2, 0);
9162         }
9163         return ret;
9164 #endif
9165 #if defined(TARGET_NR_renameat2)
9166     case TARGET_NR_renameat2:
9167         {
9168             void *p2;
9169             p  = lock_user_string(arg2);
9170             p2 = lock_user_string(arg4);
9171             if (!p || !p2) {
9172                 ret = -TARGET_EFAULT;
9173             } else {
9174                 ret = get_errno(sys_renameat2(arg1, p, arg3, p2, arg5));
9175             }
9176             unlock_user(p2, arg4, 0);
9177             unlock_user(p, arg2, 0);
9178         }
9179         return ret;
9180 #endif
9181 #ifdef TARGET_NR_mkdir
9182     case TARGET_NR_mkdir:
9183         if (!(p = lock_user_string(arg1)))
9184             return -TARGET_EFAULT;
9185         ret = get_errno(mkdir(p, arg2));
9186         unlock_user(p, arg1, 0);
9187         return ret;
9188 #endif
9189 #if defined(TARGET_NR_mkdirat)
9190     case TARGET_NR_mkdirat:
9191         if (!(p = lock_user_string(arg2)))
9192             return -TARGET_EFAULT;
9193         ret = get_errno(mkdirat(arg1, p, arg3));
9194         unlock_user(p, arg2, 0);
9195         return ret;
9196 #endif
9197 #ifdef TARGET_NR_rmdir
9198     case TARGET_NR_rmdir:
9199         if (!(p = lock_user_string(arg1)))
9200             return -TARGET_EFAULT;
9201         ret = get_errno(rmdir(p));
9202         unlock_user(p, arg1, 0);
9203         return ret;
9204 #endif
9205     case TARGET_NR_dup:
9206         ret = get_errno(dup(arg1));
9207         if (ret >= 0) {
9208             fd_trans_dup(arg1, ret);
9209         }
9210         return ret;
9211 #ifdef TARGET_NR_pipe
9212     case TARGET_NR_pipe:
9213         return do_pipe(cpu_env, arg1, 0, 0);
9214 #endif
9215 #ifdef TARGET_NR_pipe2
9216     case TARGET_NR_pipe2:
9217         return do_pipe(cpu_env, arg1,
9218                        target_to_host_bitmask(arg2, fcntl_flags_tbl), 1);
9219 #endif
9220     case TARGET_NR_times:
9221         {
9222             struct target_tms *tmsp;
9223             struct tms tms;
9224             ret = get_errno(times(&tms));
9225             if (arg1) {
9226                 tmsp = lock_user(VERIFY_WRITE, arg1, sizeof(struct target_tms), 0);
9227                 if (!tmsp)
9228                     return -TARGET_EFAULT;
9229                 tmsp->tms_utime = tswapal(host_to_target_clock_t(tms.tms_utime));
9230                 tmsp->tms_stime = tswapal(host_to_target_clock_t(tms.tms_stime));
9231                 tmsp->tms_cutime = tswapal(host_to_target_clock_t(tms.tms_cutime));
9232                 tmsp->tms_cstime = tswapal(host_to_target_clock_t(tms.tms_cstime));
9233             }
9234             if (!is_error(ret))
9235                 ret = host_to_target_clock_t(ret);
9236         }
9237         return ret;
9238     case TARGET_NR_acct:
9239         if (arg1 == 0) {
9240             ret = get_errno(acct(NULL));
9241         } else {
9242             if (!(p = lock_user_string(arg1))) {
9243                 return -TARGET_EFAULT;
9244             }
9245             ret = get_errno(acct(path(p)));
9246             unlock_user(p, arg1, 0);
9247         }
9248         return ret;
9249 #ifdef TARGET_NR_umount2
9250     case TARGET_NR_umount2:
9251         if (!(p = lock_user_string(arg1)))
9252             return -TARGET_EFAULT;
9253         ret = get_errno(umount2(p, arg2));
9254         unlock_user(p, arg1, 0);
9255         return ret;
9256 #endif
9257     case TARGET_NR_ioctl:
9258         return do_ioctl(arg1, arg2, arg3);
9259 #ifdef TARGET_NR_fcntl
9260     case TARGET_NR_fcntl:
9261         return do_fcntl(arg1, arg2, arg3);
9262 #endif
9263     case TARGET_NR_setpgid:
9264         return get_errno(setpgid(arg1, arg2));
9265     case TARGET_NR_umask:
9266         return get_errno(umask(arg1));
9267     case TARGET_NR_chroot:
9268         if (!(p = lock_user_string(arg1)))
9269             return -TARGET_EFAULT;
9270         ret = get_errno(chroot(p));
9271         unlock_user(p, arg1, 0);
9272         return ret;
9273 #ifdef TARGET_NR_dup2
9274     case TARGET_NR_dup2:
9275         ret = get_errno(dup2(arg1, arg2));
9276         if (ret >= 0) {
9277             fd_trans_dup(arg1, arg2);
9278         }
9279         return ret;
9280 #endif
9281 #if defined(CONFIG_DUP3) && defined(TARGET_NR_dup3)
9282     case TARGET_NR_dup3:
9283     {
9284         int host_flags;
9285 
9286         if ((arg3 & ~TARGET_O_CLOEXEC) != 0) {
9287             return -EINVAL;
9288         }
9289         host_flags = target_to_host_bitmask(arg3, fcntl_flags_tbl);
9290         ret = get_errno(dup3(arg1, arg2, host_flags));
9291         if (ret >= 0) {
9292             fd_trans_dup(arg1, arg2);
9293         }
9294         return ret;
9295     }
9296 #endif
9297 #ifdef TARGET_NR_getppid /* not on alpha */
9298     case TARGET_NR_getppid:
9299         return get_errno(getppid());
9300 #endif
9301 #ifdef TARGET_NR_getpgrp
9302     case TARGET_NR_getpgrp:
9303         return get_errno(getpgrp());
9304 #endif
9305     case TARGET_NR_setsid:
9306         return get_errno(setsid());
9307 #ifdef TARGET_NR_sigaction
9308     case TARGET_NR_sigaction:
9309         {
9310 #if defined(TARGET_MIPS)
9311 	    struct target_sigaction act, oact, *pact, *old_act;
9312 
9313 	    if (arg2) {
9314                 if (!lock_user_struct(VERIFY_READ, old_act, arg2, 1))
9315                     return -TARGET_EFAULT;
9316 		act._sa_handler = old_act->_sa_handler;
9317 		target_siginitset(&act.sa_mask, old_act->sa_mask.sig[0]);
9318 		act.sa_flags = old_act->sa_flags;
9319 		unlock_user_struct(old_act, arg2, 0);
9320 		pact = &act;
9321 	    } else {
9322 		pact = NULL;
9323 	    }
9324 
9325         ret = get_errno(do_sigaction(arg1, pact, &oact, 0));
9326 
9327 	    if (!is_error(ret) && arg3) {
9328                 if (!lock_user_struct(VERIFY_WRITE, old_act, arg3, 0))
9329                     return -TARGET_EFAULT;
9330 		old_act->_sa_handler = oact._sa_handler;
9331 		old_act->sa_flags = oact.sa_flags;
9332 		old_act->sa_mask.sig[0] = oact.sa_mask.sig[0];
9333 		old_act->sa_mask.sig[1] = 0;
9334 		old_act->sa_mask.sig[2] = 0;
9335 		old_act->sa_mask.sig[3] = 0;
9336 		unlock_user_struct(old_act, arg3, 1);
9337 	    }
9338 #else
9339             struct target_old_sigaction *old_act;
9340             struct target_sigaction act, oact, *pact;
9341             if (arg2) {
9342                 if (!lock_user_struct(VERIFY_READ, old_act, arg2, 1))
9343                     return -TARGET_EFAULT;
9344                 act._sa_handler = old_act->_sa_handler;
9345                 target_siginitset(&act.sa_mask, old_act->sa_mask);
9346                 act.sa_flags = old_act->sa_flags;
9347 #ifdef TARGET_ARCH_HAS_SA_RESTORER
9348                 act.sa_restorer = old_act->sa_restorer;
9349 #endif
9350                 unlock_user_struct(old_act, arg2, 0);
9351                 pact = &act;
9352             } else {
9353                 pact = NULL;
9354             }
9355             ret = get_errno(do_sigaction(arg1, pact, &oact, 0));
9356             if (!is_error(ret) && arg3) {
9357                 if (!lock_user_struct(VERIFY_WRITE, old_act, arg3, 0))
9358                     return -TARGET_EFAULT;
9359                 old_act->_sa_handler = oact._sa_handler;
9360                 old_act->sa_mask = oact.sa_mask.sig[0];
9361                 old_act->sa_flags = oact.sa_flags;
9362 #ifdef TARGET_ARCH_HAS_SA_RESTORER
9363                 old_act->sa_restorer = oact.sa_restorer;
9364 #endif
9365                 unlock_user_struct(old_act, arg3, 1);
9366             }
9367 #endif
9368         }
9369         return ret;
9370 #endif
9371     case TARGET_NR_rt_sigaction:
9372         {
9373             /*
9374              * For Alpha and SPARC this is a 5 argument syscall, with
9375              * a 'restorer' parameter which must be copied into the
9376              * sa_restorer field of the sigaction struct.
9377              * For Alpha that 'restorer' is arg5; for SPARC it is arg4,
9378              * and arg5 is the sigsetsize.
9379              */
9380 #if defined(TARGET_ALPHA)
9381             target_ulong sigsetsize = arg4;
9382             target_ulong restorer = arg5;
9383 #elif defined(TARGET_SPARC)
9384             target_ulong restorer = arg4;
9385             target_ulong sigsetsize = arg5;
9386 #else
9387             target_ulong sigsetsize = arg4;
9388             target_ulong restorer = 0;
9389 #endif
9390             struct target_sigaction *act = NULL;
9391             struct target_sigaction *oact = NULL;
9392 
9393             if (sigsetsize != sizeof(target_sigset_t)) {
9394                 return -TARGET_EINVAL;
9395             }
9396             if (arg2 && !lock_user_struct(VERIFY_READ, act, arg2, 1)) {
9397                 return -TARGET_EFAULT;
9398             }
9399             if (arg3 && !lock_user_struct(VERIFY_WRITE, oact, arg3, 0)) {
9400                 ret = -TARGET_EFAULT;
9401             } else {
9402                 ret = get_errno(do_sigaction(arg1, act, oact, restorer));
9403                 if (oact) {
9404                     unlock_user_struct(oact, arg3, 1);
9405                 }
9406             }
9407             if (act) {
9408                 unlock_user_struct(act, arg2, 0);
9409             }
9410         }
9411         return ret;
9412 #ifdef TARGET_NR_sgetmask /* not on alpha */
9413     case TARGET_NR_sgetmask:
9414         {
9415             sigset_t cur_set;
9416             abi_ulong target_set;
9417             ret = do_sigprocmask(0, NULL, &cur_set);
9418             if (!ret) {
9419                 host_to_target_old_sigset(&target_set, &cur_set);
9420                 ret = target_set;
9421             }
9422         }
9423         return ret;
9424 #endif
9425 #ifdef TARGET_NR_ssetmask /* not on alpha */
9426     case TARGET_NR_ssetmask:
9427         {
9428             sigset_t set, oset;
9429             abi_ulong target_set = arg1;
9430             target_to_host_old_sigset(&set, &target_set);
9431             ret = do_sigprocmask(SIG_SETMASK, &set, &oset);
9432             if (!ret) {
9433                 host_to_target_old_sigset(&target_set, &oset);
9434                 ret = target_set;
9435             }
9436         }
9437         return ret;
9438 #endif
9439 #ifdef TARGET_NR_sigprocmask
9440     case TARGET_NR_sigprocmask:
9441         {
9442 #if defined(TARGET_ALPHA)
9443             sigset_t set, oldset;
9444             abi_ulong mask;
9445             int how;
9446 
9447             switch (arg1) {
9448             case TARGET_SIG_BLOCK:
9449                 how = SIG_BLOCK;
9450                 break;
9451             case TARGET_SIG_UNBLOCK:
9452                 how = SIG_UNBLOCK;
9453                 break;
9454             case TARGET_SIG_SETMASK:
9455                 how = SIG_SETMASK;
9456                 break;
9457             default:
9458                 return -TARGET_EINVAL;
9459             }
9460             mask = arg2;
9461             target_to_host_old_sigset(&set, &mask);
9462 
9463             ret = do_sigprocmask(how, &set, &oldset);
9464             if (!is_error(ret)) {
9465                 host_to_target_old_sigset(&mask, &oldset);
9466                 ret = mask;
9467                 cpu_env->ir[IR_V0] = 0; /* force no error */
9468             }
9469 #else
9470             sigset_t set, oldset, *set_ptr;
9471             int how;
9472 
9473             if (arg2) {
9474                 p = lock_user(VERIFY_READ, arg2, sizeof(target_sigset_t), 1);
9475                 if (!p) {
9476                     return -TARGET_EFAULT;
9477                 }
9478                 target_to_host_old_sigset(&set, p);
9479                 unlock_user(p, arg2, 0);
9480                 set_ptr = &set;
9481                 switch (arg1) {
9482                 case TARGET_SIG_BLOCK:
9483                     how = SIG_BLOCK;
9484                     break;
9485                 case TARGET_SIG_UNBLOCK:
9486                     how = SIG_UNBLOCK;
9487                     break;
9488                 case TARGET_SIG_SETMASK:
9489                     how = SIG_SETMASK;
9490                     break;
9491                 default:
9492                     return -TARGET_EINVAL;
9493                 }
9494             } else {
9495                 how = 0;
9496                 set_ptr = NULL;
9497             }
9498             ret = do_sigprocmask(how, set_ptr, &oldset);
9499             if (!is_error(ret) && arg3) {
9500                 if (!(p = lock_user(VERIFY_WRITE, arg3, sizeof(target_sigset_t), 0)))
9501                     return -TARGET_EFAULT;
9502                 host_to_target_old_sigset(p, &oldset);
9503                 unlock_user(p, arg3, sizeof(target_sigset_t));
9504             }
9505 #endif
9506         }
9507         return ret;
9508 #endif
9509     case TARGET_NR_rt_sigprocmask:
9510         {
9511             int how = arg1;
9512             sigset_t set, oldset, *set_ptr;
9513 
9514             if (arg4 != sizeof(target_sigset_t)) {
9515                 return -TARGET_EINVAL;
9516             }
9517 
9518             if (arg2) {
9519                 p = lock_user(VERIFY_READ, arg2, sizeof(target_sigset_t), 1);
9520                 if (!p) {
9521                     return -TARGET_EFAULT;
9522                 }
9523                 target_to_host_sigset(&set, p);
9524                 unlock_user(p, arg2, 0);
9525                 set_ptr = &set;
9526                 switch(how) {
9527                 case TARGET_SIG_BLOCK:
9528                     how = SIG_BLOCK;
9529                     break;
9530                 case TARGET_SIG_UNBLOCK:
9531                     how = SIG_UNBLOCK;
9532                     break;
9533                 case TARGET_SIG_SETMASK:
9534                     how = SIG_SETMASK;
9535                     break;
9536                 default:
9537                     return -TARGET_EINVAL;
9538                 }
9539             } else {
9540                 how = 0;
9541                 set_ptr = NULL;
9542             }
9543             ret = do_sigprocmask(how, set_ptr, &oldset);
9544             if (!is_error(ret) && arg3) {
9545                 if (!(p = lock_user(VERIFY_WRITE, arg3, sizeof(target_sigset_t), 0)))
9546                     return -TARGET_EFAULT;
9547                 host_to_target_sigset(p, &oldset);
9548                 unlock_user(p, arg3, sizeof(target_sigset_t));
9549             }
9550         }
9551         return ret;
9552 #ifdef TARGET_NR_sigpending
9553     case TARGET_NR_sigpending:
9554         {
9555             sigset_t set;
9556             ret = get_errno(sigpending(&set));
9557             if (!is_error(ret)) {
9558                 if (!(p = lock_user(VERIFY_WRITE, arg1, sizeof(target_sigset_t), 0)))
9559                     return -TARGET_EFAULT;
9560                 host_to_target_old_sigset(p, &set);
9561                 unlock_user(p, arg1, sizeof(target_sigset_t));
9562             }
9563         }
9564         return ret;
9565 #endif
9566     case TARGET_NR_rt_sigpending:
9567         {
9568             sigset_t set;
9569 
9570             /* Yes, this check is >, not != like most. We follow the kernel's
9571              * logic and it does it like this because it implements
9572              * NR_sigpending through the same code path, and in that case
9573              * the old_sigset_t is smaller in size.
9574              */
9575             if (arg2 > sizeof(target_sigset_t)) {
9576                 return -TARGET_EINVAL;
9577             }
9578 
9579             ret = get_errno(sigpending(&set));
9580             if (!is_error(ret)) {
9581                 if (!(p = lock_user(VERIFY_WRITE, arg1, sizeof(target_sigset_t), 0)))
9582                     return -TARGET_EFAULT;
9583                 host_to_target_sigset(p, &set);
9584                 unlock_user(p, arg1, sizeof(target_sigset_t));
9585             }
9586         }
9587         return ret;
9588 #ifdef TARGET_NR_sigsuspend
9589     case TARGET_NR_sigsuspend:
9590         {
9591             sigset_t *set;
9592 
9593 #if defined(TARGET_ALPHA)
9594             TaskState *ts = cpu->opaque;
9595             /* target_to_host_old_sigset will bswap back */
9596             abi_ulong mask = tswapal(arg1);
9597             set = &ts->sigsuspend_mask;
9598             target_to_host_old_sigset(set, &mask);
9599 #else
9600             ret = process_sigsuspend_mask(&set, arg1, sizeof(target_sigset_t));
9601             if (ret != 0) {
9602                 return ret;
9603             }
9604 #endif
9605             ret = get_errno(safe_rt_sigsuspend(set, SIGSET_T_SIZE));
9606             finish_sigsuspend_mask(ret);
9607         }
9608         return ret;
9609 #endif
9610     case TARGET_NR_rt_sigsuspend:
9611         {
9612             sigset_t *set;
9613 
9614             ret = process_sigsuspend_mask(&set, arg1, arg2);
9615             if (ret != 0) {
9616                 return ret;
9617             }
9618             ret = get_errno(safe_rt_sigsuspend(set, SIGSET_T_SIZE));
9619             finish_sigsuspend_mask(ret);
9620         }
9621         return ret;
9622 #ifdef TARGET_NR_rt_sigtimedwait
9623     case TARGET_NR_rt_sigtimedwait:
9624         {
9625             sigset_t set;
9626             struct timespec uts, *puts;
9627             siginfo_t uinfo;
9628 
9629             if (arg4 != sizeof(target_sigset_t)) {
9630                 return -TARGET_EINVAL;
9631             }
9632 
9633             if (!(p = lock_user(VERIFY_READ, arg1, sizeof(target_sigset_t), 1)))
9634                 return -TARGET_EFAULT;
9635             target_to_host_sigset(&set, p);
9636             unlock_user(p, arg1, 0);
9637             if (arg3) {
9638                 puts = &uts;
9639                 if (target_to_host_timespec(puts, arg3)) {
9640                     return -TARGET_EFAULT;
9641                 }
9642             } else {
9643                 puts = NULL;
9644             }
9645             ret = get_errno(safe_rt_sigtimedwait(&set, &uinfo, puts,
9646                                                  SIGSET_T_SIZE));
9647             if (!is_error(ret)) {
9648                 if (arg2) {
9649                     p = lock_user(VERIFY_WRITE, arg2, sizeof(target_siginfo_t),
9650                                   0);
9651                     if (!p) {
9652                         return -TARGET_EFAULT;
9653                     }
9654                     host_to_target_siginfo(p, &uinfo);
9655                     unlock_user(p, arg2, sizeof(target_siginfo_t));
9656                 }
9657                 ret = host_to_target_signal(ret);
9658             }
9659         }
9660         return ret;
9661 #endif
9662 #ifdef TARGET_NR_rt_sigtimedwait_time64
9663     case TARGET_NR_rt_sigtimedwait_time64:
9664         {
9665             sigset_t set;
9666             struct timespec uts, *puts;
9667             siginfo_t uinfo;
9668 
9669             if (arg4 != sizeof(target_sigset_t)) {
9670                 return -TARGET_EINVAL;
9671             }
9672 
9673             p = lock_user(VERIFY_READ, arg1, sizeof(target_sigset_t), 1);
9674             if (!p) {
9675                 return -TARGET_EFAULT;
9676             }
9677             target_to_host_sigset(&set, p);
9678             unlock_user(p, arg1, 0);
9679             if (arg3) {
9680                 puts = &uts;
9681                 if (target_to_host_timespec64(puts, arg3)) {
9682                     return -TARGET_EFAULT;
9683                 }
9684             } else {
9685                 puts = NULL;
9686             }
9687             ret = get_errno(safe_rt_sigtimedwait(&set, &uinfo, puts,
9688                                                  SIGSET_T_SIZE));
9689             if (!is_error(ret)) {
9690                 if (arg2) {
9691                     p = lock_user(VERIFY_WRITE, arg2,
9692                                   sizeof(target_siginfo_t), 0);
9693                     if (!p) {
9694                         return -TARGET_EFAULT;
9695                     }
9696                     host_to_target_siginfo(p, &uinfo);
9697                     unlock_user(p, arg2, sizeof(target_siginfo_t));
9698                 }
9699                 ret = host_to_target_signal(ret);
9700             }
9701         }
9702         return ret;
9703 #endif
9704     case TARGET_NR_rt_sigqueueinfo:
9705         {
9706             siginfo_t uinfo;
9707 
9708             p = lock_user(VERIFY_READ, arg3, sizeof(target_siginfo_t), 1);
9709             if (!p) {
9710                 return -TARGET_EFAULT;
9711             }
9712             target_to_host_siginfo(&uinfo, p);
9713             unlock_user(p, arg3, 0);
9714             ret = get_errno(sys_rt_sigqueueinfo(arg1, target_to_host_signal(arg2), &uinfo));
9715         }
9716         return ret;
9717     case TARGET_NR_rt_tgsigqueueinfo:
9718         {
9719             siginfo_t uinfo;
9720 
9721             p = lock_user(VERIFY_READ, arg4, sizeof(target_siginfo_t), 1);
9722             if (!p) {
9723                 return -TARGET_EFAULT;
9724             }
9725             target_to_host_siginfo(&uinfo, p);
9726             unlock_user(p, arg4, 0);
9727             ret = get_errno(sys_rt_tgsigqueueinfo(arg1, arg2, target_to_host_signal(arg3), &uinfo));
9728         }
9729         return ret;
9730 #ifdef TARGET_NR_sigreturn
9731     case TARGET_NR_sigreturn:
9732         if (block_signals()) {
9733             return -QEMU_ERESTARTSYS;
9734         }
9735         return do_sigreturn(cpu_env);
9736 #endif
9737     case TARGET_NR_rt_sigreturn:
9738         if (block_signals()) {
9739             return -QEMU_ERESTARTSYS;
9740         }
9741         return do_rt_sigreturn(cpu_env);
9742     case TARGET_NR_sethostname:
9743         if (!(p = lock_user_string(arg1)))
9744             return -TARGET_EFAULT;
9745         ret = get_errno(sethostname(p, arg2));
9746         unlock_user(p, arg1, 0);
9747         return ret;
9748 #ifdef TARGET_NR_setrlimit
9749     case TARGET_NR_setrlimit:
9750         {
9751             int resource = target_to_host_resource(arg1);
9752             struct target_rlimit *target_rlim;
9753             struct rlimit rlim;
9754             if (!lock_user_struct(VERIFY_READ, target_rlim, arg2, 1))
9755                 return -TARGET_EFAULT;
9756             rlim.rlim_cur = target_to_host_rlim(target_rlim->rlim_cur);
9757             rlim.rlim_max = target_to_host_rlim(target_rlim->rlim_max);
9758             unlock_user_struct(target_rlim, arg2, 0);
9759             /*
9760              * If we just passed through resource limit settings for memory then
9761              * they would also apply to QEMU's own allocations, and QEMU will
9762              * crash or hang or die if its allocations fail. Ideally we would
9763              * track the guest allocations in QEMU and apply the limits ourselves.
