xref: /openbmc/qemu/linux-user/syscall.c (revision febf6fad)
1 /*
2  *  Linux syscalls
3  *
4  *  Copyright (c) 2003 Fabrice Bellard
5  *
6  *  This program is free software; you can redistribute it and/or modify
7  *  it under the terms of the GNU General Public License as published by
8  *  the Free Software Foundation; either version 2 of the License, or
9  *  (at your option) any later version.
10  *
11  *  This program is distributed in the hope that it will be useful,
12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14  *  GNU General Public License for more details.
15  *
16  *  You should have received a copy of the GNU General Public License
17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
18  */
19 #define _ATFILE_SOURCE
20 #include "qemu/osdep.h"
21 #include "qemu/cutils.h"
22 #include "qemu/path.h"
23 #include "qemu/memfd.h"
24 #include "qemu/queue.h"
25 #include <elf.h>
26 #include <endian.h>
27 #include <grp.h>
28 #include <sys/ipc.h>
29 #include <sys/msg.h>
30 #include <sys/wait.h>
31 #include <sys/mount.h>
32 #include <sys/file.h>
33 #include <sys/fsuid.h>
34 #include <sys/personality.h>
35 #include <sys/prctl.h>
36 #include <sys/resource.h>
37 #include <sys/swap.h>
38 #include <linux/capability.h>
39 #include <sched.h>
40 #include <sys/timex.h>
41 #include <sys/socket.h>
42 #include <linux/sockios.h>
43 #include <sys/un.h>
44 #include <sys/uio.h>
45 #include <poll.h>
46 #include <sys/times.h>
47 #include <sys/shm.h>
48 #include <sys/sem.h>
49 #include <sys/statfs.h>
50 #include <utime.h>
51 #include <sys/sysinfo.h>
52 #include <sys/signalfd.h>
53 //#include <sys/user.h>
54 #include <netinet/in.h>
55 #include <netinet/ip.h>
56 #include <netinet/tcp.h>
57 #include <netinet/udp.h>
58 #include <linux/wireless.h>
59 #include <linux/icmp.h>
60 #include <linux/icmpv6.h>
61 #include <linux/if_tun.h>
62 #include <linux/in6.h>
63 #include <linux/errqueue.h>
64 #include <linux/random.h>
65 #ifdef CONFIG_TIMERFD
66 #include <sys/timerfd.h>
67 #endif
68 #ifdef CONFIG_EVENTFD
69 #include <sys/eventfd.h>
70 #endif
71 #ifdef CONFIG_EPOLL
72 #include <sys/epoll.h>
73 #endif
74 #ifdef CONFIG_ATTR
75 #include "qemu/xattr.h"
76 #endif
77 #ifdef CONFIG_SENDFILE
78 #include <sys/sendfile.h>
79 #endif
80 #ifdef HAVE_SYS_KCOV_H
81 #include <sys/kcov.h>
82 #endif
83 
84 #define termios host_termios
85 #define winsize host_winsize
86 #define termio host_termio
87 #define sgttyb host_sgttyb /* same as target */
88 #define tchars host_tchars /* same as target */
89 #define ltchars host_ltchars /* same as target */
90 
91 #include <linux/termios.h>
92 #include <linux/unistd.h>
93 #include <linux/cdrom.h>
94 #include <linux/hdreg.h>
95 #include <linux/soundcard.h>
96 #include <linux/kd.h>
97 #include <linux/mtio.h>
98 #include <linux/fs.h>
99 #include <linux/fd.h>
100 #if defined(CONFIG_FIEMAP)
101 #include <linux/fiemap.h>
102 #endif
103 #include <linux/fb.h>
104 #if defined(CONFIG_USBFS)
105 #include <linux/usbdevice_fs.h>
106 #include <linux/usb/ch9.h>
107 #endif
108 #include <linux/vt.h>
109 #include <linux/dm-ioctl.h>
110 #include <linux/reboot.h>
111 #include <linux/route.h>
112 #include <linux/filter.h>
113 #include <linux/blkpg.h>
114 #include <netpacket/packet.h>
115 #include <linux/netlink.h>
116 #include <linux/if_alg.h>
117 #include <linux/rtc.h>
118 #include <sound/asound.h>
119 #ifdef HAVE_BTRFS_H
120 #include <linux/btrfs.h>
121 #endif
122 #ifdef HAVE_DRM_H
123 #include <libdrm/drm.h>
124 #include <libdrm/i915_drm.h>
125 #endif
126 #include "linux_loop.h"
127 #include "uname.h"
128 
129 #include "qemu.h"
130 #include "qemu/guest-random.h"
131 #include "qemu/selfmap.h"
132 #include "user/syscall-trace.h"
133 #include "qapi/error.h"
134 #include "fd-trans.h"
135 #include "tcg/tcg.h"
136 
137 #ifndef CLONE_IO
138 #define CLONE_IO                0x80000000      /* Clone io context */
139 #endif
140 
141 /* We can't directly call the host clone syscall, because this will
142  * badly confuse libc (breaking mutexes, for example). So we must
143  * divide clone flags into:
144  *  * flag combinations that look like pthread_create()
145  *  * flag combinations that look like fork()
146  *  * flags we can implement within QEMU itself
147  *  * flags we can't support and will return an error for
148  */
149 /* For thread creation, all these flags must be present; for
150  * fork, none must be present.
151  */
152 #define CLONE_THREAD_FLAGS                              \
153     (CLONE_VM | CLONE_FS | CLONE_FILES |                \
154      CLONE_SIGHAND | CLONE_THREAD | CLONE_SYSVSEM)
155 
156 /* These flags are ignored:
157  * CLONE_DETACHED is now ignored by the kernel;
158  * CLONE_IO is just an optimisation hint to the I/O scheduler
159  */
160 #define CLONE_IGNORED_FLAGS                     \
161     (CLONE_DETACHED | CLONE_IO)
162 
163 /* Flags for fork which we can implement within QEMU itself */
164 #define CLONE_OPTIONAL_FORK_FLAGS               \
165     (CLONE_SETTLS | CLONE_PARENT_SETTID |       \
166      CLONE_CHILD_CLEARTID | CLONE_CHILD_SETTID)
167 
168 /* Flags for thread creation which we can implement within QEMU itself */
169 #define CLONE_OPTIONAL_THREAD_FLAGS                             \
170     (CLONE_SETTLS | CLONE_PARENT_SETTID |                       \
171      CLONE_CHILD_CLEARTID | CLONE_CHILD_SETTID | CLONE_PARENT)
172 
173 #define CLONE_INVALID_FORK_FLAGS                                        \
174     (~(CSIGNAL | CLONE_OPTIONAL_FORK_FLAGS | CLONE_IGNORED_FLAGS))
175 
176 #define CLONE_INVALID_THREAD_FLAGS                                      \
177     (~(CSIGNAL | CLONE_THREAD_FLAGS | CLONE_OPTIONAL_THREAD_FLAGS |     \
178        CLONE_IGNORED_FLAGS))
179 
180 /* CLONE_VFORK is special cased early in do_fork(). The other flag bits
181  * have almost all been allocated. We cannot support any of
182  * CLONE_NEWNS, CLONE_NEWCGROUP, CLONE_NEWUTS, CLONE_NEWIPC,
183  * CLONE_NEWUSER, CLONE_NEWPID, CLONE_NEWNET, CLONE_PTRACE, CLONE_UNTRACED.
184  * The checks against the invalid thread masks above will catch these.
185  * (The one remaining unallocated bit is 0x1000 which used to be CLONE_PID.)
186  */
187 
188 /* Define DEBUG_ERESTARTSYS to force every syscall to be restarted
189  * once. This exercises the codepaths for restart.
190  */
191 //#define DEBUG_ERESTARTSYS
192 
193 //#include <linux/msdos_fs.h>
194 #define	VFAT_IOCTL_READDIR_BOTH		_IOR('r', 1, struct linux_dirent [2])
195 #define	VFAT_IOCTL_READDIR_SHORT	_IOR('r', 2, struct linux_dirent [2])
196 
197 #undef _syscall0
198 #undef _syscall1
199 #undef _syscall2
200 #undef _syscall3
201 #undef _syscall4
202 #undef _syscall5
203 #undef _syscall6
204 
205 #define _syscall0(type,name)		\
206 static type name (void)			\
207 {					\
208 	return syscall(__NR_##name);	\
209 }
210 
211 #define _syscall1(type,name,type1,arg1)		\
212 static type name (type1 arg1)			\
213 {						\
214 	return syscall(__NR_##name, arg1);	\
215 }
216 
217 #define _syscall2(type,name,type1,arg1,type2,arg2)	\
218 static type name (type1 arg1,type2 arg2)		\
219 {							\
220 	return syscall(__NR_##name, arg1, arg2);	\
221 }
222 
223 #define _syscall3(type,name,type1,arg1,type2,arg2,type3,arg3)	\
224 static type name (type1 arg1,type2 arg2,type3 arg3)		\
225 {								\
226 	return syscall(__NR_##name, arg1, arg2, arg3);		\
227 }
228 
229 #define _syscall4(type,name,type1,arg1,type2,arg2,type3,arg3,type4,arg4)	\
230 static type name (type1 arg1,type2 arg2,type3 arg3,type4 arg4)			\
231 {										\
232 	return syscall(__NR_##name, arg1, arg2, arg3, arg4);			\
233 }
234 
235 #define _syscall5(type,name,type1,arg1,type2,arg2,type3,arg3,type4,arg4,	\
236 		  type5,arg5)							\
237 static type name (type1 arg1,type2 arg2,type3 arg3,type4 arg4,type5 arg5)	\
238 {										\
239 	return syscall(__NR_##name, arg1, arg2, arg3, arg4, arg5);		\
240 }
241 
242 
243 #define _syscall6(type,name,type1,arg1,type2,arg2,type3,arg3,type4,arg4,	\
244 		  type5,arg5,type6,arg6)					\
245 static type name (type1 arg1,type2 arg2,type3 arg3,type4 arg4,type5 arg5,	\
246                   type6 arg6)							\
247 {										\
248 	return syscall(__NR_##name, arg1, arg2, arg3, arg4, arg5, arg6);	\
249 }
250 
251 
252 #define __NR_sys_uname __NR_uname
253 #define __NR_sys_getcwd1 __NR_getcwd
254 #define __NR_sys_getdents __NR_getdents
255 #define __NR_sys_getdents64 __NR_getdents64
256 #define __NR_sys_getpriority __NR_getpriority
257 #define __NR_sys_rt_sigqueueinfo __NR_rt_sigqueueinfo
258 #define __NR_sys_rt_tgsigqueueinfo __NR_rt_tgsigqueueinfo
259 #define __NR_sys_syslog __NR_syslog
260 #if defined(__NR_futex)
261 # define __NR_sys_futex __NR_futex
262 #endif
263 #if defined(__NR_futex_time64)
264 # define __NR_sys_futex_time64 __NR_futex_time64
265 #endif
266 #define __NR_sys_inotify_init __NR_inotify_init
267 #define __NR_sys_inotify_add_watch __NR_inotify_add_watch
268 #define __NR_sys_inotify_rm_watch __NR_inotify_rm_watch
269 #define __NR_sys_statx __NR_statx
270 
271 #if defined(__alpha__) || defined(__x86_64__) || defined(__s390x__)
272 #define __NR__llseek __NR_lseek
273 #endif
274 
275 /* Newer kernel ports have llseek() instead of _llseek() */
276 #if defined(TARGET_NR_llseek) && !defined(TARGET_NR__llseek)
277 #define TARGET_NR__llseek TARGET_NR_llseek
278 #endif
279 
280 /* some platforms need to mask more bits than just TARGET_O_NONBLOCK */
281 #ifndef TARGET_O_NONBLOCK_MASK
282 #define TARGET_O_NONBLOCK_MASK TARGET_O_NONBLOCK
283 #endif
284 
285 #define __NR_sys_gettid __NR_gettid
286 _syscall0(int, sys_gettid)
287 
288 /* For the 64-bit guest on 32-bit host case we must emulate
289  * getdents using getdents64, because otherwise the host
290  * might hand us back more dirent records than we can fit
291  * into the guest buffer after structure format conversion.
292  * Otherwise we emulate getdents with getdents if the host has it.
293  */
294 #if defined(__NR_getdents) && HOST_LONG_BITS >= TARGET_ABI_BITS
295 #define EMULATE_GETDENTS_WITH_GETDENTS
296 #endif
297 
298 #if defined(TARGET_NR_getdents) && defined(EMULATE_GETDENTS_WITH_GETDENTS)
299 _syscall3(int, sys_getdents, uint, fd, struct linux_dirent *, dirp, uint, count);
300 #endif
301 #if (defined(TARGET_NR_getdents) && \
302       !defined(EMULATE_GETDENTS_WITH_GETDENTS)) || \
303     (defined(TARGET_NR_getdents64) && defined(__NR_getdents64))
304 _syscall3(int, sys_getdents64, uint, fd, struct linux_dirent64 *, dirp, uint, count);
305 #endif
306 #if defined(TARGET_NR__llseek) && defined(__NR_llseek)
307 _syscall5(int, _llseek,  uint,  fd, ulong, hi, ulong, lo,
308           loff_t *, res, uint, wh);
309 #endif
310 _syscall3(int, sys_rt_sigqueueinfo, pid_t, pid, int, sig, siginfo_t *, uinfo)
311 _syscall4(int, sys_rt_tgsigqueueinfo, pid_t, pid, pid_t, tid, int, sig,
312           siginfo_t *, uinfo)
313 _syscall3(int,sys_syslog,int,type,char*,bufp,int,len)
314 #ifdef __NR_exit_group
315 _syscall1(int,exit_group,int,error_code)
316 #endif
317 #if defined(TARGET_NR_set_tid_address) && defined(__NR_set_tid_address)
318 _syscall1(int,set_tid_address,int *,tidptr)
319 #endif
320 #if defined(__NR_futex)
321 _syscall6(int,sys_futex,int *,uaddr,int,op,int,val,
322           const struct timespec *,timeout,int *,uaddr2,int,val3)
323 #endif
324 #if defined(__NR_futex_time64)
325 _syscall6(int,sys_futex_time64,int *,uaddr,int,op,int,val,
326           const struct timespec *,timeout,int *,uaddr2,int,val3)
327 #endif
328 #define __NR_sys_sched_getaffinity __NR_sched_getaffinity
329 _syscall3(int, sys_sched_getaffinity, pid_t, pid, unsigned int, len,
330           unsigned long *, user_mask_ptr);
331 #define __NR_sys_sched_setaffinity __NR_sched_setaffinity
332 _syscall3(int, sys_sched_setaffinity, pid_t, pid, unsigned int, len,
333           unsigned long *, user_mask_ptr);
334 #define __NR_sys_getcpu __NR_getcpu
335 _syscall3(int, sys_getcpu, unsigned *, cpu, unsigned *, node, void *, tcache);
336 _syscall4(int, reboot, int, magic1, int, magic2, unsigned int, cmd,
337           void *, arg);
338 _syscall2(int, capget, struct __user_cap_header_struct *, header,
339           struct __user_cap_data_struct *, data);
340 _syscall2(int, capset, struct __user_cap_header_struct *, header,
341           struct __user_cap_data_struct *, data);
342 #if defined(TARGET_NR_ioprio_get) && defined(__NR_ioprio_get)
343 _syscall2(int, ioprio_get, int, which, int, who)
344 #endif
345 #if defined(TARGET_NR_ioprio_set) && defined(__NR_ioprio_set)
346 _syscall3(int, ioprio_set, int, which, int, who, int, ioprio)
347 #endif
348 #if defined(TARGET_NR_getrandom) && defined(__NR_getrandom)
349 _syscall3(int, getrandom, void *, buf, size_t, buflen, unsigned int, flags)
350 #endif
351 
352 #if defined(TARGET_NR_kcmp) && defined(__NR_kcmp)
353 _syscall5(int, kcmp, pid_t, pid1, pid_t, pid2, int, type,
354           unsigned long, idx1, unsigned long, idx2)
355 #endif
356 
357 /*
358  * It is assumed that struct statx is architecture independent.
359  */
360 #if defined(TARGET_NR_statx) && defined(__NR_statx)
361 _syscall5(int, sys_statx, int, dirfd, const char *, pathname, int, flags,
362           unsigned int, mask, struct target_statx *, statxbuf)
363 #endif
364 #if defined(TARGET_NR_membarrier) && defined(__NR_membarrier)
365 _syscall2(int, membarrier, int, cmd, int, flags)
366 #endif
367 
368 static const bitmask_transtbl fcntl_flags_tbl[] = {
369   { TARGET_O_ACCMODE,   TARGET_O_WRONLY,    O_ACCMODE,   O_WRONLY,    },
370   { TARGET_O_ACCMODE,   TARGET_O_RDWR,      O_ACCMODE,   O_RDWR,      },
371   { TARGET_O_CREAT,     TARGET_O_CREAT,     O_CREAT,     O_CREAT,     },
372   { TARGET_O_EXCL,      TARGET_O_EXCL,      O_EXCL,      O_EXCL,      },
373   { TARGET_O_NOCTTY,    TARGET_O_NOCTTY,    O_NOCTTY,    O_NOCTTY,    },
374   { TARGET_O_TRUNC,     TARGET_O_TRUNC,     O_TRUNC,     O_TRUNC,     },
375   { TARGET_O_APPEND,    TARGET_O_APPEND,    O_APPEND,    O_APPEND,    },
376   { TARGET_O_NONBLOCK,  TARGET_O_NONBLOCK,  O_NONBLOCK,  O_NONBLOCK,  },
377   { TARGET_O_SYNC,      TARGET_O_DSYNC,     O_SYNC,      O_DSYNC,     },
378   { TARGET_O_SYNC,      TARGET_O_SYNC,      O_SYNC,      O_SYNC,      },
379   { TARGET_FASYNC,      TARGET_FASYNC,      FASYNC,      FASYNC,      },
380   { TARGET_O_DIRECTORY, TARGET_O_DIRECTORY, O_DIRECTORY, O_DIRECTORY, },
381   { TARGET_O_NOFOLLOW,  TARGET_O_NOFOLLOW,  O_NOFOLLOW,  O_NOFOLLOW,  },
382 #if defined(O_DIRECT)
383   { TARGET_O_DIRECT,    TARGET_O_DIRECT,    O_DIRECT,    O_DIRECT,    },
384 #endif
385 #if defined(O_NOATIME)
386   { TARGET_O_NOATIME,   TARGET_O_NOATIME,   O_NOATIME,   O_NOATIME    },
387 #endif
388 #if defined(O_CLOEXEC)
389   { TARGET_O_CLOEXEC,   TARGET_O_CLOEXEC,   O_CLOEXEC,   O_CLOEXEC    },
390 #endif
391 #if defined(O_PATH)
392   { TARGET_O_PATH,      TARGET_O_PATH,      O_PATH,      O_PATH       },
393 #endif
394 #if defined(O_TMPFILE)
395   { TARGET_O_TMPFILE,   TARGET_O_TMPFILE,   O_TMPFILE,   O_TMPFILE    },
396 #endif
397   /* Don't terminate the list prematurely on 64-bit host+guest.  */
398 #if TARGET_O_LARGEFILE != 0 || O_LARGEFILE != 0
399   { TARGET_O_LARGEFILE, TARGET_O_LARGEFILE, O_LARGEFILE, O_LARGEFILE, },
400 #endif
401   { 0, 0, 0, 0 }
402 };
403 
404 _syscall2(int, sys_getcwd1, char *, buf, size_t, size)
405 
406 #if defined(TARGET_NR_utimensat) || defined(TARGET_NR_utimensat_time64)
407 #if defined(__NR_utimensat)
408 #define __NR_sys_utimensat __NR_utimensat
409 _syscall4(int,sys_utimensat,int,dirfd,const char *,pathname,
410           const struct timespec *,tsp,int,flags)
411 #else
412 static int sys_utimensat(int dirfd, const char *pathname,
413                          const struct timespec times[2], int flags)
414 {
415     errno = ENOSYS;
416     return -1;
417 }
418 #endif
419 #endif /* TARGET_NR_utimensat */
420 
421 #ifdef TARGET_NR_renameat2
422 #if defined(__NR_renameat2)
423 #define __NR_sys_renameat2 __NR_renameat2
424 _syscall5(int, sys_renameat2, int, oldfd, const char *, old, int, newfd,
425           const char *, new, unsigned int, flags)
426 #else
427 static int sys_renameat2(int oldfd, const char *old,
428                          int newfd, const char *new, int flags)
429 {
430     if (flags == 0) {
431         return renameat(oldfd, old, newfd, new);
432     }
433     errno = ENOSYS;
434     return -1;
435 }
436 #endif
437 #endif /* TARGET_NR_renameat2 */
438 
439 #ifdef CONFIG_INOTIFY
440 #include <sys/inotify.h>
441 
442 #if defined(TARGET_NR_inotify_init) && defined(__NR_inotify_init)
443 static int sys_inotify_init(void)
444 {
445   return (inotify_init());
446 }
447 #endif
448 #if defined(TARGET_NR_inotify_add_watch) && defined(__NR_inotify_add_watch)
449 static int sys_inotify_add_watch(int fd,const char *pathname, int32_t mask)
450 {
451   return (inotify_add_watch(fd, pathname, mask));
452 }
453 #endif
454 #if defined(TARGET_NR_inotify_rm_watch) && defined(__NR_inotify_rm_watch)
455 static int sys_inotify_rm_watch(int fd, int32_t wd)
456 {
457   return (inotify_rm_watch(fd, wd));
458 }
459 #endif
460 #ifdef CONFIG_INOTIFY1
461 #if defined(TARGET_NR_inotify_init1) && defined(__NR_inotify_init1)
462 static int sys_inotify_init1(int flags)
463 {
464   return (inotify_init1(flags));
465 }
466 #endif
467 #endif
468 #else
469 /* Userspace can usually survive runtime without inotify */
470 #undef TARGET_NR_inotify_init
471 #undef TARGET_NR_inotify_init1
472 #undef TARGET_NR_inotify_add_watch
473 #undef TARGET_NR_inotify_rm_watch
474 #endif /* CONFIG_INOTIFY  */
475 
476 #if defined(TARGET_NR_prlimit64)
477 #ifndef __NR_prlimit64
478 # define __NR_prlimit64 -1
479 #endif
480 #define __NR_sys_prlimit64 __NR_prlimit64
481 /* The glibc rlimit structure may not be that used by the underlying syscall */
482 struct host_rlimit64 {
483     uint64_t rlim_cur;
484     uint64_t rlim_max;
485 };
486 _syscall4(int, sys_prlimit64, pid_t, pid, int, resource,
487           const struct host_rlimit64 *, new_limit,
488           struct host_rlimit64 *, old_limit)
489 #endif
490 
491 
492 #if defined(TARGET_NR_timer_create)
493 /* Maximum of 32 active POSIX timers allowed at any one time. */
494 static timer_t g_posix_timers[32] = { 0, } ;
495 
496 static inline int next_free_host_timer(void)
497 {
498     int k ;
499     /* FIXME: Does finding the next free slot require a lock? */
500     for (k = 0; k < ARRAY_SIZE(g_posix_timers); k++) {
501         if (g_posix_timers[k] == 0) {
502             g_posix_timers[k] = (timer_t) 1;
503             return k;
504         }
505     }
506     return -1;
507 }
508 #endif
509 
510 #define ERRNO_TABLE_SIZE 1200
511 
512 /* target_to_host_errno_table[] is initialized from
513  * host_to_target_errno_table[] in syscall_init(). */
514 static uint16_t target_to_host_errno_table[ERRNO_TABLE_SIZE] = {
515 };
516 
517 /*
518  * This list is the union of errno values overridden in asm-<arch>/errno.h
519  * minus the errnos that are not actually generic to all archs.
520  */
521 static uint16_t host_to_target_errno_table[ERRNO_TABLE_SIZE] = {
522     [EAGAIN]		= TARGET_EAGAIN,
523     [EIDRM]		= TARGET_EIDRM,
524     [ECHRNG]		= TARGET_ECHRNG,
525     [EL2NSYNC]		= TARGET_EL2NSYNC,
526     [EL3HLT]		= TARGET_EL3HLT,
527     [EL3RST]		= TARGET_EL3RST,
528     [ELNRNG]		= TARGET_ELNRNG,
529     [EUNATCH]		= TARGET_EUNATCH,
530     [ENOCSI]		= TARGET_ENOCSI,
531     [EL2HLT]		= TARGET_EL2HLT,
532     [EDEADLK]		= TARGET_EDEADLK,
533     [ENOLCK]		= TARGET_ENOLCK,
534     [EBADE]		= TARGET_EBADE,
535     [EBADR]		= TARGET_EBADR,
536     [EXFULL]		= TARGET_EXFULL,
537     [ENOANO]		= TARGET_ENOANO,
538     [EBADRQC]		= TARGET_EBADRQC,
539     [EBADSLT]		= TARGET_EBADSLT,
540     [EBFONT]		= TARGET_EBFONT,
541     [ENOSTR]		= TARGET_ENOSTR,
542     [ENODATA]		= TARGET_ENODATA,
543     [ETIME]		= TARGET_ETIME,
544     [ENOSR]		= TARGET_ENOSR,
545     [ENONET]		= TARGET_ENONET,
546     [ENOPKG]		= TARGET_ENOPKG,
547     [EREMOTE]		= TARGET_EREMOTE,
548     [ENOLINK]		= TARGET_ENOLINK,
549     [EADV]		= TARGET_EADV,
550     [ESRMNT]		= TARGET_ESRMNT,
551     [ECOMM]		= TARGET_ECOMM,
552     [EPROTO]		= TARGET_EPROTO,
553     [EDOTDOT]		= TARGET_EDOTDOT,
554     [EMULTIHOP]		= TARGET_EMULTIHOP,
555     [EBADMSG]		= TARGET_EBADMSG,
556     [ENAMETOOLONG]	= TARGET_ENAMETOOLONG,
557     [EOVERFLOW]		= TARGET_EOVERFLOW,
558     [ENOTUNIQ]		= TARGET_ENOTUNIQ,
559     [EBADFD]		= TARGET_EBADFD,
560     [EREMCHG]		= TARGET_EREMCHG,
561     [ELIBACC]		= TARGET_ELIBACC,
562     [ELIBBAD]		= TARGET_ELIBBAD,
563     [ELIBSCN]		= TARGET_ELIBSCN,
564     [ELIBMAX]		= TARGET_ELIBMAX,
565     [ELIBEXEC]		= TARGET_ELIBEXEC,
566     [EILSEQ]		= TARGET_EILSEQ,
567     [ENOSYS]		= TARGET_ENOSYS,
568     [ELOOP]		= TARGET_ELOOP,
569     [ERESTART]		= TARGET_ERESTART,
570     [ESTRPIPE]		= TARGET_ESTRPIPE,
571     [ENOTEMPTY]		= TARGET_ENOTEMPTY,
572     [EUSERS]		= TARGET_EUSERS,
573     [ENOTSOCK]		= TARGET_ENOTSOCK,
574     [EDESTADDRREQ]	= TARGET_EDESTADDRREQ,
575     [EMSGSIZE]		= TARGET_EMSGSIZE,
576     [EPROTOTYPE]	= TARGET_EPROTOTYPE,
577     [ENOPROTOOPT]	= TARGET_ENOPROTOOPT,
578     [EPROTONOSUPPORT]	= TARGET_EPROTONOSUPPORT,
579     [ESOCKTNOSUPPORT]	= TARGET_ESOCKTNOSUPPORT,
580     [EOPNOTSUPP]	= TARGET_EOPNOTSUPP,
581     [EPFNOSUPPORT]	= TARGET_EPFNOSUPPORT,
582     [EAFNOSUPPORT]	= TARGET_EAFNOSUPPORT,
583     [EADDRINUSE]	= TARGET_EADDRINUSE,
584     [EADDRNOTAVAIL]	= TARGET_EADDRNOTAVAIL,
585     [ENETDOWN]		= TARGET_ENETDOWN,
586     [ENETUNREACH]	= TARGET_ENETUNREACH,
587     [ENETRESET]		= TARGET_ENETRESET,
588     [ECONNABORTED]	= TARGET_ECONNABORTED,
589     [ECONNRESET]	= TARGET_ECONNRESET,
590     [ENOBUFS]		= TARGET_ENOBUFS,
591     [EISCONN]		= TARGET_EISCONN,
592     [ENOTCONN]		= TARGET_ENOTCONN,
593     [EUCLEAN]		= TARGET_EUCLEAN,
594     [ENOTNAM]		= TARGET_ENOTNAM,
595     [ENAVAIL]		= TARGET_ENAVAIL,
596     [EISNAM]		= TARGET_EISNAM,
597     [EREMOTEIO]		= TARGET_EREMOTEIO,
598     [EDQUOT]            = TARGET_EDQUOT,
599     [ESHUTDOWN]		= TARGET_ESHUTDOWN,
600     [ETOOMANYREFS]	= TARGET_ETOOMANYREFS,
601     [ETIMEDOUT]		= TARGET_ETIMEDOUT,
602     [ECONNREFUSED]	= TARGET_ECONNREFUSED,
603     [EHOSTDOWN]		= TARGET_EHOSTDOWN,
604     [EHOSTUNREACH]	= TARGET_EHOSTUNREACH,
605     [EALREADY]		= TARGET_EALREADY,
606     [EINPROGRESS]	= TARGET_EINPROGRESS,
607     [ESTALE]		= TARGET_ESTALE,
608     [ECANCELED]		= TARGET_ECANCELED,
609     [ENOMEDIUM]		= TARGET_ENOMEDIUM,
610     [EMEDIUMTYPE]	= TARGET_EMEDIUMTYPE,
611 #ifdef ENOKEY
612     [ENOKEY]		= TARGET_ENOKEY,
613 #endif
614 #ifdef EKEYEXPIRED
615     [EKEYEXPIRED]	= TARGET_EKEYEXPIRED,
616 #endif
617 #ifdef EKEYREVOKED
618     [EKEYREVOKED]	= TARGET_EKEYREVOKED,
619 #endif
620 #ifdef EKEYREJECTED
621     [EKEYREJECTED]	= TARGET_EKEYREJECTED,
622 #endif
623 #ifdef EOWNERDEAD
624     [EOWNERDEAD]	= TARGET_EOWNERDEAD,
625 #endif
626 #ifdef ENOTRECOVERABLE
627     [ENOTRECOVERABLE]	= TARGET_ENOTRECOVERABLE,
628 #endif
629 #ifdef ENOMSG
630     [ENOMSG]            = TARGET_ENOMSG,
631 #endif
632 #ifdef ERKFILL
633     [ERFKILL]           = TARGET_ERFKILL,
634 #endif
635 #ifdef EHWPOISON
636     [EHWPOISON]         = TARGET_EHWPOISON,
637 #endif
638 };
639 
640 static inline int host_to_target_errno(int err)
641 {
642     if (err >= 0 && err < ERRNO_TABLE_SIZE &&
643         host_to_target_errno_table[err]) {
644         return host_to_target_errno_table[err];
645     }
646     return err;
647 }
648 
649 static inline int target_to_host_errno(int err)
650 {
651     if (err >= 0 && err < ERRNO_TABLE_SIZE &&
652         target_to_host_errno_table[err]) {
653         return target_to_host_errno_table[err];
654     }
655     return err;
656 }
657 
658 static inline abi_long get_errno(abi_long ret)
659 {
660     if (ret == -1)
661         return -host_to_target_errno(errno);
662     else
663         return ret;
664 }
665 
666 const char *target_strerror(int err)
667 {
668     if (err == TARGET_ERESTARTSYS) {
669         return "To be restarted";
670     }
671     if (err == TARGET_QEMU_ESIGRETURN) {
672         return "Successful exit from sigreturn";
673     }
674 
675     if ((err >= ERRNO_TABLE_SIZE) || (err < 0)) {
676         return NULL;
677     }
678     return strerror(target_to_host_errno(err));
679 }
680 
681 #define safe_syscall0(type, name) \
682 static type safe_##name(void) \
683 { \
684     return safe_syscall(__NR_##name); \
685 }
686 
687 #define safe_syscall1(type, name, type1, arg1) \
688 static type safe_##name(type1 arg1) \
689 { \
690     return safe_syscall(__NR_##name, arg1); \
691 }
692 
693 #define safe_syscall2(type, name, type1, arg1, type2, arg2) \
694 static type safe_##name(type1 arg1, type2 arg2) \
695 { \
696     return safe_syscall(__NR_##name, arg1, arg2); \
697 }
698 
699 #define safe_syscall3(type, name, type1, arg1, type2, arg2, type3, arg3) \
700 static type safe_##name(type1 arg1, type2 arg2, type3 arg3) \
701 { \
702     return safe_syscall(__NR_##name, arg1, arg2, arg3); \
703 }
704 
705 #define safe_syscall4(type, name, type1, arg1, type2, arg2, type3, arg3, \
706     type4, arg4) \
707 static type safe_##name(type1 arg1, type2 arg2, type3 arg3, type4 arg4) \
708 { \
709     return safe_syscall(__NR_##name, arg1, arg2, arg3, arg4); \
710 }
711 
712 #define safe_syscall5(type, name, type1, arg1, type2, arg2, type3, arg3, \
713     type4, arg4, type5, arg5) \
714 static type safe_##name(type1 arg1, type2 arg2, type3 arg3, type4 arg4, \
715     type5 arg5) \
716 { \
717     return safe_syscall(__NR_##name, arg1, arg2, arg3, arg4, arg5); \
718 }
719 
720 #define safe_syscall6(type, name, type1, arg1, type2, arg2, type3, arg3, \
721     type4, arg4, type5, arg5, type6, arg6) \
722 static type safe_##name(type1 arg1, type2 arg2, type3 arg3, type4 arg4, \
723     type5 arg5, type6 arg6) \
724 { \
725     return safe_syscall(__NR_##name, arg1, arg2, arg3, arg4, arg5, arg6); \
726 }
727 
728 safe_syscall3(ssize_t, read, int, fd, void *, buff, size_t, count)
729 safe_syscall3(ssize_t, write, int, fd, const void *, buff, size_t, count)
730 safe_syscall4(int, openat, int, dirfd, const char *, pathname, \
731               int, flags, mode_t, mode)
732 #if defined(TARGET_NR_wait4) || defined(TARGET_NR_waitpid)
733 safe_syscall4(pid_t, wait4, pid_t, pid, int *, status, int, options, \
734               struct rusage *, rusage)
735 #endif
736 safe_syscall5(int, waitid, idtype_t, idtype, id_t, id, siginfo_t *, infop, \
737               int, options, struct rusage *, rusage)
738 safe_syscall3(int, execve, const char *, filename, char **, argv, char **, envp)
739 #if defined(TARGET_NR_select) || defined(TARGET_NR__newselect) || \
740     defined(TARGET_NR_pselect6) || defined(TARGET_NR_pselect6_time64)
741 safe_syscall6(int, pselect6, int, nfds, fd_set *, readfds, fd_set *, writefds, \
742               fd_set *, exceptfds, struct timespec *, timeout, void *, sig)
743 #endif
744 #if defined(TARGET_NR_ppoll) || defined(TARGET_NR_ppoll_time64)
745 safe_syscall5(int, ppoll, struct pollfd *, ufds, unsigned int, nfds,
746               struct timespec *, tsp, const sigset_t *, sigmask,
747               size_t, sigsetsize)
748 #endif
749 safe_syscall6(int, epoll_pwait, int, epfd, struct epoll_event *, events,
750               int, maxevents, int, timeout, const sigset_t *, sigmask,
751               size_t, sigsetsize)
752 #if defined(__NR_futex)
753 safe_syscall6(int,futex,int *,uaddr,int,op,int,val, \
754               const struct timespec *,timeout,int *,uaddr2,int,val3)
755 #endif
756 #if defined(__NR_futex_time64)
757 safe_syscall6(int,futex_time64,int *,uaddr,int,op,int,val, \
758               const struct timespec *,timeout,int *,uaddr2,int,val3)
759 #endif
760 safe_syscall2(int, rt_sigsuspend, sigset_t *, newset, size_t, sigsetsize)
761 safe_syscall2(int, kill, pid_t, pid, int, sig)
762 safe_syscall2(int, tkill, int, tid, int, sig)
763 safe_syscall3(int, tgkill, int, tgid, int, pid, int, sig)
764 safe_syscall3(ssize_t, readv, int, fd, const struct iovec *, iov, int, iovcnt)
765 safe_syscall3(ssize_t, writev, int, fd, const struct iovec *, iov, int, iovcnt)
766 safe_syscall5(ssize_t, preadv, int, fd, const struct iovec *, iov, int, iovcnt,
767               unsigned long, pos_l, unsigned long, pos_h)
768 safe_syscall5(ssize_t, pwritev, int, fd, const struct iovec *, iov, int, iovcnt,
769               unsigned long, pos_l, unsigned long, pos_h)
770 safe_syscall3(int, connect, int, fd, const struct sockaddr *, addr,
771               socklen_t, addrlen)
772 safe_syscall6(ssize_t, sendto, int, fd, const void *, buf, size_t, len,
773               int, flags, const struct sockaddr *, addr, socklen_t, addrlen)
774 safe_syscall6(ssize_t, recvfrom, int, fd, void *, buf, size_t, len,
775               int, flags, struct sockaddr *, addr, socklen_t *, addrlen)
776 safe_syscall3(ssize_t, sendmsg, int, fd, const struct msghdr *, msg, int, flags)
777 safe_syscall3(ssize_t, recvmsg, int, fd, struct msghdr *, msg, int, flags)
778 safe_syscall2(int, flock, int, fd, int, operation)
779 #if defined(TARGET_NR_rt_sigtimedwait) || defined(TARGET_NR_rt_sigtimedwait_time64)
780 safe_syscall4(int, rt_sigtimedwait, const sigset_t *, these, siginfo_t *, uinfo,
781               const struct timespec *, uts, size_t, sigsetsize)
782 #endif
783 safe_syscall4(int, accept4, int, fd, struct sockaddr *, addr, socklen_t *, len,
784               int, flags)
785 #if defined(TARGET_NR_nanosleep)
786 safe_syscall2(int, nanosleep, const struct timespec *, req,
787               struct timespec *, rem)
788 #endif
789 #if defined(TARGET_NR_clock_nanosleep) || \
790     defined(TARGET_NR_clock_nanosleep_time64)
791 safe_syscall4(int, clock_nanosleep, const clockid_t, clock, int, flags,
792               const struct timespec *, req, struct timespec *, rem)
793 #endif
794 #ifdef __NR_ipc
795 #ifdef __s390x__
796 safe_syscall5(int, ipc, int, call, long, first, long, second, long, third,
797               void *, ptr)
798 #else
799 safe_syscall6(int, ipc, int, call, long, first, long, second, long, third,
800               void *, ptr, long, fifth)
801 #endif
802 #endif
803 #ifdef __NR_msgsnd
804 safe_syscall4(int, msgsnd, int, msgid, const void *, msgp, size_t, sz,
805               int, flags)
806 #endif
807 #ifdef __NR_msgrcv
808 safe_syscall5(int, msgrcv, int, msgid, void *, msgp, size_t, sz,
809               long, msgtype, int, flags)
810 #endif
811 #ifdef __NR_semtimedop
812 safe_syscall4(int, semtimedop, int, semid, struct sembuf *, tsops,
813               unsigned, nsops, const struct timespec *, timeout)
814 #endif
815 #if defined(TARGET_NR_mq_timedsend) || \
816     defined(TARGET_NR_mq_timedsend_time64)
817 safe_syscall5(int, mq_timedsend, int, mqdes, const char *, msg_ptr,
818               size_t, len, unsigned, prio, const struct timespec *, timeout)
819 #endif
820 #if defined(TARGET_NR_mq_timedreceive) || \
821     defined(TARGET_NR_mq_timedreceive_time64)
822 safe_syscall5(int, mq_timedreceive, int, mqdes, char *, msg_ptr,
823               size_t, len, unsigned *, prio, const struct timespec *, timeout)
824 #endif
825 #if defined(TARGET_NR_copy_file_range) && defined(__NR_copy_file_range)
826 safe_syscall6(ssize_t, copy_file_range, int, infd, loff_t *, pinoff,
827               int, outfd, loff_t *, poutoff, size_t, length,
828               unsigned int, flags)
829 #endif
830 
831 /* We do ioctl like this rather than via safe_syscall3 to preserve the
832  * "third argument might be integer or pointer or not present" behaviour of
833  * the libc function.
834  */
835 #define safe_ioctl(...) safe_syscall(__NR_ioctl, __VA_ARGS__)
836 /* Similarly for fcntl. Note that callers must always:
837  *  pass the F_GETLK64 etc constants rather than the unsuffixed F_GETLK
838  *  use the flock64 struct rather than unsuffixed flock
839  * This will then work and use a 64-bit offset for both 32-bit and 64-bit hosts.
840  */
841 #ifdef __NR_fcntl64
842 #define safe_fcntl(...) safe_syscall(__NR_fcntl64, __VA_ARGS__)
843 #else
844 #define safe_fcntl(...) safe_syscall(__NR_fcntl, __VA_ARGS__)
845 #endif
846 
847 static inline int host_to_target_sock_type(int host_type)
848 {
849     int target_type;
850 
851     switch (host_type & 0xf /* SOCK_TYPE_MASK */) {
852     case SOCK_DGRAM:
853         target_type = TARGET_SOCK_DGRAM;
854         break;
855     case SOCK_STREAM:
856         target_type = TARGET_SOCK_STREAM;
857         break;
858     default:
859         target_type = host_type & 0xf /* SOCK_TYPE_MASK */;
860         break;
861     }
862 
863 #if defined(SOCK_CLOEXEC)
864     if (host_type & SOCK_CLOEXEC) {
865         target_type |= TARGET_SOCK_CLOEXEC;
866     }
867 #endif
868 
869 #if defined(SOCK_NONBLOCK)
870     if (host_type & SOCK_NONBLOCK) {
871         target_type |= TARGET_SOCK_NONBLOCK;
872     }
873 #endif
874 
875     return target_type;
876 }
877 
878 static abi_ulong target_brk;
879 static abi_ulong target_original_brk;
880 static abi_ulong brk_page;
881 
882 void target_set_brk(abi_ulong new_brk)
883 {
884     target_original_brk = target_brk = HOST_PAGE_ALIGN(new_brk);
885     brk_page = HOST_PAGE_ALIGN(target_brk);
886 }
887 
888 //#define DEBUGF_BRK(message, args...) do { fprintf(stderr, (message), ## args); } while (0)
889 #define DEBUGF_BRK(message, args...)
890 
891 /* do_brk() must return target values and target errnos. */
892 abi_long do_brk(abi_ulong new_brk)
893 {
894     abi_long mapped_addr;
895     abi_ulong new_alloc_size;
896 
897     /* brk pointers are always untagged */
898 
899     DEBUGF_BRK("do_brk(" TARGET_ABI_FMT_lx ") -> ", new_brk);
900 
901     if (!new_brk) {
902         DEBUGF_BRK(TARGET_ABI_FMT_lx " (!new_brk)\n", target_brk);
903         return target_brk;
904     }
905     if (new_brk < target_original_brk) {
906         DEBUGF_BRK(TARGET_ABI_FMT_lx " (new_brk < target_original_brk)\n",
907                    target_brk);
908         return target_brk;
909     }
910 
911     /* If the new brk is less than the highest page reserved to the
912      * target heap allocation, set it and we're almost done...  */
913     if (new_brk <= brk_page) {
914         /* Heap contents are initialized to zero, as for anonymous
915          * mapped pages.  */
916         if (new_brk > target_brk) {
917             memset(g2h_untagged(target_brk), 0, new_brk - target_brk);
918         }
919 	target_brk = new_brk;
920         DEBUGF_BRK(TARGET_ABI_FMT_lx " (new_brk <= brk_page)\n", target_brk);
921 	return target_brk;
922     }
923 
924     /* We need to allocate more memory after the brk... Note that
925      * we don't use MAP_FIXED because that will map over the top of
926      * any existing mapping (like the one with the host libc or qemu
927      * itself); instead we treat "mapped but at wrong address" as
928      * a failure and unmap again.
929      */
930     new_alloc_size = HOST_PAGE_ALIGN(new_brk - brk_page);
931     mapped_addr = get_errno(target_mmap(brk_page, new_alloc_size,
932                                         PROT_READ|PROT_WRITE,
933                                         MAP_ANON|MAP_PRIVATE, 0, 0));
934 
935     if (mapped_addr == brk_page) {
936         /* Heap contents are initialized to zero, as for anonymous
937          * mapped pages.  Technically the new pages are already
938          * initialized to zero since they *are* anonymous mapped
939          * pages, however we have to take care with the contents that
940          * come from the remaining part of the previous page: it may
941          * contains garbage data due to a previous heap usage (grown
942          * then shrunken).  */
943         memset(g2h_untagged(target_brk), 0, brk_page - target_brk);
944 
945         target_brk = new_brk;
946         brk_page = HOST_PAGE_ALIGN(target_brk);
947         DEBUGF_BRK(TARGET_ABI_FMT_lx " (mapped_addr == brk_page)\n",
948             target_brk);
949         return target_brk;
950     } else if (mapped_addr != -1) {
951         /* Mapped but at wrong address, meaning there wasn't actually
952          * enough space for this brk.
953          */
954         target_munmap(mapped_addr, new_alloc_size);
955         mapped_addr = -1;
956         DEBUGF_BRK(TARGET_ABI_FMT_lx " (mapped_addr != -1)\n", target_brk);
957     }
958     else {
959         DEBUGF_BRK(TARGET_ABI_FMT_lx " (otherwise)\n", target_brk);
960     }
961 
962 #if defined(TARGET_ALPHA)
963     /* We (partially) emulate OSF/1 on Alpha, which requires we
964        return a proper errno, not an unchanged brk value.  */
965     return -TARGET_ENOMEM;
966 #endif
967     /* For everything else, return the previous break. */
968     return target_brk;
969 }
970 
971 #if defined(TARGET_NR_select) || defined(TARGET_NR__newselect) || \
972     defined(TARGET_NR_pselect6) || defined(TARGET_NR_pselect6_time64)
973 static inline abi_long copy_from_user_fdset(fd_set *fds,
974                                             abi_ulong target_fds_addr,
975                                             int n)
976 {
977     int i, nw, j, k;
978     abi_ulong b, *target_fds;
979 
980     nw = DIV_ROUND_UP(n, TARGET_ABI_BITS);
981     if (!(target_fds = lock_user(VERIFY_READ,
982                                  target_fds_addr,
983                                  sizeof(abi_ulong) * nw,
984                                  1)))
985         return -TARGET_EFAULT;
986 
987     FD_ZERO(fds);
988     k = 0;
989     for (i = 0; i < nw; i++) {
990         /* grab the abi_ulong */
991         __get_user(b, &target_fds[i]);
992         for (j = 0; j < TARGET_ABI_BITS; j++) {
993             /* check the bit inside the abi_ulong */
994             if ((b >> j) & 1)
995                 FD_SET(k, fds);
996             k++;
997         }
998     }
999 
1000     unlock_user(target_fds, target_fds_addr, 0);
1001 
1002     return 0;
1003 }
1004 
1005 static inline abi_ulong copy_from_user_fdset_ptr(fd_set *fds, fd_set **fds_ptr,
1006                                                  abi_ulong target_fds_addr,
1007                                                  int n)
1008 {
1009     if (target_fds_addr) {
1010         if (copy_from_user_fdset(fds, target_fds_addr, n))
1011             return -TARGET_EFAULT;
1012         *fds_ptr = fds;
1013     } else {
1014         *fds_ptr = NULL;
1015     }
1016     return 0;
1017 }
1018 
1019 static inline abi_long copy_to_user_fdset(abi_ulong target_fds_addr,
1020                                           const fd_set *fds,
1021                                           int n)
1022 {
1023     int i, nw, j, k;
1024     abi_long v;
1025     abi_ulong *target_fds;
1026 
1027     nw = DIV_ROUND_UP(n, TARGET_ABI_BITS);
1028     if (!(target_fds = lock_user(VERIFY_WRITE,
1029                                  target_fds_addr,
1030                                  sizeof(abi_ulong) * nw,
1031                                  0)))
1032         return -TARGET_EFAULT;
1033 
1034     k = 0;
1035     for (i = 0; i < nw; i++) {
1036         v = 0;
1037         for (j = 0; j < TARGET_ABI_BITS; j++) {
1038             v |= ((abi_ulong)(FD_ISSET(k, fds) != 0) << j);
1039             k++;
1040         }
1041         __put_user(v, &target_fds[i]);
1042     }
1043 
1044     unlock_user(target_fds, target_fds_addr, sizeof(abi_ulong) * nw);
1045 
1046     return 0;
1047 }
1048 #endif
1049 
1050 #if defined(__alpha__)
1051 #define HOST_HZ 1024
1052 #else
1053 #define HOST_HZ 100
1054 #endif
1055 
1056 static inline abi_long host_to_target_clock_t(long ticks)
1057 {
1058 #if HOST_HZ == TARGET_HZ
1059     return ticks;
1060 #else
1061     return ((int64_t)ticks * TARGET_HZ) / HOST_HZ;
1062 #endif
1063 }
1064 
1065 static inline abi_long host_to_target_rusage(abi_ulong target_addr,
1066                                              const struct rusage *rusage)
1067 {
1068     struct target_rusage *target_rusage;
1069 
1070     if (!lock_user_struct(VERIFY_WRITE, target_rusage, target_addr, 0))
1071         return -TARGET_EFAULT;
1072     target_rusage->ru_utime.tv_sec = tswapal(rusage->ru_utime.tv_sec);
1073     target_rusage->ru_utime.tv_usec = tswapal(rusage->ru_utime.tv_usec);
1074     target_rusage->ru_stime.tv_sec = tswapal(rusage->ru_stime.tv_sec);
1075     target_rusage->ru_stime.tv_usec = tswapal(rusage->ru_stime.tv_usec);
1076     target_rusage->ru_maxrss = tswapal(rusage->ru_maxrss);
1077     target_rusage->ru_ixrss = tswapal(rusage->ru_ixrss);
1078     target_rusage->ru_idrss = tswapal(rusage->ru_idrss);
1079     target_rusage->ru_isrss = tswapal(rusage->ru_isrss);
1080     target_rusage->ru_minflt = tswapal(rusage->ru_minflt);
1081     target_rusage->ru_majflt = tswapal(rusage->ru_majflt);
1082     target_rusage->ru_nswap = tswapal(rusage->ru_nswap);
1083     target_rusage->ru_inblock = tswapal(rusage->ru_inblock);
1084     target_rusage->ru_oublock = tswapal(rusage->ru_oublock);
1085     target_rusage->ru_msgsnd = tswapal(rusage->ru_msgsnd);
1086     target_rusage->ru_msgrcv = tswapal(rusage->ru_msgrcv);
1087     target_rusage->ru_nsignals = tswapal(rusage->ru_nsignals);
1088     target_rusage->ru_nvcsw = tswapal(rusage->ru_nvcsw);
1089     target_rusage->ru_nivcsw = tswapal(rusage->ru_nivcsw);
1090     unlock_user_struct(target_rusage, target_addr, 1);
1091 
1092     return 0;
1093 }
1094 
1095 #ifdef TARGET_NR_setrlimit
1096 static inline rlim_t target_to_host_rlim(abi_ulong target_rlim)
1097 {
1098     abi_ulong target_rlim_swap;
1099     rlim_t result;
1100 
1101     target_rlim_swap = tswapal(target_rlim);
1102     if (target_rlim_swap == TARGET_RLIM_INFINITY)
1103         return RLIM_INFINITY;
1104 
1105     result = target_rlim_swap;
1106     if (target_rlim_swap != (rlim_t)result)
1107         return RLIM_INFINITY;
1108 
1109     return result;
1110 }
1111 #endif
1112 
1113 #if defined(TARGET_NR_getrlimit) || defined(TARGET_NR_ugetrlimit)
1114 static inline abi_ulong host_to_target_rlim(rlim_t rlim)
1115 {
1116     abi_ulong target_rlim_swap;
1117     abi_ulong result;
1118 
1119     if (rlim == RLIM_INFINITY || rlim != (abi_long)rlim)
1120         target_rlim_swap = TARGET_RLIM_INFINITY;
1121     else
1122         target_rlim_swap = rlim;
1123     result = tswapal(target_rlim_swap);
1124 
1125     return result;
1126 }
1127 #endif
1128 
1129 static inline int target_to_host_resource(int code)
1130 {
1131     switch (code) {
1132     case TARGET_RLIMIT_AS:
1133         return RLIMIT_AS;
1134     case TARGET_RLIMIT_CORE:
1135         return RLIMIT_CORE;
1136     case TARGET_RLIMIT_CPU:
1137         return RLIMIT_CPU;
1138     case TARGET_RLIMIT_DATA:
1139         return RLIMIT_DATA;
1140     case TARGET_RLIMIT_FSIZE:
1141         return RLIMIT_FSIZE;
1142     case TARGET_RLIMIT_LOCKS:
1143         return RLIMIT_LOCKS;
1144     case TARGET_RLIMIT_MEMLOCK:
1145         return RLIMIT_MEMLOCK;
1146     case TARGET_RLIMIT_MSGQUEUE:
1147         return RLIMIT_MSGQUEUE;
1148     case TARGET_RLIMIT_NICE:
1149         return RLIMIT_NICE;
1150     case TARGET_RLIMIT_NOFILE:
1151         return RLIMIT_NOFILE;
1152     case TARGET_RLIMIT_NPROC:
1153         return RLIMIT_NPROC;
1154     case TARGET_RLIMIT_RSS:
1155         return RLIMIT_RSS;
1156     case TARGET_RLIMIT_RTPRIO:
1157         return RLIMIT_RTPRIO;
1158     case TARGET_RLIMIT_SIGPENDING:
1159         return RLIMIT_SIGPENDING;
1160     case TARGET_RLIMIT_STACK:
1161         return RLIMIT_STACK;
1162     default:
1163         return code;
1164     }
1165 }
1166 
1167 static inline abi_long copy_from_user_timeval(struct timeval *tv,
1168                                               abi_ulong target_tv_addr)
1169 {
1170     struct target_timeval *target_tv;
1171 
1172     if (!lock_user_struct(VERIFY_READ, target_tv, target_tv_addr, 1)) {
1173         return -TARGET_EFAULT;
1174     }
1175 
1176     __get_user(tv->tv_sec, &target_tv->tv_sec);
1177     __get_user(tv->tv_usec, &target_tv->tv_usec);
1178 
1179     unlock_user_struct(target_tv, target_tv_addr, 0);
1180 
1181     return 0;
1182 }
1183 
1184 static inline abi_long copy_to_user_timeval(abi_ulong target_tv_addr,
1185                                             const struct timeval *tv)
1186 {
1187     struct target_timeval *target_tv;
1188 
1189     if (!lock_user_struct(VERIFY_WRITE, target_tv, target_tv_addr, 0)) {
1190         return -TARGET_EFAULT;
1191     }
1192 
1193     __put_user(tv->tv_sec, &target_tv->tv_sec);
1194     __put_user(tv->tv_usec, &target_tv->tv_usec);
1195 
1196     unlock_user_struct(target_tv, target_tv_addr, 1);
1197 
1198     return 0;
1199 }
1200 
1201 #if defined(TARGET_NR_clock_adjtime64) && defined(CONFIG_CLOCK_ADJTIME)
1202 static inline abi_long copy_from_user_timeval64(struct timeval *tv,
1203                                                 abi_ulong target_tv_addr)
1204 {
1205     struct target__kernel_sock_timeval *target_tv;
1206 
1207     if (!lock_user_struct(VERIFY_READ, target_tv, target_tv_addr, 1)) {
1208         return -TARGET_EFAULT;
1209     }
1210 
1211     __get_user(tv->tv_sec, &target_tv->tv_sec);
1212     __get_user(tv->tv_usec, &target_tv->tv_usec);
1213 
1214     unlock_user_struct(target_tv, target_tv_addr, 0);
1215 
1216     return 0;
1217 }
1218 #endif
1219 
1220 static inline abi_long copy_to_user_timeval64(abi_ulong target_tv_addr,
1221                                               const struct timeval *tv)
1222 {
1223     struct target__kernel_sock_timeval *target_tv;
1224 
1225     if (!lock_user_struct(VERIFY_WRITE, target_tv, target_tv_addr, 0)) {
1226         return -TARGET_EFAULT;
1227     }
1228 
1229     __put_user(tv->tv_sec, &target_tv->tv_sec);
1230     __put_user(tv->tv_usec, &target_tv->tv_usec);
1231 
1232     unlock_user_struct(target_tv, target_tv_addr, 1);
1233 
1234     return 0;
1235 }
1236 
1237 #if defined(TARGET_NR_futex) || \
1238     defined(TARGET_NR_rt_sigtimedwait) || \
1239     defined(TARGET_NR_pselect6) || defined(TARGET_NR_pselect6) || \
1240     defined(TARGET_NR_nanosleep) || defined(TARGET_NR_clock_settime) || \
1241     defined(TARGET_NR_utimensat) || defined(TARGET_NR_mq_timedsend) || \
1242     defined(TARGET_NR_mq_timedreceive) || defined(TARGET_NR_ipc) || \
1243     defined(TARGET_NR_semop) || defined(TARGET_NR_semtimedop) || \
1244     defined(TARGET_NR_timer_settime) || \
1245     (defined(TARGET_NR_timerfd_settime) && defined(CONFIG_TIMERFD))
1246 static inline abi_long target_to_host_timespec(struct timespec *host_ts,
1247                                                abi_ulong target_addr)
1248 {
1249     struct target_timespec *target_ts;
1250 
1251     if (!lock_user_struct(VERIFY_READ, target_ts, target_addr, 1)) {
1252         return -TARGET_EFAULT;
1253     }
1254     __get_user(host_ts->tv_sec, &target_ts->tv_sec);
1255     __get_user(host_ts->tv_nsec, &target_ts->tv_nsec);
1256     unlock_user_struct(target_ts, target_addr, 0);
1257     return 0;
1258 }
1259 #endif
1260 
1261 #if defined(TARGET_NR_clock_settime64) || defined(TARGET_NR_futex_time64) || \
1262     defined(TARGET_NR_timer_settime64) || \
1263     defined(TARGET_NR_mq_timedsend_time64) || \
1264     defined(TARGET_NR_mq_timedreceive_time64) || \
1265     (defined(TARGET_NR_timerfd_settime64) && defined(CONFIG_TIMERFD)) || \
1266     defined(TARGET_NR_clock_nanosleep_time64) || \
1267     defined(TARGET_NR_rt_sigtimedwait_time64) || \
1268     defined(TARGET_NR_utimensat) || \
1269     defined(TARGET_NR_utimensat_time64) || \
1270     defined(TARGET_NR_semtimedop_time64) || \
1271     defined(TARGET_NR_pselect6_time64) || defined(TARGET_NR_ppoll_time64)
1272 static inline abi_long target_to_host_timespec64(struct timespec *host_ts,
1273                                                  abi_ulong target_addr)
1274 {
1275     struct target__kernel_timespec *target_ts;
1276 
1277     if (!lock_user_struct(VERIFY_READ, target_ts, target_addr, 1)) {
1278         return -TARGET_EFAULT;
1279     }
1280     __get_user(host_ts->tv_sec, &target_ts->tv_sec);
1281     __get_user(host_ts->tv_nsec, &target_ts->tv_nsec);
1282     /* in 32bit mode, this drops the padding */
1283     host_ts->tv_nsec = (long)(abi_long)host_ts->tv_nsec;
1284     unlock_user_struct(target_ts, target_addr, 0);
1285     return 0;
1286 }
1287 #endif
1288 
1289 static inline abi_long host_to_target_timespec(abi_ulong target_addr,
1290                                                struct timespec *host_ts)
1291 {
1292     struct target_timespec *target_ts;
1293 
1294     if (!lock_user_struct(VERIFY_WRITE, target_ts, target_addr, 0)) {
1295         return -TARGET_EFAULT;
1296     }
1297     __put_user(host_ts->tv_sec, &target_ts->tv_sec);
1298     __put_user(host_ts->tv_nsec, &target_ts->tv_nsec);
1299     unlock_user_struct(target_ts, target_addr, 1);
1300     return 0;
1301 }
1302 
1303 static inline abi_long host_to_target_timespec64(abi_ulong target_addr,
1304                                                  struct timespec *host_ts)
1305 {
1306     struct target__kernel_timespec *target_ts;
1307 
1308     if (!lock_user_struct(VERIFY_WRITE, target_ts, target_addr, 0)) {
1309         return -TARGET_EFAULT;
1310     }
1311     __put_user(host_ts->tv_sec, &target_ts->tv_sec);
1312     __put_user(host_ts->tv_nsec, &target_ts->tv_nsec);
1313     unlock_user_struct(target_ts, target_addr, 1);
1314     return 0;
1315 }
1316 
1317 #if defined(TARGET_NR_gettimeofday)
1318 static inline abi_long copy_to_user_timezone(abi_ulong target_tz_addr,
1319                                              struct timezone *tz)
1320 {
1321     struct target_timezone *target_tz;
1322 
1323     if (!lock_user_struct(VERIFY_WRITE, target_tz, target_tz_addr, 1)) {
1324         return -TARGET_EFAULT;
1325     }
1326 
1327     __put_user(tz->tz_minuteswest, &target_tz->tz_minuteswest);
1328     __put_user(tz->tz_dsttime, &target_tz->tz_dsttime);
1329 
1330     unlock_user_struct(target_tz, target_tz_addr, 1);
1331 
1332     return 0;
1333 }
1334 #endif
1335 
1336 #if defined(TARGET_NR_settimeofday)
1337 static inline abi_long copy_from_user_timezone(struct timezone *tz,
1338                                                abi_ulong target_tz_addr)
1339 {
1340     struct target_timezone *target_tz;
1341 
1342     if (!lock_user_struct(VERIFY_READ, target_tz, target_tz_addr, 1)) {
1343         return -TARGET_EFAULT;
1344     }
1345 
1346     __get_user(tz->tz_minuteswest, &target_tz->tz_minuteswest);
1347     __get_user(tz->tz_dsttime, &target_tz->tz_dsttime);
1348 
1349     unlock_user_struct(target_tz, target_tz_addr, 0);
1350 
1351     return 0;
1352 }
1353 #endif
1354 
1355 #if defined(TARGET_NR_mq_open) && defined(__NR_mq_open)
1356 #include <mqueue.h>
1357 
1358 static inline abi_long copy_from_user_mq_attr(struct mq_attr *attr,
1359                                               abi_ulong target_mq_attr_addr)
1360 {
1361     struct target_mq_attr *target_mq_attr;
1362 
1363     if (!lock_user_struct(VERIFY_READ, target_mq_attr,
1364                           target_mq_attr_addr, 1))
1365         return -TARGET_EFAULT;
1366 
1367     __get_user(attr->mq_flags, &target_mq_attr->mq_flags);
1368     __get_user(attr->mq_maxmsg, &target_mq_attr->mq_maxmsg);
1369     __get_user(attr->mq_msgsize, &target_mq_attr->mq_msgsize);
1370     __get_user(attr->mq_curmsgs, &target_mq_attr->mq_curmsgs);
1371 
1372     unlock_user_struct(target_mq_attr, target_mq_attr_addr, 0);
1373 
1374     return 0;
1375 }
1376 
1377 static inline abi_long copy_to_user_mq_attr(abi_ulong target_mq_attr_addr,
1378                                             const struct mq_attr *attr)
1379 {
1380     struct target_mq_attr *target_mq_attr;
1381 
1382     if (!lock_user_struct(VERIFY_WRITE, target_mq_attr,
1383                           target_mq_attr_addr, 0))
1384         return -TARGET_EFAULT;
1385 
1386     __put_user(attr->mq_flags, &target_mq_attr->mq_flags);
1387     __put_user(attr->mq_maxmsg, &target_mq_attr->mq_maxmsg);
1388     __put_user(attr->mq_msgsize, &target_mq_attr->mq_msgsize);
1389     __put_user(attr->mq_curmsgs, &target_mq_attr->mq_curmsgs);
1390 
1391     unlock_user_struct(target_mq_attr, target_mq_attr_addr, 1);
1392 
1393     return 0;
1394 }
1395 #endif
1396 
1397 #if defined(TARGET_NR_select) || defined(TARGET_NR__newselect)
1398 /* do_select() must return target values and target errnos. */
1399 static abi_long do_select(int n,
1400                           abi_ulong rfd_addr, abi_ulong wfd_addr,
1401                           abi_ulong efd_addr, abi_ulong target_tv_addr)
1402 {
1403     fd_set rfds, wfds, efds;
1404     fd_set *rfds_ptr, *wfds_ptr, *efds_ptr;
1405     struct timeval tv;
1406     struct timespec ts, *ts_ptr;
1407     abi_long ret;
1408 
1409     ret = copy_from_user_fdset_ptr(&rfds, &rfds_ptr, rfd_addr, n);
1410     if (ret) {
1411         return ret;
1412     }
1413     ret = copy_from_user_fdset_ptr(&wfds, &wfds_ptr, wfd_addr, n);
1414     if (ret) {
1415         return ret;
1416     }
1417     ret = copy_from_user_fdset_ptr(&efds, &efds_ptr, efd_addr, n);
1418     if (ret) {
1419         return ret;
1420     }
1421 
1422     if (target_tv_addr) {
1423         if (copy_from_user_timeval(&tv, target_tv_addr))
1424             return -TARGET_EFAULT;
1425         ts.tv_sec = tv.tv_sec;
1426         ts.tv_nsec = tv.tv_usec * 1000;
1427         ts_ptr = &ts;
1428     } else {
1429         ts_ptr = NULL;
1430     }
1431 
1432     ret = get_errno(safe_pselect6(n, rfds_ptr, wfds_ptr, efds_ptr,
1433                                   ts_ptr, NULL));
1434 
1435     if (!is_error(ret)) {
1436         if (rfd_addr && copy_to_user_fdset(rfd_addr, &rfds, n))
1437             return -TARGET_EFAULT;
1438         if (wfd_addr && copy_to_user_fdset(wfd_addr, &wfds, n))
1439             return -TARGET_EFAULT;
1440         if (efd_addr && copy_to_user_fdset(efd_addr, &efds, n))
1441             return -TARGET_EFAULT;
1442 
1443         if (target_tv_addr) {
1444             tv.tv_sec = ts.tv_sec;
1445             tv.tv_usec = ts.tv_nsec / 1000;
1446             if (copy_to_user_timeval(target_tv_addr, &tv)) {
1447                 return -TARGET_EFAULT;
1448             }
1449         }
1450     }
1451 
1452     return ret;
1453 }
1454 
1455 #if defined(TARGET_WANT_OLD_SYS_SELECT)
1456 static abi_long do_old_select(abi_ulong arg1)
1457 {
1458     struct target_sel_arg_struct *sel;
1459     abi_ulong inp, outp, exp, tvp;
1460     long nsel;
1461 
1462     if (!lock_user_struct(VERIFY_READ, sel, arg1, 1)) {
1463         return -TARGET_EFAULT;
1464     }
1465 
1466     nsel = tswapal(sel->n);
1467     inp = tswapal(sel->inp);
1468     outp = tswapal(sel->outp);
1469     exp = tswapal(sel->exp);
1470     tvp = tswapal(sel->tvp);
1471 
1472     unlock_user_struct(sel, arg1, 0);
1473 
1474     return do_select(nsel, inp, outp, exp, tvp);
1475 }
1476 #endif
1477 #endif
1478 
1479 #if defined(TARGET_NR_pselect6) || defined(TARGET_NR_pselect6_time64)
1480 static abi_long do_pselect6(abi_long arg1, abi_long arg2, abi_long arg3,
1481                             abi_long arg4, abi_long arg5, abi_long arg6,
1482                             bool time64)
1483 {
1484     abi_long rfd_addr, wfd_addr, efd_addr, n, ts_addr;
1485     fd_set rfds, wfds, efds;
1486     fd_set *rfds_ptr, *wfds_ptr, *efds_ptr;
1487     struct timespec ts, *ts_ptr;
1488     abi_long ret;
1489 
1490     /*
1491      * The 6th arg is actually two args smashed together,
1492      * so we cannot use the C library.
1493      */
1494     sigset_t set;
1495     struct {
1496         sigset_t *set;
1497         size_t size;
1498     } sig, *sig_ptr;
1499 
1500     abi_ulong arg_sigset, arg_sigsize, *arg7;
1501     target_sigset_t *target_sigset;
1502 
1503     n = arg1;
1504     rfd_addr = arg2;
1505     wfd_addr = arg3;
1506     efd_addr = arg4;
1507     ts_addr = arg5;
1508 
1509     ret = copy_from_user_fdset_ptr(&rfds, &rfds_ptr, rfd_addr, n);
1510     if (ret) {
1511         return ret;
1512     }
1513     ret = copy_from_user_fdset_ptr(&wfds, &wfds_ptr, wfd_addr, n);
1514     if (ret) {
1515         return ret;
1516     }
1517     ret = copy_from_user_fdset_ptr(&efds, &efds_ptr, efd_addr, n);
1518     if (ret) {
1519         return ret;
1520     }
1521 
1522     /*
1523      * This takes a timespec, and not a timeval, so we cannot
1524      * use the do_select() helper ...
1525      */
1526     if (ts_addr) {
1527         if (time64) {
1528             if (target_to_host_timespec64(&ts, ts_addr)) {
1529                 return -TARGET_EFAULT;
1530             }
1531         } else {
1532             if (target_to_host_timespec(&ts, ts_addr)) {
1533                 return -TARGET_EFAULT;
1534             }
1535         }
1536             ts_ptr = &ts;
1537     } else {
1538         ts_ptr = NULL;
1539     }
1540 
1541     /* Extract the two packed args for the sigset */
1542     if (arg6) {
1543         sig_ptr = &sig;
1544         sig.size = SIGSET_T_SIZE;
1545 
1546         arg7 = lock_user(VERIFY_READ, arg6, sizeof(*arg7) * 2, 1);
1547         if (!arg7) {
1548             return -TARGET_EFAULT;
1549         }
1550         arg_sigset = tswapal(arg7[0]);
1551         arg_sigsize = tswapal(arg7[1]);
1552         unlock_user(arg7, arg6, 0);
1553 
1554         if (arg_sigset) {
1555             sig.set = &set;
1556             if (arg_sigsize != sizeof(*target_sigset)) {
1557                 /* Like the kernel, we enforce correct size sigsets */
1558                 return -TARGET_EINVAL;
1559             }
1560             target_sigset = lock_user(VERIFY_READ, arg_sigset,
1561                                       sizeof(*target_sigset), 1);
1562             if (!target_sigset) {
1563                 return -TARGET_EFAULT;
1564             }
1565             target_to_host_sigset(&set, target_sigset);
1566             unlock_user(target_sigset, arg_sigset, 0);
1567         } else {
1568             sig.set = NULL;
1569         }
1570     } else {
1571         sig_ptr = NULL;
1572     }
1573 
1574     ret = get_errno(safe_pselect6(n, rfds_ptr, wfds_ptr, efds_ptr,
1575                                   ts_ptr, sig_ptr));
1576 
1577     if (!is_error(ret)) {
1578         if (rfd_addr && copy_to_user_fdset(rfd_addr, &rfds, n)) {
1579             return -TARGET_EFAULT;
1580         }
1581         if (wfd_addr && copy_to_user_fdset(wfd_addr, &wfds, n)) {
1582             return -TARGET_EFAULT;
1583         }
1584         if (efd_addr && copy_to_user_fdset(efd_addr, &efds, n)) {
1585             return -TARGET_EFAULT;
1586         }
1587         if (time64) {
1588             if (ts_addr && host_to_target_timespec64(ts_addr, &ts)) {
1589                 return -TARGET_EFAULT;
1590             }
1591         } else {
1592             if (ts_addr && host_to_target_timespec(ts_addr, &ts)) {
1593                 return -TARGET_EFAULT;
1594             }
1595         }
1596     }
1597     return ret;
1598 }
1599 #endif
1600 
1601 #if defined(TARGET_NR_poll) || defined(TARGET_NR_ppoll) || \
1602     defined(TARGET_NR_ppoll_time64)
1603 static abi_long do_ppoll(abi_long arg1, abi_long arg2, abi_long arg3,
1604                          abi_long arg4, abi_long arg5, bool ppoll, bool time64)
1605 {
1606     struct target_pollfd *target_pfd;
1607     unsigned int nfds = arg2;
1608     struct pollfd *pfd;
1609     unsigned int i;
1610     abi_long ret;
1611 
1612     pfd = NULL;
1613     target_pfd = NULL;
1614     if (nfds) {
1615         if (nfds > (INT_MAX / sizeof(struct target_pollfd))) {
1616             return -TARGET_EINVAL;
1617         }
1618         target_pfd = lock_user(VERIFY_WRITE, arg1,
1619                                sizeof(struct target_pollfd) * nfds, 1);
1620         if (!target_pfd) {
1621             return -TARGET_EFAULT;
1622         }
1623 
1624         pfd = alloca(sizeof(struct pollfd) * nfds);
1625         for (i = 0; i < nfds; i++) {
1626             pfd[i].fd = tswap32(target_pfd[i].fd);
1627             pfd[i].events = tswap16(target_pfd[i].events);
1628         }
1629     }
1630     if (ppoll) {
1631         struct timespec _timeout_ts, *timeout_ts = &_timeout_ts;
1632         target_sigset_t *target_set;
1633         sigset_t _set, *set = &_set;
1634 
1635         if (arg3) {
1636             if (time64) {
1637                 if (target_to_host_timespec64(timeout_ts, arg3)) {
1638                     unlock_user(target_pfd, arg1, 0);
1639                     return -TARGET_EFAULT;
1640                 }
1641             } else {
1642                 if (target_to_host_timespec(timeout_ts, arg3)) {
1643                     unlock_user(target_pfd, arg1, 0);
1644                     return -TARGET_EFAULT;
1645                 }
1646             }
1647         } else {
1648             timeout_ts = NULL;
1649         }
1650 
1651         if (arg4) {
1652             if (arg5 != sizeof(target_sigset_t)) {
1653                 unlock_user(target_pfd, arg1, 0);
1654                 return -TARGET_EINVAL;
1655             }
1656 
1657             target_set = lock_user(VERIFY_READ, arg4,
1658                                    sizeof(target_sigset_t), 1);
1659             if (!target_set) {
1660                 unlock_user(target_pfd, arg1, 0);
1661                 return -TARGET_EFAULT;
1662             }
1663             target_to_host_sigset(set, target_set);
1664         } else {
1665             set = NULL;
1666         }
1667 
1668         ret = get_errno(safe_ppoll(pfd, nfds, timeout_ts,
1669                                    set, SIGSET_T_SIZE));
1670 
1671         if (!is_error(ret) && arg3) {
1672             if (time64) {
1673                 if (host_to_target_timespec64(arg3, timeout_ts)) {
1674                     return -TARGET_EFAULT;
1675                 }
1676             } else {
1677                 if (host_to_target_timespec(arg3, timeout_ts)) {
1678                     return -TARGET_EFAULT;
1679                 }
1680             }
1681         }
1682         if (arg4) {
1683             unlock_user(target_set, arg4, 0);
1684         }
1685     } else {
1686           struct timespec ts, *pts;
1687 
1688           if (arg3 >= 0) {
1689               /* Convert ms to secs, ns */
1690               ts.tv_sec = arg3 / 1000;
1691               ts.tv_nsec = (arg3 % 1000) * 1000000LL;
1692               pts = &ts;
1693           } else {
1694               /* -ve poll() timeout means "infinite" */
1695               pts = NULL;
1696           }
1697           ret = get_errno(safe_ppoll(pfd, nfds, pts, NULL, 0));
1698     }
1699 
1700     if (!is_error(ret)) {
1701         for (i = 0; i < nfds; i++) {
1702             target_pfd[i].revents = tswap16(pfd[i].revents);
1703         }
1704     }
1705     unlock_user(target_pfd, arg1, sizeof(struct target_pollfd) * nfds);
1706     return ret;
1707 }
1708 #endif
1709 
1710 static abi_long do_pipe2(int host_pipe[], int flags)
1711 {
1712 #ifdef CONFIG_PIPE2
1713     return pipe2(host_pipe, flags);
1714 #else
1715     return -ENOSYS;
1716 #endif
1717 }
1718 
1719 static abi_long do_pipe(void *cpu_env, abi_ulong pipedes,
1720                         int flags, int is_pipe2)
1721 {
1722     int host_pipe[2];
1723     abi_long ret;
1724     ret = flags ? do_pipe2(host_pipe, flags) : pipe(host_pipe);
1725 
1726     if (is_error(ret))
1727         return get_errno(ret);
1728 
1729     /* Several targets have special calling conventions for the original
1730        pipe syscall, but didn't replicate this into the pipe2 syscall.  */
1731     if (!is_pipe2) {
1732 #if defined(TARGET_ALPHA)
1733         ((CPUAlphaState *)cpu_env)->ir[IR_A4] = host_pipe[1];
1734         return host_pipe[0];
1735 #elif defined(TARGET_MIPS)
1736         ((CPUMIPSState*)cpu_env)->active_tc.gpr[3] = host_pipe[1];
1737         return host_pipe[0];
1738 #elif defined(TARGET_SH4)
1739         ((CPUSH4State*)cpu_env)->gregs[1] = host_pipe[1];
1740         return host_pipe[0];
1741 #elif defined(TARGET_SPARC)
1742         ((CPUSPARCState*)cpu_env)->regwptr[1] = host_pipe[1];
1743         return host_pipe[0];
1744 #endif
1745     }
1746 
1747     if (put_user_s32(host_pipe[0], pipedes)
1748         || put_user_s32(host_pipe[1], pipedes + sizeof(host_pipe[0])))
1749         return -TARGET_EFAULT;
1750     return get_errno(ret);
1751 }
1752 
1753 static inline abi_long target_to_host_ip_mreq(struct ip_mreqn *mreqn,
1754                                               abi_ulong target_addr,
1755                                               socklen_t len)
1756 {
1757     struct target_ip_mreqn *target_smreqn;
1758 
1759     target_smreqn = lock_user(VERIFY_READ, target_addr, len, 1);
1760     if (!target_smreqn)
1761         return -TARGET_EFAULT;
1762     mreqn->imr_multiaddr.s_addr = target_smreqn->imr_multiaddr.s_addr;
1763     mreqn->imr_address.s_addr = target_smreqn->imr_address.s_addr;
1764     if (len == sizeof(struct target_ip_mreqn))
1765         mreqn->imr_ifindex = tswapal(target_smreqn->imr_ifindex);
1766     unlock_user(target_smreqn, target_addr, 0);
1767 
1768     return 0;
1769 }
1770 
1771 static inline abi_long target_to_host_sockaddr(int fd, struct sockaddr *addr,
1772                                                abi_ulong target_addr,
1773                                                socklen_t len)
1774 {
1775     const socklen_t unix_maxlen = sizeof (struct sockaddr_un);
1776     sa_family_t sa_family;
1777     struct target_sockaddr *target_saddr;
1778 
1779     if (fd_trans_target_to_host_addr(fd)) {
1780         return fd_trans_target_to_host_addr(fd)(addr, target_addr, len);
1781     }
1782 
1783     target_saddr = lock_user(VERIFY_READ, target_addr, len, 1);
1784     if (!target_saddr)
1785         return -TARGET_EFAULT;
1786 
1787     sa_family = tswap16(target_saddr->sa_family);
1788 
1789     /* Oops. The caller might send a incomplete sun_path; sun_path
1790      * must be terminated by \0 (see the manual page), but
1791      * unfortunately it is quite common to specify sockaddr_un
1792      * length as "strlen(x->sun_path)" while it should be
1793      * "strlen(...) + 1". We'll fix that here if needed.
1794      * Linux kernel has a similar feature.
1795      */
1796 
1797     if (sa_family == AF_UNIX) {
1798         if (len < unix_maxlen && len > 0) {
1799             char *cp = (char*)target_saddr;
1800 
1801             if ( cp[len-1] && !cp[len] )
1802                 len++;
1803         }
1804         if (len > unix_maxlen)
1805             len = unix_maxlen;
1806     }
1807 
1808     memcpy(addr, target_saddr, len);
1809     addr->sa_family = sa_family;
1810     if (sa_family == AF_NETLINK) {
1811         struct sockaddr_nl *nladdr;
1812 
1813         nladdr = (struct sockaddr_nl *)addr;
1814         nladdr->nl_pid = tswap32(nladdr->nl_pid);
1815         nladdr->nl_groups = tswap32(nladdr->nl_groups);
1816     } else if (sa_family == AF_PACKET) {
1817 	struct target_sockaddr_ll *lladdr;
1818 
1819 	lladdr = (struct target_sockaddr_ll *)addr;
1820 	lladdr->sll_ifindex = tswap32(lladdr->sll_ifindex);
1821 	lladdr->sll_hatype = tswap16(lladdr->sll_hatype);
1822     }
1823     unlock_user(target_saddr, target_addr, 0);
1824 
1825     return 0;
1826 }
1827 
1828 static inline abi_long host_to_target_sockaddr(abi_ulong target_addr,
1829                                                struct sockaddr *addr,
1830                                                socklen_t len)
1831 {
1832     struct target_sockaddr *target_saddr;
1833 
1834     if (len == 0) {
1835         return 0;
1836     }
1837     assert(addr);
1838 
1839     target_saddr = lock_user(VERIFY_WRITE, target_addr, len, 0);
1840     if (!target_saddr)
1841         return -TARGET_EFAULT;
1842     memcpy(target_saddr, addr, len);
1843     if (len >= offsetof(struct target_sockaddr, sa_family) +
1844         sizeof(target_saddr->sa_family)) {
1845         target_saddr->sa_family = tswap16(addr->sa_family);
1846     }
1847     if (addr->sa_family == AF_NETLINK &&
1848         len >= sizeof(struct target_sockaddr_nl)) {
1849         struct target_sockaddr_nl *target_nl =
1850                (struct target_sockaddr_nl *)target_saddr;
1851         target_nl->nl_pid = tswap32(target_nl->nl_pid);
1852         target_nl->nl_groups = tswap32(target_nl->nl_groups);
1853     } else if (addr->sa_family == AF_PACKET) {
1854         struct sockaddr_ll *target_ll = (struct sockaddr_ll *)target_saddr;
1855         target_ll->sll_ifindex = tswap32(target_ll->sll_ifindex);
1856         target_ll->sll_hatype = tswap16(target_ll->sll_hatype);
1857     } else if (addr->sa_family == AF_INET6 &&
1858                len >= sizeof(struct target_sockaddr_in6)) {
1859         struct target_sockaddr_in6 *target_in6 =
1860                (struct target_sockaddr_in6 *)target_saddr;
1861         target_in6->sin6_scope_id = tswap16(target_in6->sin6_scope_id);
1862     }
1863     unlock_user(target_saddr, target_addr, len);
1864 
1865     return 0;
1866 }
1867 
1868 static inline abi_long target_to_host_cmsg(struct msghdr *msgh,
1869                                            struct target_msghdr *target_msgh)
1870 {
1871     struct cmsghdr *cmsg = CMSG_FIRSTHDR(msgh);
1872     abi_long msg_controllen;
1873     abi_ulong target_cmsg_addr;
1874     struct target_cmsghdr *target_cmsg, *target_cmsg_start;
1875     socklen_t space = 0;
1876 
1877     msg_controllen = tswapal(target_msgh->msg_controllen);
1878     if (msg_controllen < sizeof (struct target_cmsghdr))
1879         goto the_end;
1880     target_cmsg_addr = tswapal(target_msgh->msg_control);
1881     target_cmsg = lock_user(VERIFY_READ, target_cmsg_addr, msg_controllen, 1);
1882     target_cmsg_start = target_cmsg;
1883     if (!target_cmsg)
1884         return -TARGET_EFAULT;
1885 
1886     while (cmsg && target_cmsg) {
1887         void *data = CMSG_DATA(cmsg);
1888         void *target_data = TARGET_CMSG_DATA(target_cmsg);
1889 
1890         int len = tswapal(target_cmsg->cmsg_len)
1891             - sizeof(struct target_cmsghdr);
1892 
1893         space += CMSG_SPACE(len);
1894         if (space > msgh->msg_controllen) {
1895             space -= CMSG_SPACE(len);
1896             /* This is a QEMU bug, since we allocated the payload
1897              * area ourselves (unlike overflow in host-to-target
1898              * conversion, which is just the guest giving us a buffer
1899              * that's too small). It can't happen for the payload types
1900              * we currently support; if it becomes an issue in future
1901              * we would need to improve our allocation strategy to
1902              * something more intelligent than "twice the size of the
1903              * target buffer we're reading from".
1904              */
1905             qemu_log_mask(LOG_UNIMP,
1906                           ("Unsupported ancillary data %d/%d: "
1907                            "unhandled msg size\n"),
1908                           tswap32(target_cmsg->cmsg_level),
1909                           tswap32(target_cmsg->cmsg_type));
1910             break;
1911         }
1912 
1913         if (tswap32(target_cmsg->cmsg_level) == TARGET_SOL_SOCKET) {
1914             cmsg->cmsg_level = SOL_SOCKET;
1915         } else {
1916             cmsg->cmsg_level = tswap32(target_cmsg->cmsg_level);
1917         }
1918         cmsg->cmsg_type = tswap32(target_cmsg->cmsg_type);
1919         cmsg->cmsg_len = CMSG_LEN(len);
1920 
1921         if (cmsg->cmsg_level == SOL_SOCKET && cmsg->cmsg_type == SCM_RIGHTS) {
1922             int *fd = (int *)data;
1923             int *target_fd = (int *)target_data;
1924             int i, numfds = len / sizeof(int);
1925 
1926             for (i = 0; i < numfds; i++) {
1927                 __get_user(fd[i], target_fd + i);
1928             }
1929         } else if (cmsg->cmsg_level == SOL_SOCKET
1930                &&  cmsg->cmsg_type == SCM_CREDENTIALS) {
1931             struct ucred *cred = (struct ucred *)data;
1932             struct target_ucred *target_cred =
1933                 (struct target_ucred *)target_data;
1934 
1935             __get_user(cred->pid, &target_cred->pid);
1936             __get_user(cred->uid, &target_cred->uid);
1937             __get_user(cred->gid, &target_cred->gid);
1938         } else {
1939             qemu_log_mask(LOG_UNIMP, "Unsupported ancillary data: %d/%d\n",
1940                           cmsg->cmsg_level, cmsg->cmsg_type);
1941             memcpy(data, target_data, len);
1942         }
1943 
1944         cmsg = CMSG_NXTHDR(msgh, cmsg);
1945         target_cmsg = TARGET_CMSG_NXTHDR(target_msgh, target_cmsg,
1946                                          target_cmsg_start);
1947     }
1948     unlock_user(target_cmsg, target_cmsg_addr, 0);
1949  the_end:
1950     msgh->msg_controllen = space;
1951     return 0;
1952 }
1953 
1954 static inline abi_long host_to_target_cmsg(struct target_msghdr *target_msgh,
1955                                            struct msghdr *msgh)
1956 {
1957     struct cmsghdr *cmsg = CMSG_FIRSTHDR(msgh);
1958     abi_long msg_controllen;
1959     abi_ulong target_cmsg_addr;
1960     struct target_cmsghdr *target_cmsg, *target_cmsg_start;
1961     socklen_t space = 0;
1962 
1963     msg_controllen = tswapal(target_msgh->msg_controllen);
1964     if (msg_controllen < sizeof (struct target_cmsghdr))
1965         goto the_end;
1966     target_cmsg_addr = tswapal(target_msgh->msg_control);
1967     target_cmsg = lock_user(VERIFY_WRITE, target_cmsg_addr, msg_controllen, 0);
1968     target_cmsg_start = target_cmsg;
1969     if (!target_cmsg)
1970         return -TARGET_EFAULT;
1971 
1972     while (cmsg && target_cmsg) {
1973         void *data = CMSG_DATA(cmsg);
1974         void *target_data = TARGET_CMSG_DATA(target_cmsg);
1975 
1976         int len = cmsg->cmsg_len - sizeof(struct cmsghdr);
1977         int tgt_len, tgt_space;
1978 
1979         /* We never copy a half-header but may copy half-data;
1980          * this is Linux's behaviour in put_cmsg(). Note that
1981          * truncation here is a guest problem (which we report
1982          * to the guest via the CTRUNC bit), unlike truncation
1983          * in target_to_host_cmsg, which is a QEMU bug.
1984          */
1985         if (msg_controllen < sizeof(struct target_cmsghdr)) {
1986             target_msgh->msg_flags |= tswap32(MSG_CTRUNC);
1987             break;
1988         }
1989 
1990         if (cmsg->cmsg_level == SOL_SOCKET) {
1991             target_cmsg->cmsg_level = tswap32(TARGET_SOL_SOCKET);
1992         } else {
1993             target_cmsg->cmsg_level = tswap32(cmsg->cmsg_level);
1994         }
1995         target_cmsg->cmsg_type = tswap32(cmsg->cmsg_type);
1996 
1997         /* Payload types which need a different size of payload on
1998          * the target must adjust tgt_len here.
1999          */
2000         tgt_len = len;
2001         switch (cmsg->cmsg_level) {
2002         case SOL_SOCKET:
2003             switch (cmsg->cmsg_type) {
2004             case SO_TIMESTAMP:
2005                 tgt_len = sizeof(struct target_timeval);
2006                 break;
2007             default:
2008                 break;
2009             }
2010             break;
2011         default:
2012             break;
2013         }
2014 
2015         if (msg_controllen < TARGET_CMSG_LEN(tgt_len)) {
2016             target_msgh->msg_flags |= tswap32(MSG_CTRUNC);
2017             tgt_len = msg_controllen - sizeof(struct target_cmsghdr);
2018         }
2019 
2020         /* We must now copy-and-convert len bytes of payload
2021          * into tgt_len bytes of destination space. Bear in mind
2022          * that in both source and destination we may be dealing
2023          * with a truncated value!
2024          */
2025         switch (cmsg->cmsg_level) {
2026         case SOL_SOCKET:
2027             switch (cmsg->cmsg_type) {
2028             case SCM_RIGHTS:
2029             {
2030                 int *fd = (int *)data;
2031                 int *target_fd = (int *)target_data;
2032                 int i, numfds = tgt_len / sizeof(int);
2033 
2034                 for (i = 0; i < numfds; i++) {
2035                     __put_user(fd[i], target_fd + i);
2036                 }
2037                 break;
2038             }
2039             case SO_TIMESTAMP:
2040             {
2041                 struct timeval *tv = (struct timeval *)data;
2042                 struct target_timeval *target_tv =
2043                     (struct target_timeval *)target_data;
2044 
2045                 if (len != sizeof(struct timeval) ||
2046                     tgt_len != sizeof(struct target_timeval)) {
2047                     goto unimplemented;
2048                 }
2049 
2050                 /* copy struct timeval to target */
2051                 __put_user(tv->tv_sec, &target_tv->tv_sec);
2052                 __put_user(tv->tv_usec, &target_tv->tv_usec);
2053                 break;
2054             }
2055             case SCM_CREDENTIALS:
2056             {
2057                 struct ucred *cred = (struct ucred *)data;
2058                 struct target_ucred *target_cred =
2059                     (struct target_ucred *)target_data;
2060 
2061                 __put_user(cred->pid, &target_cred->pid);
2062                 __put_user(cred->uid, &target_cred->uid);
2063                 __put_user(cred->gid, &target_cred->gid);
2064                 break;
2065             }
2066             default:
2067                 goto unimplemented;
2068             }
2069             break;
2070 
2071         case SOL_IP:
2072             switch (cmsg->cmsg_type) {
2073             case IP_TTL:
2074             {
2075                 uint32_t *v = (uint32_t *)data;
2076                 uint32_t *t_int = (uint32_t *)target_data;
2077 
2078                 if (len != sizeof(uint32_t) ||
2079                     tgt_len != sizeof(uint32_t)) {
2080                     goto unimplemented;
2081                 }
2082                 __put_user(*v, t_int);
2083                 break;
2084             }
2085             case IP_RECVERR:
2086             {
2087                 struct errhdr_t {
2088                    struct sock_extended_err ee;
2089                    struct sockaddr_in offender;
2090                 };
2091                 struct errhdr_t *errh = (struct errhdr_t *)data;
2092                 struct errhdr_t *target_errh =
2093                     (struct errhdr_t *)target_data;
2094 
2095                 if (len != sizeof(struct errhdr_t) ||
2096                     tgt_len != sizeof(struct errhdr_t)) {
2097                     goto unimplemented;
2098                 }
2099                 __put_user(errh->ee.ee_errno, &target_errh->ee.ee_errno);
2100                 __put_user(errh->ee.ee_origin, &target_errh->ee.ee_origin);
2101                 __put_user(errh->ee.ee_type,  &target_errh->ee.ee_type);
2102                 __put_user(errh->ee.ee_code, &target_errh->ee.ee_code);
2103                 __put_user(errh->ee.ee_pad, &target_errh->ee.ee_pad);
2104                 __put_user(errh->ee.ee_info, &target_errh->ee.ee_info);
2105                 __put_user(errh->ee.ee_data, &target_errh->ee.ee_data);
2106                 host_to_target_sockaddr((unsigned long) &target_errh->offender,
2107                     (void *) &errh->offender, sizeof(errh->offender));
2108                 break;
2109             }
2110             default:
2111                 goto unimplemented;
2112             }
2113             break;
2114 
2115         case SOL_IPV6:
2116             switch (cmsg->cmsg_type) {
2117             case IPV6_HOPLIMIT:
2118             {
2119                 uint32_t *v = (uint32_t *)data;
2120                 uint32_t *t_int = (uint32_t *)target_data;
2121 
2122                 if (len != sizeof(uint32_t) ||
2123                     tgt_len != sizeof(uint32_t)) {
2124                     goto unimplemented;
2125                 }
2126                 __put_user(*v, t_int);
2127                 break;
2128             }
2129             case IPV6_RECVERR:
2130             {
2131                 struct errhdr6_t {
2132                    struct sock_extended_err ee;
2133                    struct sockaddr_in6 offender;
2134                 };
2135                 struct errhdr6_t *errh = (struct errhdr6_t *)data;
2136                 struct errhdr6_t *target_errh =
2137                     (struct errhdr6_t *)target_data;
2138 
2139                 if (len != sizeof(struct errhdr6_t) ||
2140                     tgt_len != sizeof(struct errhdr6_t)) {
2141                     goto unimplemented;
2142                 }
2143                 __put_user(errh->ee.ee_errno, &target_errh->ee.ee_errno);
2144                 __put_user(errh->ee.ee_origin, &target_errh->ee.ee_origin);
2145                 __put_user(errh->ee.ee_type,  &target_errh->ee.ee_type);
2146                 __put_user(errh->ee.ee_code, &target_errh->ee.ee_code);
2147                 __put_user(errh->ee.ee_pad, &target_errh->ee.ee_pad);
2148                 __put_user(errh->ee.ee_info, &target_errh->ee.ee_info);
2149                 __put_user(errh->ee.ee_data, &target_errh->ee.ee_data);
2150                 host_to_target_sockaddr((unsigned long) &target_errh->offender,
2151                     (void *) &errh->offender, sizeof(errh->offender));
2152                 break;
2153             }
2154             default:
2155                 goto unimplemented;
2156             }
2157             break;
2158 
2159         default:
2160         unimplemented:
2161             qemu_log_mask(LOG_UNIMP, "Unsupported ancillary data: %d/%d\n",
2162                           cmsg->cmsg_level, cmsg->cmsg_type);
2163             memcpy(target_data, data, MIN(len, tgt_len));
2164             if (tgt_len > len) {
2165                 memset(target_data + len, 0, tgt_len - len);
2166             }
2167         }
2168 
2169         target_cmsg->cmsg_len = tswapal(TARGET_CMSG_LEN(tgt_len));
2170         tgt_space = TARGET_CMSG_SPACE(tgt_len);
2171         if (msg_controllen < tgt_space) {
2172             tgt_space = msg_controllen;
2173         }
2174         msg_controllen -= tgt_space;
2175         space += tgt_space;
2176         cmsg = CMSG_NXTHDR(msgh, cmsg);
2177         target_cmsg = TARGET_CMSG_NXTHDR(target_msgh, target_cmsg,
2178                                          target_cmsg_start);
2179     }
2180     unlock_user(target_cmsg, target_cmsg_addr, space);
2181  the_end:
2182     target_msgh->msg_controllen = tswapal(space);
2183     return 0;
2184 }
2185 
2186 /* do_setsockopt() Must return target values and target errnos. */
2187 static abi_long do_setsockopt(int sockfd, int level, int optname,
2188                               abi_ulong optval_addr, socklen_t optlen)
2189 {
2190     abi_long ret;
2191     int val;
2192     struct ip_mreqn *ip_mreq;
2193     struct ip_mreq_source *ip_mreq_source;
2194 
2195     switch(level) {
2196     case SOL_TCP:
2197     case SOL_UDP:
2198         /* TCP and UDP options all take an 'int' value.  */
2199         if (optlen < sizeof(uint32_t))
2200             return -TARGET_EINVAL;
2201 
2202         if (get_user_u32(val, optval_addr))
2203             return -TARGET_EFAULT;
2204         ret = get_errno(setsockopt(sockfd, level, optname, &val, sizeof(val)));
2205         break;
2206     case SOL_IP:
2207         switch(optname) {
2208         case IP_TOS:
2209         case IP_TTL:
2210         case IP_HDRINCL:
2211         case IP_ROUTER_ALERT:
2212         case IP_RECVOPTS:
2213         case IP_RETOPTS:
2214         case IP_PKTINFO:
2215         case IP_MTU_DISCOVER:
2216         case IP_RECVERR:
2217         case IP_RECVTTL:
2218         case IP_RECVTOS:
2219 #ifdef IP_FREEBIND
2220         case IP_FREEBIND:
2221 #endif
2222         case IP_MULTICAST_TTL:
2223         case IP_MULTICAST_LOOP:
2224             val = 0;
2225             if (optlen >= sizeof(uint32_t)) {
2226                 if (get_user_u32(val, optval_addr))
2227                     return -TARGET_EFAULT;
2228             } else if (optlen >= 1) {
2229                 if (get_user_u8(val, optval_addr))
2230                     return -TARGET_EFAULT;
2231             }
2232             ret = get_errno(setsockopt(sockfd, level, optname, &val, sizeof(val)));
2233             break;
2234         case IP_ADD_MEMBERSHIP:
2235         case IP_DROP_MEMBERSHIP:
2236             if (optlen < sizeof (struct target_ip_mreq) ||
2237                 optlen > sizeof (struct target_ip_mreqn))
2238                 return -TARGET_EINVAL;
2239 
2240             ip_mreq = (struct ip_mreqn *) alloca(optlen);
2241             target_to_host_ip_mreq(ip_mreq, optval_addr, optlen);
2242             ret = get_errno(setsockopt(sockfd, level, optname, ip_mreq, optlen));
2243             break;
2244 
2245         case IP_BLOCK_SOURCE:
2246         case IP_UNBLOCK_SOURCE:
2247         case IP_ADD_SOURCE_MEMBERSHIP:
2248         case IP_DROP_SOURCE_MEMBERSHIP:
2249             if (optlen != sizeof (struct target_ip_mreq_source))
2250                 return -TARGET_EINVAL;
2251 
2252             ip_mreq_source = lock_user(VERIFY_READ, optval_addr, optlen, 1);
2253             ret = get_errno(setsockopt(sockfd, level, optname, ip_mreq_source, optlen));
2254             unlock_user (ip_mreq_source, optval_addr, 0);
2255             break;
2256 
2257         default:
2258             goto unimplemented;
2259         }
2260         break;
2261     case SOL_IPV6:
2262         switch (optname) {
2263         case IPV6_MTU_DISCOVER:
2264         case IPV6_MTU:
2265         case IPV6_V6ONLY:
2266         case IPV6_RECVPKTINFO:
2267         case IPV6_UNICAST_HOPS:
2268         case IPV6_MULTICAST_HOPS:
2269         case IPV6_MULTICAST_LOOP:
2270         case IPV6_RECVERR:
2271         case IPV6_RECVHOPLIMIT:
2272         case IPV6_2292HOPLIMIT:
2273         case IPV6_CHECKSUM:
2274         case IPV6_ADDRFORM:
2275         case IPV6_2292PKTINFO:
2276         case IPV6_RECVTCLASS:
2277         case IPV6_RECVRTHDR:
2278         case IPV6_2292RTHDR:
2279         case IPV6_RECVHOPOPTS:
2280         case IPV6_2292HOPOPTS:
2281         case IPV6_RECVDSTOPTS:
2282         case IPV6_2292DSTOPTS:
2283         case IPV6_TCLASS:
2284         case IPV6_ADDR_PREFERENCES:
2285 #ifdef IPV6_RECVPATHMTU
2286         case IPV6_RECVPATHMTU:
2287 #endif
2288 #ifdef IPV6_TRANSPARENT
2289         case IPV6_TRANSPARENT:
2290 #endif
2291 #ifdef IPV6_FREEBIND
2292         case IPV6_FREEBIND:
2293 #endif
2294 #ifdef IPV6_RECVORIGDSTADDR
2295         case IPV6_RECVORIGDSTADDR:
2296 #endif
2297             val = 0;
2298             if (optlen < sizeof(uint32_t)) {
2299                 return -TARGET_EINVAL;
2300             }
2301             if (get_user_u32(val, optval_addr)) {
2302                 return -TARGET_EFAULT;
2303             }
2304             ret = get_errno(setsockopt(sockfd, level, optname,
2305                                        &val, sizeof(val)));
2306             break;
2307         case IPV6_PKTINFO:
2308         {
2309             struct in6_pktinfo pki;
2310 
2311             if (optlen < sizeof(pki)) {
2312                 return -TARGET_EINVAL;
2313             }
2314 
2315             if (copy_from_user(&pki, optval_addr, sizeof(pki))) {
2316                 return -TARGET_EFAULT;
2317             }
2318 
2319             pki.ipi6_ifindex = tswap32(pki.ipi6_ifindex);
2320 
2321             ret = get_errno(setsockopt(sockfd, level, optname,
2322                                        &pki, sizeof(pki)));
2323             break;
2324         }
2325         case IPV6_ADD_MEMBERSHIP:
2326         case IPV6_DROP_MEMBERSHIP:
2327         {
2328             struct ipv6_mreq ipv6mreq;
2329 
2330             if (optlen < sizeof(ipv6mreq)) {
2331                 return -TARGET_EINVAL;
2332             }
2333 
2334             if (copy_from_user(&ipv6mreq, optval_addr, sizeof(ipv6mreq))) {
2335                 return -TARGET_EFAULT;
2336             }
2337 
2338             ipv6mreq.ipv6mr_interface = tswap32(ipv6mreq.ipv6mr_interface);
2339 
2340             ret = get_errno(setsockopt(sockfd, level, optname,
2341                                        &ipv6mreq, sizeof(ipv6mreq)));
2342             break;
2343         }
2344         default:
2345             goto unimplemented;
2346         }
2347         break;
2348     case SOL_ICMPV6:
2349         switch (optname) {
2350         case ICMPV6_FILTER:
2351         {
2352             struct icmp6_filter icmp6f;
2353 
2354             if (optlen > sizeof(icmp6f)) {
2355                 optlen = sizeof(icmp6f);
2356             }
2357 
2358             if (copy_from_user(&icmp6f, optval_addr, optlen)) {
2359                 return -TARGET_EFAULT;
2360             }
2361 
2362             for (val = 0; val < 8; val++) {
2363                 icmp6f.data[val] = tswap32(icmp6f.data[val]);
2364             }
2365 
2366             ret = get_errno(setsockopt(sockfd, level, optname,
2367                                        &icmp6f, optlen));
2368             break;
2369         }
2370         default:
2371             goto unimplemented;
2372         }
2373         break;
2374     case SOL_RAW:
2375         switch (optname) {
2376         case ICMP_FILTER:
2377         case IPV6_CHECKSUM:
2378             /* those take an u32 value */
2379             if (optlen < sizeof(uint32_t)) {
2380                 return -TARGET_EINVAL;
2381             }
2382 
2383             if (get_user_u32(val, optval_addr)) {
2384                 return -TARGET_EFAULT;
2385             }
2386             ret = get_errno(setsockopt(sockfd, level, optname,
2387                                        &val, sizeof(val)));
2388             break;
2389 
2390         default:
2391             goto unimplemented;
2392         }
2393         break;
2394 #if defined(SOL_ALG) && defined(ALG_SET_KEY) && defined(ALG_SET_AEAD_AUTHSIZE)
2395     case SOL_ALG:
2396         switch (optname) {
2397         case ALG_SET_KEY:
2398         {
2399             char *alg_key = g_malloc(optlen);
2400 
2401             if (!alg_key) {
2402                 return -TARGET_ENOMEM;
2403             }
2404             if (copy_from_user(alg_key, optval_addr, optlen)) {
2405                 g_free(alg_key);
2406                 return -TARGET_EFAULT;
2407             }
2408             ret = get_errno(setsockopt(sockfd, level, optname,
2409                                        alg_key, optlen));
2410             g_free(alg_key);
2411             break;
2412         }
2413         case ALG_SET_AEAD_AUTHSIZE:
2414         {
2415             ret = get_errno(setsockopt(sockfd, level, optname,
2416                                        NULL, optlen));
2417             break;
2418         }
2419         default:
2420             goto unimplemented;
2421         }
2422         break;
2423 #endif
2424     case TARGET_SOL_SOCKET:
2425         switch (optname) {
2426         case TARGET_SO_RCVTIMEO:
2427         {
2428                 struct timeval tv;
2429 
2430                 optname = SO_RCVTIMEO;
2431 
2432 set_timeout:
2433                 if (optlen != sizeof(struct target_timeval)) {
2434                     return -TARGET_EINVAL;
2435                 }
2436 
2437                 if (copy_from_user_timeval(&tv, optval_addr)) {
2438                     return -TARGET_EFAULT;
2439                 }
2440 
2441                 ret = get_errno(setsockopt(sockfd, SOL_SOCKET, optname,
2442                                 &tv, sizeof(tv)));
2443                 return ret;
2444         }
2445         case TARGET_SO_SNDTIMEO:
2446                 optname = SO_SNDTIMEO;
2447                 goto set_timeout;
2448         case TARGET_SO_ATTACH_FILTER:
2449         {
2450                 struct target_sock_fprog *tfprog;
2451                 struct target_sock_filter *tfilter;
2452                 struct sock_fprog fprog;
2453                 struct sock_filter *filter;
2454                 int i;
2455 
2456                 if (optlen != sizeof(*tfprog)) {
2457                     return -TARGET_EINVAL;
2458                 }
2459                 if (!lock_user_struct(VERIFY_READ, tfprog, optval_addr, 0)) {
2460                     return -TARGET_EFAULT;
2461                 }
2462                 if (!lock_user_struct(VERIFY_READ, tfilter,
2463                                       tswapal(tfprog->filter), 0)) {
2464                     unlock_user_struct(tfprog, optval_addr, 1);
2465                     return -TARGET_EFAULT;
2466                 }
2467 
2468                 fprog.len = tswap16(tfprog->len);
2469                 filter = g_try_new(struct sock_filter, fprog.len);
2470                 if (filter == NULL) {
2471                     unlock_user_struct(tfilter, tfprog->filter, 1);
2472                     unlock_user_struct(tfprog, optval_addr, 1);
2473                     return -TARGET_ENOMEM;
2474                 }
2475                 for (i = 0; i < fprog.len; i++) {
2476                     filter[i].code = tswap16(tfilter[i].code);
2477                     filter[i].jt = tfilter[i].jt;
2478                     filter[i].jf = tfilter[i].jf;
2479                     filter[i].k = tswap32(tfilter[i].k);
2480                 }
2481                 fprog.filter = filter;
2482 
2483                 ret = get_errno(setsockopt(sockfd, SOL_SOCKET,
2484                                 SO_ATTACH_FILTER, &fprog, sizeof(fprog)));
2485                 g_free(filter);
2486 
2487                 unlock_user_struct(tfilter, tfprog->filter, 1);
2488                 unlock_user_struct(tfprog, optval_addr, 1);
2489                 return ret;
2490         }
2491 	case TARGET_SO_BINDTODEVICE:
2492 	{
2493 		char *dev_ifname, *addr_ifname;
2494 
2495 		if (optlen > IFNAMSIZ - 1) {
2496 		    optlen = IFNAMSIZ - 1;
2497 		}
2498 		dev_ifname = lock_user(VERIFY_READ, optval_addr, optlen, 1);
2499 		if (!dev_ifname) {
2500 		    return -TARGET_EFAULT;
2501 		}
2502 		optname = SO_BINDTODEVICE;
2503 		addr_ifname = alloca(IFNAMSIZ);
2504 		memcpy(addr_ifname, dev_ifname, optlen);
2505 		addr_ifname[optlen] = 0;
2506 		ret = get_errno(setsockopt(sockfd, SOL_SOCKET, optname,
2507                                            addr_ifname, optlen));
2508 		unlock_user (dev_ifname, optval_addr, 0);
2509 		return ret;
2510 	}
2511         case TARGET_SO_LINGER:
2512         {
2513                 struct linger lg;
2514                 struct target_linger *tlg;
2515 
2516                 if (optlen != sizeof(struct target_linger)) {
2517                     return -TARGET_EINVAL;
2518                 }
2519                 if (!lock_user_struct(VERIFY_READ, tlg, optval_addr, 1)) {
2520                     return -TARGET_EFAULT;
2521                 }
2522                 __get_user(lg.l_onoff, &tlg->l_onoff);
2523                 __get_user(lg.l_linger, &tlg->l_linger);
2524                 ret = get_errno(setsockopt(sockfd, SOL_SOCKET, SO_LINGER,
2525                                 &lg, sizeof(lg)));
2526                 unlock_user_struct(tlg, optval_addr, 0);
2527                 return ret;
2528         }
2529             /* Options with 'int' argument.  */
2530         case TARGET_SO_DEBUG:
2531 		optname = SO_DEBUG;
2532 		break;
2533         case TARGET_SO_REUSEADDR:
2534 		optname = SO_REUSEADDR;
2535 		break;
2536 #ifdef SO_REUSEPORT
2537         case TARGET_SO_REUSEPORT:
2538                 optname = SO_REUSEPORT;
2539                 break;
2540 #endif
2541         case TARGET_SO_TYPE:
2542 		optname = SO_TYPE;
2543 		break;
2544         case TARGET_SO_ERROR:
2545 		optname = SO_ERROR;
2546 		break;
2547         case TARGET_SO_DONTROUTE:
2548 		optname = SO_DONTROUTE;
2549 		break;
2550         case TARGET_SO_BROADCAST:
2551 		optname = SO_BROADCAST;
2552 		break;
2553         case TARGET_SO_SNDBUF:
2554 		optname = SO_SNDBUF;
2555 		break;
2556         case TARGET_SO_SNDBUFFORCE:
2557                 optname = SO_SNDBUFFORCE;
2558                 break;
2559         case TARGET_SO_RCVBUF:
2560 		optname = SO_RCVBUF;
2561 		break;
2562         case TARGET_SO_RCVBUFFORCE:
2563                 optname = SO_RCVBUFFORCE;
2564                 break;
2565         case TARGET_SO_KEEPALIVE:
2566 		optname = SO_KEEPALIVE;
2567 		break;
2568         case TARGET_SO_OOBINLINE:
2569 		optname = SO_OOBINLINE;
2570 		break;
2571         case TARGET_SO_NO_CHECK:
2572 		optname = SO_NO_CHECK;
2573 		break;
2574         case TARGET_SO_PRIORITY:
2575 		optname = SO_PRIORITY;
2576 		break;
2577 #ifdef SO_BSDCOMPAT
2578         case TARGET_SO_BSDCOMPAT:
2579 		optname = SO_BSDCOMPAT;
2580 		break;
2581 #endif
2582         case TARGET_SO_PASSCRED:
2583 		optname = SO_PASSCRED;
2584 		break;
2585         case TARGET_SO_PASSSEC:
2586                 optname = SO_PASSSEC;
2587                 break;
2588         case TARGET_SO_TIMESTAMP:
2589 		optname = SO_TIMESTAMP;
2590 		break;
2591         case TARGET_SO_RCVLOWAT:
2592 		optname = SO_RCVLOWAT;
2593 		break;
2594         default:
2595             goto unimplemented;
2596         }
2597 	if (optlen < sizeof(uint32_t))
2598             return -TARGET_EINVAL;
2599 
2600 	if (get_user_u32(val, optval_addr))
2601             return -TARGET_EFAULT;
2602 	ret = get_errno(setsockopt(sockfd, SOL_SOCKET, optname, &val, sizeof(val)));
2603         break;
2604 #ifdef SOL_NETLINK
2605     case SOL_NETLINK:
2606         switch (optname) {
2607         case NETLINK_PKTINFO:
2608         case NETLINK_ADD_MEMBERSHIP:
2609         case NETLINK_DROP_MEMBERSHIP:
2610         case NETLINK_BROADCAST_ERROR:
2611         case NETLINK_NO_ENOBUFS:
2612 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 2, 0)
2613         case NETLINK_LISTEN_ALL_NSID:
2614         case NETLINK_CAP_ACK:
2615 #endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 2, 0) */
2616 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 12, 0)
2617         case NETLINK_EXT_ACK:
2618 #endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 12, 0) */
2619 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 20, 0)
2620         case NETLINK_GET_STRICT_CHK:
2621 #endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 12, 0) */
2622             break;
2623         default:
2624             goto unimplemented;
2625         }
2626         val = 0;
2627         if (optlen < sizeof(uint32_t)) {
2628             return -TARGET_EINVAL;
2629         }
2630         if (get_user_u32(val, optval_addr)) {
2631             return -TARGET_EFAULT;
2632         }
2633         ret = get_errno(setsockopt(sockfd, SOL_NETLINK, optname, &val,
2634                                    sizeof(val)));
2635         break;
2636 #endif /* SOL_NETLINK */
2637     default:
2638     unimplemented:
2639         qemu_log_mask(LOG_UNIMP, "Unsupported setsockopt level=%d optname=%d\n",
2640                       level, optname);
2641         ret = -TARGET_ENOPROTOOPT;
2642     }
2643     return ret;
2644 }
2645 
2646 /* do_getsockopt() Must return target values and target errnos. */
2647 static abi_long do_getsockopt(int sockfd, int level, int optname,
2648                               abi_ulong optval_addr, abi_ulong optlen)
2649 {
2650     abi_long ret;
2651     int len, val;
2652     socklen_t lv;
2653 
2654     switch(level) {
2655     case TARGET_SOL_SOCKET:
2656         level = SOL_SOCKET;
2657         switch (optname) {
2658         /* These don't just return a single integer */
2659         case TARGET_SO_PEERNAME:
2660             goto unimplemented;
2661         case TARGET_SO_RCVTIMEO: {
2662             struct timeval tv;
2663             socklen_t tvlen;
2664 
2665             optname = SO_RCVTIMEO;
2666 
2667 get_timeout:
2668             if (get_user_u32(len, optlen)) {
2669                 return -TARGET_EFAULT;
2670             }
2671             if (len < 0) {
2672                 return -TARGET_EINVAL;
2673             }
2674 
2675             tvlen = sizeof(tv);
2676             ret = get_errno(getsockopt(sockfd, level, optname,
2677                                        &tv, &tvlen));
2678             if (ret < 0) {
2679                 return ret;
2680             }
2681             if (len > sizeof(struct target_timeval)) {
2682                 len = sizeof(struct target_timeval);
2683             }
2684             if (copy_to_user_timeval(optval_addr, &tv)) {
2685                 return -TARGET_EFAULT;
2686             }
2687             if (put_user_u32(len, optlen)) {
2688                 return -TARGET_EFAULT;
2689             }
2690             break;
2691         }
2692         case TARGET_SO_SNDTIMEO:
2693             optname = SO_SNDTIMEO;
2694             goto get_timeout;
2695         case TARGET_SO_PEERCRED: {
2696             struct ucred cr;
2697             socklen_t crlen;
2698             struct target_ucred *tcr;
2699 
2700             if (get_user_u32(len, optlen)) {
2701                 return -TARGET_EFAULT;
2702             }
2703             if (len < 0) {
2704                 return -TARGET_EINVAL;
2705             }
2706 
2707             crlen = sizeof(cr);
2708             ret = get_errno(getsockopt(sockfd, level, SO_PEERCRED,
2709                                        &cr, &crlen));
2710             if (ret < 0) {
2711                 return ret;
2712             }
2713             if (len > crlen) {
2714                 len = crlen;
2715             }
2716             if (!lock_user_struct(VERIFY_WRITE, tcr, optval_addr, 0)) {
2717                 return -TARGET_EFAULT;
2718             }
2719             __put_user(cr.pid, &tcr->pid);
2720             __put_user(cr.uid, &tcr->uid);
2721             __put_user(cr.gid, &tcr->gid);
2722             unlock_user_struct(tcr, optval_addr, 1);
2723             if (put_user_u32(len, optlen)) {
2724                 return -TARGET_EFAULT;
2725             }
2726             break;
2727         }
2728         case TARGET_SO_PEERSEC: {
2729             char *name;
2730 
2731             if (get_user_u32(len, optlen)) {
2732                 return -TARGET_EFAULT;
2733             }
2734             if (len < 0) {
2735                 return -TARGET_EINVAL;
2736             }
2737             name = lock_user(VERIFY_WRITE, optval_addr, len, 0);
2738             if (!name) {
2739                 return -TARGET_EFAULT;
2740             }
2741             lv = len;
2742             ret = get_errno(getsockopt(sockfd, level, SO_PEERSEC,
2743                                        name, &lv));
2744             if (put_user_u32(lv, optlen)) {
2745                 ret = -TARGET_EFAULT;
2746             }
2747             unlock_user(name, optval_addr, lv);
2748             break;
2749         }
2750         case TARGET_SO_LINGER:
2751         {
2752             struct linger lg;
2753             socklen_t lglen;
2754             struct target_linger *tlg;
2755 
2756             if (get_user_u32(len, optlen)) {
2757                 return -TARGET_EFAULT;
2758             }
2759             if (len < 0) {
2760                 return -TARGET_EINVAL;
2761             }
2762 
2763             lglen = sizeof(lg);
2764             ret = get_errno(getsockopt(sockfd, level, SO_LINGER,
2765                                        &lg, &lglen));
2766             if (ret < 0) {
2767                 return ret;
2768             }
2769             if (len > lglen) {
2770                 len = lglen;
2771             }
2772             if (!lock_user_struct(VERIFY_WRITE, tlg, optval_addr, 0)) {
2773                 return -TARGET_EFAULT;
2774             }
2775             __put_user(lg.l_onoff, &tlg->l_onoff);
2776             __put_user(lg.l_linger, &tlg->l_linger);
2777             unlock_user_struct(tlg, optval_addr, 1);
2778             if (put_user_u32(len, optlen)) {
2779                 return -TARGET_EFAULT;
2780             }
2781             break;
2782         }
2783         /* Options with 'int' argument.  */
2784         case TARGET_SO_DEBUG:
2785             optname = SO_DEBUG;
2786             goto int_case;
2787         case TARGET_SO_REUSEADDR:
2788             optname = SO_REUSEADDR;
2789             goto int_case;
2790 #ifdef SO_REUSEPORT
2791         case TARGET_SO_REUSEPORT:
2792             optname = SO_REUSEPORT;
2793             goto int_case;
2794 #endif
2795         case TARGET_SO_TYPE:
2796             optname = SO_TYPE;
2797             goto int_case;
2798         case TARGET_SO_ERROR:
2799             optname = SO_ERROR;
2800             goto int_case;
2801         case TARGET_SO_DONTROUTE:
2802             optname = SO_DONTROUTE;
2803             goto int_case;
2804         case TARGET_SO_BROADCAST:
2805             optname = SO_BROADCAST;
2806             goto int_case;
2807         case TARGET_SO_SNDBUF:
2808             optname = SO_SNDBUF;
2809             goto int_case;
2810         case TARGET_SO_RCVBUF:
2811             optname = SO_RCVBUF;
2812             goto int_case;
2813         case TARGET_SO_KEEPALIVE:
2814             optname = SO_KEEPALIVE;
2815             goto int_case;
2816         case TARGET_SO_OOBINLINE:
2817             optname = SO_OOBINLINE;
2818             goto int_case;
2819         case TARGET_SO_NO_CHECK:
2820             optname = SO_NO_CHECK;
2821             goto int_case;
2822         case TARGET_SO_PRIORITY:
2823             optname = SO_PRIORITY;
2824             goto int_case;
2825 #ifdef SO_BSDCOMPAT
2826         case TARGET_SO_BSDCOMPAT:
2827             optname = SO_BSDCOMPAT;
2828             goto int_case;
2829 #endif
2830         case TARGET_SO_PASSCRED:
2831             optname = SO_PASSCRED;
2832             goto int_case;
2833         case TARGET_SO_TIMESTAMP:
2834             optname = SO_TIMESTAMP;
2835             goto int_case;
2836         case TARGET_SO_RCVLOWAT:
2837             optname = SO_RCVLOWAT;
2838             goto int_case;
2839         case TARGET_SO_ACCEPTCONN:
2840             optname = SO_ACCEPTCONN;
2841             goto int_case;
2842         case TARGET_SO_PROTOCOL:
2843             optname = SO_PROTOCOL;
2844             goto int_case;
2845         case TARGET_SO_DOMAIN:
2846             optname = SO_DOMAIN;
2847             goto int_case;
2848         default:
2849             goto int_case;
2850         }
2851         break;
2852     case SOL_TCP:
2853     case SOL_UDP:
2854         /* TCP and UDP options all take an 'int' value.  */
2855     int_case:
2856         if (get_user_u32(len, optlen))
2857             return -TARGET_EFAULT;
2858         if (len < 0)
2859             return -TARGET_EINVAL;
2860         lv = sizeof(lv);
2861         ret = get_errno(getsockopt(sockfd, level, optname, &val, &lv));
2862         if (ret < 0)
2863             return ret;
2864         if (optname == SO_TYPE) {
2865             val = host_to_target_sock_type(val);
2866         }
2867         if (len > lv)
2868             len = lv;
2869         if (len == 4) {
2870             if (put_user_u32(val, optval_addr))
2871                 return -TARGET_EFAULT;
2872         } else {
2873             if (put_user_u8(val, optval_addr))
2874                 return -TARGET_EFAULT;
2875         }
2876         if (put_user_u32(len, optlen))
2877             return -TARGET_EFAULT;
2878         break;
2879     case SOL_IP:
2880         switch(optname) {
2881         case IP_TOS:
2882         case IP_TTL:
2883         case IP_HDRINCL:
2884         case IP_ROUTER_ALERT:
2885         case IP_RECVOPTS:
2886         case IP_RETOPTS:
2887         case IP_PKTINFO:
2888         case IP_MTU_DISCOVER:
2889         case IP_RECVERR:
2890         case IP_RECVTOS:
2891 #ifdef IP_FREEBIND
2892         case IP_FREEBIND:
2893 #endif
2894         case IP_MULTICAST_TTL:
2895         case IP_MULTICAST_LOOP:
2896             if (get_user_u32(len, optlen))
2897                 return -TARGET_EFAULT;
2898             if (len < 0)
2899                 return -TARGET_EINVAL;
2900             lv = sizeof(lv);
2901             ret = get_errno(getsockopt(sockfd, level, optname, &val, &lv));
2902             if (ret < 0)
2903                 return ret;
2904             if (len < sizeof(int) && len > 0 && val >= 0 && val < 255) {
2905                 len = 1;
2906                 if (put_user_u32(len, optlen)
2907                     || put_user_u8(val, optval_addr))
2908                     return -TARGET_EFAULT;
2909             } else {
2910                 if (len > sizeof(int))
2911                     len = sizeof(int);
2912                 if (put_user_u32(len, optlen)
2913                     || put_user_u32(val, optval_addr))
2914                     return -TARGET_EFAULT;
2915             }
2916             break;
2917         default:
2918             ret = -TARGET_ENOPROTOOPT;
2919             break;
2920         }
2921         break;
2922     case SOL_IPV6:
2923         switch (optname) {
2924         case IPV6_MTU_DISCOVER:
2925         case IPV6_MTU:
2926         case IPV6_V6ONLY:
2927         case IPV6_RECVPKTINFO:
2928         case IPV6_UNICAST_HOPS:
2929         case IPV6_MULTICAST_HOPS:
2930         case IPV6_MULTICAST_LOOP:
2931         case IPV6_RECVERR:
2932         case IPV6_RECVHOPLIMIT:
2933         case IPV6_2292HOPLIMIT:
2934         case IPV6_CHECKSUM:
2935         case IPV6_ADDRFORM:
2936         case IPV6_2292PKTINFO:
2937         case IPV6_RECVTCLASS:
2938         case IPV6_RECVRTHDR:
2939         case IPV6_2292RTHDR:
2940         case IPV6_RECVHOPOPTS:
2941         case IPV6_2292HOPOPTS:
2942         case IPV6_RECVDSTOPTS:
2943         case IPV6_2292DSTOPTS:
2944         case IPV6_TCLASS:
2945         case IPV6_ADDR_PREFERENCES:
2946 #ifdef IPV6_RECVPATHMTU
2947         case IPV6_RECVPATHMTU:
2948 #endif
2949 #ifdef IPV6_TRANSPARENT
2950         case IPV6_TRANSPARENT:
2951 #endif
2952 #ifdef IPV6_FREEBIND
2953         case IPV6_FREEBIND:
2954 #endif
2955 #ifdef IPV6_RECVORIGDSTADDR
2956         case IPV6_RECVORIGDSTADDR:
2957 #endif
2958             if (get_user_u32(len, optlen))
2959                 return -TARGET_EFAULT;
2960             if (len < 0)
2961                 return -TARGET_EINVAL;
2962             lv = sizeof(lv);
2963             ret = get_errno(getsockopt(sockfd, level, optname, &val, &lv));
2964             if (ret < 0)
2965                 return ret;
2966             if (len < sizeof(int) && len > 0 && val >= 0 && val < 255) {
2967                 len = 1;
2968                 if (put_user_u32(len, optlen)
2969                     || put_user_u8(val, optval_addr))
2970                     return -TARGET_EFAULT;
2971             } else {
2972                 if (len > sizeof(int))
2973                     len = sizeof(int);
2974                 if (put_user_u32(len, optlen)
2975                     || put_user_u32(val, optval_addr))
2976                     return -TARGET_EFAULT;
2977             }
2978             break;
2979         default:
2980             ret = -TARGET_ENOPROTOOPT;
2981             break;
2982         }
2983         break;
2984 #ifdef SOL_NETLINK
2985     case SOL_NETLINK:
2986         switch (optname) {
2987         case NETLINK_PKTINFO:
2988         case NETLINK_BROADCAST_ERROR:
2989         case NETLINK_NO_ENOBUFS:
2990 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 2, 0)
2991         case NETLINK_LISTEN_ALL_NSID:
2992         case NETLINK_CAP_ACK:
2993 #endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 2, 0) */
2994 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 12, 0)
2995         case NETLINK_EXT_ACK:
2996 #endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 12, 0) */
2997 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 20, 0)
2998         case NETLINK_GET_STRICT_CHK:
2999 #endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 12, 0) */
3000             if (get_user_u32(len, optlen)) {
3001                 return -TARGET_EFAULT;
3002             }
3003             if (len != sizeof(val)) {
3004                 return -TARGET_EINVAL;
3005             }
3006             lv = len;
3007             ret = get_errno(getsockopt(sockfd, level, optname, &val, &lv));
3008             if (ret < 0) {
3009                 return ret;
3010             }
3011             if (put_user_u32(lv, optlen)
3012                 || put_user_u32(val, optval_addr)) {
3013                 return -TARGET_EFAULT;
3014             }
3015             break;
3016 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 2, 0)
3017         case NETLINK_LIST_MEMBERSHIPS:
3018         {
3019             uint32_t *results;
3020             int i;
3021             if (get_user_u32(len, optlen)) {
3022                 return -TARGET_EFAULT;
3023             }
3024             if (len < 0) {
3025                 return -TARGET_EINVAL;
3026             }
3027             results = lock_user(VERIFY_WRITE, optval_addr, len, 1);
3028             if (!results && len > 0) {
3029                 return -TARGET_EFAULT;
3030             }
3031             lv = len;
3032             ret = get_errno(getsockopt(sockfd, level, optname, results, &lv));
3033             if (ret < 0) {
3034                 unlock_user(results, optval_addr, 0);
3035                 return ret;
3036             }
3037             /* swap host endianess to target endianess. */
3038             for (i = 0; i < (len / sizeof(uint32_t)); i++) {
3039                 results[i] = tswap32(results[i]);
3040             }
3041             if (put_user_u32(lv, optlen)) {
3042                 return -TARGET_EFAULT;
3043             }
3044             unlock_user(results, optval_addr, 0);
3045             break;
3046         }
3047 #endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(4, 2, 0) */
3048         default:
3049             goto unimplemented;
3050         }
3051         break;
3052 #endif /* SOL_NETLINK */
3053     default:
3054     unimplemented:
3055         qemu_log_mask(LOG_UNIMP,
3056                       "getsockopt level=%d optname=%d not yet supported\n",
3057                       level, optname);
3058         ret = -TARGET_EOPNOTSUPP;
3059         break;
3060     }
3061     return ret;
3062 }
3063 
3064 /* Convert target low/high pair representing file offset into the host
3065  * low/high pair. This function doesn't handle offsets bigger than 64 bits
3066  * as the kernel doesn't handle them either.
3067  */
3068 static void target_to_host_low_high(abi_ulong tlow,
3069                                     abi_ulong thigh,
3070                                     unsigned long *hlow,
3071                                     unsigned long *hhigh)
3072 {
3073     uint64_t off = tlow |
3074         ((unsigned long long)thigh << TARGET_LONG_BITS / 2) <<
3075         TARGET_LONG_BITS / 2;
3076 
3077     *hlow = off;
3078     *hhigh = (off >> HOST_LONG_BITS / 2) >> HOST_LONG_BITS / 2;
3079 }
3080 
3081 static struct iovec *lock_iovec(int type, abi_ulong target_addr,
3082                                 abi_ulong count, int copy)
3083 {
3084     struct target_iovec *target_vec;
3085     struct iovec *vec;
3086     abi_ulong total_len, max_len;
3087     int i;
3088     int err = 0;
3089     bool bad_address = false;
3090 
3091     if (count == 0) {
3092         errno = 0;
3093         return NULL;
3094     }
3095     if (count > IOV_MAX) {
3096         errno = EINVAL;
3097         return NULL;
3098     }
3099 
3100     vec = g_try_new0(struct iovec, count);
3101     if (vec == NULL) {
3102         errno = ENOMEM;
3103         return NULL;
3104     }
3105 
3106     target_vec = lock_user(VERIFY_READ, target_addr,
3107                            count * sizeof(struct target_iovec), 1);
3108     if (target_vec == NULL) {
3109         err = EFAULT;
3110         goto fail2;
3111     }
3112 
3113     /* ??? If host page size > target page size, this will result in a
3114        value larger than what we can actually support.  */
3115     max_len = 0x7fffffff & TARGET_PAGE_MASK;
3116     total_len = 0;
3117 
3118     for (i = 0; i < count; i++) {
3119         abi_ulong base = tswapal(target_vec[i].iov_base);
3120         abi_long len = tswapal(target_vec[i].iov_len);
3121 
3122         if (len < 0) {
3123             err = EINVAL;
3124             goto fail;
3125         } else if (len == 0) {
3126             /* Zero length pointer is ignored.  */
3127             vec[i].iov_base = 0;
3128         } else {
3129             vec[i].iov_base = lock_user(type, base, len, copy);
3130             /* If the first buffer pointer is bad, this is a fault.  But
3131              * subsequent bad buffers will result in a partial write; this
3132              * is realized by filling the vector with null pointers and
3133              * zero lengths. */
3134             if (!vec[i].iov_base) {
3135                 if (i == 0) {
3136                     err = EFAULT;
3137                     goto fail;
3138                 } else {
3139                     bad_address = true;
3140                 }
3141             }
3142             if (bad_address) {
3143                 len = 0;
3144             }
3145             if (len > max_len - total_len) {
3146                 len = max_len - total_len;
3147             }
3148         }
3149         vec[i].iov_len = len;
3150         total_len += len;
3151     }
3152 
3153     unlock_user(target_vec, target_addr, 0);
3154     return vec;
3155 
3156  fail:
3157     while (--i >= 0) {
3158         if (tswapal(target_vec[i].iov_len) > 0) {
3159             unlock_user(vec[i].iov_base, tswapal(target_vec[i].iov_base), 0);
3160         }
3161     }
3162     unlock_user(target_vec, target_addr, 0);
3163  fail2:
3164     g_free(vec);
3165     errno = err;
3166     return NULL;
3167 }
3168 
3169 static void unlock_iovec(struct iovec *vec, abi_ulong target_addr,
3170                          abi_ulong count, int copy)
3171 {
3172     struct target_iovec *target_vec;
3173     int i;
3174 
3175     target_vec = lock_user(VERIFY_READ, target_addr,
3176                            count * sizeof(struct target_iovec), 1);
3177     if (target_vec) {
3178         for (i = 0; i < count; i++) {
3179             abi_ulong base = tswapal(target_vec[i].iov_base);
3180             abi_long len = tswapal(target_vec[i].iov_len);
3181             if (len < 0) {
3182                 break;
3183             }
3184             unlock_user(vec[i].iov_base, base, copy ? vec[i].iov_len : 0);
3185         }
3186         unlock_user(target_vec, target_addr, 0);
3187     }
3188 
3189     g_free(vec);
3190 }
3191 
3192 static inline int target_to_host_sock_type(int *type)
3193 {
3194     int host_type = 0;
3195     int target_type = *type;
3196 
3197     switch (target_type & TARGET_SOCK_TYPE_MASK) {
3198     case TARGET_SOCK_DGRAM:
3199         host_type = SOCK_DGRAM;
3200         break;
3201     case TARGET_SOCK_STREAM:
3202         host_type = SOCK_STREAM;
3203         break;
3204     default:
3205         host_type = target_type & TARGET_SOCK_TYPE_MASK;
3206         break;
3207     }
3208     if (target_type & TARGET_SOCK_CLOEXEC) {
3209 #if defined(SOCK_CLOEXEC)
3210         host_type |= SOCK_CLOEXEC;
3211 #else
3212         return -TARGET_EINVAL;
3213 #endif
3214     }
3215     if (target_type & TARGET_SOCK_NONBLOCK) {
3216 #if defined(SOCK_NONBLOCK)
3217         host_type |= SOCK_NONBLOCK;
3218 #elif !defined(O_NONBLOCK)
3219         return -TARGET_EINVAL;
3220 #endif
3221     }
3222     *type = host_type;
3223     return 0;
3224 }
3225 
3226 /* Try to emulate socket type flags after socket creation.  */
3227 static int sock_flags_fixup(int fd, int target_type)
3228 {
3229 #if !defined(SOCK_NONBLOCK) && defined(O_NONBLOCK)
3230     if (target_type & TARGET_SOCK_NONBLOCK) {
3231         int flags = fcntl(fd, F_GETFL);
3232         if (fcntl(fd, F_SETFL, O_NONBLOCK | flags) == -1) {
3233             close(fd);
3234             return -TARGET_EINVAL;
3235         }
3236     }
3237 #endif
3238     return fd;
3239 }
3240 
3241 /* do_socket() Must return target values and target errnos. */
3242 static abi_long do_socket(int domain, int type, int protocol)
3243 {
3244     int target_type = type;
3245     int ret;
3246 
3247     ret = target_to_host_sock_type(&type);
3248     if (ret) {
3249         return ret;
3250     }
3251 
3252     if (domain == PF_NETLINK && !(
3253 #ifdef CONFIG_RTNETLINK
3254          protocol == NETLINK_ROUTE ||
3255 #endif
3256          protocol == NETLINK_KOBJECT_UEVENT ||
3257          protocol == NETLINK_AUDIT)) {
3258         return -TARGET_EPROTONOSUPPORT;
3259     }
3260 
3261     if (domain == AF_PACKET ||
3262         (domain == AF_INET && type == SOCK_PACKET)) {
3263         protocol = tswap16(protocol);
3264     }
3265 
3266     ret = get_errno(socket(domain, type, protocol));
3267     if (ret >= 0) {
3268         ret = sock_flags_fixup(ret, target_type);
3269         if (type == SOCK_PACKET) {
3270             /* Manage an obsolete case :
3271              * if socket type is SOCK_PACKET, bind by name
3272              */
3273             fd_trans_register(ret, &target_packet_trans);
3274         } else if (domain == PF_NETLINK) {
3275             switch (protocol) {
3276 #ifdef CONFIG_RTNETLINK
3277             case NETLINK_ROUTE:
3278                 fd_trans_register(ret, &target_netlink_route_trans);
3279                 break;
3280 #endif
3281             case NETLINK_KOBJECT_UEVENT:
3282                 /* nothing to do: messages are strings */
3283                 break;
3284             case NETLINK_AUDIT:
3285                 fd_trans_register(ret, &target_netlink_audit_trans);
3286                 break;
3287             default:
3288                 g_assert_not_reached();
3289             }
3290         }
3291     }
3292     return ret;
3293 }
3294 
3295 /* do_bind() Must return target values and target errnos. */
3296 static abi_long do_bind(int sockfd, abi_ulong target_addr,
3297                         socklen_t addrlen)
3298 {
3299     void *addr;
3300     abi_long ret;
3301 
3302     if ((int)addrlen < 0) {
3303         return -TARGET_EINVAL;
3304     }
3305 
3306     addr = alloca(addrlen+1);
3307 
3308     ret = target_to_host_sockaddr(sockfd, addr, target_addr, addrlen);
3309     if (ret)
3310         return ret;
3311 
3312     return get_errno(bind(sockfd, addr, addrlen));
3313 }
3314 
3315 /* do_connect() Must return target values and target errnos. */
3316 static abi_long do_connect(int sockfd, abi_ulong target_addr,
3317                            socklen_t addrlen)
3318 {
3319     void *addr;
3320     abi_long ret;
3321 
3322     if ((int)addrlen < 0) {
3323         return -TARGET_EINVAL;
3324     }
3325 
3326     addr = alloca(addrlen+1);
3327 
3328     ret = target_to_host_sockaddr(sockfd, addr, target_addr, addrlen);
3329     if (ret)
3330         return ret;
3331 
3332     return get_errno(safe_connect(sockfd, addr, addrlen));
3333 }
3334 
3335 /* do_sendrecvmsg_locked() Must return target values and target errnos. */
3336 static abi_long do_sendrecvmsg_locked(int fd, struct target_msghdr *msgp,
3337                                       int flags, int send)
3338 {
3339     abi_long ret, len;
3340     struct msghdr msg;
3341     abi_ulong count;
3342     struct iovec *vec;
3343     abi_ulong target_vec;
3344 
3345     if (msgp->msg_name) {
3346         msg.msg_namelen = tswap32(msgp->msg_namelen);
3347         msg.msg_name = alloca(msg.msg_namelen+1);
3348         ret = target_to_host_sockaddr(fd, msg.msg_name,
3349                                       tswapal(msgp->msg_name),
3350                                       msg.msg_namelen);
3351         if (ret == -TARGET_EFAULT) {
3352             /* For connected sockets msg_name and msg_namelen must
3353              * be ignored, so returning EFAULT immediately is wrong.