9764              * For now, just tell the guest the call succeeded but don't actually
9765              * limit anything.
9766              */
9767             if (resource != RLIMIT_AS &&
9768                 resource != RLIMIT_DATA &&
9769                 resource != RLIMIT_STACK) {
9770                 return get_errno(setrlimit(resource, &rlim));
9771             } else {
9772                 return 0;
9773             }
9774         }
9775 #endif
9776 #ifdef TARGET_NR_getrlimit
9777     case TARGET_NR_getrlimit:
9778         {
9779             int resource = target_to_host_resource(arg1);
9780             struct target_rlimit *target_rlim;
9781             struct rlimit rlim;
9782 
9783             ret = get_errno(getrlimit(resource, &rlim));
9784             if (!is_error(ret)) {
9785                 if (!lock_user_struct(VERIFY_WRITE, target_rlim, arg2, 0))
9786                     return -TARGET_EFAULT;
9787                 target_rlim->rlim_cur = host_to_target_rlim(rlim.rlim_cur);
9788                 target_rlim->rlim_max = host_to_target_rlim(rlim.rlim_max);
9789                 unlock_user_struct(target_rlim, arg2, 1);
9790             }
9791         }
9792         return ret;
9793 #endif
9794     case TARGET_NR_getrusage:
9795         {
9796             struct rusage rusage;
9797             ret = get_errno(getrusage(arg1, &rusage));
9798             if (!is_error(ret)) {
9799                 ret = host_to_target_rusage(arg2, &rusage);
9800             }
9801         }
9802         return ret;
9803 #if defined(TARGET_NR_gettimeofday)
9804     case TARGET_NR_gettimeofday:
9805         {
9806             struct timeval tv;
9807             struct timezone tz;
9808 
9809             ret = get_errno(gettimeofday(&tv, &tz));
9810             if (!is_error(ret)) {
9811                 if (arg1 && copy_to_user_timeval(arg1, &tv)) {
9812                     return -TARGET_EFAULT;
9813                 }
9814                 if (arg2 && copy_to_user_timezone(arg2, &tz)) {
9815                     return -TARGET_EFAULT;
9816                 }
9817             }
9818         }
9819         return ret;
9820 #endif
9821 #if defined(TARGET_NR_settimeofday)
9822     case TARGET_NR_settimeofday:
9823         {
9824             struct timeval tv, *ptv = NULL;
9825             struct timezone tz, *ptz = NULL;
9826 
9827             if (arg1) {
9828                 if (copy_from_user_timeval(&tv, arg1)) {
9829                     return -TARGET_EFAULT;
9830                 }
9831                 ptv = &tv;
9832             }
9833 
9834             if (arg2) {
9835                 if (copy_from_user_timezone(&tz, arg2)) {
9836                     return -TARGET_EFAULT;
9837                 }
9838                 ptz = &tz;
9839             }
9840 
9841             return get_errno(settimeofday(ptv, ptz));
9842         }
9843 #endif
9844 #if defined(TARGET_NR_select)
9845     case TARGET_NR_select:
9846 #if defined(TARGET_WANT_NI_OLD_SELECT)
9847         /* some architectures used to have old_select here
9848          * but now ENOSYS it.
9849          */
9850         ret = -TARGET_ENOSYS;
9851 #elif defined(TARGET_WANT_OLD_SYS_SELECT)
9852         ret = do_old_select(arg1);
9853 #else
9854         ret = do_select(arg1, arg2, arg3, arg4, arg5);
9855 #endif
9856         return ret;
9857 #endif
9858 #ifdef TARGET_NR_pselect6
9859     case TARGET_NR_pselect6:
9860         return do_pselect6(arg1, arg2, arg3, arg4, arg5, arg6, false);
9861 #endif
9862 #ifdef TARGET_NR_pselect6_time64
9863     case TARGET_NR_pselect6_time64:
9864         return do_pselect6(arg1, arg2, arg3, arg4, arg5, arg6, true);
9865 #endif
9866 #ifdef TARGET_NR_symlink
9867     case TARGET_NR_symlink:
9868         {
9869             void *p2;
9870             p = lock_user_string(arg1);
9871             p2 = lock_user_string(arg2);
9872             if (!p || !p2)
9873                 ret = -TARGET_EFAULT;
9874             else
9875                 ret = get_errno(symlink(p, p2));
9876             unlock_user(p2, arg2, 0);
9877             unlock_user(p, arg1, 0);
9878         }
9879         return ret;
9880 #endif
9881 #if defined(TARGET_NR_symlinkat)
9882     case TARGET_NR_symlinkat:
9883         {
9884             void *p2;
9885             p  = lock_user_string(arg1);
9886             p2 = lock_user_string(arg3);
9887             if (!p || !p2)
9888                 ret = -TARGET_EFAULT;
9889             else
9890                 ret = get_errno(symlinkat(p, arg2, p2));
9891             unlock_user(p2, arg3, 0);
9892             unlock_user(p, arg1, 0);
9893         }
9894         return ret;
9895 #endif
9896 #ifdef TARGET_NR_readlink
9897     case TARGET_NR_readlink:
9898         {
9899             void *p2;
9900             p = lock_user_string(arg1);
9901             p2 = lock_user(VERIFY_WRITE, arg2, arg3, 0);
9902             if (!p || !p2) {
9903                 ret = -TARGET_EFAULT;
9904             } else if (!arg3) {
9905                 /* Short circuit this for the magic exe check. */
9906                 ret = -TARGET_EINVAL;
9907             } else if (is_proc_myself((const char *)p, "exe")) {
9908                 char real[PATH_MAX], *temp;
9909                 temp = realpath(exec_path, real);
9910                 /* Return value is # of bytes that we wrote to the buffer. */
9911                 if (temp == NULL) {
9912                     ret = get_errno(-1);
9913                 } else {
9914                     /* Don't worry about sign mismatch as earlier mapping
9915                      * logic would have thrown a bad address error. */
9916                     ret = MIN(strlen(real), arg3);
9917                     /* We cannot NUL terminate the string. */
9918                     memcpy(p2, real, ret);
9919                 }
9920             } else {
9921                 ret = get_errno(readlink(path(p), p2, arg3));
9922             }
9923             unlock_user(p2, arg2, ret);
9924             unlock_user(p, arg1, 0);
9925         }
9926         return ret;
9927 #endif
9928 #if defined(TARGET_NR_readlinkat)
9929     case TARGET_NR_readlinkat:
9930         {
9931             void *p2;
9932             p  = lock_user_string(arg2);
9933             p2 = lock_user(VERIFY_WRITE, arg3, arg4, 0);
9934             if (!p || !p2) {
9935                 ret = -TARGET_EFAULT;
9936             } else if (!arg4) {
9937                 /* Short circuit this for the magic exe check. */
9938                 ret = -TARGET_EINVAL;
9939             } else if (is_proc_myself((const char *)p, "exe")) {
9940                 char real[PATH_MAX], *temp;
9941                 temp = realpath(exec_path, real);
9942                 /* Return value is # of bytes that we wrote to the buffer. */
9943                 if (temp == NULL) {
9944                     ret = get_errno(-1);
9945                 } else {
9946                     /* Don't worry about sign mismatch as earlier mapping
9947                      * logic would have thrown a bad address error. */
9948                     ret = MIN(strlen(real), arg4);
9949                     /* We cannot NUL terminate the string. */
9950                     memcpy(p2, real, ret);
9951                 }
9952             } else {
9953                 ret = get_errno(readlinkat(arg1, path(p), p2, arg4));
9954             }
9955             unlock_user(p2, arg3, ret);
9956             unlock_user(p, arg2, 0);
9957         }
9958         return ret;
9959 #endif
9960 #ifdef TARGET_NR_swapon
9961     case TARGET_NR_swapon:
9962         if (!(p = lock_user_string(arg1)))
9963             return -TARGET_EFAULT;
9964         ret = get_errno(swapon(p, arg2));
9965         unlock_user(p, arg1, 0);
9966         return ret;
9967 #endif
9968     case TARGET_NR_reboot:
9969         if (arg3 == LINUX_REBOOT_CMD_RESTART2) {
9970            /* arg4 must be ignored in all other cases */
9971            p = lock_user_string(arg4);
9972            if (!p) {
9973                return -TARGET_EFAULT;
9974            }
9975            ret = get_errno(reboot(arg1, arg2, arg3, p));
9976            unlock_user(p, arg4, 0);
9977         } else {
9978            ret = get_errno(reboot(arg1, arg2, arg3, NULL));
9979         }
9980         return ret;
9981 #ifdef TARGET_NR_mmap
9982     case TARGET_NR_mmap:
9983 #if (defined(TARGET_I386) && defined(TARGET_ABI32)) || \
9984     (defined(TARGET_ARM) && defined(TARGET_ABI32)) || \
9985     defined(TARGET_M68K) || defined(TARGET_CRIS) || defined(TARGET_MICROBLAZE) \
9986     || defined(TARGET_S390X)
9987         {
9988             abi_ulong *v;
9989             abi_ulong v1, v2, v3, v4, v5, v6;
9990             if (!(v = lock_user(VERIFY_READ, arg1, 6 * sizeof(abi_ulong), 1)))
9991                 return -TARGET_EFAULT;
9992             v1 = tswapal(v[0]);
9993             v2 = tswapal(v[1]);
9994             v3 = tswapal(v[2]);
9995             v4 = tswapal(v[3]);
9996             v5 = tswapal(v[4]);
9997             v6 = tswapal(v[5]);
9998             unlock_user(v, arg1, 0);
9999             ret = get_errno(target_mmap(v1, v2, v3,
10000                                         target_to_host_bitmask(v4, mmap_flags_tbl),
10001                                         v5, v6));
10002         }
10003 #else
10004         /* mmap pointers are always untagged */
10005         ret = get_errno(target_mmap(arg1, arg2, arg3,
10006                                     target_to_host_bitmask(arg4, mmap_flags_tbl),
10007                                     arg5,
10008                                     arg6));
10009 #endif
10010         return ret;
10011 #endif
10012 #ifdef TARGET_NR_mmap2
10013     case TARGET_NR_mmap2:
10014 #ifndef MMAP_SHIFT
10015 #define MMAP_SHIFT 12
10016 #endif
10017         ret = target_mmap(arg1, arg2, arg3,
10018                           target_to_host_bitmask(arg4, mmap_flags_tbl),
10019                           arg5, arg6 << MMAP_SHIFT);
10020         return get_errno(ret);
10021 #endif
10022     case TARGET_NR_munmap:
10023         arg1 = cpu_untagged_addr(cpu, arg1);
10024         return get_errno(target_munmap(arg1, arg2));
10025     case TARGET_NR_mprotect:
10026         arg1 = cpu_untagged_addr(cpu, arg1);
10027         {
10028             TaskState *ts = cpu->opaque;
10029             /* Special hack to detect libc making the stack executable.  */
10030             if ((arg3 & PROT_GROWSDOWN)
10031                 && arg1 >= ts->info->stack_limit
10032                 && arg1 <= ts->info->start_stack) {
10033                 arg3 &= ~PROT_GROWSDOWN;
10034                 arg2 = arg2 + arg1 - ts->info->stack_limit;
10035                 arg1 = ts->info->stack_limit;
10036             }
10037         }
10038         return get_errno(target_mprotect(arg1, arg2, arg3));
10039 #ifdef TARGET_NR_mremap
10040     case TARGET_NR_mremap:
10041         arg1 = cpu_untagged_addr(cpu, arg1);
10042         /* mremap new_addr (arg5) is always untagged */
10043         return get_errno(target_mremap(arg1, arg2, arg3, arg4, arg5));
10044 #endif
10045         /* ??? msync/mlock/munlock are broken for softmmu.  */
10046 #ifdef TARGET_NR_msync
10047     case TARGET_NR_msync:
10048         return get_errno(msync(g2h(cpu, arg1), arg2, arg3));
10049 #endif
10050 #ifdef TARGET_NR_mlock
10051     case TARGET_NR_mlock:
10052         return get_errno(mlock(g2h(cpu, arg1), arg2));
10053 #endif
10054 #ifdef TARGET_NR_munlock
10055     case TARGET_NR_munlock:
10056         return get_errno(munlock(g2h(cpu, arg1), arg2));
10057 #endif
10058 #ifdef TARGET_NR_mlockall
10059     case TARGET_NR_mlockall:
10060         return get_errno(mlockall(target_to_host_mlockall_arg(arg1)));
10061 #endif
10062 #ifdef TARGET_NR_munlockall
10063     case TARGET_NR_munlockall:
10064         return get_errno(munlockall());
10065 #endif
10066 #ifdef TARGET_NR_truncate
10067     case TARGET_NR_truncate:
10068         if (!(p = lock_user_string(arg1)))
10069             return -TARGET_EFAULT;
10070         ret = get_errno(truncate(p, arg2));
10071         unlock_user(p, arg1, 0);
10072         return ret;
10073 #endif
10074 #ifdef TARGET_NR_ftruncate
10075     case TARGET_NR_ftruncate:
10076         return get_errno(ftruncate(arg1, arg2));
10077 #endif
10078     case TARGET_NR_fchmod:
10079         return get_errno(fchmod(arg1, arg2));
10080 #if defined(TARGET_NR_fchmodat)
10081     case TARGET_NR_fchmodat:
10082         if (!(p = lock_user_string(arg2)))
10083             return -TARGET_EFAULT;
10084         ret = get_errno(fchmodat(arg1, p, arg3, 0));
10085         unlock_user(p, arg2, 0);
10086         return ret;
10087 #endif
10088     case TARGET_NR_getpriority:
10089         /* Note that negative values are valid for getpriority, so we must
10090            differentiate based on errno settings.  */
10091         errno = 0;
10092         ret = getpriority(arg1, arg2);
10093         if (ret == -1 && errno != 0) {
10094             return -host_to_target_errno(errno);
10095         }
10096 #ifdef TARGET_ALPHA
10097         /* Return value is the unbiased priority.  Signal no error.  */
10098         cpu_env->ir[IR_V0] = 0;
10099 #else
10100         /* Return value is a biased priority to avoid negative numbers.  */
10101         ret = 20 - ret;
10102 #endif
10103         return ret;
10104     case TARGET_NR_setpriority:
10105         return get_errno(setpriority(arg1, arg2, arg3));
10106 #ifdef TARGET_NR_statfs
10107     case TARGET_NR_statfs:
10108         if (!(p = lock_user_string(arg1))) {
10109             return -TARGET_EFAULT;
10110         }
10111         ret = get_errno(statfs(path(p), &stfs));
10112         unlock_user(p, arg1, 0);
10113     convert_statfs:
10114         if (!is_error(ret)) {
10115             struct target_statfs *target_stfs;
10116 
10117             if (!lock_user_struct(VERIFY_WRITE, target_stfs, arg2, 0))
10118                 return -TARGET_EFAULT;
10119             __put_user(stfs.f_type, &target_stfs->f_type);
10120             __put_user(stfs.f_bsize, &target_stfs->f_bsize);
10121             __put_user(stfs.f_blocks, &target_stfs->f_blocks);
10122             __put_user(stfs.f_bfree, &target_stfs->f_bfree);
10123             __put_user(stfs.f_bavail, &target_stfs->f_bavail);
10124             __put_user(stfs.f_files, &target_stfs->f_files);
10125             __put_user(stfs.f_ffree, &target_stfs->f_ffree);
10126             __put_user(stfs.f_fsid.__val[0], &target_stfs->f_fsid.val[0]);
10127             __put_user(stfs.f_fsid.__val[1], &target_stfs->f_fsid.val[1]);
10128             __put_user(stfs.f_namelen, &target_stfs->f_namelen);
10129             __put_user(stfs.f_frsize, &target_stfs->f_frsize);
10130 #ifdef _STATFS_F_FLAGS
10131             __put_user(stfs.f_flags, &target_stfs->f_flags);
10132 #else
10133             __put_user(0, &target_stfs->f_flags);
10134 #endif
10135             memset(target_stfs->f_spare, 0, sizeof(target_stfs->f_spare));
10136             unlock_user_struct(target_stfs, arg2, 1);
10137         }
10138         return ret;
10139 #endif
10140 #ifdef TARGET_NR_fstatfs
10141     case TARGET_NR_fstatfs:
10142         ret = get_errno(fstatfs(arg1, &stfs));
10143         goto convert_statfs;
10144 #endif
10145 #ifdef TARGET_NR_statfs64
10146     case TARGET_NR_statfs64:
10147         if (!(p = lock_user_string(arg1))) {
10148             return -TARGET_EFAULT;
10149         }
10150         ret = get_errno(statfs(path(p), &stfs));
10151         unlock_user(p, arg1, 0);
10152     convert_statfs64:
10153         if (!is_error(ret)) {
10154             struct target_statfs64 *target_stfs;
10155 
10156             if (!lock_user_struct(VERIFY_WRITE, target_stfs, arg3, 0))
10157                 return -TARGET_EFAULT;
10158             __put_user(stfs.f_type, &target_stfs->f_type);
10159             __put_user(stfs.f_bsize, &target_stfs->f_bsize);
10160             __put_user(stfs.f_blocks, &target_stfs->f_blocks);
10161             __put_user(stfs.f_bfree, &target_stfs->f_bfree);