3354              * Instead, pass a bad msg_name to the host kernel, and
3355              * let it decide whether to return EFAULT or not.
3356              */
3357             msg.msg_name = (void *)-1;
3358         } else if (ret) {
3359             goto out2;
3360         }
3361     } else {
3362         msg.msg_name = NULL;
3363         msg.msg_namelen = 0;
3364     }
3365     msg.msg_controllen = 2 * tswapal(msgp->msg_controllen);
3366     msg.msg_control = alloca(msg.msg_controllen);
3367     memset(msg.msg_control, 0, msg.msg_controllen);
3368 
3369     msg.msg_flags = tswap32(msgp->msg_flags);
3370 
3371     count = tswapal(msgp->msg_iovlen);
3372     target_vec = tswapal(msgp->msg_iov);
3373 
3374     if (count > IOV_MAX) {
3375         /* sendrcvmsg returns a different errno for this condition than
3376          * readv/writev, so we must catch it here before lock_iovec() does.
3377          */
3378         ret = -TARGET_EMSGSIZE;
3379         goto out2;
3380     }
3381 
3382     vec = lock_iovec(send ? VERIFY_READ : VERIFY_WRITE,
3383                      target_vec, count, send);
3384     if (vec == NULL) {
3385         ret = -host_to_target_errno(errno);
3386         goto out2;
3387     }
3388     msg.msg_iovlen = count;
3389     msg.msg_iov = vec;
3390 
3391     if (send) {
3392         if (fd_trans_target_to_host_data(fd)) {
3393             void *host_msg;
3394 
3395             host_msg = g_malloc(msg.msg_iov->iov_len);
3396             memcpy(host_msg, msg.msg_iov->iov_base, msg.msg_iov->iov_len);
3397             ret = fd_trans_target_to_host_data(fd)(host_msg,
3398                                                    msg.msg_iov->iov_len);
3399             if (ret >= 0) {
3400                 msg.msg_iov->iov_base = host_msg;
3401                 ret = get_errno(safe_sendmsg(fd, &msg, flags));
3402             }
3403             g_free(host_msg);
3404         } else {
3405             ret = target_to_host_cmsg(&msg, msgp);
3406             if (ret == 0) {
3407                 ret = get_errno(safe_sendmsg(fd, &msg, flags));
3408             }
3409         }
3410     } else {
3411         ret = get_errno(safe_recvmsg(fd, &msg, flags));
3412         if (!is_error(ret)) {
3413             len = ret;
3414             if (fd_trans_host_to_target_data(fd)) {
3415                 ret = fd_trans_host_to_target_data(fd)(msg.msg_iov->iov_base,
3416                                                MIN(msg.msg_iov->iov_len, len));
3417             } else {
3418                 ret = host_to_target_cmsg(msgp, &msg);
3419             }
3420             if (!is_error(ret)) {
3421                 msgp->msg_namelen = tswap32(msg.msg_namelen);
3422                 msgp->msg_flags = tswap32(msg.msg_flags);
3423                 if (msg.msg_name != NULL && msg.msg_name != (void *)-1) {
3424                     ret = host_to_target_sockaddr(tswapal(msgp->msg_name),
3425                                     msg.msg_name, msg.msg_namelen);
3426                     if (ret) {
3427                         goto out;
3428                     }
3429                 }
3430 
3431                 ret = len;
3432             }
3433         }
3434     }
3435 
3436 out:
3437     unlock_iovec(vec, target_vec, count, !send);
3438 out2:
3439     return ret;
3440 }
3441 
3442 static abi_long do_sendrecvmsg(int fd, abi_ulong target_msg,
3443                                int flags, int send)
3444 {
3445     abi_long ret;
3446     struct target_msghdr *msgp;
3447 
3448     if (!lock_user_struct(send ? VERIFY_READ : VERIFY_WRITE,
3449                           msgp,
3450                           target_msg,
3451                           send ? 1 : 0)) {
3452         return -TARGET_EFAULT;
3453     }
3454     ret = do_sendrecvmsg_locked(fd, msgp, flags, send);
3455     unlock_user_struct(msgp, target_msg, send ? 0 : 1);
3456     return ret;
3457 }
3458 
3459 /* We don't rely on the C library to have sendmmsg/recvmmsg support,
3460  * so it might not have this *mmsg-specific flag either.
3461  */
3462 #ifndef MSG_WAITFORONE
3463 #define MSG_WAITFORONE 0x10000
3464 #endif
3465 
3466 static abi_long do_sendrecvmmsg(int fd, abi_ulong target_msgvec,
3467                                 unsigned int vlen, unsigned int flags,
3468                                 int send)
3469 {
3470     struct target_mmsghdr *mmsgp;
3471     abi_long ret = 0;
3472     int i;
3473 
3474     if (vlen > UIO_MAXIOV) {
3475         vlen = UIO_MAXIOV;
3476     }
3477 
3478     mmsgp = lock_user(VERIFY_WRITE, target_msgvec, sizeof(*mmsgp) * vlen, 1);
3479     if (!mmsgp) {
3480         return -TARGET_EFAULT;
3481     }
3482 
3483     for (i = 0; i < vlen; i++) {
3484         ret = do_sendrecvmsg_locked(fd, &mmsgp[i].msg_hdr, flags, send);
3485         if (is_error(ret)) {
3486             break;
3487         }
3488         mmsgp[i].msg_len = tswap32(ret);
3489         /* MSG_WAITFORONE turns on MSG_DONTWAIT after one packet */
3490         if (flags & MSG_WAITFORONE) {
3491             flags |= MSG_DONTWAIT;
3492         }
3493     }
3494 
3495     unlock_user(mmsgp, target_msgvec, sizeof(*mmsgp) * i);
3496 
3497     /* Return number of datagrams sent if we sent any at all;
3498      * otherwise return the error.
3499      */
3500     if (i) {
3501         return i;
3502     }
3503     return ret;
3504 }
3505 
3506 /* do_accept4() Must return target values and target errnos. */
3507 static abi_long do_accept4(int fd, abi_ulong target_addr,
3508                            abi_ulong target_addrlen_addr, int flags)
3509 {
3510     socklen_t addrlen, ret_addrlen;
3511     void *addr;
3512     abi_long ret;
3513     int host_flags;
3514 
3515     host_flags = target_to_host_bitmask(flags, fcntl_flags_tbl);
3516 
3517     if (target_addr == 0) {
3518         return get_errno(safe_accept4(fd, NULL, NULL, host_flags));
3519     }
3520 
3521     /* linux returns EFAULT if addrlen pointer is invalid */
3522     if (get_user_u32(addrlen, target_addrlen_addr))
3523         return -TARGET_EFAULT;
3524 
3525     if ((int)addrlen < 0) {
3526         return -TARGET_EINVAL;
3527     }
3528 
3529     if (!access_ok(thread_cpu, VERIFY_WRITE, target_addr, addrlen)) {
3530         return -TARGET_EFAULT;
3531     }
3532 
3533     addr = alloca(addrlen);
3534 
3535     ret_addrlen = addrlen;
3536     ret = get_errno(safe_accept4(fd, addr, &ret_addrlen, host_flags));
3537     if (!is_error(ret)) {
3538         host_to_target_sockaddr(target_addr, addr, MIN(addrlen, ret_addrlen));
3539         if (put_user_u32(ret_addrlen, target_addrlen_addr)) {
3540             ret = -TARGET_EFAULT;
3541         }
3542     }
3543     return ret;
3544 }
3545 
3546 /* do_getpeername() Must return target values and target errnos. */
3547 static abi_long do_getpeername(int fd, abi_ulong target_addr,
3548                                abi_ulong target_addrlen_addr)
3549 {
3550     socklen_t addrlen, ret_addrlen;
3551     void *addr;
3552     abi_long ret;
3553 
3554     if (get_user_u32(addrlen, target_addrlen_addr))
3555         return -TARGET_EFAULT;
3556 
3557     if ((int)addrlen < 0) {
3558         return -TARGET_EINVAL;
3559     }
3560 
3561     if (!access_ok(thread_cpu, VERIFY_WRITE, target_addr, addrlen)) {
3562         return -TARGET_EFAULT;
3563     }
3564 
3565     addr = alloca(addrlen);
3566 
3567     ret_addrlen = addrlen;
3568     ret = get_errno(getpeername(fd, addr, &ret_addrlen));
3569     if (!is_error(ret)) {
3570         host_to_target_sockaddr(target_addr, addr, MIN(addrlen, ret_addrlen));
3571         if (put_user_u32(ret_addrlen, target_addrlen_addr)) {
3572             ret = -TARGET_EFAULT;
3573         }
3574     }
3575     return ret;
3576 }
3577 
3578 /* do_getsockname() Must return target values and target errnos. */
3579 static abi_long do_getsockname(int fd, abi_ulong target_addr,
3580                                abi_ulong target_addrlen_addr)
3581 {
3582     socklen_t addrlen, ret_addrlen;
3583     void *addr;
3584     abi_long ret;
3585 
3586     if (get_user_u32(addrlen, target_addrlen_addr))
3587         return -TARGET_EFAULT;
3588 
3589     if ((int)addrlen < 0) {
3590         return -TARGET_EINVAL;
3591     }
3592 
3593     if (!access_ok(thread_cpu, VERIFY_WRITE, target_addr, addrlen)) {
3594         return -TARGET_EFAULT;
3595     }
3596 
3597     addr = alloca(addrlen);
3598 
3599     ret_addrlen = addrlen;
3600     ret = get_errno(getsockname(fd, addr, &ret_addrlen));
3601     if (!is_error(ret)) {
3602         host_to_target_sockaddr(target_addr, addr, MIN(addrlen, ret_addrlen));
3603         if (put_user_u32(ret_addrlen, target_addrlen_addr)) {
3604             ret = -TARGET_EFAULT;
3605         }
3606     }
3607     return ret;
3608 }
3609 
3610 /* do_socketpair() Must return target values and target errnos. */
3611 static abi_long do_socketpair(int domain, int type, int protocol,
3612                               abi_ulong target_tab_addr)
3613 {
3614     int tab[2];
3615     abi_long ret;
3616 
3617     target_to_host_sock_type(&type);
3618 
3619     ret = get_errno(socketpair(domain, type, protocol, tab));
3620     if (!is_error(ret)) {
3621         if (put_user_s32(tab[0], target_tab_addr)
3622             || put_user_s32(tab[1], target_tab_addr + sizeof(tab[0])))
3623             ret = -TARGET_EFAULT;
3624     }
3625     return ret;
3626 }
3627 
3628 /* do_sendto() Must return target values and target errnos. */
3629 static abi_long do_sendto(int fd, abi_ulong msg, size_t len, int flags,
3630                           abi_ulong target_addr, socklen_t addrlen)
3631 {
3632     void *addr;
3633     void *host_msg;
3634     void *copy_msg = NULL;
3635     abi_long ret;
3636 
3637     if ((int)addrlen < 0) {
3638         return -TARGET_EINVAL;
3639     }
3640 
3641     host_msg = lock_user(VERIFY_READ, msg, len, 1);
3642     if (!host_msg)
3643         return -TARGET_EFAULT;
3644     if (fd_trans_target_to_host_data(fd)) {
3645         copy_msg = host_msg;
3646         host_msg = g_malloc(len);
3647         memcpy(host_msg, copy_msg, len);
3648         ret = fd_trans_target_to_host_data(fd)(host_msg, len);
3649         if (ret < 0) {
3650             goto fail;
3651         }
3652     }
3653     if (target_addr) {
3654         addr = alloca(addrlen+1);
3655         ret = target_to_host_sockaddr(fd, addr, target_addr, addrlen);
3656         if (ret) {
3657             goto fail;
3658         }
3659         ret = get_errno(safe_sendto(fd, host_msg, len, flags, addr, addrlen));
3660     } else {
3661         ret = get_errno(safe_sendto(fd, host_msg, len, flags, NULL, 0));
3662     }
3663 fail:
3664     if (copy_msg) {
3665         g_free(host_msg);
3666         host_msg = copy_msg;
3667     }
3668     unlock_user(host_msg, msg, 0);
3669     return ret;
3670 }
3671 
3672 /* do_recvfrom() Must return target values and target errnos. */
3673 static abi_long do_recvfrom(int fd, abi_ulong msg, size_t len, int flags,
3674                             abi_ulong target_addr,
3675                             abi_ulong target_addrlen)
3676 {
3677     socklen_t addrlen, ret_addrlen;
3678     void *addr;
3679     void *host_msg;
3680     abi_long ret;
3681 
3682     if (!msg) {
3683         host_msg = NULL;
3684     } else {
3685         host_msg = lock_user(VERIFY_WRITE, msg, len, 0);
3686         if (!host_msg) {
3687             return -TARGET_EFAULT;
3688         }
3689     }
3690     if (target_addr) {
3691         if (get_user_u32(addrlen, target_addrlen)) {
3692             ret = -TARGET_EFAULT;
3693             goto fail;
3694         }
3695         if ((int)addrlen < 0) {
3696             ret = -TARGET_EINVAL;
3697             goto fail;
3698         }
3699         addr = alloca(addrlen);
3700         ret_addrlen = addrlen;
3701         ret = get_errno(safe_recvfrom(fd, host_msg, len, flags,
3702                                       addr, &ret_addrlen));
3703     } else {
3704         addr = NULL; /* To keep compiler quiet.  */
3705         addrlen = 0; /* To keep compiler quiet.  */
3706         ret = get_errno(safe_recvfrom(fd, host_msg, len, flags, NULL, 0));
3707     }
3708     if (!is_error(ret)) {
3709         if (fd_trans_host_to_target_data(fd)) {
3710             abi_long trans;
3711             trans = fd_trans_host_to_target_data(fd)(host_msg, MIN(ret, len));
3712             if (is_error(trans)) {
3713                 ret = trans;
3714                 goto fail;
3715             }
3716         }
3717         if (target_addr) {
3718             host_to_target_sockaddr(target_addr, addr,
3719                                     MIN(addrlen, ret_addrlen));
3720             if (put_user_u32(ret_addrlen, target_addrlen)) {
3721                 ret = -TARGET_EFAULT;
3722                 goto fail;
3723             }
3724         }
3725         unlock_user(host_msg, msg, len);
3726     } else {
3727 fail:
3728         unlock_user(host_msg, msg, 0);
3729     }
3730     return ret;
3731 }
3732 
3733 #ifdef TARGET_NR_socketcall
3734 /* do_socketcall() must return target values and target errnos. */
3735 static abi_long do_socketcall(int num, abi_ulong vptr)
3736 {
3737     static const unsigned nargs[] = { /* number of arguments per operation */
3738         [TARGET_SYS_SOCKET] = 3,      /* domain, type, protocol */
3739         [TARGET_SYS_BIND] = 3,        /* fd, addr, addrlen */
3740         [TARGET_SYS_CONNECT] = 3,     /* fd, addr, addrlen */
3741         [TARGET_SYS_LISTEN] = 2,      /* fd, backlog */
3742         [TARGET_SYS_ACCEPT] = 3,      /* fd, addr, addrlen */
3743         [TARGET_SYS_GETSOCKNAME] = 3, /* fd, addr, addrlen */
3744         [TARGET_SYS_GETPEERNAME] = 3, /* fd, addr, addrlen */
3745         [TARGET_SYS_SOCKETPAIR] = 4,  /* domain, type, protocol, tab */
3746         [TARGET_SYS_SEND] = 4,        /* fd, msg, len, flags */
3747         [TARGET_SYS_RECV] = 4,        /* fd, msg, len, flags */
3748         [TARGET_SYS_SENDTO] = 6,      /* fd, msg, len, flags, addr, addrlen */
3749         [TARGET_SYS_RECVFROM] = 6,    /* fd, msg, len, flags, addr, addrlen */
3750         [TARGET_SYS_SHUTDOWN] = 2,    /* fd, how */
3751         [TARGET_SYS_SETSOCKOPT] = 5,  /* fd, level, optname, optval, optlen */
3752         [TARGET_SYS_GETSOCKOPT] = 5,  /* fd, level, optname, optval, optlen */
3753         [TARGET_SYS_SENDMSG] = 3,     /* fd, msg, flags */
3754         [TARGET_SYS_RECVMSG] = 3,     /* fd, msg, flags */
3755         [TARGET_SYS_ACCEPT4] = 4,     /* fd, addr, addrlen, flags */
3756         [TARGET_SYS_RECVMMSG] = 4,    /* fd, msgvec, vlen, flags */
3757         [TARGET_SYS_SENDMMSG] = 4,    /* fd, msgvec, vlen, flags */
3758     };
3759     abi_long a[6]; /* max 6 args */
3760     unsigned i;
3761 
3762     /* check the range of the first argument num */
3763     /* (TARGET_SYS_SENDMMSG is the highest among TARGET_SYS_xxx) */
3764     if (num < 1 || num > TARGET_SYS_SENDMMSG) {
3765         return -TARGET_EINVAL;
3766     }
3767     /* ensure we have space for args */
3768     if (nargs[num] > ARRAY_SIZE(a)) {
3769         return -TARGET_EINVAL;
3770     }
3771     /* collect the arguments in a[] according to nargs[] */
3772     for (i = 0; i < nargs[num]; ++i) {
3773         if (get_user_ual(a[i], vptr + i * sizeof(abi_long)) != 0) {
3774             return -TARGET_EFAULT;
3775         }
3776     }
3777     /* now when we have the args, invoke the appropriate underlying function */
3778     switch (num) {
3779     case TARGET_SYS_SOCKET: /* domain, type, protocol */
3780         return do_socket(a[0], a[1], a[2]);
3781     case TARGET_SYS_BIND: /* sockfd, addr, addrlen */
3782         return do_bind(a[0], a[1], a[2]);
3783     case TARGET_SYS_CONNECT: /* sockfd, addr, addrlen */
3784         return do_connect(a[0], a[1], a[2]);
3785     case TARGET_SYS_LISTEN: /* sockfd, backlog */
3786         return get_errno(listen(a[0], a[1]));
3787     case TARGET_SYS_ACCEPT: /* sockfd, addr, addrlen */
3788         return do_accept4(a[0], a[1], a[2], 0);
3789     case TARGET_SYS_GETSOCKNAME: /* sockfd, addr, addrlen */
3790         return do_getsockname(a[0], a[1], a[2]);
3791     case TARGET_SYS_GETPEERNAME: /* sockfd, addr, addrlen */
3792         return do_getpeername(a[0], a[1], a[2]);
3793     case TARGET_SYS_SOCKETPAIR: /* domain, type, protocol, tab */
3794         return do_socketpair(a[0], a[1], a[2], a[3]);
3795     case TARGET_SYS_SEND: /* sockfd, msg, len, flags */
3796         return do_sendto(a[0], a[1], a[2], a[3], 0, 0);
3797     case TARGET_SYS_RECV: /* sockfd, msg, len, flags */
3798         return do_recvfrom(a[0], a[1], a[2], a[3], 0, 0);
3799     case TARGET_SYS_SENDTO: /* sockfd, msg, len, flags, addr, addrlen */
3800         return do_sendto(a[0], a[1], a[2], a[3], a[4], a[5]);
3801     case TARGET_SYS_RECVFROM: /* sockfd, msg, len, flags, addr, addrlen */
3802         return do_recvfrom(a[0], a[1], a[2], a[3], a[4], a[5]);
3803     case TARGET_SYS_SHUTDOWN: /* sockfd, how */
3804         return get_errno(shutdown(a[0], a[1]));
3805     case TARGET_SYS_SETSOCKOPT: /* sockfd, level, optname, optval, optlen */
3806         return do_setsockopt(a[0], a[1], a[2], a[3], a[4]);
3807     case TARGET_SYS_GETSOCKOPT: /* sockfd, level, optname, optval, optlen */
3808         return do_getsockopt(a[0], a[1], a[2], a[3], a[4]);
3809     case TARGET_SYS_SENDMSG: /* sockfd, msg, flags */
3810         return do_sendrecvmsg(a[0], a[1], a[2], 1);
3811     case TARGET_SYS_RECVMSG: /* sockfd, msg, flags */
3812         return do_sendrecvmsg(a[0], a[1], a[2], 0);
3813     case TARGET_SYS_ACCEPT4: /* sockfd, addr, addrlen, flags */
3814         return do_accept4(a[0], a[1], a[2], a[3]);
3815     case TARGET_SYS_RECVMMSG: /* sockfd, msgvec, vlen, flags */
3816         return do_sendrecvmmsg(a[0], a[1], a[2], a[3], 0);
3817     case TARGET_SYS_SENDMMSG: /* sockfd, msgvec, vlen, flags */
3818         return do_sendrecvmmsg(a[0], a[1], a[2], a[3], 1);
3819     default:
3820         qemu_log_mask(LOG_UNIMP, "Unsupported socketcall: %d\n", num);
3821         return -TARGET_EINVAL;
3822     }
3823 }
3824 #endif
3825 
3826 #define N_SHM_REGIONS	32
3827 
3828 static struct shm_region {
3829     abi_ulong start;
3830     abi_ulong size;
3831     bool in_use;
3832 } shm_regions[N_SHM_REGIONS];
3833 
3834 #ifndef TARGET_SEMID64_DS
3835 /* asm-generic version of this struct */
3836 struct target_semid64_ds
3837 {
3838   struct target_ipc_perm sem_perm;
3839   abi_ulong sem_otime;
3840 #if TARGET_ABI_BITS == 32
3841   abi_ulong __unused1;
3842 #endif
3843   abi_ulong sem_ctime;
3844 #if TARGET_ABI_BITS == 32
3845   abi_ulong __unused2;
3846 #endif
3847   abi_ulong sem_nsems;
3848   abi_ulong __unused3;
3849   abi_ulong __unused4;
3850 };
3851 #endif
3852 
3853 static inline abi_long target_to_host_ipc_perm(struct ipc_perm *host_ip,
3854                                                abi_ulong target_addr)
3855 {
3856     struct target_ipc_perm *target_ip;
3857     struct target_semid64_ds *target_sd;
3858 
3859     if (!lock_user_struct(VERIFY_READ, target_sd, target_addr, 1))
3860         return -TARGET_EFAULT;
3861     target_ip = &(target_sd->sem_perm);
3862     host_ip->__key = tswap32(target_ip->__key);
3863     host_ip->uid = tswap32(target_ip->uid);
3864     host_ip->gid = tswap32(target_ip->gid);
3865     host_ip->cuid = tswap32(target_ip->cuid);
3866     host_ip->cgid = tswap32(target_ip->cgid);
3867 #if defined(TARGET_ALPHA) || defined(TARGET_MIPS) || defined(TARGET_PPC)
3868     host_ip->mode = tswap32(target_ip->mode);
3869 #else
3870     host_ip->mode = tswap16(target_ip->mode);
3871 #endif
3872 #if defined(TARGET_PPC)
3873     host_ip->__seq = tswap32(target_ip->__seq);
3874 #else
3875     host_ip->__seq = tswap16(target_ip->__seq);
3876 #endif
3877     unlock_user_struct(target_sd, target_addr, 0);
3878     return 0;
3879 }
3880 
3881 static inline abi_long host_to_target_ipc_perm(abi_ulong target_addr,
3882                                                struct ipc_perm *host_ip)
3883 {
3884     struct target_ipc_perm *target_ip;
3885     struct target_semid64_ds *target_sd;
3886 
3887     if (!lock_user_struct(VERIFY_WRITE, target_sd, target_addr, 0))
3888         return -TARGET_EFAULT;
3889     target_ip = &(target_sd->sem_perm);
3890     target_ip->__key = tswap32(host_ip->__key);
3891     target_ip->uid = tswap32(host_ip->uid);
3892     target_ip->gid = tswap32(host_ip->gid);
3893     target_ip->cuid = tswap32(host_ip->cuid);
3894     target_ip->cgid = tswap32(host_ip->cgid);
3895 #if defined(TARGET_ALPHA) || defined(TARGET_MIPS) || defined(TARGET_PPC)
3896     target_ip->mode = tswap32(host_ip->mode);
3897 #else
3898     target_ip->mode = tswap16(host_ip->mode);
3899 #endif
3900 #if defined(TARGET_PPC)
3901     target_ip->__seq = tswap32(host_ip->__seq);
3902 #else
3903     target_ip->__seq = tswap16(host_ip->__seq);
3904 #endif
3905     unlock_user_struct(target_sd, target_addr, 1);
3906     return 0;
3907 }
3908 
3909 static inline abi_long target_to_host_semid_ds(struct semid_ds *host_sd,
3910                                                abi_ulong target_addr)
3911 {
3912     struct target_semid64_ds *target_sd;
3913 
3914     if (!lock_user_struct(VERIFY_READ, target_sd, target_addr, 1))
3915         return -TARGET_EFAULT;
3916     if (target_to_host_ipc_perm(&(host_sd->sem_perm),target_addr))
3917         return -TARGET_EFAULT;
3918     host_sd->sem_nsems = tswapal(target_sd->sem_nsems);
3919     host_sd->sem_otime = tswapal(target_sd->sem_otime);
3920     host_sd->sem_ctime = tswapal(target_sd->sem_ctime);
3921     unlock_user_struct(target_sd, target_addr, 0);
3922     return 0;
3923 }
3924 
3925 static inline abi_long host_to_target_semid_ds(abi_ulong target_addr,
3926                                                struct semid_ds *host_sd)
3927 {
3928     struct target_semid64_ds *target_sd;
3929 
3930     if (!lock_user_struct(VERIFY_WRITE, target_sd, target_addr, 0))
3931         return -TARGET_EFAULT;
3932     if (host_to_target_ipc_perm(target_addr,&(host_sd->sem_perm)))
3933         return -TARGET_EFAULT;
3934     target_sd->sem_nsems = tswapal(host_sd->sem_nsems);
3935     target_sd->sem_otime = tswapal(host_sd->sem_otime);
3936     target_sd->sem_ctime = tswapal(host_sd->sem_ctime);
3937     unlock_user_struct(target_sd, target_addr, 1);
3938     return 0;
3939 }
3940 
3941 struct target_seminfo {
3942     int semmap;
3943     int semmni;
3944     int semmns;
3945     int semmnu;
3946     int semmsl;
3947     int semopm;
3948     int semume;
3949     int semusz;
3950     int semvmx;
3951     int semaem;
3952 };
3953 
3954 static inline abi_long host_to_target_seminfo(abi_ulong target_addr,
3955                                               struct seminfo *host_seminfo)
3956 {
3957     struct target_seminfo *target_seminfo;
3958     if (!lock_user_struct(VERIFY_WRITE, target_seminfo, target_addr, 0))
3959         return -TARGET_EFAULT;
3960     __put_user(host_seminfo->semmap, &target_seminfo->semmap);
3961     __put_user(host_seminfo->semmni, &target_seminfo->semmni);
3962     __put_user(host_seminfo->semmns, &target_seminfo->semmns);
3963     __put_user(host_seminfo->semmnu, &target_seminfo->semmnu);
3964     __put_user(host_seminfo->semmsl, &target_seminfo->semmsl);
3965     __put_user(host_seminfo->semopm, &target_seminfo->semopm);
3966     __put_user(host_seminfo->semume, &target_seminfo->semume);
3967     __put_user(host_seminfo->semusz, &target_seminfo->semusz);
3968     __put_user(host_seminfo->semvmx, &target_seminfo->semvmx);
3969     __put_user(host_seminfo->semaem, &target_seminfo->semaem);
3970     unlock_user_struct(target_seminfo, target_addr, 1);
3971     return 0;
3972 }
3973 
3974 union semun {
3975 	int val;
3976 	struct semid_ds *buf;
3977 	unsigned short *array;
3978 	struct seminfo *__buf;
3979 };
3980 
3981 union target_semun {
3982 	int val;
3983 	abi_ulong buf;
3984 	abi_ulong array;
3985 	abi_ulong __buf;
3986 };
3987 
3988 static inline abi_long target_to_host_semarray(int semid, unsigned short **host_array,
3989                                                abi_ulong target_addr)
3990 {
3991     int nsems;
3992     unsigned short *array;
3993     union semun semun;
3994     struct semid_ds semid_ds;
3995     int i, ret;
3996 
3997     semun.buf = &semid_ds;
3998 
3999     ret = semctl(semid, 0, IPC_STAT, semun);
4000     if (ret == -1)
4001         return get_errno(ret);
4002 
4003     nsems = semid_ds.sem_nsems;
4004 
4005     *host_array = g_try_new(unsigned short, nsems);
4006     if (!*host_array) {
4007         return -TARGET_ENOMEM;
4008     }
4009     array = lock_user(VERIFY_READ, target_addr,
4010                       nsems*sizeof(unsigned short), 1);
4011     if (!array) {
4012         g_free(*host_array);
4013         return -TARGET_EFAULT;
4014     }
4015 
4016     for(i=0; i<nsems; i++) {
4017         __get_user((*host_array)[i], &array[i]);
4018     }
4019     unlock_user(array, target_addr, 0);
4020 
4021     return 0;
4022 }
4023 
4024 static inline abi_long host_to_target_semarray(int semid, abi_ulong target_addr,
4025                                                unsigned short **host_array)
4026 {
4027     int nsems;
4028     unsigned short *array;
4029     union semun semun;
4030     struct semid_ds semid_ds;
4031     int i, ret;
4032 
4033     semun.buf = &semid_ds;
4034 
4035     ret = semctl(semid, 0, IPC_STAT, semun);
4036     if (ret == -1)
4037         return get_errno(ret);
4038 
4039     nsems = semid_ds.sem_nsems;
4040 
4041     array = lock_user(VERIFY_WRITE, target_addr,
4042                       nsems*sizeof(unsigned short), 0);
4043     if (!array)
4044         return -TARGET_EFAULT;
4045 
4046     for(i=0; i<nsems; i++) {
4047         __put_user((*host_array)[i], &array[i]);
4048     }
4049     g_free(*host_array);
4050     unlock_user(array, target_addr, 1);
4051 
4052     return 0;
4053 }
4054 
4055 static inline abi_long do_semctl(int semid, int semnum, int cmd,
4056                                  abi_ulong target_arg)
4057 {
4058     union target_semun target_su = { .buf = target_arg };
4059     union semun arg;
4060     struct semid_ds dsarg;
4061     unsigned short *array = NULL;
4062     struct seminfo seminfo;
4063     abi_long ret = -TARGET_EINVAL;
4064     abi_long err;
4065     cmd &= 0xff;
4066 
4067     switch( cmd ) {
4068 	case GETVAL:
4069 	case SETVAL:
4070             /* In 64 bit cross-endian situations, we will erroneously pick up
4071              * the wrong half of the union for the "val" element.  To rectify
4072              * this, the entire 8-byte structure is byteswapped, followed by
4073 	     * a swap of the 4 byte val field. In other cases, the data is
4074 	     * already in proper host byte order. */
4075 	    if (sizeof(target_su.val) != (sizeof(target_su.buf))) {
4076 		target_su.buf = tswapal(target_su.buf);
4077 		arg.val = tswap32(target_su.val);
4078 	    } else {
4079 		arg.val = target_su.val;
4080 	    }
4081             ret = get_errno(semctl(semid, semnum, cmd, arg));
4082             break;
4083 	case GETALL:
4084 	case SETALL:
4085             err = target_to_host_semarray(semid, &array, target_su.array);
4086             if (err)
4087                 return err;
4088             arg.array = array;
4089             ret = get_errno(semctl(semid, semnum, cmd, arg));
4090             err = host_to_target_semarray(semid, target_su.array, &array);
4091             if (err)
4092                 return err;
4093             break;
4094 	case IPC_STAT:
4095 	case IPC_SET:
4096 	case SEM_STAT:
4097             err = target_to_host_semid_ds(&dsarg, target_su.buf);
4098             if (err)
4099                 return err;
4100             arg.buf = &dsarg;
4101             ret = get_errno(semctl(semid, semnum, cmd, arg));
4102             err = host_to_target_semid_ds(target_su.buf, &dsarg);
4103             if (err)
4104                 return err;
4105             break;
4106 	case IPC_INFO:
4107 	case SEM_INFO:
4108             arg.__buf = &seminfo;
4109             ret = get_errno(semctl(semid, semnum, cmd, arg));
4110             err = host_to_target_seminfo(target_su.__buf, &seminfo);
4111             if (err)
4112                 return err;
4113             break;
4114 	case IPC_RMID:
4115 	case GETPID:
4116 	case GETNCNT:
4117 	case GETZCNT:
4118             ret = get_errno(semctl(semid, semnum, cmd, NULL));
4119             break;
4120     }
4121 
4122     return ret;
4123 }
4124 
4125 struct target_sembuf {
4126     unsigned short sem_num;
4127     short sem_op;
4128     short sem_flg;
4129 };
4130 
4131 static inline abi_long target_to_host_sembuf(struct sembuf *host_sembuf,
4132                                              abi_ulong target_addr,
4133                                              unsigned nsops)
4134 {
4135     struct target_sembuf *target_sembuf;
4136     int i;
4137 
4138     target_sembuf = lock_user(VERIFY_READ, target_addr,
4139                               nsops*sizeof(struct target_sembuf), 1);
4140     if (!target_sembuf)
4141         return -TARGET_EFAULT;
4142 
4143     for(i=0; i<nsops; i++) {
4144         __get_user(host_sembuf[i].sem_num, &target_sembuf[i].sem_num);
4145         __get_user(host_sembuf[i].sem_op, &target_sembuf[i].sem_op);
4146         __get_user(host_sembuf[i].sem_flg, &target_sembuf[i].sem_flg);
4147     }
4148 
4149     unlock_user(target_sembuf, target_addr, 0);
4150 
4151     return 0;
4152 }
4153 
4154 #if defined(TARGET_NR_ipc) || defined(TARGET_NR_semop) || \
4155     defined(TARGET_NR_semtimedop) || defined(TARGET_NR_semtimedop_time64)
4156 
4157 /*
4158  * This macro is required to handle the s390 variants, which passes the
4159  * arguments in a different order than default.
4160  */
4161 #ifdef __s390x__
4162 #define SEMTIMEDOP_IPC_ARGS(__nsops, __sops, __timeout) \
4163   (__nsops), (__timeout), (__sops)
4164 #else
4165 #define SEMTIMEDOP_IPC_ARGS(__nsops, __sops, __timeout) \
4166   (__nsops), 0, (__sops), (__timeout)
4167 #endif
4168 
4169 static inline abi_long do_semtimedop(int semid,
4170                                      abi_long ptr,
4171                                      unsigned nsops,
4172                                      abi_long timeout, bool time64)
4173 {
4174     struct sembuf *sops;
4175     struct timespec ts, *pts = NULL;
4176     abi_long ret;
4177 
4178     if (timeout) {
4179         pts = &ts;
4180         if (time64) {
4181             if (target_to_host_timespec64(pts, timeout)) {
4182                 return -TARGET_EFAULT;
4183             }
4184         } else {
4185             if (target_to_host_timespec(pts, timeout)) {
4186                 return -TARGET_EFAULT;
4187             }
4188         }
4189     }
4190 
4191     if (nsops > TARGET_SEMOPM) {
4192         return -TARGET_E2BIG;
4193     }
4194 
4195     sops = g_new(struct sembuf, nsops);
4196 
4197     if (target_to_host_sembuf(sops, ptr, nsops)) {
4198         g_free(sops);
4199         return -TARGET_EFAULT;
4200     }
4201 
4202     ret = -TARGET_ENOSYS;
4203 #ifdef __NR_semtimedop
4204     ret = get_errno(safe_semtimedop(semid, sops, nsops, pts));
4205 #endif
4206 #ifdef __NR_ipc
4207     if (ret == -TARGET_ENOSYS) {
4208         ret = get_errno(safe_ipc(IPCOP_semtimedop, semid,
4209                                  SEMTIMEDOP_IPC_ARGS(nsops, sops, (long)pts)));
4210     }
4211 #endif
4212     g_free(sops);
4213     return ret;
4214 }
4215 #endif
4216 
4217 struct target_msqid_ds
4218 {
4219     struct target_ipc_perm msg_perm;
4220     abi_ulong msg_stime;
4221 #if TARGET_ABI_BITS == 32
4222     abi_ulong __unused1;
4223 #endif
4224     abi_ulong msg_rtime;
4225 #if TARGET_ABI_BITS == 32
4226     abi_ulong __unused2;
4227 #endif
4228     abi_ulong msg_ctime;
4229 #if TARGET_ABI_BITS == 32
4230     abi_ulong __unused3;
4231 #endif
4232     abi_ulong __msg_cbytes;
4233     abi_ulong msg_qnum;
4234     abi_ulong msg_qbytes;
4235     abi_ulong msg_lspid;
4236     abi_ulong msg_lrpid;
4237     abi_ulong __unused4;
4238     abi_ulong __unused5;
4239 };
4240 
4241 static inline abi_long target_to_host_msqid_ds(struct msqid_ds *host_md,
4242                                                abi_ulong target_addr)
4243 {
4244     struct target_msqid_ds *target_md;
4245 
4246     if (!lock_user_struct(VERIFY_READ, target_md, target_addr, 1))
4247         return -TARGET_EFAULT;
4248     if (target_to_host_ipc_perm(&(host_md->msg_perm),target_addr))
4249         return -TARGET_EFAULT;
4250     host_md->msg_stime = tswapal(target_md->msg_stime);
4251     host_md->msg_rtime = tswapal(target_md->msg_rtime);
4252     host_md->msg_ctime = tswapal(target_md->msg_ctime);
4253     host_md->__msg_cbytes = tswapal(target_md->__msg_cbytes);
4254     host_md->msg_qnum = tswapal(target_md->msg_qnum);
4255     host_md->msg_qbytes = tswapal(target_md->msg_qbytes);
4256     host_md->msg_lspid = tswapal(target_md->msg_lspid);
4257     host_md->msg_lrpid = tswapal(target_md->msg_lrpid);
4258     unlock_user_struct(target_md, target_addr, 0);
4259     return 0;
4260 }
4261 
4262 static inline abi_long host_to_target_msqid_ds(abi_ulong target_addr,
4263                                                struct msqid_ds *host_md)
4264 {
4265     struct target_msqid_ds *target_md;
4266 
4267     if (!lock_user_struct(VERIFY_WRITE, target_md, target_addr, 0))
4268         return -TARGET_EFAULT;
4269     if (host_to_target_ipc_perm(target_addr,&(host_md->msg_perm)))
4270         return -TARGET_EFAULT;
4271     target_md->msg_stime = tswapal(host_md->msg_stime);
4272     target_md->msg_rtime = tswapal(host_md->msg_rtime);
4273     target_md->msg_ctime = tswapal(host_md->msg_ctime);
4274     target_md->__msg_cbytes = tswapal(host_md->__msg_cbytes);
4275     target_md->msg_qnum = tswapal(host_md->msg_qnum);
4276     target_md->msg_qbytes = tswapal(host_md->msg_qbytes);
4277     target_md->msg_lspid = tswapal(host_md->msg_lspid);
4278     target_md->msg_lrpid = tswapal(host_md->msg_lrpid);
4279     unlock_user_struct(target_md, target_addr, 1);
4280     return 0;
4281 }
4282 
4283 struct target_msginfo {
4284     int msgpool;
4285     int msgmap;
4286     int msgmax;
4287     int msgmnb;
4288     int msgmni;
4289     int msgssz;
4290     int msgtql;
4291     unsigned short int msgseg;
4292 };
4293 
4294 static inline abi_long host_to_target_msginfo(abi_ulong target_addr,
4295                                               struct msginfo *host_msginfo)
4296 {
4297     struct target_msginfo *target_msginfo;
4298     if (!lock_user_struct(VERIFY_WRITE, target_msginfo, target_addr, 0))
4299         return -TARGET_EFAULT;
4300     __put_user(host_msginfo->msgpool, &target_msginfo->msgpool);
4301     __put_user(host_msginfo->msgmap, &target_msginfo->msgmap);
4302     __put_user(host_msginfo->msgmax, &target_msginfo->msgmax);
4303     __put_user(host_msginfo->msgmnb, &target_msginfo->msgmnb);
4304     __put_user(host_msginfo->msgmni, &target_msginfo->msgmni);
4305     __put_user(host_msginfo->msgssz, &target_msginfo->msgssz);
4306     __put_user(host_msginfo->msgtql, &target_msginfo->msgtql);
4307     __put_user(host_msginfo->msgseg, &target_msginfo->msgseg);
4308     unlock_user_struct(target_msginfo, target_addr, 1);
4309     return 0;
4310 }
4311 
4312 static inline abi_long do_msgctl(int msgid, int cmd, abi_long ptr)
4313 {
4314     struct msqid_ds dsarg;
4315     struct msginfo msginfo;
4316     abi_long ret = -TARGET_EINVAL;
4317 
4318     cmd &= 0xff;
4319 
4320     switch (cmd) {
4321     case IPC_STAT:
4322     case IPC_SET:
4323     case MSG_STAT:
4324         if (target_to_host_msqid_ds(&dsarg,ptr))
4325             return -TARGET_EFAULT;
4326         ret = get_errno(msgctl(msgid, cmd, &dsarg));
4327         if (host_to_target_msqid_ds(ptr,&dsarg))
4328             return -TARGET_EFAULT;
4329         break;
4330     case IPC_RMID:
4331         ret = get_errno(msgctl(msgid, cmd, NULL));
4332         break;
4333     case IPC_INFO:
4334     case MSG_INFO:
4335         ret = get_errno(msgctl(msgid, cmd, (struct msqid_ds *)&msginfo));
4336         if (host_to_target_msginfo(ptr, &msginfo))
4337             return -TARGET_EFAULT;
4338         break;
4339     }
4340 
4341     return ret;
4342 }
4343 
4344 struct target_msgbuf {
4345     abi_long mtype;
4346     char	mtext[1];
4347 };
4348 
4349 static inline abi_long do_msgsnd(int msqid, abi_long msgp,
4350                                  ssize_t msgsz, int msgflg)
4351 {
4352     struct target_msgbuf *target_mb;
4353     struct msgbuf *host_mb;
4354     abi_long ret = 0;
4355 
4356     if (msgsz < 0) {
4357         return -TARGET_EINVAL;
4358     }
4359 
4360     if (!lock_user_struct(VERIFY_READ, target_mb, msgp, 0))
4361         return -TARGET_EFAULT;
4362     host_mb = g_try_malloc(msgsz + sizeof(long));
4363     if (!host_mb) {
4364         unlock_user_struct(target_mb, msgp, 0);
4365         return -TARGET_ENOMEM;
4366     }
4367     host_mb->mtype = (abi_long) tswapal(target_mb->mtype);
4368     memcpy(host_mb->mtext, target_mb->mtext, msgsz);
4369     ret = -TARGET_ENOSYS;
4370 #ifdef __NR_msgsnd
4371     ret = get_errno(safe_msgsnd(msqid, host_mb, msgsz, msgflg));
4372 #endif
4373 #ifdef __NR_ipc
4374     if (ret == -TARGET_ENOSYS) {
4375 #ifdef __s390x__
4376         ret = get_errno(safe_ipc(IPCOP_msgsnd, msqid, msgsz, msgflg,
4377                                  host_mb));
4378 #else
4379         ret = get_errno(safe_ipc(IPCOP_msgsnd, msqid, msgsz, msgflg,
4380                                  host_mb, 0));
4381 #endif
4382     }
4383 #endif
4384     g_free(host_mb);
4385     unlock_user_struct(target_mb, msgp, 0);
4386 
4387     return ret;
4388 }
4389 
4390 #ifdef __NR_ipc
4391 #if defined(__sparc__)
4392 /* SPARC for msgrcv it does not use the kludge on final 2 arguments.  */
4393 #define MSGRCV_ARGS(__msgp, __msgtyp) __msgp, __msgtyp
4394 #elif defined(__s390x__)
4395 /* The s390 sys_ipc variant has only five parameters.  */
4396 #define MSGRCV_ARGS(__msgp, __msgtyp) \
4397     ((long int[]){(long int)__msgp, __msgtyp})
4398 #else
4399 #define MSGRCV_ARGS(__msgp, __msgtyp) \
4400     ((long int[]){(long int)__msgp, __msgtyp}), 0
4401 #endif
4402 #endif
4403 
4404 static inline abi_long do_msgrcv(int msqid, abi_long msgp,
4405                                  ssize_t msgsz, abi_long msgtyp,
4406                                  int msgflg)
4407 {
4408     struct target_msgbuf *target_mb;
4409     char *target_mtext;
4410     struct msgbuf *host_mb;
4411     abi_long ret = 0;
4412 
4413     if (msgsz < 0) {
4414         return -TARGET_EINVAL;
4415     }
4416 
4417     if (!lock_user_struct(VERIFY_WRITE, target_mb, msgp, 0))
4418         return -TARGET_EFAULT;
4419 
4420     host_mb = g_try_malloc(msgsz + sizeof(long));
4421     if (!host_mb) {
4422         ret = -TARGET_ENOMEM;
4423         goto end;
4424     }
4425     ret = -TARGET_ENOSYS;
4426 #ifdef __NR_msgrcv
4427     ret = get_errno(safe_msgrcv(msqid, host_mb, msgsz, msgtyp, msgflg));
4428 #endif
4429 #ifdef __NR_ipc
4430     if (ret == -TARGET_ENOSYS) {
4431         ret = get_errno(safe_ipc(IPCOP_CALL(1, IPCOP_msgrcv), msqid, msgsz,
4432                         msgflg, MSGRCV_ARGS(host_mb, msgtyp)));
4433     }
4434 #endif
4435 
4436     if (ret > 0) {
4437         abi_ulong target_mtext_addr = msgp + sizeof(abi_ulong);
4438         target_mtext = lock_user(VERIFY_WRITE, target_mtext_addr, ret, 0);
4439         if (!target_mtext) {
4440             ret = -TARGET_EFAULT;
4441             goto end;
4442         }
4443         memcpy(target_mb->mtext, host_mb->mtext, ret);
4444         unlock_user(target_mtext, target_mtext_addr, ret);
4445     }
4446 
4447     target_mb->mtype = tswapal(host_mb->mtype);
4448 
4449 end:
4450     if (target_mb)
4451         unlock_user_struct(target_mb, msgp, 1);
4452     g_free(host_mb);
4453     return ret;
4454 }
4455 
4456 static inline abi_long target_to_host_shmid_ds(struct shmid_ds *host_sd,
4457                                                abi_ulong target_addr)
4458 {
4459     struct target_shmid_ds *target_sd;
4460 
4461     if (!lock_user_struct(VERIFY_READ, target_sd, target_addr, 1))
4462         return -TARGET_EFAULT;
4463     if (target_to_host_ipc_perm(&(host_sd->shm_perm), target_addr))
4464         return -TARGET_EFAULT;
4465     __get_user(host_sd->shm_segsz, &target_sd->shm_segsz);
4466     __get_user(host_sd->shm_atime, &target_sd->shm_atime);
4467     __get_user(host_sd->shm_dtime, &target_sd->shm_dtime);
4468     __get_user(host_sd->shm_ctime, &target_sd->shm_ctime);
4469     __get_user(host_sd->shm_cpid, &target_sd->shm_cpid);
4470     __get_user(host_sd->shm_lpid, &target_sd->shm_lpid);
4471     __get_user(host_sd->shm_nattch, &target_sd->shm_nattch);
4472     unlock_user_struct(target_sd, target_addr, 0);
4473     return 0;
4474 }
4475 
4476 static inline abi_long host_to_target_shmid_ds(abi_ulong target_addr,
4477                                                struct shmid_ds *host_sd)
4478 {
4479     struct target_shmid_ds *target_sd;
4480 
4481     if (!lock_user_struct(VERIFY_WRITE, target_sd, target_addr, 0))
4482         return -TARGET_EFAULT;
4483     if (host_to_target_ipc_perm(target_addr, &(host_sd->shm_perm)))
4484         return -TARGET_EFAULT;
4485     __put_user(host_sd->shm_segsz, &target_sd->shm_segsz);
4486     __put_user(host_sd->shm_atime, &target_sd->shm_atime);
4487     __put_user(host_sd->shm_dtime, &target_sd->shm_dtime);
4488     __put_user(host_sd->shm_ctime, &target_sd->shm_ctime);
4489     __put_user(host_sd->shm_cpid, &target_sd->shm_cpid);
4490     __put_user(host_sd->shm_lpid, &target_sd->shm_lpid);
4491     __put_user(host_sd->shm_nattch, &target_sd->shm_nattch);
4492     unlock_user_struct(target_sd, target_addr, 1);
4493     return 0;
4494 }
4495 
4496 struct  target_shminfo {
4497     abi_ulong shmmax;
4498     abi_ulong shmmin;
4499     abi_ulong shmmni;
4500     abi_ulong shmseg;
4501     abi_ulong shmall;
4502 };
4503 
4504 static inline abi_long host_to_target_shminfo(abi_ulong target_addr,
4505                                               struct shminfo *host_shminfo)
4506 {
4507     struct target_shminfo *target_shminfo;
4508     if (!lock_user_struct(VERIFY_WRITE, target_shminfo, target_addr, 0))
4509         return -TARGET_EFAULT;
4510     __put_user(host_shminfo->shmmax, &target_shminfo->shmmax);
4511     __put_user(host_shminfo->shmmin, &target_shminfo->shmmin);
4512     __put_user(host_shminfo->shmmni, &target_shminfo->shmmni);
4513     __put_user(host_shminfo->shmseg, &target_shminfo->shmseg);
4514     __put_user(host_shminfo->shmall, &target_shminfo->shmall);
4515     unlock_user_struct(target_shminfo, target_addr, 1);
4516     return 0;
4517 }
4518 
4519 struct target_shm_info {
4520     int used_ids;
4521     abi_ulong shm_tot;
4522     abi_ulong shm_rss;
4523     abi_ulong shm_swp;
4524     abi_ulong swap_attempts;
4525     abi_ulong swap_successes;
4526 };
4527 
4528 static inline abi_long host_to_target_shm_info(abi_ulong target_addr,
4529                                                struct shm_info *host_shm_info)
4530 {
4531     struct target_shm_info *target_shm_info;
4532     if (!lock_user_struct(VERIFY_WRITE, target_shm_info, target_addr, 0))
4533         return -TARGET_EFAULT;
4534     __put_user(host_shm_info->used_ids, &target_shm_info->used_ids);
4535     __put_user(host_shm_info->shm_tot, &target_shm_info->shm_tot);
4536     __put_user(host_shm_info->shm_rss, &target_shm_info->shm_rss);
4537     __put_user(host_shm_info->shm_swp, &target_shm_info->shm_swp);
4538     __put_user(host_shm_info->swap_attempts, &target_shm_info->swap_attempts);
4539     __put_user(host_shm_info->swap_successes, &target_shm_info->swap_successes);
4540     unlock_user_struct(target_shm_info, target_addr, 1);
4541     return 0;
4542 }
4543 
4544 static inline abi_long do_shmctl(int shmid, int cmd, abi_long buf)
4545 {
4546     struct shmid_ds dsarg;
4547     struct shminfo shminfo;
4548     struct shm_info shm_info;
4549     abi_long ret = -TARGET_EINVAL;
4550 
4551     cmd &= 0xff;
4552 
4553     switch(cmd) {
4554     case IPC_STAT:
4555     case IPC_SET:
4556     case SHM_STAT:
4557         if (target_to_host_shmid_ds(&dsarg, buf))
4558             return -TARGET_EFAULT;
4559         ret = get_errno(shmctl(shmid, cmd, &dsarg));
4560         if (host_to_target_shmid_ds(buf, &dsarg))
4561             return -TARGET_EFAULT;
4562         break;
4563     case IPC_INFO:
4564         ret = get_errno(shmctl(shmid, cmd, (struct shmid_ds *)&shminfo));
4565         if (host_to_target_shminfo(buf, &shminfo))
4566             return -TARGET_EFAULT;
4567         break;
4568     case SHM_INFO:
4569         ret = get_errno(shmctl(shmid, cmd, (struct shmid_ds *)&shm_info));
4570         if (host_to_target_shm_info(buf, &shm_info))
4571             return -TARGET_EFAULT;
4572         break;
4573     case IPC_RMID:
4574     case SHM_LOCK:
4575     case SHM_UNLOCK:
4576         ret = get_errno(shmctl(shmid, cmd, NULL));
4577         break;
4578     }
4579 
4580     return ret;
4581 }
4582 
4583 #ifndef TARGET_FORCE_SHMLBA
4584 /* For most architectures, SHMLBA is the same as the page size;
4585  * some architectures have larger values, in which case they should
4586  * define TARGET_FORCE_SHMLBA and provide a target_shmlba() function.
4587  * This corresponds to the kernel arch code defining __ARCH_FORCE_SHMLBA
4588  * and defining its own value for SHMLBA.
4589  *
4590  * The kernel also permits SHMLBA to be set by the architecture to a
4591  * value larger than the page size without setting __ARCH_FORCE_SHMLBA;
4592  * this means that addresses are rounded to the large size if
4593  * SHM_RND is set but addresses not aligned to that size are not rejected
4594  * as long as they are at least page-aligned. Since the only architecture
4595  * which uses this is ia64 this code doesn't provide for that oddity.
4596  */
4597 static inline abi_ulong target_shmlba(CPUArchState *cpu_env)
4598 {
4599     return TARGET_PAGE_SIZE;
4600 }
4601 #endif
4602 
4603 static inline abi_ulong do_shmat(CPUArchState *cpu_env,
4604                                  int shmid, abi_ulong shmaddr, int shmflg)
4605 {
4606     CPUState *cpu = env_cpu(cpu_env);
4607     abi_long raddr;
4608     void *host_raddr;
4609     struct shmid_ds shm_info;
4610     int i,ret;
4611     abi_ulong shmlba;
4612 
4613     /* shmat pointers are always untagged */
4614 
4615     /* find out the length of the shared memory segment */
4616     ret = get_errno(shmctl(shmid, IPC_STAT, &shm_info));
4617     if (is_error(ret)) {
4618         /* can't get length, bail out */
4619         return ret;
4620     }
4621 
4622     shmlba = target_shmlba(cpu_env);
4623 
4624     if (shmaddr & (shmlba - 1)) {
4625         if (shmflg & SHM_RND) {
4626             shmaddr &= ~(shmlba - 1);
4627         } else {
4628             return -TARGET_EINVAL;
4629         }
4630     }
4631     if (!guest_range_valid_untagged(shmaddr, shm_info.shm_segsz)) {
4632         return -TARGET_EINVAL;
4633     }
4634 
4635     mmap_lock();
4636 
4637     /*
4638      * We're mapping shared memory, so ensure we generate code for parallel
4639      * execution and flush old translations.  This will work up to the level
4640      * supported by the host -- anything that requires EXCP_ATOMIC will not
4641      * be atomic with respect to an external process.
4642      */
4643     if (!(cpu->tcg_cflags & CF_PARALLEL)) {
4644         cpu->tcg_cflags |= CF_PARALLEL;
4645         tb_flush(cpu);
4646     }
4647 
4648     if (shmaddr)
4649         host_raddr = shmat(shmid, (void *)g2h_untagged(shmaddr), shmflg);
4650     else {
4651         abi_ulong mmap_start;
4652 
4653         /* In order to use the host shmat, we need to honor host SHMLBA.  */
4654         mmap_start = mmap_find_vma(0, shm_info.shm_segsz, MAX(SHMLBA, shmlba));
4655 
4656         if (mmap_start == -1) {
4657             errno = ENOMEM;
4658             host_raddr = (void *)-1;
4659         } else
4660             host_raddr = shmat(shmid, g2h_untagged(mmap_start),
4661                                shmflg | SHM_REMAP);
4662     }
4663 
4664     if (host_raddr == (void *)-1) {
4665         mmap_unlock();
4666         return get_errno((long)host_raddr);
4667     }
4668     raddr=h2g((unsigned long)host_raddr);
4669 
4670     page_set_flags(raddr, raddr + shm_info.shm_segsz,
4671                    PAGE_VALID | PAGE_RESET | PAGE_READ |
4672                    (shmflg & SHM_RDONLY ? 0 : PAGE_WRITE));
4673 
4674     for (i = 0; i < N_SHM_REGIONS; i++) {
4675         if (!shm_regions[i].in_use) {
4676             shm_regions[i].in_use = true;
4677             shm_regions[i].start = raddr;
4678             shm_regions[i].size = shm_info.shm_segsz;
4679             break;
4680         }
4681     }
4682 
4683     mmap_unlock();
4684     return raddr;
4685 
4686 }
4687 
4688 static inline abi_long do_shmdt(abi_ulong shmaddr)
4689 {
4690     int i;
4691     abi_long rv;
4692 
4693     /* shmdt pointers are always untagged */
4694 
4695     mmap_lock();
4696 
4697     for (i = 0; i < N_SHM_REGIONS; ++i) {
4698         if (shm_regions[i].in_use && shm_regions[i].start == shmaddr) {
4699             shm_regions[i].in_use = false;
4700             page_set_flags(shmaddr, shmaddr + shm_regions[i].size, 0);
4701             break;
4702         }
4703     }
4704     rv = get_errno(shmdt(g2h_untagged(shmaddr)));
4705 
4706     mmap_unlock();
4707 
4708     return rv;
4709 }
4710 
4711 #ifdef TARGET_NR_ipc
4712 /* ??? This only works with linear mappings.  */
4713 /* do_ipc() must return target values and target errnos. */
4714 static abi_long do_ipc(CPUArchState *cpu_env,
4715                        unsigned int call, abi_long first,
4716                        abi_long second, abi_long third,
4717                        abi_long ptr, abi_long fifth)
4718 {
4719     int version;
4720     abi_long ret = 0;
4721 
4722     version = call >> 16;
4723     call &= 0xffff;
4724 
4725     switch (call) {
4726     case IPCOP_semop:
4727         ret = do_semtimedop(first, ptr, second, 0, false);
4728         break;
4729     case IPCOP_semtimedop:
4730     /*
4731      * The s390 sys_ipc variant has only five parameters instead of six
4732      * (as for default variant) and the only difference is the handling of
4733      * SEMTIMEDOP where on s390 the third parameter is used as a pointer
4734      * to a struct timespec where the generic variant uses fifth parameter.
4735      */
4736 #if defined(TARGET_S390X)
4737         ret = do_semtimedop(first, ptr, second, third, TARGET_ABI_BITS == 64);
4738 #else
4739         ret = do_semtimedop(first, ptr, second, fifth, TARGET_ABI_BITS == 64);
4740 #endif
4741         break;
4742 
4743     case IPCOP_semget:
4744         ret = get_errno(semget(first, second, third));
4745         break;
4746 
4747     case IPCOP_semctl: {
4748         /* The semun argument to semctl is passed by value, so dereference the
4749          * ptr argument. */
4750         abi_ulong atptr;
4751         get_user_ual(atptr, ptr);
4752         ret = do_semctl(first, second, third, atptr);
4753         break;
4754     }
4755 
4756     case IPCOP_msgget:
4757         ret = get_errno(msgget(first, second));
4758         break;
4759 
4760     case IPCOP_msgsnd:
4761         ret = do_msgsnd(first, ptr, second, third);
4762         break;
4763 
4764     case IPCOP_msgctl:
4765         ret = do_msgctl(first, second, ptr);
4766         break;
4767 
4768     case IPCOP_msgrcv:
4769         switch (version) {
4770         case 0:
4771             {
4772                 struct target_ipc_kludge {
4773                     abi_long msgp;
4774                     abi_long msgtyp;
4775                 } *tmp;
4776 
4777                 if (!lock_user_struct(VERIFY_READ, tmp, ptr, 1)) {
4778                     ret = -TARGET_EFAULT;
4779                     break;
4780                 }
4781 
4782                 ret = do_msgrcv(first, tswapal(tmp->msgp), second, tswapal(tmp->msgtyp), third);
4783 
4784                 unlock_user_struct(tmp, ptr, 0);
4785                 break;
4786             }
4787         default:
4788             ret = do_msgrcv(first, ptr, second, fifth, third);
4789         }
4790         break;
4791 
4792     case IPCOP_shmat:
4793         switch (version) {
4794         default:
4795         {
4796             abi_ulong raddr;
4797             raddr = do_shmat(cpu_env, first, ptr, second);
4798             if (is_error(raddr))
4799                 return get_errno(raddr);
4800             if (put_user_ual(raddr, third))
4801                 return -TARGET_EFAULT;
4802             break;
4803         }
4804         case 1:
4805             ret = -TARGET_EINVAL;
4806             break;
4807         }
4808 	break;
4809     case IPCOP_shmdt:
4810         ret = do_shmdt(ptr);
4811 	break;
4812 
4813     case IPCOP_shmget:
4814 	/* IPC_* flag values are the same on all linux platforms */
4815 	ret = get_errno(shmget(first, second, third));
4816 	break;
4817 
4818 	/* IPC_* and SHM_* command values are the same on all linux platforms */
4819     case IPCOP_shmctl:
4820         ret = do_shmctl(first, second, ptr);
4821         break;
4822     default:
4823         qemu_log_mask(LOG_UNIMP, "Unsupported ipc call: %d (version %d)\n",
4824                       call, version);
4825 	ret = -TARGET_ENOSYS;
4826 	break;
4827     }
4828     return ret;
4829 }
4830 #endif
4831 
4832 /* kernel structure types definitions */
4833 
4834 #define STRUCT(name, ...) STRUCT_ ## name,
4835 #define STRUCT_SPECIAL(name) STRUCT_ ## name,
4836 enum {
4837 #include "syscall_types.h"
4838 STRUCT_MAX
4839 };
4840 #undef STRUCT
4841 #undef STRUCT_SPECIAL
4842 
4843 #define STRUCT(name, ...) static const argtype struct_ ## name ## _def[] = {  __VA_ARGS__, TYPE_NULL };
4844 #define STRUCT_SPECIAL(name)
4845 #include "syscall_types.h"
4846 #undef STRUCT
4847 #undef STRUCT_SPECIAL
4848 
4849 #define MAX_STRUCT_SIZE 4096
4850 
4851 #ifdef CONFIG_FIEMAP
4852 /* So fiemap access checks don't overflow on 32 bit systems.
4853  * This is very slightly smaller than the limit imposed by
4854  * the underlying kernel.
4855  */
4856 #define FIEMAP_MAX_EXTENTS ((UINT_MAX - sizeof(struct fiemap))  \
4857                             / sizeof(struct fiemap_extent))
4858 
4859 static abi_long do_ioctl_fs_ioc_fiemap(const IOCTLEntry *ie, uint8_t *buf_temp,
4860                                        int fd, int cmd, abi_long arg)
4861 {
4862     /* The parameter for this ioctl is a struct fiemap followed
4863      * by an array of struct fiemap_extent whose size is set
4864      * in fiemap->fm_extent_count. The array is filled in by the
4865      * ioctl.
4866      */
4867     int target_size_in, target_size_out;
4868     struct fiemap *fm;
4869     const argtype *arg_type = ie->arg_type;
4870     const argtype extent_arg_type[] = { MK_STRUCT(STRUCT_fiemap_extent) };
4871     void *argptr, *p;
4872     abi_long ret;
4873     int i, extent_size = thunk_type_size(extent_arg_type, 0);
4874     uint32_t outbufsz;
4875     int free_fm = 0;
4876 
4877     assert(arg_type[0] == TYPE_PTR);
4878     assert(ie->access == IOC_RW);
4879     arg_type++;
4880     target_size_in = thunk_type_size(arg_type, 0);
4881     argptr = lock_user(VERIFY_READ, arg, target_size_in, 1);
4882     if (!argptr) {
4883         return -TARGET_EFAULT;
4884     }
4885     thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
4886     unlock_user(argptr, arg, 0);
4887     fm = (struct fiemap *)buf_temp;
4888     if (fm->fm_extent_count > FIEMAP_MAX_EXTENTS) {
4889         return -TARGET_EINVAL;
4890     }
4891 
4892     outbufsz = sizeof (*fm) +
4893         (sizeof(struct fiemap_extent) * fm->fm_extent_count);
4894 
4895     if (outbufsz > MAX_STRUCT_SIZE) {
4896         /* We can't fit all the extents into the fixed size buffer.
4897          * Allocate one that is large enough and use it instead.
4898          */
4899         fm = g_try_malloc(outbufsz);
4900         if (!fm) {
4901             return -TARGET_ENOMEM;
4902         }
4903         memcpy(fm, buf_temp, sizeof(struct fiemap));
4904         free_fm = 1;
4905     }
4906     ret = get_errno(safe_ioctl(fd, ie->host_cmd, fm));
4907     if (!is_error(ret)) {
4908         target_size_out = target_size_in;
4909         /* An extent_count of 0 means we were only counting the extents
4910          * so there are no structs to copy
4911          */
4912         if (fm->fm_extent_count != 0) {
4913             target_size_out += fm->fm_mapped_extents * extent_size;
4914         }
4915         argptr = lock_user(VERIFY_WRITE, arg, target_size_out, 0);
4916         if (!argptr) {
4917             ret = -TARGET_EFAULT;
4918         } else {
4919             /* Convert the struct fiemap */
4920             thunk_convert(argptr, fm, arg_type, THUNK_TARGET);
4921             if (fm->fm_extent_count != 0) {
4922                 p = argptr + target_size_in;
4923                 /* ...and then all the struct fiemap_extents */
4924                 for (i = 0; i < fm->fm_mapped_extents; i++) {
4925                     thunk_convert(p, &fm->fm_extents[i], extent_arg_type,
4926                                   THUNK_TARGET);
4927                     p += extent_size;
4928                 }
4929             }
4930             unlock_user(argptr, arg, target_size_out);
4931         }
4932     }
4933     if (free_fm) {
4934         g_free(fm);
4935     }
4936     return ret;
4937 }
4938 #endif
4939 
4940 static abi_long do_ioctl_ifconf(const IOCTLEntry *ie, uint8_t *buf_temp,
4941                                 int fd, int cmd, abi_long arg)
4942 {
4943     const argtype *arg_type = ie->arg_type;
4944     int target_size;
4945     void *argptr;
4946     int ret;
4947     struct ifconf *host_ifconf;
4948     uint32_t outbufsz;
4949     const argtype ifreq_arg_type[] = { MK_STRUCT(STRUCT_sockaddr_ifreq) };
4950     const argtype ifreq_max_type[] = { MK_STRUCT(STRUCT_ifmap_ifreq) };
4951     int target_ifreq_size;
4952     int nb_ifreq;
4953     int free_buf = 0;
4954     int i;
4955     int target_ifc_len;
4956     abi_long target_ifc_buf;
4957     int host_ifc_len;
4958     char *host_ifc_buf;
4959 
4960     assert(arg_type[0] == TYPE_PTR);
4961     assert(ie->access == IOC_RW);
4962 
4963     arg_type++;
4964     target_size = thunk_type_size(arg_type, 0);
4965 
4966     argptr = lock_user(VERIFY_READ, arg, target_size, 1);
4967     if (!argptr)
4968         return -TARGET_EFAULT;
4969     thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
4970     unlock_user(argptr, arg, 0);
4971 
4972     host_ifconf = (struct ifconf *)(unsigned long)buf_temp;
4973     target_ifc_buf = (abi_long)(unsigned long)host_ifconf->ifc_buf;
4974     target_ifreq_size = thunk_type_size(ifreq_max_type, 0);
4975 
4976     if (target_ifc_buf != 0) {
4977         target_ifc_len = host_ifconf->ifc_len;
4978         nb_ifreq = target_ifc_len / target_ifreq_size;
4979         host_ifc_len = nb_ifreq * sizeof(struct ifreq);
4980 
4981         outbufsz = sizeof(*host_ifconf) + host_ifc_len;
4982         if (outbufsz > MAX_STRUCT_SIZE) {
4983             /*
4984              * We can't fit all the extents into the fixed size buffer.
4985              * Allocate one that is large enough and use it instead.
4986              */
4987             host_ifconf = malloc(outbufsz);
4988             if (!host_ifconf) {
4989                 return -TARGET_ENOMEM;
4990             }
4991             memcpy(host_ifconf, buf_temp, sizeof(*host_ifconf));
4992             free_buf = 1;
4993         }
4994         host_ifc_buf = (char *)host_ifconf + sizeof(*host_ifconf);
4995 
4996         host_ifconf->ifc_len = host_ifc_len;
4997     } else {
4998       host_ifc_buf = NULL;
4999     }
5000     host_ifconf->ifc_buf = host_ifc_buf;
5001 
5002     ret = get_errno(safe_ioctl(fd, ie->host_cmd, host_ifconf));
5003     if (!is_error(ret)) {
5004 	/* convert host ifc_len to target ifc_len */
5005 
5006         nb_ifreq = host_ifconf->ifc_len / sizeof(struct ifreq);
5007         target_ifc_len = nb_ifreq * target_ifreq_size;
5008         host_ifconf->ifc_len = target_ifc_len;
5009 
5010 	/* restore target ifc_buf */
5011 
5012         host_ifconf->ifc_buf = (char *)(unsigned long)target_ifc_buf;
5013 
5014 	/* copy struct ifconf to target user */
5015 
5016         argptr = lock_user(VERIFY_WRITE, arg, target_size, 0);
5017         if (!argptr)
5018             return -TARGET_EFAULT;
5019         thunk_convert(argptr, host_ifconf, arg_type, THUNK_TARGET);
5020         unlock_user(argptr, arg, target_size);
5021 
5022         if (target_ifc_buf != 0) {
5023             /* copy ifreq[] to target user */
5024             argptr = lock_user(VERIFY_WRITE, target_ifc_buf, target_ifc_len, 0);
5025             for (i = 0; i < nb_ifreq ; i++) {
5026                 thunk_convert(argptr + i * target_ifreq_size,
5027                               host_ifc_buf + i * sizeof(struct ifreq),
5028                               ifreq_arg_type, THUNK_TARGET);
5029             }
5030             unlock_user(argptr, target_ifc_buf, target_ifc_len);
5031         }
5032     }
5033 
5034     if (free_buf) {
5035         free(host_ifconf);
5036     }
5037 
5038     return ret;
5039 }
5040 
5041 #if defined(CONFIG_USBFS)
5042 #if HOST_LONG_BITS > 64
5043 #error USBDEVFS thunks do not support >64 bit hosts yet.
5044 #endif
5045 struct live_urb {
5046     uint64_t target_urb_adr;
5047     uint64_t target_buf_adr;
5048     char *target_buf_ptr;
5049     struct usbdevfs_urb host_urb;
5050 };
5051 
5052 static GHashTable *usbdevfs_urb_hashtable(void)
5053 {
5054     static GHashTable *urb_hashtable;
5055 
5056     if (!urb_hashtable) {
5057         urb_hashtable = g_hash_table_new(g_int64_hash, g_int64_equal);
5058     }
5059     return urb_hashtable;
5060 }
5061 
5062 static void urb_hashtable_insert(struct live_urb *urb)
5063 {
5064     GHashTable *urb_hashtable = usbdevfs_urb_hashtable();
5065     g_hash_table_insert(urb_hashtable, urb, urb);
5066 }
5067 
5068 static struct live_urb *urb_hashtable_lookup(uint64_t target_urb_adr)
5069 {
5070     GHashTable *urb_hashtable = usbdevfs_urb_hashtable();
5071     return g_hash_table_lookup(urb_hashtable, &target_urb_adr);
5072 }
5073 
5074 static void urb_hashtable_remove(struct live_urb *urb)
5075 {
5076     GHashTable *urb_hashtable = usbdevfs_urb_hashtable();
5077     g_hash_table_remove(urb_hashtable, urb);
5078 }
5079 
5080 static abi_long
5081 do_ioctl_usbdevfs_reapurb(const IOCTLEntry *ie, uint8_t *buf_temp,
5082                           int fd, int cmd, abi_long arg)
5083 {
5084     const argtype usbfsurb_arg_type[] = { MK_STRUCT(STRUCT_usbdevfs_urb) };
5085     const argtype ptrvoid_arg_type[] = { TYPE_PTRVOID, 0, 0 };
5086     struct live_urb *lurb;
5087     void *argptr;
5088     uint64_t hurb;
5089     int target_size;
5090     uintptr_t target_urb_adr;
5091     abi_long ret;
5092 
5093     target_size = thunk_type_size(usbfsurb_arg_type, THUNK_TARGET);
5094 
5095     memset(buf_temp, 0, sizeof(uint64_t));
5096     ret = get_errno(safe_ioctl(fd, ie->host_cmd, buf_temp));
5097     if (is_error(ret)) {
5098         return ret;
5099     }
5100 
5101     memcpy(&hurb, buf_temp, sizeof(uint64_t));
5102     lurb = (void *)((uintptr_t)hurb - offsetof(struct live_urb, host_urb));
5103     if (!lurb->target_urb_adr) {
5104         return -TARGET_EFAULT;
5105     }
5106     urb_hashtable_remove(lurb);
5107     unlock_user(lurb->target_buf_ptr, lurb->target_buf_adr,
5108         lurb->host_urb.buffer_length);
5109     lurb->target_buf_ptr = NULL;
5110 
5111     /* restore the guest buffer pointer */
5112     lurb->host_urb.buffer = (void *)(uintptr_t)lurb->target_buf_adr;
5113 
5114     /* update the guest urb struct */
5115     argptr = lock_user(VERIFY_WRITE, lurb->target_urb_adr, target_size, 0);
5116     if (!argptr) {
5117         g_free(lurb);
5118         return -TARGET_EFAULT;
5119     }
5120     thunk_convert(argptr, &lurb->host_urb, usbfsurb_arg_type, THUNK_TARGET);
5121     unlock_user(argptr, lurb->target_urb_adr, target_size);
5122 
5123     target_size = thunk_type_size(ptrvoid_arg_type, THUNK_TARGET);
5124     /* write back the urb handle */
5125     argptr = lock_user(VERIFY_WRITE, arg, target_size, 0);
5126     if (!argptr) {
5127         g_free(lurb);
5128         return -TARGET_EFAULT;
5129     }
5130 
5131     /* GHashTable uses 64-bit keys but thunk_convert expects uintptr_t */
5132     target_urb_adr = lurb->target_urb_adr;
5133     thunk_convert(argptr, &target_urb_adr, ptrvoid_arg_type, THUNK_TARGET);
5134     unlock_user(argptr, arg, target_size);
5135 
5136     g_free(lurb);
5137     return ret;
5138 }
5139 
5140 static abi_long
5141 do_ioctl_usbdevfs_discardurb(const IOCTLEntry *ie,
5142                              uint8_t *buf_temp __attribute__((unused)),
5143                              int fd, int cmd, abi_long arg)
5144 {
5145     struct live_urb *lurb;
5146 
5147     /* map target address back to host URB with metadata. */
5148     lurb = urb_hashtable_lookup(arg);
5149     if (!lurb) {
5150         return -TARGET_EFAULT;
5151     }
5152     return get_errno(safe_ioctl(fd, ie->host_cmd, &lurb->host_urb));
5153 }
5154 
5155 static abi_long
5156 do_ioctl_usbdevfs_submiturb(const IOCTLEntry *ie, uint8_t *buf_temp,
5157                             int fd, int cmd, abi_long arg)
5158 {
5159     const argtype *arg_type = ie->arg_type;
5160     int target_size;
5161     abi_long ret;
5162     void *argptr;
5163     int rw_dir;
5164     struct live_urb *lurb;
5165 
5166     /*
5167      * each submitted URB needs to map to a unique ID for the
5168      * kernel, and that unique ID needs to be a pointer to
5169      * host memory.  hence, we need to malloc for each URB.
5170      * isochronous transfers have a variable length struct.
5171      */
5172     arg_type++;
5173     target_size = thunk_type_size(arg_type, THUNK_TARGET);
5174 
5175     /* construct host copy of urb and metadata */
5176     lurb = g_try_malloc0(sizeof(struct live_urb));
5177     if (!lurb) {
5178         return -TARGET_ENOMEM;
5179     }
5180 
5181     argptr = lock_user(VERIFY_READ, arg, target_size, 1);
5182     if (!argptr) {
5183         g_free(lurb);
5184         return -TARGET_EFAULT;
5185     }
5186     thunk_convert(&lurb->host_urb, argptr, arg_type, THUNK_HOST);
5187     unlock_user(argptr, arg, 0);
5188 
5189     lurb->target_urb_adr = arg;
5190     lurb->target_buf_adr = (uintptr_t)lurb->host_urb.buffer;
5191 
5192     /* buffer space used depends on endpoint type so lock the entire buffer */
5193     /* control type urbs should check the buffer contents for true direction */
5194     rw_dir = lurb->host_urb.endpoint & USB_DIR_IN ? VERIFY_WRITE : VERIFY_READ;
5195     lurb->target_buf_ptr = lock_user(rw_dir, lurb->target_buf_adr,
5196         lurb->host_urb.buffer_length, 1);
5197     if (lurb->target_buf_ptr == NULL) {
5198         g_free(lurb);
5199         return -TARGET_EFAULT;
5200     }
5201 
5202     /* update buffer pointer in host copy */
5203     lurb->host_urb.buffer = lurb->target_buf_ptr;
5204 
5205     ret = get_errno(safe_ioctl(fd, ie->host_cmd, &lurb->host_urb));
5206     if (is_error(ret)) {
5207         unlock_user(lurb->target_buf_ptr, lurb->target_buf_adr, 0);
5208         g_free(lurb);
5209     } else {
5210         urb_hashtable_insert(lurb);
5211     }
5212 
5213     return ret;
5214 }
5215 #endif /* CONFIG_USBFS */
5216 
5217 static abi_long do_ioctl_dm(const IOCTLEntry *ie, uint8_t *buf_temp, int fd,
5218                             int cmd, abi_long arg)
5219 {
5220     void *argptr;
5221     struct dm_ioctl *host_dm;
5222     abi_long guest_data;
5223     uint32_t guest_data_size;
5224     int target_size;
5225     const argtype *arg_type = ie->arg_type;
5226     abi_long ret;
5227     void *big_buf = NULL;
5228     char *host_data;
5229 
5230     arg_type++;
5231     target_size = thunk_type_size(arg_type, 0);
5232     argptr = lock_user(VERIFY_READ, arg, target_size, 1);
5233     if (!argptr) {
5234         ret = -TARGET_EFAULT;
5235         goto out;
5236     }
5237     thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
5238     unlock_user(argptr, arg, 0);
5239 
5240     /* buf_temp is too small, so fetch things into a bigger buffer */
5241     big_buf = g_malloc0(((struct dm_ioctl*)buf_temp)->data_size * 2);
5242     memcpy(big_buf, buf_temp, target_size);
5243     buf_temp = big_buf;
5244     host_dm = big_buf;
5245 
5246     guest_data = arg + host_dm->data_start;
5247     if ((guest_data - arg) < 0) {
5248         ret = -TARGET_EINVAL;
5249         goto out;
5250     }
5251     guest_data_size = host_dm->data_size - host_dm->data_start;
5252     host_data = (char*)host_dm + host_dm->data_start;
5253 
5254     argptr = lock_user(VERIFY_READ, guest_data, guest_data_size, 1);
5255     if (!argptr) {
5256         ret = -TARGET_EFAULT;
5257         goto out;
5258     }
5259 
5260     switch (ie->host_cmd) {
5261     case DM_REMOVE_ALL:
5262     case DM_LIST_DEVICES:
5263     case DM_DEV_CREATE:
5264     case DM_DEV_REMOVE:
5265     case DM_DEV_SUSPEND:
5266     case DM_DEV_STATUS:
5267     case DM_DEV_WAIT:
5268     case DM_TABLE_STATUS:
5269     case DM_TABLE_CLEAR:
5270     case DM_TABLE_DEPS:
5271     case DM_LIST_VERSIONS:
5272         /* no input data */
5273         break;
5274     case DM_DEV_RENAME:
5275     case DM_DEV_SET_GEOMETRY:
5276         /* data contains only strings */
5277         memcpy(host_data, argptr, guest_data_size);
5278         break;
5279     case DM_TARGET_MSG:
5280         memcpy(host_data, argptr, guest_data_size);
5281         *(uint64_t*)host_data = tswap64(*(uint64_t*)argptr);
5282         break;
5283     case DM_TABLE_LOAD:
5284     {
5285         void *gspec = argptr;
5286         void *cur_data = host_data;
5287         const argtype arg_type[] = { MK_STRUCT(STRUCT_dm_target_spec) };
5288         int spec_size = thunk_type_size(arg_type, 0);
5289         int i;
5290 
5291         for (i = 0; i < host_dm->target_count; i++) {
5292             struct dm_target_spec *spec = cur_data;
5293             uint32_t next;
5294             int slen;
5295 
5296             thunk_convert(spec, gspec, arg_type, THUNK_HOST);
5297             slen = strlen((char*)gspec + spec_size) + 1;
5298             next = spec->next;
5299             spec->next = sizeof(*spec) + slen;
5300             strcpy((char*)&spec[1], gspec + spec_size);
5301             gspec += next;
5302             cur_data += spec->next;
5303         }
5304         break;
5305     }
5306     default:
5307         ret = -TARGET_EINVAL;
5308         unlock_user(argptr, guest_data, 0);
5309         goto out;
5310     }
5311     unlock_user(argptr, guest_data, 0);
5312 
5313     ret = get_errno(safe_ioctl(fd, ie->host_cmd, buf_temp));
5314     if (!is_error(ret)) {
5315         guest_data = arg + host_dm->data_start;
5316         guest_data_size = host_dm->data_size - host_dm->data_start;
5317         argptr = lock_user(VERIFY_WRITE, guest_data, guest_data_size, 0);
5318         switch (ie->host_cmd) {
5319         case DM_REMOVE_ALL:
5320         case DM_DEV_CREATE:
5321         case DM_DEV_REMOVE:
5322         case DM_DEV_RENAME:
5323         case DM_DEV_SUSPEND:
5324         case DM_DEV_STATUS:
5325         case DM_TABLE_LOAD:
5326         case DM_TABLE_CLEAR:
5327         case DM_TARGET_MSG:
5328         case DM_DEV_SET_GEOMETRY:
5329             /* no return data */
5330             break;
5331         case DM_LIST_DEVICES:
5332         {
5333             struct dm_name_list *nl = (void*)host_dm + host_dm->data_start;
5334             uint32_t remaining_data = guest_data_size;
5335             void *cur_data = argptr;
5336             const argtype arg_type[] = { MK_STRUCT(STRUCT_dm_name_list) };
5337             int nl_size = 12; /* can't use thunk_size due to alignment */
5338 
5339             while (1) {
5340                 uint32_t next = nl->next;
5341                 if (next) {
5342                     nl->next = nl_size + (strlen(nl->name) + 1);
5343                 }
5344                 if (remaining_data < nl->next) {
5345                     host_dm->flags |= DM_BUFFER_FULL_FLAG;
5346                     break;
5347                 }
5348                 thunk_convert(cur_data, nl, arg_type, THUNK_TARGET);
5349                 strcpy(cur_data + nl_size, nl->name);
5350                 cur_data += nl->next;
5351                 remaining_data -= nl->next;
5352                 if (!next) {
5353                     break;
5354                 }
5355                 nl = (void*)nl + next;
5356             }
5357             break;
5358         }
5359         case DM_DEV_WAIT:
5360         case DM_TABLE_STATUS:
5361         {
5362             struct dm_target_spec *spec = (void*)host_dm + host_dm->data_start;
5363             void *cur_data = argptr;
5364             const argtype arg_type[] = { MK_STRUCT(STRUCT_dm_target_spec) };
5365             int spec_size = thunk_type_size(arg_type, 0);
5366             int i;
5367 
5368             for (i = 0; i < host_dm->target_count; i++) {
5369                 uint32_t next = spec->next;
5370                 int slen = strlen((char*)&spec[1]) + 1;
5371                 spec->next = (cur_data - argptr) + spec_size + slen;
5372                 if (guest_data_size < spec->next) {
5373                     host_dm->flags |= DM_BUFFER_FULL_FLAG;
5374                     break;
5375                 }
5376                 thunk_convert(cur_data, spec, arg_type, THUNK_TARGET);
5377                 strcpy(cur_data + spec_size, (char*)&spec[1]);
5378                 cur_data = argptr + spec->next;
5379                 spec = (void*)host_dm + host_dm->data_start + next;
5380             }
5381             break;
5382         }
5383         case DM_TABLE_DEPS:
5384         {
5385             void *hdata = (void*)host_dm + host_dm->data_start;
5386             int count = *(uint32_t*)hdata;
5387             uint64_t *hdev = hdata + 8;
5388             uint64_t *gdev = argptr + 8;
5389             int i;
5390 
5391             *(uint32_t*)argptr = tswap32(count);
5392             for (i = 0; i < count; i++) {
5393                 *gdev = tswap64(*hdev);
5394                 gdev++;
5395                 hdev++;
5396             }
5397             break;
5398         }
5399         case DM_LIST_VERSIONS:
5400         {
5401             struct dm_target_versions *vers = (void*)host_dm + host_dm->data_start;
5402             uint32_t remaining_data = guest_data_size;
5403             void *cur_data = argptr;
5404             const argtype arg_type[] = { MK_STRUCT(STRUCT_dm_target_versions) };
5405             int vers_size = thunk_type_size(arg_type, 0);
5406 
5407             while (1) {
5408                 uint32_t next = vers->next;
5409                 if (next) {
5410                     vers->next = vers_size + (strlen(vers->name) + 1);
5411                 }
5412                 if (remaining_data < vers->next) {
5413                     host_dm->flags |= DM_BUFFER_FULL_FLAG;
5414                     break;
5415                 }
5416                 thunk_convert(cur_data, vers, arg_type, THUNK_TARGET);
5417                 strcpy(cur_data + vers_size, vers->name);
5418                 cur_data += vers->next;
5419                 remaining_data -= vers->next;
5420                 if (!next) {
5421                     break;
5422                 }
5423                 vers = (void*)vers + next;
5424             }
5425             break;
5426         }
5427         default:
5428             unlock_user(argptr, guest_data, 0);
5429             ret = -TARGET_EINVAL;
5430             goto out;
5431         }
5432         unlock_user(argptr, guest_data, guest_data_size);
5433 
5434         argptr = lock_user(VERIFY_WRITE, arg, target_size, 0);
5435         if (!argptr) {
5436             ret = -TARGET_EFAULT;
5437             goto out;
5438         }
5439         thunk_convert(argptr, buf_temp, arg_type, THUNK_TARGET);
5440         unlock_user(argptr, arg, target_size);
5441     }
5442 out:
5443     g_free(big_buf);
5444     return ret;
5445 }
5446 
5447 static abi_long do_ioctl_blkpg(const IOCTLEntry *ie, uint8_t *buf_temp, int fd,
5448                                int cmd, abi_long arg)
5449 {
5450     void *argptr;
5451     int target_size;
5452     const argtype *arg_type = ie->arg_type;
5453     const argtype part_arg_type[] = { MK_STRUCT(STRUCT_blkpg_partition) };
5454     abi_long ret;
5455 
5456     struct blkpg_ioctl_arg *host_blkpg = (void*)buf_temp;
5457     struct blkpg_partition host_part;
5458 
5459     /* Read and convert blkpg */
5460     arg_type++;
5461     target_size = thunk_type_size(arg_type, 0);
5462     argptr = lock_user(VERIFY_READ, arg, target_size, 1);
5463     if (!argptr) {
5464         ret = -TARGET_EFAULT;
5465         goto out;
5466     }
5467     thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
5468     unlock_user(argptr, arg, 0);
5469 
5470     switch (host_blkpg->op) {
5471     case BLKPG_ADD_PARTITION:
5472     case BLKPG_DEL_PARTITION:
5473         /* payload is struct blkpg_partition */
5474         break;
5475     default:
5476         /* Unknown opcode */
5477         ret = -TARGET_EINVAL;
5478         goto out;
5479     }
5480 
5481     /* Read and convert blkpg->data */
5482     arg = (abi_long)(uintptr_t)host_blkpg->data;
5483     target_size = thunk_type_size(part_arg_type, 0);
5484     argptr = lock_user(VERIFY_READ, arg, target_size, 1);
5485     if (!argptr) {
5486         ret = -TARGET_EFAULT;
5487         goto out;
5488     }
5489     thunk_convert(&host_part, argptr, part_arg_type, THUNK_HOST);
5490     unlock_user(argptr, arg, 0);
5491 
5492     /* Swizzle the data pointer to our local copy and call! */
5493     host_blkpg->data = &host_part;
5494     ret = get_errno(safe_ioctl(fd, ie->host_cmd, host_blkpg));
5495 
5496 out:
5497     return ret;
5498 }
5499 
5500 static abi_long do_ioctl_rt(const IOCTLEntry *ie, uint8_t *buf_temp,
5501                                 int fd, int cmd, abi_long arg)
5502 {
5503     const argtype *arg_type = ie->arg_type;
5504     const StructEntry *se;
5505     const argtype *field_types;
5506     const int *dst_offsets, *src_offsets;
5507     int target_size;
5508     void *argptr;
5509     abi_ulong *target_rt_dev_ptr = NULL;
5510     unsigned long *host_rt_dev_ptr = NULL;
5511     abi_long ret;
5512     int i;
5513 
5514     assert(ie->access == IOC_W);
5515     assert(*arg_type == TYPE_PTR);
5516     arg_type++;
5517     assert(*arg_type == TYPE_STRUCT);
5518     target_size = thunk_type_size(arg_type, 0);
5519     argptr = lock_user(VERIFY_READ, arg, target_size, 1);
5520     if (!argptr) {
5521         return -TARGET_EFAULT;
5522     }
5523     arg_type++;
5524     assert(*arg_type == (int)STRUCT_rtentry);
5525     se = struct_entries + *arg_type++;
5526     assert(se->convert[0] == NULL);
5527     /* convert struct here to be able to catch rt_dev string */
5528     field_types = se->field_types;
5529     dst_offsets = se->field_offsets[THUNK_HOST];
5530     src_offsets = se->field_offsets[THUNK_TARGET];
5531     for (i = 0; i < se->nb_fields; i++) {
5532         if (dst_offsets[i] == offsetof(struct rtentry, rt_dev)) {
5533             assert(*field_types == TYPE_PTRVOID);
5534             target_rt_dev_ptr = (abi_ulong *)(argptr + src_offsets[i]);
5535             host_rt_dev_ptr = (unsigned long *)(buf_temp + dst_offsets[i]);
5536             if (*target_rt_dev_ptr != 0) {
5537                 *host_rt_dev_ptr = (unsigned long)lock_user_string(
5538                                                   tswapal(*target_rt_dev_ptr));
5539                 if (!*host_rt_dev_ptr) {
5540                     unlock_user(argptr, arg, 0);
5541                     return -TARGET_EFAULT;
5542                 }
5543             } else {
5544                 *host_rt_dev_ptr = 0;
5545             }
5546             field_types++;
5547             continue;
5548         }
5549         field_types = thunk_convert(buf_temp + dst_offsets[i],
5550                                     argptr + src_offsets[i],
5551                                     field_types, THUNK_HOST);
5552     }
5553     unlock_user(argptr, arg, 0);
5554 
5555     ret = get_errno(safe_ioctl(fd, ie->host_cmd, buf_temp));
5556 
5557     assert(host_rt_dev_ptr != NULL);
5558     assert(target_rt_dev_ptr != NULL);
5559     if (*host_rt_dev_ptr != 0) {
5560         unlock_user((void *)*host_rt_dev_ptr,
5561                     *target_rt_dev_ptr, 0);
5562     }
5563     return ret;
5564 }
5565 
5566 static abi_long do_ioctl_kdsigaccept(const IOCTLEntry *ie, uint8_t *buf_temp,
5567                                      int fd, int cmd, abi_long arg)
5568 {
5569     int sig = target_to_host_signal(arg);
5570     return get_errno(safe_ioctl(fd, ie->host_cmd, sig));
5571 }
5572 
5573 static abi_long do_ioctl_SIOCGSTAMP(const IOCTLEntry *ie, uint8_t *buf_temp,
5574                                     int fd, int cmd, abi_long arg)
5575 {
5576     struct timeval tv;
5577     abi_long ret;
5578 
5579     ret = get_errno(safe_ioctl(fd, SIOCGSTAMP, &tv));
5580     if (is_error(ret)) {
5581         return ret;
5582     }
5583 
5584     if (cmd == (int)TARGET_SIOCGSTAMP_OLD) {
5585         if (copy_to_user_timeval(arg, &tv)) {
5586             return -TARGET_EFAULT;
5587         }
5588     } else {
5589         if (copy_to_user_timeval64(arg, &tv)) {
5590             return -TARGET_EFAULT;
5591         }
5592     }
5593 
5594     return ret;
5595 }
5596 
5597 static abi_long do_ioctl_SIOCGSTAMPNS(const IOCTLEntry *ie, uint8_t *buf_temp,
5598                                       int fd, int cmd, abi_long arg)
5599 {
5600     struct timespec ts;
5601     abi_long ret;
5602 
5603     ret = get_errno(safe_ioctl(fd, SIOCGSTAMPNS, &ts));
5604     if (is_error(ret)) {
5605         return ret;
5606     }
5607 
5608     if (cmd == (int)TARGET_SIOCGSTAMPNS_OLD) {
5609         if (host_to_target_timespec(arg, &ts)) {
5610             return -TARGET_EFAULT;
5611         }
5612     } else{
5613         if (host_to_target_timespec64(arg, &ts)) {
5614             return -TARGET_EFAULT;
5615         }
5616     }
5617 
5618     return ret;
5619 }
5620 
5621 #ifdef TIOCGPTPEER
5622 static abi_long do_ioctl_tiocgptpeer(const IOCTLEntry *ie, uint8_t *buf_temp,
5623                                      int fd, int cmd, abi_long arg)
5624 {
5625     int flags = target_to_host_bitmask(arg, fcntl_flags_tbl);
5626     return get_errno(safe_ioctl(fd, ie->host_cmd, flags));
5627 }
5628 #endif
5629 
5630 #ifdef HAVE_DRM_H
5631 
5632 static void unlock_drm_version(struct drm_version *host_ver,
5633                                struct target_drm_version *target_ver,
5634                                bool copy)
5635 {
5636     unlock_user(host_ver->name, target_ver->name,
5637                                 copy ? host_ver->name_len : 0);
5638     unlock_user(host_ver->date, target_ver->date,
5639                                 copy ? host_ver->date_len : 0);
5640     unlock_user(host_ver->desc, target_ver->desc,
5641                                 copy ? host_ver->desc_len : 0);
5642 }
5643 
5644 static inline abi_long target_to_host_drmversion(struct drm_version *host_ver,
5645                                           struct target_drm_version *target_ver)
5646 {
5647     memset(host_ver, 0, sizeof(*host_ver));
5648 
5649     __get_user(host_ver->name_len, &target_ver->name_len);
5650     if (host_ver->name_len) {
5651         host_ver->name = lock_user(VERIFY_WRITE, target_ver->name,
5652                                    target_ver->name_len, 0);
5653         if (!host_ver->name) {
5654             return -EFAULT;
5655         }
5656     }
5657 
5658     __get_user(host_ver->date_len, &target_ver->date_len);
5659     if (host_ver->date_len) {
5660         host_ver->date = lock_user(VERIFY_WRITE, target_ver->date,
5661                                    target_ver->date_len, 0);
5662         if (!host_ver->date) {
5663             goto err;
5664         }
5665     }
5666 
5667     __get_user(host_ver->desc_len, &target_ver->desc_len);
5668     if (host_ver->desc_len) {
5669         host_ver->desc = lock_user(VERIFY_WRITE, target_ver->desc,
5670                                    target_ver->desc_len, 0);
5671         if (!host_ver->desc) {
5672             goto err;
5673         }
5674     }
5675 
5676     return 0;
5677 err:
5678     unlock_drm_version(host_ver, target_ver, false);
5679     return -EFAULT;
5680 }
5681 
5682 static inline void host_to_target_drmversion(
5683                                           struct target_drm_version *target_ver,
5684                                           struct drm_version *host_ver)
5685 {
5686     __put_user(host_ver->version_major, &target_ver->version_major);
5687     __put_user(host_ver->version_minor, &target_ver->version_minor);
5688     __put_user(host_ver->version_patchlevel, &target_ver->version_patchlevel);
5689     __put_user(host_ver->name_len, &target_ver->name_len);
5690     __put_user(host_ver->date_len, &target_ver->date_len);
5691     __put_user(host_ver->desc_len, &target_ver->desc_len);
5692     unlock_drm_version(host_ver, target_ver, true);
5693 }
5694 
5695 static abi_long do_ioctl_drm(const IOCTLEntry *ie, uint8_t *buf_temp,
5696                              int fd, int cmd, abi_long arg)
5697 {
5698     struct drm_version *ver;
5699     struct target_drm_version *target_ver;
5700     abi_long ret;
5701 
5702     switch (ie->host_cmd) {
5703     case DRM_IOCTL_VERSION:
5704         if (!lock_user_struct(VERIFY_WRITE, target_ver, arg, 0)) {
5705             return -TARGET_EFAULT;
5706         }
5707         ver = (struct drm_version *)buf_temp;
5708         ret = target_to_host_drmversion(ver, target_ver);
5709         if (!is_error(ret)) {
5710             ret = get_errno(safe_ioctl(fd, ie->host_cmd, ver));
5711             if (is_error(ret)) {
5712                 unlock_drm_version(ver, target_ver, false);
5713             } else {
5714                 host_to_target_drmversion(target_ver, ver);
5715             }
5716         }
5717         unlock_user_struct(target_ver, arg, 0);
5718         return ret;
5719     }
5720     return -TARGET_ENOSYS;
5721 }
5722 
5723 static abi_long do_ioctl_drm_i915_getparam(const IOCTLEntry *ie,
5724                                            struct drm_i915_getparam *gparam,
5725                                            int fd, abi_long arg)
5726 {
5727     abi_long ret;
5728     int value;
5729     struct target_drm_i915_getparam *target_gparam;
5730 
5731     if (!lock_user_struct(VERIFY_READ, target_gparam, arg, 0)) {
5732         return -TARGET_EFAULT;
5733     }
5734 
5735     __get_user(gparam->param, &target_gparam->param);
5736     gparam->value = &value;
5737     ret = get_errno(safe_ioctl(fd, ie->host_cmd, gparam));
5738     put_user_s32(value, target_gparam->value);
5739 
5740     unlock_user_struct(target_gparam, arg, 0);
5741     return ret;
5742 }
5743 
5744 static abi_long do_ioctl_drm_i915(const IOCTLEntry *ie, uint8_t *buf_temp,
5745                                   int fd, int cmd, abi_long arg)
5746 {
5747     switch (ie->host_cmd) {
5748     case DRM_IOCTL_I915_GETPARAM:
5749         return do_ioctl_drm_i915_getparam(ie,
5750                                           (struct drm_i915_getparam *)buf_temp,
5751                                           fd, arg);
5752     default:
5753         return -TARGET_ENOSYS;
5754     }
5755 }
5756 
5757 #endif
5758 
5759 static abi_long do_ioctl_TUNSETTXFILTER(const IOCTLEntry *ie, uint8_t *buf_temp,
5760                                         int fd, int cmd, abi_long arg)
5761 {
5762     struct tun_filter *filter = (struct tun_filter *)buf_temp;
5763     struct tun_filter *target_filter;
5764     char *target_addr;
5765 
5766     assert(ie->access == IOC_W);
5767 
5768     target_filter = lock_user(VERIFY_READ, arg, sizeof(*target_filter), 1);
5769     if (!target_filter) {
5770         return -TARGET_EFAULT;
5771     }
5772     filter->flags = tswap16(target_filter->flags);
5773     filter->count = tswap16(target_filter->count);
5774     unlock_user(target_filter, arg, 0);
5775 
5776     if (filter->count) {
5777         if (offsetof(struct tun_filter, addr) + filter->count * ETH_ALEN >
5778             MAX_STRUCT_SIZE) {
5779             return -TARGET_EFAULT;
5780         }
5781 
5782         target_addr = lock_user(VERIFY_READ,
5783                                 arg + offsetof(struct tun_filter, addr),
5784                                 filter->count * ETH_ALEN, 1);
5785         if (!target_addr) {
5786             return -TARGET_EFAULT;
5787         }
5788         memcpy(filter->addr, target_addr, filter->count * ETH_ALEN);
5789         unlock_user(target_addr, arg + offsetof(struct tun_filter, addr), 0);
5790     }
5791 
5792     return get_errno(safe_ioctl(fd, ie->host_cmd, filter));
5793 }
5794 
5795 IOCTLEntry ioctl_entries[] = {
5796 #define IOCTL(cmd, access, ...) \
5797     { TARGET_ ## cmd, cmd, #cmd, access, 0, {  __VA_ARGS__ } },
5798 #define IOCTL_SPECIAL(cmd, access, dofn, ...)                      \
5799     { TARGET_ ## cmd, cmd, #cmd, access, dofn, {  __VA_ARGS__ } },
5800 #define IOCTL_IGNORE(cmd) \
5801     { TARGET_ ## cmd, 0, #cmd },
5802 #include "ioctls.h"
5803     { 0, 0, },
5804 };
5805 
5806 /* ??? Implement proper locking for ioctls.  */
5807 /* do_ioctl() Must return target values and target errnos. */
5808 static abi_long do_ioctl(int fd, int cmd, abi_long arg)
5809 {
5810     const IOCTLEntry *ie;
5811     const argtype *arg_type;
5812     abi_long ret;
5813     uint8_t buf_temp[MAX_STRUCT_SIZE];
5814     int target_size;
5815     void *argptr;
5816 
5817     ie = ioctl_entries;
5818     for(;;) {
5819         if (ie->target_cmd == 0) {
5820             qemu_log_mask(
5821                 LOG_UNIMP, "Unsupported ioctl: cmd=0x%04lx\n", (long)cmd);
5822             return -TARGET_ENOSYS;
5823         }
5824         if (ie->target_cmd == cmd)
5825             break;
5826         ie++;
5827     }
5828     arg_type = ie->arg_type;
5829     if (ie->do_ioctl) {
5830         return ie->do_ioctl(ie, buf_temp, fd, cmd, arg);
5831     } else if (!ie->host_cmd) {
5832         /* Some architectures define BSD ioctls in their headers
5833            that are not implemented in Linux.  */
5834         return -TARGET_ENOSYS;
5835     }
5836 
5837     switch(arg_type[0]) {
5838     case TYPE_NULL:
5839         /* no argument */
5840         ret = get_errno(safe_ioctl(fd, ie->host_cmd));
5841         break;
5842     case TYPE_PTRVOID:
5843     case TYPE_INT:
5844     case TYPE_LONG:
5845     case TYPE_ULONG:
5846         ret = get_errno(safe_ioctl(fd, ie->host_cmd, arg));
5847         break;
5848     case TYPE_PTR:
5849         arg_type++;
5850         target_size = thunk_type_size(arg_type, 0);
5851         switch(ie->access) {
5852         case IOC_R:
5853             ret = get_errno(safe_ioctl(fd, ie->host_cmd, buf_temp));
5854             if (!is_error(ret)) {
5855                 argptr = lock_user(VERIFY_WRITE, arg, target_size, 0);
5856                 if (!argptr)
5857                     return -TARGET_EFAULT;
5858                 thunk_convert(argptr, buf_temp, arg_type, THUNK_TARGET);
5859                 unlock_user(argptr, arg, target_size);
5860             }
5861             break;
5862         case IOC_W:
5863             argptr = lock_user(VERIFY_READ, arg, target_size, 1);
5864             if (!argptr)
5865                 return -TARGET_EFAULT;
5866             thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
5867             unlock_user(argptr, arg, 0);
5868             ret = get_errno(safe_ioctl(fd, ie->host_cmd, buf_temp));
5869             break;
5870         default:
5871         case IOC_RW:
5872             argptr = lock_user(VERIFY_READ, arg, target_size, 1);
5873             if (!argptr)
5874                 return -TARGET_EFAULT;
5875             thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
5876             unlock_user(argptr, arg, 0);
5877             ret = get_errno(safe_ioctl(fd, ie->host_cmd, buf_temp));
5878             if (!is_error(ret)) {
5879                 argptr = lock_user(VERIFY_WRITE, arg, target_size, 0);
5880                 if (!argptr)
5881                     return -TARGET_EFAULT;
5882                 thunk_convert(argptr, buf_temp, arg_type, THUNK_TARGET);
5883                 unlock_user(argptr, arg, target_size);
5884             }
5885             break;
5886         }
5887         break;
5888     default:
5889         qemu_log_mask(LOG_UNIMP,
5890                       "Unsupported ioctl type: cmd=0x%04lx type=%d\n",
5891                       (long)cmd, arg_type[0]);
5892         ret = -TARGET_ENOSYS;
5893         break;
5894     }
5895     return ret;
5896 }
5897 
5898 static const bitmask_transtbl iflag_tbl[] = {
5899         { TARGET_IGNBRK, TARGET_IGNBRK, IGNBRK, IGNBRK },
5900         { TARGET_BRKINT, TARGET_BRKINT, BRKINT, BRKINT },
5901         { TARGET_IGNPAR, TARGET_IGNPAR, IGNPAR, IGNPAR },
5902         { TARGET_PARMRK, TARGET_PARMRK, PARMRK, PARMRK },
5903         { TARGET_INPCK, TARGET_INPCK, INPCK, INPCK },
5904         { TARGET_ISTRIP, TARGET_ISTRIP, ISTRIP, ISTRIP },
5905         { TARGET_INLCR, TARGET_INLCR, INLCR, INLCR },
5906         { TARGET_IGNCR, TARGET_IGNCR, IGNCR, IGNCR },
5907         { TARGET_ICRNL, TARGET_ICRNL, ICRNL, ICRNL },
5908         { TARGET_IUCLC, TARGET_IUCLC, IUCLC, IUCLC },
5909         { TARGET_IXON, TARGET_IXON, IXON, IXON },
5910         { TARGET_IXANY, TARGET_IXANY, IXANY, IXANY },
5911         { TARGET_IXOFF, TARGET_IXOFF, IXOFF, IXOFF },
5912         { TARGET_IMAXBEL, TARGET_IMAXBEL, IMAXBEL, IMAXBEL },
5913         { TARGET_IUTF8, TARGET_IUTF8, IUTF8, IUTF8},
5914         { 0, 0, 0, 0 }
5915 };
5916 
5917 static const bitmask_transtbl oflag_tbl[] = {
5918 	{ TARGET_OPOST, TARGET_OPOST, OPOST, OPOST },
5919 	{ TARGET_OLCUC, TARGET_OLCUC, OLCUC, OLCUC },
5920 	{ TARGET_ONLCR, TARGET_ONLCR, ONLCR, ONLCR },
5921 	{ TARGET_OCRNL, TARGET_OCRNL, OCRNL, OCRNL },
5922 	{ TARGET_ONOCR, TARGET_ONOCR, ONOCR, ONOCR },
5923 	{ TARGET_ONLRET, TARGET_ONLRET, ONLRET, ONLRET },
5924 	{ TARGET_OFILL, TARGET_OFILL, OFILL, OFILL },
5925 	{ TARGET_OFDEL, TARGET_OFDEL, OFDEL, OFDEL },
5926 	{ TARGET_NLDLY, TARGET_NL0, NLDLY, NL0 },
5927 	{ TARGET_NLDLY, TARGET_NL1, NLDLY, NL1 },
5928 	{ TARGET_CRDLY, TARGET_CR0, CRDLY, CR0 },
5929 	{ TARGET_CRDLY, TARGET_CR1, CRDLY, CR1 },
5930 	{ TARGET_CRDLY, TARGET_CR2, CRDLY, CR2 },
5931 	{ TARGET_CRDLY, TARGET_CR3, CRDLY, CR3 },
5932 	{ TARGET_TABDLY, TARGET_TAB0, TABDLY, TAB0 },
5933 	{ TARGET_TABDLY, TARGET_TAB1, TABDLY, TAB1 },
5934 	{ TARGET_TABDLY, TARGET_TAB2, TABDLY, TAB2 },
5935 	{ TARGET_TABDLY, TARGET_TAB3, TABDLY, TAB3 },
5936 	{ TARGET_BSDLY, TARGET_BS0, BSDLY, BS0 },
5937 	{ TARGET_BSDLY, TARGET_BS1, BSDLY, BS1 },
5938 	{ TARGET_VTDLY, TARGET_VT0, VTDLY, VT0 },
5939 	{ TARGET_VTDLY, TARGET_VT1, VTDLY, VT1 },
5940 	{ TARGET_FFDLY, TARGET_FF0, FFDLY, FF0 },
5941 	{ TARGET_FFDLY, TARGET_FF1, FFDLY, FF1 },
5942 	{ 0, 0, 0, 0 }
5943 };
5944 
5945 static const bitmask_transtbl cflag_tbl[] = {
5946 	{ TARGET_CBAUD, TARGET_B0, CBAUD, B0 },
5947 	{ TARGET_CBAUD, TARGET_B50, CBAUD, B50 },
5948 	{ TARGET_CBAUD, TARGET_B75, CBAUD, B75 },
5949 	{ TARGET_CBAUD, TARGET_B110, CBAUD, B110 },
5950 	{ TARGET_CBAUD, TARGET_B134, CBAUD, B134 },
5951 	{ TARGET_CBAUD, TARGET_B150, CBAUD, B150 },
5952 	{ TARGET_CBAUD, TARGET_B200, CBAUD, B200 },
5953 	{ TARGET_CBAUD, TARGET_B300, CBAUD, B300 },
5954 	{ TARGET_CBAUD, TARGET_B600, CBAUD, B600 },
5955 	{ TARGET_CBAUD, TARGET_B1200, CBAUD, B1200 },
5956 	{ TARGET_CBAUD, TARGET_B1800, CBAUD, B1800 },
5957 	{ TARGET_CBAUD, TARGET_B2400, CBAUD, B2400 },
5958 	{ TARGET_CBAUD, TARGET_B4800, CBAUD, B4800 },
5959 	{ TARGET_CBAUD, TARGET_B9600, CBAUD, B9600 },
5960 	{ TARGET_CBAUD, TARGET_B19200, CBAUD, B19200 },
5961 	{ TARGET_CBAUD, TARGET_B38400, CBAUD, B38400 },
5962 	{ TARGET_CBAUD, TARGET_B57600, CBAUD, B57600 },
5963 	{ TARGET_CBAUD, TARGET_B115200, CBAUD, B115200 },
5964 	{ TARGET_CBAUD, TARGET_B230400, CBAUD, B230400 },
5965 	{ TARGET_CBAUD, TARGET_B460800, CBAUD, B460800 },
5966 	{ TARGET_CSIZE, TARGET_CS5, CSIZE, CS5 },
5967 	{ TARGET_CSIZE, TARGET_CS6, CSIZE, CS6 },
5968 	{ TARGET_CSIZE, TARGET_CS7, CSIZE, CS7 },
5969 	{ TARGET_CSIZE, TARGET_CS8, CSIZE, CS8 },
5970 	{ TARGET_CSTOPB, TARGET_CSTOPB, CSTOPB, CSTOPB },
5971 	{ TARGET_CREAD, TARGET_CREAD, CREAD, CREAD },
5972 	{ TARGET_PARENB, TARGET_PARENB, PARENB, PARENB },
5973 	{ TARGET_PARODD, TARGET_PARODD, PARODD, PARODD },
5974 	{ TARGET_HUPCL, TARGET_HUPCL, HUPCL, HUPCL },
5975 	{ TARGET_CLOCAL, TARGET_CLOCAL, CLOCAL, CLOCAL },
5976 	{ TARGET_CRTSCTS, TARGET_CRTSCTS, CRTSCTS, CRTSCTS },
5977 	{ 0, 0, 0, 0 }
5978 };
5979 
5980 static const bitmask_transtbl lflag_tbl[] = {
5981   { TARGET_ISIG, TARGET_ISIG, ISIG, ISIG },
5982   { TARGET_ICANON, TARGET_ICANON, ICANON, ICANON },
5983   { TARGET_XCASE, TARGET_XCASE, XCASE, XCASE },
5984   { TARGET_ECHO, TARGET_ECHO, ECHO, ECHO },
5985   { TARGET_ECHOE, TARGET_ECHOE, ECHOE, ECHOE },
5986   { TARGET_ECHOK, TARGET_ECHOK, ECHOK, ECHOK },
5987   { TARGET_ECHONL, TARGET_ECHONL, ECHONL, ECHONL },
5988   { TARGET_NOFLSH, TARGET_NOFLSH, NOFLSH, NOFLSH },
5989   { TARGET_TOSTOP, TARGET_TOSTOP, TOSTOP, TOSTOP },
5990   { TARGET_ECHOCTL, TARGET_ECHOCTL, ECHOCTL, ECHOCTL },
5991   { TARGET_ECHOPRT, TARGET_ECHOPRT, ECHOPRT, ECHOPRT },
5992   { TARGET_ECHOKE, TARGET_ECHOKE, ECHOKE, ECHOKE },
5993   { TARGET_FLUSHO, TARGET_FLUSHO, FLUSHO, FLUSHO },
5994   { TARGET_PENDIN, TARGET_PENDIN, PENDIN, PENDIN },
5995   { TARGET_IEXTEN, TARGET_IEXTEN, IEXTEN, IEXTEN },
5996   { TARGET_EXTPROC, TARGET_EXTPROC, EXTPROC, EXTPROC},
5997   { 0, 0, 0, 0 }
5998 };
5999 
6000 static void target_to_host_termios (void *dst, const void *src)
6001 {
6002     struct host_termios *host = dst;
6003     const struct target_termios *target = src;
6004 
6005     host->c_iflag =
6006         target_to_host_bitmask(tswap32(target->c_iflag), iflag_tbl);
6007     host->c_oflag =
6008         target_to_host_bitmask(tswap32(target->c_oflag), oflag_tbl);
6009     host->c_cflag =
6010         target_to_host_bitmask(tswap32(target->c_cflag), cflag_tbl);
6011     host->c_lflag =
6012         target_to_host_bitmask(tswap32(target->c_lflag), lflag_tbl);
6013     host->c_line = target->c_line;
6014 
6015     memset(host->c_cc, 0, sizeof(host->c_cc));
6016     host->c_cc[VINTR] = target->c_cc[TARGET_VINTR];
6017     host->c_cc[VQUIT] = target->c_cc[TARGET_VQUIT];
6018     host->c_cc[VERASE] = target->c_cc[TARGET_VERASE];
6019     host->c_cc[VKILL] = target->c_cc[TARGET_VKILL];
6020     host->c_cc[VEOF] = target->c_cc[TARGET_VEOF];
6021     host->c_cc[VTIME] = target->c_cc[TARGET_VTIME];
6022     host->c_cc[VMIN] = target->c_cc[TARGET_VMIN];
6023     host->c_cc[VSWTC] = target->c_cc[TARGET_VSWTC];
6024     host->c_cc[VSTART] = target->c_cc[TARGET_VSTART];
6025     host->c_cc[VSTOP] = target->c_cc[TARGET_VSTOP];
6026     host->c_cc[VSUSP] = target->c_cc[TARGET_VSUSP];
6027     host->c_cc[VEOL] = target->c_cc[TARGET_VEOL];
6028     host->c_cc[VREPRINT] = target->c_cc[TARGET_VREPRINT];
6029     host->c_cc[VDISCARD] = target->c_cc[TARGET_VDISCARD];
6030     host->c_cc[VWERASE] = target->c_cc[TARGET_VWERASE];
6031     host->c_cc[VLNEXT] = target->c_cc[TARGET_VLNEXT];
6032     host->c_cc[VEOL2] = target->c_cc[TARGET_VEOL2];
6033 }
6034 
6035 static void host_to_target_termios (void *dst, const void *src)
6036 {
6037     struct target_termios *target = dst;
6038     const struct host_termios *host = src;
6039 
6040     target->c_iflag =
6041         tswap32(host_to_target_bitmask(host->c_iflag, iflag_tbl));
6042     target->c_oflag =
6043         tswap32(host_to_target_bitmask(host->c_oflag, oflag_tbl));
6044     target->c_cflag =
6045         tswap32(host_to_target_bitmask(host->c_cflag, cflag_tbl));
6046     target->c_lflag =
6047         tswap32(host_to_target_bitmask(host->c_lflag, lflag_tbl));
6048     target->c_line = host->c_line;
6049 
6050     memset(target->c_cc, 0, sizeof(target->c_cc));
6051     target->c_cc[TARGET_VINTR] = host->c_cc[VINTR];
6052     target->c_cc[TARGET_VQUIT] = host->c_cc[VQUIT];
6053     target->c_cc[TARGET_VERASE] = host->c_cc[VERASE];
6054     target->c_cc[TARGET_VKILL] = host->c_cc[VKILL];
6055     target->c_cc[TARGET_VEOF] = host->c_cc[VEOF];
6056     target->c_cc[TARGET_VTIME] = host->c_cc[VTIME];
6057     target->c_cc[TARGET_VMIN] = host->c_cc[VMIN];
6058     target->c_cc[TARGET_VSWTC] = host->c_cc[VSWTC];
6059     target->c_cc[TARGET_VSTART] = host->c_cc[VSTART];
6060     target->c_cc[TARGET_VSTOP] = host->c_cc[VSTOP];
6061     target->c_cc[TARGET_VSUSP] = host->c_cc[VSUSP];
6062     target->c_cc[TARGET_VEOL] = host->c_cc[VEOL];
6063     target->c_cc[TARGET_VREPRINT] = host->c_cc[VREPRINT];
6064     target->c_cc[TARGET_VDISCARD] = host->c_cc[VDISCARD];
6065     target->c_cc[TARGET_VWERASE] = host->c_cc[VWERASE];
6066     target->c_cc[TARGET_VLNEXT] = host->c_cc[VLNEXT];
6067     target->c_cc[TARGET_VEOL2] = host->c_cc[VEOL2];
6068 }
6069 
6070 static const StructEntry struct_termios_def = {
6071     .convert = { host_to_target_termios, target_to_host_termios },
6072     .size = { sizeof(struct target_termios), sizeof(struct host_termios) },
6073     .align = { __alignof__(struct target_termios), __alignof__(struct host_termios) },
6074     .print = print_termios,
6075 };
6076 
6077 static const bitmask_transtbl mmap_flags_tbl[] = {
6078     { TARGET_MAP_SHARED, TARGET_MAP_SHARED, MAP_SHARED, MAP_SHARED },
6079     { TARGET_MAP_PRIVATE, TARGET_MAP_PRIVATE, MAP_PRIVATE, MAP_PRIVATE },
6080     { TARGET_MAP_FIXED, TARGET_MAP_FIXED, MAP_FIXED, MAP_FIXED },
6081     { TARGET_MAP_ANONYMOUS, TARGET_MAP_ANONYMOUS,
6082       MAP_ANONYMOUS, MAP_ANONYMOUS },
6083     { TARGET_MAP_GROWSDOWN, TARGET_MAP_GROWSDOWN,
6084       MAP_GROWSDOWN, MAP_GROWSDOWN },
6085     { TARGET_MAP_DENYWRITE, TARGET_MAP_DENYWRITE,
6086       MAP_DENYWRITE, MAP_DENYWRITE },
6087     { TARGET_MAP_EXECUTABLE, TARGET_MAP_EXECUTABLE,
6088       MAP_EXECUTABLE, MAP_EXECUTABLE },
6089     { TARGET_MAP_LOCKED, TARGET_MAP_LOCKED, MAP_LOCKED, MAP_LOCKED },
6090     { TARGET_MAP_NORESERVE, TARGET_MAP_NORESERVE,
6091       MAP_NORESERVE, MAP_NORESERVE },
6092     { TARGET_MAP_HUGETLB, TARGET_MAP_HUGETLB, MAP_HUGETLB, MAP_HUGETLB },
6093     /* MAP_STACK had been ignored by the kernel for quite some time.
6094        Recognize it for the target insofar as we do not want to pass
6095        it through to the host.  */
6096     { TARGET_MAP_STACK, TARGET_MAP_STACK, 0, 0 },
6097     { 0, 0, 0, 0 }
6098 };
6099 
6100 /*
6101  * NOTE: TARGET_ABI32 is defined for TARGET_I386 (but not for TARGET_X86_64)
6102  *       TARGET_I386 is defined if TARGET_X86_64 is defined
6103  */
6104 #if defined(TARGET_I386)
6105 
6106 /* NOTE: there is really one LDT for all the threads */
6107 static uint8_t *ldt_table;
6108 
6109 static abi_long read_ldt(abi_ulong ptr, unsigned long bytecount)
6110 {
6111     int size;
6112     void *p;
6113 
6114     if (!ldt_table)
6115         return 0;
6116     size = TARGET_LDT_ENTRIES * TARGET_LDT_ENTRY_SIZE;
6117     if (size > bytecount)
6118         size = bytecount;
6119     p = lock_user(VERIFY_WRITE, ptr, size, 0);
6120     if (!p)
6121         return -TARGET_EFAULT;
6122     /* ??? Should this by byteswapped?  */
6123     memcpy(p, ldt_table, size);
6124     unlock_user(p, ptr, size);
6125     return size;
6126 }
6127 
6128 /* XXX: add locking support */
6129 static abi_long write_ldt(CPUX86State *env,
6130                           abi_ulong ptr, unsigned long bytecount, int oldmode)
6131 {
6132     struct target_modify_ldt_ldt_s ldt_info;
6133     struct target_modify_ldt_ldt_s *target_ldt_info;
6134     int seg_32bit, contents, read_exec_only, limit_in_pages;
6135     int seg_not_present, useable, lm;
6136     uint32_t *lp, entry_1, entry_2;
6137 
6138     if (bytecount != sizeof(ldt_info))
6139         return -TARGET_EINVAL;
6140     if (!lock_user_struct(VERIFY_READ, target_ldt_info, ptr, 1))
6141         return -TARGET_EFAULT;
6142     ldt_info.entry_number = tswap32(target_ldt_info->entry_number);
6143     ldt_info.base_addr = tswapal(target_ldt_info->base_addr);
6144     ldt_info.limit = tswap32(target_ldt_info->limit);
6145     ldt_info.flags = tswap32(target_ldt_info->flags);
6146     unlock_user_struct(target_ldt_info, ptr, 0);
6147 
6148     if (ldt_info.entry_number >= TARGET_LDT_ENTRIES)
6149         return -TARGET_EINVAL;
6150     seg_32bit = ldt_info.flags & 1;
6151     contents = (ldt_info.flags >> 1) & 3;
6152     read_exec_only = (ldt_info.flags >> 3) & 1;
6153     limit_in_pages = (ldt_info.flags >> 4) & 1;
6154     seg_not_present = (ldt_info.flags >> 5) & 1;
6155     useable = (ldt_info.flags >> 6) & 1;
6156 #ifdef TARGET_ABI32
6157     lm = 0;
6158 #else
6159     lm = (ldt_info.flags >> 7) & 1;
6160 #endif
6161     if (contents == 3) {
6162         if (oldmode)
6163             return -TARGET_EINVAL;
6164         if (seg_not_present == 0)
6165             return -TARGET_EINVAL;
6166     }
6167     /* allocate the LDT */
6168     if (!ldt_table) {
6169         env->ldt.base = target_mmap(0,
6170                                     TARGET_LDT_ENTRIES * TARGET_LDT_ENTRY_SIZE,
6171                                     PROT_READ|PROT_WRITE,
6172                                     MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);
6173         if (env->ldt.base == -1)
6174             return -TARGET_ENOMEM;
6175         memset(g2h_untagged(env->ldt.base), 0,
6176                TARGET_LDT_ENTRIES * TARGET_LDT_ENTRY_SIZE);
6177         env->ldt.limit = 0xffff;
6178         ldt_table = g2h_untagged(env->ldt.base);
6179     }
6180 
6181     /* NOTE: same code as Linux kernel */
6182     /* Allow LDTs to be cleared by the user. */
6183     if (ldt_info.base_addr == 0 && ldt_info.limit == 0) {
6184         if (oldmode ||
6185             (contents == 0		&&
6186              read_exec_only == 1	&&
6187              seg_32bit == 0		&&
6188              limit_in_pages == 0	&&
6189              seg_not_present == 1	&&
6190              useable == 0 )) {
6191             entry_1 = 0;
6192             entry_2 = 0;
6193             goto install;
6194         }
6195     }
6196 
6197     entry_1 = ((ldt_info.base_addr & 0x0000ffff) << 16) |
6198         (ldt_info.limit & 0x0ffff);
6199     entry_2 = (ldt_info.base_addr & 0xff000000) |
6200         ((ldt_info.base_addr & 0x00ff0000) >> 16) |
6201         (ldt_info.limit & 0xf0000) |
6202         ((read_exec_only ^ 1) << 9) |
6203         (contents << 10) |
6204         ((seg_not_present ^ 1) << 15) |
6205         (seg_32bit << 22) |
6206         (limit_in_pages << 23) |
6207         (lm << 21) |
6208         0x7000;
6209     if (!oldmode)
6210         entry_2 |= (useable << 20);
6211 
6212     /* Install the new entry ...  */
6213 install:
6214     lp = (uint32_t *)(ldt_table + (ldt_info.entry_number << 3));
6215     lp[0] = tswap32(entry_1);
6216     lp[1] = tswap32(entry_2);
6217     return 0;
6218 }
6219 
6220 /* specific and weird i386 syscalls */
6221 static abi_long do_modify_ldt(CPUX86State *env, int func, abi_ulong ptr,
6222                               unsigned long bytecount)
6223 {
6224     abi_long ret;
6225 
6226     switch (func) {
6227     case 0:
6228         ret = read_ldt(ptr, bytecount);
6229         break;
6230     case 1:
6231         ret = write_ldt(env, ptr, bytecount, 1);
6232         break;
6233     case 0x11:
6234         ret = write_ldt(env, ptr, bytecount, 0);
6235         break;
6236     default:
6237         ret = -TARGET_ENOSYS;
6238         break;
6239     }
6240     return ret;
6241 }
6242 
6243 #if defined(TARGET_ABI32)
6244 abi_long do_set_thread_area(CPUX86State *env, abi_ulong ptr)
6245 {
6246     uint64_t *gdt_table = g2h_untagged(env->gdt.base);
6247     struct target_modify_ldt_ldt_s ldt_info;
6248     struct target_modify_ldt_ldt_s *target_ldt_info;
6249     int seg_32bit, contents, read_exec_only, limit_in_pages;
6250     int seg_not_present, useable, lm;
6251     uint32_t *lp, entry_1, entry_2;
6252     int i;
6253 
6254     lock_user_struct(VERIFY_WRITE, target_ldt_info, ptr, 1);
6255     if (!target_ldt_info)
6256         return -TARGET_EFAULT;
6257     ldt_info.entry_number = tswap32(target_ldt_info->entry_number);
6258     ldt_info.base_addr = tswapal(target_ldt_info->base_addr);
6259     ldt_info.limit = tswap32(target_ldt_info->limit);
6260     ldt_info.flags = tswap32(target_ldt_info->flags);
6261     if (ldt_info.entry_number == -1) {
6262         for (i=TARGET_GDT_ENTRY_TLS_MIN; i<=TARGET_GDT_ENTRY_TLS_MAX; i++) {
6263             if (gdt_table[i] == 0) {
6264                 ldt_info.entry_number = i;
6265                 target_ldt_info->entry_number = tswap32(i);
6266                 break;
6267             }
6268         }
6269     }
6270     unlock_user_struct(target_ldt_info, ptr, 1);
6271 
6272     if (ldt_info.entry_number < TARGET_GDT_ENTRY_TLS_MIN ||
6273         ldt_info.entry_number > TARGET_GDT_ENTRY_TLS_MAX)
6274            return -TARGET_EINVAL;
6275     seg_32bit = ldt_info.flags & 1;
6276     contents = (ldt_info.flags >> 1) & 3;
6277     read_exec_only = (ldt_info.flags >> 3) & 1;
6278     limit_in_pages = (ldt_info.flags >> 4) & 1;
6279     seg_not_present = (ldt_info.flags >> 5) & 1;
6280     useable = (ldt_info.flags >> 6) & 1;
6281 #ifdef TARGET_ABI32
6282     lm = 0;
6283 #else
6284     lm = (ldt_info.flags >> 7) & 1;
6285 #endif
6286 
6287     if (contents == 3) {
6288         if (seg_not_present == 0)
6289             return -TARGET_EINVAL;
6290     }
6291 
6292     /* NOTE: same code as Linux kernel */
6293     /* Allow LDTs to be cleared by the user. */
6294     if (ldt_info.base_addr == 0 && ldt_info.limit == 0) {
6295         if ((contents == 0             &&
6296              read_exec_only == 1       &&
6297              seg_32bit == 0            &&
6298              limit_in_pages == 0       &&
6299              seg_not_present == 1      &&
6300              useable == 0 )) {
6301             entry_1 = 0;
6302             entry_2 = 0;
6303             goto install;
6304         }
6305     }
6306 
6307     entry_1 = ((ldt_info.base_addr & 0x0000ffff) << 16) |
6308         (ldt_info.limit & 0x0ffff);
6309     entry_2 = (ldt_info.base_addr & 0xff000000) |
6310         ((ldt_info.base_addr & 0x00ff0000) >> 16) |
6311         (ldt_info.limit & 0xf0000) |
6312         ((read_exec_only ^ 1) << 9) |
6313         (contents << 10) |
6314         ((seg_not_present ^ 1) << 15) |
6315         (seg_32bit << 22) |
6316         (limit_in_pages << 23) |
6317         (useable << 20) |
6318         (lm << 21) |
6319         0x7000;
6320 
6321     /* Install the new entry ...  */
6322 install:
6323     lp = (uint32_t *)(gdt_table + ldt_info.entry_number);
6324     lp[0] = tswap32(entry_1);
6325     lp[1] = tswap32(entry_2);
6326     return 0;
6327 }
6328 
6329 static abi_long do_get_thread_area(CPUX86State *env, abi_ulong ptr)
6330 {
6331     struct target_modify_ldt_ldt_s *target_ldt_info;
6332     uint64_t *gdt_table = g2h_untagged(env->gdt.base);
6333     uint32_t base_addr, limit, flags;
6334     int seg_32bit, contents, read_exec_only, limit_in_pages, idx;
6335     int seg_not_present, useable, lm;
6336     uint32_t *lp, entry_1, entry_2;
6337 
6338     lock_user_struct(VERIFY_WRITE, target_ldt_info, ptr, 1);
6339     if (!target_ldt_info)
6340         return -TARGET_EFAULT;
6341     idx = tswap32(target_ldt_info->entry_number);
6342     if (idx < TARGET_GDT_ENTRY_TLS_MIN ||
6343         idx > TARGET_GDT_ENTRY_TLS_MAX) {
6344         unlock_user_struct(target_ldt_info, ptr, 1);
6345         return -TARGET_EINVAL;
6346     }
6347     lp = (uint32_t *)(gdt_table + idx);
6348     entry_1 = tswap32(lp[0]);
6349     entry_2 = tswap32(lp[1]);
6350 
6351     read_exec_only = ((entry_2 >> 9) & 1) ^ 1;
6352     contents = (entry_2 >> 10) & 3;
6353     seg_not_present = ((entry_2 >> 15) & 1) ^ 1;
6354     seg_32bit = (entry_2 >> 22) & 1;
6355     limit_in_pages = (entry_2 >> 23) & 1;
6356     useable = (entry_2 >> 20) & 1;
6357 #ifdef TARGET_ABI32
6358     lm = 0;
6359 #else
6360     lm = (entry_2 >> 21) & 1;
6361 #endif
6362     flags = (seg_32bit << 0) | (contents << 1) |
6363         (read_exec_only << 3) | (limit_in_pages << 4) |
6364         (seg_not_present << 5) | (useable << 6) | (lm << 7);
6365     limit = (entry_1 & 0xffff) | (entry_2  & 0xf0000);
6366     base_addr = (entry_1 >> 16) |
6367         (entry_2 & 0xff000000) |
6368         ((entry_2 & 0xff) << 16);
6369     target_ldt_info->base_addr = tswapal(base_addr);
6370     target_ldt_info->limit = tswap32(limit);
6371     target_ldt_info->flags = tswap32(flags);
6372     unlock_user_struct(target_ldt_info, ptr, 1);
6373     return 0;
6374 }
6375 
6376 abi_long do_arch_prctl(CPUX86State *env, int code, abi_ulong addr)
6377 {
6378     return -TARGET_ENOSYS;
6379 }
6380 #else
6381 abi_long do_arch_prctl(CPUX86State *env, int code, abi_ulong addr)
6382 {
6383     abi_long ret = 0;
6384     abi_ulong val;
6385     int idx;
6386 
6387     switch(code) {
6388     case TARGET_ARCH_SET_GS:
6389     case TARGET_ARCH_SET_FS:
6390         if (code == TARGET_ARCH_SET_GS)
6391             idx = R_GS;
6392         else
6393             idx = R_FS;
6394         cpu_x86_load_seg(env, idx, 0);
6395         env->segs[idx].base = addr;
6396         break;
6397     case TARGET_ARCH_GET_GS:
6398     case TARGET_ARCH_GET_FS:
6399         if (code == TARGET_ARCH_GET_GS)
6400             idx = R_GS;
6401         else
6402             idx = R_FS;
6403         val = env->segs[idx].base;
6404         if (put_user(val, addr, abi_ulong))
6405             ret = -TARGET_EFAULT;
6406         break;
6407     default:
6408         ret = -TARGET_EINVAL;
6409         break;
6410     }
6411     return ret;
6412 }
6413 #endif /* defined(TARGET_ABI32 */
6414 
6415 #endif /* defined(TARGET_I386) */
6416 
6417 #define NEW_STACK_SIZE 0x40000
6418 
6419 
6420 static pthread_mutex_t clone_lock = PTHREAD_MUTEX_INITIALIZER;
6421 typedef struct {
6422     CPUArchState *env;
6423     pthread_mutex_t mutex;
6424     pthread_cond_t cond;
6425     pthread_t thread;
6426     uint32_t tid;
6427     abi_ulong child_tidptr;
6428     abi_ulong parent_tidptr;
6429     sigset_t sigmask;
6430 } new_thread_info;
6431 
6432 static void *clone_func(void *arg)
6433 {
6434     new_thread_info *info = arg;
6435     CPUArchState *env;
6436     CPUState *cpu;
6437     TaskState *ts;
6438 
6439     rcu_register_thread();
6440     tcg_register_thread();
6441     env = info->env;
6442     cpu = env_cpu(env);
6443     thread_cpu = cpu;
6444     ts = (TaskState *)cpu->opaque;
6445     info->tid = sys_gettid();
6446     task_settid(ts);
6447     if (info->child_tidptr)
6448         put_user_u32(info->tid, info->child_tidptr);
6449     if (info->parent_tidptr)
6450         put_user_u32(info->tid, info->parent_tidptr);
6451     qemu_guest_random_seed_thread_part2(cpu->random_seed);
6452     /* Enable signals.  */
6453     sigprocmask(SIG_SETMASK, &info->sigmask, NULL);
6454     /* Signal to the parent that we're ready.  */
6455     pthread_mutex_lock(&info->mutex);
6456     pthread_cond_broadcast(&info->cond);
6457     pthread_mutex_unlock(&info->mutex);
6458     /* Wait until the parent has finished initializing the tls state.  */
6459     pthread_mutex_lock(&clone_lock);
6460     pthread_mutex_unlock(&clone_lock);
6461     cpu_loop(env);
6462     /* never exits */
6463     return NULL;
6464 }
6465 
6466 /* do_fork() Must return host values and target errnos (unlike most
6467    do_*() functions). */
6468 static int do_fork(CPUArchState *env, unsigned int flags, abi_ulong newsp,
6469                    abi_ulong parent_tidptr, target_ulong newtls,
6470                    abi_ulong child_tidptr)
6471 {
6472     CPUState *cpu = env_cpu(env);
6473     int ret;
6474     TaskState *ts;
6475     CPUState *new_cpu;
6476     CPUArchState *new_env;
6477     sigset_t sigmask;
6478 
6479     flags &= ~CLONE_IGNORED_FLAGS;
6480 
6481     /* Emulate vfork() with fork() */
6482     if (flags & CLONE_VFORK)
6483         flags &= ~(CLONE_VFORK | CLONE_VM);
6484 
6485     if (flags & CLONE_VM) {
6486         TaskState *parent_ts = (TaskState *)cpu->opaque;
6487         new_thread_info info;
6488         pthread_attr_t attr;
6489 
6490         if (((flags & CLONE_THREAD_FLAGS) != CLONE_THREAD_FLAGS) ||
6491             (flags & CLONE_INVALID_THREAD_FLAGS)) {
6492             return -TARGET_EINVAL;
6493         }
6494 
6495         ts = g_new0(TaskState, 1);
6496         init_task_state(ts);
6497 
6498         /* Grab a mutex so that thread setup appears atomic.  */
6499         pthread_mutex_lock(&clone_lock);
6500 
6501         /*
6502          * If this is our first additional thread, we need to ensure we
6503          * generate code for parallel execution and flush old translations.
6504          * Do this now so that the copy gets CF_PARALLEL too.