10162             __put_user(stfs.f_bavail, &target_stfs->f_bavail);
10163             __put_user(stfs.f_files, &target_stfs->f_files);
10164             __put_user(stfs.f_ffree, &target_stfs->f_ffree);
10165             __put_user(stfs.f_fsid.__val[0], &target_stfs->f_fsid.val[0]);
10166             __put_user(stfs.f_fsid.__val[1], &target_stfs->f_fsid.val[1]);
10167             __put_user(stfs.f_namelen, &target_stfs->f_namelen);
10168             __put_user(stfs.f_frsize, &target_stfs->f_frsize);
10169 #ifdef _STATFS_F_FLAGS
10170             __put_user(stfs.f_flags, &target_stfs->f_flags);
10171 #else
10172             __put_user(0, &target_stfs->f_flags);
10173 #endif
10174             memset(target_stfs->f_spare, 0, sizeof(target_stfs->f_spare));
10175             unlock_user_struct(target_stfs, arg3, 1);
10176         }
10177         return ret;
10178     case TARGET_NR_fstatfs64:
10179         ret = get_errno(fstatfs(arg1, &stfs));
10180         goto convert_statfs64;
10181 #endif
10182 #ifdef TARGET_NR_socketcall
10183     case TARGET_NR_socketcall:
10184         return do_socketcall(arg1, arg2);
10185 #endif
10186 #ifdef TARGET_NR_accept
10187     case TARGET_NR_accept:
10188         return do_accept4(arg1, arg2, arg3, 0);
10189 #endif
10190 #ifdef TARGET_NR_accept4
10191     case TARGET_NR_accept4:
10192         return do_accept4(arg1, arg2, arg3, arg4);
10193 #endif
10194 #ifdef TARGET_NR_bind
10195     case TARGET_NR_bind:
10196         return do_bind(arg1, arg2, arg3);
10197 #endif
10198 #ifdef TARGET_NR_connect
10199     case TARGET_NR_connect:
10200         return do_connect(arg1, arg2, arg3);
10201 #endif
10202 #ifdef TARGET_NR_getpeername
10203     case TARGET_NR_getpeername:
10204         return do_getpeername(arg1, arg2, arg3);
10205 #endif
10206 #ifdef TARGET_NR_getsockname
10207     case TARGET_NR_getsockname:
10208         return do_getsockname(arg1, arg2, arg3);
10209 #endif
10210 #ifdef TARGET_NR_getsockopt
10211     case TARGET_NR_getsockopt:
10212         return do_getsockopt(arg1, arg2, arg3, arg4, arg5);
10213 #endif
10214 #ifdef TARGET_NR_listen
10215     case TARGET_NR_listen:
10216         return get_errno(listen(arg1, arg2));
10217 #endif
10218 #ifdef TARGET_NR_recv
10219     case TARGET_NR_recv:
10220         return do_recvfrom(arg1, arg2, arg3, arg4, 0, 0);
10221 #endif
10222 #ifdef TARGET_NR_recvfrom
10223     case TARGET_NR_recvfrom:
10224         return do_recvfrom(arg1, arg2, arg3, arg4, arg5, arg6);
10225 #endif
10226 #ifdef TARGET_NR_recvmsg
10227     case TARGET_NR_recvmsg:
10228         return do_sendrecvmsg(arg1, arg2, arg3, 0);
10229 #endif
10230 #ifdef TARGET_NR_send
10231     case TARGET_NR_send:
10232         return do_sendto(arg1, arg2, arg3, arg4, 0, 0);
10233 #endif
10234 #ifdef TARGET_NR_sendmsg
10235     case TARGET_NR_sendmsg:
10236         return do_sendrecvmsg(arg1, arg2, arg3, 1);
10237 #endif
10238 #ifdef TARGET_NR_sendmmsg
10239     case TARGET_NR_sendmmsg:
10240         return do_sendrecvmmsg(arg1, arg2, arg3, arg4, 1);
10241 #endif
10242 #ifdef TARGET_NR_recvmmsg
10243     case TARGET_NR_recvmmsg:
10244         return do_sendrecvmmsg(arg1, arg2, arg3, arg4, 0);
10245 #endif
10246 #ifdef TARGET_NR_sendto
10247     case TARGET_NR_sendto:
10248         return do_sendto(arg1, arg2, arg3, arg4, arg5, arg6);
10249 #endif
10250 #ifdef TARGET_NR_shutdown
10251     case TARGET_NR_shutdown:
10252         return get_errno(shutdown(arg1, arg2));
10253 #endif
10254 #if defined(TARGET_NR_getrandom) && defined(__NR_getrandom)
10255     case TARGET_NR_getrandom:
10256         p = lock_user(VERIFY_WRITE, arg1, arg2, 0);
10257         if (!p) {
10258             return -TARGET_EFAULT;
10259         }
10260         ret = get_errno(getrandom(p, arg2, arg3));
10261         unlock_user(p, arg1, ret);
10262         return ret;
10263 #endif
10264 #ifdef TARGET_NR_socket
10265     case TARGET_NR_socket:
10266         return do_socket(arg1, arg2, arg3);
10267 #endif
10268 #ifdef TARGET_NR_socketpair
10269     case TARGET_NR_socketpair:
10270         return do_socketpair(arg1, arg2, arg3, arg4);
10271 #endif
10272 #ifdef TARGET_NR_setsockopt
10273     case TARGET_NR_setsockopt:
10274         return do_setsockopt(arg1, arg2, arg3, arg4, (socklen_t) arg5);
10275 #endif
10276 #if defined(TARGET_NR_syslog)
10277     case TARGET_NR_syslog:
10278         {
10279             int len = arg2;
10280 
10281             switch (arg1) {
10282             case TARGET_SYSLOG_ACTION_CLOSE:         /* Close log */
10283             case TARGET_SYSLOG_ACTION_OPEN:          /* Open log */
10284             case TARGET_SYSLOG_ACTION_CLEAR:         /* Clear ring buffer */
10285             case TARGET_SYSLOG_ACTION_CONSOLE_OFF:   /* Disable logging */
10286             case TARGET_SYSLOG_ACTION_CONSOLE_ON:    /* Enable logging */
10287             case TARGET_SYSLOG_ACTION_CONSOLE_LEVEL: /* Set messages level */
10288             case TARGET_SYSLOG_ACTION_SIZE_UNREAD:   /* Number of chars */
10289             case TARGET_SYSLOG_ACTION_SIZE_BUFFER:   /* Size of the buffer */
10290                 return get_errno(sys_syslog((int)arg1, NULL, (int)arg3));
10291             case TARGET_SYSLOG_ACTION_READ:          /* Read from log */
10292             case TARGET_SYSLOG_ACTION_READ_CLEAR:    /* Read/clear msgs */
10293             case TARGET_SYSLOG_ACTION_READ_ALL:      /* Read last messages */
10294                 {
10295                     if (len < 0) {
10296                         return -TARGET_EINVAL;
10297                     }
10298                     if (len == 0) {
10299                         return 0;
10300                     }
10301                     p = lock_user(VERIFY_WRITE, arg2, arg3, 0);
10302                     if (!p) {
10303                         return -TARGET_EFAULT;
10304                     }
10305                     ret = get_errno(sys_syslog((int)arg1, p, (int)arg3));
10306                     unlock_user(p, arg2, arg3);
10307                 }
10308                 return ret;
10309             default:
10310                 return -TARGET_EINVAL;
10311             }
10312         }
10313         break;
10314 #endif
10315     case TARGET_NR_setitimer:
10316         {
10317             struct itimerval value, ovalue, *pvalue;
10318 
10319             if (arg2) {
10320                 pvalue = &value;
10321                 if (copy_from_user_timeval(&pvalue->it_interval, arg2)
10322                     || copy_from_user_timeval(&pvalue->it_value,
10323                                               arg2 + sizeof(struct target_timeval)))
10324                     return -TARGET_EFAULT;
10325             } else {
10326                 pvalue = NULL;
10327             }
10328             ret = get_errno(setitimer(arg1, pvalue, &ovalue));
10329             if (!is_error(ret) && arg3) {
10330                 if (copy_to_user_timeval(arg3,
10331                                          &ovalue.it_interval)
10332                     || copy_to_user_timeval(arg3 + sizeof(struct target_timeval),
10333                                             &ovalue.it_value))
10334                     return -TARGET_EFAULT;
10335             }
10336         }
10337         return ret;
10338     case TARGET_NR_getitimer:
10339         {
10340             struct itimerval value;
10341 
10342             ret = get_errno(getitimer(arg1, &value));
10343             if (!is_error(ret) && arg2) {
10344                 if (copy_to_user_timeval(arg2,
10345                                          &value.it_interval)
10346                     || copy_to_user_timeval(arg2 + sizeof(struct target_timeval),
10347                                             &value.it_value))
10348                     return -TARGET_EFAULT;
10349             }
10350         }
10351         return ret;
10352 #ifdef TARGET_NR_stat
10353     case TARGET_NR_stat:
10354         if (!(p = lock_user_string(arg1))) {
10355             return -TARGET_EFAULT;
10356         }
10357         ret = get_errno(stat(path(p), &st));
10358         unlock_user(p, arg1, 0);
10359         goto do_stat;
10360 #endif
10361 #ifdef TARGET_NR_lstat
10362     case TARGET_NR_lstat:
10363         if (!(p = lock_user_string(arg1))) {
10364             return -TARGET_EFAULT;
10365         }
10366         ret = get_errno(lstat(path(p), &st));
10367         unlock_user(p, arg1, 0);
10368         goto do_stat;
10369 #endif
10370 #ifdef TARGET_NR_fstat
10371     case TARGET_NR_fstat:
10372         {
10373             ret = get_errno(fstat(arg1, &st));
10374 #if defined(TARGET_NR_stat) || defined(TARGET_NR_lstat)
10375         do_stat:
10376 #endif
10377             if (!is_error(ret)) {
10378                 struct target_stat *target_st;
10379 
10380                 if (!lock_user_struct(VERIFY_WRITE, target_st, arg2, 0))
10381                     return -TARGET_EFAULT;
10382                 memset(target_st, 0, sizeof(*target_st));
10383                 __put_user(st.st_dev, &target_st->st_dev);
10384                 __put_user(st.st_ino, &target_st->st_ino);
10385                 __put_user(st.st_mode, &target_st->st_mode);
10386                 __put_user(st.st_uid, &target_st->st_uid);
10387                 __put_user(st.st_gid, &target_st->st_gid);
10388                 __put_user(st.st_nlink, &target_st->st_nlink);
10389                 __put_user(st.st_rdev, &target_st->st_rdev);
10390                 __put_user(st.st_size, &target_st->st_size);
10391                 __put_user(st.st_blksize, &target_st->st_blksize);
10392                 __put_user(st.st_blocks, &target_st->st_blocks);
10393                 __put_user(st.st_atime, &target_st->target_st_atime);
10394                 __put_user(st.st_mtime, &target_st->target_st_mtime);
10395                 __put_user(st.st_ctime, &target_st->target_st_ctime);
10396 #if defined(HAVE_STRUCT_STAT_ST_ATIM) && defined(TARGET_STAT_HAVE_NSEC)
10397                 __put_user(st.st_atim.tv_nsec,
10398                            &target_st->target_st_atime_nsec);
10399                 __put_user(st.st_mtim.tv_nsec,
10400                            &target_st->target_st_mtime_nsec);
10401                 __put_user(st.st_ctim.tv_nsec,
10402                            &target_st->target_st_ctime_nsec);
10403 #endif
10404                 unlock_user_struct(target_st, arg2, 1);
10405             }
10406         }
10407         return ret;
10408 #endif
10409     case TARGET_NR_vhangup:
10410         return get_errno(vhangup());
10411 #ifdef TARGET_NR_syscall
10412     case TARGET_NR_syscall:
10413         return do_syscall(cpu_env, arg1 & 0xffff, arg2, arg3, arg4, arg5,
10414                           arg6, arg7, arg8, 0);
10415 #endif
10416 #if defined(TARGET_NR_wait4)
10417     case TARGET_NR_wait4:
10418         {
10419             int status;
10420             abi_long status_ptr = arg2;
10421             struct rusage rusage, *rusage_ptr;
10422             abi_ulong target_rusage = arg4;
10423             abi_long rusage_err;
10424             if (target_rusage)
10425                 rusage_ptr = &rusage;
10426             else
10427                 rusage_ptr = NULL;
10428             ret = get_errno(safe_wait4(arg1, &status, arg3, rusage_ptr));
10429             if (!is_error(ret)) {
10430                 if (status_ptr && ret) {
10431                     status = host_to_target_waitstatus(status);
10432                     if (put_user_s32(status, status_ptr))
10433                         return -TARGET_EFAULT;
10434                 }
10435                 if (target_rusage) {
10436                     rusage_err = host_to_target_rusage(target_rusage, &rusage);
10437                     if (rusage_err) {
10438                         ret = rusage_err;
10439                     }
10440                 }
10441             }
10442         }
10443         return ret;
10444 #endif
10445 #ifdef TARGET_NR_swapoff
10446     case TARGET_NR_swapoff:
10447         if (!(p = lock_user_string(arg1)))
10448             return -TARGET_EFAULT;
10449         ret = get_errno(swapoff(p));
10450         unlock_user(p, arg1, 0);
10451         return ret;
10452 #endif
10453     case TARGET_NR_sysinfo:
10454         {
10455             struct target_sysinfo *target_value;
10456             struct sysinfo value;
10457             ret = get_errno(sysinfo(&value));
10458             if (!is_error(ret) && arg1)
10459             {
10460                 if (!lock_user_struct(VERIFY_WRITE, target_value, arg1, 0))
10461                     return -TARGET_EFAULT;
10462                 __put_user(value.uptime, &target_value->uptime);
10463                 __put_user(value.loads[0], &target_value->loads[0]);
10464                 __put_user(value.loads[1], &target_value->loads[1]);
10465                 __put_user(value.loads[2], &target_value->loads[2]);
10466                 __put_user(value.totalram, &target_value->totalram);
10467                 __put_user(value.freeram, &target_value->freeram);
10468                 __put_user(value.sharedram, &target_value->sharedram);
10469                 __put_user(value.bufferram, &target_value->bufferram);
10470                 __put_user(value.totalswap, &target_value->totalswap);
10471                 __put_user(value.freeswap, &target_value->freeswap);
10472                 __put_user(value.procs, &target_value->procs);
10473                 __put_user(value.totalhigh, &target_value->totalhigh);
10474                 __put_user(value.freehigh, &target_value->freehigh);
10475                 __put_user(value.mem_unit, &target_value->mem_unit);
10476                 unlock_user_struct(target_value, arg1, 1);
10477             }
10478         }
10479         return ret;
10480 #ifdef TARGET_NR_ipc
10481     case TARGET_NR_ipc:
10482         return do_ipc(cpu_env, arg1, arg2, arg3, arg4, arg5, arg6);
10483 #endif
10484 #ifdef TARGET_NR_semget
10485     case TARGET_NR_semget:
10486         return get_errno(semget(arg1, arg2, arg3));
10487 #endif
10488 #ifdef TARGET_NR_semop
10489     case TARGET_NR_semop:
10490         return do_semtimedop(arg1, arg2, arg3, 0, false);
10491 #endif
10492 #ifdef TARGET_NR_semtimedop
10493     case TARGET_NR_semtimedop:
10494         return do_semtimedop(arg1, arg2, arg3, arg4, false);
10495 #endif
10496 #ifdef TARGET_NR_semtimedop_time64
10497     case TARGET_NR_semtimedop_time64:
10498         return do_semtimedop(arg1, arg2, arg3, arg4, true);
10499 #endif
10500 #ifdef TARGET_NR_semctl
10501     case TARGET_NR_semctl:
10502         return do_semctl(arg1, arg2, arg3, arg4);
10503 #endif
10504 #ifdef TARGET_NR_msgctl
10505     case TARGET_NR_msgctl:
10506         return do_msgctl(arg1, arg2, arg3);
10507 #endif
10508 #ifdef TARGET_NR_msgget
10509     case TARGET_NR_msgget:
10510         return get_errno(msgget(arg1, arg2));
10511 #endif
10512 #ifdef TARGET_NR_msgrcv
10513     case TARGET_NR_msgrcv:
10514         return do_msgrcv(arg1, arg2, arg3, arg4, arg5);
10515 #endif
10516 #ifdef TARGET_NR_msgsnd
10517     case TARGET_NR_msgsnd:
10518         return do_msgsnd(arg1, arg2, arg3, arg4);
10519 #endif
10520 #ifdef TARGET_NR_shmget
10521     case TARGET_NR_shmget:
10522         return get_errno(shmget(arg1, arg2, arg3));
10523 #endif
10524 #ifdef TARGET_NR_shmctl
10525     case TARGET_NR_shmctl:
10526         return do_shmctl(arg1, arg2, arg3);
10527 #endif
10528 #ifdef TARGET_NR_shmat
10529     case TARGET_NR_shmat:
10530         return do_shmat(cpu_env, arg1, arg2, arg3);
10531 #endif
10532 #ifdef TARGET_NR_shmdt
10533     case TARGET_NR_shmdt:
10534         return do_shmdt(arg1);
10535 #endif
10536     case TARGET_NR_fsync:
10537         return get_errno(fsync(arg1));
10538     case TARGET_NR_clone:
10539         /* Linux manages to have three different orderings for its
10540          * arguments to clone(); the BACKWARDS and BACKWARDS2 defines
10541          * match the kernel's CONFIG_CLONE_* settings.
10542          * Microblaze is further special in that it uses a sixth
10543          * implicit argument to clone for the TLS pointer.