6505          */
6506         if (!(cpu->tcg_cflags & CF_PARALLEL)) {
6507             cpu->tcg_cflags |= CF_PARALLEL;
6508             tb_flush(cpu);
6509         }
6510 
6511         /* we create a new CPU instance. */
6512         new_env = cpu_copy(env);
6513         /* Init regs that differ from the parent.  */
6514         cpu_clone_regs_child(new_env, newsp, flags);
6515         cpu_clone_regs_parent(env, flags);
6516         new_cpu = env_cpu(new_env);
6517         new_cpu->opaque = ts;
6518         ts->bprm = parent_ts->bprm;
6519         ts->info = parent_ts->info;
6520         ts->signal_mask = parent_ts->signal_mask;
6521 
6522         if (flags & CLONE_CHILD_CLEARTID) {
6523             ts->child_tidptr = child_tidptr;
6524         }
6525 
6526         if (flags & CLONE_SETTLS) {
6527             cpu_set_tls (new_env, newtls);
6528         }
6529 
6530         memset(&info, 0, sizeof(info));
6531         pthread_mutex_init(&info.mutex, NULL);
6532         pthread_mutex_lock(&info.mutex);
6533         pthread_cond_init(&info.cond, NULL);
6534         info.env = new_env;
6535         if (flags & CLONE_CHILD_SETTID) {
6536             info.child_tidptr = child_tidptr;
6537         }
6538         if (flags & CLONE_PARENT_SETTID) {
6539             info.parent_tidptr = parent_tidptr;
6540         }
6541 
6542         ret = pthread_attr_init(&attr);
6543         ret = pthread_attr_setstacksize(&attr, NEW_STACK_SIZE);
6544         ret = pthread_attr_setdetachstate(&attr, PTHREAD_CREATE_DETACHED);
6545         /* It is not safe to deliver signals until the child has finished
6546            initializing, so temporarily block all signals.  */
6547         sigfillset(&sigmask);
6548         sigprocmask(SIG_BLOCK, &sigmask, &info.sigmask);
6549         cpu->random_seed = qemu_guest_random_seed_thread_part1();
6550 
6551         ret = pthread_create(&info.thread, &attr, clone_func, &info);
6552         /* TODO: Free new CPU state if thread creation failed.  */
6553 
6554         sigprocmask(SIG_SETMASK, &info.sigmask, NULL);
6555         pthread_attr_destroy(&attr);
6556         if (ret == 0) {
6557             /* Wait for the child to initialize.  */
6558             pthread_cond_wait(&info.cond, &info.mutex);
6559             ret = info.tid;
6560         } else {
6561             ret = -1;
6562         }
6563         pthread_mutex_unlock(&info.mutex);
6564         pthread_cond_destroy(&info.cond);
6565         pthread_mutex_destroy(&info.mutex);
6566         pthread_mutex_unlock(&clone_lock);
6567     } else {
6568         /* if no CLONE_VM, we consider it is a fork */
6569         if (flags & CLONE_INVALID_FORK_FLAGS) {
6570             return -TARGET_EINVAL;
6571         }
6572 
6573         /* We can't support custom termination signals */
6574         if ((flags & CSIGNAL) != TARGET_SIGCHLD) {
6575             return -TARGET_EINVAL;
6576         }
6577 
6578         if (block_signals()) {
6579             return -TARGET_ERESTARTSYS;
6580         }
6581 
6582         fork_start();
6583         ret = fork();
6584         if (ret == 0) {
6585             /* Child Process.  */
6586             cpu_clone_regs_child(env, newsp, flags);
6587             fork_end(1);
6588             /* There is a race condition here.  The parent process could
6589                theoretically read the TID in the child process before the child
6590                tid is set.  This would require using either ptrace
6591                (not implemented) or having *_tidptr to point at a shared memory
6592                mapping.  We can't repeat the spinlock hack used above because
6593                the child process gets its own copy of the lock.  */
6594             if (flags & CLONE_CHILD_SETTID)
6595                 put_user_u32(sys_gettid(), child_tidptr);
6596             if (flags & CLONE_PARENT_SETTID)
6597                 put_user_u32(sys_gettid(), parent_tidptr);
6598             ts = (TaskState *)cpu->opaque;
6599             if (flags & CLONE_SETTLS)
6600                 cpu_set_tls (env, newtls);
6601             if (flags & CLONE_CHILD_CLEARTID)
6602                 ts->child_tidptr = child_tidptr;
6603         } else {
6604             cpu_clone_regs_parent(env, flags);
6605             fork_end(0);
6606         }
6607     }
6608     return ret;
6609 }
6610 
6611 /* warning : doesn't handle linux specific flags... */
6612 static int target_to_host_fcntl_cmd(int cmd)
6613 {
6614     int ret;
6615 
6616     switch(cmd) {
6617     case TARGET_F_DUPFD:
6618     case TARGET_F_GETFD:
6619     case TARGET_F_SETFD:
6620     case TARGET_F_GETFL:
6621     case TARGET_F_SETFL:
6622     case TARGET_F_OFD_GETLK:
6623     case TARGET_F_OFD_SETLK:
6624     case TARGET_F_OFD_SETLKW:
6625         ret = cmd;
6626         break;
6627     case TARGET_F_GETLK:
6628         ret = F_GETLK64;
6629         break;
6630     case TARGET_F_SETLK:
6631         ret = F_SETLK64;
6632         break;
6633     case TARGET_F_SETLKW:
6634         ret = F_SETLKW64;
6635         break;
6636     case TARGET_F_GETOWN:
6637         ret = F_GETOWN;
6638         break;
6639     case TARGET_F_SETOWN:
6640         ret = F_SETOWN;
6641         break;
6642     case TARGET_F_GETSIG:
6643         ret = F_GETSIG;
6644         break;
6645     case TARGET_F_SETSIG:
6646         ret = F_SETSIG;
6647         break;
6648 #if TARGET_ABI_BITS == 32
6649     case TARGET_F_GETLK64:
6650         ret = F_GETLK64;
6651         break;
6652     case TARGET_F_SETLK64:
6653         ret = F_SETLK64;
6654         break;
6655     case TARGET_F_SETLKW64:
6656         ret = F_SETLKW64;
6657         break;
6658 #endif
6659     case TARGET_F_SETLEASE:
6660         ret = F_SETLEASE;
6661         break;
6662     case TARGET_F_GETLEASE:
6663         ret = F_GETLEASE;
6664         break;
6665 #ifdef F_DUPFD_CLOEXEC
6666     case TARGET_F_DUPFD_CLOEXEC:
6667         ret = F_DUPFD_CLOEXEC;
6668         break;
6669 #endif
6670     case TARGET_F_NOTIFY:
6671         ret = F_NOTIFY;
6672         break;
6673 #ifdef F_GETOWN_EX
6674     case TARGET_F_GETOWN_EX:
6675         ret = F_GETOWN_EX;
6676         break;
6677 #endif
6678 #ifdef F_SETOWN_EX
6679     case TARGET_F_SETOWN_EX:
6680         ret = F_SETOWN_EX;
6681         break;
6682 #endif
6683 #ifdef F_SETPIPE_SZ
6684     case TARGET_F_SETPIPE_SZ:
6685         ret = F_SETPIPE_SZ;
6686         break;
6687     case TARGET_F_GETPIPE_SZ:
6688         ret = F_GETPIPE_SZ;
6689         break;
6690 #endif
6691 #ifdef F_ADD_SEALS
6692     case TARGET_F_ADD_SEALS:
6693         ret = F_ADD_SEALS;
6694         break;
6695     case TARGET_F_GET_SEALS:
6696         ret = F_GET_SEALS;
6697         break;
6698 #endif
6699     default:
6700         ret = -TARGET_EINVAL;
6701         break;
6702     }
6703 
6704 #if defined(__powerpc64__)
6705     /* On PPC64, glibc headers has the F_*LK* defined to 12, 13 and 14 and
6706      * is not supported by kernel. The glibc fcntl call actually adjusts
6707      * them to 5, 6 and 7 before making the syscall(). Since we make the
6708      * syscall directly, adjust to what is supported by the kernel.
6709      */
6710     if (ret >= F_GETLK64 && ret <= F_SETLKW64) {
6711         ret -= F_GETLK64 - 5;
6712     }
6713 #endif
6714 
6715     return ret;
6716 }
6717 
6718 #define FLOCK_TRANSTBL \
6719     switch (type) { \
6720     TRANSTBL_CONVERT(F_RDLCK); \
6721     TRANSTBL_CONVERT(F_WRLCK); \
6722     TRANSTBL_CONVERT(F_UNLCK); \
6723     }
6724 
6725 static int target_to_host_flock(int type)
6726 {
6727 #define TRANSTBL_CONVERT(a) case TARGET_##a: return a
6728     FLOCK_TRANSTBL
6729 #undef  TRANSTBL_CONVERT
6730     return -TARGET_EINVAL;
6731 }
6732 
6733 static int host_to_target_flock(int type)
6734 {
6735 #define TRANSTBL_CONVERT(a) case a: return TARGET_##a
6736     FLOCK_TRANSTBL
6737 #undef  TRANSTBL_CONVERT
6738     /* if we don't know how to convert the value coming
6739      * from the host we copy to the target field as-is
6740      */
6741     return type;
6742 }
6743 
6744 static inline abi_long copy_from_user_flock(struct flock64 *fl,
6745                                             abi_ulong target_flock_addr)
6746 {
6747     struct target_flock *target_fl;
6748     int l_type;
6749 
6750     if (!lock_user_struct(VERIFY_READ, target_fl, target_flock_addr, 1)) {
6751         return -TARGET_EFAULT;
6752     }
6753 
6754     __get_user(l_type, &target_fl->l_type);
6755     l_type = target_to_host_flock(l_type);
6756     if (l_type < 0) {
6757         return l_type;
6758     }
6759     fl->l_type = l_type;
6760     __get_user(fl->l_whence, &target_fl->l_whence);
6761     __get_user(fl->l_start, &target_fl->l_start);
6762     __get_user(fl->l_len, &target_fl->l_len);
6763     __get_user(fl->l_pid, &target_fl->l_pid);
6764     unlock_user_struct(target_fl, target_flock_addr, 0);
6765     return 0;
6766 }
6767 
6768 static inline abi_long copy_to_user_flock(abi_ulong target_flock_addr,
6769                                           const struct flock64 *fl)
6770 {
6771     struct target_flock *target_fl;
6772     short l_type;
6773 
6774     if (!lock_user_struct(VERIFY_WRITE, target_fl, target_flock_addr, 0)) {
6775         return -TARGET_EFAULT;
6776     }
6777 
6778     l_type = host_to_target_flock(fl->l_type);
6779     __put_user(l_type, &target_fl->l_type);
6780     __put_user(fl->l_whence, &target_fl->l_whence);
6781     __put_user(fl->l_start, &target_fl->l_start);
6782     __put_user(fl->l_len, &target_fl->l_len);
6783     __put_user(fl->l_pid, &target_fl->l_pid);
6784     unlock_user_struct(target_fl, target_flock_addr, 1);
6785     return 0;
6786 }
6787 
6788 typedef abi_long from_flock64_fn(struct flock64 *fl, abi_ulong target_addr);
6789 typedef abi_long to_flock64_fn(abi_ulong target_addr, const struct flock64 *fl);
6790 
6791 #if defined(TARGET_ARM) && TARGET_ABI_BITS == 32
6792 static inline abi_long copy_from_user_oabi_flock64(struct flock64 *fl,
6793                                                    abi_ulong target_flock_addr)
6794 {
6795     struct target_oabi_flock64 *target_fl;
6796     int l_type;
6797 
6798     if (!lock_user_struct(VERIFY_READ, target_fl, target_flock_addr, 1)) {
6799         return -TARGET_EFAULT;
6800     }
6801 
6802     __get_user(l_type, &target_fl->l_type);
6803     l_type = target_to_host_flock(l_type);
6804     if (l_type < 0) {
6805         return l_type;
6806     }
6807     fl->l_type = l_type;
6808     __get_user(fl->l_whence, &target_fl->l_whence);
6809     __get_user(fl->l_start, &target_fl->l_start);
6810     __get_user(fl->l_len, &target_fl->l_len);
6811     __get_user(fl->l_pid, &target_fl->l_pid);
6812     unlock_user_struct(target_fl, target_flock_addr, 0);
6813     return 0;
6814 }
6815 
6816 static inline abi_long copy_to_user_oabi_flock64(abi_ulong target_flock_addr,
6817                                                  const struct flock64 *fl)
6818 {
6819     struct target_oabi_flock64 *target_fl;
6820     short l_type;
6821 
6822     if (!lock_user_struct(VERIFY_WRITE, target_fl, target_flock_addr, 0)) {
6823         return -TARGET_EFAULT;
6824     }
6825 
6826     l_type = host_to_target_flock(fl->l_type);
6827     __put_user(l_type, &target_fl->l_type);
6828     __put_user(fl->l_whence, &target_fl->l_whence);
6829     __put_user(fl->l_start, &target_fl->l_start);
6830     __put_user(fl->l_len, &target_fl->l_len);
6831     __put_user(fl->l_pid, &target_fl->l_pid);
6832     unlock_user_struct(target_fl, target_flock_addr, 1);
6833     return 0;
6834 }
6835 #endif
6836 
6837 static inline abi_long copy_from_user_flock64(struct flock64 *fl,
6838                                               abi_ulong target_flock_addr)
6839 {
6840     struct target_flock64 *target_fl;
6841     int l_type;
6842 
6843     if (!lock_user_struct(VERIFY_READ, target_fl, target_flock_addr, 1)) {
6844         return -TARGET_EFAULT;
6845     }
6846 
6847     __get_user(l_type, &target_fl->l_type);
6848     l_type = target_to_host_flock(l_type);
6849     if (l_type < 0) {
6850         return l_type;
6851     }
6852     fl->l_type = l_type;
6853     __get_user(fl->l_whence, &target_fl->l_whence);
6854     __get_user(fl->l_start, &target_fl->l_start);
6855     __get_user(fl->l_len, &target_fl->l_len);
6856     __get_user(fl->l_pid, &target_fl->l_pid);
6857     unlock_user_struct(target_fl, target_flock_addr, 0);
6858     return 0;
6859 }
6860 
6861 static inline abi_long copy_to_user_flock64(abi_ulong target_flock_addr,
6862                                             const struct flock64 *fl)
6863 {
6864     struct target_flock64 *target_fl;
6865     short l_type;
6866 
6867     if (!lock_user_struct(VERIFY_WRITE, target_fl, target_flock_addr, 0)) {
6868         return -TARGET_EFAULT;
6869     }
6870 
6871     l_type = host_to_target_flock(fl->l_type);
6872     __put_user(l_type, &target_fl->l_type);
6873     __put_user(fl->l_whence, &target_fl->l_whence);
6874     __put_user(fl->l_start, &target_fl->l_start);
6875     __put_user(fl->l_len, &target_fl->l_len);
6876     __put_user(fl->l_pid, &target_fl->l_pid);
6877     unlock_user_struct(target_fl, target_flock_addr, 1);
6878     return 0;
6879 }
6880 
6881 static abi_long do_fcntl(int fd, int cmd, abi_ulong arg)
6882 {
6883     struct flock64 fl64;
6884 #ifdef F_GETOWN_EX
6885     struct f_owner_ex fox;
6886     struct target_f_owner_ex *target_fox;
6887 #endif
6888     abi_long ret;
6889     int host_cmd = target_to_host_fcntl_cmd(cmd);
6890 
6891     if (host_cmd == -TARGET_EINVAL)
6892 	    return host_cmd;
6893 
6894     switch(cmd) {
6895     case TARGET_F_GETLK:
6896         ret = copy_from_user_flock(&fl64, arg);
6897         if (ret) {
6898             return ret;
6899         }
6900         ret = get_errno(safe_fcntl(fd, host_cmd, &fl64));
6901         if (ret == 0) {
6902             ret = copy_to_user_flock(arg, &fl64);
6903         }
6904         break;
6905 
6906     case TARGET_F_SETLK:
6907     case TARGET_F_SETLKW:
6908         ret = copy_from_user_flock(&fl64, arg);
6909         if (ret) {
6910             return ret;
6911         }
6912         ret = get_errno(safe_fcntl(fd, host_cmd, &fl64));
6913         break;
6914 
6915     case TARGET_F_GETLK64:
6916     case TARGET_F_OFD_GETLK:
6917         ret = copy_from_user_flock64(&fl64, arg);
6918         if (ret) {
6919             return ret;
6920         }
6921         ret = get_errno(safe_fcntl(fd, host_cmd, &fl64));
6922         if (ret == 0) {
6923             ret = copy_to_user_flock64(arg, &fl64);
6924         }
6925         break;
6926     case TARGET_F_SETLK64:
6927     case TARGET_F_SETLKW64:
6928     case TARGET_F_OFD_SETLK:
6929     case TARGET_F_OFD_SETLKW:
6930         ret = copy_from_user_flock64(&fl64, arg);
6931         if (ret) {
6932             return ret;
6933         }
6934         ret = get_errno(safe_fcntl(fd, host_cmd, &fl64));
6935         break;
6936 
6937     case TARGET_F_GETFL:
6938         ret = get_errno(safe_fcntl(fd, host_cmd, arg));
6939         if (ret >= 0) {
6940             ret = host_to_target_bitmask(ret, fcntl_flags_tbl);
6941         }
6942         break;
6943 
6944     case TARGET_F_SETFL:
6945         ret = get_errno(safe_fcntl(fd, host_cmd,
6946                                    target_to_host_bitmask(arg,
6947                                                           fcntl_flags_tbl)));
6948         break;
6949 
6950 #ifdef F_GETOWN_EX
6951     case TARGET_F_GETOWN_EX:
6952         ret = get_errno(safe_fcntl(fd, host_cmd, &fox));
6953         if (ret >= 0) {
6954             if (!lock_user_struct(VERIFY_WRITE, target_fox, arg, 0))
6955                 return -TARGET_EFAULT;
6956             target_fox->type = tswap32(fox.type);
6957             target_fox->pid = tswap32(fox.pid);
6958             unlock_user_struct(target_fox, arg, 1);
6959         }
6960         break;
6961 #endif
6962 
6963 #ifdef F_SETOWN_EX
6964     case TARGET_F_SETOWN_EX:
6965         if (!lock_user_struct(VERIFY_READ, target_fox, arg, 1))
6966             return -TARGET_EFAULT;
6967         fox.type = tswap32(target_fox->type);
6968         fox.pid = tswap32(target_fox->pid);
6969         unlock_user_struct(target_fox, arg, 0);
6970         ret = get_errno(safe_fcntl(fd, host_cmd, &fox));
6971         break;
6972 #endif
6973 
6974     case TARGET_F_SETSIG:
6975         ret = get_errno(safe_fcntl(fd, host_cmd, target_to_host_signal(arg)));
6976         break;
6977 
6978     case TARGET_F_GETSIG:
6979         ret = host_to_target_signal(get_errno(safe_fcntl(fd, host_cmd, arg)));
6980         break;
6981 
6982     case TARGET_F_SETOWN:
6983     case TARGET_F_GETOWN:
6984     case TARGET_F_SETLEASE:
6985     case TARGET_F_GETLEASE:
6986     case TARGET_F_SETPIPE_SZ:
6987     case TARGET_F_GETPIPE_SZ:
6988     case TARGET_F_ADD_SEALS:
6989     case TARGET_F_GET_SEALS:
6990         ret = get_errno(safe_fcntl(fd, host_cmd, arg));
6991         break;
6992 
6993     default:
6994         ret = get_errno(safe_fcntl(fd, cmd, arg));
6995         break;
6996     }
6997     return ret;
6998 }
6999 
7000 #ifdef USE_UID16
7001 
7002 static inline int high2lowuid(int uid)
7003 {
7004     if (uid > 65535)
7005         return 65534;
7006     else
7007         return uid;
7008 }
7009 
7010 static inline int high2lowgid(int gid)
7011 {
7012     if (gid > 65535)
7013         return 65534;
7014     else
7015         return gid;
7016 }
7017 
7018 static inline int low2highuid(int uid)
7019 {
7020     if ((int16_t)uid == -1)
7021         return -1;
7022     else
7023         return uid;
7024 }
7025 
7026 static inline int low2highgid(int gid)
7027 {
7028     if ((int16_t)gid == -1)
7029         return -1;
7030     else
7031         return gid;
7032 }
7033 static inline int tswapid(int id)
7034 {
7035     return tswap16(id);
7036 }
7037 
7038 #define put_user_id(x, gaddr) put_user_u16(x, gaddr)
7039 
7040 #else /* !USE_UID16 */
7041 static inline int high2lowuid(int uid)
7042 {
7043     return uid;
7044 }
7045 static inline int high2lowgid(int gid)
7046 {
7047     return gid;
7048 }
7049 static inline int low2highuid(int uid)
7050 {
7051     return uid;
7052 }
7053 static inline int low2highgid(int gid)
7054 {
7055     return gid;
7056 }
7057 static inline int tswapid(int id)
7058 {
7059     return tswap32(id);
7060 }
7061 
7062 #define put_user_id(x, gaddr) put_user_u32(x, gaddr)
7063 
7064 #endif /* USE_UID16 */
7065 
7066 /* We must do direct syscalls for setting UID/GID, because we want to
7067  * implement the Linux system call semantics of "change only for this thread",
7068  * not the libc/POSIX semantics of "change for all threads in process".
7069  * (See http://ewontfix.com/17/ for more details.)
7070  * We use the 32-bit version of the syscalls if present; if it is not
7071  * then either the host architecture supports 32-bit UIDs natively with
7072  * the standard syscall, or the 16-bit UID is the best we can do.
7073  */
7074 #ifdef __NR_setuid32
7075 #define __NR_sys_setuid __NR_setuid32
7076 #else
7077 #define __NR_sys_setuid __NR_setuid
7078 #endif
7079 #ifdef __NR_setgid32
7080 #define __NR_sys_setgid __NR_setgid32
7081 #else
7082 #define __NR_sys_setgid __NR_setgid
7083 #endif
7084 #ifdef __NR_setresuid32
7085 #define __NR_sys_setresuid __NR_setresuid32
7086 #else
7087 #define __NR_sys_setresuid __NR_setresuid
7088 #endif
7089 #ifdef __NR_setresgid32
7090 #define __NR_sys_setresgid __NR_setresgid32
7091 #else
7092 #define __NR_sys_setresgid __NR_setresgid
7093 #endif
7094 
7095 _syscall1(int, sys_setuid, uid_t, uid)
7096 _syscall1(int, sys_setgid, gid_t, gid)
7097 _syscall3(int, sys_setresuid, uid_t, ruid, uid_t, euid, uid_t, suid)
7098 _syscall3(int, sys_setresgid, gid_t, rgid, gid_t, egid, gid_t, sgid)
7099 
7100 void syscall_init(void)
7101 {
7102     IOCTLEntry *ie;
7103     const argtype *arg_type;
7104     int size;
7105     int i;
7106 
7107     thunk_init(STRUCT_MAX);
7108 
7109 #define STRUCT(name, ...) thunk_register_struct(STRUCT_ ## name, #name, struct_ ## name ## _def);
7110 #define STRUCT_SPECIAL(name) thunk_register_struct_direct(STRUCT_ ## name, #name, &struct_ ## name ## _def);
7111 #include "syscall_types.h"
7112 #undef STRUCT
7113 #undef STRUCT_SPECIAL
7114 
7115     /* Build target_to_host_errno_table[] table from
7116      * host_to_target_errno_table[]. */
7117     for (i = 0; i < ERRNO_TABLE_SIZE; i++) {
7118         target_to_host_errno_table[host_to_target_errno_table[i]] = i;
7119     }
7120 
7121     /* we patch the ioctl size if necessary. We rely on the fact that
7122        no ioctl has all the bits at '1' in the size field */
7123     ie = ioctl_entries;
7124     while (ie->target_cmd != 0) {
7125         if (((ie->target_cmd >> TARGET_IOC_SIZESHIFT) & TARGET_IOC_SIZEMASK) ==
7126             TARGET_IOC_SIZEMASK) {
7127             arg_type = ie->arg_type;
7128             if (arg_type[0] != TYPE_PTR) {
7129                 fprintf(stderr, "cannot patch size for ioctl 0x%x\n",
7130                         ie->target_cmd);
7131                 exit(1);
7132             }
7133             arg_type++;
7134             size = thunk_type_size(arg_type, 0);
7135             ie->target_cmd = (ie->target_cmd &
7136                               ~(TARGET_IOC_SIZEMASK << TARGET_IOC_SIZESHIFT)) |
7137                 (size << TARGET_IOC_SIZESHIFT);
7138         }
7139 
7140         /* automatic consistency check if same arch */
7141 #if (defined(__i386__) && defined(TARGET_I386) && defined(TARGET_ABI32)) || \
7142     (defined(__x86_64__) && defined(TARGET_X86_64))
7143         if (unlikely(ie->target_cmd != ie->host_cmd)) {
7144             fprintf(stderr, "ERROR: ioctl(%s): target=0x%x host=0x%x\n",
7145                     ie->name, ie->target_cmd, ie->host_cmd);
7146         }
7147 #endif
7148         ie++;
7149     }
7150 }
7151 
7152 #ifdef TARGET_NR_truncate64
7153 static inline abi_long target_truncate64(void *cpu_env, const char *arg1,
7154                                          abi_long arg2,
7155                                          abi_long arg3,
7156                                          abi_long arg4)
7157 {
7158     if (regpairs_aligned(cpu_env, TARGET_NR_truncate64)) {
7159         arg2 = arg3;
7160         arg3 = arg4;
7161     }
7162     return get_errno(truncate64(arg1, target_offset64(arg2, arg3)));
7163 }
7164 #endif
7165 
7166 #ifdef TARGET_NR_ftruncate64
7167 static inline abi_long target_ftruncate64(void *cpu_env, abi_long arg1,
7168                                           abi_long arg2,
7169                                           abi_long arg3,
7170                                           abi_long arg4)
7171 {
7172     if (regpairs_aligned(cpu_env, TARGET_NR_ftruncate64)) {
7173         arg2 = arg3;
7174         arg3 = arg4;
7175     }
7176     return get_errno(ftruncate64(arg1, target_offset64(arg2, arg3)));
7177 }
7178 #endif
7179 
7180 #if defined(TARGET_NR_timer_settime) || \
7181     (defined(TARGET_NR_timerfd_settime) && defined(CONFIG_TIMERFD))
7182 static inline abi_long target_to_host_itimerspec(struct itimerspec *host_its,
7183                                                  abi_ulong target_addr)
7184 {
7185     if (target_to_host_timespec(&host_its->it_interval, target_addr +
7186                                 offsetof(struct target_itimerspec,
7187                                          it_interval)) ||
7188         target_to_host_timespec(&host_its->it_value, target_addr +
7189                                 offsetof(struct target_itimerspec,
7190                                          it_value))) {
7191         return -TARGET_EFAULT;
7192     }
7193 
7194     return 0;
7195 }
7196 #endif
7197 
7198 #if defined(TARGET_NR_timer_settime64) || \
7199     (defined(TARGET_NR_timerfd_settime64) && defined(CONFIG_TIMERFD))
7200 static inline abi_long target_to_host_itimerspec64(struct itimerspec *host_its,
7201                                                    abi_ulong target_addr)
7202 {
7203     if (target_to_host_timespec64(&host_its->it_interval, target_addr +
7204                                   offsetof(struct target__kernel_itimerspec,
7205                                            it_interval)) ||
7206         target_to_host_timespec64(&host_its->it_value, target_addr +
7207                                   offsetof(struct target__kernel_itimerspec,
7208                                            it_value))) {
7209         return -TARGET_EFAULT;
7210     }
7211 
7212     return 0;
7213 }
7214 #endif
7215 
7216 #if ((defined(TARGET_NR_timerfd_gettime) || \
7217       defined(TARGET_NR_timerfd_settime)) && defined(CONFIG_TIMERFD)) || \
7218       defined(TARGET_NR_timer_gettime) || defined(TARGET_NR_timer_settime)
7219 static inline abi_long host_to_target_itimerspec(abi_ulong target_addr,
7220                                                  struct itimerspec *host_its)
7221 {
7222     if (host_to_target_timespec(target_addr + offsetof(struct target_itimerspec,
7223                                                        it_interval),
7224                                 &host_its->it_interval) ||
7225         host_to_target_timespec(target_addr + offsetof(struct target_itimerspec,
7226                                                        it_value),
7227                                 &host_its->it_value)) {
7228         return -TARGET_EFAULT;
7229     }
7230     return 0;
7231 }
7232 #endif
7233 
7234 #if ((defined(TARGET_NR_timerfd_gettime64) || \
7235       defined(TARGET_NR_timerfd_settime64)) && defined(CONFIG_TIMERFD)) || \
7236       defined(TARGET_NR_timer_gettime64) || defined(TARGET_NR_timer_settime64)
7237 static inline abi_long host_to_target_itimerspec64(abi_ulong target_addr,
7238                                                    struct itimerspec *host_its)
7239 {
7240     if (host_to_target_timespec64(target_addr +
7241                                   offsetof(struct target__kernel_itimerspec,
7242                                            it_interval),
7243                                   &host_its->it_interval) ||
7244         host_to_target_timespec64(target_addr +
7245                                   offsetof(struct target__kernel_itimerspec,
7246                                            it_value),
7247                                   &host_its->it_value)) {
7248         return -TARGET_EFAULT;
7249     }
7250     return 0;
7251 }
7252 #endif
7253 
7254 #if defined(TARGET_NR_adjtimex) || \
7255     (defined(TARGET_NR_clock_adjtime) && defined(CONFIG_CLOCK_ADJTIME))
7256 static inline abi_long target_to_host_timex(struct timex *host_tx,
7257                                             abi_long target_addr)
7258 {
7259     struct target_timex *target_tx;
7260 
7261     if (!lock_user_struct(VERIFY_READ, target_tx, target_addr, 1)) {
7262         return -TARGET_EFAULT;
7263     }
7264 
7265     __get_user(host_tx->modes, &target_tx->modes);
7266     __get_user(host_tx->offset, &target_tx->offset);
7267     __get_user(host_tx->freq, &target_tx->freq);
7268     __get_user(host_tx->maxerror, &target_tx->maxerror);
7269     __get_user(host_tx->esterror, &target_tx->esterror);
7270     __get_user(host_tx->status, &target_tx->status);
7271     __get_user(host_tx->constant, &target_tx->constant);
7272     __get_user(host_tx->precision, &target_tx->precision);
7273     __get_user(host_tx->tolerance, &target_tx->tolerance);
7274     __get_user(host_tx->time.tv_sec, &target_tx->time.tv_sec);
7275     __get_user(host_tx->time.tv_usec, &target_tx->time.tv_usec);
7276     __get_user(host_tx->tick, &target_tx->tick);
7277     __get_user(host_tx->ppsfreq, &target_tx->ppsfreq);
7278     __get_user(host_tx->jitter, &target_tx->jitter);
7279     __get_user(host_tx->shift, &target_tx->shift);
7280     __get_user(host_tx->stabil, &target_tx->stabil);
7281     __get_user(host_tx->jitcnt, &target_tx->jitcnt);
7282     __get_user(host_tx->calcnt, &target_tx->calcnt);
7283     __get_user(host_tx->errcnt, &target_tx->errcnt);
7284     __get_user(host_tx->stbcnt, &target_tx->stbcnt);
7285     __get_user(host_tx->tai, &target_tx->tai);
7286 
7287     unlock_user_struct(target_tx, target_addr, 0);
7288     return 0;
7289 }
7290 
7291 static inline abi_long host_to_target_timex(abi_long target_addr,
7292                                             struct timex *host_tx)
7293 {
7294     struct target_timex *target_tx;
7295 
7296     if (!lock_user_struct(VERIFY_WRITE, target_tx, target_addr, 0)) {
7297         return -TARGET_EFAULT;
7298     }
7299 
7300     __put_user(host_tx->modes, &target_tx->modes);
7301     __put_user(host_tx->offset, &target_tx->offset);
7302     __put_user(host_tx->freq, &target_tx->freq);
7303     __put_user(host_tx->maxerror, &target_tx->maxerror);
7304     __put_user(host_tx->esterror, &target_tx->esterror);
7305     __put_user(host_tx->status, &target_tx->status);
7306     __put_user(host_tx->constant, &target_tx->constant);
7307     __put_user(host_tx->precision, &target_tx->precision);
7308     __put_user(host_tx->tolerance, &target_tx->tolerance);
7309     __put_user(host_tx->time.tv_sec, &target_tx->time.tv_sec);
7310     __put_user(host_tx->time.tv_usec, &target_tx->time.tv_usec);
7311     __put_user(host_tx->tick, &target_tx->tick);
7312     __put_user(host_tx->ppsfreq, &target_tx->ppsfreq);
7313     __put_user(host_tx->jitter, &target_tx->jitter);
7314     __put_user(host_tx->shift, &target_tx->shift);
7315     __put_user(host_tx->stabil, &target_tx->stabil);
7316     __put_user(host_tx->jitcnt, &target_tx->jitcnt);
7317     __put_user(host_tx->calcnt, &target_tx->calcnt);
7318     __put_user(host_tx->errcnt, &target_tx->errcnt);
7319     __put_user(host_tx->stbcnt, &target_tx->stbcnt);
7320     __put_user(host_tx->tai, &target_tx->tai);
7321 
7322     unlock_user_struct(target_tx, target_addr, 1);
7323     return 0;
7324 }
7325 #endif
7326 
7327 
7328 #if defined(TARGET_NR_clock_adjtime64) && defined(CONFIG_CLOCK_ADJTIME)
7329 static inline abi_long target_to_host_timex64(struct timex *host_tx,
7330                                               abi_long target_addr)
7331 {
7332     struct target__kernel_timex *target_tx;
7333 
7334     if (copy_from_user_timeval64(&host_tx->time, target_addr +
7335                                  offsetof(struct target__kernel_timex,
7336                                           time))) {
7337         return -TARGET_EFAULT;
7338     }
7339 
7340     if (!lock_user_struct(VERIFY_READ, target_tx, target_addr, 1)) {
7341         return -TARGET_EFAULT;
7342     }
7343 
7344     __get_user(host_tx->modes, &target_tx->modes);
7345     __get_user(host_tx->offset, &target_tx->offset);
7346     __get_user(host_tx->freq, &target_tx->freq);
7347     __get_user(host_tx->maxerror, &target_tx->maxerror);
7348     __get_user(host_tx->esterror, &target_tx->esterror);
7349     __get_user(host_tx->status, &target_tx->status);
7350     __get_user(host_tx->constant, &target_tx->constant);
7351     __get_user(host_tx->precision, &target_tx->precision);
7352     __get_user(host_tx->tolerance, &target_tx->tolerance);
7353     __get_user(host_tx->tick, &target_tx->tick);
7354     __get_user(host_tx->ppsfreq, &target_tx->ppsfreq);
7355     __get_user(host_tx->jitter, &target_tx->jitter);
7356     __get_user(host_tx->shift, &target_tx->shift);
7357     __get_user(host_tx->stabil, &target_tx->stabil);
7358     __get_user(host_tx->jitcnt, &target_tx->jitcnt);
7359     __get_user(host_tx->calcnt, &target_tx->calcnt);
7360     __get_user(host_tx->errcnt, &target_tx->errcnt);
7361     __get_user(host_tx->stbcnt, &target_tx->stbcnt);
7362     __get_user(host_tx->tai, &target_tx->tai);
7363 
7364     unlock_user_struct(target_tx, target_addr, 0);
7365     return 0;
7366 }
7367 
7368 static inline abi_long host_to_target_timex64(abi_long target_addr,
7369                                               struct timex *host_tx)
7370 {
7371     struct target__kernel_timex *target_tx;
7372 
7373    if (copy_to_user_timeval64(target_addr +
7374                               offsetof(struct target__kernel_timex, time),
7375                               &host_tx->time)) {
7376         return -TARGET_EFAULT;
7377     }
7378 
7379     if (!lock_user_struct(VERIFY_WRITE, target_tx, target_addr, 0)) {
7380         return -TARGET_EFAULT;
7381     }
7382 
7383     __put_user(host_tx->modes, &target_tx->modes);
7384     __put_user(host_tx->offset, &target_tx->offset);
7385     __put_user(host_tx->freq, &target_tx->freq);
7386     __put_user(host_tx->maxerror, &target_tx->maxerror);
7387     __put_user(host_tx->esterror, &target_tx->esterror);
7388     __put_user(host_tx->status, &target_tx->status);
7389     __put_user(host_tx->constant, &target_tx->constant);
7390     __put_user(host_tx->precision, &target_tx->precision);
7391     __put_user(host_tx->tolerance, &target_tx->tolerance);
7392     __put_user(host_tx->tick, &target_tx->tick);
7393     __put_user(host_tx->ppsfreq, &target_tx->ppsfreq);
7394     __put_user(host_tx->jitter, &target_tx->jitter);
7395     __put_user(host_tx->shift, &target_tx->shift);
7396     __put_user(host_tx->stabil, &target_tx->stabil);
7397     __put_user(host_tx->jitcnt, &target_tx->jitcnt);
7398     __put_user(host_tx->calcnt, &target_tx->calcnt);
7399     __put_user(host_tx->errcnt, &target_tx->errcnt);
7400     __put_user(host_tx->stbcnt, &target_tx->stbcnt);
7401     __put_user(host_tx->tai, &target_tx->tai);
7402 
7403     unlock_user_struct(target_tx, target_addr, 1);
7404     return 0;
7405 }
7406 #endif
7407 
7408 static inline abi_long target_to_host_sigevent(struct sigevent *host_sevp,
7409                                                abi_ulong target_addr)
7410 {
7411     struct target_sigevent *target_sevp;
7412 
7413     if (!lock_user_struct(VERIFY_READ, target_sevp, target_addr, 1)) {
7414         return -TARGET_EFAULT;
7415     }
7416 
7417     /* This union is awkward on 64 bit systems because it has a 32 bit
7418      * integer and a pointer in it; we follow the conversion approach
7419      * used for handling sigval types in signal.c so the guest should get
7420      * the correct value back even if we did a 64 bit byteswap and it's
7421      * using the 32 bit integer.
7422      */
7423     host_sevp->sigev_value.sival_ptr =
7424         (void *)(uintptr_t)tswapal(target_sevp->sigev_value.sival_ptr);
7425     host_sevp->sigev_signo =
7426         target_to_host_signal(tswap32(target_sevp->sigev_signo));
7427     host_sevp->sigev_notify = tswap32(target_sevp->sigev_notify);
7428     host_sevp->_sigev_un._tid = tswap32(target_sevp->_sigev_un._tid);
7429 
7430     unlock_user_struct(target_sevp, target_addr, 1);
7431     return 0;
7432 }
7433 
7434 #if defined(TARGET_NR_mlockall)
7435 static inline int target_to_host_mlockall_arg(int arg)
7436 {
7437     int result = 0;
7438 
7439     if (arg & TARGET_MCL_CURRENT) {
7440         result |= MCL_CURRENT;
7441     }
7442     if (arg & TARGET_MCL_FUTURE) {
7443         result |= MCL_FUTURE;
7444     }
7445 #ifdef MCL_ONFAULT
7446     if (arg & TARGET_MCL_ONFAULT) {
7447         result |= MCL_ONFAULT;
7448     }
7449 #endif
7450 
7451     return result;
7452 }
7453 #endif
7454 
7455 #if (defined(TARGET_NR_stat64) || defined(TARGET_NR_lstat64) ||     \
7456      defined(TARGET_NR_fstat64) || defined(TARGET_NR_fstatat64) ||  \
7457      defined(TARGET_NR_newfstatat))
7458 static inline abi_long host_to_target_stat64(void *cpu_env,
7459                                              abi_ulong target_addr,
7460                                              struct stat *host_st)
7461 {
7462 #if defined(TARGET_ARM) && defined(TARGET_ABI32)
7463     if (((CPUARMState *)cpu_env)->eabi) {
7464         struct target_eabi_stat64 *target_st;
7465 
7466         if (!lock_user_struct(VERIFY_WRITE, target_st, target_addr, 0))
7467             return -TARGET_EFAULT;
7468         memset(target_st, 0, sizeof(struct target_eabi_stat64));
7469         __put_user(host_st->st_dev, &target_st->st_dev);
7470         __put_user(host_st->st_ino, &target_st->st_ino);
7471 #ifdef TARGET_STAT64_HAS_BROKEN_ST_INO
7472         __put_user(host_st->st_ino, &target_st->__st_ino);
7473 #endif
7474         __put_user(host_st->st_mode, &target_st->st_mode);
7475         __put_user(host_st->st_nlink, &target_st->st_nlink);
7476         __put_user(host_st->st_uid, &target_st->st_uid);
7477         __put_user(host_st->st_gid, &target_st->st_gid);
7478         __put_user(host_st->st_rdev, &target_st->st_rdev);
7479         __put_user(host_st->st_size, &target_st->st_size);
7480         __put_user(host_st->st_blksize, &target_st->st_blksize);
7481         __put_user(host_st->st_blocks, &target_st->st_blocks);
7482         __put_user(host_st->st_atime, &target_st->target_st_atime);
7483         __put_user(host_st->st_mtime, &target_st->target_st_mtime);
7484         __put_user(host_st->st_ctime, &target_st->target_st_ctime);
7485 #ifdef HAVE_STRUCT_STAT_ST_ATIM
7486         __put_user(host_st->st_atim.tv_nsec, &target_st->target_st_atime_nsec);
7487         __put_user(host_st->st_mtim.tv_nsec, &target_st->target_st_mtime_nsec);
7488         __put_user(host_st->st_ctim.tv_nsec, &target_st->target_st_ctime_nsec);
7489 #endif
7490         unlock_user_struct(target_st, target_addr, 1);
7491     } else
7492 #endif
7493     {
7494 #if defined(TARGET_HAS_STRUCT_STAT64)
7495         struct target_stat64 *target_st;
7496 #else
7497         struct target_stat *target_st;
7498 #endif
7499 
7500         if (!lock_user_struct(VERIFY_WRITE, target_st, target_addr, 0))
7501             return -TARGET_EFAULT;
7502         memset(target_st, 0, sizeof(*target_st));
7503         __put_user(host_st->st_dev, &target_st->st_dev);
7504         __put_user(host_st->st_ino, &target_st->st_ino);
7505 #ifdef TARGET_STAT64_HAS_BROKEN_ST_INO
7506         __put_user(host_st->st_ino, &target_st->__st_ino);
7507 #endif
7508         __put_user(host_st->st_mode, &target_st->st_mode);
7509         __put_user(host_st->st_nlink, &target_st->st_nlink);
7510         __put_user(host_st->st_uid, &target_st->st_uid);
7511         __put_user(host_st->st_gid, &target_st->st_gid);
7512         __put_user(host_st->st_rdev, &target_st->st_rdev);
7513         /* XXX: better use of kernel struct */
7514         __put_user(host_st->st_size, &target_st->st_size);
7515         __put_user(host_st->st_blksize, &target_st->st_blksize);
7516         __put_user(host_st->st_blocks, &target_st->st_blocks);
7517         __put_user(host_st->st_atime, &target_st->target_st_atime);
7518         __put_user(host_st->st_mtime, &target_st->target_st_mtime);
7519         __put_user(host_st->st_ctime, &target_st->target_st_ctime);
7520 #ifdef HAVE_STRUCT_STAT_ST_ATIM
7521         __put_user(host_st->st_atim.tv_nsec, &target_st->target_st_atime_nsec);
7522         __put_user(host_st->st_mtim.tv_nsec, &target_st->target_st_mtime_nsec);
7523         __put_user(host_st->st_ctim.tv_nsec, &target_st->target_st_ctime_nsec);
7524 #endif
7525         unlock_user_struct(target_st, target_addr, 1);
7526     }
7527 
7528     return 0;
7529 }
7530 #endif
7531 
7532 #if defined(TARGET_NR_statx) && defined(__NR_statx)
7533 static inline abi_long host_to_target_statx(struct target_statx *host_stx,
7534                                             abi_ulong target_addr)
7535 {
7536     struct target_statx *target_stx;
7537 
7538     if (!lock_user_struct(VERIFY_WRITE, target_stx, target_addr,  0)) {
7539         return -TARGET_EFAULT;
7540     }
7541     memset(target_stx, 0, sizeof(*target_stx));
7542 
7543     __put_user(host_stx->stx_mask, &target_stx->stx_mask);
7544     __put_user(host_stx->stx_blksize, &target_stx->stx_blksize);
7545     __put_user(host_stx->stx_attributes, &target_stx->stx_attributes);
7546     __put_user(host_stx->stx_nlink, &target_stx->stx_nlink);
7547     __put_user(host_stx->stx_uid, &target_stx->stx_uid);
7548     __put_user(host_stx->stx_gid, &target_stx->stx_gid);
7549     __put_user(host_stx->stx_mode, &target_stx->stx_mode);
7550     __put_user(host_stx->stx_ino, &target_stx->stx_ino);
7551     __put_user(host_stx->stx_size, &target_stx->stx_size);
7552     __put_user(host_stx->stx_blocks, &target_stx->stx_blocks);
7553     __put_user(host_stx->stx_attributes_mask, &target_stx->stx_attributes_mask);
7554     __put_user(host_stx->stx_atime.tv_sec, &target_stx->stx_atime.tv_sec);
7555     __put_user(host_stx->stx_atime.tv_nsec, &target_stx->stx_atime.tv_nsec);
7556     __put_user(host_stx->stx_btime.tv_sec, &target_stx->stx_btime.tv_sec);
7557     __put_user(host_stx->stx_btime.tv_nsec, &target_stx->stx_btime.tv_nsec);
7558     __put_user(host_stx->stx_ctime.tv_sec, &target_stx->stx_ctime.tv_sec);
7559     __put_user(host_stx->stx_ctime.tv_nsec, &target_stx->stx_ctime.tv_nsec);
7560     __put_user(host_stx->stx_mtime.tv_sec, &target_stx->stx_mtime.tv_sec);
7561     __put_user(host_stx->stx_mtime.tv_nsec, &target_stx->stx_mtime.tv_nsec);
7562     __put_user(host_stx->stx_rdev_major, &target_stx->stx_rdev_major);
7563     __put_user(host_stx->stx_rdev_minor, &target_stx->stx_rdev_minor);
7564     __put_user(host_stx->stx_dev_major, &target_stx->stx_dev_major);
7565     __put_user(host_stx->stx_dev_minor, &target_stx->stx_dev_minor);
7566 
7567     unlock_user_struct(target_stx, target_addr, 1);
7568 
7569     return 0;
7570 }
7571 #endif
7572 
7573 static int do_sys_futex(int *uaddr, int op, int val,
7574                          const struct timespec *timeout, int *uaddr2,
7575                          int val3)
7576 {
7577 #if HOST_LONG_BITS == 64
7578 #if defined(__NR_futex)
7579     /* always a 64-bit time_t, it doesn't define _time64 version  */
7580     return sys_futex(uaddr, op, val, timeout, uaddr2, val3);
7581 
7582 #endif
7583 #else /* HOST_LONG_BITS == 64 */
7584 #if defined(__NR_futex_time64)
7585     if (sizeof(timeout->tv_sec) == 8) {
7586         /* _time64 function on 32bit arch */
7587         return sys_futex_time64(uaddr, op, val, timeout, uaddr2, val3);
7588     }
7589 #endif
7590 #if defined(__NR_futex)
7591     /* old function on 32bit arch */
7592     return sys_futex(uaddr, op, val, timeout, uaddr2, val3);
7593 #endif
7594 #endif /* HOST_LONG_BITS == 64 */
7595     g_assert_not_reached();
7596 }
7597 
7598 static int do_safe_futex(int *uaddr, int op, int val,
7599                          const struct timespec *timeout, int *uaddr2,
7600                          int val3)
7601 {
7602 #if HOST_LONG_BITS == 64
7603 #if defined(__NR_futex)
7604     /* always a 64-bit time_t, it doesn't define _time64 version  */
7605     return get_errno(safe_futex(uaddr, op, val, timeout, uaddr2, val3));
7606 #endif
7607 #else /* HOST_LONG_BITS == 64 */
7608 #if defined(__NR_futex_time64)
7609     if (sizeof(timeout->tv_sec) == 8) {
7610         /* _time64 function on 32bit arch */
7611         return get_errno(safe_futex_time64(uaddr, op, val, timeout, uaddr2,
7612                                            val3));
7613     }
7614 #endif
7615 #if defined(__NR_futex)
7616     /* old function on 32bit arch */
7617     return get_errno(safe_futex(uaddr, op, val, timeout, uaddr2, val3));
7618 #endif
7619 #endif /* HOST_LONG_BITS == 64 */
7620     return -TARGET_ENOSYS;
7621 }
7622 
7623 /* ??? Using host futex calls even when target atomic operations
7624    are not really atomic probably breaks things.  However implementing
7625    futexes locally would make futexes shared between multiple processes
7626    tricky.  However they're probably useless because guest atomic
7627    operations won't work either.  */
7628 #if defined(TARGET_NR_futex)
7629 static int do_futex(CPUState *cpu, target_ulong uaddr, int op, int val,
7630                     target_ulong timeout, target_ulong uaddr2, int val3)
7631 {
7632     struct timespec ts, *pts;
7633     int base_op;
7634 
7635     /* ??? We assume FUTEX_* constants are the same on both host
7636        and target.  */
7637 #ifdef FUTEX_CMD_MASK
7638     base_op = op & FUTEX_CMD_MASK;
7639 #else
7640     base_op = op;
7641 #endif
7642     switch (base_op) {
7643     case FUTEX_WAIT:
7644     case FUTEX_WAIT_BITSET:
7645         if (timeout) {
7646             pts = &ts;
7647             target_to_host_timespec(pts, timeout);
7648         } else {
7649             pts = NULL;
7650         }
7651         return do_safe_futex(g2h(cpu, uaddr),
7652                              op, tswap32(val), pts, NULL, val3);
7653     case FUTEX_WAKE:
7654         return do_safe_futex(g2h(cpu, uaddr),
7655                              op, val, NULL, NULL, 0);
7656     case FUTEX_FD:
7657         return do_safe_futex(g2h(cpu, uaddr),
7658                              op, val, NULL, NULL, 0);
7659     case FUTEX_REQUEUE:
7660     case FUTEX_CMP_REQUEUE:
7661     case FUTEX_WAKE_OP:
7662         /* For FUTEX_REQUEUE, FUTEX_CMP_REQUEUE, and FUTEX_WAKE_OP, the
7663            TIMEOUT parameter is interpreted as a uint32_t by the kernel.
7664            But the prototype takes a `struct timespec *'; insert casts
7665            to satisfy the compiler.  We do not need to tswap TIMEOUT
7666            since it's not compared to guest memory.  */
7667         pts = (struct timespec *)(uintptr_t) timeout;
7668         return do_safe_futex(g2h(cpu, uaddr), op, val, pts, g2h(cpu, uaddr2),
7669                              (base_op == FUTEX_CMP_REQUEUE
7670                               ? tswap32(val3) : val3));
7671     default:
7672         return -TARGET_ENOSYS;
7673     }
7674 }
7675 #endif
7676 
7677 #if defined(TARGET_NR_futex_time64)
7678 static int do_futex_time64(CPUState *cpu, target_ulong uaddr, int op,
7679                            int val, target_ulong timeout,
7680                            target_ulong uaddr2, int val3)
7681 {
7682     struct timespec ts, *pts;
7683     int base_op;
7684 
7685     /* ??? We assume FUTEX_* constants are the same on both host
7686        and target.  */
7687 #ifdef FUTEX_CMD_MASK
7688     base_op = op & FUTEX_CMD_MASK;
7689 #else
7690     base_op = op;
7691 #endif
7692     switch (base_op) {
7693     case FUTEX_WAIT:
7694     case FUTEX_WAIT_BITSET:
7695         if (timeout) {
7696             pts = &ts;
7697             if (target_to_host_timespec64(pts, timeout)) {
7698                 return -TARGET_EFAULT;
7699             }
7700         } else {
7701             pts = NULL;
7702         }
7703         return do_safe_futex(g2h(cpu, uaddr), op,
7704                              tswap32(val), pts, NULL, val3);
7705     case FUTEX_WAKE:
7706         return do_safe_futex(g2h(cpu, uaddr), op, val, NULL, NULL, 0);
7707     case FUTEX_FD:
7708         return do_safe_futex(g2h(cpu, uaddr), op, val, NULL, NULL, 0);
7709     case FUTEX_REQUEUE:
7710     case FUTEX_CMP_REQUEUE:
7711     case FUTEX_WAKE_OP:
7712         /* For FUTEX_REQUEUE, FUTEX_CMP_REQUEUE, and FUTEX_WAKE_OP, the
7713            TIMEOUT parameter is interpreted as a uint32_t by the kernel.
7714            But the prototype takes a `struct timespec *'; insert casts
7715            to satisfy the compiler.  We do not need to tswap TIMEOUT
7716            since it's not compared to guest memory.  */
7717         pts = (struct timespec *)(uintptr_t) timeout;
7718         return do_safe_futex(g2h(cpu, uaddr), op, val, pts, g2h(cpu, uaddr2),
7719                              (base_op == FUTEX_CMP_REQUEUE
7720                               ? tswap32(val3) : val3));
7721     default:
7722         return -TARGET_ENOSYS;
7723     }
7724 }
7725 #endif
7726 
7727 #if defined(TARGET_NR_name_to_handle_at) && defined(CONFIG_OPEN_BY_HANDLE)
7728 static abi_long do_name_to_handle_at(abi_long dirfd, abi_long pathname,
7729                                      abi_long handle, abi_long mount_id,
7730                                      abi_long flags)
7731 {
7732     struct file_handle *target_fh;
7733     struct file_handle *fh;
7734     int mid = 0;
7735     abi_long ret;
7736     char *name;
7737     unsigned int size, total_size;
7738 
7739     if (get_user_s32(size, handle)) {
7740         return -TARGET_EFAULT;
7741     }
7742 
7743     name = lock_user_string(pathname);
7744     if (!name) {
7745         return -TARGET_EFAULT;
7746     }
7747 
7748     total_size = sizeof(struct file_handle) + size;
7749     target_fh = lock_user(VERIFY_WRITE, handle, total_size, 0);
7750     if (!target_fh) {
7751         unlock_user(name, pathname, 0);
7752         return -TARGET_EFAULT;
7753     }
7754 
7755     fh = g_malloc0(total_size);
7756     fh->handle_bytes = size;
7757 
7758     ret = get_errno(name_to_handle_at(dirfd, path(name), fh, &mid, flags));
7759     unlock_user(name, pathname, 0);
7760 
7761     /* man name_to_handle_at(2):
7762      * Other than the use of the handle_bytes field, the caller should treat
7763      * the file_handle structure as an opaque data type
7764      */
7765 
7766     memcpy(target_fh, fh, total_size);
7767     target_fh->handle_bytes = tswap32(fh->handle_bytes);
7768     target_fh->handle_type = tswap32(fh->handle_type);
7769     g_free(fh);
7770     unlock_user(target_fh, handle, total_size);
7771 
7772     if (put_user_s32(mid, mount_id)) {
7773         return -TARGET_EFAULT;
7774     }
7775 
7776     return ret;
7777 
7778 }
7779 #endif
7780 
7781 #if defined(TARGET_NR_open_by_handle_at) && defined(CONFIG_OPEN_BY_HANDLE)
7782 static abi_long do_open_by_handle_at(abi_long mount_fd, abi_long handle,
7783                                      abi_long flags)
7784 {
7785     struct file_handle *target_fh;
7786     struct file_handle *fh;
7787     unsigned int size, total_size;
7788     abi_long ret;
7789 
7790     if (get_user_s32(size, handle)) {
7791         return -TARGET_EFAULT;
7792     }
7793 
7794     total_size = sizeof(struct file_handle) + size;
7795     target_fh = lock_user(VERIFY_READ, handle, total_size, 1);
7796     if (!target_fh) {
7797         return -TARGET_EFAULT;
7798     }
7799 
7800     fh = g_memdup(target_fh, total_size);
7801     fh->handle_bytes = size;
7802     fh->handle_type = tswap32(target_fh->handle_type);
7803 
7804     ret = get_errno(open_by_handle_at(mount_fd, fh,
7805                     target_to_host_bitmask(flags, fcntl_flags_tbl)));
7806 
7807     g_free(fh);
7808 
7809     unlock_user(target_fh, handle, total_size);
7810 
7811     return ret;
7812 }
7813 #endif
7814 
7815 #if defined(TARGET_NR_signalfd) || defined(TARGET_NR_signalfd4)
7816 
7817 static abi_long do_signalfd4(int fd, abi_long mask, int flags)
7818 {
7819     int host_flags;
7820     target_sigset_t *target_mask;
7821     sigset_t host_mask;
7822     abi_long ret;
7823 
7824     if (flags & ~(TARGET_O_NONBLOCK_MASK | TARGET_O_CLOEXEC)) {
7825         return -TARGET_EINVAL;
7826     }
7827     if (!lock_user_struct(VERIFY_READ, target_mask, mask, 1)) {
7828         return -TARGET_EFAULT;
7829     }
7830 
7831     target_to_host_sigset(&host_mask, target_mask);
7832 
7833     host_flags = target_to_host_bitmask(flags, fcntl_flags_tbl);
7834 
7835     ret = get_errno(signalfd(fd, &host_mask, host_flags));
7836     if (ret >= 0) {
7837         fd_trans_register(ret, &target_signalfd_trans);
7838     }
7839 
7840     unlock_user_struct(target_mask, mask, 0);
7841 
7842     return ret;
7843 }
7844 #endif
7845 
7846 /* Map host to target signal numbers for the wait family of syscalls.
7847    Assume all other status bits are the same.  */
7848 int host_to_target_waitstatus(int status)
7849 {
7850     if (WIFSIGNALED(status)) {
7851         return host_to_target_signal(WTERMSIG(status)) | (status & ~0x7f);
7852     }
7853     if (WIFSTOPPED(status)) {
7854         return (host_to_target_signal(WSTOPSIG(status)) << 8)
7855                | (status & 0xff);
7856     }
7857     return status;
7858 }
7859 
7860 static int open_self_cmdline(void *cpu_env, int fd)
7861 {
7862     CPUState *cpu = env_cpu((CPUArchState *)cpu_env);
7863     struct linux_binprm *bprm = ((TaskState *)cpu->opaque)->bprm;
7864     int i;
7865 
7866     for (i = 0; i < bprm->argc; i++) {
7867         size_t len = strlen(bprm->argv[i]) + 1;
7868 
7869         if (write(fd, bprm->argv[i], len) != len) {
7870             return -1;
7871         }
7872     }
7873 
7874     return 0;
7875 }
7876 
7877 static int open_self_maps(void *cpu_env, int fd)
7878 {
7879     CPUState *cpu = env_cpu((CPUArchState *)cpu_env);
7880     TaskState *ts = cpu->opaque;
7881     GSList *map_info = read_self_maps();
7882     GSList *s;
7883     int count;
7884 
7885     for (s = map_info; s; s = g_slist_next(s)) {
7886         MapInfo *e = (MapInfo *) s->data;
7887 
7888         if (h2g_valid(e->start)) {
7889             unsigned long min = e->start;
7890             unsigned long max = e->end;
7891             int flags = page_get_flags(h2g(min));
7892             const char *path;
7893 
7894             max = h2g_valid(max - 1) ?
7895                 max : (uintptr_t) g2h_untagged(GUEST_ADDR_MAX) + 1;
7896 
7897             if (page_check_range(h2g(min), max - min, flags) == -1) {
7898                 continue;
7899             }
7900 
7901             if (h2g(min) == ts->info->stack_limit) {
7902                 path = "[stack]";
7903             } else {
7904                 path = e->path;
7905             }
7906 
7907             count = dprintf(fd, TARGET_ABI_FMT_ptr "-" TARGET_ABI_FMT_ptr
7908                             " %c%c%c%c %08" PRIx64 " %s %"PRId64,
7909                             h2g(min), h2g(max - 1) + 1,
7910                             (flags & PAGE_READ) ? 'r' : '-',
7911                             (flags & PAGE_WRITE_ORG) ? 'w' : '-',
7912                             (flags & PAGE_EXEC) ? 'x' : '-',
7913                             e->is_priv ? 'p' : '-',
7914                             (uint64_t) e->offset, e->dev, e->inode);
7915             if (path) {
7916                 dprintf(fd, "%*s%s\n", 73 - count, "", path);
7917             } else {
7918                 dprintf(fd, "\n");
7919             }
7920         }
7921     }
7922 
7923     free_self_maps(map_info);
7924 
7925 #ifdef TARGET_VSYSCALL_PAGE
7926     /*
7927      * We only support execution from the vsyscall page.
7928      * This is as if CONFIG_LEGACY_VSYSCALL_XONLY=y from v5.3.
7929      */
7930     count = dprintf(fd, TARGET_FMT_lx "-" TARGET_FMT_lx
7931                     " --xp 00000000 00:00 0",
7932                     TARGET_VSYSCALL_PAGE, TARGET_VSYSCALL_PAGE + TARGET_PAGE_SIZE);
7933     dprintf(fd, "%*s%s\n", 73 - count, "",  "[vsyscall]");
7934 #endif
7935 
7936     return 0;
7937 }
7938 
7939 static int open_self_stat(void *cpu_env, int fd)
7940 {
7941     CPUState *cpu = env_cpu((CPUArchState *)cpu_env);
7942     TaskState *ts = cpu->opaque;
7943     g_autoptr(GString) buf = g_string_new(NULL);
7944     int i;
7945 
7946     for (i = 0; i < 44; i++) {
7947         if (i == 0) {
7948             /* pid */
7949             g_string_printf(buf, FMT_pid " ", getpid());
7950         } else if (i == 1) {
7951             /* app name */
7952             gchar *bin = g_strrstr(ts->bprm->argv[0], "/");
7953             bin = bin ? bin + 1 : ts->bprm->argv[0];
7954             g_string_printf(buf, "(%.15s) ", bin);
7955         } else if (i == 27) {
7956             /* stack bottom */
7957             g_string_printf(buf, TARGET_ABI_FMT_ld " ", ts->info->start_stack);
7958         } else {
7959             /* for the rest, there is MasterCard */
7960             g_string_printf(buf, "0%c", i == 43 ? '\n' : ' ');
7961         }
7962 
7963         if (write(fd, buf->str, buf->len) != buf->len) {
7964             return -1;
7965         }
7966     }
7967 
7968     return 0;
7969 }
7970 
7971 static int open_self_auxv(void *cpu_env, int fd)
7972 {
7973     CPUState *cpu = env_cpu((CPUArchState *)cpu_env);
7974     TaskState *ts = cpu->opaque;
7975     abi_ulong auxv = ts->info->saved_auxv;
7976     abi_ulong len = ts->info->auxv_len;
7977     char *ptr;
7978 
7979     /*
7980      * Auxiliary vector is stored in target process stack.
7981      * read in whole auxv vector and copy it to file
7982      */
7983     ptr = lock_user(VERIFY_READ, auxv, len, 0);
7984     if (ptr != NULL) {
7985         while (len > 0) {
7986             ssize_t r;
7987             r = write(fd, ptr, len);
7988             if (r <= 0) {
7989                 break;
7990             }
7991             len -= r;
7992             ptr += r;
7993         }
7994         lseek(fd, 0, SEEK_SET);
7995         unlock_user(ptr, auxv, len);
7996     }
7997 
7998     return 0;
7999 }
8000 
8001 static int is_proc_myself(const char *filename, const char *entry)
8002 {
8003     if (!strncmp(filename, "/proc/", strlen("/proc/"))) {
8004         filename += strlen("/proc/");
8005         if (!strncmp(filename, "self/", strlen("self/"))) {
8006             filename += strlen("self/");
8007         } else if (*filename >= '1' && *filename <= '9') {
8008             char myself[80];
8009             snprintf(myself, sizeof(myself), "%d/", getpid());
8010             if (!strncmp(filename, myself, strlen(myself))) {
8011                 filename += strlen(myself);
8012             } else {
8013                 return 0;
8014             }
8015         } else {
8016             return 0;
8017         }
8018         if (!strcmp(filename, entry)) {
8019             return 1;
8020         }
8021     }
8022     return 0;
8023 }
8024 
8025 #if defined(HOST_WORDS_BIGENDIAN) != defined(TARGET_WORDS_BIGENDIAN) || \
8026     defined(TARGET_SPARC) || defined(TARGET_M68K) || defined(TARGET_HPPA)
8027 static int is_proc(const char *filename, const char *entry)
8028 {
8029     return strcmp(filename, entry) == 0;
8030 }
8031 #endif
8032 
8033 #if defined(HOST_WORDS_BIGENDIAN) != defined(TARGET_WORDS_BIGENDIAN)
8034 static int open_net_route(void *cpu_env, int fd)
8035 {
8036     FILE *fp;
8037     char *line = NULL;
8038     size_t len = 0;
8039     ssize_t read;
8040 
8041     fp = fopen("/proc/net/route", "r");
8042     if (fp == NULL) {
8043         return -1;
8044     }
8045 
8046     /* read header */
8047 
8048     read = getline(&line, &len, fp);
8049     dprintf(fd, "%s", line);
8050 
8051     /* read routes */
8052 
8053     while ((read = getline(&line, &len, fp)) != -1) {
8054         char iface[16];
8055         uint32_t dest, gw, mask;
8056         unsigned int flags, refcnt, use, metric, mtu, window, irtt;
8057         int fields;
8058 
8059         fields = sscanf(line,
8060                         "%s\t%08x\t%08x\t%04x\t%d\t%d\t%d\t%08x\t%d\t%u\t%u\n",
8061                         iface, &dest, &gw, &flags, &refcnt, &use, &metric,
8062                         &mask, &mtu, &window, &irtt);
8063         if (fields != 11) {
8064             continue;
8065         }
8066         dprintf(fd, "%s\t%08x\t%08x\t%04x\t%d\t%d\t%d\t%08x\t%d\t%u\t%u\n",
8067                 iface, tswap32(dest), tswap32(gw), flags, refcnt, use,
8068                 metric, tswap32(mask), mtu, window, irtt);
8069     }
8070 
8071     free(line);
8072     fclose(fp);
8073 
8074     return 0;
8075 }
8076 #endif
8077 
8078 #if defined(TARGET_SPARC)
8079 static int open_cpuinfo(void *cpu_env, int fd)
8080 {
8081     dprintf(fd, "type\t\t: sun4u\n");
8082     return 0;
8083 }
8084 #endif
8085 
8086 #if defined(TARGET_HPPA)
8087 static int open_cpuinfo(void *cpu_env, int fd)
8088 {
8089     dprintf(fd, "cpu family\t: PA-RISC 1.1e\n");
8090     dprintf(fd, "cpu\t\t: PA7300LC (PCX-L2)\n");
8091     dprintf(fd, "capabilities\t: os32\n");
8092     dprintf(fd, "model\t\t: 9000/778/B160L\n");
8093     dprintf(fd, "model name\t: Merlin L2 160 QEMU (9000/778/B160L)\n");
8094     return 0;
8095 }
8096 #endif
8097 
8098 #if defined(TARGET_M68K)
8099 static int open_hardware(void *cpu_env, int fd)
8100 {
8101     dprintf(fd, "Model:\t\tqemu-m68k\n");
8102     return 0;
8103 }
8104 #endif
8105 
8106 static int do_openat(void *cpu_env, int dirfd, const char *pathname, int flags, mode_t mode)
8107 {
8108     struct fake_open {
8109         const char *filename;
8110         int (*fill)(void *cpu_env, int fd);
8111         int (*cmp)(const char *s1, const char *s2);
8112     };
8113     const struct fake_open *fake_open;
8114     static const struct fake_open fakes[] = {
8115         { "maps", open_self_maps, is_proc_myself },
8116         { "stat", open_self_stat, is_proc_myself },
8117         { "auxv", open_self_auxv, is_proc_myself },
8118         { "cmdline", open_self_cmdline, is_proc_myself },
8119 #if defined(HOST_WORDS_BIGENDIAN) != defined(TARGET_WORDS_BIGENDIAN)
8120         { "/proc/net/route", open_net_route, is_proc },
8121 #endif
8122 #if defined(TARGET_SPARC) || defined(TARGET_HPPA)
8123         { "/proc/cpuinfo", open_cpuinfo, is_proc },
8124 #endif
8125 #if defined(TARGET_M68K)
8126         { "/proc/hardware", open_hardware, is_proc },
8127 #endif
8128         { NULL, NULL, NULL }
8129     };
8130 
8131     if (is_proc_myself(pathname, "exe")) {
8132         int execfd = qemu_getauxval(AT_EXECFD);
8133         return execfd ? execfd : safe_openat(dirfd, exec_path, flags, mode);
8134     }
8135 
8136     for (fake_open = fakes; fake_open->filename; fake_open++) {
8137         if (fake_open->cmp(pathname, fake_open->filename)) {
8138             break;
8139         }
8140     }
8141 
8142     if (fake_open->filename) {
8143         const char *tmpdir;
8144         char filename[PATH_MAX];
8145         int fd, r;
8146 
8147         /* create temporary file to map stat to */
8148         tmpdir = getenv("TMPDIR");
8149         if (!tmpdir)
8150             tmpdir = "/tmp";
8151         snprintf(filename, sizeof(filename), "%s/qemu-open.XXXXXX", tmpdir);
8152         fd = mkstemp(filename);
8153         if (fd < 0) {
8154             return fd;
8155         }
8156         unlink(filename);
8157 
8158         if ((r = fake_open->fill(cpu_env, fd))) {
8159             int e = errno;
8160             close(fd);
8161             errno = e;
8162             return r;
8163         }
8164         lseek(fd, 0, SEEK_SET);
8165 
8166         return fd;
8167     }
8168 
8169     return safe_openat(dirfd, path(pathname), flags, mode);
8170 }
8171 
8172 #define TIMER_MAGIC 0x0caf0000
8173 #define TIMER_MAGIC_MASK 0xffff0000
8174 
8175 /* Convert QEMU provided timer ID back to internal 16bit index format */
8176 static target_timer_t get_timer_id(abi_long arg)
8177 {
8178     target_timer_t timerid = arg;
8179 
8180     if ((timerid & TIMER_MAGIC_MASK) != TIMER_MAGIC) {
8181         return -TARGET_EINVAL;
8182     }
8183 
8184     timerid &= 0xffff;
8185 
8186     if (timerid >= ARRAY_SIZE(g_posix_timers)) {
8187         return -TARGET_EINVAL;
8188     }
8189 
8190     return timerid;
8191 }
8192 
8193 static int target_to_host_cpu_mask(unsigned long *host_mask,
8194                                    size_t host_size,
8195                                    abi_ulong target_addr,
8196                                    size_t target_size)
8197 {
8198     unsigned target_bits = sizeof(abi_ulong) * 8;
8199     unsigned host_bits = sizeof(*host_mask) * 8;
8200     abi_ulong *target_mask;
8201     unsigned i, j;
8202 
8203     assert(host_size >= target_size);
8204 
8205     target_mask = lock_user(VERIFY_READ, target_addr, target_size, 1);
8206     if (!target_mask) {
8207         return -TARGET_EFAULT;
8208     }
8209     memset(host_mask, 0, host_size);
8210 
8211     for (i = 0 ; i < target_size / sizeof(abi_ulong); i++) {
8212         unsigned bit = i * target_bits;
8213         abi_ulong val;
8214 
8215         __get_user(val, &target_mask[i]);
8216         for (j = 0; j < target_bits; j++, bit++) {
8217             if (val & (1UL << j)) {
8218                 host_mask[bit / host_bits] |= 1UL << (bit % host_bits);
8219             }
8220         }
8221     }
8222 
8223     unlock_user(target_mask, target_addr, 0);
8224     return 0;
8225 }
8226 
8227 static int host_to_target_cpu_mask(const unsigned long *host_mask,
8228                                    size_t host_size,
8229                                    abi_ulong target_addr,
8230                                    size_t target_size)
8231 {
8232     unsigned target_bits = sizeof(abi_ulong) * 8;
8233     unsigned host_bits = sizeof(*host_mask) * 8;
8234     abi_ulong *target_mask;
8235     unsigned i, j;
8236 
8237     assert(host_size >= target_size);
8238 
8239     target_mask = lock_user(VERIFY_WRITE, target_addr, target_size, 0);
8240     if (!target_mask) {
8241         return -TARGET_EFAULT;
8242     }
8243 
8244     for (i = 0 ; i < target_size / sizeof(abi_ulong); i++) {
8245         unsigned bit = i * target_bits;
8246         abi_ulong val = 0;
8247 
8248         for (j = 0; j < target_bits; j++, bit++) {
8249             if (host_mask[bit / host_bits] & (1UL << (bit % host_bits))) {
8250                 val |= 1UL << j;
8251             }
8252         }
8253         __put_user(val, &target_mask[i]);
8254     }
8255 
8256     unlock_user(target_mask, target_addr, target_size);
8257     return 0;
8258 }
8259 
8260 #if defined(TARGET_NR_pivot_root) && defined(__NR_pivot_root)
8261 _syscall2(int, pivot_root, const char *, new_root, const char *, put_old)
8262 #endif
8263 
8264 /* This is an internal helper for do_syscall so that it is easier
8265  * to have a single return point, so that actions, such as logging
8266  * of syscall results, can be performed.
8267  * All errnos that do_syscall() returns must be -TARGET_<errcode>.
8268  */
8269 static abi_long do_syscall1(void *cpu_env, int num, abi_long arg1,
8270                             abi_long arg2, abi_long arg3, abi_long arg4,
8271                             abi_long arg5, abi_long arg6, abi_long arg7,
8272                             abi_long arg8)
8273 {
8274     CPUState *cpu = env_cpu(cpu_env);
8275     abi_long ret;
8276 #if defined(TARGET_NR_stat) || defined(TARGET_NR_stat64) \
8277     || defined(TARGET_NR_lstat) || defined(TARGET_NR_lstat64) \
8278     || defined(TARGET_NR_fstat) || defined(TARGET_NR_fstat64) \
8279     || defined(TARGET_NR_statx)
8280     struct stat st;
8281 #endif
8282 #if defined(TARGET_NR_statfs) || defined(TARGET_NR_statfs64) \
8283     || defined(TARGET_NR_fstatfs)
8284     struct statfs stfs;
8285 #endif
8286     void *p;
8287 
8288     switch(num) {
8289     case TARGET_NR_exit:
8290         /* In old applications this may be used to implement _exit(2).
8291            However in threaded applications it is used for thread termination,
8292            and _exit_group is used for application termination.
8293            Do thread termination if we have more then one thread.  */
8294 
8295         if (block_signals()) {
8296             return -TARGET_ERESTARTSYS;
8297         }
8298 
8299         pthread_mutex_lock(&clone_lock);
8300 
8301         if (CPU_NEXT(first_cpu)) {
8302             TaskState *ts = cpu->opaque;
8303 
8304             object_property_set_bool(OBJECT(cpu), "realized", false, NULL);
8305             object_unref(OBJECT(cpu));
8306             /*
8307              * At this point the CPU should be unrealized and removed
8308              * from cpu lists. We can clean-up the rest of the thread
8309              * data without the lock held.
8310              */
8311 
8312             pthread_mutex_unlock(&clone_lock);
8313 
8314             if (ts->child_tidptr) {
8315                 put_user_u32(0, ts->child_tidptr);
8316                 do_sys_futex(g2h(cpu, ts->child_tidptr),
8317                              FUTEX_WAKE, INT_MAX, NULL, NULL, 0);
8318             }
8319             thread_cpu = NULL;
8320             g_free(ts);
8321             rcu_unregister_thread();
8322             pthread_exit(NULL);
8323         }
8324 
8325         pthread_mutex_unlock(&clone_lock);
8326         preexit_cleanup(cpu_env, arg1);
8327         _exit(arg1);
8328         return 0; /* avoid warning */
8329     case TARGET_NR_read:
8330         if (arg2 == 0 && arg3 == 0) {
8331             return get_errno(safe_read(arg1, 0, 0));
8332         } else {
8333             if (!(p = lock_user(VERIFY_WRITE, arg2, arg3, 0)))
8334                 return -TARGET_EFAULT;
8335             ret = get_errno(safe_read(arg1, p, arg3));
8336             if (ret >= 0 &&
8337                 fd_trans_host_to_target_data(arg1)) {
8338                 ret = fd_trans_host_to_target_data(arg1)(p, ret);
8339             }
8340             unlock_user(p, arg2, ret);
8341         }
8342         return ret;
8343     case TARGET_NR_write:
8344         if (arg2 == 0 && arg3 == 0) {
8345             return get_errno(safe_write(arg1, 0, 0));
8346         }
8347         if (!(p = lock_user(VERIFY_READ, arg2, arg3, 1)))
8348             return -TARGET_EFAULT;
8349         if (fd_trans_target_to_host_data(arg1)) {
8350             void *copy = g_malloc(arg3);
8351             memcpy(copy, p, arg3);
8352             ret = fd_trans_target_to_host_data(arg1)(copy, arg3);
8353             if (ret >= 0) {
8354                 ret = get_errno(safe_write(arg1, copy, ret));
8355             }
8356             g_free(copy);
8357         } else {
8358             ret = get_errno(safe_write(arg1, p, arg3));
8359         }
8360         unlock_user(p, arg2, 0);
8361         return ret;
8362 
8363 #ifdef TARGET_NR_open
8364     case TARGET_NR_open:
8365         if (!(p = lock_user_string(arg1)))
8366             return -TARGET_EFAULT;
8367         ret = get_errno(do_openat(cpu_env, AT_FDCWD, p,
8368                                   target_to_host_bitmask(arg2, fcntl_flags_tbl),
8369                                   arg3));
8370         fd_trans_unregister(ret);
8371         unlock_user(p, arg1, 0);
8372         return ret;
8373 #endif
8374     case TARGET_NR_openat:
8375         if (!(p = lock_user_string(arg2)))
8376             return -TARGET_EFAULT;
8377         ret = get_errno(do_openat(cpu_env, arg1, p,
8378                                   target_to_host_bitmask(arg3, fcntl_flags_tbl),
8379                                   arg4));
8380         fd_trans_unregister(ret);
8381         unlock_user(p, arg2, 0);
8382         return ret;
8383 #if defined(TARGET_NR_name_to_handle_at) && defined(CONFIG_OPEN_BY_HANDLE)
8384     case TARGET_NR_name_to_handle_at:
8385         ret = do_name_to_handle_at(arg1, arg2, arg3, arg4, arg5);
8386         return ret;
8387 #endif
8388 #if defined(TARGET_NR_open_by_handle_at) && defined(CONFIG_OPEN_BY_HANDLE)
8389     case TARGET_NR_open_by_handle_at:
8390         ret = do_open_by_handle_at(arg1, arg2, arg3);
8391         fd_trans_unregister(ret);
8392         return ret;
8393 #endif
8394     case TARGET_NR_close:
8395         fd_trans_unregister(arg1);
8396         return get_errno(close(arg1));
8397 
8398     case TARGET_NR_brk:
8399         return do_brk(arg1);
8400 #ifdef TARGET_NR_fork
8401     case TARGET_NR_fork:
8402         return get_errno(do_fork(cpu_env, TARGET_SIGCHLD, 0, 0, 0, 0));
8403 #endif
8404 #ifdef TARGET_NR_waitpid
8405     case TARGET_NR_waitpid:
8406         {
8407             int status;
8408             ret = get_errno(safe_wait4(arg1, &status, arg3, 0));
8409             if (!is_error(ret) && arg2 && ret
8410                 && put_user_s32(host_to_target_waitstatus(status), arg2))
8411                 return -TARGET_EFAULT;
8412         }
8413         return ret;
8414 #endif
8415 #ifdef TARGET_NR_waitid
8416     case TARGET_NR_waitid:
8417         {
8418             siginfo_t info;
8419             info.si_pid = 0;
8420             ret = get_errno(safe_waitid(arg1, arg2, &info, arg4, NULL));
8421             if (!is_error(ret) && arg3 && info.si_pid != 0) {
8422                 if (!(p = lock_user(VERIFY_WRITE, arg3, sizeof(target_siginfo_t), 0)))
8423                     return -TARGET_EFAULT;
8424                 host_to_target_siginfo(p, &info);
8425                 unlock_user(p, arg3, sizeof(target_siginfo_t));
8426             }
8427         }
8428         return ret;
8429 #endif
8430 #ifdef TARGET_NR_creat /* not on alpha */
8431     case TARGET_NR_creat:
8432         if (!(p = lock_user_string(arg1)))
8433             return -TARGET_EFAULT;
8434         ret = get_errno(creat(p, arg2));
8435         fd_trans_unregister(ret);
8436         unlock_user(p, arg1, 0);
8437         return ret;
8438 #endif
8439 #ifdef TARGET_NR_link
8440     case TARGET_NR_link:
8441         {
8442             void * p2;
8443             p = lock_user_string(arg1);
8444             p2 = lock_user_string(arg2);
8445             if (!p || !p2)
8446                 ret = -TARGET_EFAULT;
8447             else
8448                 ret = get_errno(link(p, p2));
8449             unlock_user(p2, arg2, 0);
8450             unlock_user(p, arg1, 0);
8451         }
8452         return ret;
8453 #endif
8454 #if defined(TARGET_NR_linkat)
8455     case TARGET_NR_linkat:
8456         {
8457             void * p2 = NULL;
8458             if (!arg2 || !arg4)
8459                 return -TARGET_EFAULT;
8460             p  = lock_user_string(arg2);
8461             p2 = lock_user_string(arg4);
8462             if (!p || !p2)
8463                 ret = -TARGET_EFAULT;
8464             else
8465                 ret = get_errno(linkat(arg1, p, arg3, p2, arg5));
8466             unlock_user(p, arg2, 0);
8467             unlock_user(p2, arg4, 0);
8468         }
8469         return ret;
8470 #endif
8471 #ifdef TARGET_NR_unlink
8472     case TARGET_NR_unlink:
8473         if (!(p = lock_user_string(arg1)))
8474             return -TARGET_EFAULT;
8475         ret = get_errno(unlink(p));
8476         unlock_user(p, arg1, 0);
8477         return ret;
8478 #endif
8479 #if defined(TARGET_NR_unlinkat)
8480     case TARGET_NR_unlinkat:
8481         if (!(p = lock_user_string(arg2)))
8482             return -TARGET_EFAULT;
8483         ret = get_errno(unlinkat(arg1, p, arg3));
8484         unlock_user(p, arg2, 0);
8485         return ret;
8486 #endif
8487     case TARGET_NR_execve:
8488         {
8489             char **argp, **envp;
8490             int argc, envc;
8491             abi_ulong gp;
8492             abi_ulong guest_argp;
8493             abi_ulong guest_envp;
8494             abi_ulong addr;
8495             char **q;
8496             int total_size = 0;
8497 
8498             argc = 0;
8499             guest_argp = arg2;
8500             for (gp = guest_argp; gp; gp += sizeof(abi_ulong)) {
8501                 if (get_user_ual(addr, gp))
8502                     return -TARGET_EFAULT;
8503                 if (!addr)
8504                     break;
8505                 argc++;
8506             }
8507             envc = 0;
8508             guest_envp = arg3;
8509             for (gp = guest_envp; gp; gp += sizeof(abi_ulong)) {
8510                 if (get_user_ual(addr, gp))
8511                     return -TARGET_EFAULT;
8512                 if (!addr)
8513                     break;
8514                 envc++;
8515             }
8516 
8517             argp = g_new0(char *, argc + 1);
8518             envp = g_new0(char *, envc + 1);
8519 
8520             for (gp = guest_argp, q = argp; gp;
8521                   gp += sizeof(abi_ulong), q++) {
8522                 if (get_user_ual(addr, gp))
8523                     goto execve_efault;
8524                 if (!addr)
8525                     break;
8526                 if (!(*q = lock_user_string(addr)))
8527                     goto execve_efault;
8528                 total_size += strlen(*q) + 1;
8529             }
8530             *q = NULL;
8531 
8532             for (gp = guest_envp, q = envp; gp;
8533                   gp += sizeof(abi_ulong), q++) {
8534                 if (get_user_ual(addr, gp))
8535                     goto execve_efault;
8536                 if (!addr)
8537                     break;
8538                 if (!(*q = lock_user_string(addr)))
8539                     goto execve_efault;
8540                 total_size += strlen(*q) + 1;
8541             }
8542             *q = NULL;
8543 
8544             if (!(p = lock_user_string(arg1)))
8545                 goto execve_efault;
8546             /* Although execve() is not an interruptible syscall it is
8547              * a special case where we must use the safe_syscall wrapper:
8548              * if we allow a signal to happen before we make the host
8549              * syscall then we will 'lose' it, because at the point of
8550              * execve the process leaves QEMU's control. So we use the
8551              * safe syscall wrapper to ensure that we either take the
8552              * signal as a guest signal, or else it does not happen
8553              * before the execve completes and makes it the other
8554              * program's problem.
8555              */
8556             ret = get_errno(safe_execve(p, argp, envp));
8557             unlock_user(p, arg1, 0);
8558 
8559             goto execve_end;
8560 
8561         execve_efault:
8562             ret = -TARGET_EFAULT;
8563 
8564         execve_end:
8565             for (gp = guest_argp, q = argp; *q;
8566                   gp += sizeof(abi_ulong), q++) {
8567                 if (get_user_ual(addr, gp)
8568                     || !addr)
8569                     break;
8570                 unlock_user(*q, addr, 0);
8571             }
8572             for (gp = guest_envp, q = envp; *q;
8573                   gp += sizeof(abi_ulong), q++) {
8574                 if (get_user_ual(addr, gp)
8575                     || !addr)
8576                     break;
8577                 unlock_user(*q, addr, 0);
8578             }
8579 
8580             g_free(argp);
8581             g_free(envp);
8582         }
8583         return ret;
8584     case TARGET_NR_chdir:
8585         if (!(p = lock_user_string(arg1)))
8586             return -TARGET_EFAULT;
8587         ret = get_errno(chdir(p));
8588         unlock_user(p, arg1, 0);
8589         return ret;
8590 #ifdef TARGET_NR_time
8591     case TARGET_NR_time:
8592         {
8593             time_t host_time;
8594             ret = get_errno(time(&host_time));
8595             if (!is_error(ret)
8596                 && arg1
8597                 && put_user_sal(host_time, arg1))
8598                 return -TARGET_EFAULT;
8599         }
8600         return ret;
8601 #endif
8602 #ifdef TARGET_NR_mknod
8603     case TARGET_NR_mknod:
8604         if (!(p = lock_user_string(arg1)))
8605             return -TARGET_EFAULT;
8606         ret = get_errno(mknod(p, arg2, arg3));
8607         unlock_user(p, arg1, 0);
8608         return ret;
8609 #endif
8610 #if defined(TARGET_NR_mknodat)
8611     case TARGET_NR_mknodat:
8612         if (!(p = lock_user_string(arg2)))
8613             return -TARGET_EFAULT;
8614         ret = get_errno(mknodat(arg1, p, arg3, arg4));
8615         unlock_user(p, arg2, 0);
8616         return ret;
8617 #endif
8618 #ifdef TARGET_NR_chmod
8619     case TARGET_NR_chmod:
8620         if (!(p = lock_user_string(arg1)))
8621             return -TARGET_EFAULT;
8622         ret = get_errno(chmod(p, arg2));
8623         unlock_user(p, arg1, 0);
8624         return ret;
8625 #endif
8626 #ifdef TARGET_NR_lseek
8627     case TARGET_NR_lseek:
8628         return get_errno(lseek(arg1, arg2, arg3));
8629 #endif
8630 #if defined(TARGET_NR_getxpid) && defined(TARGET_ALPHA)
8631     /* Alpha specific */
8632     case TARGET_NR_getxpid:
8633         ((CPUAlphaState *)cpu_env)->ir[IR_A4] = getppid();
8634         return get_errno(getpid());
8635 #endif
8636 #ifdef TARGET_NR_getpid
8637     case TARGET_NR_getpid:
8638         return get_errno(getpid());
8639 #endif
8640     case TARGET_NR_mount:
8641         {
8642             /* need to look at the data field */
8643             void *p2, *p3;
8644 
8645             if (arg1) {
8646                 p = lock_user_string(arg1);
8647                 if (!p) {
8648                     return -TARGET_EFAULT;
8649                 }
8650             } else {
8651                 p = NULL;
8652             }
8653 
8654             p2 = lock_user_string(arg2);
8655             if (!p2) {
8656                 if (arg1) {
8657                     unlock_user(p, arg1, 0);
8658                 }
8659                 return -TARGET_EFAULT;
8660             }
8661 
8662             if (arg3) {
8663                 p3 = lock_user_string(arg3);
8664                 if (!p3) {
8665                     if (arg1) {
8666                         unlock_user(p, arg1, 0);
8667                     }
8668                     unlock_user(p2, arg2, 0);
8669                     return -TARGET_EFAULT;
8670                 }
8671             } else {
8672                 p3 = NULL;
8673             }
8674 
8675             /* FIXME - arg5 should be locked, but it isn't clear how to
8676              * do that since it's not guaranteed to be a NULL-terminated
8677              * string.
8678              */
8679             if (!arg5) {
8680                 ret = mount(p, p2, p3, (unsigned long)arg4, NULL);
8681             } else {
8682                 ret = mount(p, p2, p3, (unsigned long)arg4, g2h(cpu, arg5));
8683             }
8684             ret = get_errno(ret);
8685 
8686             if (arg1) {
8687                 unlock_user(p, arg1, 0);
8688             }
8689             unlock_user(p2, arg2, 0);
8690             if (arg3) {
8691                 unlock_user(p3, arg3, 0);
8692             }
8693         }
8694         return ret;
8695 #if defined(TARGET_NR_umount) || defined(TARGET_NR_oldumount)
8696 #if defined(TARGET_NR_umount)
8697     case TARGET_NR_umount:
8698 #endif
8699 #if defined(TARGET_NR_oldumount)
8700     case TARGET_NR_oldumount:
8701 #endif
8702         if (!(p = lock_user_string(arg1)))
8703             return -TARGET_EFAULT;
8704         ret = get_errno(umount(p));
8705         unlock_user(p, arg1, 0);
8706         return ret;
8707 #endif
8708 #ifdef TARGET_NR_stime /* not on alpha */
8709     case TARGET_NR_stime:
8710         {
8711             struct timespec ts;
8712             ts.tv_nsec = 0;
8713             if (get_user_sal(ts.tv_sec, arg1)) {
8714                 return -TARGET_EFAULT;
8715             }
8716             return get_errno(clock_settime(CLOCK_REALTIME, &ts));
8717         }
8718 #endif
8719 #ifdef TARGET_NR_alarm /* not on alpha */
8720     case TARGET_NR_alarm:
8721         return alarm(arg1);
8722 #endif
8723 #ifdef TARGET_NR_pause /* not on alpha */
8724     case TARGET_NR_pause:
8725         if (!block_signals()) {
8726             sigsuspend(&((TaskState *)cpu->opaque)->signal_mask);
8727         }
8728         return -TARGET_EINTR;
8729 #endif
8730 #ifdef TARGET_NR_utime
8731     case TARGET_NR_utime:
8732         {
8733             struct utimbuf tbuf, *host_tbuf;
8734             struct target_utimbuf *target_tbuf;
8735             if (arg2) {
8736                 if (!lock_user_struct(VERIFY_READ, target_tbuf, arg2, 1))
8737                     return -TARGET_EFAULT;
8738                 tbuf.actime = tswapal(target_tbuf->actime);
8739                 tbuf.modtime = tswapal(target_tbuf->modtime);
8740                 unlock_user_struct(target_tbuf, arg2, 0);
8741                 host_tbuf = &tbuf;
8742             } else {
8743                 host_tbuf = NULL;
8744             }
8745             if (!(p = lock_user_string(arg1)))
8746                 return -TARGET_EFAULT;
8747             ret = get_errno(utime(p, host_tbuf));
8748             unlock_user(p, arg1, 0);
8749         }
8750         return ret;
8751 #endif
8752 #ifdef TARGET_NR_utimes
8753     case TARGET_NR_utimes:
8754         {
8755             struct timeval *tvp, tv[2];
8756             if (arg2) {
8757                 if (copy_from_user_timeval(&tv[0], arg2)
8758                     || copy_from_user_timeval(&tv[1],
8759                                               arg2 + sizeof(struct target_timeval)))
8760                     return -TARGET_EFAULT;
8761                 tvp = tv;
8762             } else {
8763                 tvp = NULL;
8764             }
8765             if (!(p = lock_user_string(arg1)))
8766                 return -TARGET_EFAULT;
8767             ret = get_errno(utimes(p, tvp));
8768             unlock_user(p, arg1, 0);
8769         }
8770         return ret;
8771 #endif
8772 #if defined(TARGET_NR_futimesat)
8773     case TARGET_NR_futimesat:
8774         {
8775             struct timeval *tvp, tv[2];
8776             if (arg3) {
8777                 if (copy_from_user_timeval(&tv[0], arg3)
8778                     || copy_from_user_timeval(&tv[1],
8779                                               arg3 + sizeof(struct target_timeval)))
8780                     return -TARGET_EFAULT;
8781                 tvp = tv;
8782             } else {
8783                 tvp = NULL;
8784             }
8785             if (!(p = lock_user_string(arg2))) {
8786                 return -TARGET_EFAULT;
8787             }
8788             ret = get_errno(futimesat(arg1, path(p), tvp));
8789             unlock_user(p, arg2, 0);
8790         }
8791         return ret;
8792 #endif
8793 #ifdef TARGET_NR_access
8794     case TARGET_NR_access:
8795         if (!(p = lock_user_string(arg1))) {
8796             return -TARGET_EFAULT;
8797         }
8798         ret = get_errno(access(path(p), arg2));
8799         unlock_user(p, arg1, 0);
8800         return ret;
8801 #endif
8802 #if defined(TARGET_NR_faccessat) && defined(__NR_faccessat)
8803     case TARGET_NR_faccessat:
8804         if (!(p = lock_user_string(arg2))) {
8805             return -TARGET_EFAULT;
8806         }
8807         ret = get_errno(faccessat(arg1, p, arg3, 0));
8808         unlock_user(p, arg2, 0);
8809         return ret;
8810 #endif
8811 #ifdef TARGET_NR_nice /* not on alpha */
8812     case TARGET_NR_nice:
8813         return get_errno(nice(arg1));
8814 #endif
8815     case TARGET_NR_sync:
8816         sync();
8817         return 0;
8818 #if defined(TARGET_NR_syncfs) && defined(CONFIG_SYNCFS)
8819     case TARGET_NR_syncfs:
8820         return get_errno(syncfs(arg1));
8821 #endif
8822     case TARGET_NR_kill:
8823         return get_errno(safe_kill(arg1, target_to_host_signal(arg2)));
8824 #ifdef TARGET_NR_rename
8825     case TARGET_NR_rename:
8826         {
8827             void *p2;
8828             p = lock_user_string(arg1);
8829             p2 = lock_user_string(arg2);
8830             if (!p || !p2)
8831                 ret = -TARGET_EFAULT;
8832             else
8833                 ret = get_errno(rename(p, p2));
8834             unlock_user(p2, arg2, 0);
8835             unlock_user(p, arg1, 0);
8836         }
8837         return ret;
8838 #endif
8839 #if defined(TARGET_NR_renameat)
8840     case TARGET_NR_renameat:
8841         {
8842             void *p2;
8843             p  = lock_user_string(arg2);
8844             p2 = lock_user_string(arg4);
8845             if (!p || !p2)
8846                 ret = -TARGET_EFAULT;
8847             else
8848                 ret = get_errno(renameat(arg1, p, arg3, p2));
8849             unlock_user(p2, arg4, 0);
8850             unlock_user(p, arg2, 0);
8851         }
8852         return ret;
8853 #endif
8854 #if defined(TARGET_NR_renameat2)
8855     case TARGET_NR_renameat2:
8856         {
8857             void *p2;
8858             p  = lock_user_string(arg2);
8859             p2 = lock_user_string(arg4);
8860             if (!p || !p2) {
8861                 ret = -TARGET_EFAULT;
8862             } else {
8863                 ret = get_errno(sys_renameat2(arg1, p, arg3, p2, arg5));
8864             }
8865             unlock_user(p2, arg4, 0);
8866             unlock_user(p, arg2, 0);
8867         }
8868         return ret;
8869 #endif
8870 #ifdef TARGET_NR_mkdir
8871     case TARGET_NR_mkdir:
8872         if (!(p = lock_user_string(arg1)))
8873             return -TARGET_EFAULT;
8874         ret = get_errno(mkdir(p, arg2));
8875         unlock_user(p, arg1, 0);
8876         return ret;
8877 #endif
8878 #if defined(TARGET_NR_mkdirat)
8879     case TARGET_NR_mkdirat:
8880         if (!(p = lock_user_string(arg2)))
8881             return -TARGET_EFAULT;
8882         ret = get_errno(mkdirat(arg1, p, arg3));
8883         unlock_user(p, arg2, 0);
8884         return ret;
8885 #endif
8886 #ifdef TARGET_NR_rmdir
8887     case TARGET_NR_rmdir:
8888         if (!(p = lock_user_string(arg1)))
8889             return -TARGET_EFAULT;
8890         ret = get_errno(rmdir(p));
8891         unlock_user(p, arg1, 0);
8892         return ret;
8893 #endif
8894     case TARGET_NR_dup:
8895         ret = get_errno(dup(arg1));
8896         if (ret >= 0) {
8897             fd_trans_dup(arg1, ret);
8898         }
8899         return ret;
8900 #ifdef TARGET_NR_pipe
8901     case TARGET_NR_pipe:
8902         return do_pipe(cpu_env, arg1, 0, 0);
8903 #endif
8904 #ifdef TARGET_NR_pipe2
8905     case TARGET_NR_pipe2:
8906         return do_pipe(cpu_env, arg1,
8907                        target_to_host_bitmask(arg2, fcntl_flags_tbl), 1);
8908 #endif
8909     case TARGET_NR_times:
8910         {
8911             struct target_tms *tmsp;
8912             struct tms tms;
8913             ret = get_errno(times(&tms));
8914             if (arg1) {
8915                 tmsp = lock_user(VERIFY_WRITE, arg1, sizeof(struct target_tms), 0);
8916                 if (!tmsp)
8917                     return -TARGET_EFAULT;
8918                 tmsp->tms_utime = tswapal(host_to_target_clock_t(tms.tms_utime));
8919                 tmsp->tms_stime = tswapal(host_to_target_clock_t(tms.tms_stime));
8920                 tmsp->tms_cutime = tswapal(host_to_target_clock_t(tms.tms_cutime));
8921                 tmsp->tms_cstime = tswapal(host_to_target_clock_t(tms.tms_cstime));
8922             }
8923             if (!is_error(ret))
8924                 ret = host_to_target_clock_t(ret);
8925         }
8926         return ret;
8927     case TARGET_NR_acct:
8928         if (arg1 == 0) {
8929             ret = get_errno(acct(NULL));
8930         } else {
8931             if (!(p = lock_user_string(arg1))) {
8932                 return -TARGET_EFAULT;
8933             }
8934             ret = get_errno(acct(path(p)));
8935             unlock_user(p, arg1, 0);
8936         }
8937         return ret;
8938 #ifdef TARGET_NR_umount2
8939     case TARGET_NR_umount2:
8940         if (!(p = lock_user_string(arg1)))
8941             return -TARGET_EFAULT;
8942         ret = get_errno(umount2(p, arg2));
8943         unlock_user(p, arg1, 0);
8944         return ret;
8945 #endif
8946     case TARGET_NR_ioctl:
8947         return do_ioctl(arg1, arg2, arg3);
8948 #ifdef TARGET_NR_fcntl
8949     case TARGET_NR_fcntl:
8950         return do_fcntl(arg1, arg2, arg3);
8951 #endif
8952     case TARGET_NR_setpgid:
8953         return get_errno(setpgid(arg1, arg2));
8954     case TARGET_NR_umask:
8955         return get_errno(umask(arg1));
8956     case TARGET_NR_chroot:
8957         if (!(p = lock_user_string(arg1)))
8958             return -TARGET_EFAULT;
8959         ret = get_errno(chroot(p));
8960         unlock_user(p, arg1, 0);
8961         return ret;
8962 #ifdef TARGET_NR_dup2
8963     case TARGET_NR_dup2:
8964         ret = get_errno(dup2(arg1, arg2));
8965         if (ret >= 0) {
8966             fd_trans_dup(arg1, arg2);
8967         }
8968         return ret;
8969 #endif
8970 #if defined(CONFIG_DUP3) && defined(TARGET_NR_dup3)
8971     case TARGET_NR_dup3:
8972     {
8973         int host_flags;
8974 
8975         if ((arg3 & ~TARGET_O_CLOEXEC) != 0) {
8976             return -EINVAL;
8977         }
8978         host_flags = target_to_host_bitmask(arg3, fcntl_flags_tbl);
8979         ret = get_errno(dup3(arg1, arg2, host_flags));
8980         if (ret >= 0) {
8981             fd_trans_dup(arg1, arg2);
8982         }
8983         return ret;
8984     }
8985 #endif
8986 #ifdef TARGET_NR_getppid /* not on alpha */
8987     case TARGET_NR_getppid:
8988         return get_errno(getppid());
8989 #endif
8990 #ifdef TARGET_NR_getpgrp
8991     case TARGET_NR_getpgrp:
8992         return get_errno(getpgrp());
8993 #endif
8994     case TARGET_NR_setsid:
8995         return get_errno(setsid());
8996 #ifdef TARGET_NR_sigaction
8997     case TARGET_NR_sigaction:
8998         {
8999 #if defined(TARGET_MIPS)
9000 	    struct target_sigaction act, oact, *pact, *old_act;
9001 
9002 	    if (arg2) {
9003                 if (!lock_user_struct(VERIFY_READ, old_act, arg2, 1))
9004                     return -TARGET_EFAULT;
9005 		act._sa_handler = old_act->_sa_handler;
9006 		target_siginitset(&act.sa_mask, old_act->sa_mask.sig[0]);
9007 		act.sa_flags = old_act->sa_flags;
9008 		unlock_user_struct(old_act, arg2, 0);
9009 		pact = &act;
9010 	    } else {
9011 		pact = NULL;
9012 	    }
9013 
9014         ret = get_errno(do_sigaction(arg1, pact, &oact, 0));
9015 
9016 	    if (!is_error(ret) && arg3) {
9017                 if (!lock_user_struct(VERIFY_WRITE, old_act, arg3, 0))
9018                     return -TARGET_EFAULT;
9019 		old_act->_sa_handler = oact._sa_handler;
9020 		old_act->sa_flags = oact.sa_flags;
9021 		old_act->sa_mask.sig[0] = oact.sa_mask.sig[0];
9022 		old_act->sa_mask.sig[1] = 0;
9023 		old_act->sa_mask.sig[2] = 0;
9024 		old_act->sa_mask.sig[3] = 0;
9025 		unlock_user_struct(old_act, arg3, 1);
9026 	    }
9027 #else
9028             struct target_old_sigaction *old_act;
9029             struct target_sigaction act, oact, *pact;
9030             if (arg2) {
9031                 if (!lock_user_struct(VERIFY_READ, old_act, arg2, 1))
9032                     return -TARGET_EFAULT;
9033                 act._sa_handler = old_act->_sa_handler;
9034                 target_siginitset(&act.sa_mask, old_act->sa_mask);
9035                 act.sa_flags = old_act->sa_flags;
9036 #ifdef TARGET_ARCH_HAS_SA_RESTORER
9037                 act.sa_restorer = old_act->sa_restorer;
9038 #endif
9039                 unlock_user_struct(old_act, arg2, 0);
9040                 pact = &act;
9041             } else {
9042                 pact = NULL;
9043             }
9044             ret = get_errno(do_sigaction(arg1, pact, &oact, 0));
9045             if (!is_error(ret) && arg3) {
9046                 if (!lock_user_struct(VERIFY_WRITE, old_act, arg3, 0))
9047                     return -TARGET_EFAULT;
9048                 old_act->_sa_handler = oact._sa_handler;
9049                 old_act->sa_mask = oact.sa_mask.sig[0];
9050                 old_act->sa_flags = oact.sa_flags;
9051 #ifdef TARGET_ARCH_HAS_SA_RESTORER
9052                 old_act->sa_restorer = oact.sa_restorer;
9053 #endif
9054                 unlock_user_struct(old_act, arg3, 1);
9055             }
9056 #endif
9057         }
9058         return ret;
9059 #endif
9060     case TARGET_NR_rt_sigaction:
9061         {
9062             /*
9063              * For Alpha and SPARC this is a 5 argument syscall, with
9064              * a 'restorer' parameter which must be copied into the
9065              * sa_restorer field of the sigaction struct.
9066              * For Alpha that 'restorer' is arg5; for SPARC it is arg4,
9067              * and arg5 is the sigsetsize.
9068              */
9069 #if defined(TARGET_ALPHA)
9070             target_ulong sigsetsize = arg4;
9071             target_ulong restorer = arg5;
9072 #elif defined(TARGET_SPARC)
9073             target_ulong restorer = arg4;
9074             target_ulong sigsetsize = arg5;
9075 #else
9076             target_ulong sigsetsize = arg4;
9077             target_ulong restorer = 0;
9078 #endif
9079             struct target_sigaction *act = NULL;
9080             struct target_sigaction *oact = NULL;
9081 
9082             if (sigsetsize != sizeof(target_sigset_t)) {
9083                 return -TARGET_EINVAL;
9084             }
9085             if (arg2 && !lock_user_struct(VERIFY_READ, act, arg2, 1)) {
9086                 return -TARGET_EFAULT;
9087             }
9088             if (arg3 && !lock_user_struct(VERIFY_WRITE, oact, arg3, 0)) {
9089                 ret = -TARGET_EFAULT;
9090             } else {
9091                 ret = get_errno(do_sigaction(arg1, act, oact, restorer));
9092                 if (oact) {
9093                     unlock_user_struct(oact, arg3, 1);
9094                 }
9095             }
9096             if (act) {
9097                 unlock_user_struct(act, arg2, 0);
9098             }
9099         }
9100         return ret;
9101 #ifdef TARGET_NR_sgetmask /* not on alpha */
9102     case TARGET_NR_sgetmask:
9103         {
9104             sigset_t cur_set;
9105             abi_ulong target_set;
9106             ret = do_sigprocmask(0, NULL, &cur_set);
9107             if (!ret) {
9108                 host_to_target_old_sigset(&target_set, &cur_set);
9109                 ret = target_set;
9110             }
9111         }
9112         return ret;
9113 #endif
9114 #ifdef TARGET_NR_ssetmask /* not on alpha */
9115     case TARGET_NR_ssetmask:
9116         {
9117             sigset_t set, oset;
9118             abi_ulong target_set = arg1;
9119             target_to_host_old_sigset(&set, &target_set);
9120             ret = do_sigprocmask(SIG_SETMASK, &set, &oset);
9121             if (!ret) {
9122                 host_to_target_old_sigset(&target_set, &oset);
9123                 ret = target_set;
9124             }
9125         }
9126         return ret;
9127 #endif
9128 #ifdef TARGET_NR_sigprocmask
9129     case TARGET_NR_sigprocmask:
9130         {
9131 #if defined(TARGET_ALPHA)
9132             sigset_t set, oldset;
9133             abi_ulong mask;
9134             int how;
9135 
9136             switch (arg1) {
9137             case TARGET_SIG_BLOCK:
9138                 how = SIG_BLOCK;
9139                 break;
9140             case TARGET_SIG_UNBLOCK:
9141                 how = SIG_UNBLOCK;
9142                 break;
9143             case TARGET_SIG_SETMASK:
9144                 how = SIG_SETMASK;
9145                 break;
9146             default:
9147                 return -TARGET_EINVAL;
9148             }
9149             mask = arg2;
9150             target_to_host_old_sigset(&set, &mask);
9151 
9152             ret = do_sigprocmask(how, &set, &oldset);
9153             if (!is_error(ret)) {
9154                 host_to_target_old_sigset(&mask, &oldset);
9155                 ret = mask;
9156                 ((CPUAlphaState *)cpu_env)->ir[IR_V0] = 0; /* force no error */
9157             }
9158 #else
9159             sigset_t set, oldset, *set_ptr;
9160             int how;
9161 
9162             if (arg2) {
9163                 switch (arg1) {
9164                 case TARGET_SIG_BLOCK:
9165                     how = SIG_BLOCK;
9166                     break;
9167                 case TARGET_SIG_UNBLOCK:
9168                     how = SIG_UNBLOCK;
9169                     break;
9170                 case TARGET_SIG_SETMASK:
9171                     how = SIG_SETMASK;
9172                     break;
9173                 default:
9174                     return -TARGET_EINVAL;
9175                 }
9176                 if (!(p = lock_user(VERIFY_READ, arg2, sizeof(target_sigset_t), 1)))
9177                     return -TARGET_EFAULT;
9178                 target_to_host_old_sigset(&set, p);
9179                 unlock_user(p, arg2, 0);
9180                 set_ptr = &set;
9181             } else {
9182                 how = 0;
9183                 set_ptr = NULL;
9184             }
9185             ret = do_sigprocmask(how, set_ptr, &oldset);
9186             if (!is_error(ret) && arg3) {
9187                 if (!(p = lock_user(VERIFY_WRITE, arg3, sizeof(target_sigset_t), 0)))
9188                     return -TARGET_EFAULT;
9189                 host_to_target_old_sigset(p, &oldset);
9190                 unlock_user(p, arg3, sizeof(target_sigset_t));
9191             }
9192 #endif
9193         }
9194         return ret;
9195 #endif
9196     case TARGET_NR_rt_sigprocmask:
9197         {
9198             int how = arg1;
9199             sigset_t set, oldset, *set_ptr;
9200 
9201             if (arg4 != sizeof(target_sigset_t)) {
9202                 return -TARGET_EINVAL;
9203             }
9204 
9205             if (arg2) {
9206                 switch(how) {
9207                 case TARGET_SIG_BLOCK:
9208                     how = SIG_BLOCK;
9209                     break;
9210                 case TARGET_SIG_UNBLOCK:
9211                     how = SIG_UNBLOCK;
9212                     break;
9213                 case TARGET_SIG_SETMASK:
9214                     how = SIG_SETMASK;
9215                     break;
9216                 default:
9217                     return -TARGET_EINVAL;
9218                 }
9219                 if (!(p = lock_user(VERIFY_READ, arg2, sizeof(target_sigset_t), 1)))
9220                     return -TARGET_EFAULT;
9221                 target_to_host_sigset(&set, p);
9222                 unlock_user(p, arg2, 0);
9223                 set_ptr = &set;
9224             } else {
9225                 how = 0;
9226                 set_ptr = NULL;
9227             }
9228             ret = do_sigprocmask(how, set_ptr, &oldset);
9229             if (!is_error(ret) && arg3) {
9230                 if (!(p = lock_user(VERIFY_WRITE, arg3, sizeof(target_sigset_t), 0)))
9231                     return -TARGET_EFAULT;
9232                 host_to_target_sigset(p, &oldset);
9233                 unlock_user(p, arg3, sizeof(target_sigset_t));
9234             }
9235         }
9236         return ret;
9237 #ifdef TARGET_NR_sigpending
9238     case TARGET_NR_sigpending:
9239         {
9240             sigset_t set;
9241             ret = get_errno(sigpending(&set));
9242             if (!is_error(ret)) {
9243                 if (!(p = lock_user(VERIFY_WRITE, arg1, sizeof(target_sigset_t), 0)))
9244                     return -TARGET_EFAULT;
9245                 host_to_target_old_sigset(p, &set);
9246                 unlock_user(p, arg1, sizeof(target_sigset_t));
9247             }
9248         }
9249         return ret;
9250 #endif
9251     case TARGET_NR_rt_sigpending:
9252         {
9253             sigset_t set;
9254 
9255             /* Yes, this check is >, not != like most. We follow the kernel's
9256              * logic and it does it like this because it implements
9257              * NR_sigpending through the same code path, and in that case
9258              * the old_sigset_t is smaller in size.
9259              */
9260             if (arg2 > sizeof(target_sigset_t)) {
9261                 return -TARGET_EINVAL;
9262             }
9263 
9264             ret = get_errno(sigpending(&set));
9265             if (!is_error(ret)) {
9266                 if (!(p = lock_user(VERIFY_WRITE, arg1, sizeof(target_sigset_t), 0)))
9267                     return -TARGET_EFAULT;
9268                 host_to_target_sigset(p, &set);
9269                 unlock_user(p, arg1, sizeof(target_sigset_t));
9270             }
9271         }
9272         return ret;
9273 #ifdef TARGET_NR_sigsuspend
9274     case TARGET_NR_sigsuspend:
9275         {
9276             TaskState *ts = cpu->opaque;
9277 #if defined(TARGET_ALPHA)
9278             abi_ulong mask = arg1;
9279             target_to_host_old_sigset(&ts->sigsuspend_mask, &mask);
9280 #else
9281             if (!(p = lock_user(VERIFY_READ, arg1, sizeof(target_sigset_t), 1)))
9282                 return -TARGET_EFAULT;
9283             target_to_host_old_sigset(&ts->sigsuspend_mask, p);
9284             unlock_user(p, arg1, 0);
9285 #endif
9286             ret = get_errno(safe_rt_sigsuspend(&ts->sigsuspend_mask,
9287                                                SIGSET_T_SIZE));
9288             if (ret != -TARGET_ERESTARTSYS) {
9289                 ts->in_sigsuspend = 1;
9290             }
9291         }
9292         return ret;
9293 #endif
9294     case TARGET_NR_rt_sigsuspend:
9295         {
9296             TaskState *ts = cpu->opaque;
9297 
9298             if (arg2 != sizeof(target_sigset_t)) {
9299                 return -TARGET_EINVAL;
9300             }
9301             if (!(p = lock_user(VERIFY_READ, arg1, sizeof(target_sigset_t), 1)))
9302                 return -TARGET_EFAULT;
9303             target_to_host_sigset(&ts->sigsuspend_mask, p);
9304             unlock_user(p, arg1, 0);
9305             ret = get_errno(safe_rt_sigsuspend(&ts->sigsuspend_mask,
9306                                                SIGSET_T_SIZE));
9307             if (ret != -TARGET_ERESTARTSYS) {
9308                 ts->in_sigsuspend = 1;
9309             }
9310         }
9311         return ret;
9312 #ifdef TARGET_NR_rt_sigtimedwait
9313     case TARGET_NR_rt_sigtimedwait:
9314         {
9315             sigset_t set;
9316             struct timespec uts, *puts;
9317             siginfo_t uinfo;
9318 
9319             if (arg4 != sizeof(target_sigset_t)) {
9320                 return -TARGET_EINVAL;
9321             }
9322 
9323             if (!(p = lock_user(VERIFY_READ, arg1, sizeof(target_sigset_t), 1)))
9324                 return -TARGET_EFAULT;
9325             target_to_host_sigset(&set, p);
9326             unlock_user(p, arg1, 0);
9327             if (arg3) {
9328                 puts = &uts;
9329                 if (target_to_host_timespec(puts, arg3)) {
9330                     return -TARGET_EFAULT;
9331                 }
9332             } else {
9333                 puts = NULL;
9334             }
9335             ret = get_errno(safe_rt_sigtimedwait(&set, &uinfo, puts,
9336                                                  SIGSET_T_SIZE));
9337             if (!is_error(ret)) {
9338                 if (arg2) {
9339                     p = lock_user(VERIFY_WRITE, arg2, sizeof(target_siginfo_t),
9340                                   0);
9341                     if (!p) {
9342                         return -TARGET_EFAULT;
9343                     }
9344                     host_to_target_siginfo(p, &uinfo);
9345                     unlock_user(p, arg2, sizeof(target_siginfo_t));
9346                 }
9347                 ret = host_to_target_signal(ret);
9348             }
9349         }
9350         return ret;
9351 #endif
9352 #ifdef TARGET_NR_rt_sigtimedwait_time64
9353     case TARGET_NR_rt_sigtimedwait_time64:
9354         {
9355             sigset_t set;
9356             struct timespec uts, *puts;
9357             siginfo_t uinfo;
9358 
9359             if (arg4 != sizeof(target_sigset_t)) {
9360                 return -TARGET_EINVAL;
9361             }
9362 
9363             p = lock_user(VERIFY_READ, arg1, sizeof(target_sigset_t), 1);
9364             if (!p) {
9365                 return -TARGET_EFAULT;
9366             }
9367             target_to_host_sigset(&set, p);
9368             unlock_user(p, arg1, 0);
9369             if (arg3) {
9370                 puts = &uts;
9371                 if (target_to_host_timespec64(puts, arg3)) {
9372                     return -TARGET_EFAULT;
9373                 }
9374             } else {
9375                 puts = NULL;
9376             }
9377             ret = get_errno(safe_rt_sigtimedwait(&set, &uinfo, puts,
9378                                                  SIGSET_T_SIZE));
9379             if (!is_error(ret)) {
9380                 if (arg2) {
9381                     p = lock_user(VERIFY_WRITE, arg2,
9382                                   sizeof(target_siginfo_t), 0);
9383                     if (!p) {
9384                         return -TARGET_EFAULT;
9385                     }
9386                     host_to_target_siginfo(p, &uinfo);
9387                     unlock_user(p, arg2, sizeof(target_siginfo_t));
9388                 }
9389                 ret = host_to_target_signal(ret);
9390             }
9391         }
9392         return ret;
9393 #endif
9394     case TARGET_NR_rt_sigqueueinfo:
9395         {
9396             siginfo_t uinfo;
9397 
9398             p = lock_user(VERIFY_READ, arg3, sizeof(target_siginfo_t), 1);
9399             if (!p) {
9400                 return -TARGET_EFAULT;
9401             }
9402             target_to_host_siginfo(&uinfo, p);
9403             unlock_user(p, arg3, 0);
9404             ret = get_errno(sys_rt_sigqueueinfo(arg1, arg2, &uinfo));
9405         }
9406         return ret;
9407     case TARGET_NR_rt_tgsigqueueinfo:
9408         {
9409             siginfo_t uinfo;
9410 
9411             p = lock_user(VERIFY_READ, arg4, sizeof(target_siginfo_t), 1);
9412             if (!p) {
9413                 return -TARGET_EFAULT;
9414             }
9415             target_to_host_siginfo(&uinfo, p);
9416             unlock_user(p, arg4, 0);
9417             ret = get_errno(sys_rt_tgsigqueueinfo(arg1, arg2, arg3, &uinfo));
9418         }
9419         return ret;
9420 #ifdef TARGET_NR_sigreturn
9421     case TARGET_NR_sigreturn:
9422         if (block_signals()) {
9423             return -TARGET_ERESTARTSYS;
9424         }
9425         return do_sigreturn(cpu_env);
9426 #endif
9427     case TARGET_NR_rt_sigreturn:
9428         if (block_signals()) {
9429             return -TARGET_ERESTARTSYS;
9430         }
9431         return do_rt_sigreturn(cpu_env);
9432     case TARGET_NR_sethostname:
9433         if (!(p = lock_user_string(arg1)))
9434             return -TARGET_EFAULT;
9435         ret = get_errno(sethostname(p, arg2));
9436         unlock_user(p, arg1, 0);
9437         return ret;
9438 #ifdef TARGET_NR_setrlimit
9439     case TARGET_NR_setrlimit:
9440         {
9441             int resource = target_to_host_resource(arg1);
9442             struct target_rlimit *target_rlim;
9443             struct rlimit rlim;
9444             if (!lock_user_struct(VERIFY_READ, target_rlim, arg2, 1))
9445                 return -TARGET_EFAULT;
9446             rlim.rlim_cur = target_to_host_rlim(target_rlim->rlim_cur);
9447             rlim.rlim_max = target_to_host_rlim(target_rlim->rlim_max);
9448             unlock_user_struct(target_rlim, arg2, 0);
9449             /*
9450              * If we just passed through resource limit settings for memory then
9451              * they would also apply to QEMU's own allocations, and QEMU will
9452              * crash or hang or die if its allocations fail. Ideally we would
9453              * track the guest allocations in QEMU and apply the limits ourselves.
9454              * For now, just tell the guest the call succeeded but don't actually
9455              * limit anything.
9456              */
9457             if (resource != RLIMIT_AS &&
9458                 resource != RLIMIT_DATA &&
9459                 resource != RLIMIT_STACK) {
9460                 return get_errno(setrlimit(resource, &rlim));
9461             } else {
9462                 return 0;
9463             }
9464         }
9465 #endif
9466 #ifdef TARGET_NR_getrlimit
9467     case TARGET_NR_getrlimit:
9468         {
9469             int resource = target_to_host_resource(arg1);
9470             struct target_rlimit *target_rlim;
9471             struct rlimit rlim;
9472 
9473             ret = get_errno(getrlimit(resource, &rlim));
9474             if (!is_error(ret)) {
9475                 if (!lock_user_struct(VERIFY_WRITE, target_rlim, arg2, 0))
9476                     return -TARGET_EFAULT;
9477                 target_rlim->rlim_cur = host_to_target_rlim(rlim.rlim_cur);
9478                 target_rlim->rlim_max = host_to_target_rlim(rlim.rlim_max);
9479                 unlock_user_struct(target_rlim, arg2, 1);
9480             }
9481         }
9482         return ret;
9483 #endif
9484     case TARGET_NR_getrusage:
9485         {
9486             struct rusage rusage;
9487             ret = get_errno(getrusage(arg1, &rusage));
9488             if (!is_error(ret)) {
9489                 ret = host_to_target_rusage(arg2, &rusage);
9490             }
9491         }
9492         return ret;
9493 #if defined(TARGET_NR_gettimeofday)
9494     case TARGET_NR_gettimeofday:
9495         {
9496             struct timeval tv;
9497             struct timezone tz;
9498 
9499             ret = get_errno(gettimeofday(&tv, &tz));
9500             if (!is_error(ret)) {
9501                 if (arg1 && copy_to_user_timeval(arg1, &tv)) {
9502                     return -TARGET_EFAULT;
9503                 }
9504                 if (arg2 && copy_to_user_timezone(arg2, &tz)) {
9505                     return -TARGET_EFAULT;
9506                 }
9507             }
9508         }
9509         return ret;
9510 #endif
9511 #if defined(TARGET_NR_settimeofday)
9512     case TARGET_NR_settimeofday:
9513         {
9514             struct timeval tv, *ptv = NULL;
9515             struct timezone tz, *ptz = NULL;
9516 
9517             if (arg1) {
9518                 if (copy_from_user_timeval(&tv, arg1)) {
9519                     return -TARGET_EFAULT;
9520                 }
9521                 ptv = &tv;
9522             }
9523 
9524             if (arg2) {
9525                 if (copy_from_user_timezone(&tz, arg2)) {
9526                     return -TARGET_EFAULT;
9527                 }
9528                 ptz = &tz;
9529             }
9530 
9531             return get_errno(settimeofday(ptv, ptz));
9532         }
9533 #endif
9534 #if defined(TARGET_NR_select)
9535     case TARGET_NR_select:
9536 #if defined(TARGET_WANT_NI_OLD_SELECT)
9537         /* some architectures used to have old_select here
9538          * but now ENOSYS it.