10544          */
10545 #if defined(TARGET_MICROBLAZE)
10546         ret = get_errno(do_fork(cpu_env, arg1, arg2, arg4, arg6, arg5));
10547 #elif defined(TARGET_CLONE_BACKWARDS)
10548         ret = get_errno(do_fork(cpu_env, arg1, arg2, arg3, arg4, arg5));
10549 #elif defined(TARGET_CLONE_BACKWARDS2)
10550         ret = get_errno(do_fork(cpu_env, arg2, arg1, arg3, arg5, arg4));
10551 #else
10552         ret = get_errno(do_fork(cpu_env, arg1, arg2, arg3, arg5, arg4));
10553 #endif
10554         return ret;
10555 #ifdef __NR_exit_group
10556         /* new thread calls */
10557     case TARGET_NR_exit_group:
10558         preexit_cleanup(cpu_env, arg1);
10559         return get_errno(exit_group(arg1));
10560 #endif
10561     case TARGET_NR_setdomainname:
10562         if (!(p = lock_user_string(arg1)))
10563             return -TARGET_EFAULT;
10564         ret = get_errno(setdomainname(p, arg2));
10565         unlock_user(p, arg1, 0);
10566         return ret;
10567     case TARGET_NR_uname:
10568         /* no need to transcode because we use the linux syscall */
10569         {
10570             struct new_utsname * buf;
10571 
10572             if (!lock_user_struct(VERIFY_WRITE, buf, arg1, 0))
10573                 return -TARGET_EFAULT;
10574             ret = get_errno(sys_uname(buf));
10575             if (!is_error(ret)) {
10576                 /* Overwrite the native machine name with whatever is being
10577                    emulated. */
10578                 g_strlcpy(buf->machine, cpu_to_uname_machine(cpu_env),
10579                           sizeof(buf->machine));
10580                 /* Allow the user to override the reported release.  */
10581                 if (qemu_uname_release && *qemu_uname_release) {
10582                     g_strlcpy(buf->release, qemu_uname_release,
10583                               sizeof(buf->release));
10584                 }
10585             }
10586             unlock_user_struct(buf, arg1, 1);
10587         }
10588         return ret;
10589 #ifdef TARGET_I386
10590     case TARGET_NR_modify_ldt:
10591         return do_modify_ldt(cpu_env, arg1, arg2, arg3);
10592 #if !defined(TARGET_X86_64)
10593     case TARGET_NR_vm86:
10594         return do_vm86(cpu_env, arg1, arg2);
10595 #endif
10596 #endif
10597 #if defined(TARGET_NR_adjtimex)
10598     case TARGET_NR_adjtimex:
10599         {
10600             struct timex host_buf;
10601 
10602             if (target_to_host_timex(&host_buf, arg1) != 0) {
10603                 return -TARGET_EFAULT;
10604             }
10605             ret = get_errno(adjtimex(&host_buf));
10606             if (!is_error(ret)) {
10607                 if (host_to_target_timex(arg1, &host_buf) != 0) {
10608                     return -TARGET_EFAULT;
10609                 }
10610             }
10611         }
10612         return ret;
10613 #endif
10614 #if defined(TARGET_NR_clock_adjtime) && defined(CONFIG_CLOCK_ADJTIME)
10615     case TARGET_NR_clock_adjtime:
10616         {
10617             struct timex htx, *phtx = &htx;
10618 
10619             if (target_to_host_timex(phtx, arg2) != 0) {
10620                 return -TARGET_EFAULT;
10621             }
10622             ret = get_errno(clock_adjtime(arg1, phtx));
10623             if (!is_error(ret) && phtx) {
10624                 if (host_to_target_timex(arg2, phtx) != 0) {
10625                     return -TARGET_EFAULT;
10626                 }
10627             }
10628         }
10629         return ret;
10630 #endif
10631 #if defined(TARGET_NR_clock_adjtime64) && defined(CONFIG_CLOCK_ADJTIME)
10632     case TARGET_NR_clock_adjtime64:
10633         {
10634             struct timex htx;
10635 
10636             if (target_to_host_timex64(&htx, arg2) != 0) {
10637                 return -TARGET_EFAULT;
10638             }
10639             ret = get_errno(clock_adjtime(arg1, &htx));
10640             if (!is_error(ret) && host_to_target_timex64(arg2, &htx)) {
10641                     return -TARGET_EFAULT;
10642             }
10643         }
10644         return ret;
10645 #endif
10646     case TARGET_NR_getpgid:
10647         return get_errno(getpgid(arg1));
10648     case TARGET_NR_fchdir:
10649         return get_errno(fchdir(arg1));
10650     case TARGET_NR_personality:
10651         return get_errno(personality(arg1));
10652 #ifdef TARGET_NR__llseek /* Not on alpha */
10653     case TARGET_NR__llseek:
10654         {
10655             int64_t res;
10656 #if !defined(__NR_llseek)
10657             res = lseek(arg1, ((uint64_t)arg2 << 32) | (abi_ulong)arg3, arg5);
10658             if (res == -1) {
10659                 ret = get_errno(res);
10660             } else {
10661                 ret = 0;
10662             }
10663 #else
10664             ret = get_errno(_llseek(arg1, arg2, arg3, &res, arg5));
10665 #endif
10666             if ((ret == 0) && put_user_s64(res, arg4)) {
10667                 return -TARGET_EFAULT;
10668             }
10669         }
10670         return ret;
10671 #endif
10672 #ifdef TARGET_NR_getdents
10673     case TARGET_NR_getdents:
10674         return do_getdents(arg1, arg2, arg3);
10675 #endif /* TARGET_NR_getdents */
10676 #if defined(TARGET_NR_getdents64) && defined(__NR_getdents64)
10677     case TARGET_NR_getdents64:
10678         return do_getdents64(arg1, arg2, arg3);
10679 #endif /* TARGET_NR_getdents64 */
10680 #if defined(TARGET_NR__newselect)
10681     case TARGET_NR__newselect:
10682         return do_select(arg1, arg2, arg3, arg4, arg5);
10683 #endif
10684 #ifdef TARGET_NR_poll
10685     case TARGET_NR_poll:
10686         return do_ppoll(arg1, arg2, arg3, arg4, arg5, false, false);
10687 #endif
10688 #ifdef TARGET_NR_ppoll
10689     case TARGET_NR_ppoll:
10690         return do_ppoll(arg1, arg2, arg3, arg4, arg5, true, false);
10691 #endif
10692 #ifdef TARGET_NR_ppoll_time64
10693     case TARGET_NR_ppoll_time64:
10694         return do_ppoll(arg1, arg2, arg3, arg4, arg5, true, true);
10695 #endif
10696     case TARGET_NR_flock:
10697         /* NOTE: the flock constant seems to be the same for every
10698            Linux platform */
10699         return get_errno(safe_flock(arg1, arg2));
10700     case TARGET_NR_readv:
10701         {
10702             struct iovec *vec = lock_iovec(VERIFY_WRITE, arg2, arg3, 0);
10703             if (vec != NULL) {
10704                 ret = get_errno(safe_readv(arg1, vec, arg3));
10705                 unlock_iovec(vec, arg2, arg3, 1);
10706             } else {
10707                 ret = -host_to_target_errno(errno);
10708             }
10709         }
10710         return ret;
10711     case TARGET_NR_writev:
10712         {
10713             struct iovec *vec = lock_iovec(VERIFY_READ, arg2, arg3, 1);
10714             if (vec != NULL) {
10715                 ret = get_errno(safe_writev(arg1, vec, arg3));
10716                 unlock_iovec(vec, arg2, arg3, 0);
10717             } else {
10718                 ret = -host_to_target_errno(errno);
10719             }
10720         }
10721         return ret;
10722 #if defined(TARGET_NR_preadv)
10723     case TARGET_NR_preadv:
10724         {
10725             struct iovec *vec = lock_iovec(VERIFY_WRITE, arg2, arg3, 0);
10726             if (vec != NULL) {
10727                 unsigned long low, high;
10728 
10729                 target_to_host_low_high(arg4, arg5, &low, &high);
10730                 ret = get_errno(safe_preadv(arg1, vec, arg3, low, high));
10731                 unlock_iovec(vec, arg2, arg3, 1);
10732             } else {
10733                 ret = -host_to_target_errno(errno);
10734            }
10735         }
10736         return ret;
10737 #endif
10738 #if defined(TARGET_NR_pwritev)
10739     case TARGET_NR_pwritev:
10740         {
10741             struct iovec *vec = lock_iovec(VERIFY_READ, arg2, arg3, 1);
10742             if (vec != NULL) {
10743                 unsigned long low, high;
10744 
10745                 target_to_host_low_high(arg4, arg5, &low, &high);
10746                 ret = get_errno(safe_pwritev(arg1, vec, arg3, low, high));
10747                 unlock_iovec(vec, arg2, arg3, 0);
10748             } else {
10749                 ret = -host_to_target_errno(errno);
10750            }
10751         }
10752         return ret;
10753 #endif
10754     case TARGET_NR_getsid:
10755         return get_errno(getsid(arg1));
10756 #if defined(TARGET_NR_fdatasync) /* Not on alpha (osf_datasync ?) */
10757     case TARGET_NR_fdatasync:
10758         return get_errno(fdatasync(arg1));
10759 #endif
10760     case TARGET_NR_sched_getaffinity:
10761         {
10762             unsigned int mask_size;
10763             unsigned long *mask;
10764 
10765             /*
10766              * sched_getaffinity needs multiples of ulong, so need to take
10767              * care of mismatches between target ulong and host ulong sizes.
10768              */
10769             if (arg2 & (sizeof(abi_ulong) - 1)) {
10770                 return -TARGET_EINVAL;
10771             }
10772             mask_size = (arg2 + (sizeof(*mask) - 1)) & ~(sizeof(*mask) - 1);
10773 
10774             mask = alloca(mask_size);
10775             memset(mask, 0, mask_size);
10776             ret = get_errno(sys_sched_getaffinity(arg1, mask_size, mask));
10777 
10778             if (!is_error(ret)) {
10779                 if (ret > arg2) {
10780                     /* More data returned than the caller's buffer will fit.
10781                      * This only happens if sizeof(abi_long) < sizeof(long)
10782                      * and the caller passed us a buffer holding an odd number
10783                      * of abi_longs. If the host kernel is actually using the
10784                      * extra 4 bytes then fail EINVAL; otherwise we can just
10785                      * ignore them and only copy the interesting part.
10786                      */
10787                     int numcpus = sysconf(_SC_NPROCESSORS_CONF);
10788                     if (numcpus > arg2 * 8) {
10789                         return -TARGET_EINVAL;
10790                     }
10791                     ret = arg2;
10792                 }
10793 
10794                 if (host_to_target_cpu_mask(mask, mask_size, arg3, ret)) {
10795                     return -TARGET_EFAULT;
10796                 }
10797             }
10798         }
10799         return ret;
10800     case TARGET_NR_sched_setaffinity:
10801         {
10802             unsigned int mask_size;
10803             unsigned long *mask;
10804 
10805             /*
10806              * sched_setaffinity needs multiples of ulong, so need to take
10807              * care of mismatches between target ulong and host ulong sizes.
10808              */
10809             if (arg2 & (sizeof(abi_ulong) - 1)) {
10810                 return -TARGET_EINVAL;
10811             }
10812             mask_size = (arg2 + (sizeof(*mask) - 1)) & ~(sizeof(*mask) - 1);
10813             mask = alloca(mask_size);
10814 
10815             ret = target_to_host_cpu_mask(mask, mask_size, arg3, arg2);
10816             if (ret) {
10817                 return ret;
10818             }
10819 
10820             return get_errno(sys_sched_setaffinity(arg1, mask_size, mask));
10821         }
10822     case TARGET_NR_getcpu:
10823         {
10824             unsigned cpu, node;
10825             ret = get_errno(sys_getcpu(arg1 ? &cpu : NULL,
10826                                        arg2 ? &node : NULL,
10827                                        NULL));
10828             if (is_error(ret)) {
10829                 return ret;
10830             }
10831             if (arg1 && put_user_u32(cpu, arg1)) {
10832                 return -TARGET_EFAULT;
10833             }
10834             if (arg2 && put_user_u32(node, arg2)) {
10835                 return -TARGET_EFAULT;
10836             }
10837         }
10838         return ret;
10839     case TARGET_NR_sched_setparam:
10840         {
10841             struct target_sched_param *target_schp;
10842             struct sched_param schp;
10843 
10844             if (arg2 == 0) {
10845                 return -TARGET_EINVAL;
10846             }
10847             if (!lock_user_struct(VERIFY_READ, target_schp, arg2, 1)) {
10848                 return -TARGET_EFAULT;
10849             }
10850             schp.sched_priority = tswap32(target_schp->sched_priority);
10851             unlock_user_struct(target_schp, arg2, 0);
10852             return get_errno(sys_sched_setparam(arg1, &schp));
10853         }
10854     case TARGET_NR_sched_getparam:
10855         {
10856             struct target_sched_param *target_schp;
10857             struct sched_param schp;
10858 
10859             if (arg2 == 0) {
10860                 return -TARGET_EINVAL;
10861             }
10862             ret = get_errno(sys_sched_getparam(arg1, &schp));
10863             if (!is_error(ret)) {
10864                 if (!lock_user_struct(VERIFY_WRITE, target_schp, arg2, 0)) {
10865                     return -TARGET_EFAULT;
10866                 }
10867                 target_schp->sched_priority = tswap32(schp.sched_priority);
10868                 unlock_user_struct(target_schp, arg2, 1);
10869             }
10870         }
10871         return ret;
10872     case TARGET_NR_sched_setscheduler:
10873         {
10874             struct target_sched_param *target_schp;
10875             struct sched_param schp;
10876             if (arg3 == 0) {
10877                 return -TARGET_EINVAL;
10878             }
10879             if (!lock_user_struct(VERIFY_READ, target_schp, arg3, 1)) {
10880                 return -TARGET_EFAULT;
10881             }
10882             schp.sched_priority = tswap32(target_schp->sched_priority);
10883             unlock_user_struct(target_schp, arg3, 0);
10884             return get_errno(sys_sched_setscheduler(arg1, arg2, &schp));
10885         }
10886     case TARGET_NR_sched_getscheduler:
10887         return get_errno(sys_sched_getscheduler(arg1));
10888     case TARGET_NR_sched_getattr:
10889         {
10890             struct target_sched_attr *target_scha;
10891             struct sched_attr scha;
10892             if (arg2 == 0) {
10893                 return -TARGET_EINVAL;
10894             }
10895             if (arg3 > sizeof(scha)) {
10896                 arg3 = sizeof(scha);
10897             }
10898             ret = get_errno(sys_sched_getattr(arg1, &scha, arg3, arg4));
10899             if (!is_error(ret)) {
10900                 target_scha = lock_user(VERIFY_WRITE, arg2, arg3, 0);
10901                 if (!target_scha) {
10902                     return -TARGET_EFAULT;
10903                 }
10904                 target_scha->size = tswap32(scha.size);
10905                 target_scha->sched_policy = tswap32(scha.sched_policy);
10906                 target_scha->sched_flags = tswap64(scha.sched_flags);
10907                 target_scha->sched_nice = tswap32(scha.sched_nice);
10908                 target_scha->sched_priority = tswap32(scha.sched_priority);
10909                 target_scha->sched_runtime = tswap64(scha.sched_runtime);
10910                 target_scha->sched_deadline = tswap64(scha.sched_deadline);
10911                 target_scha->sched_period = tswap64(scha.sched_period);
10912                 if (scha.size > offsetof(struct sched_attr, sched_util_min)) {
10913                     target_scha->sched_util_min = tswap32(scha.sched_util_min);
10914                     target_scha->sched_util_max = tswap32(scha.sched_util_max);
10915                 }
10916                 unlock_user(target_scha, arg2, arg3);
10917             }
10918             return ret;
10919         }
10920     case TARGET_NR_sched_setattr:
10921         {
10922             struct target_sched_attr *target_scha;
10923             struct sched_attr scha;
10924             uint32_t size;
10925             int zeroed;
10926             if (arg2 == 0) {
10927                 return -TARGET_EINVAL;
10928             }
10929             if (get_user_u32(size, arg2)) {
10930                 return -TARGET_EFAULT;
10931             }
10932             if (!size) {
10933                 size = offsetof(struct target_sched_attr, sched_util_min);
10934             }
10935             if (size < offsetof(struct target_sched_attr, sched_util_min)) {
10936                 if (put_user_u32(sizeof(struct target_sched_attr), arg2)) {
10937                     return -TARGET_EFAULT;
10938                 }
10939                 return -TARGET_E2BIG;
10940             }
10941 
10942             zeroed = check_zeroed_user(arg2, sizeof(struct target_sched_attr), size);
10943             if (zeroed < 0) {
10944                 return zeroed;
10945             } else if (zeroed == 0) {
10946                 if (put_user_u32(sizeof(struct target_sched_attr), arg2)) {
10947                     return -TARGET_EFAULT;
10948                 }
10949                 return -TARGET_E2BIG;
10950             }
10951             if (size > sizeof(struct target_sched_attr)) {
10952                 size = sizeof(struct target_sched_attr);
10953             }
10954 
10955             target_scha = lock_user(VERIFY_READ, arg2, size, 1);
10956             if (!target_scha) {
10957                 return -TARGET_EFAULT;
10958             }
10959             scha.size = size;
10960             scha.sched_policy = tswap32(target_scha->sched_policy);
10961             scha.sched_flags = tswap64(target_scha->sched_flags);
10962             scha.sched_nice = tswap32(target_scha->sched_nice);
10963             scha.sched_priority = tswap32(target_scha->sched_priority);
10964             scha.sched_runtime = tswap64(target_scha->sched_runtime);
10965             scha.sched_deadline = tswap64(target_scha->sched_deadline);
10966             scha.sched_period = tswap64(target_scha->sched_period);
10967             if (size > offsetof(struct target_sched_attr, sched_util_min)) {
10968                 scha.sched_util_min = tswap32(target_scha->sched_util_min);
10969                 scha.sched_util_max = tswap32(target_scha->sched_util_max);
10970             }
10971             unlock_user(target_scha, arg2, 0);
10972             return get_errno(sys_sched_setattr(arg1, &scha, arg3));
10973         }
10974     case TARGET_NR_sched_yield:
10975         return get_errno(sched_yield());
10976     case TARGET_NR_sched_get_priority_max:
10977         return get_errno(sched_get_priority_max(arg1));
10978     case TARGET_NR_sched_get_priority_min:
10979         return get_errno(sched_get_priority_min(arg1));
10980 #ifdef TARGET_NR_sched_rr_get_interval
10981     case TARGET_NR_sched_rr_get_interval:
10982         {
10983             struct timespec ts;
10984             ret = get_errno(sched_rr_get_interval(arg1, &ts));
10985             if (!is_error(ret)) {
10986                 ret = host_to_target_timespec(arg2, &ts);
10987             }
10988         }
10989         return ret;
10990 #endif
10991 #ifdef TARGET_NR_sched_rr_get_interval_time64
10992     case TARGET_NR_sched_rr_get_interval_time64:
10993         {
10994             struct timespec ts;
10995             ret = get_errno(sched_rr_get_interval(arg1, &ts));
10996             if (!is_error(ret)) {
10997                 ret = host_to_target_timespec64(arg2, &ts);
10998             }
10999         }
11000         return ret;
11001 #endif
11002 #if defined(TARGET_NR_nanosleep)
11003     case TARGET_NR_nanosleep:
11004         {
11005             struct timespec req, rem;
11006             target_to_host_timespec(&req, arg1);
11007             ret = get_errno(safe_nanosleep(&req, &rem));
11008             if (is_error(ret) && arg2) {
11009                 host_to_target_timespec(arg2, &rem);
11010             }
11011         }
11012         return ret;
11013 #endif
11014     case TARGET_NR_prctl:
11015         return do_prctl(cpu_env, arg1, arg2, arg3, arg4, arg5);
11016         break;
11017 #ifdef TARGET_NR_arch_prctl
11018     case TARGET_NR_arch_prctl:
11019         return do_arch_prctl(cpu_env, arg1, arg2);
11020 #endif
11021 #ifdef TARGET_NR_pread64
11022     case TARGET_NR_pread64:
11023         if (regpairs_aligned(cpu_env, num)) {
11024             arg4 = arg5;
11025             arg5 = arg6;
11026         }
11027         if (arg2 == 0 && arg3 == 0) {
11028             /* Special-case NULL buffer and zero length, which should succeed */
11029             p = 0;
11030         } else {
11031             p = lock_user(VERIFY_WRITE, arg2, arg3, 0);
11032             if (!p) {
11033                 return -TARGET_EFAULT;
11034             }
11035         }
11036         ret = get_errno(pread64(arg1, p, arg3, target_offset64(arg4, arg5)));
11037         unlock_user(p, arg2, ret);
11038         return ret;
11039     case TARGET_NR_pwrite64:
11040         if (regpairs_aligned(cpu_env, num)) {
11041             arg4 = arg5;
11042             arg5 = arg6;
11043         }
11044         if (arg2 == 0 && arg3 == 0) {
11045             /* Special-case NULL buffer and zero length, which should succeed */
11046             p = 0;
11047         } else {
11048             p = lock_user(VERIFY_READ, arg2, arg3, 1);
11049             if (!p) {
11050                 return -TARGET_EFAULT;
11051             }
11052         }
11053         ret = get_errno(pwrite64(arg1, p, arg3, target_offset64(arg4, arg5)));
11054         unlock_user(p, arg2, 0);
11055         return ret;
11056 #endif
11057     case TARGET_NR_getcwd:
11058         if (!(p = lock_user(VERIFY_WRITE, arg1, arg2, 0)))
11059             return -TARGET_EFAULT;
11060         ret = get_errno(sys_getcwd1(p, arg2));
11061         unlock_user(p, arg1, ret);
11062         return ret;
11063     case TARGET_NR_capget:
11064     case TARGET_NR_capset:
11065     {
11066         struct target_user_cap_header *target_header;
11067         struct target_user_cap_data *target_data = NULL;
11068         struct __user_cap_header_struct header;
11069         struct __user_cap_data_struct data[2];
11070         struct __user_cap_data_struct *dataptr = NULL;
11071         int i, target_datalen;
11072         int data_items = 1;
11073 
11074         if (!lock_user_struct(VERIFY_WRITE, target_header, arg1, 1)) {
11075             return -TARGET_EFAULT;
11076         }
11077         header.version = tswap32(target_header->version);
11078         header.pid = tswap32(target_header->pid);
11079 
11080         if (header.version != _LINUX_CAPABILITY_VERSION) {
11081             /* Version 2 and up takes pointer to two user_data structs */
11082             data_items = 2;
11083         }
11084 
11085         target_datalen = sizeof(*target_data) * data_items;
11086 
11087         if (arg2) {
11088             if (num == TARGET_NR_capget) {
11089                 target_data = lock_user(VERIFY_WRITE, arg2, target_datalen, 0);
11090             } else {
11091                 target_data = lock_user(VERIFY_READ, arg2, target_datalen, 1);
11092             }
11093             if (!target_data) {
11094                 unlock_user_struct(target_header, arg1, 0);
11095                 return -TARGET_EFAULT;
11096             }
11097 
11098             if (num == TARGET_NR_capset) {
11099                 for (i = 0; i < data_items; i++) {
11100                     data[i].effective = tswap32(target_data[i].effective);
11101                     data[i].permitted = tswap32(target_data[i].permitted);
11102                     data[i].inheritable = tswap32(target_data[i].inheritable);
11103                 }
11104             }
11105 
11106             dataptr = data;
11107         }
11108 
11109         if (num == TARGET_NR_capget) {
11110             ret = get_errno(capget(&header, dataptr));
11111         } else {
11112             ret = get_errno(capset(&header, dataptr));
11113         }
11114 
11115         /* The kernel always updates version for both capget and capset */
11116         target_header->version = tswap32(header.version);
11117         unlock_user_struct(target_header, arg1, 1);
11118 
11119         if (arg2) {
11120             if (num == TARGET_NR_capget) {
11121                 for (i = 0; i < data_items; i++) {
11122                     target_data[i].effective = tswap32(data[i].effective);
11123                     target_data[i].permitted = tswap32(data[i].permitted);
11124                     target_data[i].inheritable = tswap32(data[i].inheritable);
11125                 }
11126                 unlock_user(target_data, arg2, target_datalen);
11127             } else {
11128                 unlock_user(target_data, arg2, 0);
11129             }
11130         }
11131         return ret;
11132     }
11133     case TARGET_NR_sigaltstack:
11134         return do_sigaltstack(arg1, arg2, cpu_env);
11135 
11136 #ifdef CONFIG_SENDFILE
11137 #ifdef TARGET_NR_sendfile
11138     case TARGET_NR_sendfile:
11139     {
11140         off_t *offp = NULL;
11141         off_t off;
11142         if (arg3) {
11143             ret = get_user_sal(off, arg3);
11144             if (is_error(ret)) {
11145                 return ret;
11146             }
11147             offp = &off;
11148         }
11149         ret = get_errno(sendfile(arg1, arg2, offp, arg4));
11150         if (!is_error(ret) && arg3) {
11151             abi_long ret2 = put_user_sal(off, arg3);
11152             if (is_error(ret2)) {
11153                 ret = ret2;
11154             }
11155         }
11156         return ret;
11157     }
11158 #endif
11159 #ifdef TARGET_NR_sendfile64
11160     case TARGET_NR_sendfile64:
11161     {
11162         off_t *offp = NULL;
11163         off_t off;
11164         if (arg3) {
11165             ret = get_user_s64(off, arg3);
11166             if (is_error(ret)) {
11167                 return ret;
11168             }
11169             offp = &off;
11170         }
11171         ret = get_errno(sendfile(arg1, arg2, offp, arg4));
11172         if (!is_error(ret) && arg3) {
11173             abi_long ret2 = put_user_s64(off, arg3);
11174             if (is_error(ret2)) {
11175                 ret = ret2;
11176             }
11177         }
11178         return ret;
11179     }
11180 #endif
11181 #endif
11182 #ifdef TARGET_NR_vfork
11183     case TARGET_NR_vfork:
11184         return get_errno(do_fork(cpu_env,
11185                          CLONE_VFORK | CLONE_VM | TARGET_SIGCHLD,
11186                          0, 0, 0, 0));
11187 #endif
11188 #ifdef TARGET_NR_ugetrlimit
11189     case TARGET_NR_ugetrlimit:
11190     {
11191 	struct rlimit rlim;
11192 	int resource = target_to_host_resource(arg1);
11193 	ret = get_errno(getrlimit(resource, &rlim));
11194 	if (!is_error(ret)) {
11195 	    struct target_rlimit *target_rlim;
11196             if (!lock_user_struct(VERIFY_WRITE, target_rlim, arg2, 0))
11197                 return -TARGET_EFAULT;
11198 	    target_rlim->rlim_cur = host_to_target_rlim(rlim.rlim_cur);
11199 	    target_rlim->rlim_max = host_to_target_rlim(rlim.rlim_max);
11200             unlock_user_struct(target_rlim, arg2, 1);
11201 	}
11202         return ret;
11203     }
11204 #endif
11205 #ifdef TARGET_NR_truncate64
11206     case TARGET_NR_truncate64:
11207         if (!(p = lock_user_string(arg1)))
11208             return -TARGET_EFAULT;
11209 	ret = target_truncate64(cpu_env, p, arg2, arg3, arg4);
11210         unlock_user(p, arg1, 0);
11211         return ret;
11212 #endif
11213 #ifdef TARGET_NR_ftruncate64
11214     case TARGET_NR_ftruncate64:
11215         return target_ftruncate64(cpu_env, arg1, arg2, arg3, arg4);
11216 #endif
11217 #ifdef TARGET_NR_stat64
11218     case TARGET_NR_stat64:
11219         if (!(p = lock_user_string(arg1))) {
11220             return -TARGET_EFAULT;
11221         }
11222         ret = get_errno(stat(path(p), &st));
11223         unlock_user(p, arg1, 0);
11224         if (!is_error(ret))
11225             ret = host_to_target_stat64(cpu_env, arg2, &st);
11226         return ret;
11227 #endif
11228 #ifdef TARGET_NR_lstat64
11229     case TARGET_NR_lstat64:
11230         if (!(p = lock_user_string(arg1))) {
11231             return -TARGET_EFAULT;
11232         }
11233         ret = get_errno(lstat(path(p), &st));
11234         unlock_user(p, arg1, 0);
11235         if (!is_error(ret))
11236             ret = host_to_target_stat64(cpu_env, arg2, &st);
11237         return ret;
11238 #endif
11239 #ifdef TARGET_NR_fstat64
11240     case TARGET_NR_fstat64:
11241         ret = get_errno(fstat(arg1, &st));
11242         if (!is_error(ret))
11243             ret = host_to_target_stat64(cpu_env, arg2, &st);
11244         return ret;
11245 #endif
11246 #if (defined(TARGET_NR_fstatat64) || defined(TARGET_NR_newfstatat))
11247 #ifdef TARGET_NR_fstatat64
11248     case TARGET_NR_fstatat64:
11249 #endif
11250 #ifdef TARGET_NR_newfstatat
11251     case TARGET_NR_newfstatat:
11252 #endif
11253         if (!(p = lock_user_string(arg2))) {
11254             return -TARGET_EFAULT;
11255         }
11256         ret = get_errno(fstatat(arg1, path(p), &st, arg4));
11257         unlock_user(p, arg2, 0);
11258         if (!is_error(ret))
11259             ret = host_to_target_stat64(cpu_env, arg3, &st);
11260         return ret;
11261 #endif
11262 #if defined(TARGET_NR_statx)
11263     case TARGET_NR_statx:
11264         {
11265             struct target_statx *target_stx;
11266             int dirfd = arg1;
11267             int flags = arg3;
11268 
11269             p = lock_user_string(arg2);
11270             if (p == NULL) {
11271                 return -TARGET_EFAULT;
11272             }
11273 #if defined(__NR_statx)
11274             {
11275                 /*
11276                  * It is assumed that struct statx is architecture independent.