9539          */
9540         ret = -TARGET_ENOSYS;
9541 #elif defined(TARGET_WANT_OLD_SYS_SELECT)
9542         ret = do_old_select(arg1);
9543 #else
9544         ret = do_select(arg1, arg2, arg3, arg4, arg5);
9545 #endif
9546         return ret;
9547 #endif
9548 #ifdef TARGET_NR_pselect6
9549     case TARGET_NR_pselect6:
9550         return do_pselect6(arg1, arg2, arg3, arg4, arg5, arg6, false);
9551 #endif
9552 #ifdef TARGET_NR_pselect6_time64
9553     case TARGET_NR_pselect6_time64:
9554         return do_pselect6(arg1, arg2, arg3, arg4, arg5, arg6, true);
9555 #endif
9556 #ifdef TARGET_NR_symlink
9557     case TARGET_NR_symlink:
9558         {
9559             void *p2;
9560             p = lock_user_string(arg1);
9561             p2 = lock_user_string(arg2);
9562             if (!p || !p2)
9563                 ret = -TARGET_EFAULT;
9564             else
9565                 ret = get_errno(symlink(p, p2));
9566             unlock_user(p2, arg2, 0);
9567             unlock_user(p, arg1, 0);
9568         }
9569         return ret;
9570 #endif
9571 #if defined(TARGET_NR_symlinkat)
9572     case TARGET_NR_symlinkat:
9573         {
9574             void *p2;
9575             p  = lock_user_string(arg1);
9576             p2 = lock_user_string(arg3);
9577             if (!p || !p2)
9578                 ret = -TARGET_EFAULT;
9579             else
9580                 ret = get_errno(symlinkat(p, arg2, p2));
9581             unlock_user(p2, arg3, 0);
9582             unlock_user(p, arg1, 0);
9583         }
9584         return ret;
9585 #endif
9586 #ifdef TARGET_NR_readlink
9587     case TARGET_NR_readlink:
9588         {
9589             void *p2;
9590             p = lock_user_string(arg1);
9591             p2 = lock_user(VERIFY_WRITE, arg2, arg3, 0);
9592             if (!p || !p2) {
9593                 ret = -TARGET_EFAULT;
9594             } else if (!arg3) {
9595                 /* Short circuit this for the magic exe check. */
9596                 ret = -TARGET_EINVAL;
9597             } else if (is_proc_myself((const char *)p, "exe")) {
9598                 char real[PATH_MAX], *temp;
9599                 temp = realpath(exec_path, real);
9600                 /* Return value is # of bytes that we wrote to the buffer. */
9601                 if (temp == NULL) {
9602                     ret = get_errno(-1);
9603                 } else {
9604                     /* Don't worry about sign mismatch as earlier mapping
9605                      * logic would have thrown a bad address error. */
9606                     ret = MIN(strlen(real), arg3);
9607                     /* We cannot NUL terminate the string. */
9608                     memcpy(p2, real, ret);
9609                 }
9610             } else {
9611                 ret = get_errno(readlink(path(p), p2, arg3));
9612             }
9613             unlock_user(p2, arg2, ret);
9614             unlock_user(p, arg1, 0);
9615         }
9616         return ret;
9617 #endif
9618 #if defined(TARGET_NR_readlinkat)
9619     case TARGET_NR_readlinkat:
9620         {
9621             void *p2;
9622             p  = lock_user_string(arg2);
9623             p2 = lock_user(VERIFY_WRITE, arg3, arg4, 0);
9624             if (!p || !p2) {
9625                 ret = -TARGET_EFAULT;
9626             } else if (is_proc_myself((const char *)p, "exe")) {
9627                 char real[PATH_MAX], *temp;
9628                 temp = realpath(exec_path, real);
9629                 ret = temp == NULL ? get_errno(-1) : strlen(real) ;
9630                 snprintf((char *)p2, arg4, "%s", real);
9631             } else {
9632                 ret = get_errno(readlinkat(arg1, path(p), p2, arg4));
9633             }
9634             unlock_user(p2, arg3, ret);
9635             unlock_user(p, arg2, 0);
9636         }
9637         return ret;
9638 #endif
9639 #ifdef TARGET_NR_swapon
9640     case TARGET_NR_swapon:
9641         if (!(p = lock_user_string(arg1)))
9642             return -TARGET_EFAULT;
9643         ret = get_errno(swapon(p, arg2));
9644         unlock_user(p, arg1, 0);
9645         return ret;
9646 #endif
9647     case TARGET_NR_reboot:
9648         if (arg3 == LINUX_REBOOT_CMD_RESTART2) {
9649            /* arg4 must be ignored in all other cases */
9650            p = lock_user_string(arg4);
9651            if (!p) {
9652                return -TARGET_EFAULT;
9653            }
9654            ret = get_errno(reboot(arg1, arg2, arg3, p));
9655            unlock_user(p, arg4, 0);
9656         } else {
9657            ret = get_errno(reboot(arg1, arg2, arg3, NULL));
9658         }
9659         return ret;
9660 #ifdef TARGET_NR_mmap
9661     case TARGET_NR_mmap:
9662 #if (defined(TARGET_I386) && defined(TARGET_ABI32)) || \
9663     (defined(TARGET_ARM) && defined(TARGET_ABI32)) || \
9664     defined(TARGET_M68K) || defined(TARGET_CRIS) || defined(TARGET_MICROBLAZE) \
9665     || defined(TARGET_S390X)
9666         {
9667             abi_ulong *v;
9668             abi_ulong v1, v2, v3, v4, v5, v6;
9669             if (!(v = lock_user(VERIFY_READ, arg1, 6 * sizeof(abi_ulong), 1)))
9670                 return -TARGET_EFAULT;
9671             v1 = tswapal(v[0]);
9672             v2 = tswapal(v[1]);
9673             v3 = tswapal(v[2]);
9674             v4 = tswapal(v[3]);
9675             v5 = tswapal(v[4]);
9676             v6 = tswapal(v[5]);
9677             unlock_user(v, arg1, 0);
9678             ret = get_errno(target_mmap(v1, v2, v3,
9679                                         target_to_host_bitmask(v4, mmap_flags_tbl),
9680                                         v5, v6));
9681         }
9682 #else
9683         /* mmap pointers are always untagged */
9684         ret = get_errno(target_mmap(arg1, arg2, arg3,
9685                                     target_to_host_bitmask(arg4, mmap_flags_tbl),
9686                                     arg5,
9687                                     arg6));
9688 #endif
9689         return ret;
9690 #endif
9691 #ifdef TARGET_NR_mmap2
9692     case TARGET_NR_mmap2:
9693 #ifndef MMAP_SHIFT
9694 #define MMAP_SHIFT 12
9695 #endif
9696         ret = target_mmap(arg1, arg2, arg3,
9697                           target_to_host_bitmask(arg4, mmap_flags_tbl),
9698                           arg5, arg6 << MMAP_SHIFT);
9699         return get_errno(ret);
9700 #endif
9701     case TARGET_NR_munmap:
9702         arg1 = cpu_untagged_addr(cpu, arg1);
9703         return get_errno(target_munmap(arg1, arg2));
9704     case TARGET_NR_mprotect:
9705         arg1 = cpu_untagged_addr(cpu, arg1);
9706         {
9707             TaskState *ts = cpu->opaque;
9708             /* Special hack to detect libc making the stack executable.  */
9709             if ((arg3 & PROT_GROWSDOWN)
9710                 && arg1 >= ts->info->stack_limit
9711                 && arg1 <= ts->info->start_stack) {
9712                 arg3 &= ~PROT_GROWSDOWN;
9713                 arg2 = arg2 + arg1 - ts->info->stack_limit;
9714                 arg1 = ts->info->stack_limit;
9715             }
9716         }
9717         return get_errno(target_mprotect(arg1, arg2, arg3));
9718 #ifdef TARGET_NR_mremap
9719     case TARGET_NR_mremap:
9720         arg1 = cpu_untagged_addr(cpu, arg1);
9721         /* mremap new_addr (arg5) is always untagged */
9722         return get_errno(target_mremap(arg1, arg2, arg3, arg4, arg5));
9723 #endif
9724         /* ??? msync/mlock/munlock are broken for softmmu.  */
9725 #ifdef TARGET_NR_msync
9726     case TARGET_NR_msync:
9727         return get_errno(msync(g2h(cpu, arg1), arg2, arg3));
9728 #endif
9729 #ifdef TARGET_NR_mlock
9730     case TARGET_NR_mlock:
9731         return get_errno(mlock(g2h(cpu, arg1), arg2));
9732 #endif
9733 #ifdef TARGET_NR_munlock
9734     case TARGET_NR_munlock:
9735         return get_errno(munlock(g2h(cpu, arg1), arg2));
9736 #endif
9737 #ifdef TARGET_NR_mlockall
9738     case TARGET_NR_mlockall:
9739         return get_errno(mlockall(target_to_host_mlockall_arg(arg1)));
9740 #endif
9741 #ifdef TARGET_NR_munlockall
9742     case TARGET_NR_munlockall:
9743         return get_errno(munlockall());
9744 #endif
9745 #ifdef TARGET_NR_truncate
9746     case TARGET_NR_truncate:
9747         if (!(p = lock_user_string(arg1)))
9748             return -TARGET_EFAULT;
9749         ret = get_errno(truncate(p, arg2));
9750         unlock_user(p, arg1, 0);
9751         return ret;
9752 #endif
9753 #ifdef TARGET_NR_ftruncate
9754     case TARGET_NR_ftruncate:
9755         return get_errno(ftruncate(arg1, arg2));
9756 #endif
9757     case TARGET_NR_fchmod:
9758         return get_errno(fchmod(arg1, arg2));
9759 #if defined(TARGET_NR_fchmodat)
9760     case TARGET_NR_fchmodat:
9761         if (!(p = lock_user_string(arg2)))
9762             return -TARGET_EFAULT;
9763         ret = get_errno(fchmodat(arg1, p, arg3, 0));
9764         unlock_user(p, arg2, 0);
9765         return ret;
9766 #endif
9767     case TARGET_NR_getpriority:
9768         /* Note that negative values are valid for getpriority, so we must
9769            differentiate based on errno settings.  */
9770         errno = 0;
9771         ret = getpriority(arg1, arg2);
9772         if (ret == -1 && errno != 0) {
9773             return -host_to_target_errno(errno);
9774         }
9775 #ifdef TARGET_ALPHA
9776         /* Return value is the unbiased priority.  Signal no error.  */
9777         ((CPUAlphaState *)cpu_env)->ir[IR_V0] = 0;
9778 #else
9779         /* Return value is a biased priority to avoid negative numbers.  */
9780         ret = 20 - ret;
9781 #endif
9782         return ret;
9783     case TARGET_NR_setpriority:
9784         return get_errno(setpriority(arg1, arg2, arg3));
9785 #ifdef TARGET_NR_statfs
9786     case TARGET_NR_statfs:
9787         if (!(p = lock_user_string(arg1))) {
9788             return -TARGET_EFAULT;
9789         }
9790         ret = get_errno(statfs(path(p), &stfs));
9791         unlock_user(p, arg1, 0);
9792     convert_statfs:
9793         if (!is_error(ret)) {
9794             struct target_statfs *target_stfs;
9795 
9796             if (!lock_user_struct(VERIFY_WRITE, target_stfs, arg2, 0))
9797                 return -TARGET_EFAULT;
9798             __put_user(stfs.f_type, &target_stfs->f_type);
9799             __put_user(stfs.f_bsize, &target_stfs->f_bsize);
9800             __put_user(stfs.f_blocks, &target_stfs->f_blocks);
9801             __put_user(stfs.f_bfree, &target_stfs->f_bfree);
9802             __put_user(stfs.f_bavail, &target_stfs->f_bavail);
9803             __put_user(stfs.f_files, &target_stfs->f_files);
9804             __put_user(stfs.f_ffree, &target_stfs->f_ffree);
9805             __put_user(stfs.f_fsid.__val[0], &target_stfs->f_fsid.val[0]);
9806             __put_user(stfs.f_fsid.__val[1], &target_stfs->f_fsid.val[1]);
9807             __put_user(stfs.f_namelen, &target_stfs->f_namelen);
9808             __put_user(stfs.f_frsize, &target_stfs->f_frsize);
9809 #ifdef _STATFS_F_FLAGS
9810             __put_user(stfs.f_flags, &target_stfs->f_flags);
9811 #else
9812             __put_user(0, &target_stfs->f_flags);
9813 #endif
9814             memset(target_stfs->f_spare, 0, sizeof(target_stfs->f_spare));
9815             unlock_user_struct(target_stfs, arg2, 1);
9816         }
9817         return ret;
9818 #endif
9819 #ifdef TARGET_NR_fstatfs
9820     case TARGET_NR_fstatfs:
9821         ret = get_errno(fstatfs(arg1, &stfs));
9822         goto convert_statfs;
9823 #endif
9824 #ifdef TARGET_NR_statfs64
9825     case TARGET_NR_statfs64:
9826         if (!(p = lock_user_string(arg1))) {
9827             return -TARGET_EFAULT;
9828         }
9829         ret = get_errno(statfs(path(p), &stfs));
9830         unlock_user(p, arg1, 0);
9831     convert_statfs64:
9832         if (!is_error(ret)) {
9833             struct target_statfs64 *target_stfs;
9834 
9835             if (!lock_user_struct(VERIFY_WRITE, target_stfs, arg3, 0))
9836                 return -TARGET_EFAULT;
9837             __put_user(stfs.f_type, &target_stfs->f_type);
9838             __put_user(stfs.f_bsize, &target_stfs->f_bsize);
9839             __put_user(stfs.f_blocks, &target_stfs->f_blocks);
9840             __put_user(stfs.f_bfree, &target_stfs->f_bfree);
9841             __put_user(stfs.f_bavail, &target_stfs->f_bavail);
9842             __put_user(stfs.f_files, &target_stfs->f_files);
9843             __put_user(stfs.f_ffree, &target_stfs->f_ffree);
9844             __put_user(stfs.f_fsid.__val[0], &target_stfs->f_fsid.val[0]);
9845             __put_user(stfs.f_fsid.__val[1], &target_stfs->f_fsid.val[1]);
9846             __put_user(stfs.f_namelen, &target_stfs->f_namelen);
9847             __put_user(stfs.f_frsize, &target_stfs->f_frsize);
9848 #ifdef _STATFS_F_FLAGS
9849             __put_user(stfs.f_flags, &target_stfs->f_flags);
9850 #else
9851             __put_user(0, &target_stfs->f_flags);
9852 #endif
9853             memset(target_stfs->f_spare, 0, sizeof(target_stfs->f_spare));
9854             unlock_user_struct(target_stfs, arg3, 1);
9855         }
9856         return ret;
9857     case TARGET_NR_fstatfs64:
9858         ret = get_errno(fstatfs(arg1, &stfs));
9859         goto convert_statfs64;
9860 #endif
9861 #ifdef TARGET_NR_socketcall
9862     case TARGET_NR_socketcall:
9863         return do_socketcall(arg1, arg2);
9864 #endif
9865 #ifdef TARGET_NR_accept
9866     case TARGET_NR_accept:
9867         return do_accept4(arg1, arg2, arg3, 0);
9868 #endif
9869 #ifdef TARGET_NR_accept4
9870     case TARGET_NR_accept4:
9871         return do_accept4(arg1, arg2, arg3, arg4);
9872 #endif
9873 #ifdef TARGET_NR_bind
9874     case TARGET_NR_bind:
9875         return do_bind(arg1, arg2, arg3);
9876 #endif
9877 #ifdef TARGET_NR_connect
9878     case TARGET_NR_connect:
9879         return do_connect(arg1, arg2, arg3);
9880 #endif
9881 #ifdef TARGET_NR_getpeername
9882     case TARGET_NR_getpeername:
9883         return do_getpeername(arg1, arg2, arg3);
9884 #endif
9885 #ifdef TARGET_NR_getsockname
9886     case TARGET_NR_getsockname:
9887         return do_getsockname(arg1, arg2, arg3);
9888 #endif
9889 #ifdef TARGET_NR_getsockopt
9890     case TARGET_NR_getsockopt:
9891         return do_getsockopt(arg1, arg2, arg3, arg4, arg5);
9892 #endif
9893 #ifdef TARGET_NR_listen
9894     case TARGET_NR_listen:
9895         return get_errno(listen(arg1, arg2));
9896 #endif
9897 #ifdef TARGET_NR_recv
9898     case TARGET_NR_recv:
9899         return do_recvfrom(arg1, arg2, arg3, arg4, 0, 0);
9900 #endif
9901 #ifdef TARGET_NR_recvfrom
9902     case TARGET_NR_recvfrom:
9903         return do_recvfrom(arg1, arg2, arg3, arg4, arg5, arg6);
9904 #endif
9905 #ifdef TARGET_NR_recvmsg
9906     case TARGET_NR_recvmsg:
9907         return do_sendrecvmsg(arg1, arg2, arg3, 0);
9908 #endif
9909 #ifdef TARGET_NR_send
9910     case TARGET_NR_send:
9911         return do_sendto(arg1, arg2, arg3, arg4, 0, 0);
9912 #endif
9913 #ifdef TARGET_NR_sendmsg
9914     case TARGET_NR_sendmsg:
9915         return do_sendrecvmsg(arg1, arg2, arg3, 1);
9916 #endif
9917 #ifdef TARGET_NR_sendmmsg
9918     case TARGET_NR_sendmmsg:
9919         return do_sendrecvmmsg(arg1, arg2, arg3, arg4, 1);
9920 #endif
9921 #ifdef TARGET_NR_recvmmsg
9922     case TARGET_NR_recvmmsg:
9923         return do_sendrecvmmsg(arg1, arg2, arg3, arg4, 0);
9924 #endif
9925 #ifdef TARGET_NR_sendto
9926     case TARGET_NR_sendto:
9927         return do_sendto(arg1, arg2, arg3, arg4, arg5, arg6);
9928 #endif
9929 #ifdef TARGET_NR_shutdown
9930     case TARGET_NR_shutdown:
9931         return get_errno(shutdown(arg1, arg2));
9932 #endif
9933 #if defined(TARGET_NR_getrandom) && defined(__NR_getrandom)
9934     case TARGET_NR_getrandom:
9935         p = lock_user(VERIFY_WRITE, arg1, arg2, 0);
9936         if (!p) {
9937             return -TARGET_EFAULT;
9938         }
9939         ret = get_errno(getrandom(p, arg2, arg3));
9940         unlock_user(p, arg1, ret);
9941         return ret;
9942 #endif
9943 #ifdef TARGET_NR_socket
9944     case TARGET_NR_socket:
9945         return do_socket(arg1, arg2, arg3);
9946 #endif
9947 #ifdef TARGET_NR_socketpair
9948     case TARGET_NR_socketpair:
9949         return do_socketpair(arg1, arg2, arg3, arg4);
9950 #endif
9951 #ifdef TARGET_NR_setsockopt
9952     case TARGET_NR_setsockopt:
9953         return do_setsockopt(arg1, arg2, arg3, arg4, (socklen_t) arg5);
9954 #endif
9955 #if defined(TARGET_NR_syslog)
9956     case TARGET_NR_syslog:
9957         {
9958             int len = arg2;
9959 
9960             switch (arg1) {
9961             case TARGET_SYSLOG_ACTION_CLOSE:         /* Close log */
9962             case TARGET_SYSLOG_ACTION_OPEN:          /* Open log */
9963             case TARGET_SYSLOG_ACTION_CLEAR:         /* Clear ring buffer */
9964             case TARGET_SYSLOG_ACTION_CONSOLE_OFF:   /* Disable logging */
9965             case TARGET_SYSLOG_ACTION_CONSOLE_ON:    /* Enable logging */
9966             case TARGET_SYSLOG_ACTION_CONSOLE_LEVEL: /* Set messages level */
9967             case TARGET_SYSLOG_ACTION_SIZE_UNREAD:   /* Number of chars */
9968             case TARGET_SYSLOG_ACTION_SIZE_BUFFER:   /* Size of the buffer */
9969                 return get_errno(sys_syslog((int)arg1, NULL, (int)arg3));
9970             case TARGET_SYSLOG_ACTION_READ:          /* Read from log */
9971             case TARGET_SYSLOG_ACTION_READ_CLEAR:    /* Read/clear msgs */
9972             case TARGET_SYSLOG_ACTION_READ_ALL:      /* Read last messages */
9973                 {
9974                     if (len < 0) {
9975                         return -TARGET_EINVAL;
9976                     }
9977                     if (len == 0) {
9978                         return 0;
9979                     }
9980                     p = lock_user(VERIFY_WRITE, arg2, arg3, 0);
9981                     if (!p) {
9982                         return -TARGET_EFAULT;
9983                     }
9984                     ret = get_errno(sys_syslog((int)arg1, p, (int)arg3));
9985                     unlock_user(p, arg2, arg3);
9986                 }
9987                 return ret;
9988             default:
9989                 return -TARGET_EINVAL;
9990             }
9991         }
9992         break;
9993 #endif
9994     case TARGET_NR_setitimer:
9995         {
9996             struct itimerval value, ovalue, *pvalue;
9997 
9998             if (arg2) {
9999                 pvalue = &value;
10000                 if (copy_from_user_timeval(&pvalue->it_interval, arg2)
10001                     || copy_from_user_timeval(&pvalue->it_value,
10002                                               arg2 + sizeof(struct target_timeval)))
10003                     return -TARGET_EFAULT;
10004             } else {
10005                 pvalue = NULL;
10006             }
10007             ret = get_errno(setitimer(arg1, pvalue, &ovalue));
10008             if (!is_error(ret) && arg3) {
10009                 if (copy_to_user_timeval(arg3,
10010                                          &ovalue.it_interval)
10011                     || copy_to_user_timeval(arg3 + sizeof(struct target_timeval),
10012                                             &ovalue.it_value))
10013                     return -TARGET_EFAULT;
10014             }
10015         }
10016         return ret;
10017     case TARGET_NR_getitimer:
10018         {
10019             struct itimerval value;
10020 
10021             ret = get_errno(getitimer(arg1, &value));
10022             if (!is_error(ret) && arg2) {
10023                 if (copy_to_user_timeval(arg2,
10024                                          &value.it_interval)
10025                     || copy_to_user_timeval(arg2 + sizeof(struct target_timeval),
10026                                             &value.it_value))
10027                     return -TARGET_EFAULT;
10028             }
10029         }
10030         return ret;
10031 #ifdef TARGET_NR_stat
10032     case TARGET_NR_stat:
10033         if (!(p = lock_user_string(arg1))) {
10034             return -TARGET_EFAULT;
10035         }
10036         ret = get_errno(stat(path(p), &st));
10037         unlock_user(p, arg1, 0);
10038         goto do_stat;
10039 #endif
10040 #ifdef TARGET_NR_lstat
10041     case TARGET_NR_lstat:
10042         if (!(p = lock_user_string(arg1))) {
10043             return -TARGET_EFAULT;
10044         }
10045         ret = get_errno(lstat(path(p), &st));
10046         unlock_user(p, arg1, 0);
10047         goto do_stat;
10048 #endif
10049 #ifdef TARGET_NR_fstat
10050     case TARGET_NR_fstat:
10051         {
10052             ret = get_errno(fstat(arg1, &st));
10053 #if defined(TARGET_NR_stat) || defined(TARGET_NR_lstat)
10054         do_stat:
10055 #endif
10056             if (!is_error(ret)) {
10057                 struct target_stat *target_st;
10058 
10059                 if (!lock_user_struct(VERIFY_WRITE, target_st, arg2, 0))
10060                     return -TARGET_EFAULT;
10061                 memset(target_st, 0, sizeof(*target_st));
10062                 __put_user(st.st_dev, &target_st->st_dev);
10063                 __put_user(st.st_ino, &target_st->st_ino);
10064                 __put_user(st.st_mode, &target_st->st_mode);
10065                 __put_user(st.st_uid, &target_st->st_uid);
10066                 __put_user(st.st_gid, &target_st->st_gid);
10067                 __put_user(st.st_nlink, &target_st->st_nlink);
10068                 __put_user(st.st_rdev, &target_st->st_rdev);
10069                 __put_user(st.st_size, &target_st->st_size);
10070                 __put_user(st.st_blksize, &target_st->st_blksize);
10071                 __put_user(st.st_blocks, &target_st->st_blocks);
10072                 __put_user(st.st_atime, &target_st->target_st_atime);
10073                 __put_user(st.st_mtime, &target_st->target_st_mtime);
10074                 __put_user(st.st_ctime, &target_st->target_st_ctime);
10075 #if defined(HAVE_STRUCT_STAT_ST_ATIM) && defined(TARGET_STAT_HAVE_NSEC)
10076                 __put_user(st.st_atim.tv_nsec,
10077                            &target_st->target_st_atime_nsec);
10078                 __put_user(st.st_mtim.tv_nsec,
10079                            &target_st->target_st_mtime_nsec);
10080                 __put_user(st.st_ctim.tv_nsec,
10081                            &target_st->target_st_ctime_nsec);
10082 #endif
10083                 unlock_user_struct(target_st, arg2, 1);
10084             }
10085         }
10086         return ret;
10087 #endif
10088     case TARGET_NR_vhangup:
10089         return get_errno(vhangup());
10090 #ifdef TARGET_NR_syscall
10091     case TARGET_NR_syscall:
10092         return do_syscall(cpu_env, arg1 & 0xffff, arg2, arg3, arg4, arg5,
10093                           arg6, arg7, arg8, 0);
10094 #endif
10095 #if defined(TARGET_NR_wait4)
10096     case TARGET_NR_wait4:
10097         {
10098             int status;
10099             abi_long status_ptr = arg2;
10100             struct rusage rusage, *rusage_ptr;
10101             abi_ulong target_rusage = arg4;
10102             abi_long rusage_err;
10103             if (target_rusage)
10104                 rusage_ptr = &rusage;
10105             else
10106                 rusage_ptr = NULL;
10107             ret = get_errno(safe_wait4(arg1, &status, arg3, rusage_ptr));
10108             if (!is_error(ret)) {
10109                 if (status_ptr && ret) {
10110                     status = host_to_target_waitstatus(status);
10111                     if (put_user_s32(status, status_ptr))
10112                         return -TARGET_EFAULT;
10113                 }
10114                 if (target_rusage) {
10115                     rusage_err = host_to_target_rusage(target_rusage, &rusage);
10116                     if (rusage_err) {
10117                         ret = rusage_err;
10118                     }
10119                 }
10120             }
10121         }
10122         return ret;
10123 #endif
10124 #ifdef TARGET_NR_swapoff
10125     case TARGET_NR_swapoff:
10126         if (!(p = lock_user_string(arg1)))
10127             return -TARGET_EFAULT;
10128         ret = get_errno(swapoff(p));
10129         unlock_user(p, arg1, 0);
10130         return ret;
10131 #endif
10132     case TARGET_NR_sysinfo:
10133         {
10134             struct target_sysinfo *target_value;
10135             struct sysinfo value;
10136             ret = get_errno(sysinfo(&value));
10137             if (!is_error(ret) && arg1)
10138             {
10139                 if (!lock_user_struct(VERIFY_WRITE, target_value, arg1, 0))
10140                     return -TARGET_EFAULT;
10141                 __put_user(value.uptime, &target_value->uptime);
10142                 __put_user(value.loads[0], &target_value->loads[0]);
10143                 __put_user(value.loads[1], &target_value->loads[1]);
10144                 __put_user(value.loads[2], &target_value->loads[2]);
10145                 __put_user(value.totalram, &target_value->totalram);
10146                 __put_user(value.freeram, &target_value->freeram);
10147                 __put_user(value.sharedram, &target_value->sharedram);
10148                 __put_user(value.bufferram, &target_value->bufferram);
10149                 __put_user(value.totalswap, &target_value->totalswap);
10150                 __put_user(value.freeswap, &target_value->freeswap);
10151                 __put_user(value.procs, &target_value->procs);
10152                 __put_user(value.totalhigh, &target_value->totalhigh);
10153                 __put_user(value.freehigh, &target_value->freehigh);
10154                 __put_user(value.mem_unit, &target_value->mem_unit);
10155                 unlock_user_struct(target_value, arg1, 1);
10156             }
10157         }
10158         return ret;
10159 #ifdef TARGET_NR_ipc
10160     case TARGET_NR_ipc:
10161         return do_ipc(cpu_env, arg1, arg2, arg3, arg4, arg5, arg6);
10162 #endif
10163 #ifdef TARGET_NR_semget
10164     case TARGET_NR_semget:
10165         return get_errno(semget(arg1, arg2, arg3));
10166 #endif
10167 #ifdef TARGET_NR_semop
10168     case TARGET_NR_semop:
10169         return do_semtimedop(arg1, arg2, arg3, 0, false);
10170 #endif
10171 #ifdef TARGET_NR_semtimedop
10172     case TARGET_NR_semtimedop:
10173         return do_semtimedop(arg1, arg2, arg3, arg4, false);
10174 #endif
10175 #ifdef TARGET_NR_semtimedop_time64
10176     case TARGET_NR_semtimedop_time64:
10177         return do_semtimedop(arg1, arg2, arg3, arg4, true);
10178 #endif
10179 #ifdef TARGET_NR_semctl
10180     case TARGET_NR_semctl:
10181         return do_semctl(arg1, arg2, arg3, arg4);
10182 #endif
10183 #ifdef TARGET_NR_msgctl
10184     case TARGET_NR_msgctl:
10185         return do_msgctl(arg1, arg2, arg3);
10186 #endif
10187 #ifdef TARGET_NR_msgget
10188     case TARGET_NR_msgget:
10189         return get_errno(msgget(arg1, arg2));
10190 #endif
10191 #ifdef TARGET_NR_msgrcv
10192     case TARGET_NR_msgrcv:
10193         return do_msgrcv(arg1, arg2, arg3, arg4, arg5);
10194 #endif
10195 #ifdef TARGET_NR_msgsnd
10196     case TARGET_NR_msgsnd:
10197         return do_msgsnd(arg1, arg2, arg3, arg4);
10198 #endif
10199 #ifdef TARGET_NR_shmget
10200     case TARGET_NR_shmget:
10201         return get_errno(shmget(arg1, arg2, arg3));
10202 #endif
10203 #ifdef TARGET_NR_shmctl
10204     case TARGET_NR_shmctl:
10205         return do_shmctl(arg1, arg2, arg3);
10206 #endif
10207 #ifdef TARGET_NR_shmat
10208     case TARGET_NR_shmat:
10209         return do_shmat(cpu_env, arg1, arg2, arg3);
10210 #endif
10211 #ifdef TARGET_NR_shmdt
10212     case TARGET_NR_shmdt:
10213         return do_shmdt(arg1);
10214 #endif
10215     case TARGET_NR_fsync:
10216         return get_errno(fsync(arg1));
10217     case TARGET_NR_clone:
10218         /* Linux manages to have three different orderings for its
10219          * arguments to clone(); the BACKWARDS and BACKWARDS2 defines
10220          * match the kernel's CONFIG_CLONE_* settings.
10221          * Microblaze is further special in that it uses a sixth
10222          * implicit argument to clone for the TLS pointer.
10223          */
10224 #if defined(TARGET_MICROBLAZE)
10225         ret = get_errno(do_fork(cpu_env, arg1, arg2, arg4, arg6, arg5));
10226 #elif defined(TARGET_CLONE_BACKWARDS)
10227         ret = get_errno(do_fork(cpu_env, arg1, arg2, arg3, arg4, arg5));
10228 #elif defined(TARGET_CLONE_BACKWARDS2)
10229         ret = get_errno(do_fork(cpu_env, arg2, arg1, arg3, arg5, arg4));
10230 #else
10231         ret = get_errno(do_fork(cpu_env, arg1, arg2, arg3, arg5, arg4));
10232 #endif
10233         return ret;
10234 #ifdef __NR_exit_group
10235         /* new thread calls */
10236     case TARGET_NR_exit_group:
10237         preexit_cleanup(cpu_env, arg1);
10238         return get_errno(exit_group(arg1));
10239 #endif
10240     case TARGET_NR_setdomainname:
10241         if (!(p = lock_user_string(arg1)))
10242             return -TARGET_EFAULT;
10243         ret = get_errno(setdomainname(p, arg2));
10244         unlock_user(p, arg1, 0);
10245         return ret;
10246     case TARGET_NR_uname:
10247         /* no need to transcode because we use the linux syscall */
10248         {
10249             struct new_utsname * buf;
10250 
10251             if (!lock_user_struct(VERIFY_WRITE, buf, arg1, 0))
10252                 return -TARGET_EFAULT;
10253             ret = get_errno(sys_uname(buf));
10254             if (!is_error(ret)) {
10255                 /* Overwrite the native machine name with whatever is being
10256                    emulated. */
10257                 g_strlcpy(buf->machine, cpu_to_uname_machine(cpu_env),
10258                           sizeof(buf->machine));
10259                 /* Allow the user to override the reported release.  */
10260                 if (qemu_uname_release && *qemu_uname_release) {
10261                     g_strlcpy(buf->release, qemu_uname_release,
10262                               sizeof(buf->release));
10263                 }
10264             }
10265             unlock_user_struct(buf, arg1, 1);
10266         }
10267         return ret;
10268 #ifdef TARGET_I386
10269     case TARGET_NR_modify_ldt:
10270         return do_modify_ldt(cpu_env, arg1, arg2, arg3);
10271 #if !defined(TARGET_X86_64)
10272     case TARGET_NR_vm86:
10273         return do_vm86(cpu_env, arg1, arg2);
10274 #endif
10275 #endif
10276 #if defined(TARGET_NR_adjtimex)
10277     case TARGET_NR_adjtimex:
10278         {
10279             struct timex host_buf;
10280 
10281             if (target_to_host_timex(&host_buf, arg1) != 0) {
10282                 return -TARGET_EFAULT;
10283             }
10284             ret = get_errno(adjtimex(&host_buf));
10285             if (!is_error(ret)) {
10286                 if (host_to_target_timex(arg1, &host_buf) != 0) {
10287                     return -TARGET_EFAULT;
10288                 }
10289             }
10290         }
10291         return ret;
10292 #endif
10293 #if defined(TARGET_NR_clock_adjtime) && defined(CONFIG_CLOCK_ADJTIME)
10294     case TARGET_NR_clock_adjtime:
10295         {
10296             struct timex htx, *phtx = &htx;
10297 
10298             if (target_to_host_timex(phtx, arg2) != 0) {
10299                 return -TARGET_EFAULT;
10300             }
10301             ret = get_errno(clock_adjtime(arg1, phtx));
10302             if (!is_error(ret) && phtx) {
10303                 if (host_to_target_timex(arg2, phtx) != 0) {
10304                     return -TARGET_EFAULT;
10305                 }
10306             }
10307         }
10308         return ret;
10309 #endif
10310 #if defined(TARGET_NR_clock_adjtime64) && defined(CONFIG_CLOCK_ADJTIME)
10311     case TARGET_NR_clock_adjtime64:
10312         {
10313             struct timex htx;
10314 
10315             if (target_to_host_timex64(&htx, arg2) != 0) {
10316                 return -TARGET_EFAULT;
10317             }
10318             ret = get_errno(clock_adjtime(arg1, &htx));
10319             if (!is_error(ret) && host_to_target_timex64(arg2, &htx)) {
10320                     return -TARGET_EFAULT;
10321             }
10322         }
10323         return ret;
10324 #endif
10325     case TARGET_NR_getpgid:
10326         return get_errno(getpgid(arg1));
10327     case TARGET_NR_fchdir:
10328         return get_errno(fchdir(arg1));
10329     case TARGET_NR_personality:
10330         return get_errno(personality(arg1));
10331 #ifdef TARGET_NR__llseek /* Not on alpha */
10332     case TARGET_NR__llseek:
10333         {
10334             int64_t res;
10335 #if !defined(__NR_llseek)
10336             res = lseek(arg1, ((uint64_t)arg2 << 32) | (abi_ulong)arg3, arg5);
10337             if (res == -1) {
10338                 ret = get_errno(res);
10339             } else {
10340                 ret = 0;
10341             }
10342 #else
10343             ret = get_errno(_llseek(arg1, arg2, arg3, &res, arg5));
10344 #endif
10345             if ((ret == 0) && put_user_s64(res, arg4)) {
10346                 return -TARGET_EFAULT;
10347             }
10348         }
10349         return ret;
10350 #endif
10351 #ifdef TARGET_NR_getdents
10352     case TARGET_NR_getdents:
10353 #ifdef EMULATE_GETDENTS_WITH_GETDENTS
10354 #if TARGET_ABI_BITS == 32 && HOST_LONG_BITS == 64
10355         {
10356             struct target_dirent *target_dirp;
10357             struct linux_dirent *dirp;
10358             abi_long count = arg3;
10359 
10360             dirp = g_try_malloc(count);
10361             if (!dirp) {
10362                 return -TARGET_ENOMEM;
10363             }
10364 
10365             ret = get_errno(sys_getdents(arg1, dirp, count));
10366             if (!is_error(ret)) {
10367                 struct linux_dirent *de;
10368 		struct target_dirent *tde;
10369                 int len = ret;
10370                 int reclen, treclen;
10371 		int count1, tnamelen;
10372 
10373 		count1 = 0;
10374                 de = dirp;
10375                 if (!(target_dirp = lock_user(VERIFY_WRITE, arg2, count, 0)))
10376                     return -TARGET_EFAULT;
10377 		tde = target_dirp;
10378                 while (len > 0) {
10379                     reclen = de->d_reclen;
10380                     tnamelen = reclen - offsetof(struct linux_dirent, d_name);
10381                     assert(tnamelen >= 0);
10382                     treclen = tnamelen + offsetof(struct target_dirent, d_name);
10383                     assert(count1 + treclen <= count);
10384                     tde->d_reclen = tswap16(treclen);
10385                     tde->d_ino = tswapal(de->d_ino);
10386                     tde->d_off = tswapal(de->d_off);
10387                     memcpy(tde->d_name, de->d_name, tnamelen);
10388                     de = (struct linux_dirent *)((char *)de + reclen);
10389                     len -= reclen;
10390                     tde = (struct target_dirent *)((char *)tde + treclen);
10391 		    count1 += treclen;
10392                 }
10393 		ret = count1;
10394                 unlock_user(target_dirp, arg2, ret);
10395             }
10396             g_free(dirp);
10397         }
10398 #else
10399         {
10400             struct linux_dirent *dirp;
10401             abi_long count = arg3;
10402 
10403             if (!(dirp = lock_user(VERIFY_WRITE, arg2, count, 0)))
10404                 return -TARGET_EFAULT;
10405             ret = get_errno(sys_getdents(arg1, dirp, count));
10406             if (!is_error(ret)) {
10407                 struct linux_dirent *de;
10408                 int len = ret;
10409                 int reclen;
10410                 de = dirp;
10411                 while (len > 0) {
10412                     reclen = de->d_reclen;
10413                     if (reclen > len)
10414                         break;
10415                     de->d_reclen = tswap16(reclen);
10416                     tswapls(&de->d_ino);
10417                     tswapls(&de->d_off);
10418                     de = (struct linux_dirent *)((char *)de + reclen);
10419                     len -= reclen;
10420                 }
10421             }
10422             unlock_user(dirp, arg2, ret);
10423         }
10424 #endif
10425 #else
10426         /* Implement getdents in terms of getdents64 */
10427         {
10428             struct linux_dirent64 *dirp;
10429             abi_long count = arg3;
10430 
10431             dirp = lock_user(VERIFY_WRITE, arg2, count, 0);
10432             if (!dirp) {
10433                 return -TARGET_EFAULT;
10434             }
10435             ret = get_errno(sys_getdents64(arg1, dirp, count));
10436             if (!is_error(ret)) {
10437                 /* Convert the dirent64 structs to target dirent.  We do this
10438                  * in-place, since we can guarantee that a target_dirent is no
10439                  * larger than a dirent64; however this means we have to be
10440                  * careful to read everything before writing in the new format.
10441                  */
10442                 struct linux_dirent64 *de;
10443                 struct target_dirent *tde;
10444                 int len = ret;
10445                 int tlen = 0;
10446 
10447                 de = dirp;
10448                 tde = (struct target_dirent *)dirp;
10449                 while (len > 0) {
10450                     int namelen, treclen;
10451                     int reclen = de->d_reclen;
10452                     uint64_t ino = de->d_ino;
10453                     int64_t off = de->d_off;
10454                     uint8_t type = de->d_type;
10455 
10456                     namelen = strlen(de->d_name);
10457                     treclen = offsetof(struct target_dirent, d_name)
10458                         + namelen + 2;
10459                     treclen = QEMU_ALIGN_UP(treclen, sizeof(abi_long));
10460 
10461                     memmove(tde->d_name, de->d_name, namelen + 1);
10462                     tde->d_ino = tswapal(ino);
10463                     tde->d_off = tswapal(off);
10464                     tde->d_reclen = tswap16(treclen);
10465                     /* The target_dirent type is in what was formerly a padding
10466                      * byte at the end of the structure:
10467                      */
10468                     *(((char *)tde) + treclen - 1) = type;
10469 
10470                     de = (struct linux_dirent64 *)((char *)de + reclen);
10471                     tde = (struct target_dirent *)((char *)tde + treclen);
10472                     len -= reclen;
10473                     tlen += treclen;
10474                 }
10475                 ret = tlen;
10476             }
10477             unlock_user(dirp, arg2, ret);
10478         }
10479 #endif
10480         return ret;
10481 #endif /* TARGET_NR_getdents */
10482 #if defined(TARGET_NR_getdents64) && defined(__NR_getdents64)
10483     case TARGET_NR_getdents64:
10484         {
10485             struct linux_dirent64 *dirp;
10486             abi_long count = arg3;
10487             if (!(dirp = lock_user(VERIFY_WRITE, arg2, count, 0)))
10488                 return -TARGET_EFAULT;
10489             ret = get_errno(sys_getdents64(arg1, dirp, count));
10490             if (!is_error(ret)) {
10491                 struct linux_dirent64 *de;
10492                 int len = ret;
10493                 int reclen;
10494                 de = dirp;
10495                 while (len > 0) {
10496                     reclen = de->d_reclen;
10497                     if (reclen > len)
10498                         break;
10499                     de->d_reclen = tswap16(reclen);
10500                     tswap64s((uint64_t *)&de->d_ino);
10501                     tswap64s((uint64_t *)&de->d_off);
10502                     de = (struct linux_dirent64 *)((char *)de + reclen);
10503                     len -= reclen;
10504                 }
10505             }
10506             unlock_user(dirp, arg2, ret);
10507         }
10508         return ret;
10509 #endif /* TARGET_NR_getdents64 */
10510 #if defined(TARGET_NR__newselect)
10511     case TARGET_NR__newselect:
10512         return do_select(arg1, arg2, arg3, arg4, arg5);
10513 #endif
10514 #ifdef TARGET_NR_poll
10515     case TARGET_NR_poll:
10516         return do_ppoll(arg1, arg2, arg3, arg4, arg5, false, false);
10517 #endif
10518 #ifdef TARGET_NR_ppoll
10519     case TARGET_NR_ppoll:
10520         return do_ppoll(arg1, arg2, arg3, arg4, arg5, true, false);
10521 #endif
10522 #ifdef TARGET_NR_ppoll_time64
10523     case TARGET_NR_ppoll_time64:
10524         return do_ppoll(arg1, arg2, arg3, arg4, arg5, true, true);
10525 #endif
10526     case TARGET_NR_flock:
10527         /* NOTE: the flock constant seems to be the same for every
10528            Linux platform */
10529         return get_errno(safe_flock(arg1, arg2));
10530     case TARGET_NR_readv:
10531         {
10532             struct iovec *vec = lock_iovec(VERIFY_WRITE, arg2, arg3, 0);
10533             if (vec != NULL) {
10534                 ret = get_errno(safe_readv(arg1, vec, arg3));
10535                 unlock_iovec(vec, arg2, arg3, 1);
10536             } else {
10537                 ret = -host_to_target_errno(errno);
10538             }
10539         }
10540         return ret;
10541     case TARGET_NR_writev:
10542         {
10543             struct iovec *vec = lock_iovec(VERIFY_READ, arg2, arg3, 1);
10544             if (vec != NULL) {
10545                 ret = get_errno(safe_writev(arg1, vec, arg3));
10546                 unlock_iovec(vec, arg2, arg3, 0);
10547             } else {
10548                 ret = -host_to_target_errno(errno);
10549             }
10550         }
10551         return ret;
10552 #if defined(TARGET_NR_preadv)
10553     case TARGET_NR_preadv:
10554         {
10555             struct iovec *vec = lock_iovec(VERIFY_WRITE, arg2, arg3, 0);
10556             if (vec != NULL) {
10557                 unsigned long low, high;
10558 
10559                 target_to_host_low_high(arg4, arg5, &low, &high);
10560                 ret = get_errno(safe_preadv(arg1, vec, arg3, low, high));
10561                 unlock_iovec(vec, arg2, arg3, 1);
10562             } else {
10563                 ret = -host_to_target_errno(errno);
10564            }
10565         }
10566         return ret;
10567 #endif
10568 #if defined(TARGET_NR_pwritev)
10569     case TARGET_NR_pwritev:
10570         {
10571             struct iovec *vec = lock_iovec(VERIFY_READ, arg2, arg3, 1);
10572             if (vec != NULL) {
10573                 unsigned long low, high;
10574 
10575                 target_to_host_low_high(arg4, arg5, &low, &high);
10576                 ret = get_errno(safe_pwritev(arg1, vec, arg3, low, high));
10577                 unlock_iovec(vec, arg2, arg3, 0);
10578             } else {
10579                 ret = -host_to_target_errno(errno);
10580            }
10581         }
10582         return ret;
10583 #endif
10584     case TARGET_NR_getsid:
10585         return get_errno(getsid(arg1));
10586 #if defined(TARGET_NR_fdatasync) /* Not on alpha (osf_datasync ?) */
10587     case TARGET_NR_fdatasync:
10588         return get_errno(fdatasync(arg1));
10589 #endif
10590     case TARGET_NR_sched_getaffinity:
10591         {
10592             unsigned int mask_size;
10593             unsigned long *mask;
10594 
10595             /*
10596              * sched_getaffinity needs multiples of ulong, so need to take
10597              * care of mismatches between target ulong and host ulong sizes.
10598              */
10599             if (arg2 & (sizeof(abi_ulong) - 1)) {
10600                 return -TARGET_EINVAL;
10601             }
10602             mask_size = (arg2 + (sizeof(*mask) - 1)) & ~(sizeof(*mask) - 1);
10603 
10604             mask = alloca(mask_size);
10605             memset(mask, 0, mask_size);
10606             ret = get_errno(sys_sched_getaffinity(arg1, mask_size, mask));
10607 
10608             if (!is_error(ret)) {
10609                 if (ret > arg2) {
10610                     /* More data returned than the caller's buffer will fit.
10611                      * This only happens if sizeof(abi_long) < sizeof(long)
10612                      * and the caller passed us a buffer holding an odd number
10613                      * of abi_longs. If the host kernel is actually using the
10614                      * extra 4 bytes then fail EINVAL; otherwise we can just
10615                      * ignore them and only copy the interesting part.
10616                      */
10617                     int numcpus = sysconf(_SC_NPROCESSORS_CONF);
10618                     if (numcpus > arg2 * 8) {
10619                         return -TARGET_EINVAL;
10620                     }
10621                     ret = arg2;
10622                 }
10623 
10624                 if (host_to_target_cpu_mask(mask, mask_size, arg3, ret)) {
10625                     return -TARGET_EFAULT;
10626                 }
10627             }
10628         }
10629         return ret;
10630     case TARGET_NR_sched_setaffinity:
10631         {
10632             unsigned int mask_size;
10633             unsigned long *mask;
10634 
10635             /*
10636              * sched_setaffinity needs multiples of ulong, so need to take
10637              * care of mismatches between target ulong and host ulong sizes.
10638              */
10639             if (arg2 & (sizeof(abi_ulong) - 1)) {
10640                 return -TARGET_EINVAL;
10641             }
10642             mask_size = (arg2 + (sizeof(*mask) - 1)) & ~(sizeof(*mask) - 1);
10643             mask = alloca(mask_size);
10644 
10645             ret = target_to_host_cpu_mask(mask, mask_size, arg3, arg2);
10646             if (ret) {
10647                 return ret;
10648             }
10649 
10650             return get_errno(sys_sched_setaffinity(arg1, mask_size, mask));
10651         }
10652     case TARGET_NR_getcpu:
10653         {
10654             unsigned cpu, node;
10655             ret = get_errno(sys_getcpu(arg1 ? &cpu : NULL,
10656                                        arg2 ? &node : NULL,
10657                                        NULL));
10658             if (is_error(ret)) {
10659                 return ret;
10660             }
10661             if (arg1 && put_user_u32(cpu, arg1)) {
10662                 return -TARGET_EFAULT;
10663             }
10664             if (arg2 && put_user_u32(node, arg2)) {
10665                 return -TARGET_EFAULT;
10666             }
10667         }
10668         return ret;
10669     case TARGET_NR_sched_setparam:
10670         {
10671             struct sched_param *target_schp;
10672             struct sched_param schp;
10673 
10674             if (arg2 == 0) {
10675                 return -TARGET_EINVAL;
10676             }
10677             if (!lock_user_struct(VERIFY_READ, target_schp, arg2, 1))
10678                 return -TARGET_EFAULT;
10679             schp.sched_priority = tswap32(target_schp->sched_priority);
10680             unlock_user_struct(target_schp, arg2, 0);
10681             return get_errno(sched_setparam(arg1, &schp));
10682         }
10683     case TARGET_NR_sched_getparam:
10684         {
10685             struct sched_param *target_schp;
10686             struct sched_param schp;
10687 
10688             if (arg2 == 0) {
10689                 return -TARGET_EINVAL;
10690             }
10691             ret = get_errno(sched_getparam(arg1, &schp));
10692             if (!is_error(ret)) {
10693                 if (!lock_user_struct(VERIFY_WRITE, target_schp, arg2, 0))
10694                     return -TARGET_EFAULT;
10695                 target_schp->sched_priority = tswap32(schp.sched_priority);
10696                 unlock_user_struct(target_schp, arg2, 1);
10697             }
10698         }
10699         return ret;
10700     case TARGET_NR_sched_setscheduler:
10701         {
10702             struct sched_param *target_schp;
10703             struct sched_param schp;
10704             if (arg3 == 0) {
10705                 return -TARGET_EINVAL;
10706             }
10707             if (!lock_user_struct(VERIFY_READ, target_schp, arg3, 1))
10708                 return -TARGET_EFAULT;
10709             schp.sched_priority = tswap32(target_schp->sched_priority);
10710             unlock_user_struct(target_schp, arg3, 0);
10711             return get_errno(sched_setscheduler(arg1, arg2, &schp));
10712         }
10713     case TARGET_NR_sched_getscheduler:
10714         return get_errno(sched_getscheduler(arg1));
10715     case TARGET_NR_sched_yield:
10716         return get_errno(sched_yield());
10717     case TARGET_NR_sched_get_priority_max:
10718         return get_errno(sched_get_priority_max(arg1));
10719     case TARGET_NR_sched_get_priority_min:
10720         return get_errno(sched_get_priority_min(arg1));
10721 #ifdef TARGET_NR_sched_rr_get_interval
10722     case TARGET_NR_sched_rr_get_interval:
10723         {
10724             struct timespec ts;
10725             ret = get_errno(sched_rr_get_interval(arg1, &ts));
10726             if (!is_error(ret)) {
10727                 ret = host_to_target_timespec(arg2, &ts);
10728             }
10729         }
10730         return ret;
10731 #endif
10732 #ifdef TARGET_NR_sched_rr_get_interval_time64
10733     case TARGET_NR_sched_rr_get_interval_time64:
10734         {
10735             struct timespec ts;
10736             ret = get_errno(sched_rr_get_interval(arg1, &ts));
10737             if (!is_error(ret)) {
10738                 ret = host_to_target_timespec64(arg2, &ts);
10739             }
10740         }
10741         return ret;
10742 #endif
10743 #if defined(TARGET_NR_nanosleep)
10744     case TARGET_NR_nanosleep:
10745         {
10746             struct timespec req, rem;
10747             target_to_host_timespec(&req, arg1);
10748             ret = get_errno(safe_nanosleep(&req, &rem));
10749             if (is_error(ret) && arg2) {
10750                 host_to_target_timespec(arg2, &rem);
10751             }
10752         }
10753         return ret;
10754 #endif
10755     case TARGET_NR_prctl:
10756         switch (arg1) {
10757         case PR_GET_PDEATHSIG:
10758         {
10759             int deathsig;
10760             ret = get_errno(prctl(arg1, &deathsig, arg3, arg4, arg5));
10761             if (!is_error(ret) && arg2
10762                 && put_user_s32(deathsig, arg2)) {
10763                 return -TARGET_EFAULT;
10764             }
10765             return ret;
10766         }
10767 #ifdef PR_GET_NAME
10768         case PR_GET_NAME:
10769         {
10770             void *name = lock_user(VERIFY_WRITE, arg2, 16, 1);
10771             if (!name) {
10772                 return -TARGET_EFAULT;
10773             }
10774             ret = get_errno(prctl(arg1, (unsigned long)name,
10775                                   arg3, arg4, arg5));
10776             unlock_user(name, arg2, 16);
10777             return ret;
10778         }
10779         case PR_SET_NAME:
10780         {
10781             void *name = lock_user(VERIFY_READ, arg2, 16, 1);
10782             if (!name) {
10783                 return -TARGET_EFAULT;
10784             }
10785             ret = get_errno(prctl(arg1, (unsigned long)name,
10786                                   arg3, arg4, arg5));
10787             unlock_user(name, arg2, 0);
10788             return ret;
10789         }
10790 #endif
10791 #ifdef TARGET_MIPS
10792         case TARGET_PR_GET_FP_MODE:
10793         {
10794             CPUMIPSState *env = ((CPUMIPSState *)cpu_env);
10795             ret = 0;
10796             if (env->CP0_Status & (1 << CP0St_FR)) {
10797                 ret |= TARGET_PR_FP_MODE_FR;
10798             }
10799             if (env->CP0_Config5 & (1 << CP0C5_FRE)) {
10800                 ret |= TARGET_PR_FP_MODE_FRE;
10801             }
10802             return ret;
10803         }
10804         case TARGET_PR_SET_FP_MODE:
10805         {
10806             CPUMIPSState *env = ((CPUMIPSState *)cpu_env);
10807             bool old_fr = env->CP0_Status & (1 << CP0St_FR);
10808             bool old_fre = env->CP0_Config5 & (1 << CP0C5_FRE);
10809             bool new_fr = arg2 & TARGET_PR_FP_MODE_FR;
10810             bool new_fre = arg2 & TARGET_PR_FP_MODE_FRE;
10811 
10812             const unsigned int known_bits = TARGET_PR_FP_MODE_FR |
10813                                             TARGET_PR_FP_MODE_FRE;
10814 
10815             /* If nothing to change, return right away, successfully.  */
10816             if (old_fr == new_fr && old_fre == new_fre) {
10817                 return 0;
10818             }
10819             /* Check the value is valid */
10820             if (arg2 & ~known_bits) {
10821                 return -TARGET_EOPNOTSUPP;
10822             }
10823             /* Setting FRE without FR is not supported.  */
10824             if (new_fre && !new_fr) {
10825                 return -TARGET_EOPNOTSUPP;
10826             }
10827             if (new_fr && !(env->active_fpu.fcr0 & (1 << FCR0_F64))) {
10828                 /* FR1 is not supported */
10829                 return -TARGET_EOPNOTSUPP;
10830             }
10831             if (!new_fr && (env->active_fpu.fcr0 & (1 << FCR0_F64))
10832                 && !(env->CP0_Status_rw_bitmask & (1 << CP0St_FR))) {
10833                 /* cannot set FR=0 */
10834                 return -TARGET_EOPNOTSUPP;
10835             }
10836             if (new_fre && !(env->active_fpu.fcr0 & (1 << FCR0_FREP))) {
10837                 /* Cannot set FRE=1 */
10838                 return -TARGET_EOPNOTSUPP;
10839             }
10840 
10841             int i;
10842             fpr_t *fpr = env->active_fpu.fpr;
10843             for (i = 0; i < 32 ; i += 2) {
10844                 if (!old_fr && new_fr) {
10845                     fpr[i].w[!FP_ENDIAN_IDX] = fpr[i + 1].w[FP_ENDIAN_IDX];
10846                 } else if (old_fr && !new_fr) {
10847                     fpr[i + 1].w[FP_ENDIAN_IDX] = fpr[i].w[!FP_ENDIAN_IDX];
10848                 }
10849             }
10850 
10851             if (new_fr) {
10852                 env->CP0_Status |= (1 << CP0St_FR);
10853                 env->hflags |= MIPS_HFLAG_F64;
10854             } else {
10855                 env->CP0_Status &= ~(1 << CP0St_FR);
10856                 env->hflags &= ~MIPS_HFLAG_F64;
10857             }
10858             if (new_fre) {
10859                 env->CP0_Config5 |= (1 << CP0C5_FRE);
10860                 if (env->active_fpu.fcr0 & (1 << FCR0_FREP)) {
10861                     env->hflags |= MIPS_HFLAG_FRE;
10862                 }
10863             } else {
10864                 env->CP0_Config5 &= ~(1 << CP0C5_FRE);
10865                 env->hflags &= ~MIPS_HFLAG_FRE;
10866             }
10867 
10868             return 0;
10869         }
10870 #endif /* MIPS */
10871 #ifdef TARGET_AARCH64
10872         case TARGET_PR_SVE_SET_VL:
10873             /*
10874              * We cannot support either PR_SVE_SET_VL_ONEXEC or
10875              * PR_SVE_VL_INHERIT.  Note the kernel definition
10876              * of sve_vl_valid allows for VQ=512, i.e. VL=8192,
10877              * even though the current architectural maximum is VQ=16.
10878              */
10879             ret = -TARGET_EINVAL;
10880             if (cpu_isar_feature(aa64_sve, env_archcpu(cpu_env))
10881                 && arg2 >= 0 && arg2 <= 512 * 16 && !(arg2 & 15)) {
10882                 CPUARMState *env = cpu_env;
10883                 ARMCPU *cpu = env_archcpu(env);
10884                 uint32_t vq, old_vq;
10885 
10886                 old_vq = (env->vfp.zcr_el[1] & 0xf) + 1;
10887                 vq = MAX(arg2 / 16, 1);
10888                 vq = MIN(vq, cpu->sve_max_vq);
10889 
10890                 if (vq < old_vq) {
10891                     aarch64_sve_narrow_vq(env, vq);
10892                 }
10893                 env->vfp.zcr_el[1] = vq - 1;
10894                 arm_rebuild_hflags(env);
10895                 ret = vq * 16;
10896             }
10897             return ret;
10898         case TARGET_PR_SVE_GET_VL:
10899             ret = -TARGET_EINVAL;
10900             {
10901                 ARMCPU *cpu = env_archcpu(cpu_env);
10902                 if (cpu_isar_feature(aa64_sve, cpu)) {
10903                     ret = ((cpu->env.vfp.zcr_el[1] & 0xf) + 1) * 16;
10904                 }
10905             }
10906             return ret;
10907         case TARGET_PR_PAC_RESET_KEYS:
10908             {
10909                 CPUARMState *env = cpu_env;
10910                 ARMCPU *cpu = env_archcpu(env);
10911 
10912                 if (arg3 || arg4 || arg5) {
10913                     return -TARGET_EINVAL;
10914                 }
10915                 if (cpu_isar_feature(aa64_pauth, cpu)) {
10916                     int all = (TARGET_PR_PAC_APIAKEY | TARGET_PR_PAC_APIBKEY |
10917                                TARGET_PR_PAC_APDAKEY | TARGET_PR_PAC_APDBKEY |
10918                                TARGET_PR_PAC_APGAKEY);
10919                     int ret = 0;
10920                     Error *err = NULL;
10921 
10922                     if (arg2 == 0) {
10923                         arg2 = all;
10924                     } else if (arg2 & ~all) {
10925                         return -TARGET_EINVAL;
10926                     }
10927                     if (arg2 & TARGET_PR_PAC_APIAKEY) {
10928                         ret |= qemu_guest_getrandom(&env->keys.apia,
10929                                                     sizeof(ARMPACKey), &err);
10930                     }
10931                     if (arg2 & TARGET_PR_PAC_APIBKEY) {
10932                         ret |= qemu_guest_getrandom(&env->keys.apib,
10933                                                     sizeof(ARMPACKey), &err);
10934                     }
10935                     if (arg2 & TARGET_PR_PAC_APDAKEY) {
10936                         ret |= qemu_guest_getrandom(&env->keys.apda,
10937                                                     sizeof(ARMPACKey), &err);
10938                     }
10939                     if (arg2 & TARGET_PR_PAC_APDBKEY) {
10940                         ret |= qemu_guest_getrandom(&env->keys.apdb,
10941                                                     sizeof(ARMPACKey), &err);
10942                     }
10943                     if (arg2 & TARGET_PR_PAC_APGAKEY) {
10944                         ret |= qemu_guest_getrandom(&env->keys.apga,
10945                                                     sizeof(ARMPACKey), &err);
10946                     }
10947                     if (ret != 0) {
10948                         /*
10949                          * Some unknown failure in the crypto.  The best
10950                          * we can do is log it and fail the syscall.
10951                          * The real syscall cannot fail this way.
10952                          */
10953                         qemu_log_mask(LOG_UNIMP,
10954                                       "PR_PAC_RESET_KEYS: Crypto failure: %s",
10955                                       error_get_pretty(err));
10956                         error_free(err);
10957                         return -TARGET_EIO;
10958                     }
10959                     return 0;
10960                 }
10961             }
10962             return -TARGET_EINVAL;
10963         case TARGET_PR_SET_TAGGED_ADDR_CTRL:
10964             {
10965                 abi_ulong valid_mask = TARGET_PR_TAGGED_ADDR_ENABLE;
10966                 CPUARMState *env = cpu_env;
10967                 ARMCPU *cpu = env_archcpu(env);
10968 
10969                 if (cpu_isar_feature(aa64_mte, cpu)) {
10970                     valid_mask |= TARGET_PR_MTE_TCF_MASK;
10971                     valid_mask |= TARGET_PR_MTE_TAG_MASK;
10972                 }
10973 
10974                 if ((arg2 & ~valid_mask) || arg3 || arg4 || arg5) {
10975                     return -TARGET_EINVAL;
10976                 }
10977                 env->tagged_addr_enable = arg2 & TARGET_PR_TAGGED_ADDR_ENABLE;
10978 
10979                 if (cpu_isar_feature(aa64_mte, cpu)) {
10980                     switch (arg2 & TARGET_PR_MTE_TCF_MASK) {
10981                     case TARGET_PR_MTE_TCF_NONE:
10982                     case TARGET_PR_MTE_TCF_SYNC:
10983                     case TARGET_PR_MTE_TCF_ASYNC:
10984                         break;
10985                     default:
10986                         return -EINVAL;
10987                     }
10988 
10989                     /*
10990                      * Write PR_MTE_TCF to SCTLR_EL1[TCF0].
10991                      * Note that the syscall values are consistent with hw.
10992                      */
10993                     env->cp15.sctlr_el[1] =
10994                         deposit64(env->cp15.sctlr_el[1], 38, 2,
10995                                   arg2 >> TARGET_PR_MTE_TCF_SHIFT);
10996 
10997                     /*
10998                      * Write PR_MTE_TAG to GCR_EL1[Exclude].
10999                      * Note that the syscall uses an include mask,
11000                      * and hardware uses an exclude mask -- invert.
11001                      */
11002                     env->cp15.gcr_el1 =
11003                         deposit64(env->cp15.gcr_el1, 0, 16,
11004                                   ~arg2 >> TARGET_PR_MTE_TAG_SHIFT);
11005                     arm_rebuild_hflags(env);
11006                 }
11007                 return 0;
11008             }
11009         case TARGET_PR_GET_TAGGED_ADDR_CTRL:
11010             {
11011                 abi_long ret = 0;
11012                 CPUARMState *env = cpu_env;
11013                 ARMCPU *cpu = env_archcpu(env);
11014 
11015                 if (arg2 || arg3 || arg4 || arg5) {
11016                     return -TARGET_EINVAL;
11017                 }
11018                 if (env->tagged_addr_enable) {
11019                     ret |= TARGET_PR_TAGGED_ADDR_ENABLE;
11020                 }
11021                 if (cpu_isar_feature(aa64_mte, cpu)) {
11022                     /* See above. */
11023                     ret |= (extract64(env->cp15.sctlr_el[1], 38, 2)
11024                             << TARGET_PR_MTE_TCF_SHIFT);
11025                     ret = deposit64(ret, TARGET_PR_MTE_TAG_SHIFT, 16,
11026                                     ~env->cp15.gcr_el1);
11027                 }
11028                 return ret;
11029             }
11030 #endif /* AARCH64 */
11031         case PR_GET_SECCOMP:
11032         case PR_SET_SECCOMP:
11033             /* Disable seccomp to prevent the target disabling syscalls we
11034              * need. */
11035             return -TARGET_EINVAL;
11036         default:
11037             /* Most prctl options have no pointer arguments */
11038             return get_errno(prctl(arg1, arg2, arg3, arg4, arg5));
11039         }
11040         break;
11041 #ifdef TARGET_NR_arch_prctl
11042     case TARGET_NR_arch_prctl:
11043         return do_arch_prctl(cpu_env, arg1, arg2);
11044 #endif
11045 #ifdef TARGET_NR_pread64
11046     case TARGET_NR_pread64:
11047         if (regpairs_aligned(cpu_env, num)) {
11048             arg4 = arg5;
11049             arg5 = arg6;
11050         }
11051         if (arg2 == 0 && arg3 == 0) {
11052             /* Special-case NULL buffer and zero length, which should succeed */
11053             p = 0;
11054         } else {
11055             p = lock_user(VERIFY_WRITE, arg2, arg3, 0);
11056             if (!p) {
11057                 return -TARGET_EFAULT;
11058             }
11059         }
11060         ret = get_errno(pread64(arg1, p, arg3, target_offset64(arg4, arg5)));
11061         unlock_user(p, arg2, ret);
11062         return ret;
11063     case TARGET_NR_pwrite64:
11064         if (regpairs_aligned(cpu_env, num)) {
11065             arg4 = arg5;
11066             arg5 = arg6;
11067         }
11068         if (arg2 == 0 && arg3 == 0) {
11069             /* Special-case NULL buffer and zero length, which should succeed */
11070             p = 0;
11071         } else {
11072             p = lock_user(VERIFY_READ, arg2, arg3, 1);
11073             if (!p) {
11074                 return -TARGET_EFAULT;
11075             }
11076         }
11077         ret = get_errno(pwrite64(arg1, p, arg3, target_offset64(arg4, arg5)));
11078         unlock_user(p, arg2, 0);
11079         return ret;
11080 #endif
11081     case TARGET_NR_getcwd:
11082         if (!(p = lock_user(VERIFY_WRITE, arg1, arg2, 0)))
11083             return -TARGET_EFAULT;
11084         ret = get_errno(sys_getcwd1(p, arg2));
11085         unlock_user(p, arg1, ret);
11086         return ret;
11087     case TARGET_NR_capget:
11088     case TARGET_NR_capset:
11089     {
11090         struct target_user_cap_header *target_header;
11091         struct target_user_cap_data *target_data = NULL;
11092         struct __user_cap_header_struct header;
11093         struct __user_cap_data_struct data[2];
11094         struct __user_cap_data_struct *dataptr = NULL;
11095         int i, target_datalen;
11096         int data_items = 1;
11097 
11098         if (!lock_user_struct(VERIFY_WRITE, target_header, arg1, 1)) {
11099             return -TARGET_EFAULT;
11100         }
11101         header.version = tswap32(target_header->version);
11102         header.pid = tswap32(target_header->pid);
11103 
11104         if (header.version != _LINUX_CAPABILITY_VERSION) {
11105             /* Version 2 and up takes pointer to two user_data structs */
11106             data_items = 2;
11107         }
11108 
11109         target_datalen = sizeof(*target_data) * data_items;
11110 
11111         if (arg2) {
11112             if (num == TARGET_NR_capget) {
11113                 target_data = lock_user(VERIFY_WRITE, arg2, target_datalen, 0);
11114             } else {
11115                 target_data = lock_user(VERIFY_READ, arg2, target_datalen, 1);
11116             }
11117             if (!target_data) {
11118                 unlock_user_struct(target_header, arg1, 0);
11119                 return -TARGET_EFAULT;
11120             }
11121 
11122             if (num == TARGET_NR_capset) {
11123                 for (i = 0; i < data_items; i++) {
11124                     data[i].effective = tswap32(target_data[i].effective);
11125                     data[i].permitted = tswap32(target_data[i].permitted);
11126                     data[i].inheritable = tswap32(target_data[i].inheritable);
11127                 }
11128             }
11129 
11130             dataptr = data;
11131         }
11132 
11133         if (num == TARGET_NR_capget) {
11134             ret = get_errno(capget(&header, dataptr));
11135         } else {
11136             ret = get_errno(capset(&header, dataptr));
11137         }
11138 
11139         /* The kernel always updates version for both capget and capset */
11140         target_header->version = tswap32(header.version);
11141         unlock_user_struct(target_header, arg1, 1);
11142 
11143         if (arg2) {
11144             if (num == TARGET_NR_capget) {
11145                 for (i = 0; i < data_items; i++) {
11146                     target_data[i].effective = tswap32(data[i].effective);
11147                     target_data[i].permitted = tswap32(data[i].permitted);
11148                     target_data[i].inheritable = tswap32(data[i].inheritable);
11149                 }
11150                 unlock_user(target_data, arg2, target_datalen);
11151             } else {
11152                 unlock_user(target_data, arg2, 0);
11153             }
11154         }
11155         return ret;
11156     }
11157     case TARGET_NR_sigaltstack:
11158         return do_sigaltstack(arg1, arg2, cpu_env);
11159 
11160 #ifdef CONFIG_SENDFILE
11161 #ifdef TARGET_NR_sendfile
11162     case TARGET_NR_sendfile:
11163     {
11164         off_t *offp = NULL;
11165         off_t off;
11166         if (arg3) {
11167             ret = get_user_sal(off, arg3);
11168             if (is_error(ret)) {
11169                 return ret;
11170             }
11171             offp = &off;
11172         }
11173         ret = get_errno(sendfile(arg1, arg2, offp, arg4));
11174         if (!is_error(ret) && arg3) {
11175             abi_long ret2 = put_user_sal(off, arg3);
11176             if (is_error(ret2)) {
11177                 ret = ret2;
11178             }
11179         }
11180         return ret;
11181     }
11182 #endif
11183 #ifdef TARGET_NR_sendfile64
11184     case TARGET_NR_sendfile64:
11185     {
11186         off_t *offp = NULL;
11187         off_t off;
11188         if (arg3) {
11189             ret = get_user_s64(off, arg3);
11190             if (is_error(ret)) {
11191                 return ret;
11192             }
11193             offp = &off;
11194         }
11195         ret = get_errno(sendfile(arg1, arg2, offp, arg4));
11196         if (!is_error(ret) && arg3) {
11197             abi_long ret2 = put_user_s64(off, arg3);
11198             if (is_error(ret2)) {
11199                 ret = ret2;
11200             }
11201         }
11202         return ret;
11203     }
11204 #endif
11205 #endif
11206 #ifdef TARGET_NR_vfork
11207     case TARGET_NR_vfork:
11208         return get_errno(do_fork(cpu_env,
11209                          CLONE_VFORK | CLONE_VM | TARGET_SIGCHLD,
11210                          0, 0, 0, 0));
11211 #endif
11212 #ifdef TARGET_NR_ugetrlimit
11213     case TARGET_NR_ugetrlimit:
11214     {
11215 	struct rlimit rlim;
11216 	int resource = target_to_host_resource(arg1);
11217 	ret = get_errno(getrlimit(resource, &rlim));
11218 	if (!is_error(ret)) {
11219 	    struct target_rlimit *target_rlim;
11220             if (!lock_user_struct(VERIFY_WRITE, target_rlim, arg2, 0))
11221                 return -TARGET_EFAULT;
11222 	    target_rlim->rlim_cur = host_to_target_rlim(rlim.rlim_cur);
11223 	    target_rlim->rlim_max = host_to_target_rlim(rlim.rlim_max);
11224             unlock_user_struct(target_rlim, arg2, 1);
11225 	}
11226         return ret;
11227     }
11228 #endif
11229 #ifdef TARGET_NR_truncate64
11230     case TARGET_NR_truncate64:
11231         if (!(p = lock_user_string(arg1)))
11232             return -TARGET_EFAULT;
11233 	ret = target_truncate64(cpu_env, p, arg2, arg3, arg4);
11234         unlock_user(p, arg1, 0);
11235         return ret;
11236 #endif
11237 #ifdef TARGET_NR_ftruncate64
11238     case TARGET_NR_ftruncate64:
11239         return target_ftruncate64(cpu_env, arg1, arg2, arg3, arg4);
11240 #endif
11241 #ifdef TARGET_NR_stat64
11242     case TARGET_NR_stat64:
11243         if (!(p = lock_user_string(arg1))) {
11244             return -TARGET_EFAULT;
11245         }
11246         ret = get_errno(stat(path(p), &st));
11247         unlock_user(p, arg1, 0);
11248         if (!is_error(ret))
11249             ret = host_to_target_stat64(cpu_env, arg2, &st);
11250         return ret;
11251 #endif
11252 #ifdef TARGET_NR_lstat64
11253     case TARGET_NR_lstat64:
11254         if (!(p = lock_user_string(arg1))) {
11255             return -TARGET_EFAULT;
11256         }
11257         ret = get_errno(lstat(path(p), &st));
11258         unlock_user(p, arg1, 0);
11259         if (!is_error(ret))
11260             ret = host_to_target_stat64(cpu_env, arg2, &st);
11261         return ret;
11262 #endif
11263 #ifdef TARGET_NR_fstat64
11264     case TARGET_NR_fstat64:
11265         ret = get_errno(fstat(arg1, &st));
11266         if (!is_error(ret))
11267             ret = host_to_target_stat64(cpu_env, arg2, &st);
11268         return ret;
11269 #endif
11270 #if (defined(TARGET_NR_fstatat64) || defined(TARGET_NR_newfstatat))
11271 #ifdef TARGET_NR_fstatat64
11272     case TARGET_NR_fstatat64:
11273 #endif
11274 #ifdef TARGET_NR_newfstatat
11275     case TARGET_NR_newfstatat:
11276 #endif
11277         if (!(p = lock_user_string(arg2))) {
11278             return -TARGET_EFAULT;
11279         }
11280         ret = get_errno(fstatat(arg1, path(p), &st, arg4));
11281         unlock_user(p, arg2, 0);
11282         if (!is_error(ret))
11283             ret = host_to_target_stat64(cpu_env, arg3, &st);
11284         return ret;
11285 #endif
11286 #if defined(TARGET_NR_statx)
11287     case TARGET_NR_statx:
11288         {
11289             struct target_statx *target_stx;
11290             int dirfd = arg1;
11291             int flags = arg3;
11292 
11293             p = lock_user_string(arg2);
11294             if (p == NULL) {
11295                 return -TARGET_EFAULT;
11296             }
11297 #if defined(__NR_statx)
11298             {
11299                 /*
11300                  * It is assumed that struct statx is architecture independent.
11301                  */
11302                 struct target_statx host_stx;
11303                 int mask = arg4;
11304 
11305                 ret = get_errno(sys_statx(dirfd, p, flags, mask, &host_stx));
11306                 if (!is_error(ret)) {
11307                     if (host_to_target_statx(&host_stx, arg5) != 0) {
11308                         unlock_user(p, arg2, 0);
11309                         return -TARGET_EFAULT;
11310                     }
11311                 }
11312 
11313                 if (ret != -TARGET_ENOSYS) {
11314                     unlock_user(p, arg2, 0);
11315                     return ret;
11316                 }
11317             }
11318 #endif
11319             ret = get_errno(fstatat(dirfd, path(p), &st, flags));
11320             unlock_user(p, arg2, 0);
11321 
11322             if (!is_error(ret)) {
11323                 if (!lock_user_struct(VERIFY_WRITE, target_stx, arg5, 0)) {
11324                     return -TARGET_EFAULT;
11325                 }
11326                 memset(target_stx, 0, sizeof(*target_stx));
11327                 __put_user(major(st.st_dev), &target_stx->stx_dev_major);
11328                 __put_user(minor(st.st_dev), &target_stx->stx_dev_minor);
11329                 __put_user(st.st_ino, &target_stx->stx_ino);
11330                 __put_user(st.st_mode, &target_stx->stx_mode);
11331                 __put_user(st.st_uid, &target_stx->stx_uid);
11332                 __put_user(st.st_gid, &target_stx->stx_gid);
11333                 __put_user(st.st_nlink, &target_stx->stx_nlink);
11334                 __put_user(major(st.st_rdev), &target_stx->stx_rdev_major);
11335                 __put_user(minor(st.st_rdev), &target_stx->stx_rdev_minor);
11336                 __put_user(st.st_size, &target_stx->stx_size);
11337                 __put_user(st.st_blksize, &target_stx->stx_blksize);
11338                 __put_user(st.st_blocks, &target_stx->stx_blocks);
11339                 __put_user(st.st_atime, &target_stx->stx_atime.tv_sec);
11340                 __put_user(st.st_mtime, &target_stx->stx_mtime.tv_sec);
11341                 __put_user(st.st_ctime, &target_stx->stx_ctime.tv_sec);
11342                 unlock_user_struct(target_stx, arg5, 1);
11343             }
11344         }
11345         return ret;
11346 #endif
11347 #ifdef TARGET_NR_lchown
11348     case TARGET_NR_lchown:
11349         if (!(p = lock_user_string(arg1)))
11350             return -TARGET_EFAULT;
11351         ret = get_errno(lchown(p, low2highuid(arg2), low2highgid(arg3)));
11352         unlock_user(p, arg1, 0);
11353         return ret;
11354 #endif
11355 #ifdef TARGET_NR_getuid
11356     case TARGET_NR_getuid:
11357         return get_errno(high2lowuid(getuid()));
11358 #endif
11359 #ifdef TARGET_NR_getgid
11360     case TARGET_NR_getgid:
11361         return get_errno(high2lowgid(getgid()));
11362 #endif
11363 #ifdef TARGET_NR_geteuid
11364     case TARGET_NR_geteuid:
11365         return get_errno(high2lowuid(geteuid()));
11366 #endif
11367 #ifdef TARGET_NR_getegid
11368     case TARGET_NR_getegid:
11369         return get_errno(high2lowgid(getegid()));
11370 #endif
11371     case TARGET_NR_setreuid:
11372         return get_errno(setreuid(low2highuid(arg1), low2highuid(arg2)));
11373     case TARGET_NR_setregid:
11374         return get_errno(setregid(low2highgid(arg1), low2highgid(arg2)));
11375     case TARGET_NR_getgroups:
11376         {
11377             int gidsetsize = arg1;
11378             target_id *target_grouplist;
11379             gid_t *grouplist;
11380             int i;
11381 
11382             grouplist = alloca(gidsetsize * sizeof(gid_t));
11383             ret = get_errno(getgroups(gidsetsize, grouplist));
11384             if (gidsetsize == 0)
11385                 return ret;
11386             if (!is_error(ret)) {
11387                 target_grouplist = lock_user(VERIFY_WRITE, arg2, gidsetsize * sizeof(target_id), 0);
11388                 if (!target_grouplist)
11389                     return -TARGET_EFAULT;
11390                 for(i = 0;i < ret; i++)
11391                     target_grouplist[i] = tswapid(high2lowgid(grouplist[i]));
11392                 unlock_user(target_grouplist, arg2, gidsetsize * sizeof(target_id));
11393             }
11394         }
11395         return ret;
11396     case TARGET_NR_setgroups:
11397         {
11398             int gidsetsize = arg1;
11399             target_id *target_grouplist;
11400             gid_t *grouplist = NULL;
11401             int i;
11402             if (gidsetsize) {
11403                 grouplist = alloca(gidsetsize * sizeof(gid_t));
11404                 target_grouplist = lock_user(VERIFY_READ, arg2, gidsetsize * sizeof(target_id), 1);
11405                 if (!target_grouplist) {
11406                     return -TARGET_EFAULT;
11407                 }
11408                 for (i = 0; i < gidsetsize; i++) {
11409                     grouplist[i] = low2highgid(tswapid(target_grouplist[i]));
11410                 }
11411                 unlock_user(target_grouplist, arg2, 0);
11412             }
11413             return get_errno(setgroups(gidsetsize, grouplist));
11414         }
11415     case TARGET_NR_fchown:
11416         return get_errno(fchown(arg1, low2highuid(arg2), low2highgid(arg3)));
11417 #if defined(TARGET_NR_fchownat)
11418     case TARGET_NR_fchownat:
11419         if (!(p = lock_user_string(arg2)))
11420             return -TARGET_EFAULT;
11421         ret = get_errno(fchownat(arg1, p, low2highuid(arg3),
11422                                  low2highgid(arg4), arg5));
11423         unlock_user(p, arg2, 0);
11424         return ret;
11425 #endif
11426 #ifdef TARGET_NR_setresuid
11427     case TARGET_NR_setresuid:
11428         return get_errno(sys_setresuid(low2highuid(arg1),
11429                                        low2highuid(arg2),
11430                                        low2highuid(arg3)));
11431 #endif
11432 #ifdef TARGET_NR_getresuid
11433     case TARGET_NR_getresuid:
11434         {
11435             uid_t ruid, euid, suid;
11436             ret = get_errno(getresuid(&ruid, &euid, &suid));
11437             if (!is_error(ret)) {
11438                 if (put_user_id(high2lowuid(ruid), arg1)
11439                     || put_user_id(high2lowuid(euid), arg2)
11440                     || put_user_id(high2lowuid(suid), arg3))
11441                     return -TARGET_EFAULT;
11442             }
11443         }
11444         return ret;
11445 #endif
11446 #ifdef TARGET_NR_getresgid
11447     case TARGET_NR_setresgid:
11448         return get_errno(sys_setresgid(low2highgid(arg1),
11449                                        low2highgid(arg2),
11450                                        low2highgid(arg3)));
11451 #endif
11452 #ifdef TARGET_NR_getresgid
11453     case TARGET_NR_getresgid:
11454         {
11455             gid_t rgid, egid, sgid;
11456             ret = get_errno(getresgid(&rgid, &egid, &sgid));
11457             if (!is_error(ret)) {
11458                 if (put_user_id(high2lowgid(rgid), arg1)
11459                     || put_user_id(high2lowgid(egid), arg2)
11460                     || put_user_id(high2lowgid(sgid), arg3))
11461                     return -TARGET_EFAULT;
11462             }
11463         }
11464         return ret;
11465 #endif
11466 #ifdef TARGET_NR_chown
11467     case TARGET_NR_chown:
11468         if (!(p = lock_user_string(arg1)))
11469             return -TARGET_EFAULT;
11470         ret = get_errno(chown(p, low2highuid(arg2), low2highgid(arg3)));
11471         unlock_user(p, arg1, 0);
11472         return ret;
11473 #endif
11474     case TARGET_NR_setuid:
11475         return get_errno(sys_setuid(low2highuid(arg1)));
11476     case TARGET_NR_setgid:
11477         return get_errno(sys_setgid(low2highgid(arg1)));
11478     case TARGET_NR_setfsuid:
11479         return get_errno(setfsuid(arg1));
11480     case TARGET_NR_setfsgid:
11481         return get_errno(setfsgid(arg1));
11482 
11483 #ifdef TARGET_NR_lchown32
11484     case TARGET_NR_lchown32:
11485         if (!(p = lock_user_string(arg1)))
11486             return -TARGET_EFAULT;
11487         ret = get_errno(lchown(p, arg2, arg3));
11488         unlock_user(p, arg1, 0);
11489         return ret;
11490 #endif
11491 #ifdef TARGET_NR_getuid32
11492     case TARGET_NR_getuid32:
11493         return get_errno(getuid());
11494 #endif
11495 
11496 #if defined(TARGET_NR_getxuid) && defined(TARGET_ALPHA)
11497    /* Alpha specific */
11498     case TARGET_NR_getxuid:
11499          {
11500             uid_t euid;
11501             euid=geteuid();
11502             ((CPUAlphaState *)cpu_env)->ir[IR_A4]=euid;
11503          }
11504         return get_errno(getuid());
11505 #endif
11506 #if defined(TARGET_NR_getxgid) && defined(TARGET_ALPHA)
11507    /* Alpha specific */
11508     case TARGET_NR_getxgid:
11509          {
11510             uid_t egid;
11511             egid=getegid();
11512             ((CPUAlphaState *)cpu_env)->ir[IR_A4]=egid;
11513          }
11514         return get_errno(getgid());
11515 #endif
11516 #if defined(TARGET_NR_osf_getsysinfo) && defined(TARGET_ALPHA)
11517     /* Alpha specific */
11518     case TARGET_NR_osf_getsysinfo:
11519         ret = -TARGET_EOPNOTSUPP;
11520         switch (arg1) {
11521           case TARGET_GSI_IEEE_FP_CONTROL:
11522             {
11523                 uint64_t fpcr = cpu_alpha_load_fpcr(cpu_env);
11524                 uint64_t swcr = ((CPUAlphaState *)cpu_env)->swcr;
11525 
11526                 swcr &= ~SWCR_STATUS_MASK;
11527                 swcr |= (fpcr >> 35) & SWCR_STATUS_MASK;
11528 
11529                 if (put_user_u64 (swcr, arg2))
11530                         return -TARGET_EFAULT;
11531                 ret = 0;
11532             }
11533             break;
11534 
11535           /* case GSI_IEEE_STATE_AT_SIGNAL:
11536              -- Not implemented in linux kernel.
11537              case GSI_UACPROC:
11538              -- Retrieves current unaligned access state; not much used.
11539              case GSI_PROC_TYPE:
11540              -- Retrieves implver information; surely not used.
11541              case GSI_GET_HWRPB:
11542              -- Grabs a copy of the HWRPB; surely not used.
11543           */
11544         }
11545         return ret;
11546 #endif
11547 #if defined(TARGET_NR_osf_setsysinfo) && defined(TARGET_ALPHA)
11548     /* Alpha specific */
11549     case TARGET_NR_osf_setsysinfo:
11550         ret = -TARGET_EOPNOTSUPP;
11551         switch (arg1) {
11552           case TARGET_SSI_IEEE_FP_CONTROL:
11553             {
11554                 uint64_t swcr, fpcr;
11555 
11556                 if (get_user_u64 (swcr, arg2)) {
11557                     return -TARGET_EFAULT;
11558                 }
11559 
11560                 /*
11561                  * The kernel calls swcr_update_status to update the
11562                  * status bits from the fpcr at every point that it
11563                  * could be queried.  Therefore, we store the status
11564                  * bits only in FPCR.
11565                  */
11566                 ((CPUAlphaState *)cpu_env)->swcr
11567                     = swcr & (SWCR_TRAP_ENABLE_MASK | SWCR_MAP_MASK);
11568 
11569                 fpcr = cpu_alpha_load_fpcr(cpu_env);
11570                 fpcr &= ((uint64_t)FPCR_DYN_MASK << 32);
11571                 fpcr |= alpha_ieee_swcr_to_fpcr(swcr);
11572                 cpu_alpha_store_fpcr(cpu_env, fpcr);
11573                 ret = 0;
11574             }
11575             break;
11576 
11577           case TARGET_SSI_IEEE_RAISE_EXCEPTION:
11578             {
11579                 uint64_t exc, fpcr, fex;
11580 
11581                 if (get_user_u64(exc, arg2)) {
11582                     return -TARGET_EFAULT;
11583                 }
11584                 exc &= SWCR_STATUS_MASK;
11585                 fpcr = cpu_alpha_load_fpcr(cpu_env);
11586 
11587                 /* Old exceptions are not signaled.  */
11588                 fex = alpha_ieee_fpcr_to_swcr(fpcr);
11589                 fex = exc & ~fex;
11590                 fex >>= SWCR_STATUS_TO_EXCSUM_SHIFT;
11591                 fex &= ((CPUArchState *)cpu_env)->swcr;
11592 
11593                 /* Update the hardware fpcr.  */
11594                 fpcr |= alpha_ieee_swcr_to_fpcr(exc);
11595                 cpu_alpha_store_fpcr(cpu_env, fpcr);
11596 
11597                 if (fex) {
11598                     int si_code = TARGET_FPE_FLTUNK;
11599                     target_siginfo_t info;
11600 
11601                     if (fex & SWCR_TRAP_ENABLE_DNO) {
11602                         si_code = TARGET_FPE_FLTUND;
11603                     }
11604                     if (fex & SWCR_TRAP_ENABLE_INE) {
11605                         si_code = TARGET_FPE_FLTRES;
11606                     }
11607                     if (fex & SWCR_TRAP_ENABLE_UNF) {
11608                         si_code = TARGET_FPE_FLTUND;
11609                     }
11610                     if (fex & SWCR_TRAP_ENABLE_OVF) {
11611                         si_code = TARGET_FPE_FLTOVF;
11612                     }
11613                     if (fex & SWCR_TRAP_ENABLE_DZE) {
11614                         si_code = TARGET_FPE_FLTDIV;
11615                     }
11616                     if (fex & SWCR_TRAP_ENABLE_INV) {
11617                         si_code = TARGET_FPE_FLTINV;
11618                     }
11619 
11620                     info.si_signo = SIGFPE;
11621                     info.si_errno = 0;
11622                     info.si_code = si_code;
11623                     info._sifields._sigfault._addr
11624                         = ((CPUArchState *)cpu_env)->pc;
11625                     queue_signal((CPUArchState *)cpu_env, info.si_signo,
11626                                  QEMU_SI_FAULT, &info);
11627                 }
11628                 ret = 0;
11629             }
11630             break;
11631 
11632           /* case SSI_NVPAIRS:
11633              -- Used with SSIN_UACPROC to enable unaligned accesses.
11634              case SSI_IEEE_STATE_AT_SIGNAL:
11635              case SSI_IEEE_IGNORE_STATE_AT_SIGNAL:
11636              -- Not implemented in linux kernel
11637           */
11638         }
11639         return ret;
11640 #endif
11641 #ifdef TARGET_NR_osf_sigprocmask
11642     /* Alpha specific.  */
11643     case TARGET_NR_osf_sigprocmask:
11644         {
11645             abi_ulong mask;
11646             int how;
11647             sigset_t set, oldset;
11648 
11649             switch(arg1) {
11650             case TARGET_SIG_BLOCK:
11651                 how = SIG_BLOCK;
11652                 break;
11653             case TARGET_SIG_UNBLOCK:
11654                 how = SIG_UNBLOCK;
11655                 break;
11656             case TARGET_SIG_SETMASK:
11657                 how = SIG_SETMASK;
11658                 break;
11659             default:
11660                 return -TARGET_EINVAL;
11661             }
11662             mask = arg2;
11663             target_to_host_old_sigset(&set, &mask);
11664             ret = do_sigprocmask(how, &set, &oldset);
11665             if (!ret) {
11666                 host_to_target_old_sigset(&mask, &oldset);
11667                 ret = mask;
11668             }
11669         }
11670         return ret;
11671 #endif
11672 
11673 #ifdef TARGET_NR_getgid32
11674     case TARGET_NR_getgid32:
11675         return get_errno(getgid());
11676 #endif
11677 #ifdef TARGET_NR_geteuid32
11678     case TARGET_NR_geteuid32:
11679         return get_errno(geteuid());
11680 #endif
11681 #ifdef TARGET_NR_getegid32
11682     case TARGET_NR_getegid32:
11683         return get_errno(getegid());
11684 #endif
11685 #ifdef TARGET_NR_setreuid32
11686     case TARGET_NR_setreuid32:
11687         return get_errno(setreuid(arg1, arg2));
11688 #endif
11689 #ifdef TARGET_NR_setregid32
11690     case TARGET_NR_setregid32:
11691         return get_errno(setregid(arg1, arg2));
11692 #endif
11693 #ifdef TARGET_NR_getgroups32
11694     case TARGET_NR_getgroups32:
11695         {
11696             int gidsetsize = arg1;
11697             uint32_t *target_grouplist;
11698             gid_t *grouplist;
11699             int i;
11700 
11701             grouplist = alloca(gidsetsize * sizeof(gid_t));
11702             ret = get_errno(getgroups(gidsetsize, grouplist));
11703             if (gidsetsize == 0)
11704                 return ret;
11705             if (!is_error(ret)) {
11706                 target_grouplist = lock_user(VERIFY_WRITE, arg2, gidsetsize * 4, 0);
11707                 if (!target_grouplist) {
11708                     return -TARGET_EFAULT;
11709                 }
11710                 for(i = 0;i < ret; i++)
11711                     target_grouplist[i] = tswap32(grouplist[i]);
11712                 unlock_user(target_grouplist, arg2, gidsetsize * 4);
11713             }
11714         }
11715         return ret;
11716 #endif
11717 #ifdef TARGET_NR_setgroups32
11718     case TARGET_NR_setgroups32:
11719         {
11720             int gidsetsize = arg1;
11721             uint32_t *target_grouplist;
11722             gid_t *grouplist;
11723             int i;
11724 
11725             grouplist = alloca(gidsetsize * sizeof(gid_t));
11726             target_grouplist = lock_user(VERIFY_READ, arg2, gidsetsize * 4, 1);
11727             if (!target_grouplist) {
11728                 return -TARGET_EFAULT;
11729             }
11730             for(i = 0;i < gidsetsize; i++)
11731                 grouplist[i] = tswap32(target_grouplist[i]);
11732             unlock_user(target_grouplist, arg2, 0);
11733             return get_errno(setgroups(gidsetsize, grouplist));
11734         }
11735 #endif
11736 #ifdef TARGET_NR_fchown32
11737     case TARGET_NR_fchown32:
11738         return get_errno(fchown(arg1, arg2, arg3));
11739 #endif
11740 #ifdef TARGET_NR_setresuid32
11741     case TARGET_NR_setresuid32:
11742         return get_errno(sys_setresuid(arg1, arg2, arg3));
11743 #endif
11744 #ifdef TARGET_NR_getresuid32
11745     case TARGET_NR_getresuid32:
11746         {
11747             uid_t ruid, euid, suid;
11748             ret = get_errno(getresuid(&ruid, &euid, &suid));
11749             if (!is_error(ret)) {
11750                 if (put_user_u32(ruid, arg1)
11751                     || put_user_u32(euid, arg2)
11752                     || put_user_u32(suid, arg3))
11753                     return -TARGET_EFAULT;
11754             }
11755         }
11756         return ret;
11757 #endif
11758 #ifdef TARGET_NR_setresgid32
11759     case TARGET_NR_setresgid32:
11760         return get_errno(sys_setresgid(arg1, arg2, arg3));
11761 #endif
11762 #ifdef TARGET_NR_getresgid32
11763     case TARGET_NR_getresgid32:
11764         {
11765             gid_t rgid, egid, sgid;
11766             ret = get_errno(getresgid(&rgid, &egid, &sgid));
11767             if (!is_error(ret)) {
11768                 if (put_user_u32(rgid, arg1)
11769                     || put_user_u32(egid, arg2)
11770                     || put_user_u32(sgid, arg3))
11771                     return -TARGET_EFAULT;
11772             }
11773         }
11774         return ret;
11775 #endif
11776 #ifdef TARGET_NR_chown32
11777     case TARGET_NR_chown32:
11778         if (!(p = lock_user_string(arg1)))
11779             return -TARGET_EFAULT;
11780         ret = get_errno(chown(p, arg2, arg3));
11781         unlock_user(p, arg1, 0);
11782         return ret;
11783 #endif
11784 #ifdef TARGET_NR_setuid32
11785     case TARGET_NR_setuid32:
11786         return get_errno(sys_setuid(arg1));
11787 #endif
11788 #ifdef TARGET_NR_setgid32
11789     case TARGET_NR_setgid32:
11790         return get_errno(sys_setgid(arg1));
11791 #endif
11792 #ifdef TARGET_NR_setfsuid32
11793     case TARGET_NR_setfsuid32:
11794         return get_errno(setfsuid(arg1));
11795 #endif
11796 #ifdef TARGET_NR_setfsgid32
11797     case TARGET_NR_setfsgid32:
11798         return get_errno(setfsgid(arg1));
11799 #endif
11800 #ifdef TARGET_NR_mincore
11801     case TARGET_NR_mincore:
11802         {
11803             void *a = lock_user(VERIFY_READ, arg1, arg2, 0);
11804             if (!a) {
11805                 return -TARGET_ENOMEM;
11806             }
11807             p = lock_user_string(arg3);
11808             if (!p) {
11809                 ret = -TARGET_EFAULT;
11810             } else {
11811                 ret = get_errno(mincore(a, arg2, p));
11812                 unlock_user(p, arg3, ret);
11813             }
11814             unlock_user(a, arg1, 0);
11815         }
11816         return ret;
11817 #endif
11818 #ifdef TARGET_NR_arm_fadvise64_64
11819     case TARGET_NR_arm_fadvise64_64:
11820         /* arm_fadvise64_64 looks like fadvise64_64 but
11821          * with different argument order: fd, advice, offset, len
11822          * rather than the usual fd, offset, len, advice.
11823          * Note that offset and len are both 64-bit so appear as
11824          * pairs of 32-bit registers.
11825          */
11826         ret = posix_fadvise(arg1, target_offset64(arg3, arg4),
11827                             target_offset64(arg5, arg6), arg2);
11828         return -host_to_target_errno(ret);
11829 #endif
11830 
11831 #if TARGET_ABI_BITS == 32
11832 
11833 #ifdef TARGET_NR_fadvise64_64
11834     case TARGET_NR_fadvise64_64:
11835 #if defined(TARGET_PPC) || defined(TARGET_XTENSA)
11836         /* 6 args: fd, advice, offset (high, low), len (high, low) */
11837         ret = arg2;
11838         arg2 = arg3;
11839         arg3 = arg4;
11840         arg4 = arg5;
11841         arg5 = arg6;
11842         arg6 = ret;
11843 #else
11844         /* 6 args: fd, offset (high, low), len (high, low), advice */
11845         if (regpairs_aligned(cpu_env, num)) {
11846             /* offset is in (3,4), len in (5,6) and advice in 7 */
11847             arg2 = arg3;
11848             arg3 = arg4;
11849             arg4 = arg5;
11850             arg5 = arg6;
11851             arg6 = arg7;
11852         }
11853 #endif
11854         ret = posix_fadvise(arg1, target_offset64(arg2, arg3),
11855                             target_offset64(arg4, arg5), arg6);
11856         return -host_to_target_errno(ret);
11857 #endif
11858 
11859 #ifdef TARGET_NR_fadvise64
11860     case TARGET_NR_fadvise64:
11861         /* 5 args: fd, offset (high, low), len, advice */
11862         if (regpairs_aligned(cpu_env, num)) {
11863             /* offset is in (3,4), len in 5 and advice in 6 */
11864             arg2 = arg3;
11865             arg3 = arg4;
11866             arg4 = arg5;
11867             arg5 = arg6;
11868         }
11869         ret = posix_fadvise(arg1, target_offset64(arg2, arg3), arg4, arg5);
11870         return -host_to_target_errno(ret);
11871 #endif
11872 
11873 #else /* not a 32-bit ABI */
11874 #if defined(TARGET_NR_fadvise64_64) || defined(TARGET_NR_fadvise64)
11875 #ifdef TARGET_NR_fadvise64_64
11876     case TARGET_NR_fadvise64_64:
11877 #endif
11878 #ifdef TARGET_NR_fadvise64
11879     case TARGET_NR_fadvise64:
11880 #endif
11881 #ifdef TARGET_S390X
11882         switch (arg4) {
11883         case 4: arg4 = POSIX_FADV_NOREUSE + 1; break; /* make sure it's an invalid value */
11884         case 5: arg4 = POSIX_FADV_NOREUSE + 2; break; /* ditto */
11885         case 6: arg4 = POSIX_FADV_DONTNEED; break;
11886         case 7: arg4 = POSIX_FADV_NOREUSE; break;
11887         default: break;
11888         }
11889 #endif
11890         return -host_to_target_errno(posix_fadvise(arg1, arg2, arg3, arg4));
11891 #endif
11892 #endif /* end of 64-bit ABI fadvise handling */
11893 
11894 #ifdef TARGET_NR_madvise
11895     case TARGET_NR_madvise:
11896         /* A straight passthrough may not be safe because qemu sometimes
11897            turns private file-backed mappings into anonymous mappings.
11898            This will break MADV_DONTNEED.
11899            This is a hint, so ignoring and returning success is ok.  */
11900         return 0;
11901 #endif
11902 #ifdef TARGET_NR_fcntl64
11903     case TARGET_NR_fcntl64:
11904     {
11905         int cmd;
11906         struct flock64 fl;
11907         from_flock64_fn *copyfrom = copy_from_user_flock64;
11908         to_flock64_fn *copyto = copy_to_user_flock64;
11909 
11910 #ifdef TARGET_ARM
11911         if (!((CPUARMState *)cpu_env)->eabi) {
11912             copyfrom = copy_from_user_oabi_flock64;
11913             copyto = copy_to_user_oabi_flock64;
11914         }
11915 #endif
11916 
11917         cmd = target_to_host_fcntl_cmd(arg2);
11918         if (cmd == -TARGET_EINVAL) {
11919             return cmd;
11920         }
11921 
11922         switch(arg2) {
11923         case TARGET_F_GETLK64:
11924             ret = copyfrom(&fl, arg3);
11925             if (ret) {
11926                 break;
11927             }
11928             ret = get_errno(safe_fcntl(arg1, cmd, &fl));
11929             if (ret == 0) {
11930                 ret = copyto(arg3, &fl);
11931             }
11932 	    break;
11933 
11934         case TARGET_F_SETLK64:
11935         case TARGET_F_SETLKW64:
11936             ret = copyfrom(&fl, arg3);
11937             if (ret) {
11938                 break;
11939             }
11940             ret = get_errno(safe_fcntl(arg1, cmd, &fl));
11941 	    break;
11942         default:
11943             ret = do_fcntl(arg1, arg2, arg3);
11944             break;
11945         }
11946         return ret;
11947     }
11948 #endif
11949 #ifdef TARGET_NR_cacheflush
11950     case TARGET_NR_cacheflush:
11951         /* self-modifying code is handled automatically, so nothing needed */
11952         return 0;
11953 #endif
11954 #ifdef TARGET_NR_getpagesize
11955     case TARGET_NR_getpagesize:
11956         return TARGET_PAGE_SIZE;
11957 #endif
11958     case TARGET_NR_gettid:
11959         return get_errno(sys_gettid());
11960 #ifdef TARGET_NR_readahead
11961     case TARGET_NR_readahead:
11962 #if TARGET_ABI_BITS == 32
11963         if (regpairs_aligned(cpu_env, num)) {
11964             arg2 = arg3;
11965             arg3 = arg4;
11966             arg4 = arg5;
11967         }
11968         ret = get_errno(readahead(arg1, target_offset64(arg2, arg3) , arg4));
11969 #else
11970         ret = get_errno(readahead(arg1, arg2, arg3));
11971 #endif
11972         return ret;
11973 #endif
11974 #ifdef CONFIG_ATTR
11975 #ifdef TARGET_NR_setxattr
11976     case TARGET_NR_listxattr:
11977     case TARGET_NR_llistxattr:
11978     {
11979         void *p, *b = 0;
11980         if (arg2) {
11981             b = lock_user(VERIFY_WRITE, arg2, arg3, 0);
11982             if (!b) {
11983                 return -TARGET_EFAULT;
11984             }
11985         }
11986         p = lock_user_string(arg1);
11987         if (p) {
11988             if (num == TARGET_NR_listxattr) {
11989                 ret = get_errno(listxattr(p, b, arg3));
11990             } else {
11991                 ret = get_errno(llistxattr(p, b, arg3));
11992             }
11993         } else {
11994             ret = -TARGET_EFAULT;
11995         }
11996         unlock_user(p, arg1, 0);
11997         unlock_user(b, arg2, arg3);
11998         return ret;
11999     }
12000     case TARGET_NR_flistxattr:
12001     {
12002         void *b = 0;
12003         if (arg2) {
12004             b = lock_user(VERIFY_WRITE, arg2, arg3, 0);
12005             if (!b) {
12006                 return -TARGET_EFAULT;
12007             }
12008         }
12009         ret = get_errno(flistxattr(arg1, b, arg3));
12010         unlock_user(b, arg2, arg3);
12011         return ret;
12012     }
12013     case TARGET_NR_setxattr:
12014     case TARGET_NR_lsetxattr:
12015         {
12016             void *p, *n, *v = 0;
12017             if (arg3) {
12018                 v = lock_user(VERIFY_READ, arg3, arg4, 1);
12019                 if (!v) {
12020                     return -TARGET_EFAULT;
12021                 }
12022             }
12023             p = lock_user_string(arg1);
12024             n = lock_user_string(arg2);
12025             if (p && n) {
12026                 if (num == TARGET_NR_setxattr) {
12027                     ret = get_errno(setxattr(p, n, v, arg4, arg5));
12028                 } else {
12029                     ret = get_errno(lsetxattr(p, n, v, arg4, arg5));
12030                 }
12031             } else {
12032                 ret = -TARGET_EFAULT;
12033             }
12034             unlock_user(p, arg1, 0);
12035             unlock_user(n, arg2, 0);
12036             unlock_user(v, arg3, 0);
12037         }
12038         return ret;
12039     case TARGET_NR_fsetxattr:
12040         {
12041             void *n, *v = 0;
12042             if (arg3) {
12043                 v = lock_user(VERIFY_READ, arg3, arg4, 1);
12044                 if (!v) {
12045                     return -TARGET_EFAULT;
12046                 }
12047             }
12048             n = lock_user_string(arg2);
12049             if (n) {
12050                 ret = get_errno(fsetxattr(arg1, n, v, arg4, arg5));
12051             } else {
12052                 ret = -TARGET_EFAULT;
12053             }
12054             unlock_user(n, arg2, 0);
12055             unlock_user(v, arg3, 0);
12056         }
12057         return ret;
12058     case TARGET_NR_getxattr:
12059     case TARGET_NR_lgetxattr:
12060         {
12061             void *p, *n, *v = 0;
12062             if (arg3) {
12063                 v = lock_user(VERIFY_WRITE, arg3, arg4, 0);
12064                 if (!v) {
12065                     return -TARGET_EFAULT;
12066                 }
12067             }
12068             p = lock_user_string(arg1);
12069             n = lock_user_string(arg2);
12070             if (p && n) {
12071                 if (num == TARGET_NR_getxattr) {
12072                     ret = get_errno(getxattr(p, n, v, arg4));
12073                 } else {
12074                     ret = get_errno(lgetxattr(p, n, v, arg4));
12075                 }
12076             } else {
12077                 ret = -TARGET_EFAULT;
12078             }
12079             unlock_user(p, arg1, 0);
12080             unlock_user(n, arg2, 0);
12081             unlock_user(v, arg3, arg4);
12082         }
12083         return ret;
12084     case TARGET_NR_fgetxattr:
12085         {
12086             void *n, *v = 0;
12087             if (arg3) {
12088                 v = lock_user(VERIFY_WRITE, arg3, arg4, 0);
12089                 if (!v) {
12090                     return -TARGET_EFAULT;
12091                 }
12092             }
12093             n = lock_user_string(arg2);
12094             if (n) {
12095                 ret = get_errno(fgetxattr(arg1, n, v, arg4));
12096             } else {
12097                 ret = -TARGET_EFAULT;
12098             }
12099             unlock_user(n, arg2, 0);
12100             unlock_user(v, arg3, arg4);
12101         }
12102         return ret;
12103     case TARGET_NR_removexattr:
12104     case TARGET_NR_lremovexattr:
12105         {
12106             void *p, *n;
12107             p = lock_user_string(arg1);
12108             n = lock_user_string(arg2);
12109             if (p && n) {
12110                 if (num == TARGET_NR_removexattr) {
12111                     ret = get_errno(removexattr(p, n));
12112                 } else {
12113                     ret = get_errno(lremovexattr(p, n));
12114                 }
12115             } else {
12116                 ret = -TARGET_EFAULT;
12117             }
12118             unlock_user(p, arg1, 0);
12119             unlock_user(n, arg2, 0);
12120         }
12121         return ret;
12122     case TARGET_NR_fremovexattr:
12123         {
12124             void *n;
12125             n = lock_user_string(arg2);
12126             if (n) {
12127                 ret = get_errno(fremovexattr(arg1, n));
12128             } else {
12129                 ret = -TARGET_EFAULT;
12130             }
12131             unlock_user(n, arg2, 0);
12132         }
12133         return ret;
12134 #endif
12135 #endif /* CONFIG_ATTR */
12136 #ifdef TARGET_NR_set_thread_area
12137     case TARGET_NR_set_thread_area:
12138 #if defined(TARGET_MIPS)
12139       ((CPUMIPSState *) cpu_env)->active_tc.CP0_UserLocal = arg1;
12140       return 0;
12141 #elif defined(TARGET_CRIS)
12142       if (arg1 & 0xff)
12143           ret = -TARGET_EINVAL;
12144       else {
12145           ((CPUCRISState *) cpu_env)->pregs[PR_PID] = arg1;
12146           ret = 0;
12147       }
12148       return ret;
12149 #elif defined(TARGET_I386) && defined(TARGET_ABI32)
12150       return do_set_thread_area(cpu_env, arg1);
12151 #elif defined(TARGET_M68K)
12152       {
12153           TaskState *ts = cpu->opaque;
12154           ts->tp_value = arg1;
12155           return 0;
12156       }
12157 #else
12158       return -TARGET_ENOSYS;
12159 #endif
12160 #endif
12161 #ifdef TARGET_NR_get_thread_area
12162     case TARGET_NR_get_thread_area:
12163 #if defined(TARGET_I386) && defined(TARGET_ABI32)
12164         return do_get_thread_area(cpu_env, arg1);
12165 #elif defined(TARGET_M68K)
12166         {
12167             TaskState *ts = cpu->opaque;
12168             return ts->tp_value;
12169         }
12170 #else
12171         return -TARGET_ENOSYS;
12172 #endif
12173 #endif
12174 #ifdef TARGET_NR_getdomainname
12175     case TARGET_NR_getdomainname:
12176         return -TARGET_ENOSYS;
12177 #endif
12178 
12179 #ifdef TARGET_NR_clock_settime
12180     case TARGET_NR_clock_settime:
12181     {
12182         struct timespec ts;
12183 
12184         ret = target_to_host_timespec(&ts, arg2);
12185         if (!is_error(ret)) {
12186             ret = get_errno(clock_settime(arg1, &ts));
12187         }
12188         return ret;
12189     }
12190 #endif
12191 #ifdef TARGET_NR_clock_settime64
12192     case TARGET_NR_clock_settime64:
12193     {
12194         struct timespec ts;
12195 
12196         ret = target_to_host_timespec64(&ts, arg2);
12197         if (!is_error(ret)) {
12198             ret = get_errno(clock_settime(arg1, &ts));
12199         }
12200         return ret;
12201     }
12202 #endif
12203 #ifdef TARGET_NR_clock_gettime
12204     case TARGET_NR_clock_gettime:
12205     {
12206         struct timespec ts;
12207         ret = get_errno(clock_gettime(arg1, &ts));
12208         if (!is_error(ret)) {
12209             ret = host_to_target_timespec(arg2, &ts);
12210         }
12211         return ret;
12212     }
12213 #endif
12214 #ifdef TARGET_NR_clock_gettime64
12215     case TARGET_NR_clock_gettime64:
12216     {
12217         struct timespec ts;
12218         ret = get_errno(clock_gettime(arg1, &ts));
12219         if (!is_error(ret)) {
12220             ret = host_to_target_timespec64(arg2, &ts);
12221         }
12222         return ret;
12223     }
12224 #endif
12225 #ifdef TARGET_NR_clock_getres
12226     case TARGET_NR_clock_getres:
12227     {
12228         struct timespec ts;
12229         ret = get_errno(clock_getres(arg1, &ts));
12230         if (!is_error(ret)) {
12231             host_to_target_timespec(arg2, &ts);
12232         }
12233         return ret;
12234     }
12235 #endif
12236 #ifdef TARGET_NR_clock_getres_time64
12237     case TARGET_NR_clock_getres_time64:
12238     {
12239         struct timespec ts;
12240         ret = get_errno(clock_getres(arg1, &ts));
12241         if (!is_error(ret)) {
12242             host_to_target_timespec64(arg2, &ts);
12243         }
12244         return ret;
12245     }
12246 #endif
12247 #ifdef TARGET_NR_clock_nanosleep
12248     case TARGET_NR_clock_nanosleep:
12249     {
12250         struct timespec ts;
12251         if (target_to_host_timespec(&ts, arg3)) {
12252             return -TARGET_EFAULT;
12253         }
12254         ret = get_errno(safe_clock_nanosleep(arg1, arg2,
12255                                              &ts, arg4 ? &ts : NULL));
12256         /*
12257          * if the call is interrupted by a signal handler, it fails
12258          * with error -TARGET_EINTR and if arg4 is not NULL and arg2 is not
12259          * TIMER_ABSTIME, it returns the remaining unslept time in arg4.
12260          */
12261         if (ret == -TARGET_EINTR && arg4 && arg2 != TIMER_ABSTIME &&
12262             host_to_target_timespec(arg4, &ts)) {
12263               return -TARGET_EFAULT;
12264         }
12265 
12266         return ret;
12267     }
12268 #endif
12269 #ifdef TARGET_NR_clock_nanosleep_time64
12270     case TARGET_NR_clock_nanosleep_time64:
12271     {
12272         struct timespec ts;
12273 
12274         if (target_to_host_timespec64(&ts, arg3)) {
12275             return -TARGET_EFAULT;
12276         }
12277 
12278         ret = get_errno(safe_clock_nanosleep(arg1, arg2,
12279                                              &ts, arg4 ? &ts : NULL));
12280 
12281         if (ret == -TARGET_EINTR && arg4 && arg2 != TIMER_ABSTIME &&
12282             host_to_target_timespec64(arg4, &ts)) {
12283             return -TARGET_EFAULT;
12284         }
12285         return ret;
12286     }
12287 #endif
12288 
12289 #if defined(TARGET_NR_set_tid_address) && defined(__NR_set_tid_address)
12290     case TARGET_NR_set_tid_address:
12291         return get_errno(set_tid_address((int *)g2h(cpu, arg1)));
12292 #endif
12293 
12294     case TARGET_NR_tkill:
12295         return get_errno(safe_tkill((int)arg1, target_to_host_signal(arg2)));
12296 
12297     case TARGET_NR_tgkill:
12298         return get_errno(safe_tgkill((int)arg1, (int)arg2,
12299                          target_to_host_signal(arg3)));
12300 
12301 #ifdef TARGET_NR_set_robust_list
12302     case TARGET_NR_set_robust_list:
12303     case TARGET_NR_get_robust_list:
12304         /* The ABI for supporting robust futexes has userspace pass
12305          * the kernel a pointer to a linked list which is updated by
12306          * userspace after the syscall; the list is walked by the kernel
12307          * when the thread exits. Since the linked list in QEMU guest
12308          * memory isn't a valid linked list for the host and we have
12309          * no way to reliably intercept the thread-death event, we can't
12310          * support these. Silently return ENOSYS so that guest userspace
12311          * falls back to a non-robust futex implementation (which should
12312          * be OK except in the corner case of the guest crashing while
12313          * holding a mutex that is shared with another process via
12314          * shared memory).
12315          */
12316         return -TARGET_ENOSYS;
12317 #endif
12318 
12319 #if defined(TARGET_NR_utimensat)
12320     case TARGET_NR_utimensat:
12321         {
12322             struct timespec *tsp, ts[2];
12323             if (!arg3) {
12324                 tsp = NULL;
12325             } else {
12326                 if (target_to_host_timespec(ts, arg3)) {
12327                     return -TARGET_EFAULT;
12328                 }
12329                 if (target_to_host_timespec(ts + 1, arg3 +
12330                                             sizeof(struct target_timespec))) {
12331                     return -TARGET_EFAULT;
12332                 }
12333                 tsp = ts;
12334             }
12335             if (!arg2)
12336                 ret = get_errno(sys_utimensat(arg1, NULL, tsp, arg4));
12337             else {
12338                 if (!(p = lock_user_string(arg2))) {
12339                     return -TARGET_EFAULT;
12340                 }
12341                 ret = get_errno(sys_utimensat(arg1, path(p), tsp, arg4));
12342                 unlock_user(p, arg2, 0);
12343             }
12344         }
12345         return ret;
12346 #endif
12347 #ifdef TARGET_NR_utimensat_time64
12348     case TARGET_NR_utimensat_time64:
12349         {
12350             struct timespec *tsp, ts[2];
12351             if (!arg3) {
12352                 tsp = NULL;
12353             } else {
12354                 if (target_to_host_timespec64(ts, arg3)) {
12355                     return -TARGET_EFAULT;
12356                 }
12357                 if (target_to_host_timespec64(ts + 1, arg3 +
12358                                      sizeof(struct target__kernel_timespec))) {
12359                     return -TARGET_EFAULT;
12360                 }
12361                 tsp = ts;
12362             }
12363             if (!arg2)
12364                 ret = get_errno(sys_utimensat(arg1, NULL, tsp, arg4));
12365             else {
12366                 p = lock_user_string(arg2);
12367                 if (!p) {
12368                     return -TARGET_EFAULT;
12369                 }
12370                 ret = get_errno(sys_utimensat(arg1, path(p), tsp, arg4));
12371                 unlock_user(p, arg2, 0);
12372             }
12373         }
12374         return ret;
12375 #endif
12376 #ifdef TARGET_NR_futex
12377     case TARGET_NR_futex:
12378         return do_futex(cpu, arg1, arg2, arg3, arg4, arg5, arg6);
12379 #endif
12380 #ifdef TARGET_NR_futex_time64
12381     case TARGET_NR_futex_time64:
12382         return do_futex_time64(cpu, arg1, arg2, arg3, arg4, arg5, arg6);
12383 #endif
12384 #if defined(TARGET_NR_inotify_init) && defined(__NR_inotify_init)
12385     case TARGET_NR_inotify_init:
12386         ret = get_errno(sys_inotify_init());
12387         if (ret >= 0) {
12388             fd_trans_register(ret, &target_inotify_trans);
12389         }
12390         return ret;
12391 #endif
12392 #ifdef CONFIG_INOTIFY1
12393 #if defined(TARGET_NR_inotify_init1) && defined(__NR_inotify_init1)
12394     case TARGET_NR_inotify_init1:
12395         ret = get_errno(sys_inotify_init1(target_to_host_bitmask(arg1,
12396                                           fcntl_flags_tbl)));
12397         if (ret >= 0) {
12398             fd_trans_register(ret, &target_inotify_trans);
12399         }
12400         return ret;
12401 #endif
12402 #endif
12403 #if defined(TARGET_NR_inotify_add_watch) && defined(__NR_inotify_add_watch)
12404     case TARGET_NR_inotify_add_watch:
12405         p = lock_user_string(arg2);
12406         ret = get_errno(sys_inotify_add_watch(arg1, path(p), arg3));
12407         unlock_user(p, arg2, 0);
12408         return ret;
12409 #endif
12410 #if defined(TARGET_NR_inotify_rm_watch) && defined(__NR_inotify_rm_watch)
12411     case TARGET_NR_inotify_rm_watch:
12412         return get_errno(sys_inotify_rm_watch(arg1, arg2));
12413 #endif
12414 
12415 #if defined(TARGET_NR_mq_open) && defined(__NR_mq_open)
12416     case TARGET_NR_mq_open:
12417         {
12418             struct mq_attr posix_mq_attr;
12419             struct mq_attr *pposix_mq_attr;
12420             int host_flags;
12421 
12422             host_flags = target_to_host_bitmask(arg2, fcntl_flags_tbl);
12423             pposix_mq_attr = NULL;
12424             if (arg4) {
12425                 if (copy_from_user_mq_attr(&posix_mq_attr, arg4) != 0) {
12426                     return -TARGET_EFAULT;
12427                 }
12428                 pposix_mq_attr = &posix_mq_attr;
12429             }
12430             p = lock_user_string(arg1 - 1);
12431             if (!p) {
12432                 return -TARGET_EFAULT;
12433             }
12434             ret = get_errno(mq_open(p, host_flags, arg3, pposix_mq_attr));
12435             unlock_user (p, arg1, 0);
12436         }
12437         return ret;
12438 
12439     case TARGET_NR_mq_unlink:
12440         p = lock_user_string(arg1 - 1);
12441         if (!p) {
12442             return -TARGET_EFAULT;
12443         }
12444         ret = get_errno(mq_unlink(p));
12445         unlock_user (p, arg1, 0);
12446         return ret;
12447 
12448 #ifdef TARGET_NR_mq_timedsend
12449     case TARGET_NR_mq_timedsend:
12450         {
12451             struct timespec ts;
12452 
12453             p = lock_user (VERIFY_READ, arg2, arg3, 1);
12454             if (arg5 != 0) {
12455                 if (target_to_host_timespec(&ts, arg5)) {
12456                     return -TARGET_EFAULT;
12457                 }
12458                 ret = get_errno(safe_mq_timedsend(arg1, p, arg3, arg4, &ts));
12459                 if (!is_error(ret) && host_to_target_timespec(arg5, &ts)) {
12460                     return -TARGET_EFAULT;
12461                 }
12462             } else {
12463                 ret = get_errno(safe_mq_timedsend(arg1, p, arg3, arg4, NULL));
12464             }
12465             unlock_user (p, arg2, arg3);
12466         }
12467         return ret;
12468 #endif
12469 #ifdef TARGET_NR_mq_timedsend_time64
12470     case TARGET_NR_mq_timedsend_time64:
12471         {
12472             struct timespec ts;
12473 
12474             p = lock_user(VERIFY_READ, arg2, arg3, 1);
12475             if (arg5 != 0) {
12476                 if (target_to_host_timespec64(&ts, arg5)) {
12477                     return -TARGET_EFAULT;
12478                 }
12479                 ret = get_errno(safe_mq_timedsend(arg1, p, arg3, arg4, &ts));
12480                 if (!is_error(ret) && host_to_target_timespec64(arg5, &ts)) {
12481                     return -TARGET_EFAULT;
12482                 }
12483             } else {
12484                 ret = get_errno(safe_mq_timedsend(arg1, p, arg3, arg4, NULL));
12485             }
12486             unlock_user(p, arg2, arg3);
12487         }
12488         return ret;
12489 #endif
12490 
12491 #ifdef TARGET_NR_mq_timedreceive
12492     case TARGET_NR_mq_timedreceive:
12493         {
12494             struct timespec ts;
12495             unsigned int prio;
12496 
12497             p = lock_user (VERIFY_READ, arg2, arg3, 1);
12498             if (arg5 != 0) {
12499                 if (target_to_host_timespec(&ts, arg5)) {
12500                     return -TARGET_EFAULT;
12501                 }
12502                 ret = get_errno(safe_mq_timedreceive(arg1, p, arg3,
12503                                                      &prio, &ts));
12504                 if (!is_error(ret) && host_to_target_timespec(arg5, &ts)) {
12505                     return -TARGET_EFAULT;
12506                 }
12507             } else {
12508                 ret = get_errno(safe_mq_timedreceive(arg1, p, arg3,
12509                                                      &prio, NULL));
12510             }
12511             unlock_user (p, arg2, arg3);
12512             if (arg4 != 0)
12513                 put_user_u32(prio, arg4);
12514         }
12515         return ret;
12516 #endif
12517 #ifdef TARGET_NR_mq_timedreceive_time64
12518     case TARGET_NR_mq_timedreceive_time64:
12519         {
12520             struct timespec ts;
12521             unsigned int prio;
12522 
12523             p = lock_user(VERIFY_READ, arg2, arg3, 1);
12524             if (arg5 != 0) {
12525                 if (target_to_host_timespec64(&ts, arg5)) {
12526                     return -TARGET_EFAULT;
12527                 }
12528                 ret = get_errno(safe_mq_timedreceive(arg1, p, arg3,
12529                                                      &prio, &ts));
12530                 if (!is_error(ret) && host_to_target_timespec64(arg5, &ts)) {
12531                     return -TARGET_EFAULT;
12532                 }
12533             } else {
12534                 ret = get_errno(safe_mq_timedreceive(arg1, p, arg3,
12535                                                      &prio, NULL));
12536             }
12537             unlock_user(p, arg2, arg3);
12538             if (arg4 != 0) {
12539                 put_user_u32(prio, arg4);
12540             }
12541         }
12542         return ret;
12543 #endif
12544 
12545     /* Not implemented for now... */
12546 /*     case TARGET_NR_mq_notify: */
12547 /*         break; */
12548 
12549     case TARGET_NR_mq_getsetattr:
12550         {
12551             struct mq_attr posix_mq_attr_in, posix_mq_attr_out;
12552             ret = 0;
12553             if (arg2 != 0) {
12554                 copy_from_user_mq_attr(&posix_mq_attr_in, arg2);
12555                 ret = get_errno(mq_setattr(arg1, &posix_mq_attr_in,
12556                                            &posix_mq_attr_out));
12557             } else if (arg3 != 0) {
12558                 ret = get_errno(mq_getattr(arg1, &posix_mq_attr_out));
12559             }
12560             if (ret == 0 && arg3 != 0) {
12561                 copy_to_user_mq_attr(arg3, &posix_mq_attr_out);
12562             }
12563         }
12564         return ret;
12565 #endif
12566 
12567 #ifdef CONFIG_SPLICE
12568 #ifdef TARGET_NR_tee
12569     case TARGET_NR_tee:
12570         {
12571             ret = get_errno(tee(arg1,arg2,arg3,arg4));
12572         }
12573         return ret;
12574 #endif
12575 #ifdef TARGET_NR_splice
12576     case TARGET_NR_splice:
12577         {
12578             loff_t loff_in, loff_out;
12579             loff_t *ploff_in = NULL, *ploff_out = NULL;
12580             if (arg2) {
12581                 if (get_user_u64(loff_in, arg2)) {
12582                     return -TARGET_EFAULT;
12583                 }
12584                 ploff_in = &loff_in;
12585             }
12586             if (arg4) {
12587                 if (get_user_u64(loff_out, arg4)) {
12588                     return -TARGET_EFAULT;
12589                 }
12590                 ploff_out = &loff_out;
12591             }
12592             ret = get_errno(splice(arg1, ploff_in, arg3, ploff_out, arg5, arg6));
12593             if (arg2) {
12594                 if (put_user_u64(loff_in, arg2)) {
12595                     return -TARGET_EFAULT;
12596                 }
12597             }
12598             if (arg4) {
12599                 if (put_user_u64(loff_out, arg4)) {
12600                     return -TARGET_EFAULT;
12601                 }
12602             }
12603         }
12604         return ret;
12605 #endif
12606 #ifdef TARGET_NR_vmsplice
12607 	case TARGET_NR_vmsplice:
12608         {
12609             struct iovec *vec = lock_iovec(VERIFY_READ, arg2, arg3, 1);
12610             if (vec != NULL) {
12611                 ret = get_errno(vmsplice(arg1, vec, arg3, arg4));
12612                 unlock_iovec(vec, arg2, arg3, 0);
12613             } else {
12614                 ret = -host_to_target_errno(errno);
12615             }
12616         }
12617         return ret;
12618 #endif
12619 #endif /* CONFIG_SPLICE */
12620 #ifdef CONFIG_EVENTFD
12621 #if defined(TARGET_NR_eventfd)
12622     case TARGET_NR_eventfd:
12623         ret = get_errno(eventfd(arg1, 0));
12624         if (ret >= 0) {
12625             fd_trans_register(ret, &target_eventfd_trans);
12626         }
12627         return ret;
12628 #endif
12629 #if defined(TARGET_NR_eventfd2)
12630     case TARGET_NR_eventfd2:
12631     {
12632         int host_flags = arg2 & (~(TARGET_O_NONBLOCK_MASK | TARGET_O_CLOEXEC));
12633         if (arg2 & TARGET_O_NONBLOCK) {
12634             host_flags |= O_NONBLOCK;
12635         }
12636         if (arg2 & TARGET_O_CLOEXEC) {
12637             host_flags |= O_CLOEXEC;
12638         }
12639         ret = get_errno(eventfd(arg1, host_flags));
12640         if (ret >= 0) {
12641             fd_trans_register(ret, &target_eventfd_trans);
12642         }
12643         return ret;
12644     }
12645 #endif
12646 #endif /* CONFIG_EVENTFD  */
12647 #if defined(CONFIG_FALLOCATE) && defined(TARGET_NR_fallocate)
12648     case TARGET_NR_fallocate:
12649 #if TARGET_ABI_BITS == 32
12650         ret = get_errno(fallocate(arg1, arg2, target_offset64(arg3, arg4),
12651                                   target_offset64(arg5, arg6)));
12652 #else
12653         ret = get_errno(fallocate(arg1, arg2, arg3, arg4));
12654 #endif
12655         return ret;
12656 #endif
12657 #if defined(CONFIG_SYNC_FILE_RANGE)
12658 #if defined(TARGET_NR_sync_file_range)
12659     case TARGET_NR_sync_file_range:
12660 #if TARGET_ABI_BITS == 32
12661 #if defined(TARGET_MIPS)
12662         ret = get_errno(sync_file_range(arg1, target_offset64(arg3, arg4),
12663                                         target_offset64(arg5, arg6), arg7));
12664 #else
12665         ret = get_errno(sync_file_range(arg1, target_offset64(arg2, arg3),
12666                                         target_offset64(arg4, arg5), arg6));
12667 #endif /* !TARGET_MIPS */
12668 #else
12669         ret = get_errno(sync_file_range(arg1, arg2, arg3, arg4));
12670 #endif
12671         return ret;
12672 #endif
12673 #if defined(TARGET_NR_sync_file_range2) || \
12674     defined(TARGET_NR_arm_sync_file_range)
12675 #if defined(TARGET_NR_sync_file_range2)
12676     case TARGET_NR_sync_file_range2:
12677 #endif
12678 #if defined(TARGET_NR_arm_sync_file_range)
12679     case TARGET_NR_arm_sync_file_range:
12680 #endif
12681         /* This is like sync_file_range but the arguments are reordered */
12682 #if TARGET_ABI_BITS == 32
12683         ret = get_errno(sync_file_range(arg1, target_offset64(arg3, arg4),
12684                                         target_offset64(arg5, arg6), arg2));
12685 #else
12686         ret = get_errno(sync_file_range(arg1, arg3, arg4, arg2));
12687 #endif
12688         return ret;
12689 #endif
12690 #endif
12691 #if defined(TARGET_NR_signalfd4)
12692     case TARGET_NR_signalfd4:
12693         return do_signalfd4(arg1, arg2, arg4);
12694 #endif
12695 #if defined(TARGET_NR_signalfd)
12696     case TARGET_NR_signalfd:
12697         return do_signalfd4(arg1, arg2, 0);
12698 #endif
12699 #if defined(CONFIG_EPOLL)
12700 #if defined(TARGET_NR_epoll_create)
12701     case TARGET_NR_epoll_create:
12702         return get_errno(epoll_create(arg1));
12703 #endif
12704 #if defined(TARGET_NR_epoll_create1) && defined(CONFIG_EPOLL_CREATE1)
12705     case TARGET_NR_epoll_create1:
12706         return get_errno(epoll_create1(target_to_host_bitmask(arg1, fcntl_flags_tbl)));
12707 #endif
12708 #if defined(TARGET_NR_epoll_ctl)
12709     case TARGET_NR_epoll_ctl:
12710     {
12711         struct epoll_event ep;
12712         struct epoll_event *epp = 0;
12713         if (arg4) {
12714             if (arg2 != EPOLL_CTL_DEL) {
12715                 struct target_epoll_event *target_ep;
12716                 if (!lock_user_struct(VERIFY_READ, target_ep, arg4, 1)) {
12717                     return -TARGET_EFAULT;
12718                 }
12719                 ep.events = tswap32(target_ep->events);
12720                 /*
12721                  * The epoll_data_t union is just opaque data to the kernel,
12722                  * so we transfer all 64 bits across and need not worry what
12723                  * actual data type it is.
12724                  */
12725                 ep.data.u64 = tswap64(target_ep->data.u64);
12726                 unlock_user_struct(target_ep, arg4, 0);
12727             }
12728             /*
12729              * before kernel 2.6.9, EPOLL_CTL_DEL operation required a
12730              * non-null pointer, even though this argument is ignored.
12731              *
12732              */
12733             epp = &ep;
12734         }
12735         return get_errno(epoll_ctl(arg1, arg2, arg3, epp));
12736     }
12737 #endif
12738 
12739 #if defined(TARGET_NR_epoll_wait) || defined(TARGET_NR_epoll_pwait)
12740 #if defined(TARGET_NR_epoll_wait)
12741     case TARGET_NR_epoll_wait:
12742 #endif
12743 #if defined(TARGET_NR_epoll_pwait)
12744     case TARGET_NR_epoll_pwait:
12745 #endif
12746     {
12747         struct target_epoll_event *target_ep;
12748         struct epoll_event *ep;
12749         int epfd = arg1;
12750         int maxevents = arg3;
12751         int timeout = arg4;
12752 
12753         if (maxevents <= 0 || maxevents > TARGET_EP_MAX_EVENTS) {
12754             return -TARGET_EINVAL;
12755         }
12756 
12757         target_ep = lock_user(VERIFY_WRITE, arg2,
12758                               maxevents * sizeof(struct target_epoll_event), 1);
12759         if (!target_ep) {
12760             return -TARGET_EFAULT;
12761         }
12762 
12763         ep = g_try_new(struct epoll_event, maxevents);
12764         if (!ep) {
12765             unlock_user(target_ep, arg2, 0);
12766             return -TARGET_ENOMEM;
12767         }
12768 
12769         switch (num) {
12770 #if defined(TARGET_NR_epoll_pwait)
12771         case TARGET_NR_epoll_pwait:
12772         {
12773             target_sigset_t *target_set;
12774             sigset_t _set, *set = &_set;
12775 
12776             if (arg5) {
12777                 if (arg6 != sizeof(target_sigset_t)) {
12778                     ret = -TARGET_EINVAL;
12779                     break;
12780                 }
12781 
12782                 target_set = lock_user(VERIFY_READ, arg5,
12783                                        sizeof(target_sigset_t), 1);
12784                 if (!target_set) {
12785                     ret = -TARGET_EFAULT;
12786                     break;
12787                 }
12788                 target_to_host_sigset(set, target_set);
12789                 unlock_user(target_set, arg5, 0);
12790             } else {
12791                 set = NULL;
12792             }
12793 
12794             ret = get_errno(safe_epoll_pwait(epfd, ep, maxevents, timeout,
12795                                              set, SIGSET_T_SIZE));
12796             break;
12797         }
12798 #endif
12799 #if defined(TARGET_NR_epoll_wait)
12800         case TARGET_NR_epoll_wait:
12801             ret = get_errno(safe_epoll_pwait(epfd, ep, maxevents, timeout,
12802                                              NULL, 0));
12803             break;
12804 #endif
12805         default:
12806             ret = -TARGET_ENOSYS;
12807         }
12808         if (!is_error(ret)) {
12809             int i;
12810             for (i = 0; i < ret; i++) {
12811                 target_ep[i].events = tswap32(ep[i].events);
12812                 target_ep[i].data.u64 = tswap64(ep[i].data.u64);
12813             }
12814             unlock_user(target_ep, arg2,
12815                         ret * sizeof(struct target_epoll_event));
12816         } else {
12817             unlock_user(target_ep, arg2, 0);
12818         }
12819         g_free(ep);
12820         return ret;
12821     }
12822 #endif
12823 #endif
12824 #ifdef TARGET_NR_prlimit64
12825     case TARGET_NR_prlimit64:
12826     {
12827         /* args: pid, resource number, ptr to new rlimit, ptr to old rlimit */
12828         struct target_rlimit64 *target_rnew, *target_rold;
12829         struct host_rlimit64 rnew, rold, *rnewp = 0;
12830         int resource = target_to_host_resource(arg2);
12831 
12832         if (arg3 && (resource != RLIMIT_AS &&
12833                      resource != RLIMIT_DATA &&
12834                      resource != RLIMIT_STACK)) {
12835             if (!lock_user_struct(VERIFY_READ, target_rnew, arg3, 1)) {
12836                 return -TARGET_EFAULT;
12837             }
12838             rnew.rlim_cur = tswap64(target_rnew->rlim_cur);
12839             rnew.rlim_max = tswap64(target_rnew->rlim_max);
12840             unlock_user_struct(target_rnew, arg3, 0);
12841             rnewp = &rnew;
12842         }
12843 
12844         ret = get_errno(sys_prlimit64(arg1, resource, rnewp, arg4 ? &rold : 0));
12845         if (!is_error(ret) && arg4) {
12846             if (!lock_user_struct(VERIFY_WRITE, target_rold, arg4, 1)) {
12847                 return -TARGET_EFAULT;
12848             }
12849             target_rold->rlim_cur = tswap64(rold.rlim_cur);
12850             target_rold->rlim_max = tswap64(rold.rlim_max);
12851             unlock_user_struct(target_rold, arg4, 1);
12852         }
12853         return ret;
12854     }
12855 #endif
12856 #ifdef TARGET_NR_gethostname
12857     case TARGET_NR_gethostname:
12858     {
12859         char *name = lock_user(VERIFY_WRITE, arg1, arg2, 0);
12860         if (name) {
12861             ret = get_errno(gethostname(name, arg2));
12862             unlock_user(name, arg1, arg2);
12863         } else {
12864             ret = -TARGET_EFAULT;
12865         }
12866         return ret;
12867     }
12868 #endif
12869 #ifdef TARGET_NR_atomic_cmpxchg_32
12870     case TARGET_NR_atomic_cmpxchg_32:
12871     {
12872         /* should use start_exclusive from main.c */
12873         abi_ulong mem_value;
12874         if (get_user_u32(mem_value, arg6)) {
12875             target_siginfo_t info;
12876             info.si_signo = SIGSEGV;
12877             info.si_errno = 0;
12878             info.si_code = TARGET_SEGV_MAPERR;
12879             info._sifields._sigfault._addr = arg6;
12880             queue_signal((CPUArchState *)cpu_env, info.si_signo,
12881                          QEMU_SI_FAULT, &info);
12882             ret = 0xdeadbeef;
12883 
12884         }
12885         if (mem_value == arg2)
12886             put_user_u32(arg1, arg6);
12887         return mem_value;
12888     }
12889 #endif
12890 #ifdef TARGET_NR_atomic_barrier
12891     case TARGET_NR_atomic_barrier:
12892         /* Like the kernel implementation and the
12893            qemu arm barrier, no-op this? */
12894         return 0;
12895 #endif
12896 
12897 #ifdef TARGET_NR_timer_create
12898     case TARGET_NR_timer_create:
12899     {
12900         /* args: clockid_t clockid, struct sigevent *sevp, timer_t *timerid */
12901 
12902         struct sigevent host_sevp = { {0}, }, *phost_sevp = NULL;
12903 
12904         int clkid = arg1;
12905         int timer_index = next_free_host_timer();
12906 
12907         if (timer_index < 0) {
12908             ret = -TARGET_EAGAIN;
12909         } else {
12910             timer_t *phtimer = g_posix_timers  + timer_index;
12911 
12912             if (arg2) {
12913                 phost_sevp = &host_sevp;
12914                 ret = target_to_host_sigevent(phost_sevp, arg2);
12915                 if (ret != 0) {
12916                     return ret;
12917                 }
12918             }
12919 
12920             ret = get_errno(timer_create(clkid, phost_sevp, phtimer));
12921             if (ret) {
12922                 phtimer = NULL;
12923             } else {
12924                 if (put_user(TIMER_MAGIC | timer_index, arg3, target_timer_t)) {
12925                     return -TARGET_EFAULT;
12926                 }
12927             }
12928         }
12929         return ret;
12930     }
12931 #endif
12932 
12933 #ifdef TARGET_NR_timer_settime
12934     case TARGET_NR_timer_settime:
12935     {
12936         /* args: timer_t timerid, int flags, const struct itimerspec *new_value,
12937          * struct itimerspec * old_value */
12938         target_timer_t timerid = get_timer_id(arg1);
12939 
12940         if (timerid < 0) {
12941             ret = timerid;
12942         } else if (arg3 == 0) {
12943             ret = -TARGET_EINVAL;
12944         } else {
12945             timer_t htimer = g_posix_timers[timerid];
12946             struct itimerspec hspec_new = {{0},}, hspec_old = {{0},};
12947 
12948             if (target_to_host_itimerspec(&hspec_new, arg3)) {
12949                 return -TARGET_EFAULT;
12950             }
12951             ret = get_errno(
12952                           timer_settime(htimer, arg2, &hspec_new, &hspec_old));
12953             if (arg4 && host_to_target_itimerspec(arg4, &hspec_old)) {
12954                 return -TARGET_EFAULT;
12955             }
12956         }
12957         return ret;
12958     }
12959 #endif
12960 
12961 #ifdef TARGET_NR_timer_settime64
12962     case TARGET_NR_timer_settime64:
12963     {
12964         target_timer_t timerid = get_timer_id(arg1);
12965 
12966         if (timerid < 0) {
12967             ret = timerid;
12968         } else if (arg3 == 0) {
12969             ret = -TARGET_EINVAL;
12970         } else {
12971             timer_t htimer = g_posix_timers[timerid];
12972             struct itimerspec hspec_new = {{0},}, hspec_old = {{0},};
12973 
12974             if (target_to_host_itimerspec64(&hspec_new, arg3)) {
12975                 return -TARGET_EFAULT;
12976             }
12977             ret = get_errno(
12978                           timer_settime(htimer, arg2, &hspec_new, &hspec_old));
12979             if (arg4 && host_to_target_itimerspec64(arg4, &hspec_old)) {
12980                 return -TARGET_EFAULT;
12981             }
12982         }
12983         return ret;
12984     }
12985 #endif
12986 
12987 #ifdef TARGET_NR_timer_gettime
12988     case TARGET_NR_timer_gettime:
12989     {
12990         /* args: timer_t timerid, struct itimerspec *curr_value */
12991         target_timer_t timerid = get_timer_id(arg1);
12992 
12993         if (timerid < 0) {
12994             ret = timerid;
12995         } else if (!arg2) {
12996             ret = -TARGET_EFAULT;
12997         } else {
12998             timer_t htimer = g_posix_timers[timerid];
12999             struct itimerspec hspec;
13000             ret = get_errno(timer_gettime(htimer, &hspec));
13001 
13002             if (host_to_target_itimerspec(arg2, &hspec)) {
13003                 ret = -TARGET_EFAULT;
13004             }
13005         }
13006         return ret;
13007     }
13008 #endif
13009 
13010 #ifdef TARGET_NR_timer_gettime64
13011     case TARGET_NR_timer_gettime64:
13012     {
13013         /* args: timer_t timerid, struct itimerspec64 *curr_value */
13014         target_timer_t timerid = get_timer_id(arg1);
13015 
13016         if (timerid < 0) {
13017             ret = timerid;
13018         } else if (!arg2) {
13019             ret = -TARGET_EFAULT;
13020         } else {
13021             timer_t htimer = g_posix_timers[timerid];
13022             struct itimerspec hspec;
13023             ret = get_errno(timer_gettime(htimer, &hspec));
13024 
13025             if (host_to_target_itimerspec64(arg2, &hspec)) {
13026                 ret = -TARGET_EFAULT;
13027             }
13028         }
13029         return ret;
13030     }
13031 #endif
13032 
13033 #ifdef TARGET_NR_timer_getoverrun
13034     case TARGET_NR_timer_getoverrun:
13035     {
13036         /* args: timer_t timerid */
13037         target_timer_t timerid = get_timer_id(arg1);
13038 
13039         if (timerid < 0) {
13040             ret = timerid;
13041         } else {
13042             timer_t htimer = g_posix_timers[timerid];
13043             ret = get_errno(timer_getoverrun(htimer));
13044         }
13045         return ret;
13046     }
13047 #endif
13048 
13049 #ifdef TARGET_NR_timer_delete
13050     case TARGET_NR_timer_delete:
13051     {
13052         /* args: timer_t timerid */
13053         target_timer_t timerid = get_timer_id(arg1);
13054 
13055         if (timerid < 0) {
13056             ret = timerid;
13057         } else {
13058             timer_t htimer = g_posix_timers[timerid];
13059             ret = get_errno(timer_delete(htimer));
13060             g_posix_timers[timerid] = 0;
13061         }
13062         return ret;
13063     }
13064 #endif
13065 
13066 #if defined(TARGET_NR_timerfd_create) && defined(CONFIG_TIMERFD)
13067     case TARGET_NR_timerfd_create:
13068         return get_errno(timerfd_create(arg1,
13069                           target_to_host_bitmask(arg2, fcntl_flags_tbl)));
13070 #endif
13071 
13072 #if defined(TARGET_NR_timerfd_gettime) && defined(CONFIG_TIMERFD)
13073     case TARGET_NR_timerfd_gettime:
13074         {
13075             struct itimerspec its_curr;
13076 
13077             ret = get_errno(timerfd_gettime(arg1, &its_curr));
13078 
13079             if (arg2 && host_to_target_itimerspec(arg2, &its_curr)) {
13080                 return -TARGET_EFAULT;
13081             }
13082         }
13083         return ret;
13084 #endif
13085 
13086 #if defined(TARGET_NR_timerfd_gettime64) && defined(CONFIG_TIMERFD)
13087     case TARGET_NR_timerfd_gettime64:
13088         {
13089             struct itimerspec its_curr;
13090 
13091             ret = get_errno(timerfd_gettime(arg1, &its_curr));
13092 
13093             if (arg2 && host_to_target_itimerspec64(arg2, &its_curr)) {
13094                 return -TARGET_EFAULT;
13095             }
13096         }
13097         return ret;
13098 #endif
13099 
13100 #if defined(TARGET_NR_timerfd_settime) && defined(CONFIG_TIMERFD)
13101     case TARGET_NR_timerfd_settime:
13102         {
13103             struct itimerspec its_new, its_old, *p_new;
13104 
13105             if (arg3) {
13106                 if (target_to_host_itimerspec(&its_new, arg3)) {
13107                     return -TARGET_EFAULT;
13108                 }
13109                 p_new = &its_new;
13110             } else {
13111                 p_new = NULL;
13112             }
13113 
13114             ret = get_errno(timerfd_settime(arg1, arg2, p_new, &its_old));
13115 
13116             if (arg4 && host_to_target_itimerspec(arg4, &its_old)) {
13117                 return -TARGET_EFAULT;
13118             }
13119         }
13120         return ret;
13121 #endif
13122 
13123 #if defined(TARGET_NR_timerfd_settime64) && defined(CONFIG_TIMERFD)
13124     case TARGET_NR_timerfd_settime64:
13125         {
13126             struct itimerspec its_new, its_old, *p_new;
13127 
13128             if (arg3) {
13129                 if (target_to_host_itimerspec64(&its_new, arg3)) {
13130                     return -TARGET_EFAULT;
13131                 }
13132                 p_new = &its_new;
13133             } else {
13134                 p_new = NULL;
13135             }
13136 
13137             ret = get_errno(timerfd_settime(arg1, arg2, p_new, &its_old));
13138 
13139             if (arg4 && host_to_target_itimerspec64(arg4, &its_old)) {
13140                 return -TARGET_EFAULT;
13141             }
13142         }
13143         return ret;
13144 #endif
13145 
13146 #if defined(TARGET_NR_ioprio_get) && defined(__NR_ioprio_get)
13147     case TARGET_NR_ioprio_get:
13148         return get_errno(ioprio_get(arg1, arg2));
13149 #endif
13150 
13151 #if defined(TARGET_NR_ioprio_set) && defined(__NR_ioprio_set)
13152     case TARGET_NR_ioprio_set:
13153         return get_errno(ioprio_set(arg1, arg2, arg3));
13154 #endif
13155 
13156 #if defined(TARGET_NR_setns) && defined(CONFIG_SETNS)
13157     case TARGET_NR_setns:
13158         return get_errno(setns(arg1, arg2));
13159 #endif
13160 #if defined(TARGET_NR_unshare) && defined(CONFIG_SETNS)
13161     case TARGET_NR_unshare:
13162         return get_errno(unshare(arg1));
13163 #endif
13164 #if defined(TARGET_NR_kcmp) && defined(__NR_kcmp)
13165     case TARGET_NR_kcmp:
13166         return get_errno(kcmp(arg1, arg2, arg3, arg4, arg5));
13167 #endif
13168 #ifdef TARGET_NR_swapcontext
13169     case TARGET_NR_swapcontext:
13170         /* PowerPC specific.  */
13171         return do_swapcontext(cpu_env, arg1, arg2, arg3);
13172 #endif
13173 #ifdef TARGET_NR_memfd_create
13174     case TARGET_NR_memfd_create:
13175         p = lock_user_string(arg1);
13176         if (!p) {
13177             return -TARGET_EFAULT;
13178         }
13179         ret = get_errno(memfd_create(p, arg2));
13180         fd_trans_unregister(ret);
13181         unlock_user(p, arg1, 0);
13182         return ret;
13183 #endif
13184 #if defined TARGET_NR_membarrier && defined __NR_membarrier
13185     case TARGET_NR_membarrier:
13186         return get_errno(membarrier(arg1, arg2));
13187 #endif
13188 
13189 #if defined(TARGET_NR_copy_file_range) && defined(__NR_copy_file_range)
13190     case TARGET_NR_copy_file_range:
13191         {
13192             loff_t inoff, outoff;
13193             loff_t *pinoff = NULL, *poutoff = NULL;
13194 
13195             if (arg2) {
13196                 if (get_user_u64(inoff, arg2)) {
13197                     return -TARGET_EFAULT;
13198                 }
13199                 pinoff = &inoff;
13200             }
13201             if (arg4) {
13202                 if (get_user_u64(outoff, arg4)) {
13203                     return -TARGET_EFAULT;
13204                 }
13205                 poutoff = &outoff;
13206             }
13207             /* Do not sign-extend the count parameter. */
13208             ret = get_errno(safe_copy_file_range(arg1, pinoff, arg3, poutoff,
13209                                                  (abi_ulong)arg5, arg6));
13210             if (!is_error(ret) && ret > 0) {
13211                 if (arg2) {
13212                     if (put_user_u64(inoff, arg2)) {
13213                         return -TARGET_EFAULT;
13214                     }
13215                 }
13216                 if (arg4) {
13217                     if (put_user_u64(outoff, arg4)) {
13218                         return -TARGET_EFAULT;
13219                     }
13220                 }
13221             }
13222         }
13223         return ret;
13224 #endif
13225 
13226 #if defined(TARGET_NR_pivot_root)
13227     case TARGET_NR_pivot_root:
13228         {
13229             void *p2;
13230             p = lock_user_string(arg1); /* new_root */
13231             p2 = lock_user_string(arg2); /* put_old */
13232             if (!p || !p2) {
13233                 ret = -TARGET_EFAULT;
13234             } else {
13235                 ret = get_errno(pivot_root(p, p2));
13236             }
13237             unlock_user(p2, arg2, 0);
13238             unlock_user(p, arg1, 0);
13239         }
13240         return ret;
13241 #endif
13242 
13243     default:
13244         qemu_log_mask(LOG_UNIMP, "Unsupported syscall: %d\n", num);
13245         return -TARGET_ENOSYS;
13246     }
13247     return ret;
13248 }
13249 
13250 abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
13251                     abi_long arg2, abi_long arg3, abi_long arg4,
13252                     abi_long arg5, abi_long arg6, abi_long arg7,
13253                     abi_long arg8)
13254 {
13255     CPUState *cpu = env_cpu(cpu_env);
13256     abi_long ret;
13257 
13258 #ifdef DEBUG_ERESTARTSYS
13259     /* Debug-only code for exercising the syscall-restart code paths
13260      * in the per-architecture cpu main loops: restart every syscall
13261      * the guest makes once before letting it through.
13262      */
13263     {
13264         static bool flag;
13265         flag = !flag;
13266         if (flag) {
13267             return -TARGET_ERESTARTSYS;
13268         }
13269     }
13270 #endif
13271 
13272     record_syscall_start(cpu, num, arg1,
13273                          arg2, arg3, arg4, arg5, arg6, arg7, arg8);
13274 
13275     if (unlikely(qemu_loglevel_mask(LOG_STRACE))) {
13276         print_syscall(cpu_env, num, arg1, arg2, arg3, arg4, arg5, arg6);
13277     }
13278 
13279     ret = do_syscall1(cpu_env, num, arg1, arg2, arg3, arg4,
13280                       arg5, arg6, arg7, arg8);
13281 
13282     if (unlikely(qemu_loglevel_mask(LOG_STRACE))) {
13283         print_syscall_ret(cpu_env, num, ret, arg1, arg2,
13284                           arg3, arg4, arg5, arg6);
13285     }
13286 
13287     record_syscall_return(cpu, num, ret);
13288     return ret;
13289 }
13290