11277                  */
11278                 struct target_statx host_stx;
11279                 int mask = arg4;
11280 
11281                 ret = get_errno(sys_statx(dirfd, p, flags, mask, &host_stx));
11282                 if (!is_error(ret)) {
11283                     if (host_to_target_statx(&host_stx, arg5) != 0) {
11284                         unlock_user(p, arg2, 0);
11285                         return -TARGET_EFAULT;
11286                     }
11287                 }
11288 
11289                 if (ret != -TARGET_ENOSYS) {
11290                     unlock_user(p, arg2, 0);
11291                     return ret;
11292                 }
11293             }
11294 #endif
11295             ret = get_errno(fstatat(dirfd, path(p), &st, flags));
11296             unlock_user(p, arg2, 0);
11297 
11298             if (!is_error(ret)) {
11299                 if (!lock_user_struct(VERIFY_WRITE, target_stx, arg5, 0)) {
11300                     return -TARGET_EFAULT;
11301                 }
11302                 memset(target_stx, 0, sizeof(*target_stx));
11303                 __put_user(major(st.st_dev), &target_stx->stx_dev_major);
11304                 __put_user(minor(st.st_dev), &target_stx->stx_dev_minor);
11305                 __put_user(st.st_ino, &target_stx->stx_ino);
11306                 __put_user(st.st_mode, &target_stx->stx_mode);
11307                 __put_user(st.st_uid, &target_stx->stx_uid);
11308                 __put_user(st.st_gid, &target_stx->stx_gid);
11309                 __put_user(st.st_nlink, &target_stx->stx_nlink);
11310                 __put_user(major(st.st_rdev), &target_stx->stx_rdev_major);
11311                 __put_user(minor(st.st_rdev), &target_stx->stx_rdev_minor);
11312                 __put_user(st.st_size, &target_stx->stx_size);
11313                 __put_user(st.st_blksize, &target_stx->stx_blksize);
11314                 __put_user(st.st_blocks, &target_stx->stx_blocks);
11315                 __put_user(st.st_atime, &target_stx->stx_atime.tv_sec);
11316                 __put_user(st.st_mtime, &target_stx->stx_mtime.tv_sec);
11317                 __put_user(st.st_ctime, &target_stx->stx_ctime.tv_sec);
11318                 unlock_user_struct(target_stx, arg5, 1);
11319             }
11320         }
11321         return ret;
11322 #endif
11323 #ifdef TARGET_NR_lchown
11324     case TARGET_NR_lchown:
11325         if (!(p = lock_user_string(arg1)))
11326             return -TARGET_EFAULT;
11327         ret = get_errno(lchown(p, low2highuid(arg2), low2highgid(arg3)));
11328         unlock_user(p, arg1, 0);
11329         return ret;
11330 #endif
11331 #ifdef TARGET_NR_getuid
11332     case TARGET_NR_getuid:
11333         return get_errno(high2lowuid(getuid()));
11334 #endif
11335 #ifdef TARGET_NR_getgid
11336     case TARGET_NR_getgid:
11337         return get_errno(high2lowgid(getgid()));
11338 #endif
11339 #ifdef TARGET_NR_geteuid
11340     case TARGET_NR_geteuid:
11341         return get_errno(high2lowuid(geteuid()));
11342 #endif
11343 #ifdef TARGET_NR_getegid
11344     case TARGET_NR_getegid:
11345         return get_errno(high2lowgid(getegid()));
11346 #endif
11347     case TARGET_NR_setreuid:
11348         return get_errno(setreuid(low2highuid(arg1), low2highuid(arg2)));
11349     case TARGET_NR_setregid:
11350         return get_errno(setregid(low2highgid(arg1), low2highgid(arg2)));
11351     case TARGET_NR_getgroups:
11352         {
11353             int gidsetsize = arg1;
11354             target_id *target_grouplist;
11355             gid_t *grouplist;
11356             int i;
11357 
11358             grouplist = alloca(gidsetsize * sizeof(gid_t));
11359             ret = get_errno(getgroups(gidsetsize, grouplist));
11360             if (gidsetsize == 0)
11361                 return ret;
11362             if (!is_error(ret)) {
11363                 target_grouplist = lock_user(VERIFY_WRITE, arg2, gidsetsize * sizeof(target_id), 0);
11364                 if (!target_grouplist)
11365                     return -TARGET_EFAULT;
11366                 for(i = 0;i < ret; i++)
11367                     target_grouplist[i] = tswapid(high2lowgid(grouplist[i]));
11368                 unlock_user(target_grouplist, arg2, gidsetsize * sizeof(target_id));
11369             }
11370         }
11371         return ret;
11372     case TARGET_NR_setgroups:
11373         {
11374             int gidsetsize = arg1;
11375             target_id *target_grouplist;
11376             gid_t *grouplist = NULL;
11377             int i;
11378             if (gidsetsize) {
11379                 grouplist = alloca(gidsetsize * sizeof(gid_t));
11380                 target_grouplist = lock_user(VERIFY_READ, arg2, gidsetsize * sizeof(target_id), 1);
11381                 if (!target_grouplist) {
11382                     return -TARGET_EFAULT;
11383                 }
11384                 for (i = 0; i < gidsetsize; i++) {
11385                     grouplist[i] = low2highgid(tswapid(target_grouplist[i]));
11386                 }
11387                 unlock_user(target_grouplist, arg2, 0);
11388             }
11389             return get_errno(setgroups(gidsetsize, grouplist));
11390         }
11391     case TARGET_NR_fchown:
11392         return get_errno(fchown(arg1, low2highuid(arg2), low2highgid(arg3)));
11393 #if defined(TARGET_NR_fchownat)
11394     case TARGET_NR_fchownat:
11395         if (!(p = lock_user_string(arg2)))
11396             return -TARGET_EFAULT;
11397         ret = get_errno(fchownat(arg1, p, low2highuid(arg3),
11398                                  low2highgid(arg4), arg5));
11399         unlock_user(p, arg2, 0);
11400         return ret;
11401 #endif
11402 #ifdef TARGET_NR_setresuid
11403     case TARGET_NR_setresuid:
11404         return get_errno(sys_setresuid(low2highuid(arg1),
11405                                        low2highuid(arg2),
11406                                        low2highuid(arg3)));
11407 #endif
11408 #ifdef TARGET_NR_getresuid
11409     case TARGET_NR_getresuid:
11410         {
11411             uid_t ruid, euid, suid;
11412             ret = get_errno(getresuid(&ruid, &euid, &suid));
11413             if (!is_error(ret)) {
11414                 if (put_user_id(high2lowuid(ruid), arg1)
11415                     || put_user_id(high2lowuid(euid), arg2)
11416                     || put_user_id(high2lowuid(suid), arg3))
11417                     return -TARGET_EFAULT;
11418             }
11419         }
11420         return ret;
11421 #endif
11422 #ifdef TARGET_NR_getresgid
11423     case TARGET_NR_setresgid:
11424         return get_errno(sys_setresgid(low2highgid(arg1),
11425                                        low2highgid(arg2),
11426                                        low2highgid(arg3)));
11427 #endif
11428 #ifdef TARGET_NR_getresgid
11429     case TARGET_NR_getresgid:
11430         {
11431             gid_t rgid, egid, sgid;
11432             ret = get_errno(getresgid(&rgid, &egid, &sgid));
11433             if (!is_error(ret)) {
11434                 if (put_user_id(high2lowgid(rgid), arg1)
11435                     || put_user_id(high2lowgid(egid), arg2)
11436                     || put_user_id(high2lowgid(sgid), arg3))
11437                     return -TARGET_EFAULT;
11438             }
11439         }
11440         return ret;
11441 #endif
11442 #ifdef TARGET_NR_chown
11443     case TARGET_NR_chown:
11444         if (!(p = lock_user_string(arg1)))
11445             return -TARGET_EFAULT;
11446         ret = get_errno(chown(p, low2highuid(arg2), low2highgid(arg3)));
11447         unlock_user(p, arg1, 0);
11448         return ret;
11449 #endif
11450     case TARGET_NR_setuid:
11451         return get_errno(sys_setuid(low2highuid(arg1)));
11452     case TARGET_NR_setgid:
11453         return get_errno(sys_setgid(low2highgid(arg1)));
11454     case TARGET_NR_setfsuid:
11455         return get_errno(setfsuid(arg1));
11456     case TARGET_NR_setfsgid:
11457         return get_errno(setfsgid(arg1));
11458 
11459 #ifdef TARGET_NR_lchown32
11460     case TARGET_NR_lchown32:
11461         if (!(p = lock_user_string(arg1)))
11462             return -TARGET_EFAULT;
11463         ret = get_errno(lchown(p, arg2, arg3));
11464         unlock_user(p, arg1, 0);
11465         return ret;
11466 #endif
11467 #ifdef TARGET_NR_getuid32
11468     case TARGET_NR_getuid32:
11469         return get_errno(getuid());
11470 #endif
11471 
11472 #if defined(TARGET_NR_getxuid) && defined(TARGET_ALPHA)
11473    /* Alpha specific */
11474     case TARGET_NR_getxuid:
11475          {
11476             uid_t euid;
11477             euid=geteuid();
11478             cpu_env->ir[IR_A4]=euid;
11479          }
11480         return get_errno(getuid());
11481 #endif
11482 #if defined(TARGET_NR_getxgid) && defined(TARGET_ALPHA)
11483    /* Alpha specific */
11484     case TARGET_NR_getxgid:
11485          {
11486             uid_t egid;
11487             egid=getegid();
11488             cpu_env->ir[IR_A4]=egid;
11489          }
11490         return get_errno(getgid());
11491 #endif
11492 #if defined(TARGET_NR_osf_getsysinfo) && defined(TARGET_ALPHA)
11493     /* Alpha specific */
11494     case TARGET_NR_osf_getsysinfo:
11495         ret = -TARGET_EOPNOTSUPP;
11496         switch (arg1) {
11497           case TARGET_GSI_IEEE_FP_CONTROL:
11498             {
11499                 uint64_t fpcr = cpu_alpha_load_fpcr(cpu_env);
11500                 uint64_t swcr = cpu_env->swcr;
11501 
11502                 swcr &= ~SWCR_STATUS_MASK;
11503                 swcr |= (fpcr >> 35) & SWCR_STATUS_MASK;
11504 
11505                 if (put_user_u64 (swcr, arg2))
11506                         return -TARGET_EFAULT;
11507                 ret = 0;
11508             }
11509             break;
11510 
11511           /* case GSI_IEEE_STATE_AT_SIGNAL:
11512              -- Not implemented in linux kernel.
11513              case GSI_UACPROC:
11514              -- Retrieves current unaligned access state; not much used.
11515              case GSI_PROC_TYPE:
11516              -- Retrieves implver information; surely not used.
11517              case GSI_GET_HWRPB:
11518              -- Grabs a copy of the HWRPB; surely not used.
11519           */
11520         }
11521         return ret;
11522 #endif
11523 #if defined(TARGET_NR_osf_setsysinfo) && defined(TARGET_ALPHA)
11524     /* Alpha specific */
11525     case TARGET_NR_osf_setsysinfo:
11526         ret = -TARGET_EOPNOTSUPP;
11527         switch (arg1) {
11528           case TARGET_SSI_IEEE_FP_CONTROL:
11529             {
11530                 uint64_t swcr, fpcr;
11531 
11532                 if (get_user_u64 (swcr, arg2)) {
11533                     return -TARGET_EFAULT;
11534                 }
11535 
11536                 /*
11537                  * The kernel calls swcr_update_status to update the
11538                  * status bits from the fpcr at every point that it
11539                  * could be queried.  Therefore, we store the status
11540                  * bits only in FPCR.
11541                  */
11542                 cpu_env->swcr = swcr & (SWCR_TRAP_ENABLE_MASK | SWCR_MAP_MASK);
11543 
11544                 fpcr = cpu_alpha_load_fpcr(cpu_env);
11545                 fpcr &= ((uint64_t)FPCR_DYN_MASK << 32);
11546                 fpcr |= alpha_ieee_swcr_to_fpcr(swcr);
11547                 cpu_alpha_store_fpcr(cpu_env, fpcr);
11548                 ret = 0;
11549             }
11550             break;
11551 
11552           case TARGET_SSI_IEEE_RAISE_EXCEPTION:
11553             {
11554                 uint64_t exc, fpcr, fex;
11555 
11556                 if (get_user_u64(exc, arg2)) {
11557                     return -TARGET_EFAULT;
11558                 }
11559                 exc &= SWCR_STATUS_MASK;
11560                 fpcr = cpu_alpha_load_fpcr(cpu_env);
11561 
11562                 /* Old exceptions are not signaled.  */
11563                 fex = alpha_ieee_fpcr_to_swcr(fpcr);
11564                 fex = exc & ~fex;
11565                 fex >>= SWCR_STATUS_TO_EXCSUM_SHIFT;
11566                 fex &= (cpu_env)->swcr;
11567 
11568                 /* Update the hardware fpcr.  */
11569                 fpcr |= alpha_ieee_swcr_to_fpcr(exc);
11570                 cpu_alpha_store_fpcr(cpu_env, fpcr);
11571 
11572                 if (fex) {
11573                     int si_code = TARGET_FPE_FLTUNK;
11574                     target_siginfo_t info;
11575 
11576                     if (fex & SWCR_TRAP_ENABLE_DNO) {
11577                         si_code = TARGET_FPE_FLTUND;
11578                     }
11579                     if (fex & SWCR_TRAP_ENABLE_INE) {
11580                         si_code = TARGET_FPE_FLTRES;
11581                     }
11582                     if (fex & SWCR_TRAP_ENABLE_UNF) {
11583                         si_code = TARGET_FPE_FLTUND;
11584                     }
11585                     if (fex & SWCR_TRAP_ENABLE_OVF) {
11586                         si_code = TARGET_FPE_FLTOVF;
11587                     }
11588                     if (fex & SWCR_TRAP_ENABLE_DZE) {
11589                         si_code = TARGET_FPE_FLTDIV;
11590                     }
11591                     if (fex & SWCR_TRAP_ENABLE_INV) {
11592                         si_code = TARGET_FPE_FLTINV;
11593                     }
11594 
11595                     info.si_signo = SIGFPE;
11596                     info.si_errno = 0;
11597                     info.si_code = si_code;
11598                     info._sifields._sigfault._addr = (cpu_env)->pc;
11599                     queue_signal(cpu_env, info.si_signo,
11600                                  QEMU_SI_FAULT, &info);
11601                 }
11602                 ret = 0;
11603             }
11604             break;
11605 
11606           /* case SSI_NVPAIRS:
11607              -- Used with SSIN_UACPROC to enable unaligned accesses.
11608              case SSI_IEEE_STATE_AT_SIGNAL:
11609              case SSI_IEEE_IGNORE_STATE_AT_SIGNAL:
11610              -- Not implemented in linux kernel
11611           */
11612         }
11613         return ret;
11614 #endif
11615 #ifdef TARGET_NR_osf_sigprocmask
11616     /* Alpha specific.  */
11617     case TARGET_NR_osf_sigprocmask:
11618         {
11619             abi_ulong mask;
11620             int how;
11621             sigset_t set, oldset;
11622 
11623             switch(arg1) {
11624             case TARGET_SIG_BLOCK:
11625                 how = SIG_BLOCK;
11626                 break;
11627             case TARGET_SIG_UNBLOCK:
11628                 how = SIG_UNBLOCK;
11629                 break;
11630             case TARGET_SIG_SETMASK:
11631                 how = SIG_SETMASK;
11632                 break;
11633             default:
11634                 return -TARGET_EINVAL;
11635             }
11636             mask = arg2;
11637             target_to_host_old_sigset(&set, &mask);
11638             ret = do_sigprocmask(how, &set, &oldset);
11639             if (!ret) {
11640                 host_to_target_old_sigset(&mask, &oldset);
11641                 ret = mask;
11642             }
11643         }
11644         return ret;
11645 #endif
11646 
11647 #ifdef TARGET_NR_getgid32
11648     case TARGET_NR_getgid32:
11649         return get_errno(getgid());
11650 #endif
11651 #ifdef TARGET_NR_geteuid32
11652     case TARGET_NR_geteuid32:
11653         return get_errno(geteuid());
11654 #endif
11655 #ifdef TARGET_NR_getegid32
11656     case TARGET_NR_getegid32:
11657         return get_errno(getegid());
11658 #endif
11659 #ifdef TARGET_NR_setreuid32
11660     case TARGET_NR_setreuid32:
11661         return get_errno(setreuid(arg1, arg2));
11662 #endif
11663 #ifdef TARGET_NR_setregid32
11664     case TARGET_NR_setregid32:
11665         return get_errno(setregid(arg1, arg2));
11666 #endif
11667 #ifdef TARGET_NR_getgroups32
11668     case TARGET_NR_getgroups32:
11669         {
11670             int gidsetsize = arg1;
11671             uint32_t *target_grouplist;
11672             gid_t *grouplist;
11673             int i;
11674 
11675             grouplist = alloca(gidsetsize * sizeof(gid_t));
11676             ret = get_errno(getgroups(gidsetsize, grouplist));
11677             if (gidsetsize == 0)
11678                 return ret;
11679             if (!is_error(ret)) {
11680                 target_grouplist = lock_user(VERIFY_WRITE, arg2, gidsetsize * 4, 0);
11681                 if (!target_grouplist) {
11682                     return -TARGET_EFAULT;
11683                 }
11684                 for(i = 0;i < ret; i++)
11685                     target_grouplist[i] = tswap32(grouplist[i]);
11686                 unlock_user(target_grouplist, arg2, gidsetsize * 4);
11687             }
11688         }
11689         return ret;
11690 #endif
11691 #ifdef TARGET_NR_setgroups32
11692     case TARGET_NR_setgroups32:
11693         {
11694             int gidsetsize = arg1;
11695             uint32_t *target_grouplist;
11696             gid_t *grouplist;
11697             int i;
11698 
11699             grouplist = alloca(gidsetsize * sizeof(gid_t));
11700             target_grouplist = lock_user(VERIFY_READ, arg2, gidsetsize * 4, 1);
11701             if (!target_grouplist) {
11702                 return -TARGET_EFAULT;
11703             }
11704             for(i = 0;i < gidsetsize; i++)
11705                 grouplist[i] = tswap32(target_grouplist[i]);
11706             unlock_user(target_grouplist, arg2, 0);
11707             return get_errno(setgroups(gidsetsize, grouplist));
11708         }
11709 #endif
11710 #ifdef TARGET_NR_fchown32
11711     case TARGET_NR_fchown32:
11712         return get_errno(fchown(arg1, arg2, arg3));
11713 #endif
11714 #ifdef TARGET_NR_setresuid32
11715     case TARGET_NR_setresuid32:
11716         return get_errno(sys_setresuid(arg1, arg2, arg3));
11717 #endif
11718 #ifdef TARGET_NR_getresuid32
11719     case TARGET_NR_getresuid32:
11720         {
11721             uid_t ruid, euid, suid;
11722             ret = get_errno(getresuid(&ruid, &euid, &suid));
11723             if (!is_error(ret)) {
11724                 if (put_user_u32(ruid, arg1)
11725                     || put_user_u32(euid, arg2)
11726                     || put_user_u32(suid, arg3))
11727                     return -TARGET_EFAULT;
11728             }
11729         }
11730         return ret;
11731 #endif
11732 #ifdef TARGET_NR_setresgid32
11733     case TARGET_NR_setresgid32:
11734         return get_errno(sys_setresgid(arg1, arg2, arg3));
11735 #endif
11736 #ifdef TARGET_NR_getresgid32
11737     case TARGET_NR_getresgid32:
11738         {
11739             gid_t rgid, egid, sgid;
11740             ret = get_errno(getresgid(&rgid, &egid, &sgid));
11741             if (!is_error(ret)) {
11742                 if (put_user_u32(rgid, arg1)
11743                     || put_user_u32(egid, arg2)
11744                     || put_user_u32(sgid, arg3))
11745                     return -TARGET_EFAULT;
11746             }
11747         }
11748         return ret;
11749 #endif
11750 #ifdef TARGET_NR_chown32
11751     case TARGET_NR_chown32:
11752         if (!(p = lock_user_string(arg1)))
11753             return -TARGET_EFAULT;
11754         ret = get_errno(chown(p, arg2, arg3));
11755         unlock_user(p, arg1, 0);
11756         return ret;
11757 #endif
11758 #ifdef TARGET_NR_setuid32
11759     case TARGET_NR_setuid32:
11760         return get_errno(sys_setuid(arg1));
11761 #endif
11762 #ifdef TARGET_NR_setgid32
11763     case TARGET_NR_setgid32:
11764         return get_errno(sys_setgid(arg1));
11765 #endif
11766 #ifdef TARGET_NR_setfsuid32
11767     case TARGET_NR_setfsuid32:
11768         return get_errno(setfsuid(arg1));
11769 #endif
11770 #ifdef TARGET_NR_setfsgid32
11771     case TARGET_NR_setfsgid32:
11772         return get_errno(setfsgid(arg1));
11773 #endif
11774 #ifdef TARGET_NR_mincore
11775     case TARGET_NR_mincore:
11776         {
11777             void *a = lock_user(VERIFY_READ, arg1, arg2, 0);
11778             if (!a) {
11779                 return -TARGET_ENOMEM;
11780             }
11781             p = lock_user_string(arg3);
11782             if (!p) {
11783                 ret = -TARGET_EFAULT;
11784             } else {
11785                 ret = get_errno(mincore(a, arg2, p));
11786                 unlock_user(p, arg3, ret);
11787             }
11788             unlock_user(a, arg1, 0);
11789         }
11790         return ret;
11791 #endif
11792 #ifdef TARGET_NR_arm_fadvise64_64
11793     case TARGET_NR_arm_fadvise64_64:
11794         /* arm_fadvise64_64 looks like fadvise64_64 but
11795          * with different argument order: fd, advice, offset, len
11796          * rather than the usual fd, offset, len, advice.
11797          * Note that offset and len are both 64-bit so appear as
11798          * pairs of 32-bit registers.
11799          */
11800         ret = posix_fadvise(arg1, target_offset64(arg3, arg4),
11801                             target_offset64(arg5, arg6), arg2);
11802         return -host_to_target_errno(ret);
11803 #endif
11804 
11805 #if TARGET_ABI_BITS == 32 && !defined(TARGET_ABI_MIPSN32)
11806 
11807 #ifdef TARGET_NR_fadvise64_64
11808     case TARGET_NR_fadvise64_64:
11809 #if defined(TARGET_PPC) || defined(TARGET_XTENSA)
11810         /* 6 args: fd, advice, offset (high, low), len (high, low) */
11811         ret = arg2;
11812         arg2 = arg3;
11813         arg3 = arg4;
11814         arg4 = arg5;
11815         arg5 = arg6;
11816         arg6 = ret;
11817 #else
11818         /* 6 args: fd, offset (high, low), len (high, low), advice */
11819         if (regpairs_aligned(cpu_env, num)) {
11820             /* offset is in (3,4), len in (5,6) and advice in 7 */
11821             arg2 = arg3;
11822             arg3 = arg4;
11823             arg4 = arg5;
11824             arg5 = arg6;
11825             arg6 = arg7;
11826         }
11827 #endif
11828         ret = posix_fadvise(arg1, target_offset64(arg2, arg3),
11829                             target_offset64(arg4, arg5), arg6);
11830         return -host_to_target_errno(ret);
11831 #endif
11832 
11833 #ifdef TARGET_NR_fadvise64
11834     case TARGET_NR_fadvise64:
11835         /* 5 args: fd, offset (high, low), len, advice */
11836         if (regpairs_aligned(cpu_env, num)) {
11837             /* offset is in (3,4), len in 5 and advice in 6 */
11838             arg2 = arg3;
11839             arg3 = arg4;
11840             arg4 = arg5;
11841             arg5 = arg6;
11842         }
11843         ret = posix_fadvise(arg1, target_offset64(arg2, arg3), arg4, arg5);
11844         return -host_to_target_errno(ret);
11845 #endif
11846 
11847 #else /* not a 32-bit ABI */
11848 #if defined(TARGET_NR_fadvise64_64) || defined(TARGET_NR_fadvise64)
11849 #ifdef TARGET_NR_fadvise64_64
11850     case TARGET_NR_fadvise64_64:
11851 #endif
11852 #ifdef TARGET_NR_fadvise64
11853     case TARGET_NR_fadvise64:
11854 #endif
11855 #ifdef TARGET_S390X
11856         switch (arg4) {
11857         case 4: arg4 = POSIX_FADV_NOREUSE + 1; break; /* make sure it's an invalid value */
11858         case 5: arg4 = POSIX_FADV_NOREUSE + 2; break; /* ditto */
11859         case 6: arg4 = POSIX_FADV_DONTNEED; break;
11860         case 7: arg4 = POSIX_FADV_NOREUSE; break;
11861         default: break;
11862         }
11863 #endif
11864         return -host_to_target_errno(posix_fadvise(arg1, arg2, arg3, arg4));
11865 #endif
11866 #endif /* end of 64-bit ABI fadvise handling */
11867 
11868 #ifdef TARGET_NR_madvise
11869     case TARGET_NR_madvise:
11870         return target_madvise(arg1, arg2, arg3);
11871 #endif
11872 #ifdef TARGET_NR_fcntl64
11873     case TARGET_NR_fcntl64:
11874     {
11875         int cmd;
11876         struct flock64 fl;
11877         from_flock64_fn *copyfrom = copy_from_user_flock64;
11878         to_flock64_fn *copyto = copy_to_user_flock64;
11879 
11880 #ifdef TARGET_ARM
11881         if (!cpu_env->eabi) {
11882             copyfrom = copy_from_user_oabi_flock64;
11883             copyto = copy_to_user_oabi_flock64;
11884         }
11885 #endif
11886 
11887         cmd = target_to_host_fcntl_cmd(arg2);
11888         if (cmd == -TARGET_EINVAL) {
11889             return cmd;
11890         }
11891 
11892         switch(arg2) {
11893         case TARGET_F_GETLK64:
11894             ret = copyfrom(&fl, arg3);
11895             if (ret) {
11896                 break;
11897             }
11898             ret = get_errno(safe_fcntl(arg1, cmd, &fl));
11899             if (ret == 0) {
11900                 ret = copyto(arg3, &fl);
11901             }
11902 	    break;
11903 
11904         case TARGET_F_SETLK64:
11905         case TARGET_F_SETLKW64:
11906             ret = copyfrom(&fl, arg3);
11907             if (ret) {
11908                 break;
11909             }
11910             ret = get_errno(safe_fcntl(arg1, cmd, &fl));
11911 	    break;
11912         default:
11913             ret = do_fcntl(arg1, arg2, arg3);
11914             break;
11915         }
11916         return ret;
11917     }
11918 #endif
11919 #ifdef TARGET_NR_cacheflush
11920     case TARGET_NR_cacheflush:
11921         /* self-modifying code is handled automatically, so nothing needed */
11922         return 0;
11923 #endif
11924 #ifdef TARGET_NR_getpagesize
11925     case TARGET_NR_getpagesize:
11926         return TARGET_PAGE_SIZE;
11927 #endif
11928     case TARGET_NR_gettid:
11929         return get_errno(sys_gettid());
11930 #ifdef TARGET_NR_readahead
11931     case TARGET_NR_readahead:
11932 #if TARGET_ABI_BITS == 32 && !defined(TARGET_ABI_MIPSN32)
11933         if (regpairs_aligned(cpu_env, num)) {
11934             arg2 = arg3;
11935             arg3 = arg4;
11936             arg4 = arg5;
11937         }
11938         ret = get_errno(readahead(arg1, target_offset64(arg2, arg3) , arg4));
11939 #else
11940         ret = get_errno(readahead(arg1, arg2, arg3));
11941 #endif
11942         return ret;
11943 #endif
11944 #ifdef CONFIG_ATTR
11945 #ifdef TARGET_NR_setxattr
11946     case TARGET_NR_listxattr:
11947     case TARGET_NR_llistxattr:
11948     {
11949         void *p, *b = 0;
11950         if (arg2) {
11951             b = lock_user(VERIFY_WRITE, arg2, arg3, 0);
11952             if (!b) {
11953                 return -TARGET_EFAULT;
11954             }
11955         }
11956         p = lock_user_string(arg1);
11957         if (p) {
11958             if (num == TARGET_NR_listxattr) {
11959                 ret = get_errno(listxattr(p, b, arg3));
11960             } else {
11961                 ret = get_errno(llistxattr(p, b, arg3));
11962             }
11963         } else {
11964             ret = -TARGET_EFAULT;
11965         }
11966         unlock_user(p, arg1, 0);
11967         unlock_user(b, arg2, arg3);
11968         return ret;
11969     }
11970     case TARGET_NR_flistxattr:
11971     {
11972         void *b = 0;
11973         if (arg2) {
11974             b = lock_user(VERIFY_WRITE, arg2, arg3, 0);
11975             if (!b) {
11976                 return -TARGET_EFAULT;
11977             }
11978         }
11979         ret = get_errno(flistxattr(arg1, b, arg3));
11980         unlock_user(b, arg2, arg3);
11981         return ret;
11982     }
11983     case TARGET_NR_setxattr:
11984     case TARGET_NR_lsetxattr:
11985         {
11986             void *p, *n, *v = 0;
11987             if (arg3) {
11988                 v = lock_user(VERIFY_READ, arg3, arg4, 1);
11989                 if (!v) {
11990                     return -TARGET_EFAULT;
11991                 }
11992             }
11993             p = lock_user_string(arg1);
11994             n = lock_user_string(arg2);
11995             if (p && n) {
11996                 if (num == TARGET_NR_setxattr) {
11997                     ret = get_errno(setxattr(p, n, v, arg4, arg5));
11998                 } else {
11999                     ret = get_errno(lsetxattr(p, n, v, arg4, arg5));
12000                 }
12001             } else {
12002                 ret = -TARGET_EFAULT;
12003             }
12004             unlock_user(p, arg1, 0);
12005             unlock_user(n, arg2, 0);
12006             unlock_user(v, arg3, 0);
12007         }
12008         return ret;
12009     case TARGET_NR_fsetxattr:
12010         {
12011             void *n, *v = 0;
12012             if (arg3) {
12013                 v = lock_user(VERIFY_READ, arg3, arg4, 1);
12014                 if (!v) {
12015                     return -TARGET_EFAULT;
12016                 }
12017             }
12018             n = lock_user_string(arg2);
12019             if (n) {
12020                 ret = get_errno(fsetxattr(arg1, n, v, arg4, arg5));
12021             } else {
12022                 ret = -TARGET_EFAULT;
12023             }
12024             unlock_user(n, arg2, 0);
12025             unlock_user(v, arg3, 0);
12026         }
12027         return ret;
12028     case TARGET_NR_getxattr:
12029     case TARGET_NR_lgetxattr:
12030         {
12031             void *p, *n, *v = 0;
12032             if (arg3) {
12033                 v = lock_user(VERIFY_WRITE, arg3, arg4, 0);
12034                 if (!v) {
12035                     return -TARGET_EFAULT;
12036                 }
12037             }
12038             p = lock_user_string(arg1);
12039             n = lock_user_string(arg2);
12040             if (p && n) {
12041                 if (num == TARGET_NR_getxattr) {
12042                     ret = get_errno(getxattr(p, n, v, arg4));
12043                 } else {
12044                     ret = get_errno(lgetxattr(p, n, v, arg4));
12045                 }
12046             } else {
12047                 ret = -TARGET_EFAULT;
12048             }
12049             unlock_user(p, arg1, 0);
12050             unlock_user(n, arg2, 0);
12051             unlock_user(v, arg3, arg4);
12052         }
12053         return ret;
12054     case TARGET_NR_fgetxattr:
12055         {
12056             void *n, *v = 0;
12057             if (arg3) {
12058                 v = lock_user(VERIFY_WRITE, arg3, arg4, 0);
12059                 if (!v) {
12060                     return -TARGET_EFAULT;
12061                 }
12062             }
12063             n = lock_user_string(arg2);
12064             if (n) {
12065                 ret = get_errno(fgetxattr(arg1, n, v, arg4));
12066             } else {
12067                 ret = -TARGET_EFAULT;
12068             }
12069             unlock_user(n, arg2, 0);
12070             unlock_user(v, arg3, arg4);
12071         }
12072         return ret;
12073     case TARGET_NR_removexattr:
12074     case TARGET_NR_lremovexattr:
12075         {
12076             void *p, *n;
12077             p = lock_user_string(arg1);
12078             n = lock_user_string(arg2);
12079             if (p && n) {
12080                 if (num == TARGET_NR_removexattr) {
12081                     ret = get_errno(removexattr(p, n));
12082                 } else {
12083                     ret = get_errno(lremovexattr(p, n));
12084                 }
12085             } else {
12086                 ret = -TARGET_EFAULT;
12087             }
12088             unlock_user(p, arg1, 0);
12089             unlock_user(n, arg2, 0);
12090         }
12091         return ret;
12092     case TARGET_NR_fremovexattr:
12093         {
12094             void *n;
12095             n = lock_user_string(arg2);
12096             if (n) {
12097                 ret = get_errno(fremovexattr(arg1, n));
12098             } else {
12099                 ret = -TARGET_EFAULT;
12100             }
12101             unlock_user(n, arg2, 0);
12102         }
12103         return ret;
12104 #endif
12105 #endif /* CONFIG_ATTR */
12106 #ifdef TARGET_NR_set_thread_area
12107     case TARGET_NR_set_thread_area:
12108 #if defined(TARGET_MIPS)
12109       cpu_env->active_tc.CP0_UserLocal = arg1;
12110       return 0;
12111 #elif defined(TARGET_CRIS)
12112       if (arg1 & 0xff)
12113           ret = -TARGET_EINVAL;
12114       else {
12115           cpu_env->pregs[PR_PID] = arg1;
12116           ret = 0;
12117       }
12118       return ret;
12119 #elif defined(TARGET_I386) && defined(TARGET_ABI32)
12120       return do_set_thread_area(cpu_env, arg1);
12121 #elif defined(TARGET_M68K)
12122       {
12123           TaskState *ts = cpu->opaque;
12124           ts->tp_value = arg1;
12125           return 0;
12126       }
12127 #else
12128       return -TARGET_ENOSYS;
12129 #endif
12130 #endif
12131 #ifdef TARGET_NR_get_thread_area
12132     case TARGET_NR_get_thread_area:
12133 #if defined(TARGET_I386) && defined(TARGET_ABI32)
12134         return do_get_thread_area(cpu_env, arg1);
12135 #elif defined(TARGET_M68K)
12136         {
12137             TaskState *ts = cpu->opaque;
12138             return ts->tp_value;
12139         }
12140 #else
12141         return -TARGET_ENOSYS;
12142 #endif
12143 #endif
12144 #ifdef TARGET_NR_getdomainname
12145     case TARGET_NR_getdomainname:
12146         return -TARGET_ENOSYS;
12147 #endif
12148 
12149 #ifdef TARGET_NR_clock_settime
12150     case TARGET_NR_clock_settime:
12151     {
12152         struct timespec ts;
12153 
12154         ret = target_to_host_timespec(&ts, arg2);
12155         if (!is_error(ret)) {
12156             ret = get_errno(clock_settime(arg1, &ts));
12157         }
12158         return ret;
12159     }
12160 #endif
12161 #ifdef TARGET_NR_clock_settime64
12162     case TARGET_NR_clock_settime64:
12163     {
12164         struct timespec ts;
12165 
12166         ret = target_to_host_timespec64(&ts, arg2);
12167         if (!is_error(ret)) {
12168             ret = get_errno(clock_settime(arg1, &ts));
12169         }
12170         return ret;
12171     }
12172 #endif
12173 #ifdef TARGET_NR_clock_gettime
12174     case TARGET_NR_clock_gettime:
12175     {
12176         struct timespec ts;
12177         ret = get_errno(clock_gettime(arg1, &ts));
12178         if (!is_error(ret)) {
12179             ret = host_to_target_timespec(arg2, &ts);
12180         }
12181         return ret;
12182     }
12183 #endif
12184 #ifdef TARGET_NR_clock_gettime64
12185     case TARGET_NR_clock_gettime64:
12186     {
12187         struct timespec ts;
12188         ret = get_errno(clock_gettime(arg1, &ts));
12189         if (!is_error(ret)) {
12190             ret = host_to_target_timespec64(arg2, &ts);
12191         }
12192         return ret;
12193     }
12194 #endif
12195 #ifdef TARGET_NR_clock_getres
12196     case TARGET_NR_clock_getres:
12197     {
12198         struct timespec ts;
12199         ret = get_errno(clock_getres(arg1, &ts));
12200         if (!is_error(ret)) {
12201             host_to_target_timespec(arg2, &ts);
12202         }
12203         return ret;
12204     }
12205 #endif
12206 #ifdef TARGET_NR_clock_getres_time64
12207     case TARGET_NR_clock_getres_time64:
12208     {
12209         struct timespec ts;
12210         ret = get_errno(clock_getres(arg1, &ts));
12211         if (!is_error(ret)) {
12212             host_to_target_timespec64(arg2, &ts);
12213         }
12214         return ret;
12215     }
12216 #endif
12217 #ifdef TARGET_NR_clock_nanosleep
12218     case TARGET_NR_clock_nanosleep:
12219     {
12220         struct timespec ts;
12221         if (target_to_host_timespec(&ts, arg3)) {
12222             return -TARGET_EFAULT;
12223         }
12224         ret = get_errno(safe_clock_nanosleep(arg1, arg2,
12225                                              &ts, arg4 ? &ts : NULL));
12226         /*
12227          * if the call is interrupted by a signal handler, it fails
12228          * with error -TARGET_EINTR and if arg4 is not NULL and arg2 is not
12229          * TIMER_ABSTIME, it returns the remaining unslept time in arg4.
12230          */
12231         if (ret == -TARGET_EINTR && arg4 && arg2 != TIMER_ABSTIME &&
12232             host_to_target_timespec(arg4, &ts)) {
12233               return -TARGET_EFAULT;
12234         }
12235 
12236         return ret;
12237     }
12238 #endif
12239 #ifdef TARGET_NR_clock_nanosleep_time64
12240     case TARGET_NR_clock_nanosleep_time64:
12241     {
12242         struct timespec ts;
12243 
12244         if (target_to_host_timespec64(&ts, arg3)) {
12245             return -TARGET_EFAULT;
12246         }
12247 
12248         ret = get_errno(safe_clock_nanosleep(arg1, arg2,
12249                                              &ts, arg4 ? &ts : NULL));
12250 
12251         if (ret == -TARGET_EINTR && arg4 && arg2 != TIMER_ABSTIME &&
12252             host_to_target_timespec64(arg4, &ts)) {
12253             return -TARGET_EFAULT;
12254         }
12255         return ret;
12256     }
12257 #endif
12258 
12259 #if defined(TARGET_NR_set_tid_address)
12260     case TARGET_NR_set_tid_address:
12261     {
12262         TaskState *ts = cpu->opaque;
12263         ts->child_tidptr = arg1;
12264         /* do not call host set_tid_address() syscall, instead return tid() */
12265         return get_errno(sys_gettid());
12266     }
12267 #endif
12268 
12269     case TARGET_NR_tkill:
12270         return get_errno(safe_tkill((int)arg1, target_to_host_signal(arg2)));
12271 
12272     case TARGET_NR_tgkill:
12273         return get_errno(safe_tgkill((int)arg1, (int)arg2,
12274                          target_to_host_signal(arg3)));
12275 
12276 #ifdef TARGET_NR_set_robust_list
12277     case TARGET_NR_set_robust_list:
12278     case TARGET_NR_get_robust_list:
12279         /* The ABI for supporting robust futexes has userspace pass
12280          * the kernel a pointer to a linked list which is updated by
12281          * userspace after the syscall; the list is walked by the kernel
12282          * when the thread exits. Since the linked list in QEMU guest
12283          * memory isn't a valid linked list for the host and we have
12284          * no way to reliably intercept the thread-death event, we can't
12285          * support these. Silently return ENOSYS so that guest userspace
12286          * falls back to a non-robust futex implementation (which should
12287          * be OK except in the corner case of the guest crashing while
12288          * holding a mutex that is shared with another process via
12289          * shared memory).
12290          */
12291         return -TARGET_ENOSYS;
12292 #endif
12293 
12294 #if defined(TARGET_NR_utimensat)
12295     case TARGET_NR_utimensat:
12296         {
12297             struct timespec *tsp, ts[2];
12298             if (!arg3) {
12299                 tsp = NULL;
12300             } else {
12301                 if (target_to_host_timespec(ts, arg3)) {
12302                     return -TARGET_EFAULT;
12303                 }
12304                 if (target_to_host_timespec(ts + 1, arg3 +
12305                                             sizeof(struct target_timespec))) {
12306                     return -TARGET_EFAULT;
12307                 }
12308                 tsp = ts;
12309             }
12310             if (!arg2)
12311                 ret = get_errno(sys_utimensat(arg1, NULL, tsp, arg4));
12312             else {
12313                 if (!(p = lock_user_string(arg2))) {
12314                     return -TARGET_EFAULT;
12315                 }
12316                 ret = get_errno(sys_utimensat(arg1, path(p), tsp, arg4));
12317                 unlock_user(p, arg2, 0);
12318             }
12319         }
12320         return ret;
12321 #endif
12322 #ifdef TARGET_NR_utimensat_time64
12323     case TARGET_NR_utimensat_time64:
12324         {
12325             struct timespec *tsp, ts[2];
12326             if (!arg3) {
12327                 tsp = NULL;
12328             } else {
12329                 if (target_to_host_timespec64(ts, arg3)) {
12330                     return -TARGET_EFAULT;
12331                 }
12332                 if (target_to_host_timespec64(ts + 1, arg3 +
12333                                      sizeof(struct target__kernel_timespec))) {
12334                     return -TARGET_EFAULT;
12335                 }
12336                 tsp = ts;
12337             }
12338             if (!arg2)
12339                 ret = get_errno(sys_utimensat(arg1, NULL, tsp, arg4));
12340             else {
12341                 p = lock_user_string(arg2);
12342                 if (!p) {
12343                     return -TARGET_EFAULT;
12344                 }
12345                 ret = get_errno(sys_utimensat(arg1, path(p), tsp, arg4));
12346                 unlock_user(p, arg2, 0);
12347             }
12348         }
12349         return ret;
12350 #endif
12351 #ifdef TARGET_NR_futex
12352     case TARGET_NR_futex:
12353         return do_futex(cpu, false, arg1, arg2, arg3, arg4, arg5, arg6);
12354 #endif
12355 #ifdef TARGET_NR_futex_time64
12356     case TARGET_NR_futex_time64:
12357         return do_futex(cpu, true, arg1, arg2, arg3, arg4, arg5, arg6);
12358 #endif
12359 #ifdef CONFIG_INOTIFY
12360 #if defined(TARGET_NR_inotify_init)
12361     case TARGET_NR_inotify_init:
12362         ret = get_errno(inotify_init());
12363         if (ret >= 0) {
12364             fd_trans_register(ret, &target_inotify_trans);
12365         }
12366         return ret;
12367 #endif
12368 #if defined(TARGET_NR_inotify_init1) && defined(CONFIG_INOTIFY1)
12369     case TARGET_NR_inotify_init1:
12370         ret = get_errno(inotify_init1(target_to_host_bitmask(arg1,
12371                                           fcntl_flags_tbl)));
12372         if (ret >= 0) {
12373             fd_trans_register(ret, &target_inotify_trans);
12374         }
12375         return ret;
12376 #endif
12377 #if defined(TARGET_NR_inotify_add_watch)
12378     case TARGET_NR_inotify_add_watch:
12379         p = lock_user_string(arg2);
12380         ret = get_errno(inotify_add_watch(arg1, path(p), arg3));
12381         unlock_user(p, arg2, 0);
12382         return ret;
12383 #endif
12384 #if defined(TARGET_NR_inotify_rm_watch)
12385     case TARGET_NR_inotify_rm_watch:
12386         return get_errno(inotify_rm_watch(arg1, arg2));
12387 #endif
12388 #endif
12389 
12390 #if defined(TARGET_NR_mq_open) && defined(__NR_mq_open)
12391     case TARGET_NR_mq_open:
12392         {
12393             struct mq_attr posix_mq_attr;
12394             struct mq_attr *pposix_mq_attr;
12395             int host_flags;
12396 
12397             host_flags = target_to_host_bitmask(arg2, fcntl_flags_tbl);
12398             pposix_mq_attr = NULL;
12399             if (arg4) {
12400                 if (copy_from_user_mq_attr(&posix_mq_attr, arg4) != 0) {
12401                     return -TARGET_EFAULT;
12402                 }
12403                 pposix_mq_attr = &posix_mq_attr;
12404             }
12405             p = lock_user_string(arg1 - 1);
12406             if (!p) {
12407                 return -TARGET_EFAULT;
12408             }
12409             ret = get_errno(mq_open(p, host_flags, arg3, pposix_mq_attr));
12410             unlock_user (p, arg1, 0);
12411         }
12412         return ret;
12413 
12414     case TARGET_NR_mq_unlink:
12415         p = lock_user_string(arg1 - 1);
12416         if (!p) {
12417             return -TARGET_EFAULT;
12418         }
12419         ret = get_errno(mq_unlink(p));
12420         unlock_user (p, arg1, 0);
12421         return ret;
12422 
12423 #ifdef TARGET_NR_mq_timedsend
12424     case TARGET_NR_mq_timedsend:
12425         {
12426             struct timespec ts;
12427 
12428             p = lock_user (VERIFY_READ, arg2, arg3, 1);
12429             if (arg5 != 0) {
12430                 if (target_to_host_timespec(&ts, arg5)) {
12431                     return -TARGET_EFAULT;
12432                 }
12433                 ret = get_errno(safe_mq_timedsend(arg1, p, arg3, arg4, &ts));
12434                 if (!is_error(ret) && host_to_target_timespec(arg5, &ts)) {
12435                     return -TARGET_EFAULT;
12436                 }
12437             } else {
12438                 ret = get_errno(safe_mq_timedsend(arg1, p, arg3, arg4, NULL));
12439             }
12440             unlock_user (p, arg2, arg3);
12441         }
12442         return ret;
12443 #endif
12444 #ifdef TARGET_NR_mq_timedsend_time64
12445     case TARGET_NR_mq_timedsend_time64:
12446         {
12447             struct timespec ts;
12448 
12449             p = lock_user(VERIFY_READ, arg2, arg3, 1);
12450             if (arg5 != 0) {
12451                 if (target_to_host_timespec64(&ts, arg5)) {
12452                     return -TARGET_EFAULT;
12453                 }
12454                 ret = get_errno(safe_mq_timedsend(arg1, p, arg3, arg4, &ts));
12455                 if (!is_error(ret) && host_to_target_timespec64(arg5, &ts)) {
12456                     return -TARGET_EFAULT;
12457                 }
12458             } else {
12459                 ret = get_errno(safe_mq_timedsend(arg1, p, arg3, arg4, NULL));
12460             }
12461             unlock_user(p, arg2, arg3);
12462         }
12463         return ret;
12464 #endif
12465 
12466 #ifdef TARGET_NR_mq_timedreceive
12467     case TARGET_NR_mq_timedreceive:
12468         {
12469             struct timespec ts;
12470             unsigned int prio;
12471 
12472             p = lock_user (VERIFY_READ, arg2, arg3, 1);
12473             if (arg5 != 0) {
12474                 if (target_to_host_timespec(&ts, arg5)) {
12475                     return -TARGET_EFAULT;
12476                 }
12477                 ret = get_errno(safe_mq_timedreceive(arg1, p, arg3,
12478                                                      &prio, &ts));
12479                 if (!is_error(ret) && host_to_target_timespec(arg5, &ts)) {
12480                     return -TARGET_EFAULT;
12481                 }
12482             } else {
12483                 ret = get_errno(safe_mq_timedreceive(arg1, p, arg3,
12484                                                      &prio, NULL));
12485             }
12486             unlock_user (p, arg2, arg3);
12487             if (arg4 != 0)
12488                 put_user_u32(prio, arg4);
12489         }
12490         return ret;
12491 #endif
12492 #ifdef TARGET_NR_mq_timedreceive_time64
12493     case TARGET_NR_mq_timedreceive_time64:
12494         {
12495             struct timespec ts;
12496             unsigned int prio;
12497 
12498             p = lock_user(VERIFY_READ, arg2, arg3, 1);
12499             if (arg5 != 0) {
12500                 if (target_to_host_timespec64(&ts, arg5)) {
12501                     return -TARGET_EFAULT;
12502                 }
12503                 ret = get_errno(safe_mq_timedreceive(arg1, p, arg3,
12504                                                      &prio, &ts));
12505                 if (!is_error(ret) && host_to_target_timespec64(arg5, &ts)) {
12506                     return -TARGET_EFAULT;
12507                 }
12508             } else {
12509                 ret = get_errno(safe_mq_timedreceive(arg1, p, arg3,
12510                                                      &prio, NULL));
12511             }
12512             unlock_user(p, arg2, arg3);
12513             if (arg4 != 0) {
12514                 put_user_u32(prio, arg4);
12515             }
12516         }
12517         return ret;
12518 #endif
12519 
12520     /* Not implemented for now... */
12521 /*     case TARGET_NR_mq_notify: */
12522 /*         break; */
12523 
12524     case TARGET_NR_mq_getsetattr:
12525         {
12526             struct mq_attr posix_mq_attr_in, posix_mq_attr_out;
12527             ret = 0;
12528             if (arg2 != 0) {
12529                 copy_from_user_mq_attr(&posix_mq_attr_in, arg2);
12530                 ret = get_errno(mq_setattr(arg1, &posix_mq_attr_in,
12531                                            &posix_mq_attr_out));
12532             } else if (arg3 != 0) {
12533                 ret = get_errno(mq_getattr(arg1, &posix_mq_attr_out));
12534             }
12535             if (ret == 0 && arg3 != 0) {
12536                 copy_to_user_mq_attr(arg3, &posix_mq_attr_out);
12537             }
12538         }
12539         return ret;
12540 #endif
12541 
12542 #ifdef CONFIG_SPLICE
12543 #ifdef TARGET_NR_tee
12544     case TARGET_NR_tee:
12545         {
12546             ret = get_errno(tee(arg1,arg2,arg3,arg4));
12547         }
12548         return ret;
12549 #endif
12550 #ifdef TARGET_NR_splice
12551     case TARGET_NR_splice:
12552         {
12553             loff_t loff_in, loff_out;
12554             loff_t *ploff_in = NULL, *ploff_out = NULL;
12555             if (arg2) {
12556                 if (get_user_u64(loff_in, arg2)) {
12557                     return -TARGET_EFAULT;
12558                 }
12559                 ploff_in = &loff_in;
12560             }
12561             if (arg4) {
12562                 if (get_user_u64(loff_out, arg4)) {
12563                     return -TARGET_EFAULT;
12564                 }
12565                 ploff_out = &loff_out;
12566             }
12567             ret = get_errno(splice(arg1, ploff_in, arg3, ploff_out, arg5, arg6));
12568             if (arg2) {
12569                 if (put_user_u64(loff_in, arg2)) {
12570                     return -TARGET_EFAULT;
12571                 }
12572             }
12573             if (arg4) {
12574                 if (put_user_u64(loff_out, arg4)) {
12575                     return -TARGET_EFAULT;
12576                 }
12577             }
12578         }
12579         return ret;
12580 #endif
12581 #ifdef TARGET_NR_vmsplice
12582 	case TARGET_NR_vmsplice:
12583         {
12584             struct iovec *vec = lock_iovec(VERIFY_READ, arg2, arg3, 1);
12585             if (vec != NULL) {
12586                 ret = get_errno(vmsplice(arg1, vec, arg3, arg4));
12587                 unlock_iovec(vec, arg2, arg3, 0);
12588             } else {
12589                 ret = -host_to_target_errno(errno);
12590             }
12591         }
12592         return ret;
12593 #endif
12594 #endif /* CONFIG_SPLICE */
12595 #ifdef CONFIG_EVENTFD
12596 #if defined(TARGET_NR_eventfd)
12597     case TARGET_NR_eventfd:
12598         ret = get_errno(eventfd(arg1, 0));
12599         if (ret >= 0) {
12600             fd_trans_register(ret, &target_eventfd_trans);
12601         }
12602         return ret;
12603 #endif
12604 #if defined(TARGET_NR_eventfd2)
12605     case TARGET_NR_eventfd2:
12606     {
12607         int host_flags = arg2 & (~(TARGET_O_NONBLOCK_MASK | TARGET_O_CLOEXEC));
12608         if (arg2 & TARGET_O_NONBLOCK) {
12609             host_flags |= O_NONBLOCK;
12610         }
12611         if (arg2 & TARGET_O_CLOEXEC) {
12612             host_flags |= O_CLOEXEC;
12613         }
12614         ret = get_errno(eventfd(arg1, host_flags));
12615         if (ret >= 0) {
12616             fd_trans_register(ret, &target_eventfd_trans);
12617         }
12618         return ret;
12619     }
12620 #endif
12621 #endif /* CONFIG_EVENTFD  */
12622 #if defined(CONFIG_FALLOCATE) && defined(TARGET_NR_fallocate)
12623     case TARGET_NR_fallocate:
12624 #if TARGET_ABI_BITS == 32 && !defined(TARGET_ABI_MIPSN32)
12625         ret = get_errno(fallocate(arg1, arg2, target_offset64(arg3, arg4),
12626                                   target_offset64(arg5, arg6)));
12627 #else
12628         ret = get_errno(fallocate(arg1, arg2, arg3, arg4));
12629 #endif
12630         return ret;
12631 #endif
12632 #if defined(CONFIG_SYNC_FILE_RANGE)
12633 #if defined(TARGET_NR_sync_file_range)
12634     case TARGET_NR_sync_file_range:
12635 #if TARGET_ABI_BITS == 32 && !defined(TARGET_ABI_MIPSN32)
12636 #if defined(TARGET_MIPS)
12637         ret = get_errno(sync_file_range(arg1, target_offset64(arg3, arg4),
12638                                         target_offset64(arg5, arg6), arg7));
12639 #else
12640         ret = get_errno(sync_file_range(arg1, target_offset64(arg2, arg3),
12641                                         target_offset64(arg4, arg5), arg6));
12642 #endif /* !TARGET_MIPS */
12643 #else
12644         ret = get_errno(sync_file_range(arg1, arg2, arg3, arg4));
12645 #endif
12646         return ret;
12647 #endif
12648 #if defined(TARGET_NR_sync_file_range2) || \
12649     defined(TARGET_NR_arm_sync_file_range)
12650 #if defined(TARGET_NR_sync_file_range2)
12651     case TARGET_NR_sync_file_range2:
12652 #endif
12653 #if defined(TARGET_NR_arm_sync_file_range)
12654     case TARGET_NR_arm_sync_file_range:
12655 #endif
12656         /* This is like sync_file_range but the arguments are reordered */
12657 #if TARGET_ABI_BITS == 32 && !defined(TARGET_ABI_MIPSN32)
12658         ret = get_errno(sync_file_range(arg1, target_offset64(arg3, arg4),
12659                                         target_offset64(arg5, arg6), arg2));
12660 #else
12661         ret = get_errno(sync_file_range(arg1, arg3, arg4, arg2));
12662 #endif
12663         return ret;
12664 #endif
12665 #endif
12666 #if defined(TARGET_NR_signalfd4)
12667     case TARGET_NR_signalfd4:
12668         return do_signalfd4(arg1, arg2, arg4);
12669 #endif
12670 #if defined(TARGET_NR_signalfd)
12671     case TARGET_NR_signalfd:
12672         return do_signalfd4(arg1, arg2, 0);
12673 #endif
12674 #if defined(CONFIG_EPOLL)
12675 #if defined(TARGET_NR_epoll_create)
12676     case TARGET_NR_epoll_create:
12677         return get_errno(epoll_create(arg1));
12678 #endif
12679 #if defined(TARGET_NR_epoll_create1) && defined(CONFIG_EPOLL_CREATE1)
12680     case TARGET_NR_epoll_create1:
12681         return get_errno(epoll_create1(target_to_host_bitmask(arg1, fcntl_flags_tbl)));
12682 #endif
12683 #if defined(TARGET_NR_epoll_ctl)
12684     case TARGET_NR_epoll_ctl:
12685     {
12686         struct epoll_event ep;
12687         struct epoll_event *epp = 0;
12688         if (arg4) {
12689             if (arg2 != EPOLL_CTL_DEL) {
12690                 struct target_epoll_event *target_ep;
12691                 if (!lock_user_struct(VERIFY_READ, target_ep, arg4, 1)) {
12692                     return -TARGET_EFAULT;
12693                 }
12694                 ep.events = tswap32(target_ep->events);
12695                 /*
12696                  * The epoll_data_t union is just opaque data to the kernel,
12697                  * so we transfer all 64 bits across and need not worry what
12698                  * actual data type it is.
12699                  */
12700                 ep.data.u64 = tswap64(target_ep->data.u64);
12701                 unlock_user_struct(target_ep, arg4, 0);
12702             }
12703             /*
12704              * before kernel 2.6.9, EPOLL_CTL_DEL operation required a
12705              * non-null pointer, even though this argument is ignored.
12706              *
12707              */
12708             epp = &ep;
12709         }
12710         return get_errno(epoll_ctl(arg1, arg2, arg3, epp));
12711     }
12712 #endif
12713 
12714 #if defined(TARGET_NR_epoll_wait) || defined(TARGET_NR_epoll_pwait)
12715 #if defined(TARGET_NR_epoll_wait)
12716     case TARGET_NR_epoll_wait:
12717 #endif
12718 #if defined(TARGET_NR_epoll_pwait)
12719     case TARGET_NR_epoll_pwait:
12720 #endif
12721     {
12722         struct target_epoll_event *target_ep;
12723         struct epoll_event *ep;
12724         int epfd = arg1;
12725         int maxevents = arg3;
12726         int timeout = arg4;
12727 
12728         if (maxevents <= 0 || maxevents > TARGET_EP_MAX_EVENTS) {
12729             return -TARGET_EINVAL;
12730         }
12731 
12732         target_ep = lock_user(VERIFY_WRITE, arg2,
12733                               maxevents * sizeof(struct target_epoll_event), 1);
12734         if (!target_ep) {
12735             return -TARGET_EFAULT;
12736         }
12737 
12738         ep = g_try_new(struct epoll_event, maxevents);
12739         if (!ep) {
12740             unlock_user(target_ep, arg2, 0);
12741             return -TARGET_ENOMEM;
12742         }
12743 
12744         switch (num) {
12745 #if defined(TARGET_NR_epoll_pwait)
12746         case TARGET_NR_epoll_pwait:
12747         {
12748             sigset_t *set = NULL;
12749 
12750             if (arg5) {
12751                 ret = process_sigsuspend_mask(&set, arg5, arg6);
12752                 if (ret != 0) {
12753                     break;
12754                 }
12755             }
12756 
12757             ret = get_errno(safe_epoll_pwait(epfd, ep, maxevents, timeout,
12758                                              set, SIGSET_T_SIZE));
12759 
12760             if (set) {
12761                 finish_sigsuspend_mask(ret);
12762             }
12763             break;
12764         }
12765 #endif
12766 #if defined(TARGET_NR_epoll_wait)
12767         case TARGET_NR_epoll_wait:
12768             ret = get_errno(safe_epoll_pwait(epfd, ep, maxevents, timeout,
12769                                              NULL, 0));
12770             break;
12771 #endif
12772         default:
12773             ret = -TARGET_ENOSYS;
12774         }
12775         if (!is_error(ret)) {
12776             int i;
12777             for (i = 0; i < ret; i++) {
12778                 target_ep[i].events = tswap32(ep[i].events);
12779                 target_ep[i].data.u64 = tswap64(ep[i].data.u64);
12780             }
12781             unlock_user(target_ep, arg2,
12782                         ret * sizeof(struct target_epoll_event));
12783         } else {
12784             unlock_user(target_ep, arg2, 0);
12785         }
12786         g_free(ep);
12787         return ret;
12788     }
12789 #endif
12790 #endif
12791 #ifdef TARGET_NR_prlimit64
12792     case TARGET_NR_prlimit64:
12793     {
12794         /* args: pid, resource number, ptr to new rlimit, ptr to old rlimit */
12795         struct target_rlimit64 *target_rnew, *target_rold;
12796         struct host_rlimit64 rnew, rold, *rnewp = 0;
12797         int resource = target_to_host_resource(arg2);
12798 
12799         if (arg3 && (resource != RLIMIT_AS &&
12800                      resource != RLIMIT_DATA &&
12801                      resource != RLIMIT_STACK)) {
12802             if (!lock_user_struct(VERIFY_READ, target_rnew, arg3, 1)) {
12803                 return -TARGET_EFAULT;
12804             }
12805             rnew.rlim_cur = tswap64(target_rnew->rlim_cur);
12806             rnew.rlim_max = tswap64(target_rnew->rlim_max);
12807             unlock_user_struct(target_rnew, arg3, 0);
12808             rnewp = &rnew;
12809         }
12810 
12811         ret = get_errno(sys_prlimit64(arg1, resource, rnewp, arg4 ? &rold : 0));
12812         if (!is_error(ret) && arg4) {
12813             if (!lock_user_struct(VERIFY_WRITE, target_rold, arg4, 1)) {
12814                 return -TARGET_EFAULT;
12815             }
12816             target_rold->rlim_cur = tswap64(rold.rlim_cur);
12817             target_rold->rlim_max = tswap64(rold.rlim_max);
12818             unlock_user_struct(target_rold, arg4, 1);
12819         }
12820         return ret;
12821     }
12822 #endif
12823 #ifdef TARGET_NR_gethostname
12824     case TARGET_NR_gethostname:
12825     {
12826         char *name = lock_user(VERIFY_WRITE, arg1, arg2, 0);
12827         if (name) {
12828             ret = get_errno(gethostname(name, arg2));
12829             unlock_user(name, arg1, arg2);
12830         } else {
12831             ret = -TARGET_EFAULT;
12832         }
12833         return ret;
12834     }
12835 #endif
12836 #ifdef TARGET_NR_atomic_cmpxchg_32
12837     case TARGET_NR_atomic_cmpxchg_32:
12838     {
12839         /* should use start_exclusive from main.c */
12840         abi_ulong mem_value;
12841         if (get_user_u32(mem_value, arg6)) {
12842             target_siginfo_t info;
12843             info.si_signo = SIGSEGV;
12844             info.si_errno = 0;
12845             info.si_code = TARGET_SEGV_MAPERR;
12846             info._sifields._sigfault._addr = arg6;
12847             queue_signal(cpu_env, info.si_signo, QEMU_SI_FAULT, &info);
12848             ret = 0xdeadbeef;
12849 
12850         }
12851         if (mem_value == arg2)
12852             put_user_u32(arg1, arg6);
12853         return mem_value;
12854     }
12855 #endif
12856 #ifdef TARGET_NR_atomic_barrier
12857     case TARGET_NR_atomic_barrier:
12858         /* Like the kernel implementation and the
12859            qemu arm barrier, no-op this? */
12860         return 0;
12861 #endif
12862 
12863 #ifdef TARGET_NR_timer_create
12864     case TARGET_NR_timer_create:
12865     {
12866         /* args: clockid_t clockid, struct sigevent *sevp, timer_t *timerid */
12867 
12868         struct sigevent host_sevp = { {0}, }, *phost_sevp = NULL;
12869 
12870         int clkid = arg1;
12871         int timer_index = next_free_host_timer();
12872 
12873         if (timer_index < 0) {
12874             ret = -TARGET_EAGAIN;
12875         } else {
12876             timer_t *phtimer = g_posix_timers  + timer_index;
12877 
12878             if (arg2) {
12879                 phost_sevp = &host_sevp;
12880                 ret = target_to_host_sigevent(phost_sevp, arg2);
12881                 if (ret != 0) {
12882                     free_host_timer_slot(timer_index);
12883                     return ret;
12884                 }
12885             }
12886 
12887             ret = get_errno(timer_create(clkid, phost_sevp, phtimer));
12888             if (ret) {
12889                 free_host_timer_slot(timer_index);
12890             } else {
12891                 if (put_user(TIMER_MAGIC | timer_index, arg3, target_timer_t)) {
12892                     timer_delete(*phtimer);
12893                     free_host_timer_slot(timer_index);
12894                     return -TARGET_EFAULT;
12895                 }
12896             }
12897         }
12898         return ret;
12899     }
12900 #endif
12901 
12902 #ifdef TARGET_NR_timer_settime
12903     case TARGET_NR_timer_settime:
12904     {
12905         /* args: timer_t timerid, int flags, const struct itimerspec *new_value,
12906          * struct itimerspec * old_value */
12907         target_timer_t timerid = get_timer_id(arg1);
12908 
12909         if (timerid < 0) {
12910             ret = timerid;
12911         } else if (arg3 == 0) {
12912             ret = -TARGET_EINVAL;
12913         } else {
12914             timer_t htimer = g_posix_timers[timerid];
12915             struct itimerspec hspec_new = {{0},}, hspec_old = {{0},};
12916 
12917             if (target_to_host_itimerspec(&hspec_new, arg3)) {
12918                 return -TARGET_EFAULT;
12919             }
12920             ret = get_errno(
12921                           timer_settime(htimer, arg2, &hspec_new, &hspec_old));
12922             if (arg4 && host_to_target_itimerspec(arg4, &hspec_old)) {
12923                 return -TARGET_EFAULT;
12924             }
12925         }
12926         return ret;
12927     }
12928 #endif
12929 
12930 #ifdef TARGET_NR_timer_settime64
12931     case TARGET_NR_timer_settime64:
12932     {
12933         target_timer_t timerid = get_timer_id(arg1);
12934 
12935         if (timerid < 0) {
12936             ret = timerid;
12937         } else if (arg3 == 0) {
12938             ret = -TARGET_EINVAL;
12939         } else {
12940             timer_t htimer = g_posix_timers[timerid];
12941             struct itimerspec hspec_new = {{0},}, hspec_old = {{0},};
12942 
12943             if (target_to_host_itimerspec64(&hspec_new, arg3)) {
12944                 return -TARGET_EFAULT;
12945             }
12946             ret = get_errno(
12947                           timer_settime(htimer, arg2, &hspec_new, &hspec_old));
12948             if (arg4 && host_to_target_itimerspec64(arg4, &hspec_old)) {
12949                 return -TARGET_EFAULT;
12950             }
12951         }
12952         return ret;
12953     }
12954 #endif
12955 
12956 #ifdef TARGET_NR_timer_gettime
12957     case TARGET_NR_timer_gettime:
12958     {
12959         /* args: timer_t timerid, struct itimerspec *curr_value */
12960         target_timer_t timerid = get_timer_id(arg1);
12961 
12962         if (timerid < 0) {
12963             ret = timerid;
12964         } else if (!arg2) {
12965             ret = -TARGET_EFAULT;
12966         } else {
12967             timer_t htimer = g_posix_timers[timerid];
12968             struct itimerspec hspec;
12969             ret = get_errno(timer_gettime(htimer, &hspec));
12970 
12971             if (host_to_target_itimerspec(arg2, &hspec)) {
12972                 ret = -TARGET_EFAULT;
12973             }
12974         }
12975         return ret;
12976     }
12977 #endif
12978 
12979 #ifdef TARGET_NR_timer_gettime64
12980     case TARGET_NR_timer_gettime64:
12981     {
12982         /* args: timer_t timerid, struct itimerspec64 *curr_value */
12983         target_timer_t timerid = get_timer_id(arg1);
12984 
12985         if (timerid < 0) {
12986             ret = timerid;
12987         } else if (!arg2) {
12988             ret = -TARGET_EFAULT;
12989         } else {
12990             timer_t htimer = g_posix_timers[timerid];
12991             struct itimerspec hspec;
12992             ret = get_errno(timer_gettime(htimer, &hspec));
12993 
12994             if (host_to_target_itimerspec64(arg2, &hspec)) {
12995                 ret = -TARGET_EFAULT;
12996             }
12997         }
12998         return ret;
12999     }
13000 #endif
13001 
13002 #ifdef TARGET_NR_timer_getoverrun
13003     case TARGET_NR_timer_getoverrun:
13004     {
13005         /* args: timer_t timerid */
13006         target_timer_t timerid = get_timer_id(arg1);
13007 
13008         if (timerid < 0) {
13009             ret = timerid;
13010         } else {
13011             timer_t htimer = g_posix_timers[timerid];
13012             ret = get_errno(timer_getoverrun(htimer));
13013         }
13014         return ret;
13015     }
13016 #endif
13017 
13018 #ifdef TARGET_NR_timer_delete
13019     case TARGET_NR_timer_delete:
13020     {
13021         /* args: timer_t timerid */
13022         target_timer_t timerid = get_timer_id(arg1);
13023 
13024         if (timerid < 0) {
13025             ret = timerid;
13026         } else {
13027             timer_t htimer = g_posix_timers[timerid];
13028             ret = get_errno(timer_delete(htimer));
13029             free_host_timer_slot(timerid);
13030         }
13031         return ret;
13032     }
13033 #endif
13034 
13035 #if defined(TARGET_NR_timerfd_create) && defined(CONFIG_TIMERFD)
13036     case TARGET_NR_timerfd_create:
13037         return get_errno(timerfd_create(arg1,
13038                           target_to_host_bitmask(arg2, fcntl_flags_tbl)));
13039 #endif
13040 
13041 #if defined(TARGET_NR_timerfd_gettime) && defined(CONFIG_TIMERFD)
13042     case TARGET_NR_timerfd_gettime:
13043         {
13044             struct itimerspec its_curr;
13045 
13046             ret = get_errno(timerfd_gettime(arg1, &its_curr));
13047 
13048             if (arg2 && host_to_target_itimerspec(arg2, &its_curr)) {
13049                 return -TARGET_EFAULT;
13050             }
13051         }
13052         return ret;
13053 #endif
13054 
13055 #if defined(TARGET_NR_timerfd_gettime64) && defined(CONFIG_TIMERFD)
13056     case TARGET_NR_timerfd_gettime64:
13057         {
13058             struct itimerspec its_curr;
13059 
13060             ret = get_errno(timerfd_gettime(arg1, &its_curr));
13061 
13062             if (arg2 && host_to_target_itimerspec64(arg2, &its_curr)) {
13063                 return -TARGET_EFAULT;
13064             }
13065         }
13066         return ret;
13067 #endif
13068 
13069 #if defined(TARGET_NR_timerfd_settime) && defined(CONFIG_TIMERFD)
13070     case TARGET_NR_timerfd_settime:
13071         {
13072             struct itimerspec its_new, its_old, *p_new;
13073 
13074             if (arg3) {
13075                 if (target_to_host_itimerspec(&its_new, arg3)) {
13076                     return -TARGET_EFAULT;
13077                 }
13078                 p_new = &its_new;
13079             } else {
13080                 p_new = NULL;
13081             }
13082 
13083             ret = get_errno(timerfd_settime(arg1, arg2, p_new, &its_old));
13084 
13085             if (arg4 && host_to_target_itimerspec(arg4, &its_old)) {
13086                 return -TARGET_EFAULT;
13087             }
13088         }
13089         return ret;
13090 #endif
13091 
13092 #if defined(TARGET_NR_timerfd_settime64) && defined(CONFIG_TIMERFD)
13093     case TARGET_NR_timerfd_settime64:
13094         {
13095             struct itimerspec its_new, its_old, *p_new;
13096 
13097             if (arg3) {
13098                 if (target_to_host_itimerspec64(&its_new, arg3)) {
13099                     return -TARGET_EFAULT;
13100                 }
13101                 p_new = &its_new;
13102             } else {
13103                 p_new = NULL;
13104             }
13105 
13106             ret = get_errno(timerfd_settime(arg1, arg2, p_new, &its_old));
13107 
13108             if (arg4 && host_to_target_itimerspec64(arg4, &its_old)) {
13109                 return -TARGET_EFAULT;
13110             }
13111         }
13112         return ret;
13113 #endif
13114 
13115 #if defined(TARGET_NR_ioprio_get) && defined(__NR_ioprio_get)
13116     case TARGET_NR_ioprio_get:
13117         return get_errno(ioprio_get(arg1, arg2));
13118 #endif
13119 
13120 #if defined(TARGET_NR_ioprio_set) && defined(__NR_ioprio_set)
13121     case TARGET_NR_ioprio_set:
13122         return get_errno(ioprio_set(arg1, arg2, arg3));
13123 #endif
13124 
13125 #if defined(TARGET_NR_setns) && defined(CONFIG_SETNS)
13126     case TARGET_NR_setns:
13127         return get_errno(setns(arg1, arg2));
13128 #endif
13129 #if defined(TARGET_NR_unshare) && defined(CONFIG_SETNS)
13130     case TARGET_NR_unshare:
13131         return get_errno(unshare(arg1));
13132 #endif
13133 #if defined(TARGET_NR_kcmp) && defined(__NR_kcmp)
13134     case TARGET_NR_kcmp:
13135         return get_errno(kcmp(arg1, arg2, arg3, arg4, arg5));
13136 #endif
13137 #ifdef TARGET_NR_swapcontext
13138     case TARGET_NR_swapcontext:
13139         /* PowerPC specific.  */
13140         return do_swapcontext(cpu_env, arg1, arg2, arg3);
13141 #endif
13142 #ifdef TARGET_NR_memfd_create
13143     case TARGET_NR_memfd_create:
13144         p = lock_user_string(arg1);
13145         if (!p) {
13146             return -TARGET_EFAULT;
13147         }
13148         ret = get_errno(memfd_create(p, arg2));
13149         fd_trans_unregister(ret);
13150         unlock_user(p, arg1, 0);
13151         return ret;
13152 #endif
13153 #if defined TARGET_NR_membarrier && defined __NR_membarrier
13154     case TARGET_NR_membarrier:
13155         return get_errno(membarrier(arg1, arg2));
13156 #endif
13157 
13158 #if defined(TARGET_NR_copy_file_range) && defined(__NR_copy_file_range)
13159     case TARGET_NR_copy_file_range:
13160         {
13161             loff_t inoff, outoff;
13162             loff_t *pinoff = NULL, *poutoff = NULL;
13163 
13164             if (arg2) {
13165                 if (get_user_u64(inoff, arg2)) {
13166                     return -TARGET_EFAULT;
13167                 }
13168                 pinoff = &inoff;
13169             }
13170             if (arg4) {
13171                 if (get_user_u64(outoff, arg4)) {
13172                     return -TARGET_EFAULT;
13173                 }
13174                 poutoff = &outoff;
13175             }
13176             /* Do not sign-extend the count parameter. */
13177             ret = get_errno(safe_copy_file_range(arg1, pinoff, arg3, poutoff,
13178                                                  (abi_ulong)arg5, arg6));
13179             if (!is_error(ret) && ret > 0) {
13180                 if (arg2) {
13181                     if (put_user_u64(inoff, arg2)) {
13182                         return -TARGET_EFAULT;
13183                     }
13184                 }
13185                 if (arg4) {
13186                     if (put_user_u64(outoff, arg4)) {
13187                         return -TARGET_EFAULT;
13188                     }
13189                 }
13190             }
13191         }
13192         return ret;
13193 #endif
13194 
13195 #if defined(TARGET_NR_pivot_root)
13196     case TARGET_NR_pivot_root:
13197         {
13198             void *p2;
13199             p = lock_user_string(arg1); /* new_root */
13200             p2 = lock_user_string(arg2); /* put_old */
13201             if (!p || !p2) {
13202                 ret = -TARGET_EFAULT;
13203             } else {
13204                 ret = get_errno(pivot_root(p, p2));
13205             }
13206             unlock_user(p2, arg2, 0);
13207             unlock_user(p, arg1, 0);
13208         }
13209         return ret;
13210 #endif
13211 
13212     default:
13213         qemu_log_mask(LOG_UNIMP, "Unsupported syscall: %d\n", num);
13214         return -TARGET_ENOSYS;
13215     }
13216     return ret;
13217 }
13218 
13219 abi_long do_syscall(CPUArchState *cpu_env, int num, abi_long arg1,
13220                     abi_long arg2, abi_long arg3, abi_long arg4,
13221                     abi_long arg5, abi_long arg6, abi_long arg7,
13222                     abi_long arg8)
13223 {
13224     CPUState *cpu = env_cpu(cpu_env);
13225     abi_long ret;
13226 
13227 #ifdef DEBUG_ERESTARTSYS
13228     /* Debug-only code for exercising the syscall-restart code paths
13229      * in the per-architecture cpu main loops: restart every syscall
13230      * the guest makes once before letting it through.
13231      */
13232     {
13233         static bool flag;
13234         flag = !flag;
13235         if (flag) {
13236             return -QEMU_ERESTARTSYS;
13237         }
13238     }
13239 #endif
13240 
13241     record_syscall_start(cpu, num, arg1,
13242                          arg2, arg3, arg4, arg5, arg6, arg7, arg8);
13243 
13244     if (unlikely(qemu_loglevel_mask(LOG_STRACE))) {
13245         print_syscall(cpu_env, num, arg1, arg2, arg3, arg4, arg5, arg6);
13246     }
13247 
13248     ret = do_syscall1(cpu_env, num, arg1, arg2, arg3, arg4,
13249                       arg5, arg6, arg7, arg8);
13250 
13251     if (unlikely(qemu_loglevel_mask(LOG_STRACE))) {
13252         print_syscall_ret(cpu_env, num, ret, arg1, arg2,
13253                           arg3, arg4, arg5, arg6);
13254     }
13255 
13256     record_syscall_return(cpu, num, ret);
13257     return ret;
13258 }
13